[linux-block.git] / net / ipv4 / syncookies.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *  Syncookies implementation for the Linux kernel
 *
 *  Copyright (C) 1997 Andi Kleen
 *  Based on ideas by D.J.Bernstein and Eric Schenk.
 */

#include <linux/tcp.h>
#include <linux/siphash.h>
#include <linux/kernel.h>
#include <linux/export.h>
#include <net/secure_seq.h>
#include <net/tcp.h>
#include <net/route.h>

static siphash_aligned_key_t syncookie_secret[2];

#define COOKIEBITS 24	/* Upper bits store count */
#define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)

/* TCP Timestamp: 6 lowest bits of timestamp sent in the cookie SYN-ACK
 * stores TCP options:
 *
 * MSB                               LSB
 * | 31 ...   6 |  5  |  4   | 3 2 1 0 |
 * |  Timestamp | ECN | SACK | WScale  |
 *
 * When we receive a valid cookie-ACK, we look at the echoed tsval (if
 * any) to figure out which TCP options we should use for the rebuilt
 * connection.
 *
 * A WScale setting of '0xf' (which is an invalid scaling value)
 * means that original syn did not include the TCP window scaling option.
 */
#define TS_OPT_WSCALE_MASK	0xf
#define TS_OPT_SACK		BIT(4)
#define TS_OPT_ECN		BIT(5)
/* There is no TS_OPT_TIMESTAMP:
 * if ACK contains timestamp option, we already know it was
 * requested/supported by the syn/synack exchange.
 */
#define TSBITS	6
#define TSMASK	(((__u32)1 << TSBITS) - 1)

static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
		       u32 count, int c)
{
	net_get_random_once(syncookie_secret, sizeof(syncookie_secret));
	return siphash_4u32((__force u32)saddr, (__force u32)daddr,
			    (__force u32)sport << 16 | (__force u32)dport,
			    count, &syncookie_secret[c]);
}


/*
 * when syncookies are in effect and tcp timestamps are enabled we encode
 * tcp options in the lower bits of the timestamp value that will be
 * sent in the syn-ack.
 * Since subsequent timestamps use the normal tcp_time_stamp value, we
 * must make sure that the resulting initial timestamp is <= tcp_time_stamp.
 */
u64 cookie_init_timestamp(struct request_sock *req, u64 now)
{
	struct inet_request_sock *ireq;
	u32 ts, ts_now = tcp_ns_to_ts(now);
	u32 options = 0;

	ireq = inet_rsk(req);

	options = ireq->wscale_ok ? ireq->snd_wscale : TS_OPT_WSCALE_MASK;
	if (ireq->sack_ok)
		options |= TS_OPT_SACK;
	if (ireq->ecn_ok)
		options |= TS_OPT_ECN;

	ts = ts_now & ~TSMASK;
	ts |= options;
	if (ts > ts_now) {
		ts >>= TSBITS;
		ts--;
		ts <<= TSBITS;
		ts |= options;
	}
	return (u64)ts * (NSEC_PER_SEC / TCP_TS_HZ);
}


static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport,
				   __be16 dport, __u32 sseq, __u32 data)
{
	/*
	 * Compute the secure sequence number.
	 * The output should be:
	 *   HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24)
	 *      + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24).
	 * Where sseq is their sequence number and count increases every
	 * minute by 1.
	 * As an extra hack, we add a small "data" value that encodes the
	 * MSS into the second hash value.
	 */
	u32 count = tcp_cookie_time();
	return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
		sseq + (count << COOKIEBITS) +
		((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
		 & COOKIEMASK));
}

/*
 * This retrieves the small "data" value from the syncookie.
 * If the syncookie is bad, the data returned will be out of
 * range.  This must be checked by the caller.
 *
 * The count value used to generate the cookie must be less than
 * MAX_SYNCOOKIE_AGE minutes in the past.
 * The return value (__u32)-1 if this test fails.
 */
static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
				  __be16 sport, __be16 dport, __u32 sseq)
{
	u32 diff, count = tcp_cookie_time();

	/* Strip away the layers from the cookie */
	cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;

	/* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
	diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
	if (diff >= MAX_SYNCOOKIE_AGE)
		return (__u32)-1;

	return (cookie -
		cookie_hash(saddr, daddr, sport, dport, count - diff, 1))
		& COOKIEMASK;	/* Leaving the data behind */
}

/*
 * MSS Values are chosen based on the 2011 paper
 * 'An Analysis of TCP Maximum Segement Sizes' by S. Alcock and R. Nelson.
 * Values ..
 *  .. lower than 536 are rare (< 0.2%)
 *  .. between 537 and 1299 account for less than < 1.5% of observed values
 *  .. in the 1300-1349 range account for about 15 to 20% of observed mss values
 *  .. exceeding 1460 are very rare (< 0.04%)
 *
 *  1460 is the single most frequently announced mss value (30 to 46% depending
 *  on monitor location).  Table must be sorted.
 */
static __u16 const msstab[] = {
	536,
	1300,
	1440,	/* 1440, 1452: PPPoE */
	1460,
};

/*
 * Generate a syncookie.  mssp points to the mss, which is returned
 * rounded down to the value encoded in the cookie.
 */
u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
			      u16 *mssp)
{
	int mssind;
	const __u16 mss = *mssp;

	for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
		if (mss >= msstab[mssind])
			break;
	*mssp = msstab[mssind];

	return secure_tcp_syn_cookie(iph->saddr, iph->daddr,
				     th->source, th->dest, ntohl(th->seq),
				     mssind);
}
EXPORT_SYMBOL_GPL(__cookie_v4_init_sequence);

__u32 cookie_v4_init_sequence(const struct sk_buff *skb, __u16 *mssp)
{
	const struct iphdr *iph = ip_hdr(skb);
	const struct tcphdr *th = tcp_hdr(skb);

	return __cookie_v4_init_sequence(iph, th, mssp);
}

/*
 * Check if a ack sequence number is a valid syncookie.
 * Return the decoded mss if it is, or 0 if not.
 */
int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,
		      u32 cookie)
{
	__u32 seq = ntohl(th->seq) - 1;
	__u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,
					    th->source, th->dest, seq);

	return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
}
EXPORT_SYMBOL_GPL(__cookie_v4_check);

struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
				 struct request_sock *req,
				 struct dst_entry *dst, u32 tsoff)
{
	struct inet_connection_sock *icsk = inet_csk(sk);
	struct sock *child;
	bool own_req;

	child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst,
						 NULL, &own_req);
	if (child) {
		refcount_set(&req->rsk_refcnt, 1);
		tcp_sk(child)->tsoffset = tsoff;
		sock_rps_save_rxhash(child, skb);

		if (rsk_drop_req(req)) {
			reqsk_put(req);
			return child;
		}

		if (inet_csk_reqsk_queue_add(sk, req, child))
			return child;

		bh_unlock_sock(child);
		sock_put(child);
	}
	__reqsk_free(req);

	return NULL;
}
EXPORT_SYMBOL(tcp_get_cookie_sock);

/*
 * when syncookies are in effect and tcp timestamps are enabled we stored
 * additional tcp options in the timestamp.
 * This extracts these options from the timestamp echo.
 *
 * return false if we decode a tcp option that is disabled
 * on the host.
 */
bool cookie_timestamp_decode(const struct net *net,
			     struct tcp_options_received *tcp_opt)
{
	/* echoed timestamp, lowest bits contain options */
	u32 options = tcp_opt->rcv_tsecr;

	if (!tcp_opt->saw_tstamp)  {
		tcp_clear_options(tcp_opt);
		return true;
	}

	if (!READ_ONCE(net->ipv4.sysctl_tcp_timestamps))
		return false;

	tcp_opt->sack_ok = (options & TS_OPT_SACK) ? TCP_SACK_SEEN : 0;

	if (tcp_opt->sack_ok && !READ_ONCE(net->ipv4.sysctl_tcp_sack))
		return false;

	if ((options & TS_OPT_WSCALE_MASK) == TS_OPT_WSCALE_MASK)
		return true; /* no window scaling */

	tcp_opt->wscale_ok = 1;
	tcp_opt->snd_wscale = options & TS_OPT_WSCALE_MASK;

	return READ_ONCE(net->ipv4.sysctl_tcp_window_scaling) != 0;
}
EXPORT_SYMBOL(cookie_timestamp_decode);

bool cookie_ecn_ok(const struct tcp_options_received *tcp_opt,
		   const struct net *net, const struct dst_entry *dst)
{
	bool ecn_ok = tcp_opt->rcv_tsecr & TS_OPT_ECN;

	if (!ecn_ok)
		return false;

	if (READ_ONCE(net->ipv4.sysctl_tcp_ecn))
		return true;

	return dst_feature(dst, RTAX_FEATURE_ECN);
}
EXPORT_SYMBOL(cookie_ecn_ok);

struct request_sock *cookie_tcp_reqsk_alloc(const struct request_sock_ops *ops,
					    const struct tcp_request_sock_ops *af_ops,
					    struct sock *sk,
					    struct sk_buff *skb)
{
	struct tcp_request_sock *treq;
	struct request_sock *req;

	if (sk_is_mptcp(sk))
		req = mptcp_subflow_reqsk_alloc(ops, sk, false);
	else
		req = inet_reqsk_alloc(ops, sk, false);

	if (!req)
		return NULL;

	treq = tcp_rsk(req);

	/* treq->af_specific might be used to perform TCP_MD5 lookup */
	treq->af_specific = af_ops;

	treq->syn_tos = TCP_SKB_CB(skb)->ip_dsfield;
#if IS_ENABLED(CONFIG_MPTCP)
	treq->is_mptcp = sk_is_mptcp(sk);
	if (treq->is_mptcp) {
		int err = mptcp_subflow_init_cookie_req(req, sk, skb);

		if (err) {
			reqsk_free(req);
			return NULL;
		}
	}
#endif

	return req;
}
EXPORT_SYMBOL_GPL(cookie_tcp_reqsk_alloc);

/* On input, sk is a listener.
 * Output is listener if incoming packet would not create a child
 *           NULL if memory could not be allocated.
 */
struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
{
	struct ip_options *opt = &TCP_SKB_CB(skb)->header.h4.opt;
	struct tcp_options_received tcp_opt;
	struct inet_request_sock *ireq;
	struct tcp_request_sock *treq;
	struct tcp_sock *tp = tcp_sk(sk);
	const struct tcphdr *th = tcp_hdr(skb);
	__u32 cookie = ntohl(th->ack_seq) - 1;
	struct sock *ret = sk;
	struct request_sock *req;
	int full_space, mss;
	struct rtable *rt;
	__u8 rcv_wscale;
	struct flowi4 fl4;
	u32 tsoff = 0;

	if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) ||
	    !th->ack || th->rst)
		goto out;

	if (tcp_synq_no_recent_overflow(sk))
		goto out;

	mss = __cookie_v4_check(ip_hdr(skb), th, cookie);
	if (mss == 0) {
		__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
		goto out;
	}

	__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);

	/* check for timestamp cookie support */
	memset(&tcp_opt, 0, sizeof(tcp_opt));
	tcp_parse_options(sock_net(sk), skb, &tcp_opt, 0, NULL);

	if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) {
		tsoff = secure_tcp_ts_off(sock_net(sk),
					  ip_hdr(skb)->daddr,
					  ip_hdr(skb)->saddr);
		tcp_opt.rcv_tsecr -= tsoff;
	}

	if (!cookie_timestamp_decode(sock_net(sk), &tcp_opt))
		goto out;

	ret = NULL;
	req = cookie_tcp_reqsk_alloc(&tcp_request_sock_ops,
				     &tcp_request_sock_ipv4_ops, sk, skb);
	if (!req)
		goto out;

	ireq = inet_rsk(req);
	treq = tcp_rsk(req);
	treq->rcv_isn		= ntohl(th->seq) - 1;
	treq->snt_isn		= cookie;
	treq->ts_off		= 0;
	treq->txhash		= net_tx_rndhash();
	req->mss		= mss;
	ireq->ir_num		= ntohs(th->dest);
	ireq->ir_rmt_port	= th->source;
	sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr);
	sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr);
	ireq->ir_mark		= inet_request_mark(sk, skb);
	ireq->snd_wscale	= tcp_opt.snd_wscale;
	ireq->sack_ok		= tcp_opt.sack_ok;
	ireq->wscale_ok		= tcp_opt.wscale_ok;
	ireq->tstamp_ok		= tcp_opt.saw_tstamp;
	req->ts_recent		= tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
	treq->snt_synack	= 0;
	treq->tfo_listener	= false;

	if (IS_ENABLED(CONFIG_SMC))
		ireq->smc_ok = 0;

	ireq->ir_iif = inet_request_bound_dev_if(sk, skb);

	/* We throwed the options of the initial SYN away, so we hope
	 * the ACK carries the same options again (see RFC1122 4.2.3.8)
	 */
	RCU_INIT_POINTER(ireq->ireq_opt, tcp_v4_save_options(sock_net(sk), skb));

	if (security_inet_conn_request(sk, skb, req)) {
		reqsk_free(req);
		goto out;
	}

	req->num_retrans = 0;

	/*
	 * We need to lookup the route here to get at the correct
	 * window size. We should better make sure that the window size
	 * hasn't changed since we received the original syn, but I see
	 * no easy way to do this.
	 */
	flowi4_init_output(&fl4, ireq->ir_iif, ireq->ir_mark,
			   RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP,
			   inet_sk_flowi_flags(sk),
			   opt->srr ? opt->faddr : ireq->ir_rmt_addr,
			   ireq->ir_loc_addr, th->source, th->dest, sk->sk_uid);
	security_req_classify_flow(req, flowi4_to_flowi_common(&fl4));
	rt = ip_route_output_key(sock_net(sk), &fl4);
	if (IS_ERR(rt)) {
		reqsk_free(req);
		goto out;
	}

	/* Try to redo what tcp_v4_send_synack did. */
	req->rsk_window_clamp = tp->window_clamp ? :dst_metric(&rt->dst, RTAX_WINDOW);
	/* limit the window selection if the user enforce a smaller rx buffer */
	full_space = tcp_full_space(sk);
	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
	    (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
		req->rsk_window_clamp = full_space;

	tcp_select_initial_window(sk, full_space, req->mss,
				  &req->rsk_rcv_wnd, &req->rsk_window_clamp,
				  ireq->wscale_ok, &rcv_wscale,
				  dst_metric(&rt->dst, RTAX_INITRWND));

	ireq->rcv_wscale  = rcv_wscale;
	ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk), &rt->dst);

	ret = tcp_get_cookie_sock(sk, skb, req, &rt->dst, tsoff);
	/* ip_queue_xmit() depends on our flow being setup
	 * Normal sockets get it right from inet_csk_route_child_sock()
	 */
	if (ret)
		inet_sk(ret)->cork.fl.u.ip4 = fl4;
out:	return ret;
}
Commit	Line	Data
2874c5fd	1	// SPDX-License-Identifier: GPL-2.0-or-later
1da177e4 LT	2	/*
	3	* Syncookies implementation for the Linux kernel
	4	*
	5	* Copyright (C) 1997 Andi Kleen
e905a9ed	6	* Based on ideas by D.J.Bernstein and Eric Schenk.
1da177e4 LT	7	*/
	8
	9	#include <linux/tcp.h>
fe62d05b	10	#include <linux/siphash.h>
1da177e4	11	#include <linux/kernel.h>
bc3b2d7f	12	#include <linux/export.h>
84b114b9	13	#include <net/secure_seq.h>
1da177e4	14	#include <net/tcp.h>
86b08d86	15	#include <net/route.h>
1da177e4	16
49ecc2e9	17	static siphash_aligned_key_t syncookie_secret[2];
1da177e4 LT	18
	19	#define COOKIEBITS 24 /* Upper bits store count */
	20	#define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
	21
274e2da0 FW	22	/* TCP Timestamp: 6 lowest bits of timestamp sent in the cookie SYN-ACK
	23	* stores TCP options:
	24	*
	25	* MSB LSB
	26	* \| 31 ... 6 \| 5 \| 4 \| 3 2 1 0 \|
	27	* \| Timestamp \| ECN \| SACK \| WScale \|
	28	*
	29	* When we receive a valid cookie-ACK, we look at the echoed tsval (if
	30	* any) to figure out which TCP options we should use for the rebuilt
	31	* connection.
	32	*
	33	* A WScale setting of '0xf' (which is an invalid scaling value)
	34	* means that original syn did not include the TCP window scaling option.
	35	*/
	36	#define TS_OPT_WSCALE_MASK 0xf
	37	#define TS_OPT_SACK BIT(4)
	38	#define TS_OPT_ECN BIT(5)
	39	/* There is no TS_OPT_TIMESTAMP:
	40	* if ACK contains timestamp option, we already know it was
	41	* requested/supported by the syn/synack exchange.
	42	*/
	43	#define TSBITS 6
	44	#define TSMASK (((__u32)1 << TSBITS) - 1)
	45
714e85be	46	static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
1da177e4 LT	47	u32 count, int c)
1da177e4 LT	48	{
b23a002f	49	net_get_random_once(syncookie_secret, sizeof(syncookie_secret));
fe62d05b JD	50	return siphash_4u32((__force u32)saddr, (__force u32)daddr,
	51	(__force u32)sport << 16 \| (__force u32)dport,
	52	count, &syncookie_secret[c]);
1da177e4 LT	53	}
1da177e4 LT	54
4dfc2817 FW	55
	56	/*
	57	* when syncookies are in effect and tcp timestamps are enabled we encode
734f614b	58	* tcp options in the lower bits of the timestamp value that will be
4dfc2817 FW	59	* sent in the syn-ack.
	60	* Since subsequent timestamps use the normal tcp_time_stamp value, we
	61	* must make sure that the resulting initial timestamp is <= tcp_time_stamp.
	62	*/
200ecef6	63	u64 cookie_init_timestamp(struct request_sock *req, u64 now)
4dfc2817 FW	64	{
4dfc2817 FW	65	struct inet_request_sock *ireq;
200ecef6	66	u32 ts, ts_now = tcp_ns_to_ts(now);
4dfc2817 FW	67	u32 options = 0;
	68
	69	ireq = inet_rsk(req);
734f614b	70
274e2da0 FW	71	options = ireq->wscale_ok ? ireq->snd_wscale : TS_OPT_WSCALE_MASK;
	72	if (ireq->sack_ok)
	73	options \|= TS_OPT_SACK;
	74	if (ireq->ecn_ok)
	75	options \|= TS_OPT_ECN;
4dfc2817 FW	76
	77	ts = ts_now & ~TSMASK;
	78	ts \|= options;
	79	if (ts > ts_now) {
	80	ts >>= TSBITS;
	81	ts--;
	82	ts <<= TSBITS;
	83	ts \|= options;
	84	}
d3edd06e	85	return (u64)ts * (NSEC_PER_SEC / TCP_TS_HZ);
4dfc2817 FW	86	}
	87
	88
714e85be	89	static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport,
8c27bd75	90	__be16 dport, __u32 sseq, __u32 data)
1da177e4 LT	91	{
	92	/*
	93	* Compute the secure sequence number.
	94	* The output should be:
e905a9ed	95	* HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24)
1da177e4 LT	96	* + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24).
	97	* Where sseq is their sequence number and count increases every
	98	* minute by 1.
	99	* As an extra hack, we add a small "data" value that encodes the
	100	* MSS into the second hash value.
	101	*/
8c27bd75	102	u32 count = tcp_cookie_time();
1da177e4 LT	103	return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
	104	sseq + (count << COOKIEBITS) +
	105	((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
	106	& COOKIEMASK));
	107	}
	108
	109	/*
	110	* This retrieves the small "data" value from the syncookie.
	111	* If the syncookie is bad, the data returned will be out of
	112	* range. This must be checked by the caller.
	113	*
8c27bd75 FW	114	* The count value used to generate the cookie must be less than
	115	* MAX_SYNCOOKIE_AGE minutes in the past.
	116	* The return value (__u32)-1 if this test fails.
1da177e4	117	*/
714e85be	118	static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
8c27bd75	119	__be16 sport, __be16 dport, __u32 sseq)
1da177e4	120	{
8c27bd75	121	u32 diff, count = tcp_cookie_time();
1da177e4 LT	122
	123	/* Strip away the layers from the cookie */
	124	cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
	125
	126	/* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
0c9a67d2	127	diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
8c27bd75	128	if (diff >= MAX_SYNCOOKIE_AGE)
1da177e4 LT	129	return (__u32)-1;
	130
	131	return (cookie -
	132	cookie_hash(saddr, daddr, sport, dport, count - diff, 1))
	133	& COOKIEMASK; /* Leaving the data behind */
	134	}
	135
e905a9ed	136	/*
08629354 FW	137	* MSS Values are chosen based on the 2011 paper
	138	* 'An Analysis of TCP Maximum Segement Sizes' by S. Alcock and R. Nelson.
	139	* Values ..
	140	* .. lower than 536 are rare (< 0.2%)
	141	* .. between 537 and 1299 account for less than < 1.5% of observed values
	142	* .. in the 1300-1349 range account for about 15 to 20% of observed mss values
	143	* .. exceeding 1460 are very rare (< 0.04%)
5918e2fb	144	*
08629354 FW	145	* 1460 is the single most frequently announced mss value (30 to 46% depending
08629354 FW	146	* on monitor location). Table must be sorted.
1da177e4 LT	147	*/
1da177e4 LT	148	static __u16 const msstab[] = {
5918e2fb	149	536,
08629354 FW	150	1300,
08629354 FW	151	1440, /* 1440, 1452: PPPoE */
5918e2fb	152	1460,
1da177e4	153	};
1da177e4 LT	154
	155	/*
	156	* Generate a syncookie. mssp points to the mss, which is returned
	157	* rounded down to the value encoded in the cookie.
	158	*/
0198230b PM	159	u32 __cookie_v4_init_sequence(const struct iphdr iph, const struct tcphdr th,
0198230b PM	160	u16 *mssp)
1da177e4	161	{
1da177e4 LT	162	int mssind;
	163	const __u16 mss = *mssp;
	164
5918e2fb FW	165	for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
	166	if (mss >= msstab[mssind])
	167	break;
	168	*mssp = msstab[mssind];
1da177e4	169
aa8223c7 ACM	170	return secure_tcp_syn_cookie(iph->saddr, iph->daddr,
aa8223c7 ACM	171	th->source, th->dest, ntohl(th->seq),
8c27bd75	172	mssind);
1da177e4	173	}
0198230b PM	174	EXPORT_SYMBOL_GPL(__cookie_v4_init_sequence);
0198230b PM	175
3f684b4b	176	__u32 cookie_v4_init_sequence(const struct sk_buff skb, __u16 mssp)
0198230b PM	177	{
	178	const struct iphdr *iph = ip_hdr(skb);
	179	const struct tcphdr *th = tcp_hdr(skb);
	180
0198230b PM	181	return __cookie_v4_init_sequence(iph, th, mssp);
0198230b PM	182	}
1da177e4	183
e905a9ed YH	184	/*
e905a9ed YH	185	* Check if a ack sequence number is a valid syncookie.
1da177e4 LT	186	* Return the decoded mss if it is, or 0 if not.
1da177e4 LT	187	*/
0198230b PM	188	int __cookie_v4_check(const struct iphdr iph, const struct tcphdr th,
0198230b PM	189	u32 cookie)
1da177e4	190	{
aa8223c7 ACM	191	__u32 seq = ntohl(th->seq) - 1;
aa8223c7 ACM	192	__u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,
8c27bd75	193	th->source, th->dest, seq);
1da177e4	194
5918e2fb	195	return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
1da177e4	196	}
0198230b	197	EXPORT_SYMBOL_GPL(__cookie_v4_check);
1da177e4	198
b80c0e78 ED	199	struct sock tcp_get_cookie_sock(struct sock sk, struct sk_buff *skb,
b80c0e78 ED	200	struct request_sock *req,
84b114b9	201	struct dst_entry *dst, u32 tsoff)
1da177e4	202	{
8292a17a	203	struct inet_connection_sock *icsk = inet_csk(sk);
1da177e4	204	struct sock *child;
5e0724d0	205	bool own_req;
1da177e4	206
5e0724d0 ED	207	child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst,
5e0724d0 ED	208	NULL, &own_req);
0470c8ca	209	if (child) {
41c6d650	210	refcount_set(&req->rsk_refcnt, 1);
84b114b9	211	tcp_sk(child)->tsoffset = tsoff;
6bcfd7f8	212	sock_rps_save_rxhash(child, skb);
9466a1cc	213
0e8642cf	214	if (rsk_drop_req(req)) {
9d8c05ad	215	reqsk_put(req);
9466a1cc FW	216	return child;
	217	}
	218
9403cf23 GN	219	if (inet_csk_reqsk_queue_add(sk, req, child))
	220	return child;
	221
	222	bh_unlock_sock(child);
	223	sock_put(child);
0470c8ca	224	}
9403cf23 GN	225	__reqsk_free(req);
	226
	227	return NULL;
1da177e4	228	}
b80c0e78	229	EXPORT_SYMBOL(tcp_get_cookie_sock);
4dfc2817 FW	230
	231	/*
	232	* when syncookies are in effect and tcp timestamps are enabled we stored
	233	* additional tcp options in the timestamp.
	234	* This extracts these options from the timestamp echo.
	235	*
f1673381 FW	236	* return false if we decode a tcp option that is disabled
f1673381 FW	237	* on the host.
4dfc2817	238	*/
f9301034 ED	239	bool cookie_timestamp_decode(const struct net *net,
f9301034 ED	240	struct tcp_options_received *tcp_opt)
4dfc2817	241	{
734f614b	242	/* echoed timestamp, lowest bits contain options */
274e2da0	243	u32 options = tcp_opt->rcv_tsecr;
4dfc2817	244
8c763681 FW	245	if (!tcp_opt->saw_tstamp) {
	246	tcp_clear_options(tcp_opt);
	247	return true;
	248	}
	249
3666f666	250	if (!READ_ONCE(net->ipv4.sysctl_tcp_timestamps))
8c763681 FW	251	return false;
8c763681 FW	252
274e2da0	253	tcp_opt->sack_ok = (options & TS_OPT_SACK) ? TCP_SACK_SEEN : 0;
4dfc2817	254
3666f666	255	if (tcp_opt->sack_ok && !READ_ONCE(net->ipv4.sysctl_tcp_sack))
8c763681	256	return false;
4dfc2817	257
274e2da0	258	if ((options & TS_OPT_WSCALE_MASK) == TS_OPT_WSCALE_MASK)
734f614b FW	259	return true; /* no window scaling */
	260
	261	tcp_opt->wscale_ok = 1;
274e2da0 FW	262	tcp_opt->snd_wscale = options & TS_OPT_WSCALE_MASK;
274e2da0 FW	263
3666f666	264	return READ_ONCE(net->ipv4.sysctl_tcp_window_scaling) != 0;
4dfc2817	265	}
f1673381 FW	266	EXPORT_SYMBOL(cookie_timestamp_decode);
	267
	268	bool cookie_ecn_ok(const struct tcp_options_received *tcp_opt,
f7b3bec6	269	const struct net net, const struct dst_entry dst)
f1673381 FW	270	{
	271	bool ecn_ok = tcp_opt->rcv_tsecr & TS_OPT_ECN;
	272
	273	if (!ecn_ok)
	274	return false;
	275
4785a667	276	if (READ_ONCE(net->ipv4.sysctl_tcp_ecn))
f1673381 FW	277	return true;
f1673381 FW	278
f7b3bec6	279	return dst_feature(dst, RTAX_FEATURE_ECN);
f1673381 FW	280	}
f1673381 FW	281	EXPORT_SYMBOL(cookie_ecn_ok);
4dfc2817	282
6fc8c827	283	struct request_sock cookie_tcp_reqsk_alloc(const struct request_sock_ops ops,
ba5a4fdd	284	const struct tcp_request_sock_ops *af_ops,
6fc8c827 FW	285	struct sock *sk,
	286	struct sk_buff *skb)
	287	{
e9b12edc	288	struct tcp_request_sock *treq;
6fc8c827 FW	289	struct request_sock *req;
6fc8c827 FW	290
6fc8c827	291	if (sk_is_mptcp(sk))
3fff8818 MB	292	req = mptcp_subflow_reqsk_alloc(ops, sk, false);
	293	else
	294	req = inet_reqsk_alloc(ops, sk, false);
6fc8c827	295
6fc8c827 FW	296	if (!req)
	297	return NULL;
	298
6fc8c827	299	treq = tcp_rsk(req);
ba5a4fdd ED	300
	301	/* treq->af_specific might be used to perform TCP_MD5 lookup */
	302	treq->af_specific = af_ops;
	303
e9b12edc WW	304	treq->syn_tos = TCP_SKB_CB(skb)->ip_dsfield;
e9b12edc WW	305	#if IS_ENABLED(CONFIG_MPTCP)
6fc8c827 FW	306	treq->is_mptcp = sk_is_mptcp(sk);
	307	if (treq->is_mptcp) {
	308	int err = mptcp_subflow_init_cookie_req(req, sk, skb);
	309
	310	if (err) {
	311	reqsk_free(req);
	312	return NULL;
	313	}
	314	}
	315	#endif
	316
	317	return req;
	318	}
	319	EXPORT_SYMBOL_GPL(cookie_tcp_reqsk_alloc);
	320
079096f1 ED	321	/* On input, sk is a listener.
	322	* Output is listener if incoming packet would not create a child
	323	* NULL if memory could not be allocated.
	324	*/
461b74c3	325	struct sock cookie_v4_check(struct sock sk, struct sk_buff *skb)
1da177e4	326	{
461b74c3	327	struct ip_options *opt = &TCP_SKB_CB(skb)->header.h4.opt;
4957faad	328	struct tcp_options_received tcp_opt;
2e6599cb ACM	329	struct inet_request_sock *ireq;
2e6599cb ACM	330	struct tcp_request_sock *treq;
1da177e4	331	struct tcp_sock *tp = tcp_sk(sk);
aa8223c7 ACM	332	const struct tcphdr *th = tcp_hdr(skb);
aa8223c7 ACM	333	__u32 cookie = ntohl(th->ack_seq) - 1;
1da177e4	334	struct sock *ret = sk;
e905a9ed	335	struct request_sock *req;
909172a1	336	int full_space, mss;
e905a9ed	337	struct rtable *rt;
1da177e4	338	__u8 rcv_wscale;
dfd25fff	339	struct flowi4 fl4;
84b114b9	340	u32 tsoff = 0;
1da177e4	341
f2e383b5 KI	342	if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) \|\|
f2e383b5 KI	343	!th->ack \|\| th->rst)
1da177e4 LT	344	goto out;
1da177e4 LT	345
646697b9 FW	346	if (tcp_synq_no_recent_overflow(sk))
	347	goto out;
	348
	349	mss = __cookie_v4_check(ip_hdr(skb), th, cookie);
	350	if (mss == 0) {
02a1d6e7	351	__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
1da177e4 LT	352	goto out;
	353	}
	354
02a1d6e7	355	__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
1da177e4	356
bb5b7c11 DM	357	/* check for timestamp cookie support */
bb5b7c11 DM	358	memset(&tcp_opt, 0, sizeof(tcp_opt));
eed29f17	359	tcp_parse_options(sock_net(sk), skb, &tcp_opt, 0, NULL);
bb5b7c11	360
84b114b9	361	if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) {
5d2ed052 ED	362	tsoff = secure_tcp_ts_off(sock_net(sk),
	363	ip_hdr(skb)->daddr,
	364	ip_hdr(skb)->saddr);
84b114b9 ED	365	tcp_opt.rcv_tsecr -= tsoff;
	366	}
	367
f9301034	368	if (!cookie_timestamp_decode(sock_net(sk), &tcp_opt))
8c763681	369	goto out;
bb5b7c11	370
1da177e4	371	ret = NULL;
ba5a4fdd ED	372	req = cookie_tcp_reqsk_alloc(&tcp_request_sock_ops,
ba5a4fdd ED	373	&tcp_request_sock_ipv4_ops, sk, skb);
1da177e4 LT	374	if (!req)
	375	goto out;
	376
2e6599cb ACM	377	ireq = inet_rsk(req);
2e6599cb ACM	378	treq = tcp_rsk(req);
aa8223c7	379	treq->rcv_isn = ntohl(th->seq) - 1;
e905a9ed	380	treq->snt_isn = cookie;
95a22cae	381	treq->ts_off = 0;
18bcf290	382	treq->txhash = net_tx_rndhash();
1da177e4	383	req->mss = mss;
b44084c2 ED	384	ireq->ir_num = ntohs(th->dest);
b44084c2 ED	385	ireq->ir_rmt_port = th->source;
08d2cc3b ED	386	sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr);
08d2cc3b ED	387	sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr);
84f39b08	388	ireq->ir_mark = inet_request_mark(sk, skb);
bb5b7c11	389	ireq->snd_wscale = tcp_opt.snd_wscale;
bb5b7c11 DM	390	ireq->sack_ok = tcp_opt.sack_ok;
	391	ireq->wscale_ok = tcp_opt.wscale_ok;
	392	ireq->tstamp_ok = tcp_opt.saw_tstamp;
	393	req->ts_recent = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
9a568de4	394	treq->snt_synack = 0;
9439ce00	395	treq->tfo_listener = false;
ae2dd716	396
bc58a1ba HW	397	if (IS_ENABLED(CONFIG_SMC))
bc58a1ba HW	398	ireq->smc_ok = 0;
1da177e4	399
6dd9a14e	400	ireq->ir_iif = inet_request_bound_dev_if(sk, skb);
16f86165	401
1da177e4 LT	402	/* We throwed the options of the initial SYN away, so we hope
	403	* the ACK carries the same options again (see RFC1122 4.2.3.8)
	404	*/
c92e8c02	405	RCU_INIT_POINTER(ireq->ireq_opt, tcp_v4_save_options(sock_net(sk), skb));
1da177e4	406
284904aa	407	if (security_inet_conn_request(sk, skb, req)) {
0470c8ca	408	reqsk_free(req);
284904aa PM	409	goto out;
	410	}
	411
e6c022a4	412	req->num_retrans = 0;
e905a9ed	413
1da177e4 LT	414	/*
	415	* We need to lookup the route here to get at the correct
	416	* window size. We should better make sure that the window size
	417	* hasn't changed since we received the original syn, but I see
e905a9ed	418	* no easy way to do this.
1da177e4	419	*/
6dd9a14e	420	flowi4_init_output(&fl4, ireq->ir_iif, ireq->ir_mark,
d66954a0	421	RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP,
dfd25fff	422	inet_sk_flowi_flags(sk),
461b74c3	423	opt->srr ? opt->faddr : ireq->ir_rmt_addr,
e2d118a1	424	ireq->ir_loc_addr, th->source, th->dest, sk->sk_uid);
3df98d79	425	security_req_classify_flow(req, flowi4_to_flowi_common(&fl4));
dfd25fff ED	426	rt = ip_route_output_key(sock_net(sk), &fl4);
dfd25fff ED	427	if (IS_ERR(rt)) {
0470c8ca	428	reqsk_free(req);
dfd25fff	429	goto out;
1da177e4 LT	430	}
	431
	432	/* Try to redo what tcp_v4_send_synack did. */
ed53d0ab	433	req->rsk_window_clamp = tp->window_clamp ? :dst_metric(&rt->dst, RTAX_WINDOW);
909172a1 MW	434	/* limit the window selection if the user enforce a smaller rx buffer */
	435	full_space = tcp_full_space(sk);
	436	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
	437	(req->rsk_window_clamp > full_space \|\| req->rsk_window_clamp == 0))
	438	req->rsk_window_clamp = full_space;
4dfc2817	439
909172a1	440	tcp_select_initial_window(sk, full_space, req->mss,
ed53d0ab	441	&req->rsk_rcv_wnd, &req->rsk_window_clamp,
31d12926	442	ireq->wscale_ok, &rcv_wscale,
d8d1f30b	443	dst_metric(&rt->dst, RTAX_INITRWND));
4dfc2817	444
e905a9ed	445	ireq->rcv_wscale = rcv_wscale;
f7b3bec6	446	ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk), &rt->dst);
1da177e4	447
84b114b9	448	ret = tcp_get_cookie_sock(sk, skb, req, &rt->dst, tsoff);
dfd25fff ED	449	/* ip_queue_xmit() depends on our flow being setup
	450	* Normal sockets get it right from inet_csk_route_child_sock()
	451	*/
	452	if (ret)
	453	inet_sk(ret)->cork.fl.u.ip4 = fl4;
1da177e4 LT	454	out: return ret;
1da177e4 LT	455	}