[linux-block.git] / net / ipv4 / syncookies.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *  Syncookies implementation for the Linux kernel
 *
 *  Copyright (C) 1997 Andi Kleen
 *  Based on ideas by D.J.Bernstein and Eric Schenk.
 */

#include <linux/tcp.h>
#include <linux/slab.h>
#include <linux/random.h>
#include <linux/siphash.h>
#include <linux/kernel.h>
#include <linux/export.h>
#include <net/secure_seq.h>
#include <net/tcp.h>
#include <net/route.h>

static siphash_key_t syncookie_secret[2] __read_mostly;

#define COOKIEBITS 24	/* Upper bits store count */
#define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)

/* TCP Timestamp: 6 lowest bits of timestamp sent in the cookie SYN-ACK
 * stores TCP options:
 *
 * MSB                               LSB
 * | 31 ...   6 |  5  |  4   | 3 2 1 0 |
 * |  Timestamp | ECN | SACK | WScale  |
 *
 * When we receive a valid cookie-ACK, we look at the echoed tsval (if
 * any) to figure out which TCP options we should use for the rebuilt
 * connection.
 *
 * A WScale setting of '0xf' (which is an invalid scaling value)
 * means that original syn did not include the TCP window scaling option.
 */
#define TS_OPT_WSCALE_MASK	0xf
#define TS_OPT_SACK		BIT(4)
#define TS_OPT_ECN		BIT(5)
/* There is no TS_OPT_TIMESTAMP:
 * if ACK contains timestamp option, we already know it was
 * requested/supported by the syn/synack exchange.
 */
#define TSBITS	6
#define TSMASK	(((__u32)1 << TSBITS) - 1)

static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
		       u32 count, int c)
{
	net_get_random_once(syncookie_secret, sizeof(syncookie_secret));
	return siphash_4u32((__force u32)saddr, (__force u32)daddr,
			    (__force u32)sport << 16 | (__force u32)dport,
			    count, &syncookie_secret[c]);
}


/*
 * when syncookies are in effect and tcp timestamps are enabled we encode
 * tcp options in the lower bits of the timestamp value that will be
 * sent in the syn-ack.
 * Since subsequent timestamps use the normal tcp_time_stamp value, we
 * must make sure that the resulting initial timestamp is <= tcp_time_stamp.
 */
u64 cookie_init_timestamp(struct request_sock *req, u64 now)
{
	struct inet_request_sock *ireq;
	u32 ts, ts_now = tcp_ns_to_ts(now);
	u32 options = 0;

	ireq = inet_rsk(req);

	options = ireq->wscale_ok ? ireq->snd_wscale : TS_OPT_WSCALE_MASK;
	if (ireq->sack_ok)
		options |= TS_OPT_SACK;
	if (ireq->ecn_ok)
		options |= TS_OPT_ECN;

	ts = ts_now & ~TSMASK;
	ts |= options;
	if (ts > ts_now) {
		ts >>= TSBITS;
		ts--;
		ts <<= TSBITS;
		ts |= options;
	}
	return (u64)ts * (NSEC_PER_SEC / TCP_TS_HZ);
}


static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport,
				   __be16 dport, __u32 sseq, __u32 data)
{
	/*
	 * Compute the secure sequence number.
	 * The output should be:
	 *   HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24)
	 *      + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24).
	 * Where sseq is their sequence number and count increases every
	 * minute by 1.
	 * As an extra hack, we add a small "data" value that encodes the
	 * MSS into the second hash value.
	 */
	u32 count = tcp_cookie_time();
	return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
		sseq + (count << COOKIEBITS) +
		((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
		 & COOKIEMASK));
}

/*
 * This retrieves the small "data" value from the syncookie.
 * If the syncookie is bad, the data returned will be out of
 * range.  This must be checked by the caller.
 *
 * The count value used to generate the cookie must be less than
 * MAX_SYNCOOKIE_AGE minutes in the past.
 * The return value (__u32)-1 if this test fails.
 */
static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
				  __be16 sport, __be16 dport, __u32 sseq)
{
	u32 diff, count = tcp_cookie_time();

	/* Strip away the layers from the cookie */
	cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;

	/* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
	diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
	if (diff >= MAX_SYNCOOKIE_AGE)
		return (__u32)-1;

	return (cookie -
		cookie_hash(saddr, daddr, sport, dport, count - diff, 1))
		& COOKIEMASK;	/* Leaving the data behind */
}

/*
 * MSS Values are chosen based on the 2011 paper
 * 'An Analysis of TCP Maximum Segement Sizes' by S. Alcock and R. Nelson.
 * Values ..
 *  .. lower than 536 are rare (< 0.2%)
 *  .. between 537 and 1299 account for less than < 1.5% of observed values
 *  .. in the 1300-1349 range account for about 15 to 20% of observed mss values
 *  .. exceeding 1460 are very rare (< 0.04%)
 *
 *  1460 is the single most frequently announced mss value (30 to 46% depending
 *  on monitor location).  Table must be sorted.
 */
static __u16 const msstab[] = {
	536,
	1300,
	1440,	/* 1440, 1452: PPPoE */
	1460,
};

/*
 * Generate a syncookie.  mssp points to the mss, which is returned
 * rounded down to the value encoded in the cookie.
 */
u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
			      u16 *mssp)
{
	int mssind;
	const __u16 mss = *mssp;

	for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
		if (mss >= msstab[mssind])
			break;
	*mssp = msstab[mssind];

	return secure_tcp_syn_cookie(iph->saddr, iph->daddr,
				     th->source, th->dest, ntohl(th->seq),
				     mssind);
}
EXPORT_SYMBOL_GPL(__cookie_v4_init_sequence);

__u32 cookie_v4_init_sequence(const struct sk_buff *skb, __u16 *mssp)
{
	const struct iphdr *iph = ip_hdr(skb);
	const struct tcphdr *th = tcp_hdr(skb);

	return __cookie_v4_init_sequence(iph, th, mssp);
}

/*
 * Check if a ack sequence number is a valid syncookie.
 * Return the decoded mss if it is, or 0 if not.
 */
int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,
		      u32 cookie)
{
	__u32 seq = ntohl(th->seq) - 1;
	__u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,
					    th->source, th->dest, seq);

	return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
}
EXPORT_SYMBOL_GPL(__cookie_v4_check);

struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
				 struct request_sock *req,
				 struct dst_entry *dst, u32 tsoff)
{
	struct inet_connection_sock *icsk = inet_csk(sk);
	struct sock *child;
	bool own_req;

	child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst,
						 NULL, &own_req);
	if (child) {
		refcount_set(&req->rsk_refcnt, 1);
		tcp_sk(child)->tsoffset = tsoff;
		sock_rps_save_rxhash(child, skb);

		if (rsk_drop_req(req)) {
			reqsk_put(req);
			return child;
		}

		if (inet_csk_reqsk_queue_add(sk, req, child))
			return child;

		bh_unlock_sock(child);
		sock_put(child);
	}
	__reqsk_free(req);

	return NULL;
}
EXPORT_SYMBOL(tcp_get_cookie_sock);

/*
 * when syncookies are in effect and tcp timestamps are enabled we stored
 * additional tcp options in the timestamp.
 * This extracts these options from the timestamp echo.
 *
 * return false if we decode a tcp option that is disabled
 * on the host.
 */
bool cookie_timestamp_decode(const struct net *net,
			     struct tcp_options_received *tcp_opt)
{
	/* echoed timestamp, lowest bits contain options */
	u32 options = tcp_opt->rcv_tsecr;

	if (!tcp_opt->saw_tstamp)  {
		tcp_clear_options(tcp_opt);
		return true;
	}

	if (!net->ipv4.sysctl_tcp_timestamps)
		return false;

	tcp_opt->sack_ok = (options & TS_OPT_SACK) ? TCP_SACK_SEEN : 0;

	if (tcp_opt->sack_ok && !net->ipv4.sysctl_tcp_sack)
		return false;

	if ((options & TS_OPT_WSCALE_MASK) == TS_OPT_WSCALE_MASK)
		return true; /* no window scaling */

	tcp_opt->wscale_ok = 1;
	tcp_opt->snd_wscale = options & TS_OPT_WSCALE_MASK;

	return net->ipv4.sysctl_tcp_window_scaling != 0;
}
EXPORT_SYMBOL(cookie_timestamp_decode);

bool cookie_ecn_ok(const struct tcp_options_received *tcp_opt,
		   const struct net *net, const struct dst_entry *dst)
{
	bool ecn_ok = tcp_opt->rcv_tsecr & TS_OPT_ECN;

	if (!ecn_ok)
		return false;

	if (net->ipv4.sysctl_tcp_ecn)
		return true;

	return dst_feature(dst, RTAX_FEATURE_ECN);
}
EXPORT_SYMBOL(cookie_ecn_ok);

struct request_sock *cookie_tcp_reqsk_alloc(const struct request_sock_ops *ops,
					    struct sock *sk,
					    struct sk_buff *skb)
{
	struct tcp_request_sock *treq;
	struct request_sock *req;

#ifdef CONFIG_MPTCP
	if (sk_is_mptcp(sk))
		ops = &mptcp_subflow_request_sock_ops;
#endif

	req = inet_reqsk_alloc(ops, sk, false);
	if (!req)
		return NULL;

	treq = tcp_rsk(req);
	treq->syn_tos = TCP_SKB_CB(skb)->ip_dsfield;
#if IS_ENABLED(CONFIG_MPTCP)
	treq->is_mptcp = sk_is_mptcp(sk);
	if (treq->is_mptcp) {
		int err = mptcp_subflow_init_cookie_req(req, sk, skb);

		if (err) {
			reqsk_free(req);
			return NULL;
		}
	}
#endif

	return req;
}
EXPORT_SYMBOL_GPL(cookie_tcp_reqsk_alloc);

/* On input, sk is a listener.
 * Output is listener if incoming packet would not create a child
 *           NULL if memory could not be allocated.
 */
struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
{
	struct ip_options *opt = &TCP_SKB_CB(skb)->header.h4.opt;
	struct tcp_options_received tcp_opt;
	struct inet_request_sock *ireq;
	struct tcp_request_sock *treq;
	struct tcp_sock *tp = tcp_sk(sk);
	const struct tcphdr *th = tcp_hdr(skb);
	__u32 cookie = ntohl(th->ack_seq) - 1;
	struct sock *ret = sk;
	struct request_sock *req;
	int full_space, mss;
	struct rtable *rt;
	__u8 rcv_wscale;
	struct flowi4 fl4;
	u32 tsoff = 0;

	if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst)
		goto out;

	if (tcp_synq_no_recent_overflow(sk))
		goto out;

	mss = __cookie_v4_check(ip_hdr(skb), th, cookie);
	if (mss == 0) {
		__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
		goto out;
	}

	__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);

	/* check for timestamp cookie support */
	memset(&tcp_opt, 0, sizeof(tcp_opt));
	tcp_parse_options(sock_net(sk), skb, &tcp_opt, 0, NULL);

	if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) {
		tsoff = secure_tcp_ts_off(sock_net(sk),
					  ip_hdr(skb)->daddr,
					  ip_hdr(skb)->saddr);
		tcp_opt.rcv_tsecr -= tsoff;
	}

	if (!cookie_timestamp_decode(sock_net(sk), &tcp_opt))
		goto out;

	ret = NULL;
	req = cookie_tcp_reqsk_alloc(&tcp_request_sock_ops, sk, skb);
	if (!req)
		goto out;

	ireq = inet_rsk(req);
	treq = tcp_rsk(req);
	treq->rcv_isn		= ntohl(th->seq) - 1;
	treq->snt_isn		= cookie;
	treq->ts_off		= 0;
	treq->txhash		= net_tx_rndhash();
	req->mss		= mss;
	ireq->ir_num		= ntohs(th->dest);
	ireq->ir_rmt_port	= th->source;
	sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr);
	sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr);
	ireq->ir_mark		= inet_request_mark(sk, skb);
	ireq->snd_wscale	= tcp_opt.snd_wscale;
	ireq->sack_ok		= tcp_opt.sack_ok;
	ireq->wscale_ok		= tcp_opt.wscale_ok;
	ireq->tstamp_ok		= tcp_opt.saw_tstamp;
	req->ts_recent		= tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
	treq->snt_synack	= 0;
	treq->tfo_listener	= false;

	if (IS_ENABLED(CONFIG_SMC))
		ireq->smc_ok = 0;

	ireq->ir_iif = inet_request_bound_dev_if(sk, skb);

	/* We throwed the options of the initial SYN away, so we hope
	 * the ACK carries the same options again (see RFC1122 4.2.3.8)
	 */
	RCU_INIT_POINTER(ireq->ireq_opt, tcp_v4_save_options(sock_net(sk), skb));

	if (security_inet_conn_request(sk, skb, req)) {
		reqsk_free(req);
		goto out;
	}

	req->num_retrans = 0;

	/*
	 * We need to lookup the route here to get at the correct
	 * window size. We should better make sure that the window size
	 * hasn't changed since we received the original syn, but I see
	 * no easy way to do this.
	 */
	flowi4_init_output(&fl4, ireq->ir_iif, ireq->ir_mark,
			   RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP,
			   inet_sk_flowi_flags(sk),
			   opt->srr ? opt->faddr : ireq->ir_rmt_addr,
			   ireq->ir_loc_addr, th->source, th->dest, sk->sk_uid);
	security_req_classify_flow(req, flowi4_to_flowi_common(&fl4));
	rt = ip_route_output_key(sock_net(sk), &fl4);
	if (IS_ERR(rt)) {
		reqsk_free(req);
		goto out;
	}

	/* Try to redo what tcp_v4_send_synack did. */
	req->rsk_window_clamp = tp->window_clamp ? :dst_metric(&rt->dst, RTAX_WINDOW);
	/* limit the window selection if the user enforce a smaller rx buffer */
	full_space = tcp_full_space(sk);
	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
	    (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
		req->rsk_window_clamp = full_space;

	tcp_select_initial_window(sk, full_space, req->mss,
				  &req->rsk_rcv_wnd, &req->rsk_window_clamp,
				  ireq->wscale_ok, &rcv_wscale,
				  dst_metric(&rt->dst, RTAX_INITRWND));

	ireq->rcv_wscale  = rcv_wscale;
	ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk), &rt->dst);

	ret = tcp_get_cookie_sock(sk, skb, req, &rt->dst, tsoff);
	/* ip_queue_xmit() depends on our flow being setup
	 * Normal sockets get it right from inet_csk_route_child_sock()
	 */
	if (ret)
		inet_sk(ret)->cork.fl.u.ip4 = fl4;
out:	return ret;
}
Commit	Line	Data
2874c5fd	1	// SPDX-License-Identifier: GPL-2.0-or-later
1da177e4 LT	2	/*
	3	* Syncookies implementation for the Linux kernel
	4	*
	5	* Copyright (C) 1997 Andi Kleen
e905a9ed	6	* Based on ideas by D.J.Bernstein and Eric Schenk.
1da177e4 LT	7	*/
	8
	9	#include <linux/tcp.h>
	10	#include <linux/slab.h>
	11	#include <linux/random.h>
fe62d05b	12	#include <linux/siphash.h>
1da177e4	13	#include <linux/kernel.h>
bc3b2d7f	14	#include <linux/export.h>
84b114b9	15	#include <net/secure_seq.h>
1da177e4	16	#include <net/tcp.h>
86b08d86	17	#include <net/route.h>
1da177e4	18
fe62d05b	19	static siphash_key_t syncookie_secret[2] __read_mostly;
1da177e4 LT	20
	21	#define COOKIEBITS 24 /* Upper bits store count */
	22	#define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
	23
274e2da0 FW	24	/* TCP Timestamp: 6 lowest bits of timestamp sent in the cookie SYN-ACK
	25	* stores TCP options:
	26	*
	27	* MSB LSB
	28	* \| 31 ... 6 \| 5 \| 4 \| 3 2 1 0 \|
	29	* \| Timestamp \| ECN \| SACK \| WScale \|
	30	*
	31	* When we receive a valid cookie-ACK, we look at the echoed tsval (if
	32	* any) to figure out which TCP options we should use for the rebuilt
	33	* connection.
	34	*
	35	* A WScale setting of '0xf' (which is an invalid scaling value)
	36	* means that original syn did not include the TCP window scaling option.
	37	*/
	38	#define TS_OPT_WSCALE_MASK 0xf
	39	#define TS_OPT_SACK BIT(4)
	40	#define TS_OPT_ECN BIT(5)
	41	/* There is no TS_OPT_TIMESTAMP:
	42	* if ACK contains timestamp option, we already know it was
	43	* requested/supported by the syn/synack exchange.
	44	*/
	45	#define TSBITS 6
	46	#define TSMASK (((__u32)1 << TSBITS) - 1)
	47
714e85be	48	static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
1da177e4 LT	49	u32 count, int c)
1da177e4 LT	50	{
b23a002f	51	net_get_random_once(syncookie_secret, sizeof(syncookie_secret));
fe62d05b JD	52	return siphash_4u32((__force u32)saddr, (__force u32)daddr,
	53	(__force u32)sport << 16 \| (__force u32)dport,
	54	count, &syncookie_secret[c]);
1da177e4 LT	55	}
1da177e4 LT	56
4dfc2817 FW	57
	58	/*
	59	* when syncookies are in effect and tcp timestamps are enabled we encode
734f614b	60	* tcp options in the lower bits of the timestamp value that will be
4dfc2817 FW	61	* sent in the syn-ack.
	62	* Since subsequent timestamps use the normal tcp_time_stamp value, we
	63	* must make sure that the resulting initial timestamp is <= tcp_time_stamp.
	64	*/
200ecef6	65	u64 cookie_init_timestamp(struct request_sock *req, u64 now)
4dfc2817 FW	66	{
4dfc2817 FW	67	struct inet_request_sock *ireq;
200ecef6	68	u32 ts, ts_now = tcp_ns_to_ts(now);
4dfc2817 FW	69	u32 options = 0;
	70
	71	ireq = inet_rsk(req);
734f614b	72
274e2da0 FW	73	options = ireq->wscale_ok ? ireq->snd_wscale : TS_OPT_WSCALE_MASK;
	74	if (ireq->sack_ok)
	75	options \|= TS_OPT_SACK;
	76	if (ireq->ecn_ok)
	77	options \|= TS_OPT_ECN;
4dfc2817 FW	78
	79	ts = ts_now & ~TSMASK;
	80	ts \|= options;
	81	if (ts > ts_now) {
	82	ts >>= TSBITS;
	83	ts--;
	84	ts <<= TSBITS;
	85	ts \|= options;
	86	}
d3edd06e	87	return (u64)ts * (NSEC_PER_SEC / TCP_TS_HZ);
4dfc2817 FW	88	}
	89
	90
714e85be	91	static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport,
8c27bd75	92	__be16 dport, __u32 sseq, __u32 data)
1da177e4 LT	93	{
	94	/*
	95	* Compute the secure sequence number.
	96	* The output should be:
e905a9ed	97	* HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24)
1da177e4 LT	98	* + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24).
	99	* Where sseq is their sequence number and count increases every
	100	* minute by 1.
	101	* As an extra hack, we add a small "data" value that encodes the
	102	* MSS into the second hash value.
	103	*/
8c27bd75	104	u32 count = tcp_cookie_time();
1da177e4 LT	105	return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
	106	sseq + (count << COOKIEBITS) +
	107	((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
	108	& COOKIEMASK));
	109	}
	110
	111	/*
	112	* This retrieves the small "data" value from the syncookie.
	113	* If the syncookie is bad, the data returned will be out of
	114	* range. This must be checked by the caller.
	115	*
8c27bd75 FW	116	* The count value used to generate the cookie must be less than
	117	* MAX_SYNCOOKIE_AGE minutes in the past.
	118	* The return value (__u32)-1 if this test fails.
1da177e4	119	*/
714e85be	120	static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
8c27bd75	121	__be16 sport, __be16 dport, __u32 sseq)
1da177e4	122	{
8c27bd75	123	u32 diff, count = tcp_cookie_time();
1da177e4 LT	124
	125	/* Strip away the layers from the cookie */
	126	cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
	127
	128	/* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
0c9a67d2	129	diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
8c27bd75	130	if (diff >= MAX_SYNCOOKIE_AGE)
1da177e4 LT	131	return (__u32)-1;
	132
	133	return (cookie -
	134	cookie_hash(saddr, daddr, sport, dport, count - diff, 1))
	135	& COOKIEMASK; /* Leaving the data behind */
	136	}
	137
e905a9ed	138	/*
08629354 FW	139	* MSS Values are chosen based on the 2011 paper
	140	* 'An Analysis of TCP Maximum Segement Sizes' by S. Alcock and R. Nelson.
	141	* Values ..
	142	* .. lower than 536 are rare (< 0.2%)
	143	* .. between 537 and 1299 account for less than < 1.5% of observed values
	144	* .. in the 1300-1349 range account for about 15 to 20% of observed mss values
	145	* .. exceeding 1460 are very rare (< 0.04%)
5918e2fb	146	*
08629354 FW	147	* 1460 is the single most frequently announced mss value (30 to 46% depending
08629354 FW	148	* on monitor location). Table must be sorted.
1da177e4 LT	149	*/
1da177e4 LT	150	static __u16 const msstab[] = {
5918e2fb	151	536,
08629354 FW	152	1300,
08629354 FW	153	1440, /* 1440, 1452: PPPoE */
5918e2fb	154	1460,
1da177e4	155	};
1da177e4 LT	156
	157	/*
	158	* Generate a syncookie. mssp points to the mss, which is returned
	159	* rounded down to the value encoded in the cookie.
	160	*/
0198230b PM	161	u32 __cookie_v4_init_sequence(const struct iphdr iph, const struct tcphdr th,
0198230b PM	162	u16 *mssp)
1da177e4	163	{
1da177e4 LT	164	int mssind;
	165	const __u16 mss = *mssp;
	166
5918e2fb FW	167	for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
	168	if (mss >= msstab[mssind])
	169	break;
	170	*mssp = msstab[mssind];
1da177e4	171
aa8223c7 ACM	172	return secure_tcp_syn_cookie(iph->saddr, iph->daddr,
aa8223c7 ACM	173	th->source, th->dest, ntohl(th->seq),
8c27bd75	174	mssind);
1da177e4	175	}
0198230b PM	176	EXPORT_SYMBOL_GPL(__cookie_v4_init_sequence);
0198230b PM	177
3f684b4b	178	__u32 cookie_v4_init_sequence(const struct sk_buff skb, __u16 mssp)
0198230b PM	179	{
	180	const struct iphdr *iph = ip_hdr(skb);
	181	const struct tcphdr *th = tcp_hdr(skb);
	182
0198230b PM	183	return __cookie_v4_init_sequence(iph, th, mssp);
0198230b PM	184	}
1da177e4	185
e905a9ed YH	186	/*
e905a9ed YH	187	* Check if a ack sequence number is a valid syncookie.
1da177e4 LT	188	* Return the decoded mss if it is, or 0 if not.
1da177e4 LT	189	*/
0198230b PM	190	int __cookie_v4_check(const struct iphdr iph, const struct tcphdr th,
0198230b PM	191	u32 cookie)
1da177e4	192	{
aa8223c7 ACM	193	__u32 seq = ntohl(th->seq) - 1;
aa8223c7 ACM	194	__u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,
8c27bd75	195	th->source, th->dest, seq);
1da177e4	196
5918e2fb	197	return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
1da177e4	198	}
0198230b	199	EXPORT_SYMBOL_GPL(__cookie_v4_check);
1da177e4	200
b80c0e78 ED	201	struct sock tcp_get_cookie_sock(struct sock sk, struct sk_buff *skb,
b80c0e78 ED	202	struct request_sock *req,
84b114b9	203	struct dst_entry *dst, u32 tsoff)
1da177e4	204	{
8292a17a	205	struct inet_connection_sock *icsk = inet_csk(sk);
1da177e4	206	struct sock *child;
5e0724d0	207	bool own_req;
1da177e4	208
5e0724d0 ED	209	child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst,
5e0724d0 ED	210	NULL, &own_req);
0470c8ca	211	if (child) {
41c6d650	212	refcount_set(&req->rsk_refcnt, 1);
84b114b9	213	tcp_sk(child)->tsoffset = tsoff;
6bcfd7f8	214	sock_rps_save_rxhash(child, skb);
9466a1cc	215
0e8642cf	216	if (rsk_drop_req(req)) {
9d8c05ad	217	reqsk_put(req);
9466a1cc FW	218	return child;
	219	}
	220
9403cf23 GN	221	if (inet_csk_reqsk_queue_add(sk, req, child))
	222	return child;
	223
	224	bh_unlock_sock(child);
	225	sock_put(child);
0470c8ca	226	}
9403cf23 GN	227	__reqsk_free(req);
	228
	229	return NULL;
1da177e4	230	}
b80c0e78	231	EXPORT_SYMBOL(tcp_get_cookie_sock);
4dfc2817 FW	232
	233	/*
	234	* when syncookies are in effect and tcp timestamps are enabled we stored
	235	* additional tcp options in the timestamp.
	236	* This extracts these options from the timestamp echo.
	237	*
f1673381 FW	238	* return false if we decode a tcp option that is disabled
f1673381 FW	239	* on the host.
4dfc2817	240	*/
f9301034 ED	241	bool cookie_timestamp_decode(const struct net *net,
f9301034 ED	242	struct tcp_options_received *tcp_opt)
4dfc2817	243	{
734f614b	244	/* echoed timestamp, lowest bits contain options */
274e2da0	245	u32 options = tcp_opt->rcv_tsecr;
4dfc2817	246
8c763681 FW	247	if (!tcp_opt->saw_tstamp) {
	248	tcp_clear_options(tcp_opt);
	249	return true;
	250	}
	251
5d2ed052	252	if (!net->ipv4.sysctl_tcp_timestamps)
8c763681 FW	253	return false;
8c763681 FW	254
274e2da0	255	tcp_opt->sack_ok = (options & TS_OPT_SACK) ? TCP_SACK_SEEN : 0;
4dfc2817	256
f9301034	257	if (tcp_opt->sack_ok && !net->ipv4.sysctl_tcp_sack)
8c763681	258	return false;
4dfc2817	259
274e2da0	260	if ((options & TS_OPT_WSCALE_MASK) == TS_OPT_WSCALE_MASK)
734f614b FW	261	return true; /* no window scaling */
	262
	263	tcp_opt->wscale_ok = 1;
274e2da0 FW	264	tcp_opt->snd_wscale = options & TS_OPT_WSCALE_MASK;
274e2da0 FW	265
9bb37ef0	266	return net->ipv4.sysctl_tcp_window_scaling != 0;
4dfc2817	267	}
f1673381 FW	268	EXPORT_SYMBOL(cookie_timestamp_decode);
	269
	270	bool cookie_ecn_ok(const struct tcp_options_received *tcp_opt,
f7b3bec6	271	const struct net net, const struct dst_entry dst)
f1673381 FW	272	{
	273	bool ecn_ok = tcp_opt->rcv_tsecr & TS_OPT_ECN;
	274
	275	if (!ecn_ok)
	276	return false;
	277
	278	if (net->ipv4.sysctl_tcp_ecn)
	279	return true;
	280
f7b3bec6	281	return dst_feature(dst, RTAX_FEATURE_ECN);
f1673381 FW	282	}
f1673381 FW	283	EXPORT_SYMBOL(cookie_ecn_ok);
4dfc2817	284
6fc8c827 FW	285	struct request_sock cookie_tcp_reqsk_alloc(const struct request_sock_ops ops,
	286	struct sock *sk,
	287	struct sk_buff *skb)
	288	{
e9b12edc	289	struct tcp_request_sock *treq;
6fc8c827 FW	290	struct request_sock *req;
	291
	292	#ifdef CONFIG_MPTCP
	293	if (sk_is_mptcp(sk))
	294	ops = &mptcp_subflow_request_sock_ops;
	295	#endif
	296
	297	req = inet_reqsk_alloc(ops, sk, false);
	298	if (!req)
	299	return NULL;
	300
6fc8c827	301	treq = tcp_rsk(req);
e9b12edc WW	302	treq->syn_tos = TCP_SKB_CB(skb)->ip_dsfield;
e9b12edc WW	303	#if IS_ENABLED(CONFIG_MPTCP)
6fc8c827 FW	304	treq->is_mptcp = sk_is_mptcp(sk);
	305	if (treq->is_mptcp) {
	306	int err = mptcp_subflow_init_cookie_req(req, sk, skb);
	307
	308	if (err) {
	309	reqsk_free(req);
	310	return NULL;
	311	}
	312	}
	313	#endif
	314
	315	return req;
	316	}
	317	EXPORT_SYMBOL_GPL(cookie_tcp_reqsk_alloc);
	318
079096f1 ED	319	/* On input, sk is a listener.
	320	* Output is listener if incoming packet would not create a child
	321	* NULL if memory could not be allocated.
	322	*/
461b74c3	323	struct sock cookie_v4_check(struct sock sk, struct sk_buff *skb)
1da177e4	324	{
461b74c3	325	struct ip_options *opt = &TCP_SKB_CB(skb)->header.h4.opt;
4957faad	326	struct tcp_options_received tcp_opt;
2e6599cb ACM	327	struct inet_request_sock *ireq;
2e6599cb ACM	328	struct tcp_request_sock *treq;
1da177e4	329	struct tcp_sock *tp = tcp_sk(sk);
aa8223c7 ACM	330	const struct tcphdr *th = tcp_hdr(skb);
aa8223c7 ACM	331	__u32 cookie = ntohl(th->ack_seq) - 1;
1da177e4	332	struct sock *ret = sk;
e905a9ed	333	struct request_sock *req;
909172a1	334	int full_space, mss;
e905a9ed	335	struct rtable *rt;
1da177e4	336	__u8 rcv_wscale;
dfd25fff	337	struct flowi4 fl4;
84b114b9	338	u32 tsoff = 0;
1da177e4	339
12ed8244	340	if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies \|\| !th->ack \|\| th->rst)
1da177e4 LT	341	goto out;
1da177e4 LT	342
646697b9 FW	343	if (tcp_synq_no_recent_overflow(sk))
	344	goto out;
	345
	346	mss = __cookie_v4_check(ip_hdr(skb), th, cookie);
	347	if (mss == 0) {
02a1d6e7	348	__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
1da177e4 LT	349	goto out;
	350	}
	351
02a1d6e7	352	__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
1da177e4	353
bb5b7c11 DM	354	/* check for timestamp cookie support */
bb5b7c11 DM	355	memset(&tcp_opt, 0, sizeof(tcp_opt));
eed29f17	356	tcp_parse_options(sock_net(sk), skb, &tcp_opt, 0, NULL);
bb5b7c11	357
84b114b9	358	if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) {
5d2ed052 ED	359	tsoff = secure_tcp_ts_off(sock_net(sk),
	360	ip_hdr(skb)->daddr,
	361	ip_hdr(skb)->saddr);
84b114b9 ED	362	tcp_opt.rcv_tsecr -= tsoff;
	363	}
	364
f9301034	365	if (!cookie_timestamp_decode(sock_net(sk), &tcp_opt))
8c763681	366	goto out;
bb5b7c11	367
1da177e4	368	ret = NULL;
6fc8c827	369	req = cookie_tcp_reqsk_alloc(&tcp_request_sock_ops, sk, skb);
1da177e4 LT	370	if (!req)
	371	goto out;
	372
2e6599cb ACM	373	ireq = inet_rsk(req);
2e6599cb ACM	374	treq = tcp_rsk(req);
aa8223c7	375	treq->rcv_isn = ntohl(th->seq) - 1;
e905a9ed	376	treq->snt_isn = cookie;
95a22cae	377	treq->ts_off = 0;
18bcf290	378	treq->txhash = net_tx_rndhash();
1da177e4	379	req->mss = mss;
b44084c2 ED	380	ireq->ir_num = ntohs(th->dest);
b44084c2 ED	381	ireq->ir_rmt_port = th->source;
08d2cc3b ED	382	sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr);
08d2cc3b ED	383	sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr);
84f39b08	384	ireq->ir_mark = inet_request_mark(sk, skb);
bb5b7c11	385	ireq->snd_wscale = tcp_opt.snd_wscale;
bb5b7c11 DM	386	ireq->sack_ok = tcp_opt.sack_ok;
	387	ireq->wscale_ok = tcp_opt.wscale_ok;
	388	ireq->tstamp_ok = tcp_opt.saw_tstamp;
	389	req->ts_recent = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
9a568de4	390	treq->snt_synack = 0;
9439ce00	391	treq->tfo_listener = false;
ae2dd716	392
bc58a1ba HW	393	if (IS_ENABLED(CONFIG_SMC))
bc58a1ba HW	394	ireq->smc_ok = 0;
1da177e4	395
6dd9a14e	396	ireq->ir_iif = inet_request_bound_dev_if(sk, skb);
16f86165	397
1da177e4 LT	398	/* We throwed the options of the initial SYN away, so we hope
	399	* the ACK carries the same options again (see RFC1122 4.2.3.8)
	400	*/
c92e8c02	401	RCU_INIT_POINTER(ireq->ireq_opt, tcp_v4_save_options(sock_net(sk), skb));
1da177e4	402
284904aa	403	if (security_inet_conn_request(sk, skb, req)) {
0470c8ca	404	reqsk_free(req);
284904aa PM	405	goto out;
	406	}
	407
e6c022a4	408	req->num_retrans = 0;
e905a9ed	409
1da177e4 LT	410	/*
	411	* We need to lookup the route here to get at the correct
	412	* window size. We should better make sure that the window size
	413	* hasn't changed since we received the original syn, but I see
e905a9ed	414	* no easy way to do this.
1da177e4	415	*/
6dd9a14e	416	flowi4_init_output(&fl4, ireq->ir_iif, ireq->ir_mark,
d66954a0	417	RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP,
dfd25fff	418	inet_sk_flowi_flags(sk),
461b74c3	419	opt->srr ? opt->faddr : ireq->ir_rmt_addr,
e2d118a1	420	ireq->ir_loc_addr, th->source, th->dest, sk->sk_uid);
3df98d79	421	security_req_classify_flow(req, flowi4_to_flowi_common(&fl4));
dfd25fff ED	422	rt = ip_route_output_key(sock_net(sk), &fl4);
dfd25fff ED	423	if (IS_ERR(rt)) {
0470c8ca	424	reqsk_free(req);
dfd25fff	425	goto out;
1da177e4 LT	426	}
	427
	428	/* Try to redo what tcp_v4_send_synack did. */
ed53d0ab	429	req->rsk_window_clamp = tp->window_clamp ? :dst_metric(&rt->dst, RTAX_WINDOW);
909172a1 MW	430	/* limit the window selection if the user enforce a smaller rx buffer */
	431	full_space = tcp_full_space(sk);
	432	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
	433	(req->rsk_window_clamp > full_space \|\| req->rsk_window_clamp == 0))
	434	req->rsk_window_clamp = full_space;
4dfc2817	435
909172a1	436	tcp_select_initial_window(sk, full_space, req->mss,
ed53d0ab	437	&req->rsk_rcv_wnd, &req->rsk_window_clamp,
31d12926	438	ireq->wscale_ok, &rcv_wscale,
d8d1f30b	439	dst_metric(&rt->dst, RTAX_INITRWND));
4dfc2817	440
e905a9ed	441	ireq->rcv_wscale = rcv_wscale;
f7b3bec6	442	ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk), &rt->dst);
1da177e4	443
84b114b9	444	ret = tcp_get_cookie_sock(sk, skb, req, &rt->dst, tsoff);
dfd25fff ED	445	/* ip_queue_xmit() depends on our flow being setup
	446	* Normal sockets get it right from inet_csk_route_child_sock()
	447	*/
	448	if (ret)
	449	inet_sk(ret)->cork.fl.u.ip4 = fl4;
1da177e4 LT	450	out: return ret;
1da177e4 LT	451	}