1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21#include <linux/mm.h>
22#include <linux/module.h>
23#include <linux/slab.h>
24#include <linux/sysctl.h>
25#include <linux/workqueue.h>
26#include <net/tcp.h>
27#include <net/inet_common.h>
28#include <net/xfrm.h>
29
30int sysctl_tcp_syncookies __read_mostly = 1;
31EXPORT_SYMBOL(sysctl_tcp_syncookies);
32
33int sysctl_tcp_abort_on_overflow __read_mostly;
34
35struct inet_timewait_death_row tcp_death_row = {
36 .sysctl_max_tw_buckets = NR_FILE * 2,
37 .period = TCP_TIMEWAIT_LEN / INET_TWDR_TWKILL_SLOTS,
38 .death_lock = __SPIN_LOCK_UNLOCKED(tcp_death_row.death_lock),
39 .hashinfo = &tcp_hashinfo,
40 .tw_timer = TIMER_INITIALIZER(inet_twdr_hangman, 0,
41 (unsigned long)&tcp_death_row),
42 .twkill_work = __WORK_INITIALIZER(tcp_death_row.twkill_work,
43 inet_twdr_twkill_work),
44
45
46 .twcal_hand = -1,
47 .twcal_timer = TIMER_INITIALIZER(inet_twdr_twcal_tick, 0,
48 (unsigned long)&tcp_death_row),
49};
50EXPORT_SYMBOL_GPL(tcp_death_row);
51
52static bool tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
53{
54 if (seq == s_win)
55 return true;
56 if (after(end_seq, s_win) && before(seq, e_win))
57 return true;
58 return seq == e_win && seq == end_seq;
59}
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91enum tcp_tw_status
92tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
93 const struct tcphdr *th)
94{
95 struct tcp_options_received tmp_opt;
96 struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
97 bool paws_reject = false;
98
99 tmp_opt.saw_tstamp = 0;
100 if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
101 tcp_parse_options(skb, &tmp_opt, 0, NULL);
102
103 if (tmp_opt.saw_tstamp) {
104 tmp_opt.rcv_tsecr -= tcptw->tw_ts_offset;
105 tmp_opt.ts_recent = tcptw->tw_ts_recent;
106 tmp_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
107 paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
108 }
109 }
110
111 if (tw->tw_substate == TCP_FIN_WAIT2) {
112
113
114
115 if (paws_reject ||
116 !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
117 tcptw->tw_rcv_nxt,
118 tcptw->tw_rcv_nxt + tcptw->tw_rcv_wnd))
119 return TCP_TW_ACK;
120
121 if (th->rst)
122 goto kill;
123
124 if (th->syn && !before(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt))
125 goto kill_with_rst;
126
127
128 if (!th->ack ||
129 !after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
130 TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
131 inet_twsk_put(tw);
132 return TCP_TW_SUCCESS;
133 }
134
135
136
137
138 if (!th->fin ||
139 TCP_SKB_CB(skb)->end_seq != tcptw->tw_rcv_nxt + 1) {
140kill_with_rst:
141 inet_twsk_deschedule(tw, &tcp_death_row);
142 inet_twsk_put(tw);
143 return TCP_TW_RST;
144 }
145
146
147 tw->tw_substate = TCP_TIME_WAIT;
148 tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
149 if (tmp_opt.saw_tstamp) {
150 tcptw->tw_ts_recent_stamp = get_seconds();
151 tcptw->tw_ts_recent = tmp_opt.rcv_tsval;
152 }
153
154 if (tcp_death_row.sysctl_tw_recycle &&
155 tcptw->tw_ts_recent_stamp &&
156 tcp_tw_remember_stamp(tw))
157 inet_twsk_schedule(tw, &tcp_death_row, tw->tw_timeout,
158 TCP_TIMEWAIT_LEN);
159 else
160 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
161 TCP_TIMEWAIT_LEN);
162 return TCP_TW_ACK;
163 }
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182 if (!paws_reject &&
183 (TCP_SKB_CB(skb)->seq == tcptw->tw_rcv_nxt &&
184 (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq || th->rst))) {
185
186
187 if (th->rst) {
188
189
190
191
192 if (sysctl_tcp_rfc1337 == 0) {
193kill:
194 inet_twsk_deschedule(tw, &tcp_death_row);
195 inet_twsk_put(tw);
196 return TCP_TW_SUCCESS;
197 }
198 }
199 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
200 TCP_TIMEWAIT_LEN);
201
202 if (tmp_opt.saw_tstamp) {
203 tcptw->tw_ts_recent = tmp_opt.rcv_tsval;
204 tcptw->tw_ts_recent_stamp = get_seconds();
205 }
206
207 inet_twsk_put(tw);
208 return TCP_TW_SUCCESS;
209 }
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228 if (th->syn && !th->rst && !th->ack && !paws_reject &&
229 (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) ||
230 (tmp_opt.saw_tstamp &&
231 (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) {
232 u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
233 if (isn == 0)
234 isn++;
235 TCP_SKB_CB(skb)->when = isn;
236 return TCP_TW_SYN;
237 }
238
239 if (paws_reject)
240 NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_PAWSESTABREJECTED);
241
242 if (!th->rst) {
243
244
245
246
247
248
249 if (paws_reject || th->ack)
250 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
251 TCP_TIMEWAIT_LEN);
252
253
254
255
256 return TCP_TW_ACK;
257 }
258 inet_twsk_put(tw);
259 return TCP_TW_SUCCESS;
260}
261EXPORT_SYMBOL(tcp_timewait_state_process);
262
263
264
265
266void tcp_time_wait(struct sock *sk, int state, int timeo)
267{
268 struct inet_timewait_sock *tw = NULL;
269 const struct inet_connection_sock *icsk = inet_csk(sk);
270 const struct tcp_sock *tp = tcp_sk(sk);
271 bool recycle_ok = false;
272
273 if (tcp_death_row.sysctl_tw_recycle && tp->rx_opt.ts_recent_stamp)
274 recycle_ok = tcp_remember_stamp(sk);
275
276 if (tcp_death_row.tw_count < tcp_death_row.sysctl_max_tw_buckets)
277 tw = inet_twsk_alloc(sk, state);
278
279 if (tw != NULL) {
280 struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
281 const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
282 struct inet_sock *inet = inet_sk(sk);
283
284 tw->tw_transparent = inet->transparent;
285 tw->tw_rcv_wscale = tp->rx_opt.rcv_wscale;
286 tcptw->tw_rcv_nxt = tp->rcv_nxt;
287 tcptw->tw_snd_nxt = tp->snd_nxt;
288 tcptw->tw_rcv_wnd = tcp_receive_window(tp);
289 tcptw->tw_ts_recent = tp->rx_opt.ts_recent;
290 tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
291 tcptw->tw_ts_offset = tp->tsoffset;
292
293#if IS_ENABLED(CONFIG_IPV6)
294 if (tw->tw_family == PF_INET6) {
295 struct ipv6_pinfo *np = inet6_sk(sk);
296 struct inet6_timewait_sock *tw6;
297
298 tw->tw_ipv6_offset = inet6_tw_offset(sk->sk_prot);
299 tw6 = inet6_twsk((struct sock *)tw);
300 tw6->tw_v6_daddr = np->daddr;
301 tw6->tw_v6_rcv_saddr = np->rcv_saddr;
302 tw->tw_tclass = np->tclass;
303 tw->tw_ipv6only = np->ipv6only;
304 }
305#endif
306
307#ifdef CONFIG_TCP_MD5SIG
308
309
310
311
312
313
314 do {
315 struct tcp_md5sig_key *key;
316 tcptw->tw_md5_key = NULL;
317 key = tp->af_specific->md5_lookup(sk, sk);
318 if (key != NULL) {
319 tcptw->tw_md5_key = kmemdup(key, sizeof(*key), GFP_ATOMIC);
320 if (tcptw->tw_md5_key && !tcp_alloc_md5sig_pool())
321 BUG();
322 }
323 } while (0);
324#endif
325
326
327 __inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
328
329
330 if (timeo < rto)
331 timeo = rto;
332
333 if (recycle_ok) {
334 tw->tw_timeout = rto;
335 } else {
336 tw->tw_timeout = TCP_TIMEWAIT_LEN;
337 if (state == TCP_TIME_WAIT)
338 timeo = TCP_TIMEWAIT_LEN;
339 }
340
341 inet_twsk_schedule(tw, &tcp_death_row, timeo,
342 TCP_TIMEWAIT_LEN);
343 inet_twsk_put(tw);
344 } else {
345
346
347
348
349 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPTIMEWAITOVERFLOW);
350 }
351
352 tcp_update_metrics(sk);
353 tcp_done(sk);
354}
355
356void tcp_twsk_destructor(struct sock *sk)
357{
358#ifdef CONFIG_TCP_MD5SIG
359 struct tcp_timewait_sock *twsk = tcp_twsk(sk);
360
361 if (twsk->tw_md5_key)
362 kfree_rcu(twsk->tw_md5_key, rcu);
363#endif
364}
365EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
366
367static inline void TCP_ECN_openreq_child(struct tcp_sock *tp,
368 struct request_sock *req)
369{
370 tp->ecn_flags = inet_rsk(req)->ecn_ok ? TCP_ECN_OK : 0;
371}
372
373
374
375
376
377
378
379struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb)
380{
381 struct sock *newsk = inet_csk_clone_lock(sk, req, GFP_ATOMIC);
382
383 if (newsk != NULL) {
384 const struct inet_request_sock *ireq = inet_rsk(req);
385 struct tcp_request_sock *treq = tcp_rsk(req);
386 struct inet_connection_sock *newicsk = inet_csk(newsk);
387 struct tcp_sock *newtp = tcp_sk(newsk);
388
389
390 newtp->pred_flags = 0;
391
392 newtp->rcv_wup = newtp->copied_seq =
393 newtp->rcv_nxt = treq->rcv_isn + 1;
394
395 newtp->snd_sml = newtp->snd_una =
396 newtp->snd_nxt = newtp->snd_up = treq->snt_isn + 1;
397
398 tcp_prequeue_init(newtp);
399 INIT_LIST_HEAD(&newtp->tsq_node);
400
401 tcp_init_wl(newtp, treq->rcv_isn);
402
403 newtp->srtt = 0;
404 newtp->mdev = TCP_TIMEOUT_INIT;
405 newicsk->icsk_rto = TCP_TIMEOUT_INIT;
406
407 newtp->packets_out = 0;
408 newtp->retrans_out = 0;
409 newtp->sacked_out = 0;
410 newtp->fackets_out = 0;
411 newtp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
412 tcp_enable_early_retrans(newtp);
413 newtp->tlp_high_seq = 0;
414
415
416
417
418
419
420 newtp->snd_cwnd = TCP_INIT_CWND;
421 newtp->snd_cwnd_cnt = 0;
422
423 if (newicsk->icsk_ca_ops != &tcp_init_congestion_ops &&
424 !try_module_get(newicsk->icsk_ca_ops->owner))
425 newicsk->icsk_ca_ops = &tcp_init_congestion_ops;
426
427 tcp_set_ca_state(newsk, TCP_CA_Open);
428 tcp_init_xmit_timers(newsk);
429 skb_queue_head_init(&newtp->out_of_order_queue);
430 newtp->write_seq = newtp->pushed_seq = treq->snt_isn + 1;
431
432 newtp->rx_opt.saw_tstamp = 0;
433
434 newtp->rx_opt.dsack = 0;
435 newtp->rx_opt.num_sacks = 0;
436
437 newtp->urg_data = 0;
438
439 if (sock_flag(newsk, SOCK_KEEPOPEN))
440 inet_csk_reset_keepalive_timer(newsk,
441 keepalive_time_when(newtp));
442
443 newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
444 if ((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
445 if (sysctl_tcp_fack)
446 tcp_enable_fack(newtp);
447 }
448 newtp->window_clamp = req->window_clamp;
449 newtp->rcv_ssthresh = req->rcv_wnd;
450 newtp->rcv_wnd = req->rcv_wnd;
451 newtp->rx_opt.wscale_ok = ireq->wscale_ok;
452 if (newtp->rx_opt.wscale_ok) {
453 newtp->rx_opt.snd_wscale = ireq->snd_wscale;
454 newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
455 } else {
456 newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
457 newtp->window_clamp = min(newtp->window_clamp, 65535U);
458 }
459 newtp->snd_wnd = (ntohs(tcp_hdr(skb)->window) <<
460 newtp->rx_opt.snd_wscale);
461 newtp->max_window = newtp->snd_wnd;
462
463 if (newtp->rx_opt.tstamp_ok) {
464 newtp->rx_opt.ts_recent = req->ts_recent;
465 newtp->rx_opt.ts_recent_stamp = get_seconds();
466 newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
467 } else {
468 newtp->rx_opt.ts_recent_stamp = 0;
469 newtp->tcp_header_len = sizeof(struct tcphdr);
470 }
471 newtp->tsoffset = 0;
472#ifdef CONFIG_TCP_MD5SIG
473 newtp->md5sig_info = NULL;
474 if (newtp->af_specific->md5_lookup(sk, newsk))
475 newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
476#endif
477 if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
478 newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
479 newtp->rx_opt.mss_clamp = req->mss;
480 TCP_ECN_openreq_child(newtp, req);
481 newtp->fastopen_rsk = NULL;
482 newtp->syn_data_acked = 0;
483
484 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_PASSIVEOPENS);
485 }
486 return newsk;
487}
488EXPORT_SYMBOL(tcp_create_openreq_child);
489
490
491
492
493
494
495
496
497
498
499
500
501struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
502 struct request_sock *req,
503 struct request_sock **prev,
504 bool fastopen)
505{
506 struct tcp_options_received tmp_opt;
507 struct sock *child;
508 const struct tcphdr *th = tcp_hdr(skb);
509 __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
510 bool paws_reject = false;
511
512 BUG_ON(fastopen == (sk->sk_state == TCP_LISTEN));
513
514 tmp_opt.saw_tstamp = 0;
515 if (th->doff > (sizeof(struct tcphdr)>>2)) {
516 tcp_parse_options(skb, &tmp_opt, 0, NULL);
517
518 if (tmp_opt.saw_tstamp) {
519 tmp_opt.ts_recent = req->ts_recent;
520
521
522
523
524 tmp_opt.ts_recent_stamp = get_seconds() - ((TCP_TIMEOUT_INIT/HZ)<<req->num_timeout);
525 paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
526 }
527 }
528
529
530 if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
531 flg == TCP_FLAG_SYN &&
532 !paws_reject) {
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556 if (!inet_rtx_syn_ack(sk, req))
557 req->expires = min(TCP_TIMEOUT_INIT << req->num_timeout,
558 TCP_RTO_MAX) + jiffies;
559 return NULL;
560 }
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619 if ((flg & TCP_FLAG_ACK) && !fastopen &&
620 (TCP_SKB_CB(skb)->ack_seq !=
621 tcp_rsk(req)->snt_isn + 1))
622 return sk;
623
624
625
626
627
628
629
630
631 if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
632 tcp_rsk(req)->rcv_nxt, tcp_rsk(req)->rcv_nxt + req->rcv_wnd)) {
633
634 if (!(flg & TCP_FLAG_RST))
635 req->rsk_ops->send_ack(sk, skb, req);
636 if (paws_reject)
637 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
638 return NULL;
639 }
640
641
642
643 if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt))
644 req->ts_recent = tmp_opt.rcv_tsval;
645
646 if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
647
648
649 flg &= ~TCP_FLAG_SYN;
650 }
651
652
653
654
655 if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
656 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
657 goto embryonic_reset;
658 }
659
660
661
662
663
664
665
666 if (!(flg & TCP_FLAG_ACK))
667 return NULL;
668
669
670 if (tmp_opt.saw_tstamp && tmp_opt.rcv_tsecr)
671 tcp_rsk(req)->snt_synack = tmp_opt.rcv_tsecr;
672 else if (req->num_retrans)
673 tcp_rsk(req)->snt_synack = 0;
674
675
676
677
678 if (fastopen)
679 return sk;
680
681
682 if (req->num_timeout < inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
683 TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
684 inet_rsk(req)->acked = 1;
685 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPDEFERACCEPTDROP);
686 return NULL;
687 }
688
689
690
691
692
693
694
695 child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL);
696 if (child == NULL)
697 goto listen_overflow;
698
699 inet_csk_reqsk_queue_unlink(sk, req, prev);
700 inet_csk_reqsk_queue_removed(sk, req);
701
702 inet_csk_reqsk_queue_add(sk, req, child);
703 return child;
704
705listen_overflow:
706 if (!sysctl_tcp_abort_on_overflow) {
707 inet_rsk(req)->acked = 1;
708 return NULL;
709 }
710
711embryonic_reset:
712 if (!(flg & TCP_FLAG_RST)) {
713
714
715
716
717
718 req->rsk_ops->send_reset(sk, skb);
719 } else if (fastopen) {
720 reqsk_fastopen_remove(sk, req, true);
721 tcp_reset(sk);
722 }
723 if (!fastopen) {
724 inet_csk_reqsk_queue_drop(sk, req, prev);
725 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
726 }
727 return NULL;
728}
729EXPORT_SYMBOL(tcp_check_req);
730
731
732
733
734
735
736
737
738
739
740
741
742
743int tcp_child_process(struct sock *parent, struct sock *child,
744 struct sk_buff *skb)
745{
746 int ret = 0;
747 int state = child->sk_state;
748
749 if (!sock_owned_by_user(child)) {
750 ret = tcp_rcv_state_process(child, skb, tcp_hdr(skb),
751 skb->len);
752
753 if (state == TCP_SYN_RECV && child->sk_state != state)
754 parent->sk_data_ready(parent, 0);
755 } else {
756
757
758
759
760 __sk_add_backlog(child, skb);
761 }
762
763 bh_unlock_sock(child);
764 sock_put(child);
765 return ret;
766}
767EXPORT_SYMBOL(tcp_child_process);
768