xref: /linux/net/ipv4/tcp_minisocks.c (revision 1a9239bb4253f9076b5b4b2a1a4e8d7defd77a95)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * INET		An implementation of the TCP/IP protocol suite for the LINUX
4  *		operating system.  INET is implemented using the  BSD Socket
5  *		interface as the means of communication with the user level.
6  *
7  *		Implementation of the Transmission Control Protocol(TCP).
8  *
9  * Authors:	Ross Biro
10  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
11  *		Mark Evans, <evansmp@uhura.aston.ac.uk>
12  *		Corey Minyard <wf-rch!minyard@relay.EU.net>
13  *		Florian La Roche, <flla@stud.uni-sb.de>
14  *		Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
15  *		Linus Torvalds, <torvalds@cs.helsinki.fi>
16  *		Alan Cox, <gw4pts@gw4pts.ampr.org>
17  *		Matthew Dillon, <dillon@apollo.west.oic.com>
18  *		Arnt Gulbrandsen, <agulbra@nvg.unit.no>
19  *		Jorge Cwik, <jorge@laser.satlink.net>
20  */
21 
22 #include <net/tcp.h>
23 #include <net/xfrm.h>
24 #include <net/busy_poll.h>
25 #include <net/rstreason.h>
26 
tcp_in_window(u32 seq,u32 end_seq,u32 s_win,u32 e_win)27 static bool tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
28 {
29 	if (seq == s_win)
30 		return true;
31 	if (after(end_seq, s_win) && before(seq, e_win))
32 		return true;
33 	return seq == e_win && seq == end_seq;
34 }
35 
36 static enum tcp_tw_status
tcp_timewait_check_oow_rate_limit(struct inet_timewait_sock * tw,const struct sk_buff * skb,int mib_idx)37 tcp_timewait_check_oow_rate_limit(struct inet_timewait_sock *tw,
38 				  const struct sk_buff *skb, int mib_idx)
39 {
40 	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
41 
42 	if (!tcp_oow_rate_limited(twsk_net(tw), skb, mib_idx,
43 				  &tcptw->tw_last_oow_ack_time)) {
44 		/* Send ACK. Note, we do not put the bucket,
45 		 * it will be released by caller.
46 		 */
47 		return TCP_TW_ACK_OOW;
48 	}
49 
50 	/* We are rate-limiting, so just release the tw sock and drop skb. */
51 	inet_twsk_put(tw);
52 	return TCP_TW_SUCCESS;
53 }
54 
twsk_rcv_nxt_update(struct tcp_timewait_sock * tcptw,u32 seq,u32 rcv_nxt)55 static void twsk_rcv_nxt_update(struct tcp_timewait_sock *tcptw, u32 seq,
56 				u32 rcv_nxt)
57 {
58 #ifdef CONFIG_TCP_AO
59 	struct tcp_ao_info *ao;
60 
61 	ao = rcu_dereference(tcptw->ao_info);
62 	if (unlikely(ao && seq < rcv_nxt))
63 		WRITE_ONCE(ao->rcv_sne, ao->rcv_sne + 1);
64 #endif
65 	WRITE_ONCE(tcptw->tw_rcv_nxt, seq);
66 }
67 
68 /*
69  * * Main purpose of TIME-WAIT state is to close connection gracefully,
70  *   when one of ends sits in LAST-ACK or CLOSING retransmitting FIN
71  *   (and, probably, tail of data) and one or more our ACKs are lost.
72  * * What is TIME-WAIT timeout? It is associated with maximal packet
73  *   lifetime in the internet, which results in wrong conclusion, that
74  *   it is set to catch "old duplicate segments" wandering out of their path.
75  *   It is not quite correct. This timeout is calculated so that it exceeds
76  *   maximal retransmission timeout enough to allow to lose one (or more)
77  *   segments sent by peer and our ACKs. This time may be calculated from RTO.
78  * * When TIME-WAIT socket receives RST, it means that another end
79  *   finally closed and we are allowed to kill TIME-WAIT too.
80  * * Second purpose of TIME-WAIT is catching old duplicate segments.
81  *   Well, certainly it is pure paranoia, but if we load TIME-WAIT
82  *   with this semantics, we MUST NOT kill TIME-WAIT state with RSTs.
83  * * If we invented some more clever way to catch duplicates
84  *   (f.e. based on PAWS), we could truncate TIME-WAIT to several RTOs.
85  *
86  * The algorithm below is based on FORMAL INTERPRETATION of RFCs.
87  * When you compare it to RFCs, please, read section SEGMENT ARRIVES
88  * from the very beginning.
89  *
90  * NOTE. With recycling (and later with fin-wait-2) TW bucket
91  * is _not_ stateless. It means, that strictly speaking we must
92  * spinlock it. I do not want! Well, probability of misbehaviour
93  * is ridiculously low and, seems, we could use some mb() tricks
94  * to avoid misread sequence numbers, states etc.  --ANK
95  *
96  * We don't need to initialize tmp_out.sack_ok as we don't use the results
97  */
98 enum tcp_tw_status
tcp_timewait_state_process(struct inet_timewait_sock * tw,struct sk_buff * skb,const struct tcphdr * th,u32 * tw_isn)99 tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
100 			   const struct tcphdr *th, u32 *tw_isn)
101 {
102 	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
103 	u32 rcv_nxt = READ_ONCE(tcptw->tw_rcv_nxt);
104 	struct tcp_options_received tmp_opt;
105 	bool paws_reject = false;
106 	int ts_recent_stamp;
107 
108 	tmp_opt.saw_tstamp = 0;
109 	ts_recent_stamp = READ_ONCE(tcptw->tw_ts_recent_stamp);
110 	if (th->doff > (sizeof(*th) >> 2) && ts_recent_stamp) {
111 		tcp_parse_options(twsk_net(tw), skb, &tmp_opt, 0, NULL);
112 
113 		if (tmp_opt.saw_tstamp) {
114 			if (tmp_opt.rcv_tsecr)
115 				tmp_opt.rcv_tsecr -= tcptw->tw_ts_offset;
116 			tmp_opt.ts_recent	= READ_ONCE(tcptw->tw_ts_recent);
117 			tmp_opt.ts_recent_stamp	= ts_recent_stamp;
118 			paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
119 		}
120 	}
121 
122 	if (READ_ONCE(tw->tw_substate) == TCP_FIN_WAIT2) {
123 		/* Just repeat all the checks of tcp_rcv_state_process() */
124 
125 		/* Out of window, send ACK */
126 		if (paws_reject ||
127 		    !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
128 				   rcv_nxt,
129 				   rcv_nxt + tcptw->tw_rcv_wnd))
130 			return tcp_timewait_check_oow_rate_limit(
131 				tw, skb, LINUX_MIB_TCPACKSKIPPEDFINWAIT2);
132 
133 		if (th->rst)
134 			goto kill;
135 
136 		if (th->syn && !before(TCP_SKB_CB(skb)->seq, rcv_nxt))
137 			return TCP_TW_RST;
138 
139 		/* Dup ACK? */
140 		if (!th->ack ||
141 		    !after(TCP_SKB_CB(skb)->end_seq, rcv_nxt) ||
142 		    TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
143 			inet_twsk_put(tw);
144 			return TCP_TW_SUCCESS;
145 		}
146 
147 		/* New data or FIN. If new data arrive after half-duplex close,
148 		 * reset.
149 		 */
150 		if (!th->fin ||
151 		    TCP_SKB_CB(skb)->end_seq != rcv_nxt + 1)
152 			return TCP_TW_RST;
153 
154 		/* FIN arrived, enter true time-wait state. */
155 		WRITE_ONCE(tw->tw_substate, TCP_TIME_WAIT);
156 		twsk_rcv_nxt_update(tcptw, TCP_SKB_CB(skb)->end_seq,
157 				    rcv_nxt);
158 
159 		if (tmp_opt.saw_tstamp) {
160 			u64 ts = tcp_clock_ms();
161 
162 			WRITE_ONCE(tw->tw_entry_stamp, ts);
163 			WRITE_ONCE(tcptw->tw_ts_recent_stamp,
164 				   div_u64(ts, MSEC_PER_SEC));
165 			WRITE_ONCE(tcptw->tw_ts_recent,
166 				   tmp_opt.rcv_tsval);
167 		}
168 
169 		inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
170 		return TCP_TW_ACK;
171 	}
172 
173 	/*
174 	 *	Now real TIME-WAIT state.
175 	 *
176 	 *	RFC 1122:
177 	 *	"When a connection is [...] on TIME-WAIT state [...]
178 	 *	[a TCP] MAY accept a new SYN from the remote TCP to
179 	 *	reopen the connection directly, if it:
180 	 *
181 	 *	(1)  assigns its initial sequence number for the new
182 	 *	connection to be larger than the largest sequence
183 	 *	number it used on the previous connection incarnation,
184 	 *	and
185 	 *
186 	 *	(2)  returns to TIME-WAIT state if the SYN turns out
187 	 *	to be an old duplicate".
188 	 */
189 
190 	if (!paws_reject &&
191 	    (TCP_SKB_CB(skb)->seq == rcv_nxt &&
192 	     (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq || th->rst))) {
193 		/* In window segment, it may be only reset or bare ack. */
194 
195 		if (th->rst) {
196 			/* This is TIME_WAIT assassination, in two flavors.
197 			 * Oh well... nobody has a sufficient solution to this
198 			 * protocol bug yet.
199 			 */
200 			if (!READ_ONCE(twsk_net(tw)->ipv4.sysctl_tcp_rfc1337)) {
201 kill:
202 				inet_twsk_deschedule_put(tw);
203 				return TCP_TW_SUCCESS;
204 			}
205 		} else {
206 			inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
207 		}
208 
209 		if (tmp_opt.saw_tstamp) {
210 			WRITE_ONCE(tcptw->tw_ts_recent,
211 				   tmp_opt.rcv_tsval);
212 			WRITE_ONCE(tcptw->tw_ts_recent_stamp,
213 				   ktime_get_seconds());
214 		}
215 
216 		inet_twsk_put(tw);
217 		return TCP_TW_SUCCESS;
218 	}
219 
220 	/* Out of window segment.
221 
222 	   All the segments are ACKed immediately.
223 
224 	   The only exception is new SYN. We accept it, if it is
225 	   not old duplicate and we are not in danger to be killed
226 	   by delayed old duplicates. RFC check is that it has
227 	   newer sequence number works at rates <40Mbit/sec.
228 	   However, if paws works, it is reliable AND even more,
229 	   we even may relax silly seq space cutoff.
230 
231 	   RED-PEN: we violate main RFC requirement, if this SYN will appear
232 	   old duplicate (i.e. we receive RST in reply to SYN-ACK),
233 	   we must return socket to time-wait state. It is not good,
234 	   but not fatal yet.
235 	 */
236 
237 	if (th->syn && !th->rst && !th->ack && !paws_reject &&
238 	    (after(TCP_SKB_CB(skb)->seq, rcv_nxt) ||
239 	     (tmp_opt.saw_tstamp &&
240 	      (s32)(READ_ONCE(tcptw->tw_ts_recent) - tmp_opt.rcv_tsval) < 0))) {
241 		u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
242 		if (isn == 0)
243 			isn++;
244 		*tw_isn = isn;
245 		return TCP_TW_SYN;
246 	}
247 
248 	if (paws_reject)
249 		__NET_INC_STATS(twsk_net(tw), LINUX_MIB_PAWSESTABREJECTED);
250 
251 	if (!th->rst) {
252 		/* In this case we must reset the TIMEWAIT timer.
253 		 *
254 		 * If it is ACKless SYN it may be both old duplicate
255 		 * and new good SYN with random sequence number <rcv_nxt.
256 		 * Do not reschedule in the last case.
257 		 */
258 		if (paws_reject || th->ack)
259 			inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
260 
261 		return tcp_timewait_check_oow_rate_limit(
262 			tw, skb, LINUX_MIB_TCPACKSKIPPEDTIMEWAIT);
263 	}
264 	inet_twsk_put(tw);
265 	return TCP_TW_SUCCESS;
266 }
267 EXPORT_IPV6_MOD(tcp_timewait_state_process);
268 
tcp_time_wait_init(struct sock * sk,struct tcp_timewait_sock * tcptw)269 static void tcp_time_wait_init(struct sock *sk, struct tcp_timewait_sock *tcptw)
270 {
271 #ifdef CONFIG_TCP_MD5SIG
272 	const struct tcp_sock *tp = tcp_sk(sk);
273 	struct tcp_md5sig_key *key;
274 
275 	/*
276 	 * The timewait bucket does not have the key DB from the
277 	 * sock structure. We just make a quick copy of the
278 	 * md5 key being used (if indeed we are using one)
279 	 * so the timewait ack generating code has the key.
280 	 */
281 	tcptw->tw_md5_key = NULL;
282 	if (!static_branch_unlikely(&tcp_md5_needed.key))
283 		return;
284 
285 	key = tp->af_specific->md5_lookup(sk, sk);
286 	if (key) {
287 		tcptw->tw_md5_key = kmemdup(key, sizeof(*key), GFP_ATOMIC);
288 		if (!tcptw->tw_md5_key)
289 			return;
290 		if (!static_key_fast_inc_not_disabled(&tcp_md5_needed.key.key))
291 			goto out_free;
292 		tcp_md5_add_sigpool();
293 	}
294 	return;
295 out_free:
296 	WARN_ON_ONCE(1);
297 	kfree(tcptw->tw_md5_key);
298 	tcptw->tw_md5_key = NULL;
299 #endif
300 }
301 
302 /*
303  * Move a socket to time-wait or dead fin-wait-2 state.
304  */
tcp_time_wait(struct sock * sk,int state,int timeo)305 void tcp_time_wait(struct sock *sk, int state, int timeo)
306 {
307 	const struct inet_connection_sock *icsk = inet_csk(sk);
308 	struct tcp_sock *tp = tcp_sk(sk);
309 	struct net *net = sock_net(sk);
310 	struct inet_timewait_sock *tw;
311 
312 	tw = inet_twsk_alloc(sk, &net->ipv4.tcp_death_row, state);
313 
314 	if (tw) {
315 		struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
316 		const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
317 
318 		tw->tw_transparent	= inet_test_bit(TRANSPARENT, sk);
319 		tw->tw_mark		= sk->sk_mark;
320 		tw->tw_priority		= READ_ONCE(sk->sk_priority);
321 		tw->tw_rcv_wscale	= tp->rx_opt.rcv_wscale;
322 		/* refreshed when we enter true TIME-WAIT state */
323 		tw->tw_entry_stamp	= tcp_time_stamp_ms(tp);
324 		tcptw->tw_rcv_nxt	= tp->rcv_nxt;
325 		tcptw->tw_snd_nxt	= tp->snd_nxt;
326 		tcptw->tw_rcv_wnd	= tcp_receive_window(tp);
327 		tcptw->tw_ts_recent	= tp->rx_opt.ts_recent;
328 		tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
329 		tcptw->tw_ts_offset	= tp->tsoffset;
330 		tw->tw_usec_ts		= tp->tcp_usec_ts;
331 		tcptw->tw_last_oow_ack_time = 0;
332 		tcptw->tw_tx_delay	= tp->tcp_tx_delay;
333 		tw->tw_txhash		= sk->sk_txhash;
334 		tw->tw_tx_queue_mapping = sk->sk_tx_queue_mapping;
335 #ifdef CONFIG_SOCK_RX_QUEUE_MAPPING
336 		tw->tw_rx_queue_mapping = sk->sk_rx_queue_mapping;
337 #endif
338 #if IS_ENABLED(CONFIG_IPV6)
339 		if (tw->tw_family == PF_INET6) {
340 			struct ipv6_pinfo *np = inet6_sk(sk);
341 
342 			tw->tw_v6_daddr = sk->sk_v6_daddr;
343 			tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
344 			tw->tw_tclass = np->tclass;
345 			tw->tw_flowlabel = be32_to_cpu(np->flow_label & IPV6_FLOWLABEL_MASK);
346 			tw->tw_ipv6only = sk->sk_ipv6only;
347 		}
348 #endif
349 
350 		tcp_time_wait_init(sk, tcptw);
351 		tcp_ao_time_wait(tcptw, tp);
352 
353 		/* Get the TIME_WAIT timeout firing. */
354 		if (timeo < rto)
355 			timeo = rto;
356 
357 		if (state == TCP_TIME_WAIT)
358 			timeo = TCP_TIMEWAIT_LEN;
359 
360 		/* Linkage updates.
361 		 * Note that access to tw after this point is illegal.
362 		 */
363 		inet_twsk_hashdance_schedule(tw, sk, net->ipv4.tcp_death_row.hashinfo, timeo);
364 	} else {
365 		/* Sorry, if we're out of memory, just CLOSE this
366 		 * socket up.  We've got bigger problems than
367 		 * non-graceful socket closings.
368 		 */
369 		NET_INC_STATS(net, LINUX_MIB_TCPTIMEWAITOVERFLOW);
370 	}
371 
372 	tcp_update_metrics(sk);
373 	tcp_done(sk);
374 }
375 EXPORT_SYMBOL(tcp_time_wait);
376 
377 #ifdef CONFIG_TCP_MD5SIG
tcp_md5_twsk_free_rcu(struct rcu_head * head)378 static void tcp_md5_twsk_free_rcu(struct rcu_head *head)
379 {
380 	struct tcp_md5sig_key *key;
381 
382 	key = container_of(head, struct tcp_md5sig_key, rcu);
383 	kfree(key);
384 	static_branch_slow_dec_deferred(&tcp_md5_needed);
385 	tcp_md5_release_sigpool();
386 }
387 #endif
388 
tcp_twsk_destructor(struct sock * sk)389 void tcp_twsk_destructor(struct sock *sk)
390 {
391 #ifdef CONFIG_TCP_MD5SIG
392 	if (static_branch_unlikely(&tcp_md5_needed.key)) {
393 		struct tcp_timewait_sock *twsk = tcp_twsk(sk);
394 
395 		if (twsk->tw_md5_key)
396 			call_rcu(&twsk->tw_md5_key->rcu, tcp_md5_twsk_free_rcu);
397 	}
398 #endif
399 	tcp_ao_destroy_sock(sk, true);
400 }
401 EXPORT_IPV6_MOD_GPL(tcp_twsk_destructor);
402 
tcp_twsk_purge(struct list_head * net_exit_list)403 void tcp_twsk_purge(struct list_head *net_exit_list)
404 {
405 	bool purged_once = false;
406 	struct net *net;
407 
408 	list_for_each_entry(net, net_exit_list, exit_list) {
409 		if (net->ipv4.tcp_death_row.hashinfo->pernet) {
410 			/* Even if tw_refcount == 1, we must clean up kernel reqsk */
411 			inet_twsk_purge(net->ipv4.tcp_death_row.hashinfo);
412 		} else if (!purged_once) {
413 			inet_twsk_purge(&tcp_hashinfo);
414 			purged_once = true;
415 		}
416 	}
417 }
418 
419 /* Warning : This function is called without sk_listener being locked.
420  * Be sure to read socket fields once, as their value could change under us.
421  */
tcp_openreq_init_rwin(struct request_sock * req,const struct sock * sk_listener,const struct dst_entry * dst)422 void tcp_openreq_init_rwin(struct request_sock *req,
423 			   const struct sock *sk_listener,
424 			   const struct dst_entry *dst)
425 {
426 	struct inet_request_sock *ireq = inet_rsk(req);
427 	const struct tcp_sock *tp = tcp_sk(sk_listener);
428 	int full_space = tcp_full_space(sk_listener);
429 	u32 window_clamp;
430 	__u8 rcv_wscale;
431 	u32 rcv_wnd;
432 	int mss;
433 
434 	mss = tcp_mss_clamp(tp, dst_metric_advmss(dst));
435 	window_clamp = READ_ONCE(tp->window_clamp);
436 	/* Set this up on the first call only */
437 	req->rsk_window_clamp = window_clamp ? : dst_metric(dst, RTAX_WINDOW);
438 
439 	/* limit the window selection if the user enforce a smaller rx buffer */
440 	if (sk_listener->sk_userlocks & SOCK_RCVBUF_LOCK &&
441 	    (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
442 		req->rsk_window_clamp = full_space;
443 
444 	rcv_wnd = tcp_rwnd_init_bpf((struct sock *)req);
445 	if (rcv_wnd == 0)
446 		rcv_wnd = dst_metric(dst, RTAX_INITRWND);
447 	else if (full_space < rcv_wnd * mss)
448 		full_space = rcv_wnd * mss;
449 
450 	/* tcp_full_space because it is guaranteed to be the first packet */
451 	tcp_select_initial_window(sk_listener, full_space,
452 		mss - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
453 		&req->rsk_rcv_wnd,
454 		&req->rsk_window_clamp,
455 		ireq->wscale_ok,
456 		&rcv_wscale,
457 		rcv_wnd);
458 	ireq->rcv_wscale = rcv_wscale;
459 }
460 
tcp_ecn_openreq_child(struct tcp_sock * tp,const struct request_sock * req)461 static void tcp_ecn_openreq_child(struct tcp_sock *tp,
462 				  const struct request_sock *req)
463 {
464 	tcp_ecn_mode_set(tp, inet_rsk(req)->ecn_ok ?
465 			     TCP_ECN_MODE_RFC3168 :
466 			     TCP_ECN_DISABLED);
467 }
468 
tcp_ca_openreq_child(struct sock * sk,const struct dst_entry * dst)469 void tcp_ca_openreq_child(struct sock *sk, const struct dst_entry *dst)
470 {
471 	struct inet_connection_sock *icsk = inet_csk(sk);
472 	u32 ca_key = dst_metric(dst, RTAX_CC_ALGO);
473 	bool ca_got_dst = false;
474 
475 	if (ca_key != TCP_CA_UNSPEC) {
476 		const struct tcp_congestion_ops *ca;
477 
478 		rcu_read_lock();
479 		ca = tcp_ca_find_key(ca_key);
480 		if (likely(ca && bpf_try_module_get(ca, ca->owner))) {
481 			icsk->icsk_ca_dst_locked = tcp_ca_dst_locked(dst);
482 			icsk->icsk_ca_ops = ca;
483 			ca_got_dst = true;
484 		}
485 		rcu_read_unlock();
486 	}
487 
488 	/* If no valid choice made yet, assign current system default ca. */
489 	if (!ca_got_dst &&
490 	    (!icsk->icsk_ca_setsockopt ||
491 	     !bpf_try_module_get(icsk->icsk_ca_ops, icsk->icsk_ca_ops->owner)))
492 		tcp_assign_congestion_control(sk);
493 
494 	tcp_set_ca_state(sk, TCP_CA_Open);
495 }
496 EXPORT_IPV6_MOD_GPL(tcp_ca_openreq_child);
497 
smc_check_reset_syn_req(const struct tcp_sock * oldtp,struct request_sock * req,struct tcp_sock * newtp)498 static void smc_check_reset_syn_req(const struct tcp_sock *oldtp,
499 				    struct request_sock *req,
500 				    struct tcp_sock *newtp)
501 {
502 #if IS_ENABLED(CONFIG_SMC)
503 	struct inet_request_sock *ireq;
504 
505 	if (static_branch_unlikely(&tcp_have_smc)) {
506 		ireq = inet_rsk(req);
507 		if (oldtp->syn_smc && !ireq->smc_ok)
508 			newtp->syn_smc = 0;
509 	}
510 #endif
511 }
512 
513 /* This is not only more efficient than what we used to do, it eliminates
514  * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM
515  *
516  * Actually, we could lots of memory writes here. tp of listening
517  * socket contains all necessary default parameters.
518  */
tcp_create_openreq_child(const struct sock * sk,struct request_sock * req,struct sk_buff * skb)519 struct sock *tcp_create_openreq_child(const struct sock *sk,
520 				      struct request_sock *req,
521 				      struct sk_buff *skb)
522 {
523 	struct sock *newsk = inet_csk_clone_lock(sk, req, GFP_ATOMIC);
524 	const struct inet_request_sock *ireq = inet_rsk(req);
525 	struct tcp_request_sock *treq = tcp_rsk(req);
526 	struct inet_connection_sock *newicsk;
527 	const struct tcp_sock *oldtp;
528 	struct tcp_sock *newtp;
529 	u32 seq;
530 
531 	if (!newsk)
532 		return NULL;
533 
534 	newicsk = inet_csk(newsk);
535 	newtp = tcp_sk(newsk);
536 	oldtp = tcp_sk(sk);
537 
538 	smc_check_reset_syn_req(oldtp, req, newtp);
539 
540 	/* Now setup tcp_sock */
541 	newtp->pred_flags = 0;
542 
543 	seq = treq->rcv_isn + 1;
544 	newtp->rcv_wup = seq;
545 	WRITE_ONCE(newtp->copied_seq, seq);
546 	WRITE_ONCE(newtp->rcv_nxt, seq);
547 	newtp->segs_in = 1;
548 
549 	seq = treq->snt_isn + 1;
550 	newtp->snd_sml = newtp->snd_una = seq;
551 	WRITE_ONCE(newtp->snd_nxt, seq);
552 	newtp->snd_up = seq;
553 
554 	INIT_LIST_HEAD(&newtp->tsq_node);
555 	INIT_LIST_HEAD(&newtp->tsorted_sent_queue);
556 
557 	tcp_init_wl(newtp, treq->rcv_isn);
558 
559 	minmax_reset(&newtp->rtt_min, tcp_jiffies32, ~0U);
560 	newicsk->icsk_ack.lrcvtime = tcp_jiffies32;
561 
562 	newtp->lsndtime = tcp_jiffies32;
563 	newsk->sk_txhash = READ_ONCE(treq->txhash);
564 	newtp->total_retrans = req->num_retrans;
565 
566 	tcp_init_xmit_timers(newsk);
567 	WRITE_ONCE(newtp->write_seq, newtp->pushed_seq = treq->snt_isn + 1);
568 
569 	if (sock_flag(newsk, SOCK_KEEPOPEN))
570 		tcp_reset_keepalive_timer(newsk, keepalive_time_when(newtp));
571 
572 	newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
573 	newtp->rx_opt.sack_ok = ireq->sack_ok;
574 	newtp->window_clamp = req->rsk_window_clamp;
575 	newtp->rcv_ssthresh = req->rsk_rcv_wnd;
576 	newtp->rcv_wnd = req->rsk_rcv_wnd;
577 	newtp->rx_opt.wscale_ok = ireq->wscale_ok;
578 	if (newtp->rx_opt.wscale_ok) {
579 		newtp->rx_opt.snd_wscale = ireq->snd_wscale;
580 		newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
581 	} else {
582 		newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
583 		newtp->window_clamp = min(newtp->window_clamp, 65535U);
584 	}
585 	newtp->snd_wnd = ntohs(tcp_hdr(skb)->window) << newtp->rx_opt.snd_wscale;
586 	newtp->max_window = newtp->snd_wnd;
587 
588 	if (newtp->rx_opt.tstamp_ok) {
589 		newtp->tcp_usec_ts = treq->req_usec_ts;
590 		newtp->rx_opt.ts_recent = req->ts_recent;
591 		newtp->rx_opt.ts_recent_stamp = ktime_get_seconds();
592 		newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
593 	} else {
594 		newtp->tcp_usec_ts = 0;
595 		newtp->rx_opt.ts_recent_stamp = 0;
596 		newtp->tcp_header_len = sizeof(struct tcphdr);
597 	}
598 	if (req->num_timeout) {
599 		newtp->total_rto = req->num_timeout;
600 		newtp->undo_marker = treq->snt_isn;
601 		if (newtp->tcp_usec_ts) {
602 			newtp->retrans_stamp = treq->snt_synack;
603 			newtp->total_rto_time = (u32)(tcp_clock_us() -
604 						      newtp->retrans_stamp) / USEC_PER_MSEC;
605 		} else {
606 			newtp->retrans_stamp = div_u64(treq->snt_synack,
607 						       USEC_PER_SEC / TCP_TS_HZ);
608 			newtp->total_rto_time = tcp_clock_ms() -
609 						newtp->retrans_stamp;
610 		}
611 		newtp->total_rto_recoveries = 1;
612 	}
613 	newtp->tsoffset = treq->ts_off;
614 #ifdef CONFIG_TCP_MD5SIG
615 	newtp->md5sig_info = NULL;	/*XXX*/
616 #endif
617 #ifdef CONFIG_TCP_AO
618 	newtp->ao_info = NULL;
619 
620 	if (tcp_rsk_used_ao(req)) {
621 		struct tcp_ao_key *ao_key;
622 
623 		ao_key = treq->af_specific->ao_lookup(sk, req, tcp_rsk(req)->ao_keyid, -1);
624 		if (ao_key)
625 			newtp->tcp_header_len += tcp_ao_len_aligned(ao_key);
626 	}
627  #endif
628 	if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
629 		newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
630 	newtp->rx_opt.mss_clamp = req->mss;
631 	tcp_ecn_openreq_child(newtp, req);
632 	newtp->fastopen_req = NULL;
633 	RCU_INIT_POINTER(newtp->fastopen_rsk, NULL);
634 
635 	newtp->bpf_chg_cc_inprogress = 0;
636 	tcp_bpf_clone(sk, newsk);
637 
638 	__TCP_INC_STATS(sock_net(sk), TCP_MIB_PASSIVEOPENS);
639 
640 	xa_init_flags(&newsk->sk_user_frags, XA_FLAGS_ALLOC1);
641 
642 	return newsk;
643 }
644 EXPORT_SYMBOL(tcp_create_openreq_child);
645 
646 /*
647  * Process an incoming packet for SYN_RECV sockets represented as a
648  * request_sock. Normally sk is the listener socket but for TFO it
649  * points to the child socket.
650  *
651  * XXX (TFO) - The current impl contains a special check for ack
652  * validation and inside tcp_v4_reqsk_send_ack(). Can we do better?
653  *
654  * We don't need to initialize tmp_opt.sack_ok as we don't use the results
655  *
656  * Note: If @fastopen is true, this can be called from process context.
657  *       Otherwise, this is from BH context.
658  */
659 
tcp_check_req(struct sock * sk,struct sk_buff * skb,struct request_sock * req,bool fastopen,bool * req_stolen,enum skb_drop_reason * drop_reason)660 struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
661 			   struct request_sock *req,
662 			   bool fastopen, bool *req_stolen,
663 			   enum skb_drop_reason *drop_reason)
664 {
665 	struct tcp_options_received tmp_opt;
666 	struct sock *child;
667 	const struct tcphdr *th = tcp_hdr(skb);
668 	__be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
669 	bool tsecr_reject = false;
670 	bool paws_reject = false;
671 	bool own_req;
672 
673 	tmp_opt.saw_tstamp = 0;
674 	if (th->doff > (sizeof(struct tcphdr)>>2)) {
675 		tcp_parse_options(sock_net(sk), skb, &tmp_opt, 0, NULL);
676 
677 		if (tmp_opt.saw_tstamp) {
678 			tmp_opt.ts_recent = req->ts_recent;
679 			if (tmp_opt.rcv_tsecr) {
680 				if (inet_rsk(req)->tstamp_ok && !fastopen)
681 					tsecr_reject = !between(tmp_opt.rcv_tsecr,
682 							tcp_rsk(req)->snt_tsval_first,
683 							READ_ONCE(tcp_rsk(req)->snt_tsval_last));
684 				tmp_opt.rcv_tsecr -= tcp_rsk(req)->ts_off;
685 			}
686 			/* We do not store true stamp, but it is not required,
687 			 * it can be estimated (approximately)
688 			 * from another data.
689 			 */
690 			tmp_opt.ts_recent_stamp = ktime_get_seconds() - reqsk_timeout(req, TCP_RTO_MAX) / HZ;
691 			paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
692 		}
693 	}
694 
695 	/* Check for pure retransmitted SYN. */
696 	if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
697 	    flg == TCP_FLAG_SYN &&
698 	    !paws_reject) {
699 		/*
700 		 * RFC793 draws (Incorrectly! It was fixed in RFC1122)
701 		 * this case on figure 6 and figure 8, but formal
702 		 * protocol description says NOTHING.
703 		 * To be more exact, it says that we should send ACK,
704 		 * because this segment (at least, if it has no data)
705 		 * is out of window.
706 		 *
707 		 *  CONCLUSION: RFC793 (even with RFC1122) DOES NOT
708 		 *  describe SYN-RECV state. All the description
709 		 *  is wrong, we cannot believe to it and should
710 		 *  rely only on common sense and implementation
711 		 *  experience.
712 		 *
713 		 * Enforce "SYN-ACK" according to figure 8, figure 6
714 		 * of RFC793, fixed by RFC1122.
715 		 *
716 		 * Note that even if there is new data in the SYN packet
717 		 * they will be thrown away too.
718 		 *
719 		 * Reset timer after retransmitting SYNACK, similar to
720 		 * the idea of fast retransmit in recovery.
721 		 */
722 		if (!tcp_oow_rate_limited(sock_net(sk), skb,
723 					  LINUX_MIB_TCPACKSKIPPEDSYNRECV,
724 					  &tcp_rsk(req)->last_oow_ack_time) &&
725 
726 		    !inet_rtx_syn_ack(sk, req)) {
727 			unsigned long expires = jiffies;
728 
729 			expires += reqsk_timeout(req, TCP_RTO_MAX);
730 			if (!fastopen)
731 				mod_timer_pending(&req->rsk_timer, expires);
732 			else
733 				req->rsk_timer.expires = expires;
734 		}
735 		return NULL;
736 	}
737 
738 	/* Further reproduces section "SEGMENT ARRIVES"
739 	   for state SYN-RECEIVED of RFC793.
740 	   It is broken, however, it does not work only
741 	   when SYNs are crossed.
742 
743 	   You would think that SYN crossing is impossible here, since
744 	   we should have a SYN_SENT socket (from connect()) on our end,
745 	   but this is not true if the crossed SYNs were sent to both
746 	   ends by a malicious third party.  We must defend against this,
747 	   and to do that we first verify the ACK (as per RFC793, page
748 	   36) and reset if it is invalid.  Is this a true full defense?
749 	   To convince ourselves, let us consider a way in which the ACK
750 	   test can still pass in this 'malicious crossed SYNs' case.
751 	   Malicious sender sends identical SYNs (and thus identical sequence
752 	   numbers) to both A and B:
753 
754 		A: gets SYN, seq=7
755 		B: gets SYN, seq=7
756 
757 	   By our good fortune, both A and B select the same initial
758 	   send sequence number of seven :-)
759 
760 		A: sends SYN|ACK, seq=7, ack_seq=8
761 		B: sends SYN|ACK, seq=7, ack_seq=8
762 
763 	   So we are now A eating this SYN|ACK, ACK test passes.  So
764 	   does sequence test, SYN is truncated, and thus we consider
765 	   it a bare ACK.
766 
767 	   If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this
768 	   bare ACK.  Otherwise, we create an established connection.  Both
769 	   ends (listening sockets) accept the new incoming connection and try
770 	   to talk to each other. 8-)
771 
772 	   Note: This case is both harmless, and rare.  Possibility is about the
773 	   same as us discovering intelligent life on another plant tomorrow.
774 
775 	   But generally, we should (RFC lies!) to accept ACK
776 	   from SYNACK both here and in tcp_rcv_state_process().
777 	   tcp_rcv_state_process() does not, hence, we do not too.
778 
779 	   Note that the case is absolutely generic:
780 	   we cannot optimize anything here without
781 	   violating protocol. All the checks must be made
782 	   before attempt to create socket.
783 	 */
784 
785 	/* RFC793 page 36: "If the connection is in any non-synchronized state ...
786 	 *                  and the incoming segment acknowledges something not yet
787 	 *                  sent (the segment carries an unacceptable ACK) ...
788 	 *                  a reset is sent."
789 	 *
790 	 * Invalid ACK: reset will be sent by listening socket.
791 	 * Note that the ACK validity check for a Fast Open socket is done
792 	 * elsewhere and is checked directly against the child socket rather
793 	 * than req because user data may have been sent out.
794 	 */
795 	if ((flg & TCP_FLAG_ACK) && !fastopen &&
796 	    (TCP_SKB_CB(skb)->ack_seq !=
797 	     tcp_rsk(req)->snt_isn + 1))
798 		return sk;
799 
800 	/* RFC793: "first check sequence number". */
801 
802 	if (paws_reject || tsecr_reject ||
803 	    !tcp_in_window(TCP_SKB_CB(skb)->seq,
804 			   TCP_SKB_CB(skb)->end_seq,
805 			   tcp_rsk(req)->rcv_nxt,
806 			   tcp_rsk(req)->rcv_nxt +
807 			   tcp_synack_window(req))) {
808 		/* Out of window: send ACK and drop. */
809 		if (!(flg & TCP_FLAG_RST) &&
810 		    !tcp_oow_rate_limited(sock_net(sk), skb,
811 					  LINUX_MIB_TCPACKSKIPPEDSYNRECV,
812 					  &tcp_rsk(req)->last_oow_ack_time))
813 			req->rsk_ops->send_ack(sk, skb, req);
814 		if (paws_reject) {
815 			SKB_DR_SET(*drop_reason, TCP_RFC7323_PAWS);
816 			NET_INC_STATS(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
817 		} else if (tsecr_reject) {
818 			SKB_DR_SET(*drop_reason, TCP_RFC7323_TSECR);
819 			NET_INC_STATS(sock_net(sk), LINUX_MIB_TSECRREJECTED);
820 		} else {
821 			SKB_DR_SET(*drop_reason, TCP_OVERWINDOW);
822 		}
823 		return NULL;
824 	}
825 
826 	/* In sequence, PAWS is OK. */
827 
828 	if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
829 		/* Truncate SYN, it is out of window starting
830 		   at tcp_rsk(req)->rcv_isn + 1. */
831 		flg &= ~TCP_FLAG_SYN;
832 	}
833 
834 	/* RFC793: "second check the RST bit" and
835 	 *	   "fourth, check the SYN bit"
836 	 */
837 	if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
838 		TCP_INC_STATS(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
839 		goto embryonic_reset;
840 	}
841 
842 	/* ACK sequence verified above, just make sure ACK is
843 	 * set.  If ACK not set, just silently drop the packet.
844 	 *
845 	 * XXX (TFO) - if we ever allow "data after SYN", the
846 	 * following check needs to be removed.
847 	 */
848 	if (!(flg & TCP_FLAG_ACK))
849 		return NULL;
850 
851 	/* For Fast Open no more processing is needed (sk is the
852 	 * child socket).
853 	 */
854 	if (fastopen)
855 		return sk;
856 
857 	/* While TCP_DEFER_ACCEPT is active, drop bare ACK. */
858 	if (req->num_timeout < READ_ONCE(inet_csk(sk)->icsk_accept_queue.rskq_defer_accept) &&
859 	    TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
860 		inet_rsk(req)->acked = 1;
861 		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPDEFERACCEPTDROP);
862 		return NULL;
863 	}
864 
865 	/* OK, ACK is valid, create big socket and
866 	 * feed this segment to it. It will repeat all
867 	 * the tests. THIS SEGMENT MUST MOVE SOCKET TO
868 	 * ESTABLISHED STATE. If it will be dropped after
869 	 * socket is created, wait for troubles.
870 	 */
871 	child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
872 							 req, &own_req);
873 	if (!child)
874 		goto listen_overflow;
875 
876 	if (own_req && tmp_opt.saw_tstamp &&
877 	    !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt))
878 		tcp_sk(child)->rx_opt.ts_recent = tmp_opt.rcv_tsval;
879 
880 	if (own_req && rsk_drop_req(req)) {
881 		reqsk_queue_removed(&inet_csk(req->rsk_listener)->icsk_accept_queue, req);
882 		inet_csk_reqsk_queue_drop_and_put(req->rsk_listener, req);
883 		return child;
884 	}
885 
886 	sock_rps_save_rxhash(child, skb);
887 	tcp_synack_rtt_meas(child, req);
888 	*req_stolen = !own_req;
889 	return inet_csk_complete_hashdance(sk, child, req, own_req);
890 
891 listen_overflow:
892 	SKB_DR_SET(*drop_reason, TCP_LISTEN_OVERFLOW);
893 	if (sk != req->rsk_listener)
894 		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMIGRATEREQFAILURE);
895 
896 	if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_abort_on_overflow)) {
897 		inet_rsk(req)->acked = 1;
898 		return NULL;
899 	}
900 
901 embryonic_reset:
902 	if (!(flg & TCP_FLAG_RST)) {
903 		/* Received a bad SYN pkt - for TFO We try not to reset
904 		 * the local connection unless it's really necessary to
905 		 * avoid becoming vulnerable to outside attack aiming at
906 		 * resetting legit local connections.
907 		 */
908 		req->rsk_ops->send_reset(sk, skb, SK_RST_REASON_INVALID_SYN);
909 	} else if (fastopen) { /* received a valid RST pkt */
910 		reqsk_fastopen_remove(sk, req, true);
911 		tcp_reset(sk, skb);
912 	}
913 	if (!fastopen) {
914 		bool unlinked = inet_csk_reqsk_queue_drop(sk, req);
915 
916 		if (unlinked)
917 			__NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
918 		*req_stolen = !unlinked;
919 	}
920 	return NULL;
921 }
922 EXPORT_IPV6_MOD(tcp_check_req);
923 
924 /*
925  * Queue segment on the new socket if the new socket is active,
926  * otherwise we just shortcircuit this and continue with
927  * the new socket.
928  *
929  * For the vast majority of cases child->sk_state will be TCP_SYN_RECV
930  * when entering. But other states are possible due to a race condition
931  * where after __inet_lookup_established() fails but before the listener
932  * locked is obtained, other packets cause the same connection to
933  * be created.
934  */
935 
tcp_child_process(struct sock * parent,struct sock * child,struct sk_buff * skb)936 enum skb_drop_reason tcp_child_process(struct sock *parent, struct sock *child,
937 				       struct sk_buff *skb)
938 	__releases(&((child)->sk_lock.slock))
939 {
940 	enum skb_drop_reason reason = SKB_NOT_DROPPED_YET;
941 	int state = child->sk_state;
942 
943 	/* record sk_napi_id and sk_rx_queue_mapping of child. */
944 	sk_mark_napi_id_set(child, skb);
945 
946 	tcp_segs_in(tcp_sk(child), skb);
947 	if (!sock_owned_by_user(child)) {
948 		reason = tcp_rcv_state_process(child, skb);
949 		/* Wakeup parent, send SIGIO */
950 		if (state == TCP_SYN_RECV && child->sk_state != state)
951 			parent->sk_data_ready(parent);
952 	} else {
953 		/* Alas, it is possible again, because we do lookup
954 		 * in main socket hash table and lock on listening
955 		 * socket does not protect us more.
956 		 */
957 		__sk_add_backlog(child, skb);
958 	}
959 
960 	bh_unlock_sock(child);
961 	sock_put(child);
962 	return reason;
963 }
964 EXPORT_IPV6_MOD(tcp_child_process);
965