12874c5fdSThomas Gleixner // SPDX-License-Identifier: GPL-2.0-or-later
21da177e4SLinus Torvalds /*
31da177e4SLinus Torvalds * Syncookies implementation for the Linux kernel
41da177e4SLinus Torvalds *
51da177e4SLinus Torvalds * Copyright (C) 1997 Andi Kleen
61da177e4SLinus Torvalds * Based on ideas by D.J.Bernstein and Eric Schenk.
71da177e4SLinus Torvalds */
81da177e4SLinus Torvalds
91da177e4SLinus Torvalds #include <linux/tcp.h>
10fe62d05bSJason A. Donenfeld #include <linux/siphash.h>
111da177e4SLinus Torvalds #include <linux/kernel.h>
12bc3b2d7fSPaul Gortmaker #include <linux/export.h>
1384b114b9SEric Dumazet #include <net/secure_seq.h>
141da177e4SLinus Torvalds #include <net/tcp.h>
1586b08d86SKOVACS Krisztian #include <net/route.h>
161da177e4SLinus Torvalds
1749ecc2e9SEric Dumazet static siphash_aligned_key_t syncookie_secret[2];
181da177e4SLinus Torvalds
191da177e4SLinus Torvalds #define COOKIEBITS 24 /* Upper bits store count */
201da177e4SLinus Torvalds #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
211da177e4SLinus Torvalds
22274e2da0SFlorian Westphal /* TCP Timestamp: 6 lowest bits of timestamp sent in the cookie SYN-ACK
23274e2da0SFlorian Westphal * stores TCP options:
24274e2da0SFlorian Westphal *
25274e2da0SFlorian Westphal * MSB LSB
26274e2da0SFlorian Westphal * | 31 ... 6 | 5 | 4 | 3 2 1 0 |
27274e2da0SFlorian Westphal * | Timestamp | ECN | SACK | WScale |
28274e2da0SFlorian Westphal *
29274e2da0SFlorian Westphal * When we receive a valid cookie-ACK, we look at the echoed tsval (if
30274e2da0SFlorian Westphal * any) to figure out which TCP options we should use for the rebuilt
31274e2da0SFlorian Westphal * connection.
32274e2da0SFlorian Westphal *
33274e2da0SFlorian Westphal * A WScale setting of '0xf' (which is an invalid scaling value)
34274e2da0SFlorian Westphal * means that original syn did not include the TCP window scaling option.
35274e2da0SFlorian Westphal */
36274e2da0SFlorian Westphal #define TS_OPT_WSCALE_MASK 0xf
37274e2da0SFlorian Westphal #define TS_OPT_SACK BIT(4)
38274e2da0SFlorian Westphal #define TS_OPT_ECN BIT(5)
39274e2da0SFlorian Westphal /* There is no TS_OPT_TIMESTAMP:
40274e2da0SFlorian Westphal * if ACK contains timestamp option, we already know it was
41274e2da0SFlorian Westphal * requested/supported by the syn/synack exchange.
42274e2da0SFlorian Westphal */
43274e2da0SFlorian Westphal #define TSBITS 6
44274e2da0SFlorian Westphal
cookie_hash(__be32 saddr,__be32 daddr,__be16 sport,__be16 dport,u32 count,int c)45714e85beSAl Viro static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
461da177e4SLinus Torvalds u32 count, int c)
471da177e4SLinus Torvalds {
48b23a002fSHannes Frederic Sowa net_get_random_once(syncookie_secret, sizeof(syncookie_secret));
49fe62d05bSJason A. Donenfeld return siphash_4u32((__force u32)saddr, (__force u32)daddr,
50fe62d05bSJason A. Donenfeld (__force u32)sport << 16 | (__force u32)dport,
51fe62d05bSJason A. Donenfeld count, &syncookie_secret[c]);
521da177e4SLinus Torvalds }
531da177e4SLinus Torvalds
544dfc2817SFlorian Westphal /*
554dfc2817SFlorian Westphal * when syncookies are in effect and tcp timestamps are enabled we encode
56734f614bSFlorian Westphal * tcp options in the lower bits of the timestamp value that will be
574dfc2817SFlorian Westphal * sent in the syn-ack.
584dfc2817SFlorian Westphal * Since subsequent timestamps use the normal tcp_time_stamp value, we
594dfc2817SFlorian Westphal * must make sure that the resulting initial timestamp is <= tcp_time_stamp.
604dfc2817SFlorian Westphal */
cookie_init_timestamp(struct request_sock * req,u64 now)61200ecef6SEric Dumazet u64 cookie_init_timestamp(struct request_sock *req, u64 now)
624dfc2817SFlorian Westphal {
6373ed8e03SEric Dumazet const struct inet_request_sock *ireq = inet_rsk(req);
64003e07a1SEric Dumazet u64 ts, ts_now = tcp_ns_to_ts(false, now);
654dfc2817SFlorian Westphal u32 options = 0;
664dfc2817SFlorian Westphal
67274e2da0SFlorian Westphal options = ireq->wscale_ok ? ireq->snd_wscale : TS_OPT_WSCALE_MASK;
68274e2da0SFlorian Westphal if (ireq->sack_ok)
69274e2da0SFlorian Westphal options |= TS_OPT_SACK;
70274e2da0SFlorian Westphal if (ireq->ecn_ok)
71274e2da0SFlorian Westphal options |= TS_OPT_ECN;
724dfc2817SFlorian Westphal
7373ed8e03SEric Dumazet ts = (ts_now >> TSBITS) << TSBITS;
744dfc2817SFlorian Westphal ts |= options;
7573ed8e03SEric Dumazet if (ts > ts_now)
7673ed8e03SEric Dumazet ts -= (1UL << TSBITS);
7773ed8e03SEric Dumazet
78614e8316SEric Dumazet if (tcp_rsk(req)->req_usec_ts)
79614e8316SEric Dumazet return ts * NSEC_PER_USEC;
80614e8316SEric Dumazet return ts * NSEC_PER_MSEC;
814dfc2817SFlorian Westphal }
824dfc2817SFlorian Westphal
834dfc2817SFlorian Westphal
secure_tcp_syn_cookie(__be32 saddr,__be32 daddr,__be16 sport,__be16 dport,__u32 sseq,__u32 data)84714e85beSAl Viro static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport,
858c27bd75SFlorian Westphal __be16 dport, __u32 sseq, __u32 data)
861da177e4SLinus Torvalds {
871da177e4SLinus Torvalds /*
881da177e4SLinus Torvalds * Compute the secure sequence number.
891da177e4SLinus Torvalds * The output should be:
901da177e4SLinus Torvalds * HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24)
911da177e4SLinus Torvalds * + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24).
921da177e4SLinus Torvalds * Where sseq is their sequence number and count increases every
931da177e4SLinus Torvalds * minute by 1.
941da177e4SLinus Torvalds * As an extra hack, we add a small "data" value that encodes the
951da177e4SLinus Torvalds * MSS into the second hash value.
961da177e4SLinus Torvalds */
978c27bd75SFlorian Westphal u32 count = tcp_cookie_time();
981da177e4SLinus Torvalds return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
991da177e4SLinus Torvalds sseq + (count << COOKIEBITS) +
1001da177e4SLinus Torvalds ((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
1011da177e4SLinus Torvalds & COOKIEMASK));
1021da177e4SLinus Torvalds }
1031da177e4SLinus Torvalds
1041da177e4SLinus Torvalds /*
1051da177e4SLinus Torvalds * This retrieves the small "data" value from the syncookie.
1061da177e4SLinus Torvalds * If the syncookie is bad, the data returned will be out of
1071da177e4SLinus Torvalds * range. This must be checked by the caller.
1081da177e4SLinus Torvalds *
1098c27bd75SFlorian Westphal * The count value used to generate the cookie must be less than
1108c27bd75SFlorian Westphal * MAX_SYNCOOKIE_AGE minutes in the past.
1118c27bd75SFlorian Westphal * The return value (__u32)-1 if this test fails.
1121da177e4SLinus Torvalds */
check_tcp_syn_cookie(__u32 cookie,__be32 saddr,__be32 daddr,__be16 sport,__be16 dport,__u32 sseq)113714e85beSAl Viro static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
1148c27bd75SFlorian Westphal __be16 sport, __be16 dport, __u32 sseq)
1151da177e4SLinus Torvalds {
1168c27bd75SFlorian Westphal u32 diff, count = tcp_cookie_time();
1171da177e4SLinus Torvalds
1181da177e4SLinus Torvalds /* Strip away the layers from the cookie */
1191da177e4SLinus Torvalds cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
1201da177e4SLinus Torvalds
1211da177e4SLinus Torvalds /* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
1221da177e4SLinus Torvalds diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
1238c27bd75SFlorian Westphal if (diff >= MAX_SYNCOOKIE_AGE)
1241da177e4SLinus Torvalds return (__u32)-1;
1251da177e4SLinus Torvalds
1261da177e4SLinus Torvalds return (cookie -
1271da177e4SLinus Torvalds cookie_hash(saddr, daddr, sport, dport, count - diff, 1))
1281da177e4SLinus Torvalds & COOKIEMASK; /* Leaving the data behind */
1291da177e4SLinus Torvalds }
1301da177e4SLinus Torvalds
1311da177e4SLinus Torvalds /*
13208629354SFlorian Westphal * MSS Values are chosen based on the 2011 paper
13308629354SFlorian Westphal * 'An Analysis of TCP Maximum Segement Sizes' by S. Alcock and R. Nelson.
13408629354SFlorian Westphal * Values ..
13508629354SFlorian Westphal * .. lower than 536 are rare (< 0.2%)
13608629354SFlorian Westphal * .. between 537 and 1299 account for less than < 1.5% of observed values
13708629354SFlorian Westphal * .. in the 1300-1349 range account for about 15 to 20% of observed mss values
13808629354SFlorian Westphal * .. exceeding 1460 are very rare (< 0.04%)
1395918e2fbSFlorian Westphal *
14008629354SFlorian Westphal * 1460 is the single most frequently announced mss value (30 to 46% depending
14108629354SFlorian Westphal * on monitor location). Table must be sorted.
1421da177e4SLinus Torvalds */
1431da177e4SLinus Torvalds static __u16 const msstab[] = {
1445918e2fbSFlorian Westphal 536,
14508629354SFlorian Westphal 1300,
14608629354SFlorian Westphal 1440, /* 1440, 1452: PPPoE */
1475918e2fbSFlorian Westphal 1460,
1481da177e4SLinus Torvalds };
1491da177e4SLinus Torvalds
1501da177e4SLinus Torvalds /*
1511da177e4SLinus Torvalds * Generate a syncookie. mssp points to the mss, which is returned
1521da177e4SLinus Torvalds * rounded down to the value encoded in the cookie.
1531da177e4SLinus Torvalds */
__cookie_v4_init_sequence(const struct iphdr * iph,const struct tcphdr * th,u16 * mssp)1540198230bSPatrick McHardy u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
1550198230bSPatrick McHardy u16 *mssp)
1561da177e4SLinus Torvalds {
1571da177e4SLinus Torvalds int mssind;
1581da177e4SLinus Torvalds const __u16 mss = *mssp;
1591da177e4SLinus Torvalds
1605918e2fbSFlorian Westphal for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
1615918e2fbSFlorian Westphal if (mss >= msstab[mssind])
1625918e2fbSFlorian Westphal break;
1635918e2fbSFlorian Westphal *mssp = msstab[mssind];
1641da177e4SLinus Torvalds
165aa8223c7SArnaldo Carvalho de Melo return secure_tcp_syn_cookie(iph->saddr, iph->daddr,
166aa8223c7SArnaldo Carvalho de Melo th->source, th->dest, ntohl(th->seq),
1678c27bd75SFlorian Westphal mssind);
1681da177e4SLinus Torvalds }
1690198230bSPatrick McHardy EXPORT_SYMBOL_GPL(__cookie_v4_init_sequence);
1700198230bSPatrick McHardy
cookie_v4_init_sequence(const struct sk_buff * skb,__u16 * mssp)1713f684b4bSEric Dumazet __u32 cookie_v4_init_sequence(const struct sk_buff *skb, __u16 *mssp)
1720198230bSPatrick McHardy {
1730198230bSPatrick McHardy const struct iphdr *iph = ip_hdr(skb);
1740198230bSPatrick McHardy const struct tcphdr *th = tcp_hdr(skb);
1750198230bSPatrick McHardy
1760198230bSPatrick McHardy return __cookie_v4_init_sequence(iph, th, mssp);
1770198230bSPatrick McHardy }
1781da177e4SLinus Torvalds
1791da177e4SLinus Torvalds /*
1801da177e4SLinus Torvalds * Check if a ack sequence number is a valid syncookie.
1811da177e4SLinus Torvalds * Return the decoded mss if it is, or 0 if not.
1821da177e4SLinus Torvalds */
__cookie_v4_check(const struct iphdr * iph,const struct tcphdr * th)1837577bc82SKuniyuki Iwashima int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th)
1841da177e4SLinus Torvalds {
1857577bc82SKuniyuki Iwashima __u32 cookie = ntohl(th->ack_seq) - 1;
186aa8223c7SArnaldo Carvalho de Melo __u32 seq = ntohl(th->seq) - 1;
1877577bc82SKuniyuki Iwashima __u32 mssind;
1887577bc82SKuniyuki Iwashima
1897577bc82SKuniyuki Iwashima mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,
1908c27bd75SFlorian Westphal th->source, th->dest, seq);
1911da177e4SLinus Torvalds
1925918e2fbSFlorian Westphal return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
1931da177e4SLinus Torvalds }
1940198230bSPatrick McHardy EXPORT_SYMBOL_GPL(__cookie_v4_check);
1951da177e4SLinus Torvalds
tcp_get_cookie_sock(struct sock * sk,struct sk_buff * skb,struct request_sock * req,struct dst_entry * dst)196b80c0e78SEric Dumazet struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
19760236fddSArnaldo Carvalho de Melo struct request_sock *req,
198efce3d1fSKuniyuki Iwashima struct dst_entry *dst)
1991da177e4SLinus Torvalds {
2008292a17aSArnaldo Carvalho de Melo struct inet_connection_sock *icsk = inet_csk(sk);
2011da177e4SLinus Torvalds struct sock *child;
2025e0724d0SEric Dumazet bool own_req;
2031da177e4SLinus Torvalds
2045e0724d0SEric Dumazet child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst,
2055e0724d0SEric Dumazet NULL, &own_req);
2060470c8caSEric Dumazet if (child) {
20741c6d650SReshetova, Elena refcount_set(&req->rsk_refcnt, 1);
2086bcfd7f8SEric Dumazet sock_rps_save_rxhash(child, skb);
2099466a1ccSFlorian Westphal
2100e8642cfSEric Dumazet if (rsk_drop_req(req)) {
2119d8c05adSPaolo Abeni reqsk_put(req);
2129466a1ccSFlorian Westphal return child;
2139466a1ccSFlorian Westphal }
2149466a1ccSFlorian Westphal
2159403cf23SGuillaume Nault if (inet_csk_reqsk_queue_add(sk, req, child))
2169403cf23SGuillaume Nault return child;
2179403cf23SGuillaume Nault
2189d3e1368SGuillaume Nault bh_unlock_sock(child);
2199d3e1368SGuillaume Nault sock_put(child);
2209d3e1368SGuillaume Nault }
2219403cf23SGuillaume Nault __reqsk_free(req);
2229403cf23SGuillaume Nault
2239403cf23SGuillaume Nault return NULL;
2241da177e4SLinus Torvalds }
225b80c0e78SEric Dumazet EXPORT_SYMBOL(tcp_get_cookie_sock);
2264dfc2817SFlorian Westphal
2274dfc2817SFlorian Westphal /*
2284dfc2817SFlorian Westphal * when syncookies are in effect and tcp timestamps are enabled we stored
2294dfc2817SFlorian Westphal * additional tcp options in the timestamp.
2304dfc2817SFlorian Westphal * This extracts these options from the timestamp echo.
2314dfc2817SFlorian Westphal *
232f1673381SFlorian Westphal * return false if we decode a tcp option that is disabled
233f1673381SFlorian Westphal * on the host.
2344dfc2817SFlorian Westphal */
cookie_timestamp_decode(const struct net * net,struct tcp_options_received * tcp_opt)235f9301034SEric Dumazet bool cookie_timestamp_decode(const struct net *net,
236f9301034SEric Dumazet struct tcp_options_received *tcp_opt)
2374dfc2817SFlorian Westphal {
238734f614bSFlorian Westphal /* echoed timestamp, lowest bits contain options */
239274e2da0SFlorian Westphal u32 options = tcp_opt->rcv_tsecr;
2404dfc2817SFlorian Westphal
2418c763681SFlorian Westphal if (!tcp_opt->saw_tstamp) {
2428c763681SFlorian Westphal tcp_clear_options(tcp_opt);
2438c763681SFlorian Westphal return true;
2448c763681SFlorian Westphal }
2458c763681SFlorian Westphal
2463666f666SKuniyuki Iwashima if (!READ_ONCE(net->ipv4.sysctl_tcp_timestamps))
2478c763681SFlorian Westphal return false;
2488c763681SFlorian Westphal
249274e2da0SFlorian Westphal tcp_opt->sack_ok = (options & TS_OPT_SACK) ? TCP_SACK_SEEN : 0;
2504dfc2817SFlorian Westphal
2513666f666SKuniyuki Iwashima if (tcp_opt->sack_ok && !READ_ONCE(net->ipv4.sysctl_tcp_sack))
2528c763681SFlorian Westphal return false;
2534dfc2817SFlorian Westphal
254274e2da0SFlorian Westphal if ((options & TS_OPT_WSCALE_MASK) == TS_OPT_WSCALE_MASK)
255734f614bSFlorian Westphal return true; /* no window scaling */
256734f614bSFlorian Westphal
2574dfc2817SFlorian Westphal tcp_opt->wscale_ok = 1;
258274e2da0SFlorian Westphal tcp_opt->snd_wscale = options & TS_OPT_WSCALE_MASK;
259274e2da0SFlorian Westphal
2603666f666SKuniyuki Iwashima return READ_ONCE(net->ipv4.sysctl_tcp_window_scaling) != 0;
2618c763681SFlorian Westphal }
262f1673381SFlorian Westphal EXPORT_SYMBOL(cookie_timestamp_decode);
263f1673381SFlorian Westphal
cookie_tcp_reqsk_init(struct sock * sk,struct sk_buff * skb,struct request_sock * req)264de5626b9SKuniyuki Iwashima static int cookie_tcp_reqsk_init(struct sock *sk, struct sk_buff *skb,
265de5626b9SKuniyuki Iwashima struct request_sock *req)
266de5626b9SKuniyuki Iwashima {
267de5626b9SKuniyuki Iwashima struct inet_request_sock *ireq = inet_rsk(req);
268de5626b9SKuniyuki Iwashima struct tcp_request_sock *treq = tcp_rsk(req);
269de5626b9SKuniyuki Iwashima const struct tcphdr *th = tcp_hdr(skb);
270de5626b9SKuniyuki Iwashima
271de5626b9SKuniyuki Iwashima req->num_retrans = 0;
272de5626b9SKuniyuki Iwashima
273de5626b9SKuniyuki Iwashima ireq->ir_num = ntohs(th->dest);
274de5626b9SKuniyuki Iwashima ireq->ir_rmt_port = th->source;
275de5626b9SKuniyuki Iwashima ireq->ir_iif = inet_request_bound_dev_if(sk, skb);
276de5626b9SKuniyuki Iwashima ireq->ir_mark = inet_request_mark(sk, skb);
277de5626b9SKuniyuki Iwashima
278de5626b9SKuniyuki Iwashima if (IS_ENABLED(CONFIG_SMC))
279de5626b9SKuniyuki Iwashima ireq->smc_ok = 0;
280de5626b9SKuniyuki Iwashima
281de5626b9SKuniyuki Iwashima treq->snt_synack = 0;
282de5626b9SKuniyuki Iwashima treq->tfo_listener = false;
283de5626b9SKuniyuki Iwashima treq->txhash = net_tx_rndhash();
284de5626b9SKuniyuki Iwashima treq->rcv_isn = ntohl(th->seq) - 1;
285de5626b9SKuniyuki Iwashima treq->snt_isn = ntohl(th->ack_seq) - 1;
286de5626b9SKuniyuki Iwashima treq->syn_tos = TCP_SKB_CB(skb)->ip_dsfield;
287de5626b9SKuniyuki Iwashima treq->req_usec_ts = false;
288de5626b9SKuniyuki Iwashima
289de5626b9SKuniyuki Iwashima #if IS_ENABLED(CONFIG_MPTCP)
290de5626b9SKuniyuki Iwashima treq->is_mptcp = sk_is_mptcp(sk);
291de5626b9SKuniyuki Iwashima if (treq->is_mptcp)
292de5626b9SKuniyuki Iwashima return mptcp_subflow_init_cookie_req(req, sk, skb);
293de5626b9SKuniyuki Iwashima #endif
294de5626b9SKuniyuki Iwashima
295de5626b9SKuniyuki Iwashima return 0;
296de5626b9SKuniyuki Iwashima }
297de5626b9SKuniyuki Iwashima
298695751e3SKuniyuki Iwashima #if IS_ENABLED(CONFIG_BPF)
cookie_bpf_check(struct sock * sk,struct sk_buff * skb)299695751e3SKuniyuki Iwashima struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb)
300695751e3SKuniyuki Iwashima {
301695751e3SKuniyuki Iwashima struct request_sock *req = inet_reqsk(skb->sk);
302695751e3SKuniyuki Iwashima
303695751e3SKuniyuki Iwashima skb->sk = NULL;
304695751e3SKuniyuki Iwashima skb->destructor = NULL;
305695751e3SKuniyuki Iwashima
306695751e3SKuniyuki Iwashima if (cookie_tcp_reqsk_init(sk, skb, req)) {
307695751e3SKuniyuki Iwashima reqsk_free(req);
308695751e3SKuniyuki Iwashima req = NULL;
309695751e3SKuniyuki Iwashima }
310695751e3SKuniyuki Iwashima
311695751e3SKuniyuki Iwashima return req;
312695751e3SKuniyuki Iwashima }
313695751e3SKuniyuki Iwashima EXPORT_SYMBOL_GPL(cookie_bpf_check);
314695751e3SKuniyuki Iwashima #endif
315695751e3SKuniyuki Iwashima
cookie_tcp_reqsk_alloc(const struct request_sock_ops * ops,struct sock * sk,struct sk_buff * skb,struct tcp_options_received * tcp_opt,int mss,u32 tsoff)3166fc8c827SFlorian Westphal struct request_sock *cookie_tcp_reqsk_alloc(const struct request_sock_ops *ops,
3178e7bab6bSKuniyuki Iwashima struct sock *sk, struct sk_buff *skb,
3188e7bab6bSKuniyuki Iwashima struct tcp_options_received *tcp_opt,
3198e7bab6bSKuniyuki Iwashima int mss, u32 tsoff)
3206fc8c827SFlorian Westphal {
3218e7bab6bSKuniyuki Iwashima struct inet_request_sock *ireq;
3228e7bab6bSKuniyuki Iwashima struct tcp_request_sock *treq;
3236fc8c827SFlorian Westphal struct request_sock *req;
3246fc8c827SFlorian Westphal
3256fc8c827SFlorian Westphal if (sk_is_mptcp(sk))
3263fff8818SMatthieu Baerts req = mptcp_subflow_reqsk_alloc(ops, sk, false);
3273fff8818SMatthieu Baerts else
3286fc8c827SFlorian Westphal req = inet_reqsk_alloc(ops, sk, false);
3293fff8818SMatthieu Baerts
3306fc8c827SFlorian Westphal if (!req)
3316fc8c827SFlorian Westphal return NULL;
3326fc8c827SFlorian Westphal
333de5626b9SKuniyuki Iwashima if (cookie_tcp_reqsk_init(sk, skb, req)) {
3346fc8c827SFlorian Westphal reqsk_free(req);
3356fc8c827SFlorian Westphal return NULL;
3366fc8c827SFlorian Westphal }
3376fc8c827SFlorian Westphal
3388e7bab6bSKuniyuki Iwashima ireq = inet_rsk(req);
3398e7bab6bSKuniyuki Iwashima treq = tcp_rsk(req);
3408e7bab6bSKuniyuki Iwashima
3418e7bab6bSKuniyuki Iwashima req->mss = mss;
3428e7bab6bSKuniyuki Iwashima req->ts_recent = tcp_opt->saw_tstamp ? tcp_opt->rcv_tsval : 0;
3438e7bab6bSKuniyuki Iwashima
3448e7bab6bSKuniyuki Iwashima ireq->snd_wscale = tcp_opt->snd_wscale;
3458e7bab6bSKuniyuki Iwashima ireq->tstamp_ok = tcp_opt->saw_tstamp;
3468e7bab6bSKuniyuki Iwashima ireq->sack_ok = tcp_opt->sack_ok;
3478e7bab6bSKuniyuki Iwashima ireq->wscale_ok = tcp_opt->wscale_ok;
3488e7bab6bSKuniyuki Iwashima ireq->ecn_ok = !!(tcp_opt->rcv_tsecr & TS_OPT_ECN);
3498e7bab6bSKuniyuki Iwashima
3508e7bab6bSKuniyuki Iwashima treq->ts_off = tsoff;
3518e7bab6bSKuniyuki Iwashima
3526fc8c827SFlorian Westphal return req;
3536fc8c827SFlorian Westphal }
3546fc8c827SFlorian Westphal EXPORT_SYMBOL_GPL(cookie_tcp_reqsk_alloc);
3556fc8c827SFlorian Westphal
cookie_tcp_check(struct net * net,struct sock * sk,struct sk_buff * skb)3568e7bab6bSKuniyuki Iwashima static struct request_sock *cookie_tcp_check(struct net *net, struct sock *sk,
3578e7bab6bSKuniyuki Iwashima struct sk_buff *skb)
3581da177e4SLinus Torvalds {
35934efc9cfSKuniyuki Iwashima struct tcp_options_received tcp_opt;
36084b114b9SEric Dumazet u32 tsoff = 0;
3618e7bab6bSKuniyuki Iwashima int mss;
3621da177e4SLinus Torvalds
363646697b9SFlorian Westphal if (tcp_synq_no_recent_overflow(sk))
364646697b9SFlorian Westphal goto out;
365646697b9SFlorian Westphal
3668e7bab6bSKuniyuki Iwashima mss = __cookie_v4_check(ip_hdr(skb), tcp_hdr(skb));
3678e7bab6bSKuniyuki Iwashima if (!mss) {
36845c28509SKuniyuki Iwashima __NET_INC_STATS(net, LINUX_MIB_SYNCOOKIESFAILED);
3691da177e4SLinus Torvalds goto out;
3701da177e4SLinus Torvalds }
3711da177e4SLinus Torvalds
37245c28509SKuniyuki Iwashima __NET_INC_STATS(net, LINUX_MIB_SYNCOOKIESRECV);
3731da177e4SLinus Torvalds
374bb5b7c11SDavid S. Miller /* check for timestamp cookie support */
375bb5b7c11SDavid S. Miller memset(&tcp_opt, 0, sizeof(tcp_opt));
37645c28509SKuniyuki Iwashima tcp_parse_options(net, skb, &tcp_opt, 0, NULL);
377bb5b7c11SDavid S. Miller
37884b114b9SEric Dumazet if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) {
37945c28509SKuniyuki Iwashima tsoff = secure_tcp_ts_off(net,
3805d2ed052SEric Dumazet ip_hdr(skb)->daddr,
3815d2ed052SEric Dumazet ip_hdr(skb)->saddr);
38284b114b9SEric Dumazet tcp_opt.rcv_tsecr -= tsoff;
38384b114b9SEric Dumazet }
38484b114b9SEric Dumazet
38545c28509SKuniyuki Iwashima if (!cookie_timestamp_decode(net, &tcp_opt))
3868c763681SFlorian Westphal goto out;
387bb5b7c11SDavid S. Miller
3888e7bab6bSKuniyuki Iwashima return cookie_tcp_reqsk_alloc(&tcp_request_sock_ops, sk, skb,
3898e7bab6bSKuniyuki Iwashima &tcp_opt, mss, tsoff);
3908e7bab6bSKuniyuki Iwashima out:
3918e7bab6bSKuniyuki Iwashima return ERR_PTR(-EINVAL);
3928e7bab6bSKuniyuki Iwashima }
3938e7bab6bSKuniyuki Iwashima
3948e7bab6bSKuniyuki Iwashima /* On input, sk is a listener.
3958e7bab6bSKuniyuki Iwashima * Output is listener if incoming packet would not create a child
3968e7bab6bSKuniyuki Iwashima * NULL if memory could not be allocated.
3978e7bab6bSKuniyuki Iwashima */
cookie_v4_check(struct sock * sk,struct sk_buff * skb)3988e7bab6bSKuniyuki Iwashima struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
3998e7bab6bSKuniyuki Iwashima {
4008e7bab6bSKuniyuki Iwashima struct ip_options *opt = &TCP_SKB_CB(skb)->header.h4.opt;
4018e7bab6bSKuniyuki Iwashima const struct tcphdr *th = tcp_hdr(skb);
4028e7bab6bSKuniyuki Iwashima struct tcp_sock *tp = tcp_sk(sk);
4038e7bab6bSKuniyuki Iwashima struct inet_request_sock *ireq;
4048e7bab6bSKuniyuki Iwashima struct net *net = sock_net(sk);
4058e7bab6bSKuniyuki Iwashima struct request_sock *req;
4068e7bab6bSKuniyuki Iwashima struct sock *ret = sk;
4078e7bab6bSKuniyuki Iwashima struct flowi4 fl4;
4088e7bab6bSKuniyuki Iwashima struct rtable *rt;
4098e7bab6bSKuniyuki Iwashima __u8 rcv_wscale;
4108e7bab6bSKuniyuki Iwashima int full_space;
41165be4393SJason Xing SKB_DR(reason);
4128e7bab6bSKuniyuki Iwashima
4138e7bab6bSKuniyuki Iwashima if (!READ_ONCE(net->ipv4.sysctl_tcp_syncookies) ||
4148e7bab6bSKuniyuki Iwashima !th->ack || th->rst)
4158e7bab6bSKuniyuki Iwashima goto out;
4168e7bab6bSKuniyuki Iwashima
417695751e3SKuniyuki Iwashima if (cookie_bpf_ok(skb)) {
418695751e3SKuniyuki Iwashima req = cookie_bpf_check(sk, skb);
419695751e3SKuniyuki Iwashima } else {
4208e7bab6bSKuniyuki Iwashima req = cookie_tcp_check(net, sk, skb);
4218e7bab6bSKuniyuki Iwashima if (IS_ERR(req))
4228e7bab6bSKuniyuki Iwashima goto out;
423695751e3SKuniyuki Iwashima }
424a4a69a37SJason Xing if (!req) {
425a4a69a37SJason Xing SKB_DR_SET(reason, NO_SOCKET);
42650468cddSKuniyuki Iwashima goto out_drop;
427a4a69a37SJason Xing }
4281da177e4SLinus Torvalds
4292e6599cbSArnaldo Carvalho de Melo ireq = inet_rsk(req);
4308e7bab6bSKuniyuki Iwashima
43108d2cc3bSEric Dumazet sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr);
43208d2cc3bSEric Dumazet sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr);
43316f86165SEric Dumazet
4341da177e4SLinus Torvalds /* We throwed the options of the initial SYN away, so we hope
4351da177e4SLinus Torvalds * the ACK carries the same options again (see RFC1122 4.2.3.8)
4361da177e4SLinus Torvalds */
43745c28509SKuniyuki Iwashima RCU_INIT_POINTER(ireq->ireq_opt, tcp_v4_save_options(net, skb));
4381da177e4SLinus Torvalds
439a4a69a37SJason Xing if (security_inet_conn_request(sk, skb, req)) {
440a4a69a37SJason Xing SKB_DR_SET(reason, SECURITY_HOOK);
44150468cddSKuniyuki Iwashima goto out_free;
442a4a69a37SJason Xing }
443284904aaSPaul Moore
4447b0f570fSKuniyuki Iwashima tcp_ao_syncookie(sk, skb, req, AF_INET);
4457b0f570fSKuniyuki Iwashima
4461da177e4SLinus Torvalds /*
4471da177e4SLinus Torvalds * We need to lookup the route here to get at the correct
4481da177e4SLinus Torvalds * window size. We should better make sure that the window size
4491da177e4SLinus Torvalds * hasn't changed since we received the original syn, but I see
4501da177e4SLinus Torvalds * no easy way to do this.
4511da177e4SLinus Torvalds */
4526dd9a14eSDavid Ahern flowi4_init_output(&fl4, ireq->ir_iif, ireq->ir_mark,
4536f8a76f8SGuillaume Nault ip_sock_rt_tos(sk), ip_sock_rt_scope(sk),
4546f8a76f8SGuillaume Nault IPPROTO_TCP, inet_sk_flowi_flags(sk),
455461b74c3SCong Wang opt->srr ? opt->faddr : ireq->ir_rmt_addr,
456e2d118a1SLorenzo Colitti ireq->ir_loc_addr, th->source, th->dest, sk->sk_uid);
4573df98d79SPaul Moore security_req_classify_flow(req, flowi4_to_flowi_common(&fl4));
45845c28509SKuniyuki Iwashima rt = ip_route_output_key(net, &fl4);
459a4a69a37SJason Xing if (IS_ERR(rt)) {
460a4a69a37SJason Xing SKB_DR_SET(reason, IP_OUTNOROUTES);
46150468cddSKuniyuki Iwashima goto out_free;
462a4a69a37SJason Xing }
4631da177e4SLinus Torvalds
4641da177e4SLinus Torvalds /* Try to redo what tcp_v4_send_synack did. */
465f410cbeaSEric Dumazet req->rsk_window_clamp = READ_ONCE(tp->window_clamp) ? :
466f410cbeaSEric Dumazet dst_metric(&rt->dst, RTAX_WINDOW);
467909172a1SMao Wenan /* limit the window selection if the user enforce a smaller rx buffer */
468909172a1SMao Wenan full_space = tcp_full_space(sk);
469909172a1SMao Wenan if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
470909172a1SMao Wenan (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
471909172a1SMao Wenan req->rsk_window_clamp = full_space;
4724dfc2817SFlorian Westphal
473909172a1SMao Wenan tcp_select_initial_window(sk, full_space, req->mss,
474ed53d0abSEric Dumazet &req->rsk_rcv_wnd, &req->rsk_window_clamp,
47531d12926Slaurent chavey ireq->wscale_ok, &rcv_wscale,
476d8d1f30bSChangli Gao dst_metric(&rt->dst, RTAX_INITRWND));
4774dfc2817SFlorian Westphal
478956c0d61SKuniyuki Iwashima /* req->syncookie is set true only if ACK is validated
479956c0d61SKuniyuki Iwashima * by BPF kfunc, then, rcv_wscale is already configured.
480956c0d61SKuniyuki Iwashima */
481695751e3SKuniyuki Iwashima if (!req->syncookie)
4822e6599cbSArnaldo Carvalho de Melo ireq->rcv_wscale = rcv_wscale;
4838e7bab6bSKuniyuki Iwashima ireq->ecn_ok &= cookie_ecn_ok(net, &rt->dst);
4841da177e4SLinus Torvalds
485efce3d1fSKuniyuki Iwashima ret = tcp_get_cookie_sock(sk, skb, req, &rt->dst);
486dfd25fffSEric Dumazet /* ip_queue_xmit() depends on our flow being setup
487dfd25fffSEric Dumazet * Normal sockets get it right from inet_csk_route_child_sock()
488dfd25fffSEric Dumazet */
489a4a69a37SJason Xing if (!ret) {
490a4a69a37SJason Xing SKB_DR_SET(reason, NO_SOCKET);
49165be4393SJason Xing goto out_drop;
492a4a69a37SJason Xing }
493a4a69a37SJason Xing inet_sk(ret)->cork.fl.u.ip4 = fl4;
49450468cddSKuniyuki Iwashima out:
49550468cddSKuniyuki Iwashima return ret;
49650468cddSKuniyuki Iwashima out_free:
49750468cddSKuniyuki Iwashima reqsk_free(req);
49850468cddSKuniyuki Iwashima out_drop:
499*46a02aa3SYan Zhai sk_skb_reason_drop(sk, skb, reason);
50050468cddSKuniyuki Iwashima return NULL;
5011da177e4SLinus Torvalds }
502