xref: /openbmc/linux/net/ipv4/tcp_minisocks.c (revision 740ea3c4a0b2e326b23d7cdf05472a0e92aa39bc)
1457c8996SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
21da177e4SLinus Torvalds /*
31da177e4SLinus Torvalds  * INET		An implementation of the TCP/IP protocol suite for the LINUX
41da177e4SLinus Torvalds  *		operating system.  INET is implemented using the  BSD Socket
51da177e4SLinus Torvalds  *		interface as the means of communication with the user level.
61da177e4SLinus Torvalds  *
71da177e4SLinus Torvalds  *		Implementation of the Transmission Control Protocol(TCP).
81da177e4SLinus Torvalds  *
902c30a84SJesper Juhl  * Authors:	Ross Biro
101da177e4SLinus Torvalds  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
111da177e4SLinus Torvalds  *		Mark Evans, <evansmp@uhura.aston.ac.uk>
121da177e4SLinus Torvalds  *		Corey Minyard <wf-rch!minyard@relay.EU.net>
131da177e4SLinus Torvalds  *		Florian La Roche, <flla@stud.uni-sb.de>
141da177e4SLinus Torvalds  *		Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
151da177e4SLinus Torvalds  *		Linus Torvalds, <torvalds@cs.helsinki.fi>
161da177e4SLinus Torvalds  *		Alan Cox, <gw4pts@gw4pts.ampr.org>
171da177e4SLinus Torvalds  *		Matthew Dillon, <dillon@apollo.west.oic.com>
181da177e4SLinus Torvalds  *		Arnt Gulbrandsen, <agulbra@nvg.unit.no>
191da177e4SLinus Torvalds  *		Jorge Cwik, <jorge@laser.satlink.net>
201da177e4SLinus Torvalds  */
211da177e4SLinus Torvalds 
221da177e4SLinus Torvalds #include <net/tcp.h>
231da177e4SLinus Torvalds #include <net/xfrm.h>
24e5907459SAlexander Duyck #include <net/busy_poll.h>
251da177e4SLinus Torvalds 
26a2a385d6SEric Dumazet static bool tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
271da177e4SLinus Torvalds {
281da177e4SLinus Torvalds 	if (seq == s_win)
29a2a385d6SEric Dumazet 		return true;
301da177e4SLinus Torvalds 	if (after(end_seq, s_win) && before(seq, e_win))
31a2a385d6SEric Dumazet 		return true;
32a02cec21SEric Dumazet 	return seq == e_win && seq == end_seq;
331da177e4SLinus Torvalds }
341da177e4SLinus Torvalds 
354fb17a60SNeal Cardwell static enum tcp_tw_status
364fb17a60SNeal Cardwell tcp_timewait_check_oow_rate_limit(struct inet_timewait_sock *tw,
374fb17a60SNeal Cardwell 				  const struct sk_buff *skb, int mib_idx)
384fb17a60SNeal Cardwell {
394fb17a60SNeal Cardwell 	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
404fb17a60SNeal Cardwell 
414fb17a60SNeal Cardwell 	if (!tcp_oow_rate_limited(twsk_net(tw), skb, mib_idx,
424fb17a60SNeal Cardwell 				  &tcptw->tw_last_oow_ack_time)) {
434fb17a60SNeal Cardwell 		/* Send ACK. Note, we do not put the bucket,
444fb17a60SNeal Cardwell 		 * it will be released by caller.
454fb17a60SNeal Cardwell 		 */
464fb17a60SNeal Cardwell 		return TCP_TW_ACK;
474fb17a60SNeal Cardwell 	}
484fb17a60SNeal Cardwell 
494fb17a60SNeal Cardwell 	/* We are rate-limiting, so just release the tw sock and drop skb. */
504fb17a60SNeal Cardwell 	inet_twsk_put(tw);
514fb17a60SNeal Cardwell 	return TCP_TW_SUCCESS;
524fb17a60SNeal Cardwell }
534fb17a60SNeal Cardwell 
541da177e4SLinus Torvalds /*
551da177e4SLinus Torvalds  * * Main purpose of TIME-WAIT state is to close connection gracefully,
561da177e4SLinus Torvalds  *   when one of ends sits in LAST-ACK or CLOSING retransmitting FIN
571da177e4SLinus Torvalds  *   (and, probably, tail of data) and one or more our ACKs are lost.
581da177e4SLinus Torvalds  * * What is TIME-WAIT timeout? It is associated with maximal packet
591da177e4SLinus Torvalds  *   lifetime in the internet, which results in wrong conclusion, that
601da177e4SLinus Torvalds  *   it is set to catch "old duplicate segments" wandering out of their path.
611da177e4SLinus Torvalds  *   It is not quite correct. This timeout is calculated so that it exceeds
621da177e4SLinus Torvalds  *   maximal retransmission timeout enough to allow to lose one (or more)
631da177e4SLinus Torvalds  *   segments sent by peer and our ACKs. This time may be calculated from RTO.
641da177e4SLinus Torvalds  * * When TIME-WAIT socket receives RST, it means that another end
651da177e4SLinus Torvalds  *   finally closed and we are allowed to kill TIME-WAIT too.
661da177e4SLinus Torvalds  * * Second purpose of TIME-WAIT is catching old duplicate segments.
671da177e4SLinus Torvalds  *   Well, certainly it is pure paranoia, but if we load TIME-WAIT
681da177e4SLinus Torvalds  *   with this semantics, we MUST NOT kill TIME-WAIT state with RSTs.
691da177e4SLinus Torvalds  * * If we invented some more clever way to catch duplicates
701da177e4SLinus Torvalds  *   (f.e. based on PAWS), we could truncate TIME-WAIT to several RTOs.
711da177e4SLinus Torvalds  *
721da177e4SLinus Torvalds  * The algorithm below is based on FORMAL INTERPRETATION of RFCs.
731da177e4SLinus Torvalds  * When you compare it to RFCs, please, read section SEGMENT ARRIVES
741da177e4SLinus Torvalds  * from the very beginning.
751da177e4SLinus Torvalds  *
761da177e4SLinus Torvalds  * NOTE. With recycling (and later with fin-wait-2) TW bucket
771da177e4SLinus Torvalds  * is _not_ stateless. It means, that strictly speaking we must
781da177e4SLinus Torvalds  * spinlock it. I do not want! Well, probability of misbehaviour
791da177e4SLinus Torvalds  * is ridiculously low and, seems, we could use some mb() tricks
801da177e4SLinus Torvalds  * to avoid misread sequence numbers, states etc.  --ANK
814308fc58SAlan Cox  *
824308fc58SAlan Cox  * We don't need to initialize tmp_out.sack_ok as we don't use the results
831da177e4SLinus Torvalds  */
841da177e4SLinus Torvalds enum tcp_tw_status
858feaf0c0SArnaldo Carvalho de Melo tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
868feaf0c0SArnaldo Carvalho de Melo 			   const struct tcphdr *th)
871da177e4SLinus Torvalds {
881da177e4SLinus Torvalds 	struct tcp_options_received tmp_opt;
894957faadSWilliam Allen Simpson 	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
90a2a385d6SEric Dumazet 	bool paws_reject = false;
911da177e4SLinus Torvalds 
92bb5b7c11SDavid S. Miller 	tmp_opt.saw_tstamp = 0;
938feaf0c0SArnaldo Carvalho de Melo 	if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
94eed29f17SEric Dumazet 		tcp_parse_options(twsk_net(tw), skb, &tmp_opt, 0, NULL);
951da177e4SLinus Torvalds 
961da177e4SLinus Torvalds 		if (tmp_opt.saw_tstamp) {
97eee2faabSAlexey Kodanev 			if (tmp_opt.rcv_tsecr)
98ee684b6fSAndrey Vagin 				tmp_opt.rcv_tsecr -= tcptw->tw_ts_offset;
998feaf0c0SArnaldo Carvalho de Melo 			tmp_opt.ts_recent	= tcptw->tw_ts_recent;
1008feaf0c0SArnaldo Carvalho de Melo 			tmp_opt.ts_recent_stamp	= tcptw->tw_ts_recent_stamp;
101c887e6d2SIlpo Järvinen 			paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
1021da177e4SLinus Torvalds 		}
1031da177e4SLinus Torvalds 	}
1041da177e4SLinus Torvalds 
1051da177e4SLinus Torvalds 	if (tw->tw_substate == TCP_FIN_WAIT2) {
1061da177e4SLinus Torvalds 		/* Just repeat all the checks of tcp_rcv_state_process() */
1071da177e4SLinus Torvalds 
1081da177e4SLinus Torvalds 		/* Out of window, send ACK */
1091da177e4SLinus Torvalds 		if (paws_reject ||
1101da177e4SLinus Torvalds 		    !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
1118feaf0c0SArnaldo Carvalho de Melo 				   tcptw->tw_rcv_nxt,
1128feaf0c0SArnaldo Carvalho de Melo 				   tcptw->tw_rcv_nxt + tcptw->tw_rcv_wnd))
1134fb17a60SNeal Cardwell 			return tcp_timewait_check_oow_rate_limit(
1144fb17a60SNeal Cardwell 				tw, skb, LINUX_MIB_TCPACKSKIPPEDFINWAIT2);
1151da177e4SLinus Torvalds 
1161da177e4SLinus Torvalds 		if (th->rst)
1171da177e4SLinus Torvalds 			goto kill;
1181da177e4SLinus Torvalds 
1198feaf0c0SArnaldo Carvalho de Melo 		if (th->syn && !before(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt))
120271c3b9bSFlorian Westphal 			return TCP_TW_RST;
1211da177e4SLinus Torvalds 
1221da177e4SLinus Torvalds 		/* Dup ACK? */
1231ac530b3SWei Yongjun 		if (!th->ack ||
1241ac530b3SWei Yongjun 		    !after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
1251da177e4SLinus Torvalds 		    TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
1268feaf0c0SArnaldo Carvalho de Melo 			inet_twsk_put(tw);
1271da177e4SLinus Torvalds 			return TCP_TW_SUCCESS;
1281da177e4SLinus Torvalds 		}
1291da177e4SLinus Torvalds 
1301da177e4SLinus Torvalds 		/* New data or FIN. If new data arrive after half-duplex close,
1311da177e4SLinus Torvalds 		 * reset.
1321da177e4SLinus Torvalds 		 */
1331da177e4SLinus Torvalds 		if (!th->fin ||
134271c3b9bSFlorian Westphal 		    TCP_SKB_CB(skb)->end_seq != tcptw->tw_rcv_nxt + 1)
1351da177e4SLinus Torvalds 			return TCP_TW_RST;
1361da177e4SLinus Torvalds 
1371da177e4SLinus Torvalds 		/* FIN arrived, enter true time-wait state. */
1381da177e4SLinus Torvalds 		tw->tw_substate	  = TCP_TIME_WAIT;
1398feaf0c0SArnaldo Carvalho de Melo 		tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
1401da177e4SLinus Torvalds 		if (tmp_opt.saw_tstamp) {
141cca9bab1SArnd Bergmann 			tcptw->tw_ts_recent_stamp = ktime_get_seconds();
1428feaf0c0SArnaldo Carvalho de Melo 			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
1431da177e4SLinus Torvalds 		}
1441da177e4SLinus Torvalds 
145ed2e9239SEric Dumazet 		inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
1461da177e4SLinus Torvalds 		return TCP_TW_ACK;
1471da177e4SLinus Torvalds 	}
1481da177e4SLinus Torvalds 
1491da177e4SLinus Torvalds 	/*
1501da177e4SLinus Torvalds 	 *	Now real TIME-WAIT state.
1511da177e4SLinus Torvalds 	 *
1521da177e4SLinus Torvalds 	 *	RFC 1122:
1531da177e4SLinus Torvalds 	 *	"When a connection is [...] on TIME-WAIT state [...]
1541da177e4SLinus Torvalds 	 *	[a TCP] MAY accept a new SYN from the remote TCP to
1551da177e4SLinus Torvalds 	 *	reopen the connection directly, if it:
1561da177e4SLinus Torvalds 	 *
1571da177e4SLinus Torvalds 	 *	(1)  assigns its initial sequence number for the new
1581da177e4SLinus Torvalds 	 *	connection to be larger than the largest sequence
1591da177e4SLinus Torvalds 	 *	number it used on the previous connection incarnation,
1601da177e4SLinus Torvalds 	 *	and
1611da177e4SLinus Torvalds 	 *
1621da177e4SLinus Torvalds 	 *	(2)  returns to TIME-WAIT state if the SYN turns out
1631da177e4SLinus Torvalds 	 *	to be an old duplicate".
1641da177e4SLinus Torvalds 	 */
1651da177e4SLinus Torvalds 
1661da177e4SLinus Torvalds 	if (!paws_reject &&
1678feaf0c0SArnaldo Carvalho de Melo 	    (TCP_SKB_CB(skb)->seq == tcptw->tw_rcv_nxt &&
1681da177e4SLinus Torvalds 	     (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq || th->rst))) {
1691da177e4SLinus Torvalds 		/* In window segment, it may be only reset or bare ack. */
1701da177e4SLinus Torvalds 
1711da177e4SLinus Torvalds 		if (th->rst) {
172caa20d9aSStephen Hemminger 			/* This is TIME_WAIT assassination, in two flavors.
1731da177e4SLinus Torvalds 			 * Oh well... nobody has a sufficient solution to this
1741da177e4SLinus Torvalds 			 * protocol bug yet.
1751da177e4SLinus Torvalds 			 */
1760b484c91SKuniyuki Iwashima 			if (!READ_ONCE(twsk_net(tw)->ipv4.sysctl_tcp_rfc1337)) {
1771da177e4SLinus Torvalds kill:
178dbe7faa4SEric Dumazet 				inet_twsk_deschedule_put(tw);
1791da177e4SLinus Torvalds 				return TCP_TW_SUCCESS;
1801da177e4SLinus Torvalds 			}
18163cc357fSFlorian Westphal 		} else {
182ed2e9239SEric Dumazet 			inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
18363cc357fSFlorian Westphal 		}
1841da177e4SLinus Torvalds 
1851da177e4SLinus Torvalds 		if (tmp_opt.saw_tstamp) {
1868feaf0c0SArnaldo Carvalho de Melo 			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
187cca9bab1SArnd Bergmann 			tcptw->tw_ts_recent_stamp = ktime_get_seconds();
1881da177e4SLinus Torvalds 		}
1891da177e4SLinus Torvalds 
1908feaf0c0SArnaldo Carvalho de Melo 		inet_twsk_put(tw);
1911da177e4SLinus Torvalds 		return TCP_TW_SUCCESS;
1921da177e4SLinus Torvalds 	}
1931da177e4SLinus Torvalds 
1941da177e4SLinus Torvalds 	/* Out of window segment.
1951da177e4SLinus Torvalds 
1961da177e4SLinus Torvalds 	   All the segments are ACKed immediately.
1971da177e4SLinus Torvalds 
1981da177e4SLinus Torvalds 	   The only exception is new SYN. We accept it, if it is
1991da177e4SLinus Torvalds 	   not old duplicate and we are not in danger to be killed
2001da177e4SLinus Torvalds 	   by delayed old duplicates. RFC check is that it has
2011da177e4SLinus Torvalds 	   newer sequence number works at rates <40Mbit/sec.
2021da177e4SLinus Torvalds 	   However, if paws works, it is reliable AND even more,
2031da177e4SLinus Torvalds 	   we even may relax silly seq space cutoff.
2041da177e4SLinus Torvalds 
2051da177e4SLinus Torvalds 	   RED-PEN: we violate main RFC requirement, if this SYN will appear
2061da177e4SLinus Torvalds 	   old duplicate (i.e. we receive RST in reply to SYN-ACK),
2071da177e4SLinus Torvalds 	   we must return socket to time-wait state. It is not good,
2081da177e4SLinus Torvalds 	   but not fatal yet.
2091da177e4SLinus Torvalds 	 */
2101da177e4SLinus Torvalds 
2111da177e4SLinus Torvalds 	if (th->syn && !th->rst && !th->ack && !paws_reject &&
2128feaf0c0SArnaldo Carvalho de Melo 	    (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) ||
2138feaf0c0SArnaldo Carvalho de Melo 	     (tmp_opt.saw_tstamp &&
2148feaf0c0SArnaldo Carvalho de Melo 	      (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) {
2158feaf0c0SArnaldo Carvalho de Melo 		u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
2161da177e4SLinus Torvalds 		if (isn == 0)
2171da177e4SLinus Torvalds 			isn++;
21804317dafSEric Dumazet 		TCP_SKB_CB(skb)->tcp_tw_isn = isn;
2191da177e4SLinus Torvalds 		return TCP_TW_SYN;
2201da177e4SLinus Torvalds 	}
2211da177e4SLinus Torvalds 
2221da177e4SLinus Torvalds 	if (paws_reject)
22302a1d6e7SEric Dumazet 		__NET_INC_STATS(twsk_net(tw), LINUX_MIB_PAWSESTABREJECTED);
2241da177e4SLinus Torvalds 
2251da177e4SLinus Torvalds 	if (!th->rst) {
2261da177e4SLinus Torvalds 		/* In this case we must reset the TIMEWAIT timer.
2271da177e4SLinus Torvalds 		 *
2281da177e4SLinus Torvalds 		 * If it is ACKless SYN it may be both old duplicate
2291da177e4SLinus Torvalds 		 * and new good SYN with random sequence number <rcv_nxt.
2301da177e4SLinus Torvalds 		 * Do not reschedule in the last case.
2311da177e4SLinus Torvalds 		 */
2321da177e4SLinus Torvalds 		if (paws_reject || th->ack)
233ed2e9239SEric Dumazet 			inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
2341da177e4SLinus Torvalds 
2354fb17a60SNeal Cardwell 		return tcp_timewait_check_oow_rate_limit(
2364fb17a60SNeal Cardwell 			tw, skb, LINUX_MIB_TCPACKSKIPPEDTIMEWAIT);
2371da177e4SLinus Torvalds 	}
2388feaf0c0SArnaldo Carvalho de Melo 	inet_twsk_put(tw);
2391da177e4SLinus Torvalds 	return TCP_TW_SUCCESS;
2401da177e4SLinus Torvalds }
2414bc2f18bSEric Dumazet EXPORT_SYMBOL(tcp_timewait_state_process);
2421da177e4SLinus Torvalds 
2431da177e4SLinus Torvalds /*
2441da177e4SLinus Torvalds  * Move a socket to time-wait or dead fin-wait-2 state.
2451da177e4SLinus Torvalds  */
2461da177e4SLinus Torvalds void tcp_time_wait(struct sock *sk, int state, int timeo)
2471da177e4SLinus Torvalds {
2488292a17aSArnaldo Carvalho de Melo 	const struct inet_connection_sock *icsk = inet_csk(sk);
2498feaf0c0SArnaldo Carvalho de Melo 	const struct tcp_sock *tp = tcp_sk(sk);
25008eaef90SKuniyuki Iwashima 	struct net *net = sock_net(sk);
251789f558cSEric Dumazet 	struct inet_timewait_sock *tw;
2521da177e4SLinus Torvalds 
253e9bd0ccaSKuniyuki Iwashima 	tw = inet_twsk_alloc(sk, &net->ipv4.tcp_death_row, state);
2541da177e4SLinus Torvalds 
25500db4124SIan Morris 	if (tw) {
2568feaf0c0SArnaldo Carvalho de Melo 		struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
257463c84b9SArnaldo Carvalho de Melo 		const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
2582397849bSDavid S. Miller 		struct inet_sock *inet = inet_sk(sk);
2598feaf0c0SArnaldo Carvalho de Melo 
2602397849bSDavid S. Miller 		tw->tw_transparent	= inet->transparent;
26100483690SJon Maxwell 		tw->tw_mark		= sk->sk_mark;
262f6c0f5d2SEric Dumazet 		tw->tw_priority		= sk->sk_priority;
2631da177e4SLinus Torvalds 		tw->tw_rcv_wscale	= tp->rx_opt.rcv_wscale;
2648feaf0c0SArnaldo Carvalho de Melo 		tcptw->tw_rcv_nxt	= tp->rcv_nxt;
2658feaf0c0SArnaldo Carvalho de Melo 		tcptw->tw_snd_nxt	= tp->snd_nxt;
2668feaf0c0SArnaldo Carvalho de Melo 		tcptw->tw_rcv_wnd	= tcp_receive_window(tp);
2678feaf0c0SArnaldo Carvalho de Melo 		tcptw->tw_ts_recent	= tp->rx_opt.ts_recent;
2688feaf0c0SArnaldo Carvalho de Melo 		tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
269ceaa1fefSAndrey Vagin 		tcptw->tw_ts_offset	= tp->tsoffset;
2704fb17a60SNeal Cardwell 		tcptw->tw_last_oow_ack_time = 0;
271a842fe14SEric Dumazet 		tcptw->tw_tx_delay	= tp->tcp_tx_delay;
272dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6)
2731da177e4SLinus Torvalds 		if (tw->tw_family == PF_INET6) {
2741da177e4SLinus Torvalds 			struct ipv6_pinfo *np = inet6_sk(sk);
2751da177e4SLinus Torvalds 
276efe4208fSEric Dumazet 			tw->tw_v6_daddr = sk->sk_v6_daddr;
277efe4208fSEric Dumazet 			tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
278b903d324SEric Dumazet 			tw->tw_tclass = np->tclass;
27921858cd0SFlorent Fourcot 			tw->tw_flowlabel = be32_to_cpu(np->flow_label & IPV6_FLOWLABEL_MASK);
280c67b8555SEric Dumazet 			tw->tw_txhash = sk->sk_txhash;
2819fe516baSEric Dumazet 			tw->tw_ipv6only = sk->sk_ipv6only;
282c676270bSArnaldo Carvalho de Melo 		}
2831da177e4SLinus Torvalds #endif
284cfb6eeb4SYOSHIFUJI Hideaki 
285cfb6eeb4SYOSHIFUJI Hideaki #ifdef CONFIG_TCP_MD5SIG
286cfb6eeb4SYOSHIFUJI Hideaki 		/*
287cfb6eeb4SYOSHIFUJI Hideaki 		 * The timewait bucket does not have the key DB from the
288cfb6eeb4SYOSHIFUJI Hideaki 		 * sock structure. We just make a quick copy of the
289cfb6eeb4SYOSHIFUJI Hideaki 		 * md5 key being used (if indeed we are using one)
290cfb6eeb4SYOSHIFUJI Hideaki 		 * so the timewait ack generating code has the key.
291cfb6eeb4SYOSHIFUJI Hideaki 		 */
292cfb6eeb4SYOSHIFUJI Hideaki 		do {
293a915da9bSEric Dumazet 			tcptw->tw_md5_key = NULL;
2946aedbf98SEric Dumazet 			if (static_branch_unlikely(&tcp_md5_needed)) {
2956aedbf98SEric Dumazet 				struct tcp_md5sig_key *key;
2966aedbf98SEric Dumazet 
297cfb6eeb4SYOSHIFUJI Hideaki 				key = tp->af_specific->md5_lookup(sk, sk);
29800db4124SIan Morris 				if (key) {
299a915da9bSEric Dumazet 					tcptw->tw_md5_key = kmemdup(key, sizeof(*key), GFP_ATOMIC);
30049ca1943SGustavo A. R. Silva 					BUG_ON(tcptw->tw_md5_key && !tcp_alloc_md5sig_pool());
301cfb6eeb4SYOSHIFUJI Hideaki 				}
3026aedbf98SEric Dumazet 			}
303cfb6eeb4SYOSHIFUJI Hideaki 		} while (0);
304cfb6eeb4SYOSHIFUJI Hideaki #endif
305cfb6eeb4SYOSHIFUJI Hideaki 
3061da177e4SLinus Torvalds 		/* Get the TIME_WAIT timeout firing. */
3071da177e4SLinus Torvalds 		if (timeo < rto)
3081da177e4SLinus Torvalds 			timeo = rto;
3091da177e4SLinus Torvalds 
3101da177e4SLinus Torvalds 		if (state == TCP_TIME_WAIT)
3111da177e4SLinus Torvalds 			timeo = TCP_TIMEWAIT_LEN;
3121da177e4SLinus Torvalds 
313cfac7f83SEric Dumazet 		/* tw_timer is pinned, so we need to make sure BH are disabled
314cfac7f83SEric Dumazet 		 * in following section, otherwise timer handler could run before
315cfac7f83SEric Dumazet 		 * we complete the initialization.
316cfac7f83SEric Dumazet 		 */
317cfac7f83SEric Dumazet 		local_bh_disable();
318789f558cSEric Dumazet 		inet_twsk_schedule(tw, timeo);
319ec94c269SEric Dumazet 		/* Linkage updates.
320ec94c269SEric Dumazet 		 * Note that access to tw after this point is illegal.
321ec94c269SEric Dumazet 		 */
3224461568aSKuniyuki Iwashima 		inet_twsk_hashdance(tw, sk, net->ipv4.tcp_death_row.hashinfo);
323cfac7f83SEric Dumazet 		local_bh_enable();
3241da177e4SLinus Torvalds 	} else {
3251da177e4SLinus Torvalds 		/* Sorry, if we're out of memory, just CLOSE this
3261da177e4SLinus Torvalds 		 * socket up.  We've got bigger problems than
3271da177e4SLinus Torvalds 		 * non-graceful socket closings.
3281da177e4SLinus Torvalds 		 */
32908eaef90SKuniyuki Iwashima 		NET_INC_STATS(net, LINUX_MIB_TCPTIMEWAITOVERFLOW);
3301da177e4SLinus Torvalds 	}
3311da177e4SLinus Torvalds 
3321da177e4SLinus Torvalds 	tcp_update_metrics(sk);
3331da177e4SLinus Torvalds 	tcp_done(sk);
3341da177e4SLinus Torvalds }
335cc35c88aSAtul Gupta EXPORT_SYMBOL(tcp_time_wait);
3361da177e4SLinus Torvalds 
337cfb6eeb4SYOSHIFUJI Hideaki void tcp_twsk_destructor(struct sock *sk)
338cfb6eeb4SYOSHIFUJI Hideaki {
339b6242b9bSDavid S. Miller #ifdef CONFIG_TCP_MD5SIG
3406aedbf98SEric Dumazet 	if (static_branch_unlikely(&tcp_md5_needed)) {
341a928630aSDavid S. Miller 		struct tcp_timewait_sock *twsk = tcp_twsk(sk);
3422397849bSDavid S. Miller 
34371cea17eSEric Dumazet 		if (twsk->tw_md5_key)
344a915da9bSEric Dumazet 			kfree_rcu(twsk->tw_md5_key, rcu);
3456aedbf98SEric Dumazet 	}
346cfb6eeb4SYOSHIFUJI Hideaki #endif
347cfb6eeb4SYOSHIFUJI Hideaki }
348cfb6eeb4SYOSHIFUJI Hideaki EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
349cfb6eeb4SYOSHIFUJI Hideaki 
350edc12f03SKuniyuki Iwashima void tcp_twsk_purge(struct list_head *net_exit_list, int family)
351edc12f03SKuniyuki Iwashima {
352d1e5e640SKuniyuki Iwashima 	bool purged_once = false;
353edc12f03SKuniyuki Iwashima 	struct net *net;
354edc12f03SKuniyuki Iwashima 
355edc12f03SKuniyuki Iwashima 	list_for_each_entry(net, net_exit_list, exit_list) {
356*740ea3c4SKuniyuki Iwashima 		if (net->ipv4.tcp_death_row.hashinfo->pernet) {
357*740ea3c4SKuniyuki Iwashima 			/* Even if tw_refcount == 1, we must clean up kernel reqsk */
358*740ea3c4SKuniyuki Iwashima 			inet_twsk_purge(net->ipv4.tcp_death_row.hashinfo, family);
359*740ea3c4SKuniyuki Iwashima 		} else if (!purged_once) {
360edc12f03SKuniyuki Iwashima 			/* The last refcount is decremented in tcp_sk_exit_batch() */
361edc12f03SKuniyuki Iwashima 			if (refcount_read(&net->ipv4.tcp_death_row.tw_refcount) == 1)
362edc12f03SKuniyuki Iwashima 				continue;
363edc12f03SKuniyuki Iwashima 
364edc12f03SKuniyuki Iwashima 			inet_twsk_purge(&tcp_hashinfo, family);
365d1e5e640SKuniyuki Iwashima 			purged_once = true;
366d1e5e640SKuniyuki Iwashima 		}
367edc12f03SKuniyuki Iwashima 	}
368edc12f03SKuniyuki Iwashima }
369edc12f03SKuniyuki Iwashima EXPORT_SYMBOL_GPL(tcp_twsk_purge);
370edc12f03SKuniyuki Iwashima 
371b1964b5fSEric Dumazet /* Warning : This function is called without sk_listener being locked.
372b1964b5fSEric Dumazet  * Be sure to read socket fields once, as their value could change under us.
373b1964b5fSEric Dumazet  */
374843f4a55SYuchung Cheng void tcp_openreq_init_rwin(struct request_sock *req,
375b1964b5fSEric Dumazet 			   const struct sock *sk_listener,
376b1964b5fSEric Dumazet 			   const struct dst_entry *dst)
377843f4a55SYuchung Cheng {
378843f4a55SYuchung Cheng 	struct inet_request_sock *ireq = inet_rsk(req);
379b1964b5fSEric Dumazet 	const struct tcp_sock *tp = tcp_sk(sk_listener);
380b1964b5fSEric Dumazet 	int full_space = tcp_full_space(sk_listener);
381b1964b5fSEric Dumazet 	u32 window_clamp;
382b1964b5fSEric Dumazet 	__u8 rcv_wscale;
38313d3b1ebSLawrence Brakmo 	u32 rcv_wnd;
3843541f9e8SEric Dumazet 	int mss;
385843f4a55SYuchung Cheng 
3863541f9e8SEric Dumazet 	mss = tcp_mss_clamp(tp, dst_metric_advmss(dst));
387b1964b5fSEric Dumazet 	window_clamp = READ_ONCE(tp->window_clamp);
388843f4a55SYuchung Cheng 	/* Set this up on the first call only */
389ed53d0abSEric Dumazet 	req->rsk_window_clamp = window_clamp ? : dst_metric(dst, RTAX_WINDOW);
390843f4a55SYuchung Cheng 
391843f4a55SYuchung Cheng 	/* limit the window selection if the user enforce a smaller rx buffer */
392b1964b5fSEric Dumazet 	if (sk_listener->sk_userlocks & SOCK_RCVBUF_LOCK &&
393ed53d0abSEric Dumazet 	    (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
394ed53d0abSEric Dumazet 		req->rsk_window_clamp = full_space;
395843f4a55SYuchung Cheng 
39613d3b1ebSLawrence Brakmo 	rcv_wnd = tcp_rwnd_init_bpf((struct sock *)req);
39713d3b1ebSLawrence Brakmo 	if (rcv_wnd == 0)
39813d3b1ebSLawrence Brakmo 		rcv_wnd = dst_metric(dst, RTAX_INITRWND);
39913d3b1ebSLawrence Brakmo 	else if (full_space < rcv_wnd * mss)
40013d3b1ebSLawrence Brakmo 		full_space = rcv_wnd * mss;
40113d3b1ebSLawrence Brakmo 
402843f4a55SYuchung Cheng 	/* tcp_full_space because it is guaranteed to be the first packet */
403ceef9ab6SEric Dumazet 	tcp_select_initial_window(sk_listener, full_space,
404843f4a55SYuchung Cheng 		mss - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
405ed53d0abSEric Dumazet 		&req->rsk_rcv_wnd,
406ed53d0abSEric Dumazet 		&req->rsk_window_clamp,
407843f4a55SYuchung Cheng 		ireq->wscale_ok,
408843f4a55SYuchung Cheng 		&rcv_wscale,
40913d3b1ebSLawrence Brakmo 		rcv_wnd);
410843f4a55SYuchung Cheng 	ireq->rcv_wscale = rcv_wscale;
411843f4a55SYuchung Cheng }
412843f4a55SYuchung Cheng EXPORT_SYMBOL(tcp_openreq_init_rwin);
413843f4a55SYuchung Cheng 
414735d3831SFlorian Westphal static void tcp_ecn_openreq_child(struct tcp_sock *tp,
415735d3831SFlorian Westphal 				  const struct request_sock *req)
416bdf1ee5dSIlpo Järvinen {
417bdf1ee5dSIlpo Järvinen 	tp->ecn_flags = inet_rsk(req)->ecn_ok ? TCP_ECN_OK : 0;
418bdf1ee5dSIlpo Järvinen }
419bdf1ee5dSIlpo Järvinen 
42081164413SDaniel Borkmann void tcp_ca_openreq_child(struct sock *sk, const struct dst_entry *dst)
42181164413SDaniel Borkmann {
42281164413SDaniel Borkmann 	struct inet_connection_sock *icsk = inet_csk(sk);
42381164413SDaniel Borkmann 	u32 ca_key = dst_metric(dst, RTAX_CC_ALGO);
42481164413SDaniel Borkmann 	bool ca_got_dst = false;
42581164413SDaniel Borkmann 
42681164413SDaniel Borkmann 	if (ca_key != TCP_CA_UNSPEC) {
42781164413SDaniel Borkmann 		const struct tcp_congestion_ops *ca;
42881164413SDaniel Borkmann 
42981164413SDaniel Borkmann 		rcu_read_lock();
43081164413SDaniel Borkmann 		ca = tcp_ca_find_key(ca_key);
4310baf26b0SMartin KaFai Lau 		if (likely(ca && bpf_try_module_get(ca, ca->owner))) {
43281164413SDaniel Borkmann 			icsk->icsk_ca_dst_locked = tcp_ca_dst_locked(dst);
43381164413SDaniel Borkmann 			icsk->icsk_ca_ops = ca;
43481164413SDaniel Borkmann 			ca_got_dst = true;
43581164413SDaniel Borkmann 		}
43681164413SDaniel Borkmann 		rcu_read_unlock();
43781164413SDaniel Borkmann 	}
43881164413SDaniel Borkmann 
4399f950415SNeal Cardwell 	/* If no valid choice made yet, assign current system default ca. */
4409f950415SNeal Cardwell 	if (!ca_got_dst &&
4419f950415SNeal Cardwell 	    (!icsk->icsk_ca_setsockopt ||
4420baf26b0SMartin KaFai Lau 	     !bpf_try_module_get(icsk->icsk_ca_ops, icsk->icsk_ca_ops->owner)))
44381164413SDaniel Borkmann 		tcp_assign_congestion_control(sk);
44481164413SDaniel Borkmann 
44581164413SDaniel Borkmann 	tcp_set_ca_state(sk, TCP_CA_Open);
44681164413SDaniel Borkmann }
44781164413SDaniel Borkmann EXPORT_SYMBOL_GPL(tcp_ca_openreq_child);
44881164413SDaniel Borkmann 
44960e2a778SUrsula Braun static void smc_check_reset_syn_req(struct tcp_sock *oldtp,
45060e2a778SUrsula Braun 				    struct request_sock *req,
45160e2a778SUrsula Braun 				    struct tcp_sock *newtp)
45260e2a778SUrsula Braun {
45360e2a778SUrsula Braun #if IS_ENABLED(CONFIG_SMC)
45460e2a778SUrsula Braun 	struct inet_request_sock *ireq;
45560e2a778SUrsula Braun 
45660e2a778SUrsula Braun 	if (static_branch_unlikely(&tcp_have_smc)) {
45760e2a778SUrsula Braun 		ireq = inet_rsk(req);
45860e2a778SUrsula Braun 		if (oldtp->syn_smc && !ireq->smc_ok)
45960e2a778SUrsula Braun 			newtp->syn_smc = 0;
46060e2a778SUrsula Braun 	}
46160e2a778SUrsula Braun #endif
46260e2a778SUrsula Braun }
46360e2a778SUrsula Braun 
4641da177e4SLinus Torvalds /* This is not only more efficient than what we used to do, it eliminates
4651da177e4SLinus Torvalds  * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM
4661da177e4SLinus Torvalds  *
4671da177e4SLinus Torvalds  * Actually, we could lots of memory writes here. tp of listening
4681da177e4SLinus Torvalds  * socket contains all necessary default parameters.
4691da177e4SLinus Torvalds  */
470c28c6f04SEric Dumazet struct sock *tcp_create_openreq_child(const struct sock *sk,
471c28c6f04SEric Dumazet 				      struct request_sock *req,
472c28c6f04SEric Dumazet 				      struct sk_buff *skb)
4731da177e4SLinus Torvalds {
474e56c57d0SEric Dumazet 	struct sock *newsk = inet_csk_clone_lock(sk, req, GFP_ATOMIC);
4759f1d2604SArnaldo Carvalho de Melo 	const struct inet_request_sock *ireq = inet_rsk(req);
4762e6599cbSArnaldo Carvalho de Melo 	struct tcp_request_sock *treq = tcp_rsk(req);
477242b1bbeSEric Dumazet 	struct inet_connection_sock *newicsk;
478242b1bbeSEric Dumazet 	struct tcp_sock *oldtp, *newtp;
479dba7d9b8SEric Dumazet 	u32 seq;
480242b1bbeSEric Dumazet 
481242b1bbeSEric Dumazet 	if (!newsk)
482242b1bbeSEric Dumazet 		return NULL;
483242b1bbeSEric Dumazet 
484242b1bbeSEric Dumazet 	newicsk = inet_csk(newsk);
485242b1bbeSEric Dumazet 	newtp = tcp_sk(newsk);
486242b1bbeSEric Dumazet 	oldtp = tcp_sk(sk);
48760e2a778SUrsula Braun 
48860e2a778SUrsula Braun 	smc_check_reset_syn_req(oldtp, req, newtp);
4891da177e4SLinus Torvalds 
4901da177e4SLinus Torvalds 	/* Now setup tcp_sock */
49131770e34SFlorian Westphal 	newtp->pred_flags = 0;
49231770e34SFlorian Westphal 
493dba7d9b8SEric Dumazet 	seq = treq->rcv_isn + 1;
494dba7d9b8SEric Dumazet 	newtp->rcv_wup = seq;
4957db48e98SEric Dumazet 	WRITE_ONCE(newtp->copied_seq, seq);
496dba7d9b8SEric Dumazet 	WRITE_ONCE(newtp->rcv_nxt, seq);
497a9d99ce2SEric Dumazet 	newtp->segs_in = 1;
498435cf559SWilliam Allen Simpson 
499e0d694d6SEric Dumazet 	seq = treq->snt_isn + 1;
500e0d694d6SEric Dumazet 	newtp->snd_sml = newtp->snd_una = seq;
501e0d694d6SEric Dumazet 	WRITE_ONCE(newtp->snd_nxt, seq);
502e0d694d6SEric Dumazet 	newtp->snd_up = seq;
5031da177e4SLinus Torvalds 
50446d3ceabSEric Dumazet 	INIT_LIST_HEAD(&newtp->tsq_node);
505e2080072SEric Dumazet 	INIT_LIST_HEAD(&newtp->tsorted_sent_queue);
5061da177e4SLinus Torvalds 
507ee7537b6SHantzis Fotis 	tcp_init_wl(newtp, treq->rcv_isn);
5081da177e4SLinus Torvalds 
509ac9517fcSEric Dumazet 	minmax_reset(&newtp->rtt_min, tcp_jiffies32, ~0U);
51070eabf0eSEric Dumazet 	newicsk->icsk_ack.lrcvtime = tcp_jiffies32;
5111da177e4SLinus Torvalds 
5129a568de4SEric Dumazet 	newtp->lsndtime = tcp_jiffies32;
513d8ed6250SEric Dumazet 	newsk->sk_txhash = treq->txhash;
514375fe02cSYuchung Cheng 	newtp->total_retrans = req->num_retrans;
5151da177e4SLinus Torvalds 
5161da177e4SLinus Torvalds 	tcp_init_xmit_timers(newsk);
5170f317464SEric Dumazet 	WRITE_ONCE(newtp->write_seq, newtp->pushed_seq = treq->snt_isn + 1);
5181da177e4SLinus Torvalds 
5191da177e4SLinus Torvalds 	if (sock_flag(newsk, SOCK_KEEPOPEN))
520463c84b9SArnaldo Carvalho de Melo 		inet_csk_reset_keepalive_timer(newsk,
5211da177e4SLinus Torvalds 					       keepalive_time_when(newtp));
5221da177e4SLinus Torvalds 
5232e6599cbSArnaldo Carvalho de Melo 	newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
524713bafeaSYuchung Cheng 	newtp->rx_opt.sack_ok = ireq->sack_ok;
525ed53d0abSEric Dumazet 	newtp->window_clamp = req->rsk_window_clamp;
526ed53d0abSEric Dumazet 	newtp->rcv_ssthresh = req->rsk_rcv_wnd;
527ed53d0abSEric Dumazet 	newtp->rcv_wnd = req->rsk_rcv_wnd;
5282e6599cbSArnaldo Carvalho de Melo 	newtp->rx_opt.wscale_ok = ireq->wscale_ok;
5291da177e4SLinus Torvalds 	if (newtp->rx_opt.wscale_ok) {
5302e6599cbSArnaldo Carvalho de Melo 		newtp->rx_opt.snd_wscale = ireq->snd_wscale;
5312e6599cbSArnaldo Carvalho de Melo 		newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
5321da177e4SLinus Torvalds 	} else {
5331da177e4SLinus Torvalds 		newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
5341da177e4SLinus Torvalds 		newtp->window_clamp = min(newtp->window_clamp, 65535U);
5351da177e4SLinus Torvalds 	}
536242b1bbeSEric Dumazet 	newtp->snd_wnd = ntohs(tcp_hdr(skb)->window) << newtp->rx_opt.snd_wscale;
5371da177e4SLinus Torvalds 	newtp->max_window = newtp->snd_wnd;
5381da177e4SLinus Torvalds 
5391da177e4SLinus Torvalds 	if (newtp->rx_opt.tstamp_ok) {
5401da177e4SLinus Torvalds 		newtp->rx_opt.ts_recent = req->ts_recent;
541cca9bab1SArnd Bergmann 		newtp->rx_opt.ts_recent_stamp = ktime_get_seconds();
5421da177e4SLinus Torvalds 		newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
5431da177e4SLinus Torvalds 	} else {
5441da177e4SLinus Torvalds 		newtp->rx_opt.ts_recent_stamp = 0;
5451da177e4SLinus Torvalds 		newtp->tcp_header_len = sizeof(struct tcphdr);
5461da177e4SLinus Torvalds 	}
547336c39a0SYuchung Cheng 	if (req->num_timeout) {
548336c39a0SYuchung Cheng 		newtp->undo_marker = treq->snt_isn;
549336c39a0SYuchung Cheng 		newtp->retrans_stamp = div_u64(treq->snt_synack,
550336c39a0SYuchung Cheng 					       USEC_PER_SEC / TCP_TS_HZ);
551336c39a0SYuchung Cheng 	}
55295a22caeSFlorian Westphal 	newtp->tsoffset = treq->ts_off;
553cfb6eeb4SYOSHIFUJI Hideaki #ifdef CONFIG_TCP_MD5SIG
554cfb6eeb4SYOSHIFUJI Hideaki 	newtp->md5sig_info = NULL;	/*XXX*/
5555b0b9e4cSFrancesco Ruggeri 	if (treq->af_specific->req_md5_lookup(sk, req_to_sk(req)))
556cfb6eeb4SYOSHIFUJI Hideaki 		newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
557cfb6eeb4SYOSHIFUJI Hideaki #endif
558bee7ca9eSWilliam Allen Simpson 	if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
559463c84b9SArnaldo Carvalho de Melo 		newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
5601da177e4SLinus Torvalds 	newtp->rx_opt.mss_clamp = req->mss;
561735d3831SFlorian Westphal 	tcp_ecn_openreq_child(newtp, req);
5628b485ce6SEric Dumazet 	newtp->fastopen_req = NULL;
563d983ea6fSEric Dumazet 	RCU_INIT_POINTER(newtp->fastopen_rsk, NULL);
5641da177e4SLinus Torvalds 
565061ff040SMartin KaFai Lau 	newtp->bpf_chg_cc_inprogress = 0;
566e8025155SJakub Sitnicki 	tcp_bpf_clone(sk, newsk);
567e8025155SJakub Sitnicki 
56890bbcc60SEric Dumazet 	__TCP_INC_STATS(sock_net(sk), TCP_MIB_PASSIVEOPENS);
569242b1bbeSEric Dumazet 
5701da177e4SLinus Torvalds 	return newsk;
5711da177e4SLinus Torvalds }
5724bc2f18bSEric Dumazet EXPORT_SYMBOL(tcp_create_openreq_child);
5731da177e4SLinus Torvalds 
5741da177e4SLinus Torvalds /*
5758336886fSJerry Chu  * Process an incoming packet for SYN_RECV sockets represented as a
5768336886fSJerry Chu  * request_sock. Normally sk is the listener socket but for TFO it
5778336886fSJerry Chu  * points to the child socket.
5788336886fSJerry Chu  *
5798336886fSJerry Chu  * XXX (TFO) - The current impl contains a special check for ack
5808336886fSJerry Chu  * validation and inside tcp_v4_reqsk_send_ack(). Can we do better?
5814308fc58SAlan Cox  *
5824308fc58SAlan Cox  * We don't need to initialize tmp_opt.sack_ok as we don't use the results
5831da177e4SLinus Torvalds  */
5841da177e4SLinus Torvalds 
5851da177e4SLinus Torvalds struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
58660236fddSArnaldo Carvalho de Melo 			   struct request_sock *req,
587e0f9759fSEric Dumazet 			   bool fastopen, bool *req_stolen)
5881da177e4SLinus Torvalds {
5894957faadSWilliam Allen Simpson 	struct tcp_options_received tmp_opt;
5904957faadSWilliam Allen Simpson 	struct sock *child;
591aa8223c7SArnaldo Carvalho de Melo 	const struct tcphdr *th = tcp_hdr(skb);
592714e85beSAl Viro 	__be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
593a2a385d6SEric Dumazet 	bool paws_reject = false;
5945e0724d0SEric Dumazet 	bool own_req;
5951da177e4SLinus Torvalds 
596bb5b7c11SDavid S. Miller 	tmp_opt.saw_tstamp = 0;
597bb5b7c11SDavid S. Miller 	if (th->doff > (sizeof(struct tcphdr)>>2)) {
598eed29f17SEric Dumazet 		tcp_parse_options(sock_net(sk), skb, &tmp_opt, 0, NULL);
5991da177e4SLinus Torvalds 
6001da177e4SLinus Torvalds 		if (tmp_opt.saw_tstamp) {
6011da177e4SLinus Torvalds 			tmp_opt.ts_recent = req->ts_recent;
60295a22caeSFlorian Westphal 			if (tmp_opt.rcv_tsecr)
60395a22caeSFlorian Westphal 				tmp_opt.rcv_tsecr -= tcp_rsk(req)->ts_off;
6041da177e4SLinus Torvalds 			/* We do not store true stamp, but it is not required,
6051da177e4SLinus Torvalds 			 * it can be estimated (approximately)
6061da177e4SLinus Torvalds 			 * from another data.
6071da177e4SLinus Torvalds 			 */
6085903123fSAkhmat Karakotov 			tmp_opt.ts_recent_stamp = ktime_get_seconds() - reqsk_timeout(req, TCP_RTO_MAX) / HZ;
609c887e6d2SIlpo Järvinen 			paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
6101da177e4SLinus Torvalds 		}
6111da177e4SLinus Torvalds 	}
6121da177e4SLinus Torvalds 
6131da177e4SLinus Torvalds 	/* Check for pure retransmitted SYN. */
6142e6599cbSArnaldo Carvalho de Melo 	if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
6151da177e4SLinus Torvalds 	    flg == TCP_FLAG_SYN &&
6161da177e4SLinus Torvalds 	    !paws_reject) {
6171da177e4SLinus Torvalds 		/*
6181da177e4SLinus Torvalds 		 * RFC793 draws (Incorrectly! It was fixed in RFC1122)
6191da177e4SLinus Torvalds 		 * this case on figure 6 and figure 8, but formal
6201da177e4SLinus Torvalds 		 * protocol description says NOTHING.
6211da177e4SLinus Torvalds 		 * To be more exact, it says that we should send ACK,
6221da177e4SLinus Torvalds 		 * because this segment (at least, if it has no data)
6231da177e4SLinus Torvalds 		 * is out of window.
6241da177e4SLinus Torvalds 		 *
6251da177e4SLinus Torvalds 		 *  CONCLUSION: RFC793 (even with RFC1122) DOES NOT
6261da177e4SLinus Torvalds 		 *  describe SYN-RECV state. All the description
6271da177e4SLinus Torvalds 		 *  is wrong, we cannot believe to it and should
6281da177e4SLinus Torvalds 		 *  rely only on common sense and implementation
6291da177e4SLinus Torvalds 		 *  experience.
6301da177e4SLinus Torvalds 		 *
6311da177e4SLinus Torvalds 		 * Enforce "SYN-ACK" according to figure 8, figure 6
6321da177e4SLinus Torvalds 		 * of RFC793, fixed by RFC1122.
6338336886fSJerry Chu 		 *
6348336886fSJerry Chu 		 * Note that even if there is new data in the SYN packet
6358336886fSJerry Chu 		 * they will be thrown away too.
636cd75eff6SYuchung Cheng 		 *
637cd75eff6SYuchung Cheng 		 * Reset timer after retransmitting SYNACK, similar to
638cd75eff6SYuchung Cheng 		 * the idea of fast retransmit in recovery.
6391da177e4SLinus Torvalds 		 */
640a9b2c06dSNeal Cardwell 		if (!tcp_oow_rate_limited(sock_net(sk), skb,
641a9b2c06dSNeal Cardwell 					  LINUX_MIB_TCPACKSKIPPEDSYNRECV,
642a9b2c06dSNeal Cardwell 					  &tcp_rsk(req)->last_oow_ack_time) &&
643a9b2c06dSNeal Cardwell 
644dd929c1bSEric Dumazet 		    !inet_rtx_syn_ack(sk, req)) {
645dd929c1bSEric Dumazet 			unsigned long expires = jiffies;
646dd929c1bSEric Dumazet 
6475903123fSAkhmat Karakotov 			expires += reqsk_timeout(req, TCP_RTO_MAX);
648dd929c1bSEric Dumazet 			if (!fastopen)
649dd929c1bSEric Dumazet 				mod_timer_pending(&req->rsk_timer, expires);
650dd929c1bSEric Dumazet 			else
651dd929c1bSEric Dumazet 				req->rsk_timer.expires = expires;
652dd929c1bSEric Dumazet 		}
6531da177e4SLinus Torvalds 		return NULL;
6541da177e4SLinus Torvalds 	}
6551da177e4SLinus Torvalds 
6561da177e4SLinus Torvalds 	/* Further reproduces section "SEGMENT ARRIVES"
6571da177e4SLinus Torvalds 	   for state SYN-RECEIVED of RFC793.
6581da177e4SLinus Torvalds 	   It is broken, however, it does not work only
6591da177e4SLinus Torvalds 	   when SYNs are crossed.
6601da177e4SLinus Torvalds 
6611da177e4SLinus Torvalds 	   You would think that SYN crossing is impossible here, since
6621da177e4SLinus Torvalds 	   we should have a SYN_SENT socket (from connect()) on our end,
6631da177e4SLinus Torvalds 	   but this is not true if the crossed SYNs were sent to both
6641da177e4SLinus Torvalds 	   ends by a malicious third party.  We must defend against this,
6651da177e4SLinus Torvalds 	   and to do that we first verify the ACK (as per RFC793, page
6661da177e4SLinus Torvalds 	   36) and reset if it is invalid.  Is this a true full defense?
6671da177e4SLinus Torvalds 	   To convince ourselves, let us consider a way in which the ACK
6681da177e4SLinus Torvalds 	   test can still pass in this 'malicious crossed SYNs' case.
6691da177e4SLinus Torvalds 	   Malicious sender sends identical SYNs (and thus identical sequence
6701da177e4SLinus Torvalds 	   numbers) to both A and B:
6711da177e4SLinus Torvalds 
6721da177e4SLinus Torvalds 		A: gets SYN, seq=7
6731da177e4SLinus Torvalds 		B: gets SYN, seq=7
6741da177e4SLinus Torvalds 
6751da177e4SLinus Torvalds 	   By our good fortune, both A and B select the same initial
6761da177e4SLinus Torvalds 	   send sequence number of seven :-)
6771da177e4SLinus Torvalds 
6781da177e4SLinus Torvalds 		A: sends SYN|ACK, seq=7, ack_seq=8
6791da177e4SLinus Torvalds 		B: sends SYN|ACK, seq=7, ack_seq=8
6801da177e4SLinus Torvalds 
6811da177e4SLinus Torvalds 	   So we are now A eating this SYN|ACK, ACK test passes.  So
6821da177e4SLinus Torvalds 	   does sequence test, SYN is truncated, and thus we consider
6831da177e4SLinus Torvalds 	   it a bare ACK.
6841da177e4SLinus Torvalds 
685ec0a1966SDavid S. Miller 	   If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this
686ec0a1966SDavid S. Miller 	   bare ACK.  Otherwise, we create an established connection.  Both
687ec0a1966SDavid S. Miller 	   ends (listening sockets) accept the new incoming connection and try
688ec0a1966SDavid S. Miller 	   to talk to each other. 8-)
6891da177e4SLinus Torvalds 
6901da177e4SLinus Torvalds 	   Note: This case is both harmless, and rare.  Possibility is about the
6911da177e4SLinus Torvalds 	   same as us discovering intelligent life on another plant tomorrow.
6921da177e4SLinus Torvalds 
6931da177e4SLinus Torvalds 	   But generally, we should (RFC lies!) to accept ACK
6941da177e4SLinus Torvalds 	   from SYNACK both here and in tcp_rcv_state_process().
6951da177e4SLinus Torvalds 	   tcp_rcv_state_process() does not, hence, we do not too.
6961da177e4SLinus Torvalds 
6971da177e4SLinus Torvalds 	   Note that the case is absolutely generic:
6981da177e4SLinus Torvalds 	   we cannot optimize anything here without
6991da177e4SLinus Torvalds 	   violating protocol. All the checks must be made
7001da177e4SLinus Torvalds 	   before attempt to create socket.
7011da177e4SLinus Torvalds 	 */
7021da177e4SLinus Torvalds 
7031da177e4SLinus Torvalds 	/* RFC793 page 36: "If the connection is in any non-synchronized state ...
7041da177e4SLinus Torvalds 	 *                  and the incoming segment acknowledges something not yet
705caa20d9aSStephen Hemminger 	 *                  sent (the segment carries an unacceptable ACK) ...
7061da177e4SLinus Torvalds 	 *                  a reset is sent."
7071da177e4SLinus Torvalds 	 *
7088336886fSJerry Chu 	 * Invalid ACK: reset will be sent by listening socket.
7098336886fSJerry Chu 	 * Note that the ACK validity check for a Fast Open socket is done
7108336886fSJerry Chu 	 * elsewhere and is checked directly against the child socket rather
7118336886fSJerry Chu 	 * than req because user data may have been sent out.
7121da177e4SLinus Torvalds 	 */
7138336886fSJerry Chu 	if ((flg & TCP_FLAG_ACK) && !fastopen &&
714435cf559SWilliam Allen Simpson 	    (TCP_SKB_CB(skb)->ack_seq !=
7151a2c6181SChristoph Paasch 	     tcp_rsk(req)->snt_isn + 1))
7161da177e4SLinus Torvalds 		return sk;
7171da177e4SLinus Torvalds 
7181da177e4SLinus Torvalds 	/* Also, it would be not so bad idea to check rcv_tsecr, which
7191da177e4SLinus Torvalds 	 * is essentially ACK extension and too early or too late values
7201da177e4SLinus Torvalds 	 * should cause reset in unsynchronized states.
7211da177e4SLinus Torvalds 	 */
7221da177e4SLinus Torvalds 
7231da177e4SLinus Torvalds 	/* RFC793: "first check sequence number". */
7241da177e4SLinus Torvalds 
7251da177e4SLinus Torvalds 	if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
726ed53d0abSEric Dumazet 					  tcp_rsk(req)->rcv_nxt, tcp_rsk(req)->rcv_nxt + req->rsk_rcv_wnd)) {
7271da177e4SLinus Torvalds 		/* Out of window: send ACK and drop. */
7284ce7e93cSEric Dumazet 		if (!(flg & TCP_FLAG_RST) &&
7294ce7e93cSEric Dumazet 		    !tcp_oow_rate_limited(sock_net(sk), skb,
7304ce7e93cSEric Dumazet 					  LINUX_MIB_TCPACKSKIPPEDSYNRECV,
7314ce7e93cSEric Dumazet 					  &tcp_rsk(req)->last_oow_ack_time))
7326edafaafSGui Jianfeng 			req->rsk_ops->send_ack(sk, skb, req);
7331da177e4SLinus Torvalds 		if (paws_reject)
73402a1d6e7SEric Dumazet 			__NET_INC_STATS(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
7351da177e4SLinus Torvalds 		return NULL;
7361da177e4SLinus Torvalds 	}
7371da177e4SLinus Torvalds 
7381da177e4SLinus Torvalds 	/* In sequence, PAWS is OK. */
7391da177e4SLinus Torvalds 
7408336886fSJerry Chu 	if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt))
7411da177e4SLinus Torvalds 		req->ts_recent = tmp_opt.rcv_tsval;
7421da177e4SLinus Torvalds 
7432e6599cbSArnaldo Carvalho de Melo 	if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
7441da177e4SLinus Torvalds 		/* Truncate SYN, it is out of window starting
7452e6599cbSArnaldo Carvalho de Melo 		   at tcp_rsk(req)->rcv_isn + 1. */
7461da177e4SLinus Torvalds 		flg &= ~TCP_FLAG_SYN;
7471da177e4SLinus Torvalds 	}
7481da177e4SLinus Torvalds 
7491da177e4SLinus Torvalds 	/* RFC793: "second check the RST bit" and
7501da177e4SLinus Torvalds 	 *	   "fourth, check the SYN bit"
7511da177e4SLinus Torvalds 	 */
7523687b1dcSWei Yongjun 	if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
75390bbcc60SEric Dumazet 		__TCP_INC_STATS(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
7541da177e4SLinus Torvalds 		goto embryonic_reset;
7553687b1dcSWei Yongjun 	}
7561da177e4SLinus Torvalds 
7571da177e4SLinus Torvalds 	/* ACK sequence verified above, just make sure ACK is
7581da177e4SLinus Torvalds 	 * set.  If ACK not set, just silently drop the packet.
7598336886fSJerry Chu 	 *
7608336886fSJerry Chu 	 * XXX (TFO) - if we ever allow "data after SYN", the
7618336886fSJerry Chu 	 * following check needs to be removed.
7621da177e4SLinus Torvalds 	 */
7631da177e4SLinus Torvalds 	if (!(flg & TCP_FLAG_ACK))
7641da177e4SLinus Torvalds 		return NULL;
7651da177e4SLinus Torvalds 
7668336886fSJerry Chu 	/* For Fast Open no more processing is needed (sk is the
7678336886fSJerry Chu 	 * child socket).
7688336886fSJerry Chu 	 */
7698336886fSJerry Chu 	if (fastopen)
7708336886fSJerry Chu 		return sk;
7718336886fSJerry Chu 
772d1b99ba4SJulian Anastasov 	/* While TCP_DEFER_ACCEPT is active, drop bare ACK. */
773e6c022a4SEric Dumazet 	if (req->num_timeout < inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
774ec0a1966SDavid S. Miller 	    TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
775ec0a1966SDavid S. Miller 		inet_rsk(req)->acked = 1;
77602a1d6e7SEric Dumazet 		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPDEFERACCEPTDROP);
777ec0a1966SDavid S. Miller 		return NULL;
778ec0a1966SDavid S. Miller 	}
779ec0a1966SDavid S. Miller 
7801da177e4SLinus Torvalds 	/* OK, ACK is valid, create big socket and
7811da177e4SLinus Torvalds 	 * feed this segment to it. It will repeat all
7821da177e4SLinus Torvalds 	 * the tests. THIS SEGMENT MUST MOVE SOCKET TO
7831da177e4SLinus Torvalds 	 * ESTABLISHED STATE. If it will be dropped after
7841da177e4SLinus Torvalds 	 * socket is created, wait for troubles.
7851da177e4SLinus Torvalds 	 */
7865e0724d0SEric Dumazet 	child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
7875e0724d0SEric Dumazet 							 req, &own_req);
78851456b29SIan Morris 	if (!child)
7891da177e4SLinus Torvalds 		goto listen_overflow;
7901da177e4SLinus Torvalds 
79190bf4513SPaolo Abeni 	if (own_req && rsk_drop_req(req)) {
792d4f2c86bSKuniyuki Iwashima 		reqsk_queue_removed(&inet_csk(req->rsk_listener)->icsk_accept_queue, req);
793d4f2c86bSKuniyuki Iwashima 		inet_csk_reqsk_queue_drop_and_put(req->rsk_listener, req);
794f296234cSPeter Krystad 		return child;
795f296234cSPeter Krystad 	}
796f296234cSPeter Krystad 
7976bcfd7f8SEric Dumazet 	sock_rps_save_rxhash(child, skb);
7980f1c28aeSYuchung Cheng 	tcp_synack_rtt_meas(child, req);
799e0f9759fSEric Dumazet 	*req_stolen = !own_req;
8005e0724d0SEric Dumazet 	return inet_csk_complete_hashdance(sk, child, req, own_req);
8011da177e4SLinus Torvalds 
8021da177e4SLinus Torvalds listen_overflow:
80355d444b3SKuniyuki Iwashima 	if (sk != req->rsk_listener)
80455d444b3SKuniyuki Iwashima 		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMIGRATEREQFAILURE);
80555d444b3SKuniyuki Iwashima 
8062d17d9c7SKuniyuki Iwashima 	if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_abort_on_overflow)) {
8072e6599cbSArnaldo Carvalho de Melo 		inet_rsk(req)->acked = 1;
8081da177e4SLinus Torvalds 		return NULL;
8091da177e4SLinus Torvalds 	}
8101da177e4SLinus Torvalds 
8111da177e4SLinus Torvalds embryonic_reset:
8128336886fSJerry Chu 	if (!(flg & TCP_FLAG_RST)) {
8138336886fSJerry Chu 		/* Received a bad SYN pkt - for TFO We try not to reset
8148336886fSJerry Chu 		 * the local connection unless it's really necessary to
8158336886fSJerry Chu 		 * avoid becoming vulnerable to outside attack aiming at
8168336886fSJerry Chu 		 * resetting legit local connections.
8178336886fSJerry Chu 		 */
818cfb6eeb4SYOSHIFUJI Hideaki 		req->rsk_ops->send_reset(sk, skb);
8198336886fSJerry Chu 	} else if (fastopen) { /* received a valid RST pkt */
8208336886fSJerry Chu 		reqsk_fastopen_remove(sk, req, true);
821049fe386SFlorian Westphal 		tcp_reset(sk, skb);
8228336886fSJerry Chu 	}
8238336886fSJerry Chu 	if (!fastopen) {
8247233da86SAlexander Ovechkin 		bool unlinked = inet_csk_reqsk_queue_drop(sk, req);
8257233da86SAlexander Ovechkin 
8267233da86SAlexander Ovechkin 		if (unlinked)
82702a1d6e7SEric Dumazet 			__NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
8287233da86SAlexander Ovechkin 		*req_stolen = !unlinked;
8298336886fSJerry Chu 	}
8301da177e4SLinus Torvalds 	return NULL;
8311da177e4SLinus Torvalds }
8324bc2f18bSEric Dumazet EXPORT_SYMBOL(tcp_check_req);
8331da177e4SLinus Torvalds 
8341da177e4SLinus Torvalds /*
8351da177e4SLinus Torvalds  * Queue segment on the new socket if the new socket is active,
8361da177e4SLinus Torvalds  * otherwise we just shortcircuit this and continue with
8371da177e4SLinus Torvalds  * the new socket.
8388336886fSJerry Chu  *
8398336886fSJerry Chu  * For the vast majority of cases child->sk_state will be TCP_SYN_RECV
8408336886fSJerry Chu  * when entering. But other states are possible due to a race condition
8418336886fSJerry Chu  * where after __inet_lookup_established() fails but before the listener
8428336886fSJerry Chu  * locked is obtained, other packets cause the same connection to
8438336886fSJerry Chu  * be created.
8441da177e4SLinus Torvalds  */
8451da177e4SLinus Torvalds 
8461da177e4SLinus Torvalds int tcp_child_process(struct sock *parent, struct sock *child,
8471da177e4SLinus Torvalds 		      struct sk_buff *skb)
848734c8f75SJules Irenge 	__releases(&((child)->sk_lock.slock))
8491da177e4SLinus Torvalds {
8501da177e4SLinus Torvalds 	int ret = 0;
8511da177e4SLinus Torvalds 	int state = child->sk_state;
8521da177e4SLinus Torvalds 
85303cfda4fSEric Dumazet 	/* record sk_napi_id and sk_rx_queue_mapping of child. */
85403cfda4fSEric Dumazet 	sk_mark_napi_id_set(child, skb);
855e5907459SAlexander Duyck 
856a44d6eacSMartin KaFai Lau 	tcp_segs_in(tcp_sk(child), skb);
8571da177e4SLinus Torvalds 	if (!sock_owned_by_user(child)) {
85872ab4a86SEric Dumazet 		ret = tcp_rcv_state_process(child, skb);
8591da177e4SLinus Torvalds 		/* Wakeup parent, send SIGIO */
8601da177e4SLinus Torvalds 		if (state == TCP_SYN_RECV && child->sk_state != state)
861676d2369SDavid S. Miller 			parent->sk_data_ready(parent);
8621da177e4SLinus Torvalds 	} else {
8631da177e4SLinus Torvalds 		/* Alas, it is possible again, because we do lookup
8641da177e4SLinus Torvalds 		 * in main socket hash table and lock on listening
8651da177e4SLinus Torvalds 		 * socket does not protect us more.
8661da177e4SLinus Torvalds 		 */
867a3a858ffSZhu Yi 		__sk_add_backlog(child, skb);
8681da177e4SLinus Torvalds 	}
8691da177e4SLinus Torvalds 
8701da177e4SLinus Torvalds 	bh_unlock_sock(child);
8711da177e4SLinus Torvalds 	sock_put(child);
8721da177e4SLinus Torvalds 	return ret;
8731da177e4SLinus Torvalds }
8741da177e4SLinus Torvalds EXPORT_SYMBOL(tcp_child_process);
875