1 /* 2 * INET An implementation of the TCP/IP protocol suite for the LINUX 3 * operating system. INET is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * Support for INET connection oriented protocols. 7 * 8 * Authors: See the TCP sources 9 * 10 * This program is free software; you can redistribute it and/or 11 * modify it under the terms of the GNU General Public License 12 * as published by the Free Software Foundation; either version 13 * 2 of the License, or(at your option) any later version. 14 */ 15 16 #include <linux/module.h> 17 #include <linux/jhash.h> 18 19 #include <net/inet_connection_sock.h> 20 #include <net/inet_hashtables.h> 21 #include <net/inet_timewait_sock.h> 22 #include <net/ip.h> 23 #include <net/route.h> 24 #include <net/tcp_states.h> 25 #include <net/xfrm.h> 26 27 #ifdef INET_CSK_DEBUG 28 const char inet_csk_timer_bug_msg[] = "inet_csk BUG: unknown timer value\n"; 29 EXPORT_SYMBOL(inet_csk_timer_bug_msg); 30 #endif 31 32 /* 33 * This struct holds the first and last local port number. 34 */ 35 struct local_ports sysctl_local_ports __read_mostly = { 36 .lock = __SEQLOCK_UNLOCKED(sysctl_local_ports.lock), 37 .range = { 32768, 61000 }, 38 }; 39 40 unsigned long *sysctl_local_reserved_ports; 41 EXPORT_SYMBOL(sysctl_local_reserved_ports); 42 43 void inet_get_local_port_range(int *low, int *high) 44 { 45 unsigned int seq; 46 47 do { 48 seq = read_seqbegin(&sysctl_local_ports.lock); 49 50 *low = sysctl_local_ports.range[0]; 51 *high = sysctl_local_ports.range[1]; 52 } while (read_seqretry(&sysctl_local_ports.lock, seq)); 53 } 54 EXPORT_SYMBOL(inet_get_local_port_range); 55 56 int inet_csk_bind_conflict(const struct sock *sk, 57 const struct inet_bind_bucket *tb, bool relax) 58 { 59 struct sock *sk2; 60 struct hlist_node *node; 61 int reuse = sk->sk_reuse; 62 int reuseport = sk->sk_reuseport; 63 kuid_t uid = sock_i_uid((struct sock *)sk); 64 65 /* 66 * Unlike other sk lookup places we do not check 67 * for sk_net here, since _all_ the socks listed 68 * in tb->owners list belong to the same net - the 69 * one this bucket belongs to. 70 */ 71 72 sk_for_each_bound(sk2, node, &tb->owners) { 73 if (sk != sk2 && 74 !inet_v6_ipv6only(sk2) && 75 (!sk->sk_bound_dev_if || 76 !sk2->sk_bound_dev_if || 77 sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) { 78 if ((!reuse || !sk2->sk_reuse || 79 sk2->sk_state == TCP_LISTEN) && 80 (!reuseport || !sk2->sk_reuseport || 81 (sk2->sk_state != TCP_TIME_WAIT && 82 !uid_eq(uid, sock_i_uid(sk2))))) { 83 const __be32 sk2_rcv_saddr = sk_rcv_saddr(sk2); 84 if (!sk2_rcv_saddr || !sk_rcv_saddr(sk) || 85 sk2_rcv_saddr == sk_rcv_saddr(sk)) 86 break; 87 } 88 if (!relax && reuse && sk2->sk_reuse && 89 sk2->sk_state != TCP_LISTEN) { 90 const __be32 sk2_rcv_saddr = sk_rcv_saddr(sk2); 91 92 if (!sk2_rcv_saddr || !sk_rcv_saddr(sk) || 93 sk2_rcv_saddr == sk_rcv_saddr(sk)) 94 break; 95 } 96 } 97 } 98 return node != NULL; 99 } 100 EXPORT_SYMBOL_GPL(inet_csk_bind_conflict); 101 102 /* Obtain a reference to a local port for the given sock, 103 * if snum is zero it means select any available local port. 104 */ 105 int inet_csk_get_port(struct sock *sk, unsigned short snum) 106 { 107 struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo; 108 struct inet_bind_hashbucket *head; 109 struct hlist_node *node; 110 struct inet_bind_bucket *tb; 111 int ret, attempts = 5; 112 struct net *net = sock_net(sk); 113 int smallest_size = -1, smallest_rover; 114 kuid_t uid = sock_i_uid(sk); 115 116 local_bh_disable(); 117 if (!snum) { 118 int remaining, rover, low, high; 119 120 again: 121 inet_get_local_port_range(&low, &high); 122 remaining = (high - low) + 1; 123 smallest_rover = rover = net_random() % remaining + low; 124 125 smallest_size = -1; 126 do { 127 if (inet_is_reserved_local_port(rover)) 128 goto next_nolock; 129 head = &hashinfo->bhash[inet_bhashfn(net, rover, 130 hashinfo->bhash_size)]; 131 spin_lock(&head->lock); 132 inet_bind_bucket_for_each(tb, node, &head->chain) 133 if (net_eq(ib_net(tb), net) && tb->port == rover) { 134 if (((tb->fastreuse > 0 && 135 sk->sk_reuse && 136 sk->sk_state != TCP_LISTEN) || 137 (tb->fastreuseport > 0 && 138 sk->sk_reuseport && 139 uid_eq(tb->fastuid, uid))) && 140 (tb->num_owners < smallest_size || smallest_size == -1)) { 141 smallest_size = tb->num_owners; 142 smallest_rover = rover; 143 if (atomic_read(&hashinfo->bsockets) > (high - low) + 1 && 144 !inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, false)) { 145 snum = smallest_rover; 146 goto tb_found; 147 } 148 } 149 if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, false)) { 150 snum = rover; 151 goto tb_found; 152 } 153 goto next; 154 } 155 break; 156 next: 157 spin_unlock(&head->lock); 158 next_nolock: 159 if (++rover > high) 160 rover = low; 161 } while (--remaining > 0); 162 163 /* Exhausted local port range during search? It is not 164 * possible for us to be holding one of the bind hash 165 * locks if this test triggers, because if 'remaining' 166 * drops to zero, we broke out of the do/while loop at 167 * the top level, not from the 'break;' statement. 168 */ 169 ret = 1; 170 if (remaining <= 0) { 171 if (smallest_size != -1) { 172 snum = smallest_rover; 173 goto have_snum; 174 } 175 goto fail; 176 } 177 /* OK, here is the one we will use. HEAD is 178 * non-NULL and we hold it's mutex. 179 */ 180 snum = rover; 181 } else { 182 have_snum: 183 head = &hashinfo->bhash[inet_bhashfn(net, snum, 184 hashinfo->bhash_size)]; 185 spin_lock(&head->lock); 186 inet_bind_bucket_for_each(tb, node, &head->chain) 187 if (net_eq(ib_net(tb), net) && tb->port == snum) 188 goto tb_found; 189 } 190 tb = NULL; 191 goto tb_not_found; 192 tb_found: 193 if (!hlist_empty(&tb->owners)) { 194 if (sk->sk_reuse == SK_FORCE_REUSE) 195 goto success; 196 197 if (((tb->fastreuse > 0 && 198 sk->sk_reuse && sk->sk_state != TCP_LISTEN) || 199 (tb->fastreuseport > 0 && 200 sk->sk_reuseport && uid_eq(tb->fastuid, uid))) && 201 smallest_size == -1) { 202 goto success; 203 } else { 204 ret = 1; 205 if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, true)) { 206 if (((sk->sk_reuse && sk->sk_state != TCP_LISTEN) || 207 (tb->fastreuseport > 0 && 208 sk->sk_reuseport && uid_eq(tb->fastuid, uid))) && 209 smallest_size != -1 && --attempts >= 0) { 210 spin_unlock(&head->lock); 211 goto again; 212 } 213 214 goto fail_unlock; 215 } 216 } 217 } 218 tb_not_found: 219 ret = 1; 220 if (!tb && (tb = inet_bind_bucket_create(hashinfo->bind_bucket_cachep, 221 net, head, snum)) == NULL) 222 goto fail_unlock; 223 if (hlist_empty(&tb->owners)) { 224 if (sk->sk_reuse && sk->sk_state != TCP_LISTEN) 225 tb->fastreuse = 1; 226 else 227 tb->fastreuse = 0; 228 if (sk->sk_reuseport) { 229 tb->fastreuseport = 1; 230 tb->fastuid = uid; 231 } else 232 tb->fastreuseport = 0; 233 } else { 234 if (tb->fastreuse && 235 (!sk->sk_reuse || sk->sk_state == TCP_LISTEN)) 236 tb->fastreuse = 0; 237 if (tb->fastreuseport && 238 (!sk->sk_reuseport || !uid_eq(tb->fastuid, uid))) 239 tb->fastreuseport = 0; 240 } 241 success: 242 if (!inet_csk(sk)->icsk_bind_hash) 243 inet_bind_hash(sk, tb, snum); 244 WARN_ON(inet_csk(sk)->icsk_bind_hash != tb); 245 ret = 0; 246 247 fail_unlock: 248 spin_unlock(&head->lock); 249 fail: 250 local_bh_enable(); 251 return ret; 252 } 253 EXPORT_SYMBOL_GPL(inet_csk_get_port); 254 255 /* 256 * Wait for an incoming connection, avoid race conditions. This must be called 257 * with the socket locked. 258 */ 259 static int inet_csk_wait_for_connect(struct sock *sk, long timeo) 260 { 261 struct inet_connection_sock *icsk = inet_csk(sk); 262 DEFINE_WAIT(wait); 263 int err; 264 265 /* 266 * True wake-one mechanism for incoming connections: only 267 * one process gets woken up, not the 'whole herd'. 268 * Since we do not 'race & poll' for established sockets 269 * anymore, the common case will execute the loop only once. 270 * 271 * Subtle issue: "add_wait_queue_exclusive()" will be added 272 * after any current non-exclusive waiters, and we know that 273 * it will always _stay_ after any new non-exclusive waiters 274 * because all non-exclusive waiters are added at the 275 * beginning of the wait-queue. As such, it's ok to "drop" 276 * our exclusiveness temporarily when we get woken up without 277 * having to remove and re-insert us on the wait queue. 278 */ 279 for (;;) { 280 prepare_to_wait_exclusive(sk_sleep(sk), &wait, 281 TASK_INTERRUPTIBLE); 282 release_sock(sk); 283 if (reqsk_queue_empty(&icsk->icsk_accept_queue)) 284 timeo = schedule_timeout(timeo); 285 lock_sock(sk); 286 err = 0; 287 if (!reqsk_queue_empty(&icsk->icsk_accept_queue)) 288 break; 289 err = -EINVAL; 290 if (sk->sk_state != TCP_LISTEN) 291 break; 292 err = sock_intr_errno(timeo); 293 if (signal_pending(current)) 294 break; 295 err = -EAGAIN; 296 if (!timeo) 297 break; 298 } 299 finish_wait(sk_sleep(sk), &wait); 300 return err; 301 } 302 303 /* 304 * This will accept the next outstanding connection. 305 */ 306 struct sock *inet_csk_accept(struct sock *sk, int flags, int *err) 307 { 308 struct inet_connection_sock *icsk = inet_csk(sk); 309 struct request_sock_queue *queue = &icsk->icsk_accept_queue; 310 struct sock *newsk; 311 struct request_sock *req; 312 int error; 313 314 lock_sock(sk); 315 316 /* We need to make sure that this socket is listening, 317 * and that it has something pending. 318 */ 319 error = -EINVAL; 320 if (sk->sk_state != TCP_LISTEN) 321 goto out_err; 322 323 /* Find already established connection */ 324 if (reqsk_queue_empty(queue)) { 325 long timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK); 326 327 /* If this is a non blocking socket don't sleep */ 328 error = -EAGAIN; 329 if (!timeo) 330 goto out_err; 331 332 error = inet_csk_wait_for_connect(sk, timeo); 333 if (error) 334 goto out_err; 335 } 336 req = reqsk_queue_remove(queue); 337 newsk = req->sk; 338 339 sk_acceptq_removed(sk); 340 if (sk->sk_protocol == IPPROTO_TCP && queue->fastopenq != NULL) { 341 spin_lock_bh(&queue->fastopenq->lock); 342 if (tcp_rsk(req)->listener) { 343 /* We are still waiting for the final ACK from 3WHS 344 * so can't free req now. Instead, we set req->sk to 345 * NULL to signify that the child socket is taken 346 * so reqsk_fastopen_remove() will free the req 347 * when 3WHS finishes (or is aborted). 348 */ 349 req->sk = NULL; 350 req = NULL; 351 } 352 spin_unlock_bh(&queue->fastopenq->lock); 353 } 354 out: 355 release_sock(sk); 356 if (req) 357 __reqsk_free(req); 358 return newsk; 359 out_err: 360 newsk = NULL; 361 req = NULL; 362 *err = error; 363 goto out; 364 } 365 EXPORT_SYMBOL(inet_csk_accept); 366 367 /* 368 * Using different timers for retransmit, delayed acks and probes 369 * We may wish use just one timer maintaining a list of expire jiffies 370 * to optimize. 371 */ 372 void inet_csk_init_xmit_timers(struct sock *sk, 373 void (*retransmit_handler)(unsigned long), 374 void (*delack_handler)(unsigned long), 375 void (*keepalive_handler)(unsigned long)) 376 { 377 struct inet_connection_sock *icsk = inet_csk(sk); 378 379 setup_timer(&icsk->icsk_retransmit_timer, retransmit_handler, 380 (unsigned long)sk); 381 setup_timer(&icsk->icsk_delack_timer, delack_handler, 382 (unsigned long)sk); 383 setup_timer(&sk->sk_timer, keepalive_handler, (unsigned long)sk); 384 icsk->icsk_pending = icsk->icsk_ack.pending = 0; 385 } 386 EXPORT_SYMBOL(inet_csk_init_xmit_timers); 387 388 void inet_csk_clear_xmit_timers(struct sock *sk) 389 { 390 struct inet_connection_sock *icsk = inet_csk(sk); 391 392 icsk->icsk_pending = icsk->icsk_ack.pending = icsk->icsk_ack.blocked = 0; 393 394 sk_stop_timer(sk, &icsk->icsk_retransmit_timer); 395 sk_stop_timer(sk, &icsk->icsk_delack_timer); 396 sk_stop_timer(sk, &sk->sk_timer); 397 } 398 EXPORT_SYMBOL(inet_csk_clear_xmit_timers); 399 400 void inet_csk_delete_keepalive_timer(struct sock *sk) 401 { 402 sk_stop_timer(sk, &sk->sk_timer); 403 } 404 EXPORT_SYMBOL(inet_csk_delete_keepalive_timer); 405 406 void inet_csk_reset_keepalive_timer(struct sock *sk, unsigned long len) 407 { 408 sk_reset_timer(sk, &sk->sk_timer, jiffies + len); 409 } 410 EXPORT_SYMBOL(inet_csk_reset_keepalive_timer); 411 412 struct dst_entry *inet_csk_route_req(struct sock *sk, 413 struct flowi4 *fl4, 414 const struct request_sock *req) 415 { 416 struct rtable *rt; 417 const struct inet_request_sock *ireq = inet_rsk(req); 418 struct ip_options_rcu *opt = inet_rsk(req)->opt; 419 struct net *net = sock_net(sk); 420 int flags = inet_sk_flowi_flags(sk); 421 422 flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 423 RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, 424 sk->sk_protocol, 425 flags, 426 (opt && opt->opt.srr) ? opt->opt.faddr : ireq->rmt_addr, 427 ireq->loc_addr, ireq->rmt_port, inet_sk(sk)->inet_sport); 428 security_req_classify_flow(req, flowi4_to_flowi(fl4)); 429 rt = ip_route_output_flow(net, fl4, sk); 430 if (IS_ERR(rt)) 431 goto no_route; 432 if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway) 433 goto route_err; 434 return &rt->dst; 435 436 route_err: 437 ip_rt_put(rt); 438 no_route: 439 IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES); 440 return NULL; 441 } 442 EXPORT_SYMBOL_GPL(inet_csk_route_req); 443 444 struct dst_entry *inet_csk_route_child_sock(struct sock *sk, 445 struct sock *newsk, 446 const struct request_sock *req) 447 { 448 const struct inet_request_sock *ireq = inet_rsk(req); 449 struct inet_sock *newinet = inet_sk(newsk); 450 struct ip_options_rcu *opt; 451 struct net *net = sock_net(sk); 452 struct flowi4 *fl4; 453 struct rtable *rt; 454 455 fl4 = &newinet->cork.fl.u.ip4; 456 457 rcu_read_lock(); 458 opt = rcu_dereference(newinet->inet_opt); 459 flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 460 RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, 461 sk->sk_protocol, inet_sk_flowi_flags(sk), 462 (opt && opt->opt.srr) ? opt->opt.faddr : ireq->rmt_addr, 463 ireq->loc_addr, ireq->rmt_port, inet_sk(sk)->inet_sport); 464 security_req_classify_flow(req, flowi4_to_flowi(fl4)); 465 rt = ip_route_output_flow(net, fl4, sk); 466 if (IS_ERR(rt)) 467 goto no_route; 468 if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway) 469 goto route_err; 470 rcu_read_unlock(); 471 return &rt->dst; 472 473 route_err: 474 ip_rt_put(rt); 475 no_route: 476 rcu_read_unlock(); 477 IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES); 478 return NULL; 479 } 480 EXPORT_SYMBOL_GPL(inet_csk_route_child_sock); 481 482 static inline u32 inet_synq_hash(const __be32 raddr, const __be16 rport, 483 const u32 rnd, const u32 synq_hsize) 484 { 485 return jhash_2words((__force u32)raddr, (__force u32)rport, rnd) & (synq_hsize - 1); 486 } 487 488 #if IS_ENABLED(CONFIG_IPV6) 489 #define AF_INET_FAMILY(fam) ((fam) == AF_INET) 490 #else 491 #define AF_INET_FAMILY(fam) 1 492 #endif 493 494 struct request_sock *inet_csk_search_req(const struct sock *sk, 495 struct request_sock ***prevp, 496 const __be16 rport, const __be32 raddr, 497 const __be32 laddr) 498 { 499 const struct inet_connection_sock *icsk = inet_csk(sk); 500 struct listen_sock *lopt = icsk->icsk_accept_queue.listen_opt; 501 struct request_sock *req, **prev; 502 503 for (prev = &lopt->syn_table[inet_synq_hash(raddr, rport, lopt->hash_rnd, 504 lopt->nr_table_entries)]; 505 (req = *prev) != NULL; 506 prev = &req->dl_next) { 507 const struct inet_request_sock *ireq = inet_rsk(req); 508 509 if (ireq->rmt_port == rport && 510 ireq->rmt_addr == raddr && 511 ireq->loc_addr == laddr && 512 AF_INET_FAMILY(req->rsk_ops->family)) { 513 WARN_ON(req->sk); 514 *prevp = prev; 515 break; 516 } 517 } 518 519 return req; 520 } 521 EXPORT_SYMBOL_GPL(inet_csk_search_req); 522 523 void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req, 524 unsigned long timeout) 525 { 526 struct inet_connection_sock *icsk = inet_csk(sk); 527 struct listen_sock *lopt = icsk->icsk_accept_queue.listen_opt; 528 const u32 h = inet_synq_hash(inet_rsk(req)->rmt_addr, inet_rsk(req)->rmt_port, 529 lopt->hash_rnd, lopt->nr_table_entries); 530 531 reqsk_queue_hash_req(&icsk->icsk_accept_queue, h, req, timeout); 532 inet_csk_reqsk_queue_added(sk, timeout); 533 } 534 EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add); 535 536 /* Only thing we need from tcp.h */ 537 extern int sysctl_tcp_synack_retries; 538 539 540 /* Decide when to expire the request and when to resend SYN-ACK */ 541 static inline void syn_ack_recalc(struct request_sock *req, const int thresh, 542 const int max_retries, 543 const u8 rskq_defer_accept, 544 int *expire, int *resend) 545 { 546 if (!rskq_defer_accept) { 547 *expire = req->num_timeout >= thresh; 548 *resend = 1; 549 return; 550 } 551 *expire = req->num_timeout >= thresh && 552 (!inet_rsk(req)->acked || req->num_timeout >= max_retries); 553 /* 554 * Do not resend while waiting for data after ACK, 555 * start to resend on end of deferring period to give 556 * last chance for data or ACK to create established socket. 557 */ 558 *resend = !inet_rsk(req)->acked || 559 req->num_timeout >= rskq_defer_accept - 1; 560 } 561 562 int inet_rtx_syn_ack(struct sock *parent, struct request_sock *req) 563 { 564 int err = req->rsk_ops->rtx_syn_ack(parent, req, NULL); 565 566 if (!err) 567 req->num_retrans++; 568 return err; 569 } 570 EXPORT_SYMBOL(inet_rtx_syn_ack); 571 572 void inet_csk_reqsk_queue_prune(struct sock *parent, 573 const unsigned long interval, 574 const unsigned long timeout, 575 const unsigned long max_rto) 576 { 577 struct inet_connection_sock *icsk = inet_csk(parent); 578 struct request_sock_queue *queue = &icsk->icsk_accept_queue; 579 struct listen_sock *lopt = queue->listen_opt; 580 int max_retries = icsk->icsk_syn_retries ? : sysctl_tcp_synack_retries; 581 int thresh = max_retries; 582 unsigned long now = jiffies; 583 struct request_sock **reqp, *req; 584 int i, budget; 585 586 if (lopt == NULL || lopt->qlen == 0) 587 return; 588 589 /* Normally all the openreqs are young and become mature 590 * (i.e. converted to established socket) for first timeout. 591 * If synack was not acknowledged for 1 second, it means 592 * one of the following things: synack was lost, ack was lost, 593 * rtt is high or nobody planned to ack (i.e. synflood). 594 * When server is a bit loaded, queue is populated with old 595 * open requests, reducing effective size of queue. 596 * When server is well loaded, queue size reduces to zero 597 * after several minutes of work. It is not synflood, 598 * it is normal operation. The solution is pruning 599 * too old entries overriding normal timeout, when 600 * situation becomes dangerous. 601 * 602 * Essentially, we reserve half of room for young 603 * embrions; and abort old ones without pity, if old 604 * ones are about to clog our table. 605 */ 606 if (lopt->qlen>>(lopt->max_qlen_log-1)) { 607 int young = (lopt->qlen_young<<1); 608 609 while (thresh > 2) { 610 if (lopt->qlen < young) 611 break; 612 thresh--; 613 young <<= 1; 614 } 615 } 616 617 if (queue->rskq_defer_accept) 618 max_retries = queue->rskq_defer_accept; 619 620 budget = 2 * (lopt->nr_table_entries / (timeout / interval)); 621 i = lopt->clock_hand; 622 623 do { 624 reqp=&lopt->syn_table[i]; 625 while ((req = *reqp) != NULL) { 626 if (time_after_eq(now, req->expires)) { 627 int expire = 0, resend = 0; 628 629 syn_ack_recalc(req, thresh, max_retries, 630 queue->rskq_defer_accept, 631 &expire, &resend); 632 req->rsk_ops->syn_ack_timeout(parent, req); 633 if (!expire && 634 (!resend || 635 !inet_rtx_syn_ack(parent, req) || 636 inet_rsk(req)->acked)) { 637 unsigned long timeo; 638 639 if (req->num_timeout++ == 0) 640 lopt->qlen_young--; 641 timeo = min(timeout << req->num_timeout, 642 max_rto); 643 req->expires = now + timeo; 644 reqp = &req->dl_next; 645 continue; 646 } 647 648 /* Drop this request */ 649 inet_csk_reqsk_queue_unlink(parent, req, reqp); 650 reqsk_queue_removed(queue, req); 651 reqsk_free(req); 652 continue; 653 } 654 reqp = &req->dl_next; 655 } 656 657 i = (i + 1) & (lopt->nr_table_entries - 1); 658 659 } while (--budget > 0); 660 661 lopt->clock_hand = i; 662 663 if (lopt->qlen) 664 inet_csk_reset_keepalive_timer(parent, interval); 665 } 666 EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_prune); 667 668 /** 669 * inet_csk_clone_lock - clone an inet socket, and lock its clone 670 * @sk: the socket to clone 671 * @req: request_sock 672 * @priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc) 673 * 674 * Caller must unlock socket even in error path (bh_unlock_sock(newsk)) 675 */ 676 struct sock *inet_csk_clone_lock(const struct sock *sk, 677 const struct request_sock *req, 678 const gfp_t priority) 679 { 680 struct sock *newsk = sk_clone_lock(sk, priority); 681 682 if (newsk != NULL) { 683 struct inet_connection_sock *newicsk = inet_csk(newsk); 684 685 newsk->sk_state = TCP_SYN_RECV; 686 newicsk->icsk_bind_hash = NULL; 687 688 inet_sk(newsk)->inet_dport = inet_rsk(req)->rmt_port; 689 inet_sk(newsk)->inet_num = ntohs(inet_rsk(req)->loc_port); 690 inet_sk(newsk)->inet_sport = inet_rsk(req)->loc_port; 691 newsk->sk_write_space = sk_stream_write_space; 692 693 newicsk->icsk_retransmits = 0; 694 newicsk->icsk_backoff = 0; 695 newicsk->icsk_probes_out = 0; 696 697 /* Deinitialize accept_queue to trap illegal accesses. */ 698 memset(&newicsk->icsk_accept_queue, 0, sizeof(newicsk->icsk_accept_queue)); 699 700 security_inet_csk_clone(newsk, req); 701 } 702 return newsk; 703 } 704 EXPORT_SYMBOL_GPL(inet_csk_clone_lock); 705 706 /* 707 * At this point, there should be no process reference to this 708 * socket, and thus no user references at all. Therefore we 709 * can assume the socket waitqueue is inactive and nobody will 710 * try to jump onto it. 711 */ 712 void inet_csk_destroy_sock(struct sock *sk) 713 { 714 WARN_ON(sk->sk_state != TCP_CLOSE); 715 WARN_ON(!sock_flag(sk, SOCK_DEAD)); 716 717 /* It cannot be in hash table! */ 718 WARN_ON(!sk_unhashed(sk)); 719 720 /* If it has not 0 inet_sk(sk)->inet_num, it must be bound */ 721 WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash); 722 723 sk->sk_prot->destroy(sk); 724 725 sk_stream_kill_queues(sk); 726 727 xfrm_sk_free_policy(sk); 728 729 sk_refcnt_debug_release(sk); 730 731 percpu_counter_dec(sk->sk_prot->orphan_count); 732 sock_put(sk); 733 } 734 EXPORT_SYMBOL(inet_csk_destroy_sock); 735 736 /* This function allows to force a closure of a socket after the call to 737 * tcp/dccp_create_openreq_child(). 738 */ 739 void inet_csk_prepare_forced_close(struct sock *sk) 740 { 741 /* sk_clone_lock locked the socket and set refcnt to 2 */ 742 bh_unlock_sock(sk); 743 sock_put(sk); 744 745 /* The below has to be done to allow calling inet_csk_destroy_sock */ 746 sock_set_flag(sk, SOCK_DEAD); 747 percpu_counter_inc(sk->sk_prot->orphan_count); 748 inet_sk(sk)->inet_num = 0; 749 } 750 EXPORT_SYMBOL(inet_csk_prepare_forced_close); 751 752 int inet_csk_listen_start(struct sock *sk, const int nr_table_entries) 753 { 754 struct inet_sock *inet = inet_sk(sk); 755 struct inet_connection_sock *icsk = inet_csk(sk); 756 int rc = reqsk_queue_alloc(&icsk->icsk_accept_queue, nr_table_entries); 757 758 if (rc != 0) 759 return rc; 760 761 sk->sk_max_ack_backlog = 0; 762 sk->sk_ack_backlog = 0; 763 inet_csk_delack_init(sk); 764 765 /* There is race window here: we announce ourselves listening, 766 * but this transition is still not validated by get_port(). 767 * It is OK, because this socket enters to hash table only 768 * after validation is complete. 769 */ 770 sk->sk_state = TCP_LISTEN; 771 if (!sk->sk_prot->get_port(sk, inet->inet_num)) { 772 inet->inet_sport = htons(inet->inet_num); 773 774 sk_dst_reset(sk); 775 sk->sk_prot->hash(sk); 776 777 return 0; 778 } 779 780 sk->sk_state = TCP_CLOSE; 781 __reqsk_queue_destroy(&icsk->icsk_accept_queue); 782 return -EADDRINUSE; 783 } 784 EXPORT_SYMBOL_GPL(inet_csk_listen_start); 785 786 /* 787 * This routine closes sockets which have been at least partially 788 * opened, but not yet accepted. 789 */ 790 void inet_csk_listen_stop(struct sock *sk) 791 { 792 struct inet_connection_sock *icsk = inet_csk(sk); 793 struct request_sock_queue *queue = &icsk->icsk_accept_queue; 794 struct request_sock *acc_req; 795 struct request_sock *req; 796 797 inet_csk_delete_keepalive_timer(sk); 798 799 /* make all the listen_opt local to us */ 800 acc_req = reqsk_queue_yank_acceptq(queue); 801 802 /* Following specs, it would be better either to send FIN 803 * (and enter FIN-WAIT-1, it is normal close) 804 * or to send active reset (abort). 805 * Certainly, it is pretty dangerous while synflood, but it is 806 * bad justification for our negligence 8) 807 * To be honest, we are not able to make either 808 * of the variants now. --ANK 809 */ 810 reqsk_queue_destroy(queue); 811 812 while ((req = acc_req) != NULL) { 813 struct sock *child = req->sk; 814 815 acc_req = req->dl_next; 816 817 local_bh_disable(); 818 bh_lock_sock(child); 819 WARN_ON(sock_owned_by_user(child)); 820 sock_hold(child); 821 822 sk->sk_prot->disconnect(child, O_NONBLOCK); 823 824 sock_orphan(child); 825 826 percpu_counter_inc(sk->sk_prot->orphan_count); 827 828 if (sk->sk_protocol == IPPROTO_TCP && tcp_rsk(req)->listener) { 829 BUG_ON(tcp_sk(child)->fastopen_rsk != req); 830 BUG_ON(sk != tcp_rsk(req)->listener); 831 832 /* Paranoid, to prevent race condition if 833 * an inbound pkt destined for child is 834 * blocked by sock lock in tcp_v4_rcv(). 835 * Also to satisfy an assertion in 836 * tcp_v4_destroy_sock(). 837 */ 838 tcp_sk(child)->fastopen_rsk = NULL; 839 sock_put(sk); 840 } 841 inet_csk_destroy_sock(child); 842 843 bh_unlock_sock(child); 844 local_bh_enable(); 845 sock_put(child); 846 847 sk_acceptq_removed(sk); 848 __reqsk_free(req); 849 } 850 if (queue->fastopenq != NULL) { 851 /* Free all the reqs queued in rskq_rst_head. */ 852 spin_lock_bh(&queue->fastopenq->lock); 853 acc_req = queue->fastopenq->rskq_rst_head; 854 queue->fastopenq->rskq_rst_head = NULL; 855 spin_unlock_bh(&queue->fastopenq->lock); 856 while ((req = acc_req) != NULL) { 857 acc_req = req->dl_next; 858 __reqsk_free(req); 859 } 860 } 861 WARN_ON(sk->sk_ack_backlog); 862 } 863 EXPORT_SYMBOL_GPL(inet_csk_listen_stop); 864 865 void inet_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr) 866 { 867 struct sockaddr_in *sin = (struct sockaddr_in *)uaddr; 868 const struct inet_sock *inet = inet_sk(sk); 869 870 sin->sin_family = AF_INET; 871 sin->sin_addr.s_addr = inet->inet_daddr; 872 sin->sin_port = inet->inet_dport; 873 } 874 EXPORT_SYMBOL_GPL(inet_csk_addr2sockaddr); 875 876 #ifdef CONFIG_COMPAT 877 int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname, 878 char __user *optval, int __user *optlen) 879 { 880 const struct inet_connection_sock *icsk = inet_csk(sk); 881 882 if (icsk->icsk_af_ops->compat_getsockopt != NULL) 883 return icsk->icsk_af_ops->compat_getsockopt(sk, level, optname, 884 optval, optlen); 885 return icsk->icsk_af_ops->getsockopt(sk, level, optname, 886 optval, optlen); 887 } 888 EXPORT_SYMBOL_GPL(inet_csk_compat_getsockopt); 889 890 int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname, 891 char __user *optval, unsigned int optlen) 892 { 893 const struct inet_connection_sock *icsk = inet_csk(sk); 894 895 if (icsk->icsk_af_ops->compat_setsockopt != NULL) 896 return icsk->icsk_af_ops->compat_setsockopt(sk, level, optname, 897 optval, optlen); 898 return icsk->icsk_af_ops->setsockopt(sk, level, optname, 899 optval, optlen); 900 } 901 EXPORT_SYMBOL_GPL(inet_csk_compat_setsockopt); 902 #endif 903 904 static struct dst_entry *inet_csk_rebuild_route(struct sock *sk, struct flowi *fl) 905 { 906 const struct inet_sock *inet = inet_sk(sk); 907 const struct ip_options_rcu *inet_opt; 908 __be32 daddr = inet->inet_daddr; 909 struct flowi4 *fl4; 910 struct rtable *rt; 911 912 rcu_read_lock(); 913 inet_opt = rcu_dereference(inet->inet_opt); 914 if (inet_opt && inet_opt->opt.srr) 915 daddr = inet_opt->opt.faddr; 916 fl4 = &fl->u.ip4; 917 rt = ip_route_output_ports(sock_net(sk), fl4, sk, daddr, 918 inet->inet_saddr, inet->inet_dport, 919 inet->inet_sport, sk->sk_protocol, 920 RT_CONN_FLAGS(sk), sk->sk_bound_dev_if); 921 if (IS_ERR(rt)) 922 rt = NULL; 923 if (rt) 924 sk_setup_caps(sk, &rt->dst); 925 rcu_read_unlock(); 926 927 return &rt->dst; 928 } 929 930 struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu) 931 { 932 struct dst_entry *dst = __sk_dst_check(sk, 0); 933 struct inet_sock *inet = inet_sk(sk); 934 935 if (!dst) { 936 dst = inet_csk_rebuild_route(sk, &inet->cork.fl); 937 if (!dst) 938 goto out; 939 } 940 dst->ops->update_pmtu(dst, sk, NULL, mtu); 941 942 dst = __sk_dst_check(sk, 0); 943 if (!dst) 944 dst = inet_csk_rebuild_route(sk, &inet->cork.fl); 945 out: 946 return dst; 947 } 948 EXPORT_SYMBOL_GPL(inet_csk_update_pmtu); 949