1 /* 2 * INET An implementation of the TCP/IP protocol suite for the LINUX 3 * operating system. INET is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * Support for INET connection oriented protocols. 7 * 8 * Authors: See the TCP sources 9 * 10 * This program is free software; you can redistribute it and/or 11 * modify it under the terms of the GNU General Public License 12 * as published by the Free Software Foundation; either version 13 * 2 of the License, or(at your option) any later version. 14 */ 15 16 #include <linux/module.h> 17 #include <linux/jhash.h> 18 19 #include <net/inet_connection_sock.h> 20 #include <net/inet_hashtables.h> 21 #include <net/inet_timewait_sock.h> 22 #include <net/ip.h> 23 #include <net/route.h> 24 #include <net/tcp_states.h> 25 #include <net/xfrm.h> 26 #include <net/tcp.h> 27 #include <net/sock_reuseport.h> 28 #include <net/addrconf.h> 29 30 #ifdef INET_CSK_DEBUG 31 const char inet_csk_timer_bug_msg[] = "inet_csk BUG: unknown timer value\n"; 32 EXPORT_SYMBOL(inet_csk_timer_bug_msg); 33 #endif 34 35 #if IS_ENABLED(CONFIG_IPV6) 36 /* match_wildcard == true: IPV6_ADDR_ANY equals to any IPv6 addresses if IPv6 37 * only, and any IPv4 addresses if not IPv6 only 38 * match_wildcard == false: addresses must be exactly the same, i.e. 39 * IPV6_ADDR_ANY only equals to IPV6_ADDR_ANY, 40 * and 0.0.0.0 equals to 0.0.0.0 only 41 */ 42 static int ipv6_rcv_saddr_equal(const struct in6_addr *sk1_rcv_saddr6, 43 const struct in6_addr *sk2_rcv_saddr6, 44 __be32 sk1_rcv_saddr, __be32 sk2_rcv_saddr, 45 bool sk1_ipv6only, bool sk2_ipv6only, 46 bool match_wildcard) 47 { 48 int addr_type = ipv6_addr_type(sk1_rcv_saddr6); 49 int addr_type2 = sk2_rcv_saddr6 ? ipv6_addr_type(sk2_rcv_saddr6) : IPV6_ADDR_MAPPED; 50 51 /* if both are mapped, treat as IPv4 */ 52 if (addr_type == IPV6_ADDR_MAPPED && addr_type2 == IPV6_ADDR_MAPPED) { 53 if (!sk2_ipv6only) { 54 if (sk1_rcv_saddr == sk2_rcv_saddr) 55 return 1; 56 if (!sk1_rcv_saddr || !sk2_rcv_saddr) 57 return match_wildcard; 58 } 59 return 0; 60 } 61 62 if (addr_type == IPV6_ADDR_ANY && addr_type2 == IPV6_ADDR_ANY) 63 return 1; 64 65 if (addr_type2 == IPV6_ADDR_ANY && match_wildcard && 66 !(sk2_ipv6only && addr_type == IPV6_ADDR_MAPPED)) 67 return 1; 68 69 if (addr_type == IPV6_ADDR_ANY && match_wildcard && 70 !(sk1_ipv6only && addr_type2 == IPV6_ADDR_MAPPED)) 71 return 1; 72 73 if (sk2_rcv_saddr6 && 74 ipv6_addr_equal(sk1_rcv_saddr6, sk2_rcv_saddr6)) 75 return 1; 76 77 return 0; 78 } 79 #endif 80 81 /* match_wildcard == true: 0.0.0.0 equals to any IPv4 addresses 82 * match_wildcard == false: addresses must be exactly the same, i.e. 83 * 0.0.0.0 only equals to 0.0.0.0 84 */ 85 static int ipv4_rcv_saddr_equal(__be32 sk1_rcv_saddr, __be32 sk2_rcv_saddr, 86 bool sk2_ipv6only, bool match_wildcard) 87 { 88 if (!sk2_ipv6only) { 89 if (sk1_rcv_saddr == sk2_rcv_saddr) 90 return 1; 91 if (!sk1_rcv_saddr || !sk2_rcv_saddr) 92 return match_wildcard; 93 } 94 return 0; 95 } 96 97 int inet_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2, 98 bool match_wildcard) 99 { 100 #if IS_ENABLED(CONFIG_IPV6) 101 if (sk->sk_family == AF_INET6) 102 return ipv6_rcv_saddr_equal(&sk->sk_v6_rcv_saddr, 103 inet6_rcv_saddr(sk2), 104 sk->sk_rcv_saddr, 105 sk2->sk_rcv_saddr, 106 ipv6_only_sock(sk), 107 ipv6_only_sock(sk2), 108 match_wildcard); 109 #endif 110 return ipv4_rcv_saddr_equal(sk->sk_rcv_saddr, sk2->sk_rcv_saddr, 111 ipv6_only_sock(sk2), match_wildcard); 112 } 113 EXPORT_SYMBOL(inet_rcv_saddr_equal); 114 115 void inet_get_local_port_range(struct net *net, int *low, int *high) 116 { 117 unsigned int seq; 118 119 do { 120 seq = read_seqbegin(&net->ipv4.ip_local_ports.lock); 121 122 *low = net->ipv4.ip_local_ports.range[0]; 123 *high = net->ipv4.ip_local_ports.range[1]; 124 } while (read_seqretry(&net->ipv4.ip_local_ports.lock, seq)); 125 } 126 EXPORT_SYMBOL(inet_get_local_port_range); 127 128 static int inet_csk_bind_conflict(const struct sock *sk, 129 const struct inet_bind_bucket *tb, 130 bool relax, bool reuseport_ok) 131 { 132 struct sock *sk2; 133 bool reuse = sk->sk_reuse; 134 bool reuseport = !!sk->sk_reuseport && reuseport_ok; 135 kuid_t uid = sock_i_uid((struct sock *)sk); 136 137 /* 138 * Unlike other sk lookup places we do not check 139 * for sk_net here, since _all_ the socks listed 140 * in tb->owners list belong to the same net - the 141 * one this bucket belongs to. 142 */ 143 144 sk_for_each_bound(sk2, &tb->owners) { 145 if (sk != sk2 && 146 (!sk->sk_bound_dev_if || 147 !sk2->sk_bound_dev_if || 148 sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) { 149 if ((!reuse || !sk2->sk_reuse || 150 sk2->sk_state == TCP_LISTEN) && 151 (!reuseport || !sk2->sk_reuseport || 152 rcu_access_pointer(sk->sk_reuseport_cb) || 153 (sk2->sk_state != TCP_TIME_WAIT && 154 !uid_eq(uid, sock_i_uid(sk2))))) { 155 if (inet_rcv_saddr_equal(sk, sk2, true)) 156 break; 157 } 158 if (!relax && reuse && sk2->sk_reuse && 159 sk2->sk_state != TCP_LISTEN) { 160 if (inet_rcv_saddr_equal(sk, sk2, true)) 161 break; 162 } 163 } 164 } 165 return sk2 != NULL; 166 } 167 168 /* 169 * Find an open port number for the socket. Returns with the 170 * inet_bind_hashbucket lock held. 171 */ 172 static struct inet_bind_hashbucket * 173 inet_csk_find_open_port(struct sock *sk, struct inet_bind_bucket **tb_ret, int *port_ret) 174 { 175 struct inet_hashinfo *hinfo = sk->sk_prot->h.hashinfo; 176 int port = 0; 177 struct inet_bind_hashbucket *head; 178 struct net *net = sock_net(sk); 179 int i, low, high, attempt_half; 180 struct inet_bind_bucket *tb; 181 u32 remaining, offset; 182 183 attempt_half = (sk->sk_reuse == SK_CAN_REUSE) ? 1 : 0; 184 other_half_scan: 185 inet_get_local_port_range(net, &low, &high); 186 high++; /* [32768, 60999] -> [32768, 61000[ */ 187 if (high - low < 4) 188 attempt_half = 0; 189 if (attempt_half) { 190 int half = low + (((high - low) >> 2) << 1); 191 192 if (attempt_half == 1) 193 high = half; 194 else 195 low = half; 196 } 197 remaining = high - low; 198 if (likely(remaining > 1)) 199 remaining &= ~1U; 200 201 offset = prandom_u32() % remaining; 202 /* __inet_hash_connect() favors ports having @low parity 203 * We do the opposite to not pollute connect() users. 204 */ 205 offset |= 1U; 206 207 other_parity_scan: 208 port = low + offset; 209 for (i = 0; i < remaining; i += 2, port += 2) { 210 if (unlikely(port >= high)) 211 port -= remaining; 212 if (inet_is_local_reserved_port(net, port)) 213 continue; 214 head = &hinfo->bhash[inet_bhashfn(net, port, 215 hinfo->bhash_size)]; 216 spin_lock_bh(&head->lock); 217 inet_bind_bucket_for_each(tb, &head->chain) 218 if (net_eq(ib_net(tb), net) && tb->port == port) { 219 if (!inet_csk_bind_conflict(sk, tb, false, false)) 220 goto success; 221 goto next_port; 222 } 223 tb = NULL; 224 goto success; 225 next_port: 226 spin_unlock_bh(&head->lock); 227 cond_resched(); 228 } 229 230 offset--; 231 if (!(offset & 1)) 232 goto other_parity_scan; 233 234 if (attempt_half == 1) { 235 /* OK we now try the upper half of the range */ 236 attempt_half = 2; 237 goto other_half_scan; 238 } 239 return NULL; 240 success: 241 *port_ret = port; 242 *tb_ret = tb; 243 return head; 244 } 245 246 static inline int sk_reuseport_match(struct inet_bind_bucket *tb, 247 struct sock *sk) 248 { 249 kuid_t uid = sock_i_uid(sk); 250 251 if (tb->fastreuseport <= 0) 252 return 0; 253 if (!sk->sk_reuseport) 254 return 0; 255 if (rcu_access_pointer(sk->sk_reuseport_cb)) 256 return 0; 257 if (!uid_eq(tb->fastuid, uid)) 258 return 0; 259 /* We only need to check the rcv_saddr if this tb was once marked 260 * without fastreuseport and then was reset, as we can only know that 261 * the fast_*rcv_saddr doesn't have any conflicts with the socks on the 262 * owners list. 263 */ 264 if (tb->fastreuseport == FASTREUSEPORT_ANY) 265 return 1; 266 #if IS_ENABLED(CONFIG_IPV6) 267 if (tb->fast_sk_family == AF_INET6) 268 return ipv6_rcv_saddr_equal(&tb->fast_v6_rcv_saddr, 269 inet6_rcv_saddr(sk), 270 tb->fast_rcv_saddr, 271 sk->sk_rcv_saddr, 272 tb->fast_ipv6_only, 273 ipv6_only_sock(sk), true); 274 #endif 275 return ipv4_rcv_saddr_equal(tb->fast_rcv_saddr, sk->sk_rcv_saddr, 276 ipv6_only_sock(sk), true); 277 } 278 279 /* Obtain a reference to a local port for the given sock, 280 * if snum is zero it means select any available local port. 281 * We try to allocate an odd port (and leave even ports for connect()) 282 */ 283 int inet_csk_get_port(struct sock *sk, unsigned short snum) 284 { 285 bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN; 286 struct inet_hashinfo *hinfo = sk->sk_prot->h.hashinfo; 287 int ret = 1, port = snum; 288 struct inet_bind_hashbucket *head; 289 struct net *net = sock_net(sk); 290 struct inet_bind_bucket *tb = NULL; 291 kuid_t uid = sock_i_uid(sk); 292 293 if (!port) { 294 head = inet_csk_find_open_port(sk, &tb, &port); 295 if (!head) 296 return ret; 297 if (!tb) 298 goto tb_not_found; 299 goto success; 300 } 301 head = &hinfo->bhash[inet_bhashfn(net, port, 302 hinfo->bhash_size)]; 303 spin_lock_bh(&head->lock); 304 inet_bind_bucket_for_each(tb, &head->chain) 305 if (net_eq(ib_net(tb), net) && tb->port == port) 306 goto tb_found; 307 tb_not_found: 308 tb = inet_bind_bucket_create(hinfo->bind_bucket_cachep, 309 net, head, port); 310 if (!tb) 311 goto fail_unlock; 312 tb_found: 313 if (!hlist_empty(&tb->owners)) { 314 if (sk->sk_reuse == SK_FORCE_REUSE) 315 goto success; 316 317 if ((tb->fastreuse > 0 && reuse) || 318 sk_reuseport_match(tb, sk)) 319 goto success; 320 if (inet_csk_bind_conflict(sk, tb, true, true)) 321 goto fail_unlock; 322 } 323 success: 324 if (hlist_empty(&tb->owners)) { 325 tb->fastreuse = reuse; 326 if (sk->sk_reuseport) { 327 tb->fastreuseport = FASTREUSEPORT_ANY; 328 tb->fastuid = uid; 329 tb->fast_rcv_saddr = sk->sk_rcv_saddr; 330 tb->fast_ipv6_only = ipv6_only_sock(sk); 331 tb->fast_sk_family = sk->sk_family; 332 #if IS_ENABLED(CONFIG_IPV6) 333 tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr; 334 #endif 335 } else { 336 tb->fastreuseport = 0; 337 } 338 } else { 339 if (!reuse) 340 tb->fastreuse = 0; 341 if (sk->sk_reuseport) { 342 /* We didn't match or we don't have fastreuseport set on 343 * the tb, but we have sk_reuseport set on this socket 344 * and we know that there are no bind conflicts with 345 * this socket in this tb, so reset our tb's reuseport 346 * settings so that any subsequent sockets that match 347 * our current socket will be put on the fast path. 348 * 349 * If we reset we need to set FASTREUSEPORT_STRICT so we 350 * do extra checking for all subsequent sk_reuseport 351 * socks. 352 */ 353 if (!sk_reuseport_match(tb, sk)) { 354 tb->fastreuseport = FASTREUSEPORT_STRICT; 355 tb->fastuid = uid; 356 tb->fast_rcv_saddr = sk->sk_rcv_saddr; 357 tb->fast_ipv6_only = ipv6_only_sock(sk); 358 tb->fast_sk_family = sk->sk_family; 359 #if IS_ENABLED(CONFIG_IPV6) 360 tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr; 361 #endif 362 } 363 } else { 364 tb->fastreuseport = 0; 365 } 366 } 367 if (!inet_csk(sk)->icsk_bind_hash) 368 inet_bind_hash(sk, tb, port); 369 WARN_ON(inet_csk(sk)->icsk_bind_hash != tb); 370 ret = 0; 371 372 fail_unlock: 373 spin_unlock_bh(&head->lock); 374 return ret; 375 } 376 EXPORT_SYMBOL_GPL(inet_csk_get_port); 377 378 /* 379 * Wait for an incoming connection, avoid race conditions. This must be called 380 * with the socket locked. 381 */ 382 static int inet_csk_wait_for_connect(struct sock *sk, long timeo) 383 { 384 struct inet_connection_sock *icsk = inet_csk(sk); 385 DEFINE_WAIT(wait); 386 int err; 387 388 /* 389 * True wake-one mechanism for incoming connections: only 390 * one process gets woken up, not the 'whole herd'. 391 * Since we do not 'race & poll' for established sockets 392 * anymore, the common case will execute the loop only once. 393 * 394 * Subtle issue: "add_wait_queue_exclusive()" will be added 395 * after any current non-exclusive waiters, and we know that 396 * it will always _stay_ after any new non-exclusive waiters 397 * because all non-exclusive waiters are added at the 398 * beginning of the wait-queue. As such, it's ok to "drop" 399 * our exclusiveness temporarily when we get woken up without 400 * having to remove and re-insert us on the wait queue. 401 */ 402 for (;;) { 403 prepare_to_wait_exclusive(sk_sleep(sk), &wait, 404 TASK_INTERRUPTIBLE); 405 release_sock(sk); 406 if (reqsk_queue_empty(&icsk->icsk_accept_queue)) 407 timeo = schedule_timeout(timeo); 408 sched_annotate_sleep(); 409 lock_sock(sk); 410 err = 0; 411 if (!reqsk_queue_empty(&icsk->icsk_accept_queue)) 412 break; 413 err = -EINVAL; 414 if (sk->sk_state != TCP_LISTEN) 415 break; 416 err = sock_intr_errno(timeo); 417 if (signal_pending(current)) 418 break; 419 err = -EAGAIN; 420 if (!timeo) 421 break; 422 } 423 finish_wait(sk_sleep(sk), &wait); 424 return err; 425 } 426 427 /* 428 * This will accept the next outstanding connection. 429 */ 430 struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern) 431 { 432 struct inet_connection_sock *icsk = inet_csk(sk); 433 struct request_sock_queue *queue = &icsk->icsk_accept_queue; 434 struct request_sock *req; 435 struct sock *newsk; 436 int error; 437 438 lock_sock(sk); 439 440 /* We need to make sure that this socket is listening, 441 * and that it has something pending. 442 */ 443 error = -EINVAL; 444 if (sk->sk_state != TCP_LISTEN) 445 goto out_err; 446 447 /* Find already established connection */ 448 if (reqsk_queue_empty(queue)) { 449 long timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK); 450 451 /* If this is a non blocking socket don't sleep */ 452 error = -EAGAIN; 453 if (!timeo) 454 goto out_err; 455 456 error = inet_csk_wait_for_connect(sk, timeo); 457 if (error) 458 goto out_err; 459 } 460 req = reqsk_queue_remove(queue, sk); 461 newsk = req->sk; 462 463 if (sk->sk_protocol == IPPROTO_TCP && 464 tcp_rsk(req)->tfo_listener) { 465 spin_lock_bh(&queue->fastopenq.lock); 466 if (tcp_rsk(req)->tfo_listener) { 467 /* We are still waiting for the final ACK from 3WHS 468 * so can't free req now. Instead, we set req->sk to 469 * NULL to signify that the child socket is taken 470 * so reqsk_fastopen_remove() will free the req 471 * when 3WHS finishes (or is aborted). 472 */ 473 req->sk = NULL; 474 req = NULL; 475 } 476 spin_unlock_bh(&queue->fastopenq.lock); 477 } 478 out: 479 release_sock(sk); 480 if (req) 481 reqsk_put(req); 482 return newsk; 483 out_err: 484 newsk = NULL; 485 req = NULL; 486 *err = error; 487 goto out; 488 } 489 EXPORT_SYMBOL(inet_csk_accept); 490 491 /* 492 * Using different timers for retransmit, delayed acks and probes 493 * We may wish use just one timer maintaining a list of expire jiffies 494 * to optimize. 495 */ 496 void inet_csk_init_xmit_timers(struct sock *sk, 497 void (*retransmit_handler)(unsigned long), 498 void (*delack_handler)(unsigned long), 499 void (*keepalive_handler)(unsigned long)) 500 { 501 struct inet_connection_sock *icsk = inet_csk(sk); 502 503 setup_timer(&icsk->icsk_retransmit_timer, retransmit_handler, 504 (unsigned long)sk); 505 setup_timer(&icsk->icsk_delack_timer, delack_handler, 506 (unsigned long)sk); 507 setup_timer(&sk->sk_timer, keepalive_handler, (unsigned long)sk); 508 icsk->icsk_pending = icsk->icsk_ack.pending = 0; 509 } 510 EXPORT_SYMBOL(inet_csk_init_xmit_timers); 511 512 void inet_csk_clear_xmit_timers(struct sock *sk) 513 { 514 struct inet_connection_sock *icsk = inet_csk(sk); 515 516 icsk->icsk_pending = icsk->icsk_ack.pending = icsk->icsk_ack.blocked = 0; 517 518 sk_stop_timer(sk, &icsk->icsk_retransmit_timer); 519 sk_stop_timer(sk, &icsk->icsk_delack_timer); 520 sk_stop_timer(sk, &sk->sk_timer); 521 } 522 EXPORT_SYMBOL(inet_csk_clear_xmit_timers); 523 524 void inet_csk_delete_keepalive_timer(struct sock *sk) 525 { 526 sk_stop_timer(sk, &sk->sk_timer); 527 } 528 EXPORT_SYMBOL(inet_csk_delete_keepalive_timer); 529 530 void inet_csk_reset_keepalive_timer(struct sock *sk, unsigned long len) 531 { 532 sk_reset_timer(sk, &sk->sk_timer, jiffies + len); 533 } 534 EXPORT_SYMBOL(inet_csk_reset_keepalive_timer); 535 536 struct dst_entry *inet_csk_route_req(const struct sock *sk, 537 struct flowi4 *fl4, 538 const struct request_sock *req) 539 { 540 const struct inet_request_sock *ireq = inet_rsk(req); 541 struct net *net = read_pnet(&ireq->ireq_net); 542 struct ip_options_rcu *opt = ireq->opt; 543 struct rtable *rt; 544 545 flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark, 546 RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, 547 sk->sk_protocol, inet_sk_flowi_flags(sk), 548 (opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr, 549 ireq->ir_loc_addr, ireq->ir_rmt_port, 550 htons(ireq->ir_num), sk->sk_uid); 551 security_req_classify_flow(req, flowi4_to_flowi(fl4)); 552 rt = ip_route_output_flow(net, fl4, sk); 553 if (IS_ERR(rt)) 554 goto no_route; 555 if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway) 556 goto route_err; 557 return &rt->dst; 558 559 route_err: 560 ip_rt_put(rt); 561 no_route: 562 __IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES); 563 return NULL; 564 } 565 EXPORT_SYMBOL_GPL(inet_csk_route_req); 566 567 struct dst_entry *inet_csk_route_child_sock(const struct sock *sk, 568 struct sock *newsk, 569 const struct request_sock *req) 570 { 571 const struct inet_request_sock *ireq = inet_rsk(req); 572 struct net *net = read_pnet(&ireq->ireq_net); 573 struct inet_sock *newinet = inet_sk(newsk); 574 struct ip_options_rcu *opt; 575 struct flowi4 *fl4; 576 struct rtable *rt; 577 578 fl4 = &newinet->cork.fl.u.ip4; 579 580 rcu_read_lock(); 581 opt = rcu_dereference(newinet->inet_opt); 582 flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark, 583 RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, 584 sk->sk_protocol, inet_sk_flowi_flags(sk), 585 (opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr, 586 ireq->ir_loc_addr, ireq->ir_rmt_port, 587 htons(ireq->ir_num), sk->sk_uid); 588 security_req_classify_flow(req, flowi4_to_flowi(fl4)); 589 rt = ip_route_output_flow(net, fl4, sk); 590 if (IS_ERR(rt)) 591 goto no_route; 592 if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway) 593 goto route_err; 594 rcu_read_unlock(); 595 return &rt->dst; 596 597 route_err: 598 ip_rt_put(rt); 599 no_route: 600 rcu_read_unlock(); 601 __IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES); 602 return NULL; 603 } 604 EXPORT_SYMBOL_GPL(inet_csk_route_child_sock); 605 606 #if IS_ENABLED(CONFIG_IPV6) 607 #define AF_INET_FAMILY(fam) ((fam) == AF_INET) 608 #else 609 #define AF_INET_FAMILY(fam) true 610 #endif 611 612 /* Decide when to expire the request and when to resend SYN-ACK */ 613 static inline void syn_ack_recalc(struct request_sock *req, const int thresh, 614 const int max_retries, 615 const u8 rskq_defer_accept, 616 int *expire, int *resend) 617 { 618 if (!rskq_defer_accept) { 619 *expire = req->num_timeout >= thresh; 620 *resend = 1; 621 return; 622 } 623 *expire = req->num_timeout >= thresh && 624 (!inet_rsk(req)->acked || req->num_timeout >= max_retries); 625 /* 626 * Do not resend while waiting for data after ACK, 627 * start to resend on end of deferring period to give 628 * last chance for data or ACK to create established socket. 629 */ 630 *resend = !inet_rsk(req)->acked || 631 req->num_timeout >= rskq_defer_accept - 1; 632 } 633 634 int inet_rtx_syn_ack(const struct sock *parent, struct request_sock *req) 635 { 636 int err = req->rsk_ops->rtx_syn_ack(parent, req); 637 638 if (!err) 639 req->num_retrans++; 640 return err; 641 } 642 EXPORT_SYMBOL(inet_rtx_syn_ack); 643 644 /* return true if req was found in the ehash table */ 645 static bool reqsk_queue_unlink(struct request_sock_queue *queue, 646 struct request_sock *req) 647 { 648 struct inet_hashinfo *hashinfo = req_to_sk(req)->sk_prot->h.hashinfo; 649 bool found = false; 650 651 if (sk_hashed(req_to_sk(req))) { 652 spinlock_t *lock = inet_ehash_lockp(hashinfo, req->rsk_hash); 653 654 spin_lock(lock); 655 found = __sk_nulls_del_node_init_rcu(req_to_sk(req)); 656 spin_unlock(lock); 657 } 658 if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer)) 659 reqsk_put(req); 660 return found; 661 } 662 663 void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) 664 { 665 if (reqsk_queue_unlink(&inet_csk(sk)->icsk_accept_queue, req)) { 666 reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req); 667 reqsk_put(req); 668 } 669 } 670 EXPORT_SYMBOL(inet_csk_reqsk_queue_drop); 671 672 void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req) 673 { 674 inet_csk_reqsk_queue_drop(sk, req); 675 reqsk_put(req); 676 } 677 EXPORT_SYMBOL(inet_csk_reqsk_queue_drop_and_put); 678 679 static void reqsk_timer_handler(unsigned long data) 680 { 681 struct request_sock *req = (struct request_sock *)data; 682 struct sock *sk_listener = req->rsk_listener; 683 struct net *net = sock_net(sk_listener); 684 struct inet_connection_sock *icsk = inet_csk(sk_listener); 685 struct request_sock_queue *queue = &icsk->icsk_accept_queue; 686 int qlen, expire = 0, resend = 0; 687 int max_retries, thresh; 688 u8 defer_accept; 689 690 if (sk_state_load(sk_listener) != TCP_LISTEN) 691 goto drop; 692 693 max_retries = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_synack_retries; 694 thresh = max_retries; 695 /* Normally all the openreqs are young and become mature 696 * (i.e. converted to established socket) for first timeout. 697 * If synack was not acknowledged for 1 second, it means 698 * one of the following things: synack was lost, ack was lost, 699 * rtt is high or nobody planned to ack (i.e. synflood). 700 * When server is a bit loaded, queue is populated with old 701 * open requests, reducing effective size of queue. 702 * When server is well loaded, queue size reduces to zero 703 * after several minutes of work. It is not synflood, 704 * it is normal operation. The solution is pruning 705 * too old entries overriding normal timeout, when 706 * situation becomes dangerous. 707 * 708 * Essentially, we reserve half of room for young 709 * embrions; and abort old ones without pity, if old 710 * ones are about to clog our table. 711 */ 712 qlen = reqsk_queue_len(queue); 713 if ((qlen << 1) > max(8U, sk_listener->sk_max_ack_backlog)) { 714 int young = reqsk_queue_len_young(queue) << 1; 715 716 while (thresh > 2) { 717 if (qlen < young) 718 break; 719 thresh--; 720 young <<= 1; 721 } 722 } 723 defer_accept = READ_ONCE(queue->rskq_defer_accept); 724 if (defer_accept) 725 max_retries = defer_accept; 726 syn_ack_recalc(req, thresh, max_retries, defer_accept, 727 &expire, &resend); 728 req->rsk_ops->syn_ack_timeout(req); 729 if (!expire && 730 (!resend || 731 !inet_rtx_syn_ack(sk_listener, req) || 732 inet_rsk(req)->acked)) { 733 unsigned long timeo; 734 735 if (req->num_timeout++ == 0) 736 atomic_dec(&queue->young); 737 timeo = min(TCP_TIMEOUT_INIT << req->num_timeout, TCP_RTO_MAX); 738 mod_timer(&req->rsk_timer, jiffies + timeo); 739 return; 740 } 741 drop: 742 inet_csk_reqsk_queue_drop_and_put(sk_listener, req); 743 } 744 745 static void reqsk_queue_hash_req(struct request_sock *req, 746 unsigned long timeout) 747 { 748 req->num_retrans = 0; 749 req->num_timeout = 0; 750 req->sk = NULL; 751 752 setup_pinned_timer(&req->rsk_timer, reqsk_timer_handler, 753 (unsigned long)req); 754 mod_timer(&req->rsk_timer, jiffies + timeout); 755 756 inet_ehash_insert(req_to_sk(req), NULL); 757 /* before letting lookups find us, make sure all req fields 758 * are committed to memory and refcnt initialized. 759 */ 760 smp_wmb(); 761 refcount_set(&req->rsk_refcnt, 2 + 1); 762 } 763 764 void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req, 765 unsigned long timeout) 766 { 767 reqsk_queue_hash_req(req, timeout); 768 inet_csk_reqsk_queue_added(sk); 769 } 770 EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add); 771 772 /** 773 * inet_csk_clone_lock - clone an inet socket, and lock its clone 774 * @sk: the socket to clone 775 * @req: request_sock 776 * @priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc) 777 * 778 * Caller must unlock socket even in error path (bh_unlock_sock(newsk)) 779 */ 780 struct sock *inet_csk_clone_lock(const struct sock *sk, 781 const struct request_sock *req, 782 const gfp_t priority) 783 { 784 struct sock *newsk = sk_clone_lock(sk, priority); 785 786 if (newsk) { 787 struct inet_connection_sock *newicsk = inet_csk(newsk); 788 789 newsk->sk_state = TCP_SYN_RECV; 790 newicsk->icsk_bind_hash = NULL; 791 792 inet_sk(newsk)->inet_dport = inet_rsk(req)->ir_rmt_port; 793 inet_sk(newsk)->inet_num = inet_rsk(req)->ir_num; 794 inet_sk(newsk)->inet_sport = htons(inet_rsk(req)->ir_num); 795 796 /* listeners have SOCK_RCU_FREE, not the children */ 797 sock_reset_flag(newsk, SOCK_RCU_FREE); 798 799 inet_sk(newsk)->mc_list = NULL; 800 801 newsk->sk_mark = inet_rsk(req)->ir_mark; 802 atomic64_set(&newsk->sk_cookie, 803 atomic64_read(&inet_rsk(req)->ir_cookie)); 804 805 newicsk->icsk_retransmits = 0; 806 newicsk->icsk_backoff = 0; 807 newicsk->icsk_probes_out = 0; 808 809 /* Deinitialize accept_queue to trap illegal accesses. */ 810 memset(&newicsk->icsk_accept_queue, 0, sizeof(newicsk->icsk_accept_queue)); 811 812 security_inet_csk_clone(newsk, req); 813 } 814 return newsk; 815 } 816 EXPORT_SYMBOL_GPL(inet_csk_clone_lock); 817 818 /* 819 * At this point, there should be no process reference to this 820 * socket, and thus no user references at all. Therefore we 821 * can assume the socket waitqueue is inactive and nobody will 822 * try to jump onto it. 823 */ 824 void inet_csk_destroy_sock(struct sock *sk) 825 { 826 WARN_ON(sk->sk_state != TCP_CLOSE); 827 WARN_ON(!sock_flag(sk, SOCK_DEAD)); 828 829 /* It cannot be in hash table! */ 830 WARN_ON(!sk_unhashed(sk)); 831 832 /* If it has not 0 inet_sk(sk)->inet_num, it must be bound */ 833 WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash); 834 835 sk->sk_prot->destroy(sk); 836 837 sk_stream_kill_queues(sk); 838 839 xfrm_sk_free_policy(sk); 840 841 sk_refcnt_debug_release(sk); 842 843 percpu_counter_dec(sk->sk_prot->orphan_count); 844 845 sock_put(sk); 846 } 847 EXPORT_SYMBOL(inet_csk_destroy_sock); 848 849 /* This function allows to force a closure of a socket after the call to 850 * tcp/dccp_create_openreq_child(). 851 */ 852 void inet_csk_prepare_forced_close(struct sock *sk) 853 __releases(&sk->sk_lock.slock) 854 { 855 /* sk_clone_lock locked the socket and set refcnt to 2 */ 856 bh_unlock_sock(sk); 857 sock_put(sk); 858 859 /* The below has to be done to allow calling inet_csk_destroy_sock */ 860 sock_set_flag(sk, SOCK_DEAD); 861 percpu_counter_inc(sk->sk_prot->orphan_count); 862 inet_sk(sk)->inet_num = 0; 863 } 864 EXPORT_SYMBOL(inet_csk_prepare_forced_close); 865 866 int inet_csk_listen_start(struct sock *sk, int backlog) 867 { 868 struct inet_connection_sock *icsk = inet_csk(sk); 869 struct inet_sock *inet = inet_sk(sk); 870 int err = -EADDRINUSE; 871 872 reqsk_queue_alloc(&icsk->icsk_accept_queue); 873 874 sk->sk_max_ack_backlog = backlog; 875 sk->sk_ack_backlog = 0; 876 inet_csk_delack_init(sk); 877 878 /* There is race window here: we announce ourselves listening, 879 * but this transition is still not validated by get_port(). 880 * It is OK, because this socket enters to hash table only 881 * after validation is complete. 882 */ 883 sk_state_store(sk, TCP_LISTEN); 884 if (!sk->sk_prot->get_port(sk, inet->inet_num)) { 885 inet->inet_sport = htons(inet->inet_num); 886 887 sk_dst_reset(sk); 888 err = sk->sk_prot->hash(sk); 889 890 if (likely(!err)) 891 return 0; 892 } 893 894 sk->sk_state = TCP_CLOSE; 895 return err; 896 } 897 EXPORT_SYMBOL_GPL(inet_csk_listen_start); 898 899 static void inet_child_forget(struct sock *sk, struct request_sock *req, 900 struct sock *child) 901 { 902 sk->sk_prot->disconnect(child, O_NONBLOCK); 903 904 sock_orphan(child); 905 906 percpu_counter_inc(sk->sk_prot->orphan_count); 907 908 if (sk->sk_protocol == IPPROTO_TCP && tcp_rsk(req)->tfo_listener) { 909 BUG_ON(tcp_sk(child)->fastopen_rsk != req); 910 BUG_ON(sk != req->rsk_listener); 911 912 /* Paranoid, to prevent race condition if 913 * an inbound pkt destined for child is 914 * blocked by sock lock in tcp_v4_rcv(). 915 * Also to satisfy an assertion in 916 * tcp_v4_destroy_sock(). 917 */ 918 tcp_sk(child)->fastopen_rsk = NULL; 919 } 920 inet_csk_destroy_sock(child); 921 } 922 923 struct sock *inet_csk_reqsk_queue_add(struct sock *sk, 924 struct request_sock *req, 925 struct sock *child) 926 { 927 struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue; 928 929 spin_lock(&queue->rskq_lock); 930 if (unlikely(sk->sk_state != TCP_LISTEN)) { 931 inet_child_forget(sk, req, child); 932 child = NULL; 933 } else { 934 req->sk = child; 935 req->dl_next = NULL; 936 if (queue->rskq_accept_head == NULL) 937 queue->rskq_accept_head = req; 938 else 939 queue->rskq_accept_tail->dl_next = req; 940 queue->rskq_accept_tail = req; 941 sk_acceptq_added(sk); 942 } 943 spin_unlock(&queue->rskq_lock); 944 return child; 945 } 946 EXPORT_SYMBOL(inet_csk_reqsk_queue_add); 947 948 struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child, 949 struct request_sock *req, bool own_req) 950 { 951 if (own_req) { 952 inet_csk_reqsk_queue_drop(sk, req); 953 reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req); 954 if (inet_csk_reqsk_queue_add(sk, req, child)) 955 return child; 956 } 957 /* Too bad, another child took ownership of the request, undo. */ 958 bh_unlock_sock(child); 959 sock_put(child); 960 return NULL; 961 } 962 EXPORT_SYMBOL(inet_csk_complete_hashdance); 963 964 /* 965 * This routine closes sockets which have been at least partially 966 * opened, but not yet accepted. 967 */ 968 void inet_csk_listen_stop(struct sock *sk) 969 { 970 struct inet_connection_sock *icsk = inet_csk(sk); 971 struct request_sock_queue *queue = &icsk->icsk_accept_queue; 972 struct request_sock *next, *req; 973 974 /* Following specs, it would be better either to send FIN 975 * (and enter FIN-WAIT-1, it is normal close) 976 * or to send active reset (abort). 977 * Certainly, it is pretty dangerous while synflood, but it is 978 * bad justification for our negligence 8) 979 * To be honest, we are not able to make either 980 * of the variants now. --ANK 981 */ 982 while ((req = reqsk_queue_remove(queue, sk)) != NULL) { 983 struct sock *child = req->sk; 984 985 local_bh_disable(); 986 bh_lock_sock(child); 987 WARN_ON(sock_owned_by_user(child)); 988 sock_hold(child); 989 990 inet_child_forget(sk, req, child); 991 reqsk_put(req); 992 bh_unlock_sock(child); 993 local_bh_enable(); 994 sock_put(child); 995 996 cond_resched(); 997 } 998 if (queue->fastopenq.rskq_rst_head) { 999 /* Free all the reqs queued in rskq_rst_head. */ 1000 spin_lock_bh(&queue->fastopenq.lock); 1001 req = queue->fastopenq.rskq_rst_head; 1002 queue->fastopenq.rskq_rst_head = NULL; 1003 spin_unlock_bh(&queue->fastopenq.lock); 1004 while (req != NULL) { 1005 next = req->dl_next; 1006 reqsk_put(req); 1007 req = next; 1008 } 1009 } 1010 WARN_ON_ONCE(sk->sk_ack_backlog); 1011 } 1012 EXPORT_SYMBOL_GPL(inet_csk_listen_stop); 1013 1014 void inet_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr) 1015 { 1016 struct sockaddr_in *sin = (struct sockaddr_in *)uaddr; 1017 const struct inet_sock *inet = inet_sk(sk); 1018 1019 sin->sin_family = AF_INET; 1020 sin->sin_addr.s_addr = inet->inet_daddr; 1021 sin->sin_port = inet->inet_dport; 1022 } 1023 EXPORT_SYMBOL_GPL(inet_csk_addr2sockaddr); 1024 1025 #ifdef CONFIG_COMPAT 1026 int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname, 1027 char __user *optval, int __user *optlen) 1028 { 1029 const struct inet_connection_sock *icsk = inet_csk(sk); 1030 1031 if (icsk->icsk_af_ops->compat_getsockopt) 1032 return icsk->icsk_af_ops->compat_getsockopt(sk, level, optname, 1033 optval, optlen); 1034 return icsk->icsk_af_ops->getsockopt(sk, level, optname, 1035 optval, optlen); 1036 } 1037 EXPORT_SYMBOL_GPL(inet_csk_compat_getsockopt); 1038 1039 int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname, 1040 char __user *optval, unsigned int optlen) 1041 { 1042 const struct inet_connection_sock *icsk = inet_csk(sk); 1043 1044 if (icsk->icsk_af_ops->compat_setsockopt) 1045 return icsk->icsk_af_ops->compat_setsockopt(sk, level, optname, 1046 optval, optlen); 1047 return icsk->icsk_af_ops->setsockopt(sk, level, optname, 1048 optval, optlen); 1049 } 1050 EXPORT_SYMBOL_GPL(inet_csk_compat_setsockopt); 1051 #endif 1052 1053 static struct dst_entry *inet_csk_rebuild_route(struct sock *sk, struct flowi *fl) 1054 { 1055 const struct inet_sock *inet = inet_sk(sk); 1056 const struct ip_options_rcu *inet_opt; 1057 __be32 daddr = inet->inet_daddr; 1058 struct flowi4 *fl4; 1059 struct rtable *rt; 1060 1061 rcu_read_lock(); 1062 inet_opt = rcu_dereference(inet->inet_opt); 1063 if (inet_opt && inet_opt->opt.srr) 1064 daddr = inet_opt->opt.faddr; 1065 fl4 = &fl->u.ip4; 1066 rt = ip_route_output_ports(sock_net(sk), fl4, sk, daddr, 1067 inet->inet_saddr, inet->inet_dport, 1068 inet->inet_sport, sk->sk_protocol, 1069 RT_CONN_FLAGS(sk), sk->sk_bound_dev_if); 1070 if (IS_ERR(rt)) 1071 rt = NULL; 1072 if (rt) 1073 sk_setup_caps(sk, &rt->dst); 1074 rcu_read_unlock(); 1075 1076 return &rt->dst; 1077 } 1078 1079 struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu) 1080 { 1081 struct dst_entry *dst = __sk_dst_check(sk, 0); 1082 struct inet_sock *inet = inet_sk(sk); 1083 1084 if (!dst) { 1085 dst = inet_csk_rebuild_route(sk, &inet->cork.fl); 1086 if (!dst) 1087 goto out; 1088 } 1089 dst->ops->update_pmtu(dst, sk, NULL, mtu); 1090 1091 dst = __sk_dst_check(sk, 0); 1092 if (!dst) 1093 dst = inet_csk_rebuild_route(sk, &inet->cork.fl); 1094 out: 1095 return dst; 1096 } 1097 EXPORT_SYMBOL_GPL(inet_csk_update_pmtu); 1098