1 /* 2 * Syncookies implementation for the Linux kernel 3 * 4 * Copyright (C) 1997 Andi Kleen 5 * Based on ideas by D.J.Bernstein and Eric Schenk. 6 * 7 * This program is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU General Public License 9 * as published by the Free Software Foundation; either version 10 * 2 of the License, or (at your option) any later version. 11 */ 12 13 #include <linux/tcp.h> 14 #include <linux/slab.h> 15 #include <linux/random.h> 16 #include <linux/cryptohash.h> 17 #include <linux/kernel.h> 18 #include <net/tcp.h> 19 #include <net/route.h> 20 21 /* Timestamps: lowest 9 bits store TCP options */ 22 #define TSBITS 9 23 #define TSMASK (((__u32)1 << TSBITS) - 1) 24 25 extern int sysctl_tcp_syncookies; 26 27 __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS]; 28 EXPORT_SYMBOL(syncookie_secret); 29 30 static __init int init_syncookies(void) 31 { 32 get_random_bytes(syncookie_secret, sizeof(syncookie_secret)); 33 return 0; 34 } 35 __initcall(init_syncookies); 36 37 #define COOKIEBITS 24 /* Upper bits store count */ 38 #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1) 39 40 static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS], 41 ipv4_cookie_scratch); 42 43 static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport, 44 u32 count, int c) 45 { 46 __u32 *tmp = __get_cpu_var(ipv4_cookie_scratch); 47 48 memcpy(tmp + 4, syncookie_secret[c], sizeof(syncookie_secret[c])); 49 tmp[0] = (__force u32)saddr; 50 tmp[1] = (__force u32)daddr; 51 tmp[2] = ((__force u32)sport << 16) + (__force u32)dport; 52 tmp[3] = count; 53 sha_transform(tmp + 16, (__u8 *)tmp, tmp + 16 + 5); 54 55 return tmp[17]; 56 } 57 58 59 /* 60 * when syncookies are in effect and tcp timestamps are enabled we encode 61 * tcp options in the lowest 9 bits of the timestamp value that will be 62 * sent in the syn-ack. 63 * Since subsequent timestamps use the normal tcp_time_stamp value, we 64 * must make sure that the resulting initial timestamp is <= tcp_time_stamp. 65 */ 66 __u32 cookie_init_timestamp(struct request_sock *req) 67 { 68 struct inet_request_sock *ireq; 69 u32 ts, ts_now = tcp_time_stamp; 70 u32 options = 0; 71 72 ireq = inet_rsk(req); 73 if (ireq->wscale_ok) { 74 options = ireq->snd_wscale; 75 options |= ireq->rcv_wscale << 4; 76 } 77 options |= ireq->sack_ok << 8; 78 79 ts = ts_now & ~TSMASK; 80 ts |= options; 81 if (ts > ts_now) { 82 ts >>= TSBITS; 83 ts--; 84 ts <<= TSBITS; 85 ts |= options; 86 } 87 return ts; 88 } 89 90 91 static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport, 92 __be16 dport, __u32 sseq, __u32 count, 93 __u32 data) 94 { 95 /* 96 * Compute the secure sequence number. 97 * The output should be: 98 * HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24) 99 * + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24). 100 * Where sseq is their sequence number and count increases every 101 * minute by 1. 102 * As an extra hack, we add a small "data" value that encodes the 103 * MSS into the second hash value. 104 */ 105 106 return (cookie_hash(saddr, daddr, sport, dport, 0, 0) + 107 sseq + (count << COOKIEBITS) + 108 ((cookie_hash(saddr, daddr, sport, dport, count, 1) + data) 109 & COOKIEMASK)); 110 } 111 112 /* 113 * This retrieves the small "data" value from the syncookie. 114 * If the syncookie is bad, the data returned will be out of 115 * range. This must be checked by the caller. 116 * 117 * The count value used to generate the cookie must be within 118 * "maxdiff" if the current (passed-in) "count". The return value 119 * is (__u32)-1 if this test fails. 120 */ 121 static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr, 122 __be16 sport, __be16 dport, __u32 sseq, 123 __u32 count, __u32 maxdiff) 124 { 125 __u32 diff; 126 127 /* Strip away the layers from the cookie */ 128 cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq; 129 130 /* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */ 131 diff = (count - (cookie >> COOKIEBITS)) & ((__u32) - 1 >> COOKIEBITS); 132 if (diff >= maxdiff) 133 return (__u32)-1; 134 135 return (cookie - 136 cookie_hash(saddr, daddr, sport, dport, count - diff, 1)) 137 & COOKIEMASK; /* Leaving the data behind */ 138 } 139 140 /* 141 * This table has to be sorted and terminated with (__u16)-1. 142 * XXX generate a better table. 143 * Unresolved Issues: HIPPI with a 64k MSS is not well supported. 144 */ 145 static __u16 const msstab[] = { 146 64 - 1, 147 256 - 1, 148 512 - 1, 149 536 - 1, 150 1024 - 1, 151 1440 - 1, 152 1460 - 1, 153 4312 - 1, 154 (__u16)-1 155 }; 156 /* The number doesn't include the -1 terminator */ 157 #define NUM_MSS (ARRAY_SIZE(msstab) - 1) 158 159 /* 160 * Generate a syncookie. mssp points to the mss, which is returned 161 * rounded down to the value encoded in the cookie. 162 */ 163 __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp) 164 { 165 const struct iphdr *iph = ip_hdr(skb); 166 const struct tcphdr *th = tcp_hdr(skb); 167 int mssind; 168 const __u16 mss = *mssp; 169 170 tcp_synq_overflow(sk); 171 172 /* XXX sort msstab[] by probability? Binary search? */ 173 for (mssind = 0; mss > msstab[mssind + 1]; mssind++) 174 ; 175 *mssp = msstab[mssind] + 1; 176 177 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT); 178 179 return secure_tcp_syn_cookie(iph->saddr, iph->daddr, 180 th->source, th->dest, ntohl(th->seq), 181 jiffies / (HZ * 60), mssind); 182 } 183 184 /* 185 * This (misnamed) value is the age of syncookie which is permitted. 186 * Its ideal value should be dependent on TCP_TIMEOUT_INIT and 187 * sysctl_tcp_retries1. It's a rather complicated formula (exponential 188 * backoff) to compute at runtime so it's currently hardcoded here. 189 */ 190 #define COUNTER_TRIES 4 191 /* 192 * Check if a ack sequence number is a valid syncookie. 193 * Return the decoded mss if it is, or 0 if not. 194 */ 195 static inline int cookie_check(struct sk_buff *skb, __u32 cookie) 196 { 197 const struct iphdr *iph = ip_hdr(skb); 198 const struct tcphdr *th = tcp_hdr(skb); 199 __u32 seq = ntohl(th->seq) - 1; 200 __u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr, 201 th->source, th->dest, seq, 202 jiffies / (HZ * 60), 203 COUNTER_TRIES); 204 205 return mssind < NUM_MSS ? msstab[mssind] + 1 : 0; 206 } 207 208 static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb, 209 struct request_sock *req, 210 struct dst_entry *dst) 211 { 212 struct inet_connection_sock *icsk = inet_csk(sk); 213 struct sock *child; 214 215 child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst); 216 if (child) 217 inet_csk_reqsk_queue_add(sk, req, child); 218 else 219 reqsk_free(req); 220 221 return child; 222 } 223 224 225 /* 226 * when syncookies are in effect and tcp timestamps are enabled we stored 227 * additional tcp options in the timestamp. 228 * This extracts these options from the timestamp echo. 229 * 230 * The lowest 4 bits are for snd_wscale 231 * The next 4 lsb are for rcv_wscale 232 * The next lsb is for sack_ok 233 */ 234 void cookie_check_timestamp(struct tcp_options_received *tcp_opt) 235 { 236 /* echoed timestamp, 9 lowest bits contain options */ 237 u32 options = tcp_opt->rcv_tsecr & TSMASK; 238 239 tcp_opt->snd_wscale = options & 0xf; 240 options >>= 4; 241 tcp_opt->rcv_wscale = options & 0xf; 242 243 tcp_opt->sack_ok = (options >> 4) & 0x1; 244 245 if (tcp_opt->sack_ok) 246 tcp_sack_reset(tcp_opt); 247 248 if (tcp_opt->snd_wscale || tcp_opt->rcv_wscale) 249 tcp_opt->wscale_ok = 1; 250 } 251 EXPORT_SYMBOL(cookie_check_timestamp); 252 253 struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, 254 struct ip_options *opt) 255 { 256 struct tcp_options_received tcp_opt; 257 u8 *hash_location; 258 struct inet_request_sock *ireq; 259 struct tcp_request_sock *treq; 260 struct tcp_sock *tp = tcp_sk(sk); 261 const struct tcphdr *th = tcp_hdr(skb); 262 __u32 cookie = ntohl(th->ack_seq) - 1; 263 struct sock *ret = sk; 264 struct request_sock *req; 265 int mss; 266 struct rtable *rt; 267 __u8 rcv_wscale; 268 269 if (!sysctl_tcp_syncookies || !th->ack) 270 goto out; 271 272 if (tcp_synq_no_recent_overflow(sk) || 273 (mss = cookie_check(skb, cookie)) == 0) { 274 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED); 275 goto out; 276 } 277 278 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV); 279 280 /* check for timestamp cookie support */ 281 memset(&tcp_opt, 0, sizeof(tcp_opt)); 282 tcp_parse_options(skb, &tcp_opt, &hash_location, 0); 283 284 if (tcp_opt.saw_tstamp) 285 cookie_check_timestamp(&tcp_opt); 286 287 ret = NULL; 288 req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */ 289 if (!req) 290 goto out; 291 292 ireq = inet_rsk(req); 293 treq = tcp_rsk(req); 294 treq->rcv_isn = ntohl(th->seq) - 1; 295 treq->snt_isn = cookie; 296 req->mss = mss; 297 ireq->loc_port = th->dest; 298 ireq->rmt_port = th->source; 299 ireq->loc_addr = ip_hdr(skb)->daddr; 300 ireq->rmt_addr = ip_hdr(skb)->saddr; 301 ireq->ecn_ok = 0; 302 ireq->snd_wscale = tcp_opt.snd_wscale; 303 ireq->rcv_wscale = tcp_opt.rcv_wscale; 304 ireq->sack_ok = tcp_opt.sack_ok; 305 ireq->wscale_ok = tcp_opt.wscale_ok; 306 ireq->tstamp_ok = tcp_opt.saw_tstamp; 307 req->ts_recent = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0; 308 309 /* We throwed the options of the initial SYN away, so we hope 310 * the ACK carries the same options again (see RFC1122 4.2.3.8) 311 */ 312 if (opt && opt->optlen) { 313 int opt_size = sizeof(struct ip_options) + opt->optlen; 314 315 ireq->opt = kmalloc(opt_size, GFP_ATOMIC); 316 if (ireq->opt != NULL && ip_options_echo(ireq->opt, skb)) { 317 kfree(ireq->opt); 318 ireq->opt = NULL; 319 } 320 } 321 322 if (security_inet_conn_request(sk, skb, req)) { 323 reqsk_free(req); 324 goto out; 325 } 326 327 req->expires = 0UL; 328 req->retrans = 0; 329 330 /* 331 * We need to lookup the route here to get at the correct 332 * window size. We should better make sure that the window size 333 * hasn't changed since we received the original syn, but I see 334 * no easy way to do this. 335 */ 336 { 337 struct flowi fl = { .mark = sk->sk_mark, 338 .nl_u = { .ip4_u = 339 { .daddr = ((opt && opt->srr) ? 340 opt->faddr : 341 ireq->rmt_addr), 342 .saddr = ireq->loc_addr, 343 .tos = RT_CONN_FLAGS(sk) } }, 344 .proto = IPPROTO_TCP, 345 .flags = inet_sk_flowi_flags(sk), 346 .uli_u = { .ports = 347 { .sport = th->dest, 348 .dport = th->source } } }; 349 security_req_classify_flow(req, &fl); 350 if (ip_route_output_key(sock_net(sk), &rt, &fl)) { 351 reqsk_free(req); 352 goto out; 353 } 354 } 355 356 /* Try to redo what tcp_v4_send_synack did. */ 357 req->window_clamp = tp->window_clamp ? :dst_metric(&rt->u.dst, RTAX_WINDOW); 358 359 tcp_select_initial_window(tcp_full_space(sk), req->mss, 360 &req->rcv_wnd, &req->window_clamp, 361 ireq->wscale_ok, &rcv_wscale, 362 dst_metric(&rt->u.dst, RTAX_INITRWND)); 363 364 ireq->rcv_wscale = rcv_wscale; 365 366 ret = get_cookie_sock(sk, skb, req, &rt->u.dst); 367 out: return ret; 368 } 369