1 /* 2 * Syncookies implementation for the Linux kernel 3 * 4 * Copyright (C) 1997 Andi Kleen 5 * Based on ideas by D.J.Bernstein and Eric Schenk. 6 * 7 * This program is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU General Public License 9 * as published by the Free Software Foundation; either version 10 * 2 of the License, or (at your option) any later version. 11 * 12 * $Id: syncookies.c,v 1.18 2002/02/01 22:01:04 davem Exp $ 13 */ 14 15 #include <linux/tcp.h> 16 #include <linux/slab.h> 17 #include <linux/random.h> 18 #include <linux/cryptohash.h> 19 #include <linux/kernel.h> 20 #include <net/tcp.h> 21 22 /* Timestamps: lowest 9 bits store TCP options */ 23 #define TSBITS 9 24 #define TSMASK (((__u32)1 << TSBITS) - 1) 25 26 extern int sysctl_tcp_syncookies; 27 28 __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS]; 29 EXPORT_SYMBOL(syncookie_secret); 30 31 static __init int init_syncookies(void) 32 { 33 get_random_bytes(syncookie_secret, sizeof(syncookie_secret)); 34 return 0; 35 } 36 __initcall(init_syncookies); 37 38 #define COOKIEBITS 24 /* Upper bits store count */ 39 #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1) 40 41 static DEFINE_PER_CPU(__u32, cookie_scratch)[16 + 5 + SHA_WORKSPACE_WORDS]; 42 43 static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport, 44 u32 count, int c) 45 { 46 __u32 *tmp = __get_cpu_var(cookie_scratch); 47 48 memcpy(tmp + 4, syncookie_secret[c], sizeof(syncookie_secret[c])); 49 tmp[0] = (__force u32)saddr; 50 tmp[1] = (__force u32)daddr; 51 tmp[2] = ((__force u32)sport << 16) + (__force u32)dport; 52 tmp[3] = count; 53 sha_transform(tmp + 16, (__u8 *)tmp, tmp + 16 + 5); 54 55 return tmp[17]; 56 } 57 58 59 /* 60 * when syncookies are in effect and tcp timestamps are enabled we encode 61 * tcp options in the lowest 9 bits of the timestamp value that will be 62 * sent in the syn-ack. 63 * Since subsequent timestamps use the normal tcp_time_stamp value, we 64 * must make sure that the resulting initial timestamp is <= tcp_time_stamp. 65 */ 66 __u32 cookie_init_timestamp(struct request_sock *req) 67 { 68 struct inet_request_sock *ireq; 69 u32 ts, ts_now = tcp_time_stamp; 70 u32 options = 0; 71 72 ireq = inet_rsk(req); 73 if (ireq->wscale_ok) { 74 options = ireq->snd_wscale; 75 options |= ireq->rcv_wscale << 4; 76 } 77 options |= ireq->sack_ok << 8; 78 79 ts = ts_now & ~TSMASK; 80 ts |= options; 81 if (ts > ts_now) { 82 ts >>= TSBITS; 83 ts--; 84 ts <<= TSBITS; 85 ts |= options; 86 } 87 return ts; 88 } 89 90 91 static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport, 92 __be16 dport, __u32 sseq, __u32 count, 93 __u32 data) 94 { 95 /* 96 * Compute the secure sequence number. 97 * The output should be: 98 * HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24) 99 * + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24). 100 * Where sseq is their sequence number and count increases every 101 * minute by 1. 102 * As an extra hack, we add a small "data" value that encodes the 103 * MSS into the second hash value. 104 */ 105 106 return (cookie_hash(saddr, daddr, sport, dport, 0, 0) + 107 sseq + (count << COOKIEBITS) + 108 ((cookie_hash(saddr, daddr, sport, dport, count, 1) + data) 109 & COOKIEMASK)); 110 } 111 112 /* 113 * This retrieves the small "data" value from the syncookie. 114 * If the syncookie is bad, the data returned will be out of 115 * range. This must be checked by the caller. 116 * 117 * The count value used to generate the cookie must be within 118 * "maxdiff" if the current (passed-in) "count". The return value 119 * is (__u32)-1 if this test fails. 120 */ 121 static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr, 122 __be16 sport, __be16 dport, __u32 sseq, 123 __u32 count, __u32 maxdiff) 124 { 125 __u32 diff; 126 127 /* Strip away the layers from the cookie */ 128 cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq; 129 130 /* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */ 131 diff = (count - (cookie >> COOKIEBITS)) & ((__u32) - 1 >> COOKIEBITS); 132 if (diff >= maxdiff) 133 return (__u32)-1; 134 135 return (cookie - 136 cookie_hash(saddr, daddr, sport, dport, count - diff, 1)) 137 & COOKIEMASK; /* Leaving the data behind */ 138 } 139 140 /* 141 * This table has to be sorted and terminated with (__u16)-1. 142 * XXX generate a better table. 143 * Unresolved Issues: HIPPI with a 64k MSS is not well supported. 144 */ 145 static __u16 const msstab[] = { 146 64 - 1, 147 256 - 1, 148 512 - 1, 149 536 - 1, 150 1024 - 1, 151 1440 - 1, 152 1460 - 1, 153 4312 - 1, 154 (__u16)-1 155 }; 156 /* The number doesn't include the -1 terminator */ 157 #define NUM_MSS (ARRAY_SIZE(msstab) - 1) 158 159 /* 160 * Generate a syncookie. mssp points to the mss, which is returned 161 * rounded down to the value encoded in the cookie. 162 */ 163 __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp) 164 { 165 struct tcp_sock *tp = tcp_sk(sk); 166 const struct iphdr *iph = ip_hdr(skb); 167 const struct tcphdr *th = tcp_hdr(skb); 168 int mssind; 169 const __u16 mss = *mssp; 170 171 tp->last_synq_overflow = jiffies; 172 173 /* XXX sort msstab[] by probability? Binary search? */ 174 for (mssind = 0; mss > msstab[mssind + 1]; mssind++) 175 ; 176 *mssp = msstab[mssind] + 1; 177 178 NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESSENT); 179 180 return secure_tcp_syn_cookie(iph->saddr, iph->daddr, 181 th->source, th->dest, ntohl(th->seq), 182 jiffies / (HZ * 60), mssind); 183 } 184 185 /* 186 * This (misnamed) value is the age of syncookie which is permitted. 187 * Its ideal value should be dependent on TCP_TIMEOUT_INIT and 188 * sysctl_tcp_retries1. It's a rather complicated formula (exponential 189 * backoff) to compute at runtime so it's currently hardcoded here. 190 */ 191 #define COUNTER_TRIES 4 192 /* 193 * Check if a ack sequence number is a valid syncookie. 194 * Return the decoded mss if it is, or 0 if not. 195 */ 196 static inline int cookie_check(struct sk_buff *skb, __u32 cookie) 197 { 198 const struct iphdr *iph = ip_hdr(skb); 199 const struct tcphdr *th = tcp_hdr(skb); 200 __u32 seq = ntohl(th->seq) - 1; 201 __u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr, 202 th->source, th->dest, seq, 203 jiffies / (HZ * 60), 204 COUNTER_TRIES); 205 206 return mssind < NUM_MSS ? msstab[mssind] + 1 : 0; 207 } 208 209 static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb, 210 struct request_sock *req, 211 struct dst_entry *dst) 212 { 213 struct inet_connection_sock *icsk = inet_csk(sk); 214 struct sock *child; 215 216 child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst); 217 if (child) 218 inet_csk_reqsk_queue_add(sk, req, child); 219 else 220 reqsk_free(req); 221 222 return child; 223 } 224 225 226 /* 227 * when syncookies are in effect and tcp timestamps are enabled we stored 228 * additional tcp options in the timestamp. 229 * This extracts these options from the timestamp echo. 230 * 231 * The lowest 4 bits are for snd_wscale 232 * The next 4 lsb are for rcv_wscale 233 * The next lsb is for sack_ok 234 */ 235 void cookie_check_timestamp(struct tcp_options_received *tcp_opt) 236 { 237 /* echoed timestamp, 9 lowest bits contain options */ 238 u32 options = tcp_opt->rcv_tsecr & TSMASK; 239 240 tcp_opt->snd_wscale = options & 0xf; 241 options >>= 4; 242 tcp_opt->rcv_wscale = options & 0xf; 243 244 tcp_opt->sack_ok = (options >> 4) & 0x1; 245 246 if (tcp_opt->sack_ok) 247 tcp_sack_reset(tcp_opt); 248 249 if (tcp_opt->snd_wscale || tcp_opt->rcv_wscale) 250 tcp_opt->wscale_ok = 1; 251 } 252 EXPORT_SYMBOL(cookie_check_timestamp); 253 254 struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, 255 struct ip_options *opt) 256 { 257 struct inet_request_sock *ireq; 258 struct tcp_request_sock *treq; 259 struct tcp_sock *tp = tcp_sk(sk); 260 const struct tcphdr *th = tcp_hdr(skb); 261 __u32 cookie = ntohl(th->ack_seq) - 1; 262 struct sock *ret = sk; 263 struct request_sock *req; 264 int mss; 265 struct rtable *rt; 266 __u8 rcv_wscale; 267 struct tcp_options_received tcp_opt; 268 269 if (!sysctl_tcp_syncookies || !th->ack) 270 goto out; 271 272 if (time_after(jiffies, tp->last_synq_overflow + TCP_TIMEOUT_INIT) || 273 (mss = cookie_check(skb, cookie)) == 0) { 274 NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESFAILED); 275 goto out; 276 } 277 278 NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESRECV); 279 280 /* check for timestamp cookie support */ 281 memset(&tcp_opt, 0, sizeof(tcp_opt)); 282 tcp_parse_options(skb, &tcp_opt, 0); 283 284 if (tcp_opt.saw_tstamp) 285 cookie_check_timestamp(&tcp_opt); 286 287 ret = NULL; 288 req = reqsk_alloc(&tcp_request_sock_ops); /* for safety */ 289 if (!req) 290 goto out; 291 292 if (security_inet_conn_request(sk, skb, req)) { 293 reqsk_free(req); 294 goto out; 295 } 296 ireq = inet_rsk(req); 297 treq = tcp_rsk(req); 298 treq->rcv_isn = ntohl(th->seq) - 1; 299 treq->snt_isn = cookie; 300 req->mss = mss; 301 ireq->rmt_port = th->source; 302 ireq->loc_addr = ip_hdr(skb)->daddr; 303 ireq->rmt_addr = ip_hdr(skb)->saddr; 304 ireq->opt = NULL; 305 ireq->snd_wscale = tcp_opt.snd_wscale; 306 ireq->rcv_wscale = tcp_opt.rcv_wscale; 307 ireq->sack_ok = tcp_opt.sack_ok; 308 ireq->wscale_ok = tcp_opt.wscale_ok; 309 ireq->tstamp_ok = tcp_opt.saw_tstamp; 310 req->ts_recent = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0; 311 312 /* We throwed the options of the initial SYN away, so we hope 313 * the ACK carries the same options again (see RFC1122 4.2.3.8) 314 */ 315 if (opt && opt->optlen) { 316 int opt_size = sizeof(struct ip_options) + opt->optlen; 317 318 ireq->opt = kmalloc(opt_size, GFP_ATOMIC); 319 if (ireq->opt != NULL && ip_options_echo(ireq->opt, skb)) { 320 kfree(ireq->opt); 321 ireq->opt = NULL; 322 } 323 } 324 325 req->expires = 0UL; 326 req->retrans = 0; 327 328 /* 329 * We need to lookup the route here to get at the correct 330 * window size. We should better make sure that the window size 331 * hasn't changed since we received the original syn, but I see 332 * no easy way to do this. 333 */ 334 { 335 struct flowi fl = { .nl_u = { .ip4_u = 336 { .daddr = ((opt && opt->srr) ? 337 opt->faddr : 338 ireq->rmt_addr), 339 .saddr = ireq->loc_addr, 340 .tos = RT_CONN_FLAGS(sk) } }, 341 .proto = IPPROTO_TCP, 342 .uli_u = { .ports = 343 { .sport = th->dest, 344 .dport = th->source } } }; 345 security_req_classify_flow(req, &fl); 346 if (ip_route_output_key(&init_net, &rt, &fl)) { 347 reqsk_free(req); 348 goto out; 349 } 350 } 351 352 /* Try to redo what tcp_v4_send_synack did. */ 353 req->window_clamp = tp->window_clamp ? :dst_metric(&rt->u.dst, RTAX_WINDOW); 354 355 tcp_select_initial_window(tcp_full_space(sk), req->mss, 356 &req->rcv_wnd, &req->window_clamp, 357 ireq->wscale_ok, &rcv_wscale); 358 359 ireq->rcv_wscale = rcv_wscale; 360 361 ret = get_cookie_sock(sk, skb, req, &rt->u.dst); 362 out: return ret; 363 } 364