1cf80e0e4SHerbert Xu #include <linux/crypto.h> 210467163SJerry Chu #include <linux/err.h> 32100c8d2SYuchung Cheng #include <linux/init.h> 42100c8d2SYuchung Cheng #include <linux/kernel.h> 510467163SJerry Chu #include <linux/list.h> 610467163SJerry Chu #include <linux/tcp.h> 710467163SJerry Chu #include <linux/rcupdate.h> 810467163SJerry Chu #include <linux/rculist.h> 910467163SJerry Chu #include <net/inetpeer.h> 1010467163SJerry Chu #include <net/tcp.h> 112100c8d2SYuchung Cheng 1243713848SHaishuang Yan void tcp_fastopen_init_key_once(struct net *net) 13222e83d2SHannes Frederic Sowa { 1443713848SHaishuang Yan u8 key[TCP_FASTOPEN_KEY_LENGTH]; 1543713848SHaishuang Yan struct tcp_fastopen_context *ctxt; 1643713848SHaishuang Yan 1743713848SHaishuang Yan rcu_read_lock(); 1843713848SHaishuang Yan ctxt = rcu_dereference(net->ipv4.tcp_fastopen_ctx); 1943713848SHaishuang Yan if (ctxt) { 2043713848SHaishuang Yan rcu_read_unlock(); 2143713848SHaishuang Yan return; 2243713848SHaishuang Yan } 2343713848SHaishuang Yan rcu_read_unlock(); 24222e83d2SHannes Frederic Sowa 25222e83d2SHannes Frederic Sowa /* tcp_fastopen_reset_cipher publishes the new context 26222e83d2SHannes Frederic Sowa * atomically, so we allow this race happening here. 27222e83d2SHannes Frederic Sowa * 28222e83d2SHannes Frederic Sowa * All call sites of tcp_fastopen_cookie_gen also check 29222e83d2SHannes Frederic Sowa * for a valid cookie, so this is an acceptable risk. 30222e83d2SHannes Frederic Sowa */ 3143713848SHaishuang Yan get_random_bytes(key, sizeof(key)); 3243713848SHaishuang Yan tcp_fastopen_reset_cipher(net, key, sizeof(key)); 33222e83d2SHannes Frederic Sowa } 34222e83d2SHannes Frederic Sowa 3510467163SJerry Chu static void tcp_fastopen_ctx_free(struct rcu_head *head) 3610467163SJerry Chu { 3710467163SJerry Chu struct tcp_fastopen_context *ctx = 3810467163SJerry Chu container_of(head, struct tcp_fastopen_context, rcu); 3910467163SJerry Chu crypto_free_cipher(ctx->tfm); 4010467163SJerry Chu kfree(ctx); 4110467163SJerry Chu } 4210467163SJerry Chu 4343713848SHaishuang Yan void tcp_fastopen_ctx_destroy(struct net *net) 4443713848SHaishuang Yan { 4543713848SHaishuang Yan struct tcp_fastopen_context *ctxt; 4643713848SHaishuang Yan 4743713848SHaishuang Yan spin_lock(&net->ipv4.tcp_fastopen_ctx_lock); 4843713848SHaishuang Yan 4943713848SHaishuang Yan ctxt = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx, 5043713848SHaishuang Yan lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock)); 5143713848SHaishuang Yan rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, NULL); 5243713848SHaishuang Yan spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock); 5343713848SHaishuang Yan 5443713848SHaishuang Yan if (ctxt) 5543713848SHaishuang Yan call_rcu(&ctxt->rcu, tcp_fastopen_ctx_free); 5643713848SHaishuang Yan } 5743713848SHaishuang Yan 5843713848SHaishuang Yan int tcp_fastopen_reset_cipher(struct net *net, void *key, unsigned int len) 5910467163SJerry Chu { 6010467163SJerry Chu int err; 6110467163SJerry Chu struct tcp_fastopen_context *ctx, *octx; 6210467163SJerry Chu 6310467163SJerry Chu ctx = kmalloc(sizeof(*ctx), GFP_KERNEL); 6410467163SJerry Chu if (!ctx) 6510467163SJerry Chu return -ENOMEM; 6610467163SJerry Chu ctx->tfm = crypto_alloc_cipher("aes", 0, 0); 6710467163SJerry Chu 6810467163SJerry Chu if (IS_ERR(ctx->tfm)) { 6910467163SJerry Chu err = PTR_ERR(ctx->tfm); 7010467163SJerry Chu error: kfree(ctx); 7110467163SJerry Chu pr_err("TCP: TFO aes cipher alloc error: %d\n", err); 7210467163SJerry Chu return err; 7310467163SJerry Chu } 7410467163SJerry Chu err = crypto_cipher_setkey(ctx->tfm, key, len); 7510467163SJerry Chu if (err) { 7610467163SJerry Chu pr_err("TCP: TFO cipher key error: %d\n", err); 7710467163SJerry Chu crypto_free_cipher(ctx->tfm); 7810467163SJerry Chu goto error; 7910467163SJerry Chu } 8010467163SJerry Chu memcpy(ctx->key, key, len); 8110467163SJerry Chu 8243713848SHaishuang Yan spin_lock(&net->ipv4.tcp_fastopen_ctx_lock); 8310467163SJerry Chu 8443713848SHaishuang Yan octx = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx, 8543713848SHaishuang Yan lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock)); 8643713848SHaishuang Yan rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, ctx); 8743713848SHaishuang Yan spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock); 8810467163SJerry Chu 8910467163SJerry Chu if (octx) 9010467163SJerry Chu call_rcu(&octx->rcu, tcp_fastopen_ctx_free); 9110467163SJerry Chu return err; 9210467163SJerry Chu } 9310467163SJerry Chu 9443713848SHaishuang Yan static bool __tcp_fastopen_cookie_gen(struct net *net, 9543713848SHaishuang Yan const void *path, 96149479d0SYuchung Cheng struct tcp_fastopen_cookie *foc) 9710467163SJerry Chu { 9810467163SJerry Chu struct tcp_fastopen_context *ctx; 993a19ce0eSDaniel Lee bool ok = false; 10010467163SJerry Chu 10110467163SJerry Chu rcu_read_lock(); 10243713848SHaishuang Yan ctx = rcu_dereference(net->ipv4.tcp_fastopen_ctx); 10310467163SJerry Chu if (ctx) { 1043a19ce0eSDaniel Lee crypto_cipher_encrypt_one(ctx->tfm, foc->val, path); 10510467163SJerry Chu foc->len = TCP_FASTOPEN_COOKIE_SIZE; 1063a19ce0eSDaniel Lee ok = true; 10710467163SJerry Chu } 10810467163SJerry Chu rcu_read_unlock(); 1093a19ce0eSDaniel Lee return ok; 1103a19ce0eSDaniel Lee } 1113a19ce0eSDaniel Lee 1123a19ce0eSDaniel Lee /* Generate the fastopen cookie by doing aes128 encryption on both 1133a19ce0eSDaniel Lee * the source and destination addresses. Pad 0s for IPv4 or IPv4-mapped-IPv6 1143a19ce0eSDaniel Lee * addresses. For the longer IPv6 addresses use CBC-MAC. 1153a19ce0eSDaniel Lee * 1163a19ce0eSDaniel Lee * XXX (TFO) - refactor when TCP_FASTOPEN_COOKIE_SIZE != AES_BLOCK_SIZE. 1173a19ce0eSDaniel Lee */ 11843713848SHaishuang Yan static bool tcp_fastopen_cookie_gen(struct net *net, 11943713848SHaishuang Yan struct request_sock *req, 1203a19ce0eSDaniel Lee struct sk_buff *syn, 1213a19ce0eSDaniel Lee struct tcp_fastopen_cookie *foc) 1223a19ce0eSDaniel Lee { 1233a19ce0eSDaniel Lee if (req->rsk_ops->family == AF_INET) { 1243a19ce0eSDaniel Lee const struct iphdr *iph = ip_hdr(syn); 1253a19ce0eSDaniel Lee 1263a19ce0eSDaniel Lee __be32 path[4] = { iph->saddr, iph->daddr, 0, 0 }; 12743713848SHaishuang Yan return __tcp_fastopen_cookie_gen(net, path, foc); 1283a19ce0eSDaniel Lee } 1293a19ce0eSDaniel Lee 1303a19ce0eSDaniel Lee #if IS_ENABLED(CONFIG_IPV6) 1313a19ce0eSDaniel Lee if (req->rsk_ops->family == AF_INET6) { 1323a19ce0eSDaniel Lee const struct ipv6hdr *ip6h = ipv6_hdr(syn); 1333a19ce0eSDaniel Lee struct tcp_fastopen_cookie tmp; 1343a19ce0eSDaniel Lee 13543713848SHaishuang Yan if (__tcp_fastopen_cookie_gen(net, &ip6h->saddr, &tmp)) { 136003c9410SShannon Nelson struct in6_addr *buf = &tmp.addr; 13741c91996SLi RongQing int i; 1383a19ce0eSDaniel Lee 1393a19ce0eSDaniel Lee for (i = 0; i < 4; i++) 1403a19ce0eSDaniel Lee buf->s6_addr32[i] ^= ip6h->daddr.s6_addr32[i]; 14143713848SHaishuang Yan return __tcp_fastopen_cookie_gen(net, buf, foc); 1423a19ce0eSDaniel Lee } 1433a19ce0eSDaniel Lee } 1443a19ce0eSDaniel Lee #endif 1453a19ce0eSDaniel Lee return false; 14610467163SJerry Chu } 1475b7ed089SYuchung Cheng 14861d2bcaeSEric Dumazet 14961d2bcaeSEric Dumazet /* If an incoming SYN or SYNACK frame contains a payload and/or FIN, 15061d2bcaeSEric Dumazet * queue this additional data / FIN. 15161d2bcaeSEric Dumazet */ 15261d2bcaeSEric Dumazet void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb) 15361d2bcaeSEric Dumazet { 15461d2bcaeSEric Dumazet struct tcp_sock *tp = tcp_sk(sk); 15561d2bcaeSEric Dumazet 15661d2bcaeSEric Dumazet if (TCP_SKB_CB(skb)->end_seq == tp->rcv_nxt) 15761d2bcaeSEric Dumazet return; 15861d2bcaeSEric Dumazet 15961d2bcaeSEric Dumazet skb = skb_clone(skb, GFP_ATOMIC); 16061d2bcaeSEric Dumazet if (!skb) 16161d2bcaeSEric Dumazet return; 16261d2bcaeSEric Dumazet 16361d2bcaeSEric Dumazet skb_dst_drop(skb); 164a44d6eacSMartin KaFai Lau /* segs_in has been initialized to 1 in tcp_create_openreq_child(). 165a44d6eacSMartin KaFai Lau * Hence, reset segs_in to 0 before calling tcp_segs_in() 166a44d6eacSMartin KaFai Lau * to avoid double counting. Also, tcp_segs_in() expects 167a44d6eacSMartin KaFai Lau * skb->len to include the tcp_hdrlen. Hence, it should 168a44d6eacSMartin KaFai Lau * be called before __skb_pull(). 169a44d6eacSMartin KaFai Lau */ 170a44d6eacSMartin KaFai Lau tp->segs_in = 0; 171a44d6eacSMartin KaFai Lau tcp_segs_in(tp, skb); 17261d2bcaeSEric Dumazet __skb_pull(skb, tcp_hdrlen(skb)); 17376061f63SEric Dumazet sk_forced_mem_schedule(sk, skb->truesize); 17461d2bcaeSEric Dumazet skb_set_owner_r(skb, sk); 17561d2bcaeSEric Dumazet 1769d691539SEric Dumazet TCP_SKB_CB(skb)->seq++; 1779d691539SEric Dumazet TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_SYN; 1789d691539SEric Dumazet 17961d2bcaeSEric Dumazet tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq; 18061d2bcaeSEric Dumazet __skb_queue_tail(&sk->sk_receive_queue, skb); 18161d2bcaeSEric Dumazet tp->syn_data_acked = 1; 18261d2bcaeSEric Dumazet 18361d2bcaeSEric Dumazet /* u64_stats_update_begin(&tp->syncp) not needed here, 18461d2bcaeSEric Dumazet * as we certainly are not changing upper 32bit value (0) 18561d2bcaeSEric Dumazet */ 18661d2bcaeSEric Dumazet tp->bytes_received = skb->len; 187e3e17b77SEric Dumazet 188e3e17b77SEric Dumazet if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) 189e3e17b77SEric Dumazet tcp_fin(sk); 19061d2bcaeSEric Dumazet } 19161d2bcaeSEric Dumazet 1927c85af88SEric Dumazet static struct sock *tcp_fastopen_create_child(struct sock *sk, 1935b7ed089SYuchung Cheng struct sk_buff *skb, 1945b7ed089SYuchung Cheng struct request_sock *req) 1955b7ed089SYuchung Cheng { 19617846376SDave Jones struct tcp_sock *tp; 1975b7ed089SYuchung Cheng struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue; 1985b7ed089SYuchung Cheng struct sock *child; 1995e0724d0SEric Dumazet bool own_req; 2005b7ed089SYuchung Cheng 2015b7ed089SYuchung Cheng req->num_retrans = 0; 2025b7ed089SYuchung Cheng req->num_timeout = 0; 2035b7ed089SYuchung Cheng req->sk = NULL; 2045b7ed089SYuchung Cheng 2055e0724d0SEric Dumazet child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, 2065e0724d0SEric Dumazet NULL, &own_req); 20751456b29SIan Morris if (!child) 2087c85af88SEric Dumazet return NULL; 2095b7ed089SYuchung Cheng 2100536fcc0SEric Dumazet spin_lock(&queue->fastopenq.lock); 2110536fcc0SEric Dumazet queue->fastopenq.qlen++; 2120536fcc0SEric Dumazet spin_unlock(&queue->fastopenq.lock); 2135b7ed089SYuchung Cheng 2145b7ed089SYuchung Cheng /* Initialize the child socket. Have to fix some values to take 2155b7ed089SYuchung Cheng * into account the child is a Fast Open socket and is created 2165b7ed089SYuchung Cheng * only out of the bits carried in the SYN packet. 2175b7ed089SYuchung Cheng */ 2185b7ed089SYuchung Cheng tp = tcp_sk(child); 2195b7ed089SYuchung Cheng 2205b7ed089SYuchung Cheng tp->fastopen_rsk = req; 2219439ce00SEric Dumazet tcp_rsk(req)->tfo_listener = true; 2225b7ed089SYuchung Cheng 2235b7ed089SYuchung Cheng /* RFC1323: The window in SYN & SYN/ACK segments is never 2245b7ed089SYuchung Cheng * scaled. So correct it appropriately. 2255b7ed089SYuchung Cheng */ 2265b7ed089SYuchung Cheng tp->snd_wnd = ntohs(tcp_hdr(skb)->window); 2270dbd7ff3SAlexey Kodanev tp->max_window = tp->snd_wnd; 2285b7ed089SYuchung Cheng 2295b7ed089SYuchung Cheng /* Activate the retrans timer so that SYNACK can be retransmitted. 230ca6fb065SEric Dumazet * The request socket is not added to the ehash 2315b7ed089SYuchung Cheng * because it's been added to the accept queue directly. 2325b7ed089SYuchung Cheng */ 2335b7ed089SYuchung Cheng inet_csk_reset_xmit_timer(child, ICSK_TIME_RETRANS, 2345b7ed089SYuchung Cheng TCP_TIMEOUT_INIT, TCP_RTO_MAX); 2355b7ed089SYuchung Cheng 23641c6d650SReshetova, Elena refcount_set(&req->rsk_refcnt, 2); 2375b7ed089SYuchung Cheng 2385b7ed089SYuchung Cheng /* Now finish processing the fastopen child socket. */ 23927204aaaSWei Wang tcp_init_transfer(child, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB); 2405b7ed089SYuchung Cheng 24161d2bcaeSEric Dumazet tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1; 242ba34e6d9SEric Dumazet 24361d2bcaeSEric Dumazet tcp_fastopen_add_skb(child, skb); 244d654976cSEric Dumazet 24561d2bcaeSEric Dumazet tcp_rsk(req)->rcv_nxt = tp->rcv_nxt; 24628b346cbSNeal Cardwell tp->rcv_wup = tp->rcv_nxt; 2477656d842SEric Dumazet /* tcp_conn_request() is sending the SYNACK, 2487656d842SEric Dumazet * and queues the child into listener accept queue. 2497c85af88SEric Dumazet */ 2507c85af88SEric Dumazet return child; 2515b7ed089SYuchung Cheng } 2525b7ed089SYuchung Cheng 2535b7ed089SYuchung Cheng static bool tcp_fastopen_queue_check(struct sock *sk) 2545b7ed089SYuchung Cheng { 2555b7ed089SYuchung Cheng struct fastopen_queue *fastopenq; 2565b7ed089SYuchung Cheng 2575b7ed089SYuchung Cheng /* Make sure the listener has enabled fastopen, and we don't 2585b7ed089SYuchung Cheng * exceed the max # of pending TFO requests allowed before trying 2595b7ed089SYuchung Cheng * to validating the cookie in order to avoid burning CPU cycles 2605b7ed089SYuchung Cheng * unnecessarily. 2615b7ed089SYuchung Cheng * 2625b7ed089SYuchung Cheng * XXX (TFO) - The implication of checking the max_qlen before 2635b7ed089SYuchung Cheng * processing a cookie request is that clients can't differentiate 2645b7ed089SYuchung Cheng * between qlen overflow causing Fast Open to be disabled 2655b7ed089SYuchung Cheng * temporarily vs a server not supporting Fast Open at all. 2665b7ed089SYuchung Cheng */ 2670536fcc0SEric Dumazet fastopenq = &inet_csk(sk)->icsk_accept_queue.fastopenq; 2680536fcc0SEric Dumazet if (fastopenq->max_qlen == 0) 2695b7ed089SYuchung Cheng return false; 2705b7ed089SYuchung Cheng 2715b7ed089SYuchung Cheng if (fastopenq->qlen >= fastopenq->max_qlen) { 2725b7ed089SYuchung Cheng struct request_sock *req1; 2735b7ed089SYuchung Cheng spin_lock(&fastopenq->lock); 2745b7ed089SYuchung Cheng req1 = fastopenq->rskq_rst_head; 275fa76ce73SEric Dumazet if (!req1 || time_after(req1->rsk_timer.expires, jiffies)) { 27602a1d6e7SEric Dumazet __NET_INC_STATS(sock_net(sk), 2775b7ed089SYuchung Cheng LINUX_MIB_TCPFASTOPENLISTENOVERFLOW); 278c10d9310SEric Dumazet spin_unlock(&fastopenq->lock); 2795b7ed089SYuchung Cheng return false; 2805b7ed089SYuchung Cheng } 2815b7ed089SYuchung Cheng fastopenq->rskq_rst_head = req1->dl_next; 2825b7ed089SYuchung Cheng fastopenq->qlen--; 2835b7ed089SYuchung Cheng spin_unlock(&fastopenq->lock); 28413854e5aSEric Dumazet reqsk_put(req1); 2855b7ed089SYuchung Cheng } 2865b7ed089SYuchung Cheng return true; 2875b7ed089SYuchung Cheng } 2885b7ed089SYuchung Cheng 28989278c9dSYuchung Cheng /* Returns true if we should perform Fast Open on the SYN. The cookie (foc) 29089278c9dSYuchung Cheng * may be updated and return the client in the SYN-ACK later. E.g., Fast Open 29189278c9dSYuchung Cheng * cookie request (foc->len == 0). 29289278c9dSYuchung Cheng */ 2937c85af88SEric Dumazet struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb, 2945b7ed089SYuchung Cheng struct request_sock *req, 29511199369STonghao Zhang struct tcp_fastopen_cookie *foc) 2965b7ed089SYuchung Cheng { 29789278c9dSYuchung Cheng bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1; 298e1cfcbe8SHaishuang Yan int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen; 299e1cfcbe8SHaishuang Yan struct tcp_fastopen_cookie valid_foc = { .len = -1 }; 3007c85af88SEric Dumazet struct sock *child; 3015b7ed089SYuchung Cheng 302531c94a9SYuchung Cheng if (foc->len == 0) /* Client requests a cookie */ 303c10d9310SEric Dumazet NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENCOOKIEREQD); 304531c94a9SYuchung Cheng 305e1cfcbe8SHaishuang Yan if (!((tcp_fastopen & TFO_SERVER_ENABLE) && 30689278c9dSYuchung Cheng (syn_data || foc->len >= 0) && 30789278c9dSYuchung Cheng tcp_fastopen_queue_check(sk))) { 30889278c9dSYuchung Cheng foc->len = -1; 3097c85af88SEric Dumazet return NULL; 3105b7ed089SYuchung Cheng } 31189278c9dSYuchung Cheng 312e1cfcbe8SHaishuang Yan if (syn_data && (tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD)) 31389278c9dSYuchung Cheng goto fastopen; 31489278c9dSYuchung Cheng 315531c94a9SYuchung Cheng if (foc->len >= 0 && /* Client presents or requests a cookie */ 31643713848SHaishuang Yan tcp_fastopen_cookie_gen(sock_net(sk), req, skb, &valid_foc) && 3173a19ce0eSDaniel Lee foc->len == TCP_FASTOPEN_COOKIE_SIZE && 31889278c9dSYuchung Cheng foc->len == valid_foc.len && 31989278c9dSYuchung Cheng !memcmp(foc->val, valid_foc.val, foc->len)) { 320843f4a55SYuchung Cheng /* Cookie is valid. Create a (full) child socket to accept 321843f4a55SYuchung Cheng * the data in SYN before returning a SYN-ACK to ack the 322843f4a55SYuchung Cheng * data. If we fail to create the socket, fall back and 323843f4a55SYuchung Cheng * ack the ISN only but includes the same cookie. 324843f4a55SYuchung Cheng * 325843f4a55SYuchung Cheng * Note: Data-less SYN with valid cookie is allowed to send 326843f4a55SYuchung Cheng * data in SYN_RECV state. 327843f4a55SYuchung Cheng */ 32889278c9dSYuchung Cheng fastopen: 32911199369STonghao Zhang child = tcp_fastopen_create_child(sk, skb, req); 3307c85af88SEric Dumazet if (child) { 33189278c9dSYuchung Cheng foc->len = -1; 332c10d9310SEric Dumazet NET_INC_STATS(sock_net(sk), 333843f4a55SYuchung Cheng LINUX_MIB_TCPFASTOPENPASSIVE); 3347c85af88SEric Dumazet return child; 3355b7ed089SYuchung Cheng } 336c10d9310SEric Dumazet NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENPASSIVEFAIL); 337531c94a9SYuchung Cheng } else if (foc->len > 0) /* Client presents an invalid cookie */ 338c10d9310SEric Dumazet NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENPASSIVEFAIL); 3395b7ed089SYuchung Cheng 3407f9b838bSDaniel Lee valid_foc.exp = foc->exp; 34189278c9dSYuchung Cheng *foc = valid_foc; 3427c85af88SEric Dumazet return NULL; 3435b7ed089SYuchung Cheng } 344065263f4SWei Wang 345065263f4SWei Wang bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss, 346065263f4SWei Wang struct tcp_fastopen_cookie *cookie) 347065263f4SWei Wang { 348065263f4SWei Wang unsigned long last_syn_loss = 0; 349065263f4SWei Wang int syn_loss = 0; 350065263f4SWei Wang 351065263f4SWei Wang tcp_fastopen_cache_get(sk, mss, cookie, &syn_loss, &last_syn_loss); 352065263f4SWei Wang 353065263f4SWei Wang /* Recurring FO SYN losses: no cookie or data in SYN */ 354065263f4SWei Wang if (syn_loss > 1 && 355065263f4SWei Wang time_before(jiffies, last_syn_loss + (60*HZ << syn_loss))) { 356065263f4SWei Wang cookie->len = -1; 357065263f4SWei Wang return false; 358065263f4SWei Wang } 359cf1ef3f0SWei Wang 360cf1ef3f0SWei Wang /* Firewall blackhole issue check */ 361cf1ef3f0SWei Wang if (tcp_fastopen_active_should_disable(sk)) { 362cf1ef3f0SWei Wang cookie->len = -1; 363cf1ef3f0SWei Wang return false; 364cf1ef3f0SWei Wang } 365cf1ef3f0SWei Wang 366e1cfcbe8SHaishuang Yan if (sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE) { 367065263f4SWei Wang cookie->len = -1; 368065263f4SWei Wang return true; 369065263f4SWei Wang } 370065263f4SWei Wang return cookie->len > 0; 371065263f4SWei Wang } 37219f6d3f3SWei Wang 37319f6d3f3SWei Wang /* This function checks if we want to defer sending SYN until the first 37419f6d3f3SWei Wang * write(). We defer under the following conditions: 37519f6d3f3SWei Wang * 1. fastopen_connect sockopt is set 37619f6d3f3SWei Wang * 2. we have a valid cookie 37719f6d3f3SWei Wang * Return value: return true if we want to defer until application writes data 37819f6d3f3SWei Wang * return false if we want to send out SYN immediately 37919f6d3f3SWei Wang */ 38019f6d3f3SWei Wang bool tcp_fastopen_defer_connect(struct sock *sk, int *err) 38119f6d3f3SWei Wang { 38219f6d3f3SWei Wang struct tcp_fastopen_cookie cookie = { .len = 0 }; 38319f6d3f3SWei Wang struct tcp_sock *tp = tcp_sk(sk); 38419f6d3f3SWei Wang u16 mss; 38519f6d3f3SWei Wang 38619f6d3f3SWei Wang if (tp->fastopen_connect && !tp->fastopen_req) { 38719f6d3f3SWei Wang if (tcp_fastopen_cookie_check(sk, &mss, &cookie)) { 38819f6d3f3SWei Wang inet_sk(sk)->defer_connect = 1; 38919f6d3f3SWei Wang return true; 39019f6d3f3SWei Wang } 39119f6d3f3SWei Wang 39219f6d3f3SWei Wang /* Alloc fastopen_req in order for FO option to be included 39319f6d3f3SWei Wang * in SYN 39419f6d3f3SWei Wang */ 39519f6d3f3SWei Wang tp->fastopen_req = kzalloc(sizeof(*tp->fastopen_req), 39619f6d3f3SWei Wang sk->sk_allocation); 39719f6d3f3SWei Wang if (tp->fastopen_req) 39819f6d3f3SWei Wang tp->fastopen_req->cookie = cookie; 39919f6d3f3SWei Wang else 40019f6d3f3SWei Wang *err = -ENOBUFS; 40119f6d3f3SWei Wang } 40219f6d3f3SWei Wang return false; 40319f6d3f3SWei Wang } 40419f6d3f3SWei Wang EXPORT_SYMBOL(tcp_fastopen_defer_connect); 405cf1ef3f0SWei Wang 406cf1ef3f0SWei Wang /* 407cf1ef3f0SWei Wang * The following code block is to deal with middle box issues with TFO: 408cf1ef3f0SWei Wang * Middlebox firewall issues can potentially cause server's data being 409cf1ef3f0SWei Wang * blackholed after a successful 3WHS using TFO. 410cf1ef3f0SWei Wang * The proposed solution is to disable active TFO globally under the 411cf1ef3f0SWei Wang * following circumstances: 412cf1ef3f0SWei Wang * 1. client side TFO socket receives out of order FIN 413cf1ef3f0SWei Wang * 2. client side TFO socket receives out of order RST 414cf1ef3f0SWei Wang * We disable active side TFO globally for 1hr at first. Then if it 415cf1ef3f0SWei Wang * happens again, we disable it for 2h, then 4h, 8h, ... 416cf1ef3f0SWei Wang * And we reset the timeout back to 1hr when we see a successful active 417cf1ef3f0SWei Wang * TFO connection with data exchanges. 418cf1ef3f0SWei Wang */ 419cf1ef3f0SWei Wang 420cf1ef3f0SWei Wang /* Disable active TFO and record current jiffies and 421cf1ef3f0SWei Wang * tfo_active_disable_times 422cf1ef3f0SWei Wang */ 42346c2fa39SWei Wang void tcp_fastopen_active_disable(struct sock *sk) 424cf1ef3f0SWei Wang { 4253733be14SHaishuang Yan struct net *net = sock_net(sk); 426cf1ef3f0SWei Wang 4273733be14SHaishuang Yan atomic_inc(&net->ipv4.tfo_active_disable_times); 4283733be14SHaishuang Yan net->ipv4.tfo_active_disable_stamp = jiffies; 4293733be14SHaishuang Yan NET_INC_STATS(net, LINUX_MIB_TCPFASTOPENBLACKHOLE); 430cf1ef3f0SWei Wang } 431cf1ef3f0SWei Wang 432cf1ef3f0SWei Wang /* Calculate timeout for tfo active disable 433cf1ef3f0SWei Wang * Return true if we are still in the active TFO disable period 434cf1ef3f0SWei Wang * Return false if timeout already expired and we should use active TFO 435cf1ef3f0SWei Wang */ 436cf1ef3f0SWei Wang bool tcp_fastopen_active_should_disable(struct sock *sk) 437cf1ef3f0SWei Wang { 4383733be14SHaishuang Yan unsigned int tfo_bh_timeout = sock_net(sk)->ipv4.sysctl_tcp_fastopen_blackhole_timeout; 4393733be14SHaishuang Yan int tfo_da_times = atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times); 440cf1ef3f0SWei Wang unsigned long timeout; 4413733be14SHaishuang Yan int multiplier; 442cf1ef3f0SWei Wang 443cf1ef3f0SWei Wang if (!tfo_da_times) 444cf1ef3f0SWei Wang return false; 445cf1ef3f0SWei Wang 446cf1ef3f0SWei Wang /* Limit timout to max: 2^6 * initial timeout */ 447cf1ef3f0SWei Wang multiplier = 1 << min(tfo_da_times - 1, 6); 4483733be14SHaishuang Yan timeout = multiplier * tfo_bh_timeout * HZ; 4493733be14SHaishuang Yan if (time_before(jiffies, sock_net(sk)->ipv4.tfo_active_disable_stamp + timeout)) 450cf1ef3f0SWei Wang return true; 451cf1ef3f0SWei Wang 452cf1ef3f0SWei Wang /* Mark check bit so we can check for successful active TFO 453cf1ef3f0SWei Wang * condition and reset tfo_active_disable_times 454cf1ef3f0SWei Wang */ 455cf1ef3f0SWei Wang tcp_sk(sk)->syn_fastopen_ch = 1; 456cf1ef3f0SWei Wang return false; 457cf1ef3f0SWei Wang } 458cf1ef3f0SWei Wang 459cf1ef3f0SWei Wang /* Disable active TFO if FIN is the only packet in the ofo queue 460cf1ef3f0SWei Wang * and no data is received. 461cf1ef3f0SWei Wang * Also check if we can reset tfo_active_disable_times if data is 462cf1ef3f0SWei Wang * received successfully on a marked active TFO sockets opened on 463cf1ef3f0SWei Wang * a non-loopback interface 464cf1ef3f0SWei Wang */ 465cf1ef3f0SWei Wang void tcp_fastopen_active_disable_ofo_check(struct sock *sk) 466cf1ef3f0SWei Wang { 467cf1ef3f0SWei Wang struct tcp_sock *tp = tcp_sk(sk); 468cf1ef3f0SWei Wang struct rb_node *p; 469cf1ef3f0SWei Wang struct sk_buff *skb; 470cf1ef3f0SWei Wang struct dst_entry *dst; 471cf1ef3f0SWei Wang 472cf1ef3f0SWei Wang if (!tp->syn_fastopen) 473cf1ef3f0SWei Wang return; 474cf1ef3f0SWei Wang 475cf1ef3f0SWei Wang if (!tp->data_segs_in) { 476cf1ef3f0SWei Wang p = rb_first(&tp->out_of_order_queue); 477cf1ef3f0SWei Wang if (p && !rb_next(p)) { 478cf1ef3f0SWei Wang skb = rb_entry(p, struct sk_buff, rbnode); 479cf1ef3f0SWei Wang if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) { 48046c2fa39SWei Wang tcp_fastopen_active_disable(sk); 481cf1ef3f0SWei Wang return; 482cf1ef3f0SWei Wang } 483cf1ef3f0SWei Wang } 484cf1ef3f0SWei Wang } else if (tp->syn_fastopen_ch && 4853733be14SHaishuang Yan atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times)) { 486cf1ef3f0SWei Wang dst = sk_dst_get(sk); 487cf1ef3f0SWei Wang if (!(dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK))) 4883733be14SHaishuang Yan atomic_set(&sock_net(sk)->ipv4.tfo_active_disable_times, 0); 489cf1ef3f0SWei Wang dst_release(dst); 490cf1ef3f0SWei Wang } 491cf1ef3f0SWei Wang } 492