1b2441318SGreg Kroah-Hartman // SPDX-License-Identifier: GPL-2.0 2cf80e0e4SHerbert Xu #include <linux/crypto.h> 310467163SJerry Chu #include <linux/err.h> 42100c8d2SYuchung Cheng #include <linux/init.h> 52100c8d2SYuchung Cheng #include <linux/kernel.h> 610467163SJerry Chu #include <linux/list.h> 710467163SJerry Chu #include <linux/tcp.h> 810467163SJerry Chu #include <linux/rcupdate.h> 910467163SJerry Chu #include <linux/rculist.h> 1010467163SJerry Chu #include <net/inetpeer.h> 1110467163SJerry Chu #include <net/tcp.h> 122100c8d2SYuchung Cheng 1343713848SHaishuang Yan void tcp_fastopen_init_key_once(struct net *net) 14222e83d2SHannes Frederic Sowa { 1543713848SHaishuang Yan u8 key[TCP_FASTOPEN_KEY_LENGTH]; 1643713848SHaishuang Yan struct tcp_fastopen_context *ctxt; 1743713848SHaishuang Yan 1843713848SHaishuang Yan rcu_read_lock(); 1943713848SHaishuang Yan ctxt = rcu_dereference(net->ipv4.tcp_fastopen_ctx); 2043713848SHaishuang Yan if (ctxt) { 2143713848SHaishuang Yan rcu_read_unlock(); 2243713848SHaishuang Yan return; 2343713848SHaishuang Yan } 2443713848SHaishuang Yan rcu_read_unlock(); 25222e83d2SHannes Frederic Sowa 26222e83d2SHannes Frederic Sowa /* tcp_fastopen_reset_cipher publishes the new context 27222e83d2SHannes Frederic Sowa * atomically, so we allow this race happening here. 28222e83d2SHannes Frederic Sowa * 29222e83d2SHannes Frederic Sowa * All call sites of tcp_fastopen_cookie_gen also check 30222e83d2SHannes Frederic Sowa * for a valid cookie, so this is an acceptable risk. 31222e83d2SHannes Frederic Sowa */ 3243713848SHaishuang Yan get_random_bytes(key, sizeof(key)); 331fba70e5SYuchung Cheng tcp_fastopen_reset_cipher(net, NULL, key, sizeof(key)); 34222e83d2SHannes Frederic Sowa } 35222e83d2SHannes Frederic Sowa 3610467163SJerry Chu static void tcp_fastopen_ctx_free(struct rcu_head *head) 3710467163SJerry Chu { 3810467163SJerry Chu struct tcp_fastopen_context *ctx = 3910467163SJerry Chu container_of(head, struct tcp_fastopen_context, rcu); 4010467163SJerry Chu crypto_free_cipher(ctx->tfm); 4110467163SJerry Chu kfree(ctx); 4210467163SJerry Chu } 4310467163SJerry Chu 441fba70e5SYuchung Cheng void tcp_fastopen_destroy_cipher(struct sock *sk) 451fba70e5SYuchung Cheng { 461fba70e5SYuchung Cheng struct tcp_fastopen_context *ctx; 471fba70e5SYuchung Cheng 481fba70e5SYuchung Cheng ctx = rcu_dereference_protected( 491fba70e5SYuchung Cheng inet_csk(sk)->icsk_accept_queue.fastopenq.ctx, 1); 501fba70e5SYuchung Cheng if (ctx) 511fba70e5SYuchung Cheng call_rcu(&ctx->rcu, tcp_fastopen_ctx_free); 521fba70e5SYuchung Cheng } 531fba70e5SYuchung Cheng 5443713848SHaishuang Yan void tcp_fastopen_ctx_destroy(struct net *net) 5543713848SHaishuang Yan { 5643713848SHaishuang Yan struct tcp_fastopen_context *ctxt; 5743713848SHaishuang Yan 5843713848SHaishuang Yan spin_lock(&net->ipv4.tcp_fastopen_ctx_lock); 5943713848SHaishuang Yan 6043713848SHaishuang Yan ctxt = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx, 6143713848SHaishuang Yan lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock)); 6243713848SHaishuang Yan rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, NULL); 6343713848SHaishuang Yan spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock); 6443713848SHaishuang Yan 6543713848SHaishuang Yan if (ctxt) 6643713848SHaishuang Yan call_rcu(&ctxt->rcu, tcp_fastopen_ctx_free); 6743713848SHaishuang Yan } 6843713848SHaishuang Yan 691fba70e5SYuchung Cheng int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk, 701fba70e5SYuchung Cheng void *key, unsigned int len) 7110467163SJerry Chu { 7210467163SJerry Chu struct tcp_fastopen_context *ctx, *octx; 731fba70e5SYuchung Cheng struct fastopen_queue *q; 741fba70e5SYuchung Cheng int err; 7510467163SJerry Chu 7610467163SJerry Chu ctx = kmalloc(sizeof(*ctx), GFP_KERNEL); 7710467163SJerry Chu if (!ctx) 7810467163SJerry Chu return -ENOMEM; 7910467163SJerry Chu ctx->tfm = crypto_alloc_cipher("aes", 0, 0); 8010467163SJerry Chu 8110467163SJerry Chu if (IS_ERR(ctx->tfm)) { 8210467163SJerry Chu err = PTR_ERR(ctx->tfm); 8310467163SJerry Chu error: kfree(ctx); 8410467163SJerry Chu pr_err("TCP: TFO aes cipher alloc error: %d\n", err); 8510467163SJerry Chu return err; 8610467163SJerry Chu } 8710467163SJerry Chu err = crypto_cipher_setkey(ctx->tfm, key, len); 8810467163SJerry Chu if (err) { 8910467163SJerry Chu pr_err("TCP: TFO cipher key error: %d\n", err); 9010467163SJerry Chu crypto_free_cipher(ctx->tfm); 9110467163SJerry Chu goto error; 9210467163SJerry Chu } 9310467163SJerry Chu memcpy(ctx->key, key, len); 9410467163SJerry Chu 9510467163SJerry Chu 969eba9353SEric Dumazet spin_lock(&net->ipv4.tcp_fastopen_ctx_lock); 971fba70e5SYuchung Cheng if (sk) { 981fba70e5SYuchung Cheng q = &inet_csk(sk)->icsk_accept_queue.fastopenq; 991fba70e5SYuchung Cheng octx = rcu_dereference_protected(q->ctx, 1009eba9353SEric Dumazet lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock)); 1011fba70e5SYuchung Cheng rcu_assign_pointer(q->ctx, ctx); 1021fba70e5SYuchung Cheng } else { 10343713848SHaishuang Yan octx = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx, 10443713848SHaishuang Yan lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock)); 10543713848SHaishuang Yan rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, ctx); 1061fba70e5SYuchung Cheng } 1079eba9353SEric Dumazet spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock); 10810467163SJerry Chu 10910467163SJerry Chu if (octx) 11010467163SJerry Chu call_rcu(&octx->rcu, tcp_fastopen_ctx_free); 11110467163SJerry Chu return err; 11210467163SJerry Chu } 11310467163SJerry Chu 114483642e5SChristoph Paasch static bool __tcp_fastopen_cookie_gen_cipher(struct request_sock *req, 115483642e5SChristoph Paasch struct sk_buff *syn, 116483642e5SChristoph Paasch struct crypto_cipher *tfm, 117149479d0SYuchung Cheng struct tcp_fastopen_cookie *foc) 11810467163SJerry Chu { 119483642e5SChristoph Paasch if (req->rsk_ops->family == AF_INET) { 120483642e5SChristoph Paasch const struct iphdr *iph = ip_hdr(syn); 121483642e5SChristoph Paasch __be32 path[4] = { iph->saddr, iph->daddr, 0, 0 }; 12210467163SJerry Chu 123483642e5SChristoph Paasch crypto_cipher_encrypt_one(tfm, foc->val, (void *)path); 12410467163SJerry Chu foc->len = TCP_FASTOPEN_COOKIE_SIZE; 125483642e5SChristoph Paasch return true; 12610467163SJerry Chu } 127483642e5SChristoph Paasch 128483642e5SChristoph Paasch #if IS_ENABLED(CONFIG_IPV6) 129483642e5SChristoph Paasch if (req->rsk_ops->family == AF_INET6) { 130483642e5SChristoph Paasch const struct ipv6hdr *ip6h = ipv6_hdr(syn); 131483642e5SChristoph Paasch struct tcp_fastopen_cookie tmp; 132483642e5SChristoph Paasch struct in6_addr *buf; 133483642e5SChristoph Paasch int i; 134483642e5SChristoph Paasch 135483642e5SChristoph Paasch crypto_cipher_encrypt_one(tfm, tmp.val, 136483642e5SChristoph Paasch (void *)&ip6h->saddr); 137483642e5SChristoph Paasch buf = &tmp.addr; 138483642e5SChristoph Paasch for (i = 0; i < 4; i++) 139483642e5SChristoph Paasch buf->s6_addr32[i] ^= ip6h->daddr.s6_addr32[i]; 140483642e5SChristoph Paasch crypto_cipher_encrypt_one(tfm, foc->val, (void *)buf); 141483642e5SChristoph Paasch foc->len = TCP_FASTOPEN_COOKIE_SIZE; 142483642e5SChristoph Paasch return true; 143483642e5SChristoph Paasch } 144483642e5SChristoph Paasch #endif 145483642e5SChristoph Paasch return false; 1463a19ce0eSDaniel Lee } 1473a19ce0eSDaniel Lee 1483a19ce0eSDaniel Lee /* Generate the fastopen cookie by doing aes128 encryption on both 1493a19ce0eSDaniel Lee * the source and destination addresses. Pad 0s for IPv4 or IPv4-mapped-IPv6 1503a19ce0eSDaniel Lee * addresses. For the longer IPv6 addresses use CBC-MAC. 1513a19ce0eSDaniel Lee * 1523a19ce0eSDaniel Lee * XXX (TFO) - refactor when TCP_FASTOPEN_COOKIE_SIZE != AES_BLOCK_SIZE. 1533a19ce0eSDaniel Lee */ 1541fba70e5SYuchung Cheng static bool tcp_fastopen_cookie_gen(struct sock *sk, 15543713848SHaishuang Yan struct request_sock *req, 1563a19ce0eSDaniel Lee struct sk_buff *syn, 1573a19ce0eSDaniel Lee struct tcp_fastopen_cookie *foc) 1583a19ce0eSDaniel Lee { 159483642e5SChristoph Paasch struct tcp_fastopen_context *ctx; 160483642e5SChristoph Paasch bool ok = false; 1613a19ce0eSDaniel Lee 162483642e5SChristoph Paasch rcu_read_lock(); 163483642e5SChristoph Paasch ctx = rcu_dereference(inet_csk(sk)->icsk_accept_queue.fastopenq.ctx); 164483642e5SChristoph Paasch if (!ctx) 165483642e5SChristoph Paasch ctx = rcu_dereference(sock_net(sk)->ipv4.tcp_fastopen_ctx); 166483642e5SChristoph Paasch if (ctx) 167483642e5SChristoph Paasch ok = __tcp_fastopen_cookie_gen_cipher(req, syn, ctx->tfm, foc); 168483642e5SChristoph Paasch rcu_read_unlock(); 169483642e5SChristoph Paasch return ok; 17010467163SJerry Chu } 1715b7ed089SYuchung Cheng 17261d2bcaeSEric Dumazet 17361d2bcaeSEric Dumazet /* If an incoming SYN or SYNACK frame contains a payload and/or FIN, 17461d2bcaeSEric Dumazet * queue this additional data / FIN. 17561d2bcaeSEric Dumazet */ 17661d2bcaeSEric Dumazet void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb) 17761d2bcaeSEric Dumazet { 17861d2bcaeSEric Dumazet struct tcp_sock *tp = tcp_sk(sk); 17961d2bcaeSEric Dumazet 18061d2bcaeSEric Dumazet if (TCP_SKB_CB(skb)->end_seq == tp->rcv_nxt) 18161d2bcaeSEric Dumazet return; 18261d2bcaeSEric Dumazet 18361d2bcaeSEric Dumazet skb = skb_clone(skb, GFP_ATOMIC); 18461d2bcaeSEric Dumazet if (!skb) 18561d2bcaeSEric Dumazet return; 18661d2bcaeSEric Dumazet 18761d2bcaeSEric Dumazet skb_dst_drop(skb); 188a44d6eacSMartin KaFai Lau /* segs_in has been initialized to 1 in tcp_create_openreq_child(). 189a44d6eacSMartin KaFai Lau * Hence, reset segs_in to 0 before calling tcp_segs_in() 190a44d6eacSMartin KaFai Lau * to avoid double counting. Also, tcp_segs_in() expects 191a44d6eacSMartin KaFai Lau * skb->len to include the tcp_hdrlen. Hence, it should 192a44d6eacSMartin KaFai Lau * be called before __skb_pull(). 193a44d6eacSMartin KaFai Lau */ 194a44d6eacSMartin KaFai Lau tp->segs_in = 0; 195a44d6eacSMartin KaFai Lau tcp_segs_in(tp, skb); 19661d2bcaeSEric Dumazet __skb_pull(skb, tcp_hdrlen(skb)); 19776061f63SEric Dumazet sk_forced_mem_schedule(sk, skb->truesize); 19861d2bcaeSEric Dumazet skb_set_owner_r(skb, sk); 19961d2bcaeSEric Dumazet 2009d691539SEric Dumazet TCP_SKB_CB(skb)->seq++; 2019d691539SEric Dumazet TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_SYN; 2029d691539SEric Dumazet 20361d2bcaeSEric Dumazet tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq; 20461d2bcaeSEric Dumazet __skb_queue_tail(&sk->sk_receive_queue, skb); 20561d2bcaeSEric Dumazet tp->syn_data_acked = 1; 20661d2bcaeSEric Dumazet 20761d2bcaeSEric Dumazet /* u64_stats_update_begin(&tp->syncp) not needed here, 20861d2bcaeSEric Dumazet * as we certainly are not changing upper 32bit value (0) 20961d2bcaeSEric Dumazet */ 21061d2bcaeSEric Dumazet tp->bytes_received = skb->len; 211e3e17b77SEric Dumazet 212e3e17b77SEric Dumazet if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) 213e3e17b77SEric Dumazet tcp_fin(sk); 21461d2bcaeSEric Dumazet } 21561d2bcaeSEric Dumazet 2167c85af88SEric Dumazet static struct sock *tcp_fastopen_create_child(struct sock *sk, 2175b7ed089SYuchung Cheng struct sk_buff *skb, 2185b7ed089SYuchung Cheng struct request_sock *req) 2195b7ed089SYuchung Cheng { 22017846376SDave Jones struct tcp_sock *tp; 2215b7ed089SYuchung Cheng struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue; 2225b7ed089SYuchung Cheng struct sock *child; 2235e0724d0SEric Dumazet bool own_req; 2245b7ed089SYuchung Cheng 2255b7ed089SYuchung Cheng req->num_retrans = 0; 2265b7ed089SYuchung Cheng req->num_timeout = 0; 2275b7ed089SYuchung Cheng req->sk = NULL; 2285b7ed089SYuchung Cheng 2295e0724d0SEric Dumazet child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, 2305e0724d0SEric Dumazet NULL, &own_req); 23151456b29SIan Morris if (!child) 2327c85af88SEric Dumazet return NULL; 2335b7ed089SYuchung Cheng 2340536fcc0SEric Dumazet spin_lock(&queue->fastopenq.lock); 2350536fcc0SEric Dumazet queue->fastopenq.qlen++; 2360536fcc0SEric Dumazet spin_unlock(&queue->fastopenq.lock); 2375b7ed089SYuchung Cheng 2385b7ed089SYuchung Cheng /* Initialize the child socket. Have to fix some values to take 2395b7ed089SYuchung Cheng * into account the child is a Fast Open socket and is created 2405b7ed089SYuchung Cheng * only out of the bits carried in the SYN packet. 2415b7ed089SYuchung Cheng */ 2425b7ed089SYuchung Cheng tp = tcp_sk(child); 2435b7ed089SYuchung Cheng 2445b7ed089SYuchung Cheng tp->fastopen_rsk = req; 2459439ce00SEric Dumazet tcp_rsk(req)->tfo_listener = true; 2465b7ed089SYuchung Cheng 2475b7ed089SYuchung Cheng /* RFC1323: The window in SYN & SYN/ACK segments is never 2485b7ed089SYuchung Cheng * scaled. So correct it appropriately. 2495b7ed089SYuchung Cheng */ 2505b7ed089SYuchung Cheng tp->snd_wnd = ntohs(tcp_hdr(skb)->window); 2510dbd7ff3SAlexey Kodanev tp->max_window = tp->snd_wnd; 2525b7ed089SYuchung Cheng 2535b7ed089SYuchung Cheng /* Activate the retrans timer so that SYNACK can be retransmitted. 254ca6fb065SEric Dumazet * The request socket is not added to the ehash 2555b7ed089SYuchung Cheng * because it's been added to the accept queue directly. 2565b7ed089SYuchung Cheng */ 2575b7ed089SYuchung Cheng inet_csk_reset_xmit_timer(child, ICSK_TIME_RETRANS, 2585b7ed089SYuchung Cheng TCP_TIMEOUT_INIT, TCP_RTO_MAX); 2595b7ed089SYuchung Cheng 26041c6d650SReshetova, Elena refcount_set(&req->rsk_refcnt, 2); 2615b7ed089SYuchung Cheng 2625b7ed089SYuchung Cheng /* Now finish processing the fastopen child socket. */ 26327204aaaSWei Wang tcp_init_transfer(child, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB); 2645b7ed089SYuchung Cheng 26561d2bcaeSEric Dumazet tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1; 266ba34e6d9SEric Dumazet 26761d2bcaeSEric Dumazet tcp_fastopen_add_skb(child, skb); 268d654976cSEric Dumazet 26961d2bcaeSEric Dumazet tcp_rsk(req)->rcv_nxt = tp->rcv_nxt; 27028b346cbSNeal Cardwell tp->rcv_wup = tp->rcv_nxt; 2717656d842SEric Dumazet /* tcp_conn_request() is sending the SYNACK, 2727656d842SEric Dumazet * and queues the child into listener accept queue. 2737c85af88SEric Dumazet */ 2747c85af88SEric Dumazet return child; 2755b7ed089SYuchung Cheng } 2765b7ed089SYuchung Cheng 2775b7ed089SYuchung Cheng static bool tcp_fastopen_queue_check(struct sock *sk) 2785b7ed089SYuchung Cheng { 2795b7ed089SYuchung Cheng struct fastopen_queue *fastopenq; 2805b7ed089SYuchung Cheng 2815b7ed089SYuchung Cheng /* Make sure the listener has enabled fastopen, and we don't 2825b7ed089SYuchung Cheng * exceed the max # of pending TFO requests allowed before trying 2835b7ed089SYuchung Cheng * to validating the cookie in order to avoid burning CPU cycles 2845b7ed089SYuchung Cheng * unnecessarily. 2855b7ed089SYuchung Cheng * 2865b7ed089SYuchung Cheng * XXX (TFO) - The implication of checking the max_qlen before 2875b7ed089SYuchung Cheng * processing a cookie request is that clients can't differentiate 2885b7ed089SYuchung Cheng * between qlen overflow causing Fast Open to be disabled 2895b7ed089SYuchung Cheng * temporarily vs a server not supporting Fast Open at all. 2905b7ed089SYuchung Cheng */ 2910536fcc0SEric Dumazet fastopenq = &inet_csk(sk)->icsk_accept_queue.fastopenq; 2920536fcc0SEric Dumazet if (fastopenq->max_qlen == 0) 2935b7ed089SYuchung Cheng return false; 2945b7ed089SYuchung Cheng 2955b7ed089SYuchung Cheng if (fastopenq->qlen >= fastopenq->max_qlen) { 2965b7ed089SYuchung Cheng struct request_sock *req1; 2975b7ed089SYuchung Cheng spin_lock(&fastopenq->lock); 2985b7ed089SYuchung Cheng req1 = fastopenq->rskq_rst_head; 299fa76ce73SEric Dumazet if (!req1 || time_after(req1->rsk_timer.expires, jiffies)) { 30002a1d6e7SEric Dumazet __NET_INC_STATS(sock_net(sk), 3015b7ed089SYuchung Cheng LINUX_MIB_TCPFASTOPENLISTENOVERFLOW); 302c10d9310SEric Dumazet spin_unlock(&fastopenq->lock); 3035b7ed089SYuchung Cheng return false; 3045b7ed089SYuchung Cheng } 3055b7ed089SYuchung Cheng fastopenq->rskq_rst_head = req1->dl_next; 3065b7ed089SYuchung Cheng fastopenq->qlen--; 3075b7ed089SYuchung Cheng spin_unlock(&fastopenq->lock); 30813854e5aSEric Dumazet reqsk_put(req1); 3095b7ed089SYuchung Cheng } 3105b7ed089SYuchung Cheng return true; 3115b7ed089SYuchung Cheng } 3125b7ed089SYuchung Cheng 31371c02379SChristoph Paasch static bool tcp_fastopen_no_cookie(const struct sock *sk, 31471c02379SChristoph Paasch const struct dst_entry *dst, 31571c02379SChristoph Paasch int flag) 31671c02379SChristoph Paasch { 31771c02379SChristoph Paasch return (sock_net(sk)->ipv4.sysctl_tcp_fastopen & flag) || 31871c02379SChristoph Paasch tcp_sk(sk)->fastopen_no_cookie || 31971c02379SChristoph Paasch (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE)); 32071c02379SChristoph Paasch } 32171c02379SChristoph Paasch 32289278c9dSYuchung Cheng /* Returns true if we should perform Fast Open on the SYN. The cookie (foc) 32389278c9dSYuchung Cheng * may be updated and return the client in the SYN-ACK later. E.g., Fast Open 32489278c9dSYuchung Cheng * cookie request (foc->len == 0). 32589278c9dSYuchung Cheng */ 3267c85af88SEric Dumazet struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb, 3275b7ed089SYuchung Cheng struct request_sock *req, 32871c02379SChristoph Paasch struct tcp_fastopen_cookie *foc, 32971c02379SChristoph Paasch const struct dst_entry *dst) 3305b7ed089SYuchung Cheng { 33189278c9dSYuchung Cheng bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1; 332e1cfcbe8SHaishuang Yan int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen; 333e1cfcbe8SHaishuang Yan struct tcp_fastopen_cookie valid_foc = { .len = -1 }; 3347c85af88SEric Dumazet struct sock *child; 3355b7ed089SYuchung Cheng 336531c94a9SYuchung Cheng if (foc->len == 0) /* Client requests a cookie */ 337c10d9310SEric Dumazet NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENCOOKIEREQD); 338531c94a9SYuchung Cheng 339e1cfcbe8SHaishuang Yan if (!((tcp_fastopen & TFO_SERVER_ENABLE) && 34089278c9dSYuchung Cheng (syn_data || foc->len >= 0) && 34189278c9dSYuchung Cheng tcp_fastopen_queue_check(sk))) { 34289278c9dSYuchung Cheng foc->len = -1; 3437c85af88SEric Dumazet return NULL; 3445b7ed089SYuchung Cheng } 34589278c9dSYuchung Cheng 34671c02379SChristoph Paasch if (syn_data && 34771c02379SChristoph Paasch tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD)) 34889278c9dSYuchung Cheng goto fastopen; 34989278c9dSYuchung Cheng 350531c94a9SYuchung Cheng if (foc->len >= 0 && /* Client presents or requests a cookie */ 3511fba70e5SYuchung Cheng tcp_fastopen_cookie_gen(sk, req, skb, &valid_foc) && 3523a19ce0eSDaniel Lee foc->len == TCP_FASTOPEN_COOKIE_SIZE && 35389278c9dSYuchung Cheng foc->len == valid_foc.len && 35489278c9dSYuchung Cheng !memcmp(foc->val, valid_foc.val, foc->len)) { 355843f4a55SYuchung Cheng /* Cookie is valid. Create a (full) child socket to accept 356843f4a55SYuchung Cheng * the data in SYN before returning a SYN-ACK to ack the 357843f4a55SYuchung Cheng * data. If we fail to create the socket, fall back and 358843f4a55SYuchung Cheng * ack the ISN only but includes the same cookie. 359843f4a55SYuchung Cheng * 360843f4a55SYuchung Cheng * Note: Data-less SYN with valid cookie is allowed to send 361843f4a55SYuchung Cheng * data in SYN_RECV state. 362843f4a55SYuchung Cheng */ 36389278c9dSYuchung Cheng fastopen: 36411199369STonghao Zhang child = tcp_fastopen_create_child(sk, skb, req); 3657c85af88SEric Dumazet if (child) { 36689278c9dSYuchung Cheng foc->len = -1; 367c10d9310SEric Dumazet NET_INC_STATS(sock_net(sk), 368843f4a55SYuchung Cheng LINUX_MIB_TCPFASTOPENPASSIVE); 3697c85af88SEric Dumazet return child; 3705b7ed089SYuchung Cheng } 371c10d9310SEric Dumazet NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENPASSIVEFAIL); 372531c94a9SYuchung Cheng } else if (foc->len > 0) /* Client presents an invalid cookie */ 373c10d9310SEric Dumazet NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENPASSIVEFAIL); 3745b7ed089SYuchung Cheng 3757f9b838bSDaniel Lee valid_foc.exp = foc->exp; 37689278c9dSYuchung Cheng *foc = valid_foc; 3777c85af88SEric Dumazet return NULL; 3785b7ed089SYuchung Cheng } 379065263f4SWei Wang 380065263f4SWei Wang bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss, 381065263f4SWei Wang struct tcp_fastopen_cookie *cookie) 382065263f4SWei Wang { 38371c02379SChristoph Paasch const struct dst_entry *dst; 384065263f4SWei Wang 3857268586bSYuchung Cheng tcp_fastopen_cache_get(sk, mss, cookie); 386cf1ef3f0SWei Wang 387cf1ef3f0SWei Wang /* Firewall blackhole issue check */ 388cf1ef3f0SWei Wang if (tcp_fastopen_active_should_disable(sk)) { 389cf1ef3f0SWei Wang cookie->len = -1; 390cf1ef3f0SWei Wang return false; 391cf1ef3f0SWei Wang } 392cf1ef3f0SWei Wang 39371c02379SChristoph Paasch dst = __sk_dst_get(sk); 39471c02379SChristoph Paasch 39571c02379SChristoph Paasch if (tcp_fastopen_no_cookie(sk, dst, TFO_CLIENT_NO_COOKIE)) { 396065263f4SWei Wang cookie->len = -1; 397065263f4SWei Wang return true; 398065263f4SWei Wang } 399065263f4SWei Wang return cookie->len > 0; 400065263f4SWei Wang } 40119f6d3f3SWei Wang 40219f6d3f3SWei Wang /* This function checks if we want to defer sending SYN until the first 40319f6d3f3SWei Wang * write(). We defer under the following conditions: 40419f6d3f3SWei Wang * 1. fastopen_connect sockopt is set 40519f6d3f3SWei Wang * 2. we have a valid cookie 40619f6d3f3SWei Wang * Return value: return true if we want to defer until application writes data 40719f6d3f3SWei Wang * return false if we want to send out SYN immediately 40819f6d3f3SWei Wang */ 40919f6d3f3SWei Wang bool tcp_fastopen_defer_connect(struct sock *sk, int *err) 41019f6d3f3SWei Wang { 41119f6d3f3SWei Wang struct tcp_fastopen_cookie cookie = { .len = 0 }; 41219f6d3f3SWei Wang struct tcp_sock *tp = tcp_sk(sk); 41319f6d3f3SWei Wang u16 mss; 41419f6d3f3SWei Wang 41519f6d3f3SWei Wang if (tp->fastopen_connect && !tp->fastopen_req) { 41619f6d3f3SWei Wang if (tcp_fastopen_cookie_check(sk, &mss, &cookie)) { 41719f6d3f3SWei Wang inet_sk(sk)->defer_connect = 1; 41819f6d3f3SWei Wang return true; 41919f6d3f3SWei Wang } 42019f6d3f3SWei Wang 42119f6d3f3SWei Wang /* Alloc fastopen_req in order for FO option to be included 42219f6d3f3SWei Wang * in SYN 42319f6d3f3SWei Wang */ 42419f6d3f3SWei Wang tp->fastopen_req = kzalloc(sizeof(*tp->fastopen_req), 42519f6d3f3SWei Wang sk->sk_allocation); 42619f6d3f3SWei Wang if (tp->fastopen_req) 42719f6d3f3SWei Wang tp->fastopen_req->cookie = cookie; 42819f6d3f3SWei Wang else 42919f6d3f3SWei Wang *err = -ENOBUFS; 43019f6d3f3SWei Wang } 43119f6d3f3SWei Wang return false; 43219f6d3f3SWei Wang } 43319f6d3f3SWei Wang EXPORT_SYMBOL(tcp_fastopen_defer_connect); 434cf1ef3f0SWei Wang 435cf1ef3f0SWei Wang /* 436cf1ef3f0SWei Wang * The following code block is to deal with middle box issues with TFO: 437cf1ef3f0SWei Wang * Middlebox firewall issues can potentially cause server's data being 438cf1ef3f0SWei Wang * blackholed after a successful 3WHS using TFO. 439cf1ef3f0SWei Wang * The proposed solution is to disable active TFO globally under the 440cf1ef3f0SWei Wang * following circumstances: 441cf1ef3f0SWei Wang * 1. client side TFO socket receives out of order FIN 442cf1ef3f0SWei Wang * 2. client side TFO socket receives out of order RST 4437268586bSYuchung Cheng * 3. client side TFO socket has timed out three times consecutively during 4447268586bSYuchung Cheng * or after handshake 445cf1ef3f0SWei Wang * We disable active side TFO globally for 1hr at first. Then if it 446cf1ef3f0SWei Wang * happens again, we disable it for 2h, then 4h, 8h, ... 447cf1ef3f0SWei Wang * And we reset the timeout back to 1hr when we see a successful active 448cf1ef3f0SWei Wang * TFO connection with data exchanges. 449cf1ef3f0SWei Wang */ 450cf1ef3f0SWei Wang 451cf1ef3f0SWei Wang /* Disable active TFO and record current jiffies and 452cf1ef3f0SWei Wang * tfo_active_disable_times 453cf1ef3f0SWei Wang */ 45446c2fa39SWei Wang void tcp_fastopen_active_disable(struct sock *sk) 455cf1ef3f0SWei Wang { 4563733be14SHaishuang Yan struct net *net = sock_net(sk); 457cf1ef3f0SWei Wang 4583733be14SHaishuang Yan atomic_inc(&net->ipv4.tfo_active_disable_times); 4593733be14SHaishuang Yan net->ipv4.tfo_active_disable_stamp = jiffies; 4603733be14SHaishuang Yan NET_INC_STATS(net, LINUX_MIB_TCPFASTOPENBLACKHOLE); 461cf1ef3f0SWei Wang } 462cf1ef3f0SWei Wang 463cf1ef3f0SWei Wang /* Calculate timeout for tfo active disable 464cf1ef3f0SWei Wang * Return true if we are still in the active TFO disable period 465cf1ef3f0SWei Wang * Return false if timeout already expired and we should use active TFO 466cf1ef3f0SWei Wang */ 467cf1ef3f0SWei Wang bool tcp_fastopen_active_should_disable(struct sock *sk) 468cf1ef3f0SWei Wang { 4693733be14SHaishuang Yan unsigned int tfo_bh_timeout = sock_net(sk)->ipv4.sysctl_tcp_fastopen_blackhole_timeout; 4703733be14SHaishuang Yan int tfo_da_times = atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times); 471cf1ef3f0SWei Wang unsigned long timeout; 4723733be14SHaishuang Yan int multiplier; 473cf1ef3f0SWei Wang 474cf1ef3f0SWei Wang if (!tfo_da_times) 475cf1ef3f0SWei Wang return false; 476cf1ef3f0SWei Wang 477cf1ef3f0SWei Wang /* Limit timout to max: 2^6 * initial timeout */ 478cf1ef3f0SWei Wang multiplier = 1 << min(tfo_da_times - 1, 6); 4793733be14SHaishuang Yan timeout = multiplier * tfo_bh_timeout * HZ; 4803733be14SHaishuang Yan if (time_before(jiffies, sock_net(sk)->ipv4.tfo_active_disable_stamp + timeout)) 481cf1ef3f0SWei Wang return true; 482cf1ef3f0SWei Wang 483cf1ef3f0SWei Wang /* Mark check bit so we can check for successful active TFO 484cf1ef3f0SWei Wang * condition and reset tfo_active_disable_times 485cf1ef3f0SWei Wang */ 486cf1ef3f0SWei Wang tcp_sk(sk)->syn_fastopen_ch = 1; 487cf1ef3f0SWei Wang return false; 488cf1ef3f0SWei Wang } 489cf1ef3f0SWei Wang 490cf1ef3f0SWei Wang /* Disable active TFO if FIN is the only packet in the ofo queue 491cf1ef3f0SWei Wang * and no data is received. 492cf1ef3f0SWei Wang * Also check if we can reset tfo_active_disable_times if data is 493cf1ef3f0SWei Wang * received successfully on a marked active TFO sockets opened on 494cf1ef3f0SWei Wang * a non-loopback interface 495cf1ef3f0SWei Wang */ 496cf1ef3f0SWei Wang void tcp_fastopen_active_disable_ofo_check(struct sock *sk) 497cf1ef3f0SWei Wang { 498cf1ef3f0SWei Wang struct tcp_sock *tp = tcp_sk(sk); 499cf1ef3f0SWei Wang struct dst_entry *dst; 50018a4c0eaSEric Dumazet struct sk_buff *skb; 501cf1ef3f0SWei Wang 502cf1ef3f0SWei Wang if (!tp->syn_fastopen) 503cf1ef3f0SWei Wang return; 504cf1ef3f0SWei Wang 505cf1ef3f0SWei Wang if (!tp->data_segs_in) { 50618a4c0eaSEric Dumazet skb = skb_rb_first(&tp->out_of_order_queue); 50718a4c0eaSEric Dumazet if (skb && !skb_rb_next(skb)) { 508cf1ef3f0SWei Wang if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) { 50946c2fa39SWei Wang tcp_fastopen_active_disable(sk); 510cf1ef3f0SWei Wang return; 511cf1ef3f0SWei Wang } 512cf1ef3f0SWei Wang } 513cf1ef3f0SWei Wang } else if (tp->syn_fastopen_ch && 5143733be14SHaishuang Yan atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times)) { 515cf1ef3f0SWei Wang dst = sk_dst_get(sk); 516cf1ef3f0SWei Wang if (!(dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK))) 5173733be14SHaishuang Yan atomic_set(&sock_net(sk)->ipv4.tfo_active_disable_times, 0); 518cf1ef3f0SWei Wang dst_release(dst); 519cf1ef3f0SWei Wang } 520cf1ef3f0SWei Wang } 5217268586bSYuchung Cheng 5227268586bSYuchung Cheng void tcp_fastopen_active_detect_blackhole(struct sock *sk, bool expired) 5237268586bSYuchung Cheng { 5247268586bSYuchung Cheng u32 timeouts = inet_csk(sk)->icsk_retransmits; 5257268586bSYuchung Cheng struct tcp_sock *tp = tcp_sk(sk); 5267268586bSYuchung Cheng 5277268586bSYuchung Cheng /* Broken middle-boxes may black-hole Fast Open connection during or 5287268586bSYuchung Cheng * even after the handshake. Be extremely conservative and pause 5297268586bSYuchung Cheng * Fast Open globally after hitting the third consecutive timeout or 5307268586bSYuchung Cheng * exceeding the configured timeout limit. 5317268586bSYuchung Cheng */ 5327268586bSYuchung Cheng if ((tp->syn_fastopen || tp->syn_data || tp->syn_data_acked) && 5337268586bSYuchung Cheng (timeouts == 2 || (timeouts < 2 && expired))) { 5347268586bSYuchung Cheng tcp_fastopen_active_disable(sk); 5357268586bSYuchung Cheng NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENACTIVEFAIL); 5367268586bSYuchung Cheng } 5377268586bSYuchung Cheng } 538