1 /* 2 * INET An implementation of the TCP/IP protocol suite for the LINUX 3 * operating system. INET is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * Implementation of the Transmission Control Protocol(TCP). 7 * 8 * IPv4 specific functions 9 * 10 * 11 * code split from: 12 * linux/ipv4/tcp.c 13 * linux/ipv4/tcp_input.c 14 * linux/ipv4/tcp_output.c 15 * 16 * See tcp.c for author information 17 * 18 * This program is free software; you can redistribute it and/or 19 * modify it under the terms of the GNU General Public License 20 * as published by the Free Software Foundation; either version 21 * 2 of the License, or (at your option) any later version. 22 */ 23 24 /* 25 * Changes: 26 * David S. Miller : New socket lookup architecture. 27 * This code is dedicated to John Dyson. 28 * David S. Miller : Change semantics of established hash, 29 * half is devoted to TIME_WAIT sockets 30 * and the rest go in the other half. 31 * Andi Kleen : Add support for syncookies and fixed 32 * some bugs: ip options weren't passed to 33 * the TCP layer, missed a check for an 34 * ACK bit. 35 * Andi Kleen : Implemented fast path mtu discovery. 36 * Fixed many serious bugs in the 37 * request_sock handling and moved 38 * most of it into the af independent code. 39 * Added tail drop and some other bugfixes. 40 * Added new listen semantics. 41 * Mike McLagan : Routing by source 42 * Juan Jose Ciarlante: ip_dynaddr bits 43 * Andi Kleen: various fixes. 44 * Vitaly E. Lavrov : Transparent proxy revived after year 45 * coma. 46 * Andi Kleen : Fix new listen. 47 * Andi Kleen : Fix accept error reporting. 48 * YOSHIFUJI Hideaki @USAGI and: Support IPV6_V6ONLY socket option, which 49 * Alexey Kuznetsov allow both IPv4 and IPv6 sockets to bind 50 * a single port at the same time. 51 */ 52 53 #define pr_fmt(fmt) "TCP: " fmt 54 55 #include <linux/bottom_half.h> 56 #include <linux/types.h> 57 #include <linux/fcntl.h> 58 #include <linux/module.h> 59 #include <linux/random.h> 60 #include <linux/cache.h> 61 #include <linux/jhash.h> 62 #include <linux/init.h> 63 #include <linux/times.h> 64 #include <linux/slab.h> 65 66 #include <net/net_namespace.h> 67 #include <net/icmp.h> 68 #include <net/inet_hashtables.h> 69 #include <net/tcp.h> 70 #include <net/transp_v6.h> 71 #include <net/ipv6.h> 72 #include <net/inet_common.h> 73 #include <net/timewait_sock.h> 74 #include <net/xfrm.h> 75 #include <net/netdma.h> 76 #include <net/secure_seq.h> 77 #include <net/tcp_memcontrol.h> 78 79 #include <linux/inet.h> 80 #include <linux/ipv6.h> 81 #include <linux/stddef.h> 82 #include <linux/proc_fs.h> 83 #include <linux/seq_file.h> 84 85 #include <linux/crypto.h> 86 #include <linux/scatterlist.h> 87 88 int sysctl_tcp_tw_reuse __read_mostly; 89 int sysctl_tcp_low_latency __read_mostly; 90 EXPORT_SYMBOL(sysctl_tcp_low_latency); 91 92 93 #ifdef CONFIG_TCP_MD5SIG 94 static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key, 95 __be32 daddr, __be32 saddr, const struct tcphdr *th); 96 #endif 97 98 struct inet_hashinfo tcp_hashinfo; 99 EXPORT_SYMBOL(tcp_hashinfo); 100 101 static inline __u32 tcp_v4_init_sequence(const struct sk_buff *skb) 102 { 103 return secure_tcp_sequence_number(ip_hdr(skb)->daddr, 104 ip_hdr(skb)->saddr, 105 tcp_hdr(skb)->dest, 106 tcp_hdr(skb)->source); 107 } 108 109 int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp) 110 { 111 const struct tcp_timewait_sock *tcptw = tcp_twsk(sktw); 112 struct tcp_sock *tp = tcp_sk(sk); 113 114 /* With PAWS, it is safe from the viewpoint 115 of data integrity. Even without PAWS it is safe provided sequence 116 spaces do not overlap i.e. at data rates <= 80Mbit/sec. 117 118 Actually, the idea is close to VJ's one, only timestamp cache is 119 held not per host, but per port pair and TW bucket is used as state 120 holder. 121 122 If TW bucket has been already destroyed we fall back to VJ's scheme 123 and use initial timestamp retrieved from peer table. 124 */ 125 if (tcptw->tw_ts_recent_stamp && 126 (twp == NULL || (sysctl_tcp_tw_reuse && 127 get_seconds() - tcptw->tw_ts_recent_stamp > 1))) { 128 tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2; 129 if (tp->write_seq == 0) 130 tp->write_seq = 1; 131 tp->rx_opt.ts_recent = tcptw->tw_ts_recent; 132 tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp; 133 sock_hold(sktw); 134 return 1; 135 } 136 137 return 0; 138 } 139 EXPORT_SYMBOL_GPL(tcp_twsk_unique); 140 141 /* This will initiate an outgoing connection. */ 142 int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) 143 { 144 struct sockaddr_in *usin = (struct sockaddr_in *)uaddr; 145 struct inet_sock *inet = inet_sk(sk); 146 struct tcp_sock *tp = tcp_sk(sk); 147 __be16 orig_sport, orig_dport; 148 __be32 daddr, nexthop; 149 struct flowi4 *fl4; 150 struct rtable *rt; 151 int err; 152 struct ip_options_rcu *inet_opt; 153 154 if (addr_len < sizeof(struct sockaddr_in)) 155 return -EINVAL; 156 157 if (usin->sin_family != AF_INET) 158 return -EAFNOSUPPORT; 159 160 nexthop = daddr = usin->sin_addr.s_addr; 161 inet_opt = rcu_dereference_protected(inet->inet_opt, 162 sock_owned_by_user(sk)); 163 if (inet_opt && inet_opt->opt.srr) { 164 if (!daddr) 165 return -EINVAL; 166 nexthop = inet_opt->opt.faddr; 167 } 168 169 orig_sport = inet->inet_sport; 170 orig_dport = usin->sin_port; 171 fl4 = &inet->cork.fl.u.ip4; 172 rt = ip_route_connect(fl4, nexthop, inet->inet_saddr, 173 RT_CONN_FLAGS(sk), sk->sk_bound_dev_if, 174 IPPROTO_TCP, 175 orig_sport, orig_dport, sk, true); 176 if (IS_ERR(rt)) { 177 err = PTR_ERR(rt); 178 if (err == -ENETUNREACH) 179 IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES); 180 return err; 181 } 182 183 if (rt->rt_flags & (RTCF_MULTICAST | RTCF_BROADCAST)) { 184 ip_rt_put(rt); 185 return -ENETUNREACH; 186 } 187 188 if (!inet_opt || !inet_opt->opt.srr) 189 daddr = fl4->daddr; 190 191 if (!inet->inet_saddr) 192 inet->inet_saddr = fl4->saddr; 193 inet->inet_rcv_saddr = inet->inet_saddr; 194 195 if (tp->rx_opt.ts_recent_stamp && inet->inet_daddr != daddr) { 196 /* Reset inherited state */ 197 tp->rx_opt.ts_recent = 0; 198 tp->rx_opt.ts_recent_stamp = 0; 199 if (likely(!tp->repair)) 200 tp->write_seq = 0; 201 } 202 203 if (tcp_death_row.sysctl_tw_recycle && 204 !tp->rx_opt.ts_recent_stamp && fl4->daddr == daddr) 205 tcp_fetch_timewait_stamp(sk, &rt->dst); 206 207 inet->inet_dport = usin->sin_port; 208 inet->inet_daddr = daddr; 209 210 inet_csk(sk)->icsk_ext_hdr_len = 0; 211 if (inet_opt) 212 inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen; 213 214 tp->rx_opt.mss_clamp = TCP_MSS_DEFAULT; 215 216 /* Socket identity is still unknown (sport may be zero). 217 * However we set state to SYN-SENT and not releasing socket 218 * lock select source port, enter ourselves into the hash tables and 219 * complete initialization after this. 220 */ 221 tcp_set_state(sk, TCP_SYN_SENT); 222 err = inet_hash_connect(&tcp_death_row, sk); 223 if (err) 224 goto failure; 225 226 rt = ip_route_newports(fl4, rt, orig_sport, orig_dport, 227 inet->inet_sport, inet->inet_dport, sk); 228 if (IS_ERR(rt)) { 229 err = PTR_ERR(rt); 230 rt = NULL; 231 goto failure; 232 } 233 /* OK, now commit destination to socket. */ 234 sk->sk_gso_type = SKB_GSO_TCPV4; 235 sk_setup_caps(sk, &rt->dst); 236 237 if (!tp->write_seq && likely(!tp->repair)) 238 tp->write_seq = secure_tcp_sequence_number(inet->inet_saddr, 239 inet->inet_daddr, 240 inet->inet_sport, 241 usin->sin_port); 242 243 inet->inet_id = tp->write_seq ^ jiffies; 244 245 err = tcp_connect(sk); 246 247 rt = NULL; 248 if (err) 249 goto failure; 250 251 return 0; 252 253 failure: 254 /* 255 * This unhashes the socket and releases the local port, 256 * if necessary. 257 */ 258 tcp_set_state(sk, TCP_CLOSE); 259 ip_rt_put(rt); 260 sk->sk_route_caps = 0; 261 inet->inet_dport = 0; 262 return err; 263 } 264 EXPORT_SYMBOL(tcp_v4_connect); 265 266 /* 267 * This routine reacts to ICMP_FRAG_NEEDED mtu indications as defined in RFC1191. 268 * It can be called through tcp_release_cb() if socket was owned by user 269 * at the time tcp_v4_err() was called to handle ICMP message. 270 */ 271 static void tcp_v4_mtu_reduced(struct sock *sk) 272 { 273 struct dst_entry *dst; 274 struct inet_sock *inet = inet_sk(sk); 275 u32 mtu = tcp_sk(sk)->mtu_info; 276 277 dst = inet_csk_update_pmtu(sk, mtu); 278 if (!dst) 279 return; 280 281 /* Something is about to be wrong... Remember soft error 282 * for the case, if this connection will not able to recover. 283 */ 284 if (mtu < dst_mtu(dst) && ip_dont_fragment(sk, dst)) 285 sk->sk_err_soft = EMSGSIZE; 286 287 mtu = dst_mtu(dst); 288 289 if (inet->pmtudisc != IP_PMTUDISC_DONT && 290 inet_csk(sk)->icsk_pmtu_cookie > mtu) { 291 tcp_sync_mss(sk, mtu); 292 293 /* Resend the TCP packet because it's 294 * clear that the old packet has been 295 * dropped. This is the new "fast" path mtu 296 * discovery. 297 */ 298 tcp_simple_retransmit(sk); 299 } /* else let the usual retransmit timer handle it */ 300 } 301 302 static void do_redirect(struct sk_buff *skb, struct sock *sk) 303 { 304 struct dst_entry *dst = __sk_dst_check(sk, 0); 305 306 if (dst) 307 dst->ops->redirect(dst, sk, skb); 308 } 309 310 /* 311 * This routine is called by the ICMP module when it gets some 312 * sort of error condition. If err < 0 then the socket should 313 * be closed and the error returned to the user. If err > 0 314 * it's just the icmp type << 8 | icmp code. After adjustment 315 * header points to the first 8 bytes of the tcp header. We need 316 * to find the appropriate port. 317 * 318 * The locking strategy used here is very "optimistic". When 319 * someone else accesses the socket the ICMP is just dropped 320 * and for some paths there is no check at all. 321 * A more general error queue to queue errors for later handling 322 * is probably better. 323 * 324 */ 325 326 void tcp_v4_err(struct sk_buff *icmp_skb, u32 info) 327 { 328 const struct iphdr *iph = (const struct iphdr *)icmp_skb->data; 329 struct tcphdr *th = (struct tcphdr *)(icmp_skb->data + (iph->ihl << 2)); 330 struct inet_connection_sock *icsk; 331 struct tcp_sock *tp; 332 struct inet_sock *inet; 333 const int type = icmp_hdr(icmp_skb)->type; 334 const int code = icmp_hdr(icmp_skb)->code; 335 struct sock *sk; 336 struct sk_buff *skb; 337 struct request_sock *req; 338 __u32 seq; 339 __u32 remaining; 340 int err; 341 struct net *net = dev_net(icmp_skb->dev); 342 343 if (icmp_skb->len < (iph->ihl << 2) + 8) { 344 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS); 345 return; 346 } 347 348 sk = inet_lookup(net, &tcp_hashinfo, iph->daddr, th->dest, 349 iph->saddr, th->source, inet_iif(icmp_skb)); 350 if (!sk) { 351 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS); 352 return; 353 } 354 if (sk->sk_state == TCP_TIME_WAIT) { 355 inet_twsk_put(inet_twsk(sk)); 356 return; 357 } 358 359 bh_lock_sock(sk); 360 /* If too many ICMPs get dropped on busy 361 * servers this needs to be solved differently. 362 * We do take care of PMTU discovery (RFC1191) special case : 363 * we can receive locally generated ICMP messages while socket is held. 364 */ 365 if (sock_owned_by_user(sk)) { 366 if (!(type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)) 367 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS); 368 } 369 if (sk->sk_state == TCP_CLOSE) 370 goto out; 371 372 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) { 373 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP); 374 goto out; 375 } 376 377 icsk = inet_csk(sk); 378 tp = tcp_sk(sk); 379 req = tp->fastopen_rsk; 380 seq = ntohl(th->seq); 381 if (sk->sk_state != TCP_LISTEN && 382 !between(seq, tp->snd_una, tp->snd_nxt) && 383 (req == NULL || seq != tcp_rsk(req)->snt_isn)) { 384 /* For a Fast Open socket, allow seq to be snt_isn. */ 385 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS); 386 goto out; 387 } 388 389 switch (type) { 390 case ICMP_REDIRECT: 391 do_redirect(icmp_skb, sk); 392 goto out; 393 case ICMP_SOURCE_QUENCH: 394 /* Just silently ignore these. */ 395 goto out; 396 case ICMP_PARAMETERPROB: 397 err = EPROTO; 398 break; 399 case ICMP_DEST_UNREACH: 400 if (code > NR_ICMP_UNREACH) 401 goto out; 402 403 if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */ 404 /* We are not interested in TCP_LISTEN and open_requests 405 * (SYN-ACKs send out by Linux are always <576bytes so 406 * they should go through unfragmented). 407 */ 408 if (sk->sk_state == TCP_LISTEN) 409 goto out; 410 411 tp->mtu_info = info; 412 if (!sock_owned_by_user(sk)) { 413 tcp_v4_mtu_reduced(sk); 414 } else { 415 if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED, &tp->tsq_flags)) 416 sock_hold(sk); 417 } 418 goto out; 419 } 420 421 err = icmp_err_convert[code].errno; 422 /* check if icmp_skb allows revert of backoff 423 * (see draft-zimmermann-tcp-lcd) */ 424 if (code != ICMP_NET_UNREACH && code != ICMP_HOST_UNREACH) 425 break; 426 if (seq != tp->snd_una || !icsk->icsk_retransmits || 427 !icsk->icsk_backoff) 428 break; 429 430 /* XXX (TFO) - revisit the following logic for TFO */ 431 432 if (sock_owned_by_user(sk)) 433 break; 434 435 icsk->icsk_backoff--; 436 inet_csk(sk)->icsk_rto = (tp->srtt ? __tcp_set_rto(tp) : 437 TCP_TIMEOUT_INIT) << icsk->icsk_backoff; 438 tcp_bound_rto(sk); 439 440 skb = tcp_write_queue_head(sk); 441 BUG_ON(!skb); 442 443 remaining = icsk->icsk_rto - min(icsk->icsk_rto, 444 tcp_time_stamp - TCP_SKB_CB(skb)->when); 445 446 if (remaining) { 447 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, 448 remaining, TCP_RTO_MAX); 449 } else { 450 /* RTO revert clocked out retransmission. 451 * Will retransmit now */ 452 tcp_retransmit_timer(sk); 453 } 454 455 break; 456 case ICMP_TIME_EXCEEDED: 457 err = EHOSTUNREACH; 458 break; 459 default: 460 goto out; 461 } 462 463 /* XXX (TFO) - if it's a TFO socket and has been accepted, rather 464 * than following the TCP_SYN_RECV case and closing the socket, 465 * we ignore the ICMP error and keep trying like a fully established 466 * socket. Is this the right thing to do? 467 */ 468 if (req && req->sk == NULL) 469 goto out; 470 471 switch (sk->sk_state) { 472 struct request_sock *req, **prev; 473 case TCP_LISTEN: 474 if (sock_owned_by_user(sk)) 475 goto out; 476 477 req = inet_csk_search_req(sk, &prev, th->dest, 478 iph->daddr, iph->saddr); 479 if (!req) 480 goto out; 481 482 /* ICMPs are not backlogged, hence we cannot get 483 an established socket here. 484 */ 485 WARN_ON(req->sk); 486 487 if (seq != tcp_rsk(req)->snt_isn) { 488 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS); 489 goto out; 490 } 491 492 /* 493 * Still in SYN_RECV, just remove it silently. 494 * There is no good way to pass the error to the newly 495 * created socket, and POSIX does not want network 496 * errors returned from accept(). 497 */ 498 inet_csk_reqsk_queue_drop(sk, req, prev); 499 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS); 500 goto out; 501 502 case TCP_SYN_SENT: 503 case TCP_SYN_RECV: /* Cannot happen. 504 It can f.e. if SYNs crossed, 505 or Fast Open. 506 */ 507 if (!sock_owned_by_user(sk)) { 508 sk->sk_err = err; 509 510 sk->sk_error_report(sk); 511 512 tcp_done(sk); 513 } else { 514 sk->sk_err_soft = err; 515 } 516 goto out; 517 } 518 519 /* If we've already connected we will keep trying 520 * until we time out, or the user gives up. 521 * 522 * rfc1122 4.2.3.9 allows to consider as hard errors 523 * only PROTO_UNREACH and PORT_UNREACH (well, FRAG_FAILED too, 524 * but it is obsoleted by pmtu discovery). 525 * 526 * Note, that in modern internet, where routing is unreliable 527 * and in each dark corner broken firewalls sit, sending random 528 * errors ordered by their masters even this two messages finally lose 529 * their original sense (even Linux sends invalid PORT_UNREACHs) 530 * 531 * Now we are in compliance with RFCs. 532 * --ANK (980905) 533 */ 534 535 inet = inet_sk(sk); 536 if (!sock_owned_by_user(sk) && inet->recverr) { 537 sk->sk_err = err; 538 sk->sk_error_report(sk); 539 } else { /* Only an error on timeout */ 540 sk->sk_err_soft = err; 541 } 542 543 out: 544 bh_unlock_sock(sk); 545 sock_put(sk); 546 } 547 548 static void __tcp_v4_send_check(struct sk_buff *skb, 549 __be32 saddr, __be32 daddr) 550 { 551 struct tcphdr *th = tcp_hdr(skb); 552 553 if (skb->ip_summed == CHECKSUM_PARTIAL) { 554 th->check = ~tcp_v4_check(skb->len, saddr, daddr, 0); 555 skb->csum_start = skb_transport_header(skb) - skb->head; 556 skb->csum_offset = offsetof(struct tcphdr, check); 557 } else { 558 th->check = tcp_v4_check(skb->len, saddr, daddr, 559 csum_partial(th, 560 th->doff << 2, 561 skb->csum)); 562 } 563 } 564 565 /* This routine computes an IPv4 TCP checksum. */ 566 void tcp_v4_send_check(struct sock *sk, struct sk_buff *skb) 567 { 568 const struct inet_sock *inet = inet_sk(sk); 569 570 __tcp_v4_send_check(skb, inet->inet_saddr, inet->inet_daddr); 571 } 572 EXPORT_SYMBOL(tcp_v4_send_check); 573 574 int tcp_v4_gso_send_check(struct sk_buff *skb) 575 { 576 const struct iphdr *iph; 577 struct tcphdr *th; 578 579 if (!pskb_may_pull(skb, sizeof(*th))) 580 return -EINVAL; 581 582 iph = ip_hdr(skb); 583 th = tcp_hdr(skb); 584 585 th->check = 0; 586 skb->ip_summed = CHECKSUM_PARTIAL; 587 __tcp_v4_send_check(skb, iph->saddr, iph->daddr); 588 return 0; 589 } 590 591 /* 592 * This routine will send an RST to the other tcp. 593 * 594 * Someone asks: why I NEVER use socket parameters (TOS, TTL etc.) 595 * for reset. 596 * Answer: if a packet caused RST, it is not for a socket 597 * existing in our system, if it is matched to a socket, 598 * it is just duplicate segment or bug in other side's TCP. 599 * So that we build reply only basing on parameters 600 * arrived with segment. 601 * Exception: precedence violation. We do not implement it in any case. 602 */ 603 604 static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb) 605 { 606 const struct tcphdr *th = tcp_hdr(skb); 607 struct { 608 struct tcphdr th; 609 #ifdef CONFIG_TCP_MD5SIG 610 __be32 opt[(TCPOLEN_MD5SIG_ALIGNED >> 2)]; 611 #endif 612 } rep; 613 struct ip_reply_arg arg; 614 #ifdef CONFIG_TCP_MD5SIG 615 struct tcp_md5sig_key *key; 616 const __u8 *hash_location = NULL; 617 unsigned char newhash[16]; 618 int genhash; 619 struct sock *sk1 = NULL; 620 #endif 621 struct net *net; 622 623 /* Never send a reset in response to a reset. */ 624 if (th->rst) 625 return; 626 627 if (skb_rtable(skb)->rt_type != RTN_LOCAL) 628 return; 629 630 /* Swap the send and the receive. */ 631 memset(&rep, 0, sizeof(rep)); 632 rep.th.dest = th->source; 633 rep.th.source = th->dest; 634 rep.th.doff = sizeof(struct tcphdr) / 4; 635 rep.th.rst = 1; 636 637 if (th->ack) { 638 rep.th.seq = th->ack_seq; 639 } else { 640 rep.th.ack = 1; 641 rep.th.ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin + 642 skb->len - (th->doff << 2)); 643 } 644 645 memset(&arg, 0, sizeof(arg)); 646 arg.iov[0].iov_base = (unsigned char *)&rep; 647 arg.iov[0].iov_len = sizeof(rep.th); 648 649 #ifdef CONFIG_TCP_MD5SIG 650 hash_location = tcp_parse_md5sig_option(th); 651 if (!sk && hash_location) { 652 /* 653 * active side is lost. Try to find listening socket through 654 * source port, and then find md5 key through listening socket. 655 * we are not loose security here: 656 * Incoming packet is checked with md5 hash with finding key, 657 * no RST generated if md5 hash doesn't match. 658 */ 659 sk1 = __inet_lookup_listener(dev_net(skb_dst(skb)->dev), 660 &tcp_hashinfo, ip_hdr(skb)->saddr, 661 th->source, ip_hdr(skb)->daddr, 662 ntohs(th->source), inet_iif(skb)); 663 /* don't send rst if it can't find key */ 664 if (!sk1) 665 return; 666 rcu_read_lock(); 667 key = tcp_md5_do_lookup(sk1, (union tcp_md5_addr *) 668 &ip_hdr(skb)->saddr, AF_INET); 669 if (!key) 670 goto release_sk1; 671 672 genhash = tcp_v4_md5_hash_skb(newhash, key, NULL, NULL, skb); 673 if (genhash || memcmp(hash_location, newhash, 16) != 0) 674 goto release_sk1; 675 } else { 676 key = sk ? tcp_md5_do_lookup(sk, (union tcp_md5_addr *) 677 &ip_hdr(skb)->saddr, 678 AF_INET) : NULL; 679 } 680 681 if (key) { 682 rep.opt[0] = htonl((TCPOPT_NOP << 24) | 683 (TCPOPT_NOP << 16) | 684 (TCPOPT_MD5SIG << 8) | 685 TCPOLEN_MD5SIG); 686 /* Update length and the length the header thinks exists */ 687 arg.iov[0].iov_len += TCPOLEN_MD5SIG_ALIGNED; 688 rep.th.doff = arg.iov[0].iov_len / 4; 689 690 tcp_v4_md5_hash_hdr((__u8 *) &rep.opt[1], 691 key, ip_hdr(skb)->saddr, 692 ip_hdr(skb)->daddr, &rep.th); 693 } 694 #endif 695 arg.csum = csum_tcpudp_nofold(ip_hdr(skb)->daddr, 696 ip_hdr(skb)->saddr, /* XXX */ 697 arg.iov[0].iov_len, IPPROTO_TCP, 0); 698 arg.csumoffset = offsetof(struct tcphdr, check) / 2; 699 arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0; 700 /* When socket is gone, all binding information is lost. 701 * routing might fail in this case. No choice here, if we choose to force 702 * input interface, we will misroute in case of asymmetric route. 703 */ 704 if (sk) 705 arg.bound_dev_if = sk->sk_bound_dev_if; 706 707 net = dev_net(skb_dst(skb)->dev); 708 arg.tos = ip_hdr(skb)->tos; 709 ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr, 710 ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len); 711 712 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS); 713 TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS); 714 715 #ifdef CONFIG_TCP_MD5SIG 716 release_sk1: 717 if (sk1) { 718 rcu_read_unlock(); 719 sock_put(sk1); 720 } 721 #endif 722 } 723 724 /* The code following below sending ACKs in SYN-RECV and TIME-WAIT states 725 outside socket context is ugly, certainly. What can I do? 726 */ 727 728 static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack, 729 u32 win, u32 tsval, u32 tsecr, int oif, 730 struct tcp_md5sig_key *key, 731 int reply_flags, u8 tos) 732 { 733 const struct tcphdr *th = tcp_hdr(skb); 734 struct { 735 struct tcphdr th; 736 __be32 opt[(TCPOLEN_TSTAMP_ALIGNED >> 2) 737 #ifdef CONFIG_TCP_MD5SIG 738 + (TCPOLEN_MD5SIG_ALIGNED >> 2) 739 #endif 740 ]; 741 } rep; 742 struct ip_reply_arg arg; 743 struct net *net = dev_net(skb_dst(skb)->dev); 744 745 memset(&rep.th, 0, sizeof(struct tcphdr)); 746 memset(&arg, 0, sizeof(arg)); 747 748 arg.iov[0].iov_base = (unsigned char *)&rep; 749 arg.iov[0].iov_len = sizeof(rep.th); 750 if (tsecr) { 751 rep.opt[0] = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | 752 (TCPOPT_TIMESTAMP << 8) | 753 TCPOLEN_TIMESTAMP); 754 rep.opt[1] = htonl(tsval); 755 rep.opt[2] = htonl(tsecr); 756 arg.iov[0].iov_len += TCPOLEN_TSTAMP_ALIGNED; 757 } 758 759 /* Swap the send and the receive. */ 760 rep.th.dest = th->source; 761 rep.th.source = th->dest; 762 rep.th.doff = arg.iov[0].iov_len / 4; 763 rep.th.seq = htonl(seq); 764 rep.th.ack_seq = htonl(ack); 765 rep.th.ack = 1; 766 rep.th.window = htons(win); 767 768 #ifdef CONFIG_TCP_MD5SIG 769 if (key) { 770 int offset = (tsecr) ? 3 : 0; 771 772 rep.opt[offset++] = htonl((TCPOPT_NOP << 24) | 773 (TCPOPT_NOP << 16) | 774 (TCPOPT_MD5SIG << 8) | 775 TCPOLEN_MD5SIG); 776 arg.iov[0].iov_len += TCPOLEN_MD5SIG_ALIGNED; 777 rep.th.doff = arg.iov[0].iov_len/4; 778 779 tcp_v4_md5_hash_hdr((__u8 *) &rep.opt[offset], 780 key, ip_hdr(skb)->saddr, 781 ip_hdr(skb)->daddr, &rep.th); 782 } 783 #endif 784 arg.flags = reply_flags; 785 arg.csum = csum_tcpudp_nofold(ip_hdr(skb)->daddr, 786 ip_hdr(skb)->saddr, /* XXX */ 787 arg.iov[0].iov_len, IPPROTO_TCP, 0); 788 arg.csumoffset = offsetof(struct tcphdr, check) / 2; 789 if (oif) 790 arg.bound_dev_if = oif; 791 arg.tos = tos; 792 ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr, 793 ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len); 794 795 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS); 796 } 797 798 static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb) 799 { 800 struct inet_timewait_sock *tw = inet_twsk(sk); 801 struct tcp_timewait_sock *tcptw = tcp_twsk(sk); 802 803 tcp_v4_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt, 804 tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale, 805 tcp_time_stamp + tcptw->tw_ts_offset, 806 tcptw->tw_ts_recent, 807 tw->tw_bound_dev_if, 808 tcp_twsk_md5_key(tcptw), 809 tw->tw_transparent ? IP_REPLY_ARG_NOSRCCHECK : 0, 810 tw->tw_tos 811 ); 812 813 inet_twsk_put(tw); 814 } 815 816 static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb, 817 struct request_sock *req) 818 { 819 /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV 820 * sk->sk_state == TCP_SYN_RECV -> for Fast Open. 821 */ 822 tcp_v4_send_ack(skb, (sk->sk_state == TCP_LISTEN) ? 823 tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt, 824 tcp_rsk(req)->rcv_nxt, req->rcv_wnd, 825 tcp_time_stamp, 826 req->ts_recent, 827 0, 828 tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->daddr, 829 AF_INET), 830 inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0, 831 ip_hdr(skb)->tos); 832 } 833 834 /* 835 * Send a SYN-ACK after having received a SYN. 836 * This still operates on a request_sock only, not on a big 837 * socket. 838 */ 839 static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst, 840 struct request_sock *req, 841 u16 queue_mapping, 842 bool nocache) 843 { 844 const struct inet_request_sock *ireq = inet_rsk(req); 845 struct flowi4 fl4; 846 int err = -1; 847 struct sk_buff * skb; 848 849 /* First, grab a route. */ 850 if (!dst && (dst = inet_csk_route_req(sk, &fl4, req)) == NULL) 851 return -1; 852 853 skb = tcp_make_synack(sk, dst, req, NULL); 854 855 if (skb) { 856 __tcp_v4_send_check(skb, ireq->loc_addr, ireq->rmt_addr); 857 858 skb_set_queue_mapping(skb, queue_mapping); 859 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr, 860 ireq->rmt_addr, 861 ireq->opt); 862 err = net_xmit_eval(err); 863 if (!tcp_rsk(req)->snt_synack && !err) 864 tcp_rsk(req)->snt_synack = tcp_time_stamp; 865 } 866 867 return err; 868 } 869 870 static int tcp_v4_rtx_synack(struct sock *sk, struct request_sock *req) 871 { 872 int res = tcp_v4_send_synack(sk, NULL, req, 0, false); 873 874 if (!res) 875 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS); 876 return res; 877 } 878 879 /* 880 * IPv4 request_sock destructor. 881 */ 882 static void tcp_v4_reqsk_destructor(struct request_sock *req) 883 { 884 kfree(inet_rsk(req)->opt); 885 } 886 887 /* 888 * Return true if a syncookie should be sent 889 */ 890 bool tcp_syn_flood_action(struct sock *sk, 891 const struct sk_buff *skb, 892 const char *proto) 893 { 894 const char *msg = "Dropping request"; 895 bool want_cookie = false; 896 struct listen_sock *lopt; 897 898 899 900 #ifdef CONFIG_SYN_COOKIES 901 if (sysctl_tcp_syncookies) { 902 msg = "Sending cookies"; 903 want_cookie = true; 904 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES); 905 } else 906 #endif 907 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP); 908 909 lopt = inet_csk(sk)->icsk_accept_queue.listen_opt; 910 if (!lopt->synflood_warned) { 911 lopt->synflood_warned = 1; 912 pr_info("%s: Possible SYN flooding on port %d. %s. Check SNMP counters.\n", 913 proto, ntohs(tcp_hdr(skb)->dest), msg); 914 } 915 return want_cookie; 916 } 917 EXPORT_SYMBOL(tcp_syn_flood_action); 918 919 /* 920 * Save and compile IPv4 options into the request_sock if needed. 921 */ 922 static struct ip_options_rcu *tcp_v4_save_options(struct sk_buff *skb) 923 { 924 const struct ip_options *opt = &(IPCB(skb)->opt); 925 struct ip_options_rcu *dopt = NULL; 926 927 if (opt && opt->optlen) { 928 int opt_size = sizeof(*dopt) + opt->optlen; 929 930 dopt = kmalloc(opt_size, GFP_ATOMIC); 931 if (dopt) { 932 if (ip_options_echo(&dopt->opt, skb)) { 933 kfree(dopt); 934 dopt = NULL; 935 } 936 } 937 } 938 return dopt; 939 } 940 941 #ifdef CONFIG_TCP_MD5SIG 942 /* 943 * RFC2385 MD5 checksumming requires a mapping of 944 * IP address->MD5 Key. 945 * We need to maintain these in the sk structure. 946 */ 947 948 /* Find the Key structure for an address. */ 949 struct tcp_md5sig_key *tcp_md5_do_lookup(struct sock *sk, 950 const union tcp_md5_addr *addr, 951 int family) 952 { 953 struct tcp_sock *tp = tcp_sk(sk); 954 struct tcp_md5sig_key *key; 955 unsigned int size = sizeof(struct in_addr); 956 struct tcp_md5sig_info *md5sig; 957 958 /* caller either holds rcu_read_lock() or socket lock */ 959 md5sig = rcu_dereference_check(tp->md5sig_info, 960 sock_owned_by_user(sk) || 961 lockdep_is_held(&sk->sk_lock.slock)); 962 if (!md5sig) 963 return NULL; 964 #if IS_ENABLED(CONFIG_IPV6) 965 if (family == AF_INET6) 966 size = sizeof(struct in6_addr); 967 #endif 968 hlist_for_each_entry_rcu(key, &md5sig->head, node) { 969 if (key->family != family) 970 continue; 971 if (!memcmp(&key->addr, addr, size)) 972 return key; 973 } 974 return NULL; 975 } 976 EXPORT_SYMBOL(tcp_md5_do_lookup); 977 978 struct tcp_md5sig_key *tcp_v4_md5_lookup(struct sock *sk, 979 struct sock *addr_sk) 980 { 981 union tcp_md5_addr *addr; 982 983 addr = (union tcp_md5_addr *)&inet_sk(addr_sk)->inet_daddr; 984 return tcp_md5_do_lookup(sk, addr, AF_INET); 985 } 986 EXPORT_SYMBOL(tcp_v4_md5_lookup); 987 988 static struct tcp_md5sig_key *tcp_v4_reqsk_md5_lookup(struct sock *sk, 989 struct request_sock *req) 990 { 991 union tcp_md5_addr *addr; 992 993 addr = (union tcp_md5_addr *)&inet_rsk(req)->rmt_addr; 994 return tcp_md5_do_lookup(sk, addr, AF_INET); 995 } 996 997 /* This can be called on a newly created socket, from other files */ 998 int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr, 999 int family, const u8 *newkey, u8 newkeylen, gfp_t gfp) 1000 { 1001 /* Add Key to the list */ 1002 struct tcp_md5sig_key *key; 1003 struct tcp_sock *tp = tcp_sk(sk); 1004 struct tcp_md5sig_info *md5sig; 1005 1006 key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&addr, AF_INET); 1007 if (key) { 1008 /* Pre-existing entry - just update that one. */ 1009 memcpy(key->key, newkey, newkeylen); 1010 key->keylen = newkeylen; 1011 return 0; 1012 } 1013 1014 md5sig = rcu_dereference_protected(tp->md5sig_info, 1015 sock_owned_by_user(sk)); 1016 if (!md5sig) { 1017 md5sig = kmalloc(sizeof(*md5sig), gfp); 1018 if (!md5sig) 1019 return -ENOMEM; 1020 1021 sk_nocaps_add(sk, NETIF_F_GSO_MASK); 1022 INIT_HLIST_HEAD(&md5sig->head); 1023 rcu_assign_pointer(tp->md5sig_info, md5sig); 1024 } 1025 1026 key = sock_kmalloc(sk, sizeof(*key), gfp); 1027 if (!key) 1028 return -ENOMEM; 1029 if (hlist_empty(&md5sig->head) && !tcp_alloc_md5sig_pool(sk)) { 1030 sock_kfree_s(sk, key, sizeof(*key)); 1031 return -ENOMEM; 1032 } 1033 1034 memcpy(key->key, newkey, newkeylen); 1035 key->keylen = newkeylen; 1036 key->family = family; 1037 memcpy(&key->addr, addr, 1038 (family == AF_INET6) ? sizeof(struct in6_addr) : 1039 sizeof(struct in_addr)); 1040 hlist_add_head_rcu(&key->node, &md5sig->head); 1041 return 0; 1042 } 1043 EXPORT_SYMBOL(tcp_md5_do_add); 1044 1045 int tcp_md5_do_del(struct sock *sk, const union tcp_md5_addr *addr, int family) 1046 { 1047 struct tcp_sock *tp = tcp_sk(sk); 1048 struct tcp_md5sig_key *key; 1049 struct tcp_md5sig_info *md5sig; 1050 1051 key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&addr, AF_INET); 1052 if (!key) 1053 return -ENOENT; 1054 hlist_del_rcu(&key->node); 1055 atomic_sub(sizeof(*key), &sk->sk_omem_alloc); 1056 kfree_rcu(key, rcu); 1057 md5sig = rcu_dereference_protected(tp->md5sig_info, 1058 sock_owned_by_user(sk)); 1059 if (hlist_empty(&md5sig->head)) 1060 tcp_free_md5sig_pool(); 1061 return 0; 1062 } 1063 EXPORT_SYMBOL(tcp_md5_do_del); 1064 1065 static void tcp_clear_md5_list(struct sock *sk) 1066 { 1067 struct tcp_sock *tp = tcp_sk(sk); 1068 struct tcp_md5sig_key *key; 1069 struct hlist_node *n; 1070 struct tcp_md5sig_info *md5sig; 1071 1072 md5sig = rcu_dereference_protected(tp->md5sig_info, 1); 1073 1074 if (!hlist_empty(&md5sig->head)) 1075 tcp_free_md5sig_pool(); 1076 hlist_for_each_entry_safe(key, n, &md5sig->head, node) { 1077 hlist_del_rcu(&key->node); 1078 atomic_sub(sizeof(*key), &sk->sk_omem_alloc); 1079 kfree_rcu(key, rcu); 1080 } 1081 } 1082 1083 static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval, 1084 int optlen) 1085 { 1086 struct tcp_md5sig cmd; 1087 struct sockaddr_in *sin = (struct sockaddr_in *)&cmd.tcpm_addr; 1088 1089 if (optlen < sizeof(cmd)) 1090 return -EINVAL; 1091 1092 if (copy_from_user(&cmd, optval, sizeof(cmd))) 1093 return -EFAULT; 1094 1095 if (sin->sin_family != AF_INET) 1096 return -EINVAL; 1097 1098 if (!cmd.tcpm_key || !cmd.tcpm_keylen) 1099 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin->sin_addr.s_addr, 1100 AF_INET); 1101 1102 if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN) 1103 return -EINVAL; 1104 1105 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin->sin_addr.s_addr, 1106 AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, 1107 GFP_KERNEL); 1108 } 1109 1110 static int tcp_v4_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp, 1111 __be32 daddr, __be32 saddr, int nbytes) 1112 { 1113 struct tcp4_pseudohdr *bp; 1114 struct scatterlist sg; 1115 1116 bp = &hp->md5_blk.ip4; 1117 1118 /* 1119 * 1. the TCP pseudo-header (in the order: source IP address, 1120 * destination IP address, zero-padded protocol number, and 1121 * segment length) 1122 */ 1123 bp->saddr = saddr; 1124 bp->daddr = daddr; 1125 bp->pad = 0; 1126 bp->protocol = IPPROTO_TCP; 1127 bp->len = cpu_to_be16(nbytes); 1128 1129 sg_init_one(&sg, bp, sizeof(*bp)); 1130 return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp)); 1131 } 1132 1133 static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key, 1134 __be32 daddr, __be32 saddr, const struct tcphdr *th) 1135 { 1136 struct tcp_md5sig_pool *hp; 1137 struct hash_desc *desc; 1138 1139 hp = tcp_get_md5sig_pool(); 1140 if (!hp) 1141 goto clear_hash_noput; 1142 desc = &hp->md5_desc; 1143 1144 if (crypto_hash_init(desc)) 1145 goto clear_hash; 1146 if (tcp_v4_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2)) 1147 goto clear_hash; 1148 if (tcp_md5_hash_header(hp, th)) 1149 goto clear_hash; 1150 if (tcp_md5_hash_key(hp, key)) 1151 goto clear_hash; 1152 if (crypto_hash_final(desc, md5_hash)) 1153 goto clear_hash; 1154 1155 tcp_put_md5sig_pool(); 1156 return 0; 1157 1158 clear_hash: 1159 tcp_put_md5sig_pool(); 1160 clear_hash_noput: 1161 memset(md5_hash, 0, 16); 1162 return 1; 1163 } 1164 1165 int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key, 1166 const struct sock *sk, const struct request_sock *req, 1167 const struct sk_buff *skb) 1168 { 1169 struct tcp_md5sig_pool *hp; 1170 struct hash_desc *desc; 1171 const struct tcphdr *th = tcp_hdr(skb); 1172 __be32 saddr, daddr; 1173 1174 if (sk) { 1175 saddr = inet_sk(sk)->inet_saddr; 1176 daddr = inet_sk(sk)->inet_daddr; 1177 } else if (req) { 1178 saddr = inet_rsk(req)->loc_addr; 1179 daddr = inet_rsk(req)->rmt_addr; 1180 } else { 1181 const struct iphdr *iph = ip_hdr(skb); 1182 saddr = iph->saddr; 1183 daddr = iph->daddr; 1184 } 1185 1186 hp = tcp_get_md5sig_pool(); 1187 if (!hp) 1188 goto clear_hash_noput; 1189 desc = &hp->md5_desc; 1190 1191 if (crypto_hash_init(desc)) 1192 goto clear_hash; 1193 1194 if (tcp_v4_md5_hash_pseudoheader(hp, daddr, saddr, skb->len)) 1195 goto clear_hash; 1196 if (tcp_md5_hash_header(hp, th)) 1197 goto clear_hash; 1198 if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2)) 1199 goto clear_hash; 1200 if (tcp_md5_hash_key(hp, key)) 1201 goto clear_hash; 1202 if (crypto_hash_final(desc, md5_hash)) 1203 goto clear_hash; 1204 1205 tcp_put_md5sig_pool(); 1206 return 0; 1207 1208 clear_hash: 1209 tcp_put_md5sig_pool(); 1210 clear_hash_noput: 1211 memset(md5_hash, 0, 16); 1212 return 1; 1213 } 1214 EXPORT_SYMBOL(tcp_v4_md5_hash_skb); 1215 1216 static bool tcp_v4_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb) 1217 { 1218 /* 1219 * This gets called for each TCP segment that arrives 1220 * so we want to be efficient. 1221 * We have 3 drop cases: 1222 * o No MD5 hash and one expected. 1223 * o MD5 hash and we're not expecting one. 1224 * o MD5 hash and its wrong. 1225 */ 1226 const __u8 *hash_location = NULL; 1227 struct tcp_md5sig_key *hash_expected; 1228 const struct iphdr *iph = ip_hdr(skb); 1229 const struct tcphdr *th = tcp_hdr(skb); 1230 int genhash; 1231 unsigned char newhash[16]; 1232 1233 hash_expected = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&iph->saddr, 1234 AF_INET); 1235 hash_location = tcp_parse_md5sig_option(th); 1236 1237 /* We've parsed the options - do we have a hash? */ 1238 if (!hash_expected && !hash_location) 1239 return false; 1240 1241 if (hash_expected && !hash_location) { 1242 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND); 1243 return true; 1244 } 1245 1246 if (!hash_expected && hash_location) { 1247 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED); 1248 return true; 1249 } 1250 1251 /* Okay, so this is hash_expected and hash_location - 1252 * so we need to calculate the checksum. 1253 */ 1254 genhash = tcp_v4_md5_hash_skb(newhash, 1255 hash_expected, 1256 NULL, NULL, skb); 1257 1258 if (genhash || memcmp(hash_location, newhash, 16) != 0) { 1259 net_info_ratelimited("MD5 Hash failed for (%pI4, %d)->(%pI4, %d)%s\n", 1260 &iph->saddr, ntohs(th->source), 1261 &iph->daddr, ntohs(th->dest), 1262 genhash ? " tcp_v4_calc_md5_hash failed" 1263 : ""); 1264 return true; 1265 } 1266 return false; 1267 } 1268 1269 #endif 1270 1271 struct request_sock_ops tcp_request_sock_ops __read_mostly = { 1272 .family = PF_INET, 1273 .obj_size = sizeof(struct tcp_request_sock), 1274 .rtx_syn_ack = tcp_v4_rtx_synack, 1275 .send_ack = tcp_v4_reqsk_send_ack, 1276 .destructor = tcp_v4_reqsk_destructor, 1277 .send_reset = tcp_v4_send_reset, 1278 .syn_ack_timeout = tcp_syn_ack_timeout, 1279 }; 1280 1281 #ifdef CONFIG_TCP_MD5SIG 1282 static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = { 1283 .md5_lookup = tcp_v4_reqsk_md5_lookup, 1284 .calc_md5_hash = tcp_v4_md5_hash_skb, 1285 }; 1286 #endif 1287 1288 static bool tcp_fastopen_check(struct sock *sk, struct sk_buff *skb, 1289 struct request_sock *req, 1290 struct tcp_fastopen_cookie *foc, 1291 struct tcp_fastopen_cookie *valid_foc) 1292 { 1293 bool skip_cookie = false; 1294 struct fastopen_queue *fastopenq; 1295 1296 if (likely(!fastopen_cookie_present(foc))) { 1297 /* See include/net/tcp.h for the meaning of these knobs */ 1298 if ((sysctl_tcp_fastopen & TFO_SERVER_ALWAYS) || 1299 ((sysctl_tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD) && 1300 (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1))) 1301 skip_cookie = true; /* no cookie to validate */ 1302 else 1303 return false; 1304 } 1305 fastopenq = inet_csk(sk)->icsk_accept_queue.fastopenq; 1306 /* A FO option is present; bump the counter. */ 1307 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPFASTOPENPASSIVE); 1308 1309 /* Make sure the listener has enabled fastopen, and we don't 1310 * exceed the max # of pending TFO requests allowed before trying 1311 * to validating the cookie in order to avoid burning CPU cycles 1312 * unnecessarily. 1313 * 1314 * XXX (TFO) - The implication of checking the max_qlen before 1315 * processing a cookie request is that clients can't differentiate 1316 * between qlen overflow causing Fast Open to be disabled 1317 * temporarily vs a server not supporting Fast Open at all. 1318 */ 1319 if ((sysctl_tcp_fastopen & TFO_SERVER_ENABLE) == 0 || 1320 fastopenq == NULL || fastopenq->max_qlen == 0) 1321 return false; 1322 1323 if (fastopenq->qlen >= fastopenq->max_qlen) { 1324 struct request_sock *req1; 1325 spin_lock(&fastopenq->lock); 1326 req1 = fastopenq->rskq_rst_head; 1327 if ((req1 == NULL) || time_after(req1->expires, jiffies)) { 1328 spin_unlock(&fastopenq->lock); 1329 NET_INC_STATS_BH(sock_net(sk), 1330 LINUX_MIB_TCPFASTOPENLISTENOVERFLOW); 1331 /* Avoid bumping LINUX_MIB_TCPFASTOPENPASSIVEFAIL*/ 1332 foc->len = -1; 1333 return false; 1334 } 1335 fastopenq->rskq_rst_head = req1->dl_next; 1336 fastopenq->qlen--; 1337 spin_unlock(&fastopenq->lock); 1338 reqsk_free(req1); 1339 } 1340 if (skip_cookie) { 1341 tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->end_seq; 1342 return true; 1343 } 1344 if (foc->len == TCP_FASTOPEN_COOKIE_SIZE) { 1345 if ((sysctl_tcp_fastopen & TFO_SERVER_COOKIE_NOT_CHKED) == 0) { 1346 tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc); 1347 if ((valid_foc->len != TCP_FASTOPEN_COOKIE_SIZE) || 1348 memcmp(&foc->val[0], &valid_foc->val[0], 1349 TCP_FASTOPEN_COOKIE_SIZE) != 0) 1350 return false; 1351 valid_foc->len = -1; 1352 } 1353 /* Acknowledge the data received from the peer. */ 1354 tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->end_seq; 1355 return true; 1356 } else if (foc->len == 0) { /* Client requesting a cookie */ 1357 tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc); 1358 NET_INC_STATS_BH(sock_net(sk), 1359 LINUX_MIB_TCPFASTOPENCOOKIEREQD); 1360 } else { 1361 /* Client sent a cookie with wrong size. Treat it 1362 * the same as invalid and return a valid one. 1363 */ 1364 tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc); 1365 } 1366 return false; 1367 } 1368 1369 static int tcp_v4_conn_req_fastopen(struct sock *sk, 1370 struct sk_buff *skb, 1371 struct sk_buff *skb_synack, 1372 struct request_sock *req) 1373 { 1374 struct tcp_sock *tp = tcp_sk(sk); 1375 struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue; 1376 const struct inet_request_sock *ireq = inet_rsk(req); 1377 struct sock *child; 1378 int err; 1379 1380 req->num_retrans = 0; 1381 req->num_timeout = 0; 1382 req->sk = NULL; 1383 1384 child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL); 1385 if (child == NULL) { 1386 NET_INC_STATS_BH(sock_net(sk), 1387 LINUX_MIB_TCPFASTOPENPASSIVEFAIL); 1388 kfree_skb(skb_synack); 1389 return -1; 1390 } 1391 err = ip_build_and_send_pkt(skb_synack, sk, ireq->loc_addr, 1392 ireq->rmt_addr, ireq->opt); 1393 err = net_xmit_eval(err); 1394 if (!err) 1395 tcp_rsk(req)->snt_synack = tcp_time_stamp; 1396 /* XXX (TFO) - is it ok to ignore error and continue? */ 1397 1398 spin_lock(&queue->fastopenq->lock); 1399 queue->fastopenq->qlen++; 1400 spin_unlock(&queue->fastopenq->lock); 1401 1402 /* Initialize the child socket. Have to fix some values to take 1403 * into account the child is a Fast Open socket and is created 1404 * only out of the bits carried in the SYN packet. 1405 */ 1406 tp = tcp_sk(child); 1407 1408 tp->fastopen_rsk = req; 1409 /* Do a hold on the listner sk so that if the listener is being 1410 * closed, the child that has been accepted can live on and still 1411 * access listen_lock. 1412 */ 1413 sock_hold(sk); 1414 tcp_rsk(req)->listener = sk; 1415 1416 /* RFC1323: The window in SYN & SYN/ACK segments is never 1417 * scaled. So correct it appropriately. 1418 */ 1419 tp->snd_wnd = ntohs(tcp_hdr(skb)->window); 1420 1421 /* Activate the retrans timer so that SYNACK can be retransmitted. 1422 * The request socket is not added to the SYN table of the parent 1423 * because it's been added to the accept queue directly. 1424 */ 1425 inet_csk_reset_xmit_timer(child, ICSK_TIME_RETRANS, 1426 TCP_TIMEOUT_INIT, TCP_RTO_MAX); 1427 1428 /* Add the child socket directly into the accept queue */ 1429 inet_csk_reqsk_queue_add(sk, req, child); 1430 1431 /* Now finish processing the fastopen child socket. */ 1432 inet_csk(child)->icsk_af_ops->rebuild_header(child); 1433 tcp_init_congestion_control(child); 1434 tcp_mtup_init(child); 1435 tcp_init_buffer_space(child); 1436 tcp_init_metrics(child); 1437 1438 /* Queue the data carried in the SYN packet. We need to first 1439 * bump skb's refcnt because the caller will attempt to free it. 1440 * 1441 * XXX (TFO) - we honor a zero-payload TFO request for now. 1442 * (Any reason not to?) 1443 */ 1444 if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq + 1) { 1445 /* Don't queue the skb if there is no payload in SYN. 1446 * XXX (TFO) - How about SYN+FIN? 1447 */ 1448 tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq; 1449 } else { 1450 skb = skb_get(skb); 1451 skb_dst_drop(skb); 1452 __skb_pull(skb, tcp_hdr(skb)->doff * 4); 1453 skb_set_owner_r(skb, child); 1454 __skb_queue_tail(&child->sk_receive_queue, skb); 1455 tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq; 1456 tp->syn_data_acked = 1; 1457 } 1458 sk->sk_data_ready(sk, 0); 1459 bh_unlock_sock(child); 1460 sock_put(child); 1461 WARN_ON(req->sk == NULL); 1462 return 0; 1463 } 1464 1465 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb) 1466 { 1467 struct tcp_options_received tmp_opt; 1468 struct request_sock *req; 1469 struct inet_request_sock *ireq; 1470 struct tcp_sock *tp = tcp_sk(sk); 1471 struct dst_entry *dst = NULL; 1472 __be32 saddr = ip_hdr(skb)->saddr; 1473 __be32 daddr = ip_hdr(skb)->daddr; 1474 __u32 isn = TCP_SKB_CB(skb)->when; 1475 bool want_cookie = false; 1476 struct flowi4 fl4; 1477 struct tcp_fastopen_cookie foc = { .len = -1 }; 1478 struct tcp_fastopen_cookie valid_foc = { .len = -1 }; 1479 struct sk_buff *skb_synack; 1480 int do_fastopen; 1481 1482 /* Never answer to SYNs send to broadcast or multicast */ 1483 if (skb_rtable(skb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) 1484 goto drop; 1485 1486 /* TW buckets are converted to open requests without 1487 * limitations, they conserve resources and peer is 1488 * evidently real one. 1489 */ 1490 if (inet_csk_reqsk_queue_is_full(sk) && !isn) { 1491 want_cookie = tcp_syn_flood_action(sk, skb, "TCP"); 1492 if (!want_cookie) 1493 goto drop; 1494 } 1495 1496 /* Accept backlog is full. If we have already queued enough 1497 * of warm entries in syn queue, drop request. It is better than 1498 * clogging syn queue with openreqs with exponentially increasing 1499 * timeout. 1500 */ 1501 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) { 1502 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS); 1503 goto drop; 1504 } 1505 1506 req = inet_reqsk_alloc(&tcp_request_sock_ops); 1507 if (!req) 1508 goto drop; 1509 1510 #ifdef CONFIG_TCP_MD5SIG 1511 tcp_rsk(req)->af_specific = &tcp_request_sock_ipv4_ops; 1512 #endif 1513 1514 tcp_clear_options(&tmp_opt); 1515 tmp_opt.mss_clamp = TCP_MSS_DEFAULT; 1516 tmp_opt.user_mss = tp->rx_opt.user_mss; 1517 tcp_parse_options(skb, &tmp_opt, 0, want_cookie ? NULL : &foc); 1518 1519 if (want_cookie && !tmp_opt.saw_tstamp) 1520 tcp_clear_options(&tmp_opt); 1521 1522 tmp_opt.tstamp_ok = tmp_opt.saw_tstamp; 1523 tcp_openreq_init(req, &tmp_opt, skb); 1524 1525 ireq = inet_rsk(req); 1526 ireq->loc_addr = daddr; 1527 ireq->rmt_addr = saddr; 1528 ireq->no_srccheck = inet_sk(sk)->transparent; 1529 ireq->opt = tcp_v4_save_options(skb); 1530 1531 if (security_inet_conn_request(sk, skb, req)) 1532 goto drop_and_free; 1533 1534 if (!want_cookie || tmp_opt.tstamp_ok) 1535 TCP_ECN_create_request(req, skb, sock_net(sk)); 1536 1537 if (want_cookie) { 1538 isn = cookie_v4_init_sequence(sk, skb, &req->mss); 1539 req->cookie_ts = tmp_opt.tstamp_ok; 1540 } else if (!isn) { 1541 /* VJ's idea. We save last timestamp seen 1542 * from the destination in peer table, when entering 1543 * state TIME-WAIT, and check against it before 1544 * accepting new connection request. 1545 * 1546 * If "isn" is not zero, this request hit alive 1547 * timewait bucket, so that all the necessary checks 1548 * are made in the function processing timewait state. 1549 */ 1550 if (tmp_opt.saw_tstamp && 1551 tcp_death_row.sysctl_tw_recycle && 1552 (dst = inet_csk_route_req(sk, &fl4, req)) != NULL && 1553 fl4.daddr == saddr) { 1554 if (!tcp_peer_is_proven(req, dst, true)) { 1555 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED); 1556 goto drop_and_release; 1557 } 1558 } 1559 /* Kill the following clause, if you dislike this way. */ 1560 else if (!sysctl_tcp_syncookies && 1561 (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) < 1562 (sysctl_max_syn_backlog >> 2)) && 1563 !tcp_peer_is_proven(req, dst, false)) { 1564 /* Without syncookies last quarter of 1565 * backlog is filled with destinations, 1566 * proven to be alive. 1567 * It means that we continue to communicate 1568 * to destinations, already remembered 1569 * to the moment of synflood. 1570 */ 1571 LIMIT_NETDEBUG(KERN_DEBUG pr_fmt("drop open request from %pI4/%u\n"), 1572 &saddr, ntohs(tcp_hdr(skb)->source)); 1573 goto drop_and_release; 1574 } 1575 1576 isn = tcp_v4_init_sequence(skb); 1577 } 1578 tcp_rsk(req)->snt_isn = isn; 1579 1580 if (dst == NULL) { 1581 dst = inet_csk_route_req(sk, &fl4, req); 1582 if (dst == NULL) 1583 goto drop_and_free; 1584 } 1585 do_fastopen = tcp_fastopen_check(sk, skb, req, &foc, &valid_foc); 1586 1587 /* We don't call tcp_v4_send_synack() directly because we need 1588 * to make sure a child socket can be created successfully before 1589 * sending back synack! 1590 * 1591 * XXX (TFO) - Ideally one would simply call tcp_v4_send_synack() 1592 * (or better yet, call tcp_send_synack() in the child context 1593 * directly, but will have to fix bunch of other code first) 1594 * after syn_recv_sock() except one will need to first fix the 1595 * latter to remove its dependency on the current implementation 1596 * of tcp_v4_send_synack()->tcp_select_initial_window(). 1597 */ 1598 skb_synack = tcp_make_synack(sk, dst, req, 1599 fastopen_cookie_present(&valid_foc) ? &valid_foc : NULL); 1600 1601 if (skb_synack) { 1602 __tcp_v4_send_check(skb_synack, ireq->loc_addr, ireq->rmt_addr); 1603 skb_set_queue_mapping(skb_synack, skb_get_queue_mapping(skb)); 1604 } else 1605 goto drop_and_free; 1606 1607 if (likely(!do_fastopen)) { 1608 int err; 1609 err = ip_build_and_send_pkt(skb_synack, sk, ireq->loc_addr, 1610 ireq->rmt_addr, ireq->opt); 1611 err = net_xmit_eval(err); 1612 if (err || want_cookie) 1613 goto drop_and_free; 1614 1615 tcp_rsk(req)->snt_synack = tcp_time_stamp; 1616 tcp_rsk(req)->listener = NULL; 1617 /* Add the request_sock to the SYN table */ 1618 inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT); 1619 if (fastopen_cookie_present(&foc) && foc.len != 0) 1620 NET_INC_STATS_BH(sock_net(sk), 1621 LINUX_MIB_TCPFASTOPENPASSIVEFAIL); 1622 } else if (tcp_v4_conn_req_fastopen(sk, skb, skb_synack, req)) 1623 goto drop_and_free; 1624 1625 return 0; 1626 1627 drop_and_release: 1628 dst_release(dst); 1629 drop_and_free: 1630 reqsk_free(req); 1631 drop: 1632 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS); 1633 return 0; 1634 } 1635 EXPORT_SYMBOL(tcp_v4_conn_request); 1636 1637 1638 /* 1639 * The three way handshake has completed - we got a valid synack - 1640 * now create the new socket. 1641 */ 1642 struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb, 1643 struct request_sock *req, 1644 struct dst_entry *dst) 1645 { 1646 struct inet_request_sock *ireq; 1647 struct inet_sock *newinet; 1648 struct tcp_sock *newtp; 1649 struct sock *newsk; 1650 #ifdef CONFIG_TCP_MD5SIG 1651 struct tcp_md5sig_key *key; 1652 #endif 1653 struct ip_options_rcu *inet_opt; 1654 1655 if (sk_acceptq_is_full(sk)) 1656 goto exit_overflow; 1657 1658 newsk = tcp_create_openreq_child(sk, req, skb); 1659 if (!newsk) 1660 goto exit_nonewsk; 1661 1662 newsk->sk_gso_type = SKB_GSO_TCPV4; 1663 inet_sk_rx_dst_set(newsk, skb); 1664 1665 newtp = tcp_sk(newsk); 1666 newinet = inet_sk(newsk); 1667 ireq = inet_rsk(req); 1668 newinet->inet_daddr = ireq->rmt_addr; 1669 newinet->inet_rcv_saddr = ireq->loc_addr; 1670 newinet->inet_saddr = ireq->loc_addr; 1671 inet_opt = ireq->opt; 1672 rcu_assign_pointer(newinet->inet_opt, inet_opt); 1673 ireq->opt = NULL; 1674 newinet->mc_index = inet_iif(skb); 1675 newinet->mc_ttl = ip_hdr(skb)->ttl; 1676 newinet->rcv_tos = ip_hdr(skb)->tos; 1677 inet_csk(newsk)->icsk_ext_hdr_len = 0; 1678 if (inet_opt) 1679 inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen; 1680 newinet->inet_id = newtp->write_seq ^ jiffies; 1681 1682 if (!dst) { 1683 dst = inet_csk_route_child_sock(sk, newsk, req); 1684 if (!dst) 1685 goto put_and_exit; 1686 } else { 1687 /* syncookie case : see end of cookie_v4_check() */ 1688 } 1689 sk_setup_caps(newsk, dst); 1690 1691 tcp_mtup_init(newsk); 1692 tcp_sync_mss(newsk, dst_mtu(dst)); 1693 newtp->advmss = dst_metric_advmss(dst); 1694 if (tcp_sk(sk)->rx_opt.user_mss && 1695 tcp_sk(sk)->rx_opt.user_mss < newtp->advmss) 1696 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss; 1697 1698 tcp_initialize_rcv_mss(newsk); 1699 tcp_synack_rtt_meas(newsk, req); 1700 newtp->total_retrans = req->num_retrans; 1701 1702 #ifdef CONFIG_TCP_MD5SIG 1703 /* Copy over the MD5 key from the original socket */ 1704 key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&newinet->inet_daddr, 1705 AF_INET); 1706 if (key != NULL) { 1707 /* 1708 * We're using one, so create a matching key 1709 * on the newsk structure. If we fail to get 1710 * memory, then we end up not copying the key 1711 * across. Shucks. 1712 */ 1713 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newinet->inet_daddr, 1714 AF_INET, key->key, key->keylen, GFP_ATOMIC); 1715 sk_nocaps_add(newsk, NETIF_F_GSO_MASK); 1716 } 1717 #endif 1718 1719 if (__inet_inherit_port(sk, newsk) < 0) 1720 goto put_and_exit; 1721 __inet_hash_nolisten(newsk, NULL); 1722 1723 return newsk; 1724 1725 exit_overflow: 1726 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS); 1727 exit_nonewsk: 1728 dst_release(dst); 1729 exit: 1730 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS); 1731 return NULL; 1732 put_and_exit: 1733 inet_csk_prepare_forced_close(newsk); 1734 tcp_done(newsk); 1735 goto exit; 1736 } 1737 EXPORT_SYMBOL(tcp_v4_syn_recv_sock); 1738 1739 static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb) 1740 { 1741 struct tcphdr *th = tcp_hdr(skb); 1742 const struct iphdr *iph = ip_hdr(skb); 1743 struct sock *nsk; 1744 struct request_sock **prev; 1745 /* Find possible connection requests. */ 1746 struct request_sock *req = inet_csk_search_req(sk, &prev, th->source, 1747 iph->saddr, iph->daddr); 1748 if (req) 1749 return tcp_check_req(sk, skb, req, prev, false); 1750 1751 nsk = inet_lookup_established(sock_net(sk), &tcp_hashinfo, iph->saddr, 1752 th->source, iph->daddr, th->dest, inet_iif(skb)); 1753 1754 if (nsk) { 1755 if (nsk->sk_state != TCP_TIME_WAIT) { 1756 bh_lock_sock(nsk); 1757 return nsk; 1758 } 1759 inet_twsk_put(inet_twsk(nsk)); 1760 return NULL; 1761 } 1762 1763 #ifdef CONFIG_SYN_COOKIES 1764 if (!th->syn) 1765 sk = cookie_v4_check(sk, skb, &(IPCB(skb)->opt)); 1766 #endif 1767 return sk; 1768 } 1769 1770 static __sum16 tcp_v4_checksum_init(struct sk_buff *skb) 1771 { 1772 const struct iphdr *iph = ip_hdr(skb); 1773 1774 if (skb->ip_summed == CHECKSUM_COMPLETE) { 1775 if (!tcp_v4_check(skb->len, iph->saddr, 1776 iph->daddr, skb->csum)) { 1777 skb->ip_summed = CHECKSUM_UNNECESSARY; 1778 return 0; 1779 } 1780 } 1781 1782 skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, 1783 skb->len, IPPROTO_TCP, 0); 1784 1785 if (skb->len <= 76) { 1786 return __skb_checksum_complete(skb); 1787 } 1788 return 0; 1789 } 1790 1791 1792 /* The socket must have it's spinlock held when we get 1793 * here. 1794 * 1795 * We have a potential double-lock case here, so even when 1796 * doing backlog processing we use the BH locking scheme. 1797 * This is because we cannot sleep with the original spinlock 1798 * held. 1799 */ 1800 int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) 1801 { 1802 struct sock *rsk; 1803 #ifdef CONFIG_TCP_MD5SIG 1804 /* 1805 * We really want to reject the packet as early as possible 1806 * if: 1807 * o We're expecting an MD5'd packet and this is no MD5 tcp option 1808 * o There is an MD5 option and we're not expecting one 1809 */ 1810 if (tcp_v4_inbound_md5_hash(sk, skb)) 1811 goto discard; 1812 #endif 1813 1814 if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */ 1815 struct dst_entry *dst = sk->sk_rx_dst; 1816 1817 sock_rps_save_rxhash(sk, skb); 1818 if (dst) { 1819 if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif || 1820 dst->ops->check(dst, 0) == NULL) { 1821 dst_release(dst); 1822 sk->sk_rx_dst = NULL; 1823 } 1824 } 1825 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) { 1826 rsk = sk; 1827 goto reset; 1828 } 1829 return 0; 1830 } 1831 1832 if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb)) 1833 goto csum_err; 1834 1835 if (sk->sk_state == TCP_LISTEN) { 1836 struct sock *nsk = tcp_v4_hnd_req(sk, skb); 1837 if (!nsk) 1838 goto discard; 1839 1840 if (nsk != sk) { 1841 sock_rps_save_rxhash(nsk, skb); 1842 if (tcp_child_process(sk, nsk, skb)) { 1843 rsk = nsk; 1844 goto reset; 1845 } 1846 return 0; 1847 } 1848 } else 1849 sock_rps_save_rxhash(sk, skb); 1850 1851 if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len)) { 1852 rsk = sk; 1853 goto reset; 1854 } 1855 return 0; 1856 1857 reset: 1858 tcp_v4_send_reset(rsk, skb); 1859 discard: 1860 kfree_skb(skb); 1861 /* Be careful here. If this function gets more complicated and 1862 * gcc suffers from register pressure on the x86, sk (in %ebx) 1863 * might be destroyed here. This current version compiles correctly, 1864 * but you have been warned. 1865 */ 1866 return 0; 1867 1868 csum_err: 1869 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS); 1870 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS); 1871 goto discard; 1872 } 1873 EXPORT_SYMBOL(tcp_v4_do_rcv); 1874 1875 void tcp_v4_early_demux(struct sk_buff *skb) 1876 { 1877 const struct iphdr *iph; 1878 const struct tcphdr *th; 1879 struct sock *sk; 1880 1881 if (skb->pkt_type != PACKET_HOST) 1882 return; 1883 1884 if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr))) 1885 return; 1886 1887 iph = ip_hdr(skb); 1888 th = tcp_hdr(skb); 1889 1890 if (th->doff < sizeof(struct tcphdr) / 4) 1891 return; 1892 1893 sk = __inet_lookup_established(dev_net(skb->dev), &tcp_hashinfo, 1894 iph->saddr, th->source, 1895 iph->daddr, ntohs(th->dest), 1896 skb->skb_iif); 1897 if (sk) { 1898 skb->sk = sk; 1899 skb->destructor = sock_edemux; 1900 if (sk->sk_state != TCP_TIME_WAIT) { 1901 struct dst_entry *dst = sk->sk_rx_dst; 1902 1903 if (dst) 1904 dst = dst_check(dst, 0); 1905 if (dst && 1906 inet_sk(sk)->rx_dst_ifindex == skb->skb_iif) 1907 skb_dst_set_noref(skb, dst); 1908 } 1909 } 1910 } 1911 1912 /* Packet is added to VJ-style prequeue for processing in process 1913 * context, if a reader task is waiting. Apparently, this exciting 1914 * idea (VJ's mail "Re: query about TCP header on tcp-ip" of 07 Sep 93) 1915 * failed somewhere. Latency? Burstiness? Well, at least now we will 1916 * see, why it failed. 8)8) --ANK 1917 * 1918 */ 1919 bool tcp_prequeue(struct sock *sk, struct sk_buff *skb) 1920 { 1921 struct tcp_sock *tp = tcp_sk(sk); 1922 1923 if (sysctl_tcp_low_latency || !tp->ucopy.task) 1924 return false; 1925 1926 if (skb->len <= tcp_hdrlen(skb) && 1927 skb_queue_len(&tp->ucopy.prequeue) == 0) 1928 return false; 1929 1930 skb_dst_force(skb); 1931 __skb_queue_tail(&tp->ucopy.prequeue, skb); 1932 tp->ucopy.memory += skb->truesize; 1933 if (tp->ucopy.memory > sk->sk_rcvbuf) { 1934 struct sk_buff *skb1; 1935 1936 BUG_ON(sock_owned_by_user(sk)); 1937 1938 while ((skb1 = __skb_dequeue(&tp->ucopy.prequeue)) != NULL) { 1939 sk_backlog_rcv(sk, skb1); 1940 NET_INC_STATS_BH(sock_net(sk), 1941 LINUX_MIB_TCPPREQUEUEDROPPED); 1942 } 1943 1944 tp->ucopy.memory = 0; 1945 } else if (skb_queue_len(&tp->ucopy.prequeue) == 1) { 1946 wake_up_interruptible_sync_poll(sk_sleep(sk), 1947 POLLIN | POLLRDNORM | POLLRDBAND); 1948 if (!inet_csk_ack_scheduled(sk)) 1949 inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK, 1950 (3 * tcp_rto_min(sk)) / 4, 1951 TCP_RTO_MAX); 1952 } 1953 return true; 1954 } 1955 EXPORT_SYMBOL(tcp_prequeue); 1956 1957 /* 1958 * From tcp_input.c 1959 */ 1960 1961 int tcp_v4_rcv(struct sk_buff *skb) 1962 { 1963 const struct iphdr *iph; 1964 const struct tcphdr *th; 1965 struct sock *sk; 1966 int ret; 1967 struct net *net = dev_net(skb->dev); 1968 1969 if (skb->pkt_type != PACKET_HOST) 1970 goto discard_it; 1971 1972 /* Count it even if it's bad */ 1973 TCP_INC_STATS_BH(net, TCP_MIB_INSEGS); 1974 1975 if (!pskb_may_pull(skb, sizeof(struct tcphdr))) 1976 goto discard_it; 1977 1978 th = tcp_hdr(skb); 1979 1980 if (th->doff < sizeof(struct tcphdr) / 4) 1981 goto bad_packet; 1982 if (!pskb_may_pull(skb, th->doff * 4)) 1983 goto discard_it; 1984 1985 /* An explanation is required here, I think. 1986 * Packet length and doff are validated by header prediction, 1987 * provided case of th->doff==0 is eliminated. 1988 * So, we defer the checks. */ 1989 if (!skb_csum_unnecessary(skb) && tcp_v4_checksum_init(skb)) 1990 goto csum_error; 1991 1992 th = tcp_hdr(skb); 1993 iph = ip_hdr(skb); 1994 TCP_SKB_CB(skb)->seq = ntohl(th->seq); 1995 TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin + 1996 skb->len - th->doff * 4); 1997 TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq); 1998 TCP_SKB_CB(skb)->when = 0; 1999 TCP_SKB_CB(skb)->ip_dsfield = ipv4_get_dsfield(iph); 2000 TCP_SKB_CB(skb)->sacked = 0; 2001 2002 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest); 2003 if (!sk) 2004 goto no_tcp_socket; 2005 2006 process: 2007 if (sk->sk_state == TCP_TIME_WAIT) 2008 goto do_time_wait; 2009 2010 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) { 2011 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP); 2012 goto discard_and_relse; 2013 } 2014 2015 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) 2016 goto discard_and_relse; 2017 nf_reset(skb); 2018 2019 if (sk_filter(sk, skb)) 2020 goto discard_and_relse; 2021 2022 skb->dev = NULL; 2023 2024 bh_lock_sock_nested(sk); 2025 ret = 0; 2026 if (!sock_owned_by_user(sk)) { 2027 #ifdef CONFIG_NET_DMA 2028 struct tcp_sock *tp = tcp_sk(sk); 2029 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list) 2030 tp->ucopy.dma_chan = net_dma_find_channel(); 2031 if (tp->ucopy.dma_chan) 2032 ret = tcp_v4_do_rcv(sk, skb); 2033 else 2034 #endif 2035 { 2036 if (!tcp_prequeue(sk, skb)) 2037 ret = tcp_v4_do_rcv(sk, skb); 2038 } 2039 } else if (unlikely(sk_add_backlog(sk, skb, 2040 sk->sk_rcvbuf + sk->sk_sndbuf))) { 2041 bh_unlock_sock(sk); 2042 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP); 2043 goto discard_and_relse; 2044 } 2045 bh_unlock_sock(sk); 2046 2047 sock_put(sk); 2048 2049 return ret; 2050 2051 no_tcp_socket: 2052 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) 2053 goto discard_it; 2054 2055 if (skb->len < (th->doff << 2) || tcp_checksum_complete(skb)) { 2056 csum_error: 2057 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS); 2058 bad_packet: 2059 TCP_INC_STATS_BH(net, TCP_MIB_INERRS); 2060 } else { 2061 tcp_v4_send_reset(NULL, skb); 2062 } 2063 2064 discard_it: 2065 /* Discard frame. */ 2066 kfree_skb(skb); 2067 return 0; 2068 2069 discard_and_relse: 2070 sock_put(sk); 2071 goto discard_it; 2072 2073 do_time_wait: 2074 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) { 2075 inet_twsk_put(inet_twsk(sk)); 2076 goto discard_it; 2077 } 2078 2079 if (skb->len < (th->doff << 2)) { 2080 inet_twsk_put(inet_twsk(sk)); 2081 goto bad_packet; 2082 } 2083 if (tcp_checksum_complete(skb)) { 2084 inet_twsk_put(inet_twsk(sk)); 2085 goto csum_error; 2086 } 2087 switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) { 2088 case TCP_TW_SYN: { 2089 struct sock *sk2 = inet_lookup_listener(dev_net(skb->dev), 2090 &tcp_hashinfo, 2091 iph->saddr, th->source, 2092 iph->daddr, th->dest, 2093 inet_iif(skb)); 2094 if (sk2) { 2095 inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row); 2096 inet_twsk_put(inet_twsk(sk)); 2097 sk = sk2; 2098 goto process; 2099 } 2100 /* Fall through to ACK */ 2101 } 2102 case TCP_TW_ACK: 2103 tcp_v4_timewait_ack(sk, skb); 2104 break; 2105 case TCP_TW_RST: 2106 goto no_tcp_socket; 2107 case TCP_TW_SUCCESS:; 2108 } 2109 goto discard_it; 2110 } 2111 2112 static struct timewait_sock_ops tcp_timewait_sock_ops = { 2113 .twsk_obj_size = sizeof(struct tcp_timewait_sock), 2114 .twsk_unique = tcp_twsk_unique, 2115 .twsk_destructor= tcp_twsk_destructor, 2116 }; 2117 2118 void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb) 2119 { 2120 struct dst_entry *dst = skb_dst(skb); 2121 2122 dst_hold(dst); 2123 sk->sk_rx_dst = dst; 2124 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif; 2125 } 2126 EXPORT_SYMBOL(inet_sk_rx_dst_set); 2127 2128 const struct inet_connection_sock_af_ops ipv4_specific = { 2129 .queue_xmit = ip_queue_xmit, 2130 .send_check = tcp_v4_send_check, 2131 .rebuild_header = inet_sk_rebuild_header, 2132 .sk_rx_dst_set = inet_sk_rx_dst_set, 2133 .conn_request = tcp_v4_conn_request, 2134 .syn_recv_sock = tcp_v4_syn_recv_sock, 2135 .net_header_len = sizeof(struct iphdr), 2136 .setsockopt = ip_setsockopt, 2137 .getsockopt = ip_getsockopt, 2138 .addr2sockaddr = inet_csk_addr2sockaddr, 2139 .sockaddr_len = sizeof(struct sockaddr_in), 2140 .bind_conflict = inet_csk_bind_conflict, 2141 #ifdef CONFIG_COMPAT 2142 .compat_setsockopt = compat_ip_setsockopt, 2143 .compat_getsockopt = compat_ip_getsockopt, 2144 #endif 2145 }; 2146 EXPORT_SYMBOL(ipv4_specific); 2147 2148 #ifdef CONFIG_TCP_MD5SIG 2149 static const struct tcp_sock_af_ops tcp_sock_ipv4_specific = { 2150 .md5_lookup = tcp_v4_md5_lookup, 2151 .calc_md5_hash = tcp_v4_md5_hash_skb, 2152 .md5_parse = tcp_v4_parse_md5_keys, 2153 }; 2154 #endif 2155 2156 /* NOTE: A lot of things set to zero explicitly by call to 2157 * sk_alloc() so need not be done here. 2158 */ 2159 static int tcp_v4_init_sock(struct sock *sk) 2160 { 2161 struct inet_connection_sock *icsk = inet_csk(sk); 2162 2163 tcp_init_sock(sk); 2164 2165 icsk->icsk_af_ops = &ipv4_specific; 2166 2167 #ifdef CONFIG_TCP_MD5SIG 2168 tcp_sk(sk)->af_specific = &tcp_sock_ipv4_specific; 2169 #endif 2170 2171 return 0; 2172 } 2173 2174 void tcp_v4_destroy_sock(struct sock *sk) 2175 { 2176 struct tcp_sock *tp = tcp_sk(sk); 2177 2178 tcp_clear_xmit_timers(sk); 2179 2180 tcp_cleanup_congestion_control(sk); 2181 2182 /* Cleanup up the write buffer. */ 2183 tcp_write_queue_purge(sk); 2184 2185 /* Cleans up our, hopefully empty, out_of_order_queue. */ 2186 __skb_queue_purge(&tp->out_of_order_queue); 2187 2188 #ifdef CONFIG_TCP_MD5SIG 2189 /* Clean up the MD5 key list, if any */ 2190 if (tp->md5sig_info) { 2191 tcp_clear_md5_list(sk); 2192 kfree_rcu(tp->md5sig_info, rcu); 2193 tp->md5sig_info = NULL; 2194 } 2195 #endif 2196 2197 #ifdef CONFIG_NET_DMA 2198 /* Cleans up our sk_async_wait_queue */ 2199 __skb_queue_purge(&sk->sk_async_wait_queue); 2200 #endif 2201 2202 /* Clean prequeue, it must be empty really */ 2203 __skb_queue_purge(&tp->ucopy.prequeue); 2204 2205 /* Clean up a referenced TCP bind bucket. */ 2206 if (inet_csk(sk)->icsk_bind_hash) 2207 inet_put_port(sk); 2208 2209 BUG_ON(tp->fastopen_rsk != NULL); 2210 2211 /* If socket is aborted during connect operation */ 2212 tcp_free_fastopen_req(tp); 2213 2214 sk_sockets_allocated_dec(sk); 2215 sock_release_memcg(sk); 2216 } 2217 EXPORT_SYMBOL(tcp_v4_destroy_sock); 2218 2219 #ifdef CONFIG_PROC_FS 2220 /* Proc filesystem TCP sock list dumping. */ 2221 2222 static inline struct inet_timewait_sock *tw_head(struct hlist_nulls_head *head) 2223 { 2224 return hlist_nulls_empty(head) ? NULL : 2225 list_entry(head->first, struct inet_timewait_sock, tw_node); 2226 } 2227 2228 static inline struct inet_timewait_sock *tw_next(struct inet_timewait_sock *tw) 2229 { 2230 return !is_a_nulls(tw->tw_node.next) ? 2231 hlist_nulls_entry(tw->tw_node.next, typeof(*tw), tw_node) : NULL; 2232 } 2233 2234 /* 2235 * Get next listener socket follow cur. If cur is NULL, get first socket 2236 * starting from bucket given in st->bucket; when st->bucket is zero the 2237 * very first socket in the hash table is returned. 2238 */ 2239 static void *listening_get_next(struct seq_file *seq, void *cur) 2240 { 2241 struct inet_connection_sock *icsk; 2242 struct hlist_nulls_node *node; 2243 struct sock *sk = cur; 2244 struct inet_listen_hashbucket *ilb; 2245 struct tcp_iter_state *st = seq->private; 2246 struct net *net = seq_file_net(seq); 2247 2248 if (!sk) { 2249 ilb = &tcp_hashinfo.listening_hash[st->bucket]; 2250 spin_lock_bh(&ilb->lock); 2251 sk = sk_nulls_head(&ilb->head); 2252 st->offset = 0; 2253 goto get_sk; 2254 } 2255 ilb = &tcp_hashinfo.listening_hash[st->bucket]; 2256 ++st->num; 2257 ++st->offset; 2258 2259 if (st->state == TCP_SEQ_STATE_OPENREQ) { 2260 struct request_sock *req = cur; 2261 2262 icsk = inet_csk(st->syn_wait_sk); 2263 req = req->dl_next; 2264 while (1) { 2265 while (req) { 2266 if (req->rsk_ops->family == st->family) { 2267 cur = req; 2268 goto out; 2269 } 2270 req = req->dl_next; 2271 } 2272 if (++st->sbucket >= icsk->icsk_accept_queue.listen_opt->nr_table_entries) 2273 break; 2274 get_req: 2275 req = icsk->icsk_accept_queue.listen_opt->syn_table[st->sbucket]; 2276 } 2277 sk = sk_nulls_next(st->syn_wait_sk); 2278 st->state = TCP_SEQ_STATE_LISTENING; 2279 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock); 2280 } else { 2281 icsk = inet_csk(sk); 2282 read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock); 2283 if (reqsk_queue_len(&icsk->icsk_accept_queue)) 2284 goto start_req; 2285 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock); 2286 sk = sk_nulls_next(sk); 2287 } 2288 get_sk: 2289 sk_nulls_for_each_from(sk, node) { 2290 if (!net_eq(sock_net(sk), net)) 2291 continue; 2292 if (sk->sk_family == st->family) { 2293 cur = sk; 2294 goto out; 2295 } 2296 icsk = inet_csk(sk); 2297 read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock); 2298 if (reqsk_queue_len(&icsk->icsk_accept_queue)) { 2299 start_req: 2300 st->uid = sock_i_uid(sk); 2301 st->syn_wait_sk = sk; 2302 st->state = TCP_SEQ_STATE_OPENREQ; 2303 st->sbucket = 0; 2304 goto get_req; 2305 } 2306 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock); 2307 } 2308 spin_unlock_bh(&ilb->lock); 2309 st->offset = 0; 2310 if (++st->bucket < INET_LHTABLE_SIZE) { 2311 ilb = &tcp_hashinfo.listening_hash[st->bucket]; 2312 spin_lock_bh(&ilb->lock); 2313 sk = sk_nulls_head(&ilb->head); 2314 goto get_sk; 2315 } 2316 cur = NULL; 2317 out: 2318 return cur; 2319 } 2320 2321 static void *listening_get_idx(struct seq_file *seq, loff_t *pos) 2322 { 2323 struct tcp_iter_state *st = seq->private; 2324 void *rc; 2325 2326 st->bucket = 0; 2327 st->offset = 0; 2328 rc = listening_get_next(seq, NULL); 2329 2330 while (rc && *pos) { 2331 rc = listening_get_next(seq, rc); 2332 --*pos; 2333 } 2334 return rc; 2335 } 2336 2337 static inline bool empty_bucket(struct tcp_iter_state *st) 2338 { 2339 return hlist_nulls_empty(&tcp_hashinfo.ehash[st->bucket].chain) && 2340 hlist_nulls_empty(&tcp_hashinfo.ehash[st->bucket].twchain); 2341 } 2342 2343 /* 2344 * Get first established socket starting from bucket given in st->bucket. 2345 * If st->bucket is zero, the very first socket in the hash is returned. 2346 */ 2347 static void *established_get_first(struct seq_file *seq) 2348 { 2349 struct tcp_iter_state *st = seq->private; 2350 struct net *net = seq_file_net(seq); 2351 void *rc = NULL; 2352 2353 st->offset = 0; 2354 for (; st->bucket <= tcp_hashinfo.ehash_mask; ++st->bucket) { 2355 struct sock *sk; 2356 struct hlist_nulls_node *node; 2357 struct inet_timewait_sock *tw; 2358 spinlock_t *lock = inet_ehash_lockp(&tcp_hashinfo, st->bucket); 2359 2360 /* Lockless fast path for the common case of empty buckets */ 2361 if (empty_bucket(st)) 2362 continue; 2363 2364 spin_lock_bh(lock); 2365 sk_nulls_for_each(sk, node, &tcp_hashinfo.ehash[st->bucket].chain) { 2366 if (sk->sk_family != st->family || 2367 !net_eq(sock_net(sk), net)) { 2368 continue; 2369 } 2370 rc = sk; 2371 goto out; 2372 } 2373 st->state = TCP_SEQ_STATE_TIME_WAIT; 2374 inet_twsk_for_each(tw, node, 2375 &tcp_hashinfo.ehash[st->bucket].twchain) { 2376 if (tw->tw_family != st->family || 2377 !net_eq(twsk_net(tw), net)) { 2378 continue; 2379 } 2380 rc = tw; 2381 goto out; 2382 } 2383 spin_unlock_bh(lock); 2384 st->state = TCP_SEQ_STATE_ESTABLISHED; 2385 } 2386 out: 2387 return rc; 2388 } 2389 2390 static void *established_get_next(struct seq_file *seq, void *cur) 2391 { 2392 struct sock *sk = cur; 2393 struct inet_timewait_sock *tw; 2394 struct hlist_nulls_node *node; 2395 struct tcp_iter_state *st = seq->private; 2396 struct net *net = seq_file_net(seq); 2397 2398 ++st->num; 2399 ++st->offset; 2400 2401 if (st->state == TCP_SEQ_STATE_TIME_WAIT) { 2402 tw = cur; 2403 tw = tw_next(tw); 2404 get_tw: 2405 while (tw && (tw->tw_family != st->family || !net_eq(twsk_net(tw), net))) { 2406 tw = tw_next(tw); 2407 } 2408 if (tw) { 2409 cur = tw; 2410 goto out; 2411 } 2412 spin_unlock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket)); 2413 st->state = TCP_SEQ_STATE_ESTABLISHED; 2414 2415 /* Look for next non empty bucket */ 2416 st->offset = 0; 2417 while (++st->bucket <= tcp_hashinfo.ehash_mask && 2418 empty_bucket(st)) 2419 ; 2420 if (st->bucket > tcp_hashinfo.ehash_mask) 2421 return NULL; 2422 2423 spin_lock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket)); 2424 sk = sk_nulls_head(&tcp_hashinfo.ehash[st->bucket].chain); 2425 } else 2426 sk = sk_nulls_next(sk); 2427 2428 sk_nulls_for_each_from(sk, node) { 2429 if (sk->sk_family == st->family && net_eq(sock_net(sk), net)) 2430 goto found; 2431 } 2432 2433 st->state = TCP_SEQ_STATE_TIME_WAIT; 2434 tw = tw_head(&tcp_hashinfo.ehash[st->bucket].twchain); 2435 goto get_tw; 2436 found: 2437 cur = sk; 2438 out: 2439 return cur; 2440 } 2441 2442 static void *established_get_idx(struct seq_file *seq, loff_t pos) 2443 { 2444 struct tcp_iter_state *st = seq->private; 2445 void *rc; 2446 2447 st->bucket = 0; 2448 rc = established_get_first(seq); 2449 2450 while (rc && pos) { 2451 rc = established_get_next(seq, rc); 2452 --pos; 2453 } 2454 return rc; 2455 } 2456 2457 static void *tcp_get_idx(struct seq_file *seq, loff_t pos) 2458 { 2459 void *rc; 2460 struct tcp_iter_state *st = seq->private; 2461 2462 st->state = TCP_SEQ_STATE_LISTENING; 2463 rc = listening_get_idx(seq, &pos); 2464 2465 if (!rc) { 2466 st->state = TCP_SEQ_STATE_ESTABLISHED; 2467 rc = established_get_idx(seq, pos); 2468 } 2469 2470 return rc; 2471 } 2472 2473 static void *tcp_seek_last_pos(struct seq_file *seq) 2474 { 2475 struct tcp_iter_state *st = seq->private; 2476 int offset = st->offset; 2477 int orig_num = st->num; 2478 void *rc = NULL; 2479 2480 switch (st->state) { 2481 case TCP_SEQ_STATE_OPENREQ: 2482 case TCP_SEQ_STATE_LISTENING: 2483 if (st->bucket >= INET_LHTABLE_SIZE) 2484 break; 2485 st->state = TCP_SEQ_STATE_LISTENING; 2486 rc = listening_get_next(seq, NULL); 2487 while (offset-- && rc) 2488 rc = listening_get_next(seq, rc); 2489 if (rc) 2490 break; 2491 st->bucket = 0; 2492 /* Fallthrough */ 2493 case TCP_SEQ_STATE_ESTABLISHED: 2494 case TCP_SEQ_STATE_TIME_WAIT: 2495 st->state = TCP_SEQ_STATE_ESTABLISHED; 2496 if (st->bucket > tcp_hashinfo.ehash_mask) 2497 break; 2498 rc = established_get_first(seq); 2499 while (offset-- && rc) 2500 rc = established_get_next(seq, rc); 2501 } 2502 2503 st->num = orig_num; 2504 2505 return rc; 2506 } 2507 2508 static void *tcp_seq_start(struct seq_file *seq, loff_t *pos) 2509 { 2510 struct tcp_iter_state *st = seq->private; 2511 void *rc; 2512 2513 if (*pos && *pos == st->last_pos) { 2514 rc = tcp_seek_last_pos(seq); 2515 if (rc) 2516 goto out; 2517 } 2518 2519 st->state = TCP_SEQ_STATE_LISTENING; 2520 st->num = 0; 2521 st->bucket = 0; 2522 st->offset = 0; 2523 rc = *pos ? tcp_get_idx(seq, *pos - 1) : SEQ_START_TOKEN; 2524 2525 out: 2526 st->last_pos = *pos; 2527 return rc; 2528 } 2529 2530 static void *tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos) 2531 { 2532 struct tcp_iter_state *st = seq->private; 2533 void *rc = NULL; 2534 2535 if (v == SEQ_START_TOKEN) { 2536 rc = tcp_get_idx(seq, 0); 2537 goto out; 2538 } 2539 2540 switch (st->state) { 2541 case TCP_SEQ_STATE_OPENREQ: 2542 case TCP_SEQ_STATE_LISTENING: 2543 rc = listening_get_next(seq, v); 2544 if (!rc) { 2545 st->state = TCP_SEQ_STATE_ESTABLISHED; 2546 st->bucket = 0; 2547 st->offset = 0; 2548 rc = established_get_first(seq); 2549 } 2550 break; 2551 case TCP_SEQ_STATE_ESTABLISHED: 2552 case TCP_SEQ_STATE_TIME_WAIT: 2553 rc = established_get_next(seq, v); 2554 break; 2555 } 2556 out: 2557 ++*pos; 2558 st->last_pos = *pos; 2559 return rc; 2560 } 2561 2562 static void tcp_seq_stop(struct seq_file *seq, void *v) 2563 { 2564 struct tcp_iter_state *st = seq->private; 2565 2566 switch (st->state) { 2567 case TCP_SEQ_STATE_OPENREQ: 2568 if (v) { 2569 struct inet_connection_sock *icsk = inet_csk(st->syn_wait_sk); 2570 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock); 2571 } 2572 case TCP_SEQ_STATE_LISTENING: 2573 if (v != SEQ_START_TOKEN) 2574 spin_unlock_bh(&tcp_hashinfo.listening_hash[st->bucket].lock); 2575 break; 2576 case TCP_SEQ_STATE_TIME_WAIT: 2577 case TCP_SEQ_STATE_ESTABLISHED: 2578 if (v) 2579 spin_unlock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket)); 2580 break; 2581 } 2582 } 2583 2584 int tcp_seq_open(struct inode *inode, struct file *file) 2585 { 2586 struct tcp_seq_afinfo *afinfo = PDE_DATA(inode); 2587 struct tcp_iter_state *s; 2588 int err; 2589 2590 err = seq_open_net(inode, file, &afinfo->seq_ops, 2591 sizeof(struct tcp_iter_state)); 2592 if (err < 0) 2593 return err; 2594 2595 s = ((struct seq_file *)file->private_data)->private; 2596 s->family = afinfo->family; 2597 s->last_pos = 0; 2598 return 0; 2599 } 2600 EXPORT_SYMBOL(tcp_seq_open); 2601 2602 int tcp_proc_register(struct net *net, struct tcp_seq_afinfo *afinfo) 2603 { 2604 int rc = 0; 2605 struct proc_dir_entry *p; 2606 2607 afinfo->seq_ops.start = tcp_seq_start; 2608 afinfo->seq_ops.next = tcp_seq_next; 2609 afinfo->seq_ops.stop = tcp_seq_stop; 2610 2611 p = proc_create_data(afinfo->name, S_IRUGO, net->proc_net, 2612 afinfo->seq_fops, afinfo); 2613 if (!p) 2614 rc = -ENOMEM; 2615 return rc; 2616 } 2617 EXPORT_SYMBOL(tcp_proc_register); 2618 2619 void tcp_proc_unregister(struct net *net, struct tcp_seq_afinfo *afinfo) 2620 { 2621 remove_proc_entry(afinfo->name, net->proc_net); 2622 } 2623 EXPORT_SYMBOL(tcp_proc_unregister); 2624 2625 static void get_openreq4(const struct sock *sk, const struct request_sock *req, 2626 struct seq_file *f, int i, kuid_t uid, int *len) 2627 { 2628 const struct inet_request_sock *ireq = inet_rsk(req); 2629 long delta = req->expires - jiffies; 2630 2631 seq_printf(f, "%4d: %08X:%04X %08X:%04X" 2632 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %pK%n", 2633 i, 2634 ireq->loc_addr, 2635 ntohs(inet_sk(sk)->inet_sport), 2636 ireq->rmt_addr, 2637 ntohs(ireq->rmt_port), 2638 TCP_SYN_RECV, 2639 0, 0, /* could print option size, but that is af dependent. */ 2640 1, /* timers active (only the expire timer) */ 2641 jiffies_delta_to_clock_t(delta), 2642 req->num_timeout, 2643 from_kuid_munged(seq_user_ns(f), uid), 2644 0, /* non standard timer */ 2645 0, /* open_requests have no inode */ 2646 atomic_read(&sk->sk_refcnt), 2647 req, 2648 len); 2649 } 2650 2651 static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len) 2652 { 2653 int timer_active; 2654 unsigned long timer_expires; 2655 const struct tcp_sock *tp = tcp_sk(sk); 2656 const struct inet_connection_sock *icsk = inet_csk(sk); 2657 const struct inet_sock *inet = inet_sk(sk); 2658 struct fastopen_queue *fastopenq = icsk->icsk_accept_queue.fastopenq; 2659 __be32 dest = inet->inet_daddr; 2660 __be32 src = inet->inet_rcv_saddr; 2661 __u16 destp = ntohs(inet->inet_dport); 2662 __u16 srcp = ntohs(inet->inet_sport); 2663 int rx_queue; 2664 2665 if (icsk->icsk_pending == ICSK_TIME_RETRANS || 2666 icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS || 2667 icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) { 2668 timer_active = 1; 2669 timer_expires = icsk->icsk_timeout; 2670 } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) { 2671 timer_active = 4; 2672 timer_expires = icsk->icsk_timeout; 2673 } else if (timer_pending(&sk->sk_timer)) { 2674 timer_active = 2; 2675 timer_expires = sk->sk_timer.expires; 2676 } else { 2677 timer_active = 0; 2678 timer_expires = jiffies; 2679 } 2680 2681 if (sk->sk_state == TCP_LISTEN) 2682 rx_queue = sk->sk_ack_backlog; 2683 else 2684 /* 2685 * because we dont lock socket, we might find a transient negative value 2686 */ 2687 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0); 2688 2689 seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX " 2690 "%08X %5d %8d %lu %d %pK %lu %lu %u %u %d%n", 2691 i, src, srcp, dest, destp, sk->sk_state, 2692 tp->write_seq - tp->snd_una, 2693 rx_queue, 2694 timer_active, 2695 jiffies_delta_to_clock_t(timer_expires - jiffies), 2696 icsk->icsk_retransmits, 2697 from_kuid_munged(seq_user_ns(f), sock_i_uid(sk)), 2698 icsk->icsk_probes_out, 2699 sock_i_ino(sk), 2700 atomic_read(&sk->sk_refcnt), sk, 2701 jiffies_to_clock_t(icsk->icsk_rto), 2702 jiffies_to_clock_t(icsk->icsk_ack.ato), 2703 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong, 2704 tp->snd_cwnd, 2705 sk->sk_state == TCP_LISTEN ? 2706 (fastopenq ? fastopenq->max_qlen : 0) : 2707 (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh), 2708 len); 2709 } 2710 2711 static void get_timewait4_sock(const struct inet_timewait_sock *tw, 2712 struct seq_file *f, int i, int *len) 2713 { 2714 __be32 dest, src; 2715 __u16 destp, srcp; 2716 long delta = tw->tw_ttd - jiffies; 2717 2718 dest = tw->tw_daddr; 2719 src = tw->tw_rcv_saddr; 2720 destp = ntohs(tw->tw_dport); 2721 srcp = ntohs(tw->tw_sport); 2722 2723 seq_printf(f, "%4d: %08X:%04X %08X:%04X" 2724 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n", 2725 i, src, srcp, dest, destp, tw->tw_substate, 0, 0, 2726 3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0, 2727 atomic_read(&tw->tw_refcnt), tw, len); 2728 } 2729 2730 #define TMPSZ 150 2731 2732 static int tcp4_seq_show(struct seq_file *seq, void *v) 2733 { 2734 struct tcp_iter_state *st; 2735 int len; 2736 2737 if (v == SEQ_START_TOKEN) { 2738 seq_printf(seq, "%-*s\n", TMPSZ - 1, 2739 " sl local_address rem_address st tx_queue " 2740 "rx_queue tr tm->when retrnsmt uid timeout " 2741 "inode"); 2742 goto out; 2743 } 2744 st = seq->private; 2745 2746 switch (st->state) { 2747 case TCP_SEQ_STATE_LISTENING: 2748 case TCP_SEQ_STATE_ESTABLISHED: 2749 get_tcp4_sock(v, seq, st->num, &len); 2750 break; 2751 case TCP_SEQ_STATE_OPENREQ: 2752 get_openreq4(st->syn_wait_sk, v, seq, st->num, st->uid, &len); 2753 break; 2754 case TCP_SEQ_STATE_TIME_WAIT: 2755 get_timewait4_sock(v, seq, st->num, &len); 2756 break; 2757 } 2758 seq_printf(seq, "%*s\n", TMPSZ - 1 - len, ""); 2759 out: 2760 return 0; 2761 } 2762 2763 static const struct file_operations tcp_afinfo_seq_fops = { 2764 .owner = THIS_MODULE, 2765 .open = tcp_seq_open, 2766 .read = seq_read, 2767 .llseek = seq_lseek, 2768 .release = seq_release_net 2769 }; 2770 2771 static struct tcp_seq_afinfo tcp4_seq_afinfo = { 2772 .name = "tcp", 2773 .family = AF_INET, 2774 .seq_fops = &tcp_afinfo_seq_fops, 2775 .seq_ops = { 2776 .show = tcp4_seq_show, 2777 }, 2778 }; 2779 2780 static int __net_init tcp4_proc_init_net(struct net *net) 2781 { 2782 return tcp_proc_register(net, &tcp4_seq_afinfo); 2783 } 2784 2785 static void __net_exit tcp4_proc_exit_net(struct net *net) 2786 { 2787 tcp_proc_unregister(net, &tcp4_seq_afinfo); 2788 } 2789 2790 static struct pernet_operations tcp4_net_ops = { 2791 .init = tcp4_proc_init_net, 2792 .exit = tcp4_proc_exit_net, 2793 }; 2794 2795 int __init tcp4_proc_init(void) 2796 { 2797 return register_pernet_subsys(&tcp4_net_ops); 2798 } 2799 2800 void tcp4_proc_exit(void) 2801 { 2802 unregister_pernet_subsys(&tcp4_net_ops); 2803 } 2804 #endif /* CONFIG_PROC_FS */ 2805 2806 struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb) 2807 { 2808 const struct iphdr *iph = skb_gro_network_header(skb); 2809 __wsum wsum; 2810 __sum16 sum; 2811 2812 switch (skb->ip_summed) { 2813 case CHECKSUM_COMPLETE: 2814 if (!tcp_v4_check(skb_gro_len(skb), iph->saddr, iph->daddr, 2815 skb->csum)) { 2816 skb->ip_summed = CHECKSUM_UNNECESSARY; 2817 break; 2818 } 2819 flush: 2820 NAPI_GRO_CB(skb)->flush = 1; 2821 return NULL; 2822 2823 case CHECKSUM_NONE: 2824 wsum = csum_tcpudp_nofold(iph->saddr, iph->daddr, 2825 skb_gro_len(skb), IPPROTO_TCP, 0); 2826 sum = csum_fold(skb_checksum(skb, 2827 skb_gro_offset(skb), 2828 skb_gro_len(skb), 2829 wsum)); 2830 if (sum) 2831 goto flush; 2832 2833 skb->ip_summed = CHECKSUM_UNNECESSARY; 2834 break; 2835 } 2836 2837 return tcp_gro_receive(head, skb); 2838 } 2839 2840 int tcp4_gro_complete(struct sk_buff *skb) 2841 { 2842 const struct iphdr *iph = ip_hdr(skb); 2843 struct tcphdr *th = tcp_hdr(skb); 2844 2845 th->check = ~tcp_v4_check(skb->len - skb_transport_offset(skb), 2846 iph->saddr, iph->daddr, 0); 2847 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4; 2848 2849 return tcp_gro_complete(skb); 2850 } 2851 2852 struct proto tcp_prot = { 2853 .name = "TCP", 2854 .owner = THIS_MODULE, 2855 .close = tcp_close, 2856 .connect = tcp_v4_connect, 2857 .disconnect = tcp_disconnect, 2858 .accept = inet_csk_accept, 2859 .ioctl = tcp_ioctl, 2860 .init = tcp_v4_init_sock, 2861 .destroy = tcp_v4_destroy_sock, 2862 .shutdown = tcp_shutdown, 2863 .setsockopt = tcp_setsockopt, 2864 .getsockopt = tcp_getsockopt, 2865 .recvmsg = tcp_recvmsg, 2866 .sendmsg = tcp_sendmsg, 2867 .sendpage = tcp_sendpage, 2868 .backlog_rcv = tcp_v4_do_rcv, 2869 .release_cb = tcp_release_cb, 2870 .mtu_reduced = tcp_v4_mtu_reduced, 2871 .hash = inet_hash, 2872 .unhash = inet_unhash, 2873 .get_port = inet_csk_get_port, 2874 .enter_memory_pressure = tcp_enter_memory_pressure, 2875 .sockets_allocated = &tcp_sockets_allocated, 2876 .orphan_count = &tcp_orphan_count, 2877 .memory_allocated = &tcp_memory_allocated, 2878 .memory_pressure = &tcp_memory_pressure, 2879 .sysctl_wmem = sysctl_tcp_wmem, 2880 .sysctl_rmem = sysctl_tcp_rmem, 2881 .max_header = MAX_TCP_HEADER, 2882 .obj_size = sizeof(struct tcp_sock), 2883 .slab_flags = SLAB_DESTROY_BY_RCU, 2884 .twsk_prot = &tcp_timewait_sock_ops, 2885 .rsk_prot = &tcp_request_sock_ops, 2886 .h.hashinfo = &tcp_hashinfo, 2887 .no_autobind = true, 2888 #ifdef CONFIG_COMPAT 2889 .compat_setsockopt = compat_tcp_setsockopt, 2890 .compat_getsockopt = compat_tcp_getsockopt, 2891 #endif 2892 #ifdef CONFIG_MEMCG_KMEM 2893 .init_cgroup = tcp_init_cgroup, 2894 .destroy_cgroup = tcp_destroy_cgroup, 2895 .proto_cgroup = tcp_proto_cgroup, 2896 #endif 2897 }; 2898 EXPORT_SYMBOL(tcp_prot); 2899 2900 static int __net_init tcp_sk_init(struct net *net) 2901 { 2902 net->ipv4.sysctl_tcp_ecn = 2; 2903 return 0; 2904 } 2905 2906 static void __net_exit tcp_sk_exit(struct net *net) 2907 { 2908 } 2909 2910 static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list) 2911 { 2912 inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET); 2913 } 2914 2915 static struct pernet_operations __net_initdata tcp_sk_ops = { 2916 .init = tcp_sk_init, 2917 .exit = tcp_sk_exit, 2918 .exit_batch = tcp_sk_exit_batch, 2919 }; 2920 2921 void __init tcp_v4_init(void) 2922 { 2923 inet_hashinfo_init(&tcp_hashinfo); 2924 if (register_pernet_subsys(&tcp_sk_ops)) 2925 panic("Failed to create the TCP control socket.\n"); 2926 } 2927