xref: /openbmc/linux/net/ipv4/tcp_minisocks.c (revision ca637c0e)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * INET		An implementation of the TCP/IP protocol suite for the LINUX
4  *		operating system.  INET is implemented using the  BSD Socket
5  *		interface as the means of communication with the user level.
6  *
7  *		Implementation of the Transmission Control Protocol(TCP).
8  *
9  * Authors:	Ross Biro
10  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
11  *		Mark Evans, <evansmp@uhura.aston.ac.uk>
12  *		Corey Minyard <wf-rch!minyard@relay.EU.net>
13  *		Florian La Roche, <flla@stud.uni-sb.de>
14  *		Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
15  *		Linus Torvalds, <torvalds@cs.helsinki.fi>
16  *		Alan Cox, <gw4pts@gw4pts.ampr.org>
17  *		Matthew Dillon, <dillon@apollo.west.oic.com>
18  *		Arnt Gulbrandsen, <agulbra@nvg.unit.no>
19  *		Jorge Cwik, <jorge@laser.satlink.net>
20  */
21 
22 #include <net/tcp.h>
23 #include <net/xfrm.h>
24 #include <net/busy_poll.h>
25 
26 static bool tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
27 {
28 	if (seq == s_win)
29 		return true;
30 	if (after(end_seq, s_win) && before(seq, e_win))
31 		return true;
32 	return seq == e_win && seq == end_seq;
33 }
34 
35 static enum tcp_tw_status
36 tcp_timewait_check_oow_rate_limit(struct inet_timewait_sock *tw,
37 				  const struct sk_buff *skb, int mib_idx)
38 {
39 	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
40 
41 	if (!tcp_oow_rate_limited(twsk_net(tw), skb, mib_idx,
42 				  &tcptw->tw_last_oow_ack_time)) {
43 		/* Send ACK. Note, we do not put the bucket,
44 		 * it will be released by caller.
45 		 */
46 		return TCP_TW_ACK;
47 	}
48 
49 	/* We are rate-limiting, so just release the tw sock and drop skb. */
50 	inet_twsk_put(tw);
51 	return TCP_TW_SUCCESS;
52 }
53 
54 /*
55  * * Main purpose of TIME-WAIT state is to close connection gracefully,
56  *   when one of ends sits in LAST-ACK or CLOSING retransmitting FIN
57  *   (and, probably, tail of data) and one or more our ACKs are lost.
58  * * What is TIME-WAIT timeout? It is associated with maximal packet
59  *   lifetime in the internet, which results in wrong conclusion, that
60  *   it is set to catch "old duplicate segments" wandering out of their path.
61  *   It is not quite correct. This timeout is calculated so that it exceeds
62  *   maximal retransmission timeout enough to allow to lose one (or more)
63  *   segments sent by peer and our ACKs. This time may be calculated from RTO.
64  * * When TIME-WAIT socket receives RST, it means that another end
65  *   finally closed and we are allowed to kill TIME-WAIT too.
66  * * Second purpose of TIME-WAIT is catching old duplicate segments.
67  *   Well, certainly it is pure paranoia, but if we load TIME-WAIT
68  *   with this semantics, we MUST NOT kill TIME-WAIT state with RSTs.
69  * * If we invented some more clever way to catch duplicates
70  *   (f.e. based on PAWS), we could truncate TIME-WAIT to several RTOs.
71  *
72  * The algorithm below is based on FORMAL INTERPRETATION of RFCs.
73  * When you compare it to RFCs, please, read section SEGMENT ARRIVES
74  * from the very beginning.
75  *
76  * NOTE. With recycling (and later with fin-wait-2) TW bucket
77  * is _not_ stateless. It means, that strictly speaking we must
78  * spinlock it. I do not want! Well, probability of misbehaviour
79  * is ridiculously low and, seems, we could use some mb() tricks
80  * to avoid misread sequence numbers, states etc.  --ANK
81  *
82  * We don't need to initialize tmp_out.sack_ok as we don't use the results
83  */
84 enum tcp_tw_status
85 tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
86 			   const struct tcphdr *th)
87 {
88 	struct tcp_options_received tmp_opt;
89 	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
90 	bool paws_reject = false;
91 
92 	tmp_opt.saw_tstamp = 0;
93 	if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
94 		tcp_parse_options(twsk_net(tw), skb, &tmp_opt, 0, NULL);
95 
96 		if (tmp_opt.saw_tstamp) {
97 			if (tmp_opt.rcv_tsecr)
98 				tmp_opt.rcv_tsecr -= tcptw->tw_ts_offset;
99 			tmp_opt.ts_recent	= tcptw->tw_ts_recent;
100 			tmp_opt.ts_recent_stamp	= tcptw->tw_ts_recent_stamp;
101 			paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
102 		}
103 	}
104 
105 	if (tw->tw_substate == TCP_FIN_WAIT2) {
106 		/* Just repeat all the checks of tcp_rcv_state_process() */
107 
108 		/* Out of window, send ACK */
109 		if (paws_reject ||
110 		    !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
111 				   tcptw->tw_rcv_nxt,
112 				   tcptw->tw_rcv_nxt + tcptw->tw_rcv_wnd))
113 			return tcp_timewait_check_oow_rate_limit(
114 				tw, skb, LINUX_MIB_TCPACKSKIPPEDFINWAIT2);
115 
116 		if (th->rst)
117 			goto kill;
118 
119 		if (th->syn && !before(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt))
120 			return TCP_TW_RST;
121 
122 		/* Dup ACK? */
123 		if (!th->ack ||
124 		    !after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
125 		    TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
126 			inet_twsk_put(tw);
127 			return TCP_TW_SUCCESS;
128 		}
129 
130 		/* New data or FIN. If new data arrive after half-duplex close,
131 		 * reset.
132 		 */
133 		if (!th->fin ||
134 		    TCP_SKB_CB(skb)->end_seq != tcptw->tw_rcv_nxt + 1)
135 			return TCP_TW_RST;
136 
137 		/* FIN arrived, enter true time-wait state. */
138 		tw->tw_substate	  = TCP_TIME_WAIT;
139 		tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
140 		if (tmp_opt.saw_tstamp) {
141 			tcptw->tw_ts_recent_stamp = ktime_get_seconds();
142 			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
143 		}
144 
145 		inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
146 		return TCP_TW_ACK;
147 	}
148 
149 	/*
150 	 *	Now real TIME-WAIT state.
151 	 *
152 	 *	RFC 1122:
153 	 *	"When a connection is [...] on TIME-WAIT state [...]
154 	 *	[a TCP] MAY accept a new SYN from the remote TCP to
155 	 *	reopen the connection directly, if it:
156 	 *
157 	 *	(1)  assigns its initial sequence number for the new
158 	 *	connection to be larger than the largest sequence
159 	 *	number it used on the previous connection incarnation,
160 	 *	and
161 	 *
162 	 *	(2)  returns to TIME-WAIT state if the SYN turns out
163 	 *	to be an old duplicate".
164 	 */
165 
166 	if (!paws_reject &&
167 	    (TCP_SKB_CB(skb)->seq == tcptw->tw_rcv_nxt &&
168 	     (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq || th->rst))) {
169 		/* In window segment, it may be only reset or bare ack. */
170 
171 		if (th->rst) {
172 			/* This is TIME_WAIT assassination, in two flavors.
173 			 * Oh well... nobody has a sufficient solution to this
174 			 * protocol bug yet.
175 			 */
176 			if (!READ_ONCE(twsk_net(tw)->ipv4.sysctl_tcp_rfc1337)) {
177 kill:
178 				inet_twsk_deschedule_put(tw);
179 				return TCP_TW_SUCCESS;
180 			}
181 		} else {
182 			inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
183 		}
184 
185 		if (tmp_opt.saw_tstamp) {
186 			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
187 			tcptw->tw_ts_recent_stamp = ktime_get_seconds();
188 		}
189 
190 		inet_twsk_put(tw);
191 		return TCP_TW_SUCCESS;
192 	}
193 
194 	/* Out of window segment.
195 
196 	   All the segments are ACKed immediately.
197 
198 	   The only exception is new SYN. We accept it, if it is
199 	   not old duplicate and we are not in danger to be killed
200 	   by delayed old duplicates. RFC check is that it has
201 	   newer sequence number works at rates <40Mbit/sec.
202 	   However, if paws works, it is reliable AND even more,
203 	   we even may relax silly seq space cutoff.
204 
205 	   RED-PEN: we violate main RFC requirement, if this SYN will appear
206 	   old duplicate (i.e. we receive RST in reply to SYN-ACK),
207 	   we must return socket to time-wait state. It is not good,
208 	   but not fatal yet.
209 	 */
210 
211 	if (th->syn && !th->rst && !th->ack && !paws_reject &&
212 	    (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) ||
213 	     (tmp_opt.saw_tstamp &&
214 	      (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) {
215 		u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
216 		if (isn == 0)
217 			isn++;
218 		TCP_SKB_CB(skb)->tcp_tw_isn = isn;
219 		return TCP_TW_SYN;
220 	}
221 
222 	if (paws_reject)
223 		__NET_INC_STATS(twsk_net(tw), LINUX_MIB_PAWSESTABREJECTED);
224 
225 	if (!th->rst) {
226 		/* In this case we must reset the TIMEWAIT timer.
227 		 *
228 		 * If it is ACKless SYN it may be both old duplicate
229 		 * and new good SYN with random sequence number <rcv_nxt.
230 		 * Do not reschedule in the last case.
231 		 */
232 		if (paws_reject || th->ack)
233 			inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
234 
235 		return tcp_timewait_check_oow_rate_limit(
236 			tw, skb, LINUX_MIB_TCPACKSKIPPEDTIMEWAIT);
237 	}
238 	inet_twsk_put(tw);
239 	return TCP_TW_SUCCESS;
240 }
241 EXPORT_SYMBOL(tcp_timewait_state_process);
242 
243 /*
244  * Move a socket to time-wait or dead fin-wait-2 state.
245  */
246 void tcp_time_wait(struct sock *sk, int state, int timeo)
247 {
248 	const struct inet_connection_sock *icsk = inet_csk(sk);
249 	const struct tcp_sock *tp = tcp_sk(sk);
250 	struct net *net = sock_net(sk);
251 	struct inet_timewait_sock *tw;
252 
253 	tw = inet_twsk_alloc(sk, &net->ipv4.tcp_death_row, state);
254 
255 	if (tw) {
256 		struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
257 		const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
258 		struct inet_sock *inet = inet_sk(sk);
259 
260 		tw->tw_transparent	= inet->transparent;
261 		tw->tw_mark		= sk->sk_mark;
262 		tw->tw_priority		= sk->sk_priority;
263 		tw->tw_rcv_wscale	= tp->rx_opt.rcv_wscale;
264 		tcptw->tw_rcv_nxt	= tp->rcv_nxt;
265 		tcptw->tw_snd_nxt	= tp->snd_nxt;
266 		tcptw->tw_rcv_wnd	= tcp_receive_window(tp);
267 		tcptw->tw_ts_recent	= tp->rx_opt.ts_recent;
268 		tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
269 		tcptw->tw_ts_offset	= tp->tsoffset;
270 		tcptw->tw_last_oow_ack_time = 0;
271 		tcptw->tw_tx_delay	= tp->tcp_tx_delay;
272 #if IS_ENABLED(CONFIG_IPV6)
273 		if (tw->tw_family == PF_INET6) {
274 			struct ipv6_pinfo *np = inet6_sk(sk);
275 
276 			tw->tw_v6_daddr = sk->sk_v6_daddr;
277 			tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
278 			tw->tw_tclass = np->tclass;
279 			tw->tw_flowlabel = be32_to_cpu(np->flow_label & IPV6_FLOWLABEL_MASK);
280 			tw->tw_txhash = sk->sk_txhash;
281 			tw->tw_ipv6only = sk->sk_ipv6only;
282 		}
283 #endif
284 
285 #ifdef CONFIG_TCP_MD5SIG
286 		/*
287 		 * The timewait bucket does not have the key DB from the
288 		 * sock structure. We just make a quick copy of the
289 		 * md5 key being used (if indeed we are using one)
290 		 * so the timewait ack generating code has the key.
291 		 */
292 		do {
293 			tcptw->tw_md5_key = NULL;
294 			if (static_branch_unlikely(&tcp_md5_needed)) {
295 				struct tcp_md5sig_key *key;
296 
297 				key = tp->af_specific->md5_lookup(sk, sk);
298 				if (key) {
299 					tcptw->tw_md5_key = kmemdup(key, sizeof(*key), GFP_ATOMIC);
300 					BUG_ON(tcptw->tw_md5_key && !tcp_alloc_md5sig_pool());
301 				}
302 			}
303 		} while (0);
304 #endif
305 
306 		/* Get the TIME_WAIT timeout firing. */
307 		if (timeo < rto)
308 			timeo = rto;
309 
310 		if (state == TCP_TIME_WAIT)
311 			timeo = TCP_TIMEWAIT_LEN;
312 
313 		/* tw_timer is pinned, so we need to make sure BH are disabled
314 		 * in following section, otherwise timer handler could run before
315 		 * we complete the initialization.
316 		 */
317 		local_bh_disable();
318 		inet_twsk_schedule(tw, timeo);
319 		/* Linkage updates.
320 		 * Note that access to tw after this point is illegal.
321 		 */
322 		inet_twsk_hashdance(tw, sk, net->ipv4.tcp_death_row.hashinfo);
323 		local_bh_enable();
324 	} else {
325 		/* Sorry, if we're out of memory, just CLOSE this
326 		 * socket up.  We've got bigger problems than
327 		 * non-graceful socket closings.
328 		 */
329 		NET_INC_STATS(net, LINUX_MIB_TCPTIMEWAITOVERFLOW);
330 	}
331 
332 	tcp_update_metrics(sk);
333 	tcp_done(sk);
334 }
335 EXPORT_SYMBOL(tcp_time_wait);
336 
337 void tcp_twsk_destructor(struct sock *sk)
338 {
339 #ifdef CONFIG_TCP_MD5SIG
340 	if (static_branch_unlikely(&tcp_md5_needed)) {
341 		struct tcp_timewait_sock *twsk = tcp_twsk(sk);
342 
343 		if (twsk->tw_md5_key)
344 			kfree_rcu(twsk->tw_md5_key, rcu);
345 	}
346 #endif
347 }
348 EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
349 
350 void tcp_twsk_purge(struct list_head *net_exit_list, int family)
351 {
352 	bool purged_once = false;
353 	struct net *net;
354 
355 	list_for_each_entry(net, net_exit_list, exit_list) {
356 		if (net->ipv4.tcp_death_row.hashinfo->pernet) {
357 			/* Even if tw_refcount == 1, we must clean up kernel reqsk */
358 			inet_twsk_purge(net->ipv4.tcp_death_row.hashinfo, family);
359 		} else if (!purged_once) {
360 			/* The last refcount is decremented in tcp_sk_exit_batch() */
361 			if (refcount_read(&net->ipv4.tcp_death_row.tw_refcount) == 1)
362 				continue;
363 
364 			inet_twsk_purge(&tcp_hashinfo, family);
365 			purged_once = true;
366 		}
367 	}
368 }
369 EXPORT_SYMBOL_GPL(tcp_twsk_purge);
370 
371 /* Warning : This function is called without sk_listener being locked.
372  * Be sure to read socket fields once, as their value could change under us.
373  */
374 void tcp_openreq_init_rwin(struct request_sock *req,
375 			   const struct sock *sk_listener,
376 			   const struct dst_entry *dst)
377 {
378 	struct inet_request_sock *ireq = inet_rsk(req);
379 	const struct tcp_sock *tp = tcp_sk(sk_listener);
380 	int full_space = tcp_full_space(sk_listener);
381 	u32 window_clamp;
382 	__u8 rcv_wscale;
383 	u32 rcv_wnd;
384 	int mss;
385 
386 	mss = tcp_mss_clamp(tp, dst_metric_advmss(dst));
387 	window_clamp = READ_ONCE(tp->window_clamp);
388 	/* Set this up on the first call only */
389 	req->rsk_window_clamp = window_clamp ? : dst_metric(dst, RTAX_WINDOW);
390 
391 	/* limit the window selection if the user enforce a smaller rx buffer */
392 	if (sk_listener->sk_userlocks & SOCK_RCVBUF_LOCK &&
393 	    (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
394 		req->rsk_window_clamp = full_space;
395 
396 	rcv_wnd = tcp_rwnd_init_bpf((struct sock *)req);
397 	if (rcv_wnd == 0)
398 		rcv_wnd = dst_metric(dst, RTAX_INITRWND);
399 	else if (full_space < rcv_wnd * mss)
400 		full_space = rcv_wnd * mss;
401 
402 	/* tcp_full_space because it is guaranteed to be the first packet */
403 	tcp_select_initial_window(sk_listener, full_space,
404 		mss - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
405 		&req->rsk_rcv_wnd,
406 		&req->rsk_window_clamp,
407 		ireq->wscale_ok,
408 		&rcv_wscale,
409 		rcv_wnd);
410 	ireq->rcv_wscale = rcv_wscale;
411 }
412 EXPORT_SYMBOL(tcp_openreq_init_rwin);
413 
414 static void tcp_ecn_openreq_child(struct tcp_sock *tp,
415 				  const struct request_sock *req)
416 {
417 	tp->ecn_flags = inet_rsk(req)->ecn_ok ? TCP_ECN_OK : 0;
418 }
419 
420 void tcp_ca_openreq_child(struct sock *sk, const struct dst_entry *dst)
421 {
422 	struct inet_connection_sock *icsk = inet_csk(sk);
423 	u32 ca_key = dst_metric(dst, RTAX_CC_ALGO);
424 	bool ca_got_dst = false;
425 
426 	if (ca_key != TCP_CA_UNSPEC) {
427 		const struct tcp_congestion_ops *ca;
428 
429 		rcu_read_lock();
430 		ca = tcp_ca_find_key(ca_key);
431 		if (likely(ca && bpf_try_module_get(ca, ca->owner))) {
432 			icsk->icsk_ca_dst_locked = tcp_ca_dst_locked(dst);
433 			icsk->icsk_ca_ops = ca;
434 			ca_got_dst = true;
435 		}
436 		rcu_read_unlock();
437 	}
438 
439 	/* If no valid choice made yet, assign current system default ca. */
440 	if (!ca_got_dst &&
441 	    (!icsk->icsk_ca_setsockopt ||
442 	     !bpf_try_module_get(icsk->icsk_ca_ops, icsk->icsk_ca_ops->owner)))
443 		tcp_assign_congestion_control(sk);
444 
445 	tcp_set_ca_state(sk, TCP_CA_Open);
446 }
447 EXPORT_SYMBOL_GPL(tcp_ca_openreq_child);
448 
449 static void smc_check_reset_syn_req(struct tcp_sock *oldtp,
450 				    struct request_sock *req,
451 				    struct tcp_sock *newtp)
452 {
453 #if IS_ENABLED(CONFIG_SMC)
454 	struct inet_request_sock *ireq;
455 
456 	if (static_branch_unlikely(&tcp_have_smc)) {
457 		ireq = inet_rsk(req);
458 		if (oldtp->syn_smc && !ireq->smc_ok)
459 			newtp->syn_smc = 0;
460 	}
461 #endif
462 }
463 
464 /* This is not only more efficient than what we used to do, it eliminates
465  * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM
466  *
467  * Actually, we could lots of memory writes here. tp of listening
468  * socket contains all necessary default parameters.
469  */
470 struct sock *tcp_create_openreq_child(const struct sock *sk,
471 				      struct request_sock *req,
472 				      struct sk_buff *skb)
473 {
474 	struct sock *newsk = inet_csk_clone_lock(sk, req, GFP_ATOMIC);
475 	const struct inet_request_sock *ireq = inet_rsk(req);
476 	struct tcp_request_sock *treq = tcp_rsk(req);
477 	struct inet_connection_sock *newicsk;
478 	struct tcp_sock *oldtp, *newtp;
479 	u32 seq;
480 
481 	if (!newsk)
482 		return NULL;
483 
484 	newicsk = inet_csk(newsk);
485 	newtp = tcp_sk(newsk);
486 	oldtp = tcp_sk(sk);
487 
488 	smc_check_reset_syn_req(oldtp, req, newtp);
489 
490 	/* Now setup tcp_sock */
491 	newtp->pred_flags = 0;
492 
493 	seq = treq->rcv_isn + 1;
494 	newtp->rcv_wup = seq;
495 	WRITE_ONCE(newtp->copied_seq, seq);
496 	WRITE_ONCE(newtp->rcv_nxt, seq);
497 	newtp->segs_in = 1;
498 
499 	seq = treq->snt_isn + 1;
500 	newtp->snd_sml = newtp->snd_una = seq;
501 	WRITE_ONCE(newtp->snd_nxt, seq);
502 	newtp->snd_up = seq;
503 
504 	INIT_LIST_HEAD(&newtp->tsq_node);
505 	INIT_LIST_HEAD(&newtp->tsorted_sent_queue);
506 
507 	tcp_init_wl(newtp, treq->rcv_isn);
508 
509 	minmax_reset(&newtp->rtt_min, tcp_jiffies32, ~0U);
510 	newicsk->icsk_ack.lrcvtime = tcp_jiffies32;
511 
512 	newtp->lsndtime = tcp_jiffies32;
513 	newsk->sk_txhash = treq->txhash;
514 	newtp->total_retrans = req->num_retrans;
515 
516 	tcp_init_xmit_timers(newsk);
517 	WRITE_ONCE(newtp->write_seq, newtp->pushed_seq = treq->snt_isn + 1);
518 
519 	if (sock_flag(newsk, SOCK_KEEPOPEN))
520 		inet_csk_reset_keepalive_timer(newsk,
521 					       keepalive_time_when(newtp));
522 
523 	newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
524 	newtp->rx_opt.sack_ok = ireq->sack_ok;
525 	newtp->window_clamp = req->rsk_window_clamp;
526 	newtp->rcv_ssthresh = req->rsk_rcv_wnd;
527 	newtp->rcv_wnd = req->rsk_rcv_wnd;
528 	newtp->rx_opt.wscale_ok = ireq->wscale_ok;
529 	if (newtp->rx_opt.wscale_ok) {
530 		newtp->rx_opt.snd_wscale = ireq->snd_wscale;
531 		newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
532 	} else {
533 		newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
534 		newtp->window_clamp = min(newtp->window_clamp, 65535U);
535 	}
536 	newtp->snd_wnd = ntohs(tcp_hdr(skb)->window) << newtp->rx_opt.snd_wscale;
537 	newtp->max_window = newtp->snd_wnd;
538 
539 	if (newtp->rx_opt.tstamp_ok) {
540 		newtp->rx_opt.ts_recent = req->ts_recent;
541 		newtp->rx_opt.ts_recent_stamp = ktime_get_seconds();
542 		newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
543 	} else {
544 		newtp->rx_opt.ts_recent_stamp = 0;
545 		newtp->tcp_header_len = sizeof(struct tcphdr);
546 	}
547 	if (req->num_timeout) {
548 		newtp->undo_marker = treq->snt_isn;
549 		newtp->retrans_stamp = div_u64(treq->snt_synack,
550 					       USEC_PER_SEC / TCP_TS_HZ);
551 	}
552 	newtp->tsoffset = treq->ts_off;
553 #ifdef CONFIG_TCP_MD5SIG
554 	newtp->md5sig_info = NULL;	/*XXX*/
555 	if (treq->af_specific->req_md5_lookup(sk, req_to_sk(req)))
556 		newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
557 #endif
558 	if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
559 		newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
560 	newtp->rx_opt.mss_clamp = req->mss;
561 	tcp_ecn_openreq_child(newtp, req);
562 	newtp->fastopen_req = NULL;
563 	RCU_INIT_POINTER(newtp->fastopen_rsk, NULL);
564 
565 	newtp->bpf_chg_cc_inprogress = 0;
566 	tcp_bpf_clone(sk, newsk);
567 
568 	__TCP_INC_STATS(sock_net(sk), TCP_MIB_PASSIVEOPENS);
569 
570 	return newsk;
571 }
572 EXPORT_SYMBOL(tcp_create_openreq_child);
573 
574 /*
575  * Process an incoming packet for SYN_RECV sockets represented as a
576  * request_sock. Normally sk is the listener socket but for TFO it
577  * points to the child socket.
578  *
579  * XXX (TFO) - The current impl contains a special check for ack
580  * validation and inside tcp_v4_reqsk_send_ack(). Can we do better?
581  *
582  * We don't need to initialize tmp_opt.sack_ok as we don't use the results
583  */
584 
585 struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
586 			   struct request_sock *req,
587 			   bool fastopen, bool *req_stolen)
588 {
589 	struct tcp_options_received tmp_opt;
590 	struct sock *child;
591 	const struct tcphdr *th = tcp_hdr(skb);
592 	__be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
593 	bool paws_reject = false;
594 	bool own_req;
595 
596 	tmp_opt.saw_tstamp = 0;
597 	if (th->doff > (sizeof(struct tcphdr)>>2)) {
598 		tcp_parse_options(sock_net(sk), skb, &tmp_opt, 0, NULL);
599 
600 		if (tmp_opt.saw_tstamp) {
601 			tmp_opt.ts_recent = req->ts_recent;
602 			if (tmp_opt.rcv_tsecr)
603 				tmp_opt.rcv_tsecr -= tcp_rsk(req)->ts_off;
604 			/* We do not store true stamp, but it is not required,
605 			 * it can be estimated (approximately)
606 			 * from another data.
607 			 */
608 			tmp_opt.ts_recent_stamp = ktime_get_seconds() - reqsk_timeout(req, TCP_RTO_MAX) / HZ;
609 			paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
610 		}
611 	}
612 
613 	/* Check for pure retransmitted SYN. */
614 	if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
615 	    flg == TCP_FLAG_SYN &&
616 	    !paws_reject) {
617 		/*
618 		 * RFC793 draws (Incorrectly! It was fixed in RFC1122)
619 		 * this case on figure 6 and figure 8, but formal
620 		 * protocol description says NOTHING.
621 		 * To be more exact, it says that we should send ACK,
622 		 * because this segment (at least, if it has no data)
623 		 * is out of window.
624 		 *
625 		 *  CONCLUSION: RFC793 (even with RFC1122) DOES NOT
626 		 *  describe SYN-RECV state. All the description
627 		 *  is wrong, we cannot believe to it and should
628 		 *  rely only on common sense and implementation
629 		 *  experience.
630 		 *
631 		 * Enforce "SYN-ACK" according to figure 8, figure 6
632 		 * of RFC793, fixed by RFC1122.
633 		 *
634 		 * Note that even if there is new data in the SYN packet
635 		 * they will be thrown away too.
636 		 *
637 		 * Reset timer after retransmitting SYNACK, similar to
638 		 * the idea of fast retransmit in recovery.
639 		 */
640 		if (!tcp_oow_rate_limited(sock_net(sk), skb,
641 					  LINUX_MIB_TCPACKSKIPPEDSYNRECV,
642 					  &tcp_rsk(req)->last_oow_ack_time) &&
643 
644 		    !inet_rtx_syn_ack(sk, req)) {
645 			unsigned long expires = jiffies;
646 
647 			expires += reqsk_timeout(req, TCP_RTO_MAX);
648 			if (!fastopen)
649 				mod_timer_pending(&req->rsk_timer, expires);
650 			else
651 				req->rsk_timer.expires = expires;
652 		}
653 		return NULL;
654 	}
655 
656 	/* Further reproduces section "SEGMENT ARRIVES"
657 	   for state SYN-RECEIVED of RFC793.
658 	   It is broken, however, it does not work only
659 	   when SYNs are crossed.
660 
661 	   You would think that SYN crossing is impossible here, since
662 	   we should have a SYN_SENT socket (from connect()) on our end,
663 	   but this is not true if the crossed SYNs were sent to both
664 	   ends by a malicious third party.  We must defend against this,
665 	   and to do that we first verify the ACK (as per RFC793, page
666 	   36) and reset if it is invalid.  Is this a true full defense?
667 	   To convince ourselves, let us consider a way in which the ACK
668 	   test can still pass in this 'malicious crossed SYNs' case.
669 	   Malicious sender sends identical SYNs (and thus identical sequence
670 	   numbers) to both A and B:
671 
672 		A: gets SYN, seq=7
673 		B: gets SYN, seq=7
674 
675 	   By our good fortune, both A and B select the same initial
676 	   send sequence number of seven :-)
677 
678 		A: sends SYN|ACK, seq=7, ack_seq=8
679 		B: sends SYN|ACK, seq=7, ack_seq=8
680 
681 	   So we are now A eating this SYN|ACK, ACK test passes.  So
682 	   does sequence test, SYN is truncated, and thus we consider
683 	   it a bare ACK.
684 
685 	   If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this
686 	   bare ACK.  Otherwise, we create an established connection.  Both
687 	   ends (listening sockets) accept the new incoming connection and try
688 	   to talk to each other. 8-)
689 
690 	   Note: This case is both harmless, and rare.  Possibility is about the
691 	   same as us discovering intelligent life on another plant tomorrow.
692 
693 	   But generally, we should (RFC lies!) to accept ACK
694 	   from SYNACK both here and in tcp_rcv_state_process().
695 	   tcp_rcv_state_process() does not, hence, we do not too.
696 
697 	   Note that the case is absolutely generic:
698 	   we cannot optimize anything here without
699 	   violating protocol. All the checks must be made
700 	   before attempt to create socket.
701 	 */
702 
703 	/* RFC793 page 36: "If the connection is in any non-synchronized state ...
704 	 *                  and the incoming segment acknowledges something not yet
705 	 *                  sent (the segment carries an unacceptable ACK) ...
706 	 *                  a reset is sent."
707 	 *
708 	 * Invalid ACK: reset will be sent by listening socket.
709 	 * Note that the ACK validity check for a Fast Open socket is done
710 	 * elsewhere and is checked directly against the child socket rather
711 	 * than req because user data may have been sent out.
712 	 */
713 	if ((flg & TCP_FLAG_ACK) && !fastopen &&
714 	    (TCP_SKB_CB(skb)->ack_seq !=
715 	     tcp_rsk(req)->snt_isn + 1))
716 		return sk;
717 
718 	/* Also, it would be not so bad idea to check rcv_tsecr, which
719 	 * is essentially ACK extension and too early or too late values
720 	 * should cause reset in unsynchronized states.
721 	 */
722 
723 	/* RFC793: "first check sequence number". */
724 
725 	if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
726 					  tcp_rsk(req)->rcv_nxt, tcp_rsk(req)->rcv_nxt + req->rsk_rcv_wnd)) {
727 		/* Out of window: send ACK and drop. */
728 		if (!(flg & TCP_FLAG_RST) &&
729 		    !tcp_oow_rate_limited(sock_net(sk), skb,
730 					  LINUX_MIB_TCPACKSKIPPEDSYNRECV,
731 					  &tcp_rsk(req)->last_oow_ack_time))
732 			req->rsk_ops->send_ack(sk, skb, req);
733 		if (paws_reject)
734 			__NET_INC_STATS(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
735 		return NULL;
736 	}
737 
738 	/* In sequence, PAWS is OK. */
739 
740 	if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt))
741 		req->ts_recent = tmp_opt.rcv_tsval;
742 
743 	if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
744 		/* Truncate SYN, it is out of window starting
745 		   at tcp_rsk(req)->rcv_isn + 1. */
746 		flg &= ~TCP_FLAG_SYN;
747 	}
748 
749 	/* RFC793: "second check the RST bit" and
750 	 *	   "fourth, check the SYN bit"
751 	 */
752 	if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
753 		__TCP_INC_STATS(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
754 		goto embryonic_reset;
755 	}
756 
757 	/* ACK sequence verified above, just make sure ACK is
758 	 * set.  If ACK not set, just silently drop the packet.
759 	 *
760 	 * XXX (TFO) - if we ever allow "data after SYN", the
761 	 * following check needs to be removed.
762 	 */
763 	if (!(flg & TCP_FLAG_ACK))
764 		return NULL;
765 
766 	/* For Fast Open no more processing is needed (sk is the
767 	 * child socket).
768 	 */
769 	if (fastopen)
770 		return sk;
771 
772 	/* While TCP_DEFER_ACCEPT is active, drop bare ACK. */
773 	if (req->num_timeout < inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
774 	    TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
775 		inet_rsk(req)->acked = 1;
776 		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPDEFERACCEPTDROP);
777 		return NULL;
778 	}
779 
780 	/* OK, ACK is valid, create big socket and
781 	 * feed this segment to it. It will repeat all
782 	 * the tests. THIS SEGMENT MUST MOVE SOCKET TO
783 	 * ESTABLISHED STATE. If it will be dropped after
784 	 * socket is created, wait for troubles.
785 	 */
786 	child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
787 							 req, &own_req);
788 	if (!child)
789 		goto listen_overflow;
790 
791 	if (own_req && rsk_drop_req(req)) {
792 		reqsk_queue_removed(&inet_csk(req->rsk_listener)->icsk_accept_queue, req);
793 		inet_csk_reqsk_queue_drop_and_put(req->rsk_listener, req);
794 		return child;
795 	}
796 
797 	sock_rps_save_rxhash(child, skb);
798 	tcp_synack_rtt_meas(child, req);
799 	*req_stolen = !own_req;
800 	return inet_csk_complete_hashdance(sk, child, req, own_req);
801 
802 listen_overflow:
803 	if (sk != req->rsk_listener)
804 		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMIGRATEREQFAILURE);
805 
806 	if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_abort_on_overflow)) {
807 		inet_rsk(req)->acked = 1;
808 		return NULL;
809 	}
810 
811 embryonic_reset:
812 	if (!(flg & TCP_FLAG_RST)) {
813 		/* Received a bad SYN pkt - for TFO We try not to reset
814 		 * the local connection unless it's really necessary to
815 		 * avoid becoming vulnerable to outside attack aiming at
816 		 * resetting legit local connections.
817 		 */
818 		req->rsk_ops->send_reset(sk, skb);
819 	} else if (fastopen) { /* received a valid RST pkt */
820 		reqsk_fastopen_remove(sk, req, true);
821 		tcp_reset(sk, skb);
822 	}
823 	if (!fastopen) {
824 		bool unlinked = inet_csk_reqsk_queue_drop(sk, req);
825 
826 		if (unlinked)
827 			__NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
828 		*req_stolen = !unlinked;
829 	}
830 	return NULL;
831 }
832 EXPORT_SYMBOL(tcp_check_req);
833 
834 /*
835  * Queue segment on the new socket if the new socket is active,
836  * otherwise we just shortcircuit this and continue with
837  * the new socket.
838  *
839  * For the vast majority of cases child->sk_state will be TCP_SYN_RECV
840  * when entering. But other states are possible due to a race condition
841  * where after __inet_lookup_established() fails but before the listener
842  * locked is obtained, other packets cause the same connection to
843  * be created.
844  */
845 
846 int tcp_child_process(struct sock *parent, struct sock *child,
847 		      struct sk_buff *skb)
848 	__releases(&((child)->sk_lock.slock))
849 {
850 	int ret = 0;
851 	int state = child->sk_state;
852 
853 	/* record sk_napi_id and sk_rx_queue_mapping of child. */
854 	sk_mark_napi_id_set(child, skb);
855 
856 	tcp_segs_in(tcp_sk(child), skb);
857 	if (!sock_owned_by_user(child)) {
858 		ret = tcp_rcv_state_process(child, skb);
859 		/* Wakeup parent, send SIGIO */
860 		if (state == TCP_SYN_RECV && child->sk_state != state)
861 			parent->sk_data_ready(parent);
862 	} else {
863 		/* Alas, it is possible again, because we do lookup
864 		 * in main socket hash table and lock on listening
865 		 * socket does not protect us more.
866 		 */
867 		__sk_add_backlog(child, skb);
868 	}
869 
870 	bh_unlock_sock(child);
871 	sock_put(child);
872 	return ret;
873 }
874 EXPORT_SYMBOL(tcp_child_process);
875