2
* Syncookies implementation for the Linux kernel
4
* Copyright (C) 1997 Andi Kleen
5
* Based on ideas by D.J.Bernstein and Eric Schenk.
7
* This program is free software; you can redistribute it and/or
8
* modify it under the terms of the GNU General Public License
9
* as published by the Free Software Foundation; either version
10
* 2 of the License, or (at your option) any later version.
13
#include <linux/tcp.h>
14
#include <linux/slab.h>
15
#include <linux/random.h>
16
#include <linux/cryptohash.h>
17
#include <linux/kernel.h>
18
#include <linux/export.h>
20
#include <net/route.h>
22
/* Timestamps: lowest bits store TCP options */
24
#define TSMASK (((__u32)1 << TSBITS) - 1)
26
extern int sysctl_tcp_syncookies;
28
__u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
29
EXPORT_SYMBOL(syncookie_secret);
31
static __init int init_syncookies(void)
33
get_random_bytes(syncookie_secret, sizeof(syncookie_secret));
36
__initcall(init_syncookies);
38
#define COOKIEBITS 24 /* Upper bits store count */
39
#define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
41
static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS],
44
static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
47
__u32 *tmp = __get_cpu_var(ipv4_cookie_scratch);
49
memcpy(tmp + 4, syncookie_secret[c], sizeof(syncookie_secret[c]));
50
tmp[0] = (__force u32)saddr;
51
tmp[1] = (__force u32)daddr;
52
tmp[2] = ((__force u32)sport << 16) + (__force u32)dport;
54
sha_transform(tmp + 16, (__u8 *)tmp, tmp + 16 + 5);
61
* when syncookies are in effect and tcp timestamps are enabled we encode
62
* tcp options in the lower bits of the timestamp value that will be
63
* sent in the syn-ack.
64
* Since subsequent timestamps use the normal tcp_time_stamp value, we
65
* must make sure that the resulting initial timestamp is <= tcp_time_stamp.
67
__u32 cookie_init_timestamp(struct request_sock *req)
69
struct inet_request_sock *ireq;
70
u32 ts, ts_now = tcp_time_stamp;
75
options = ireq->wscale_ok ? ireq->snd_wscale : 0xf;
76
options |= ireq->sack_ok << 4;
77
options |= ireq->ecn_ok << 5;
79
ts = ts_now & ~TSMASK;
91
static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport,
92
__be16 dport, __u32 sseq, __u32 count,
96
* Compute the secure sequence number.
97
* The output should be:
98
* HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24)
99
* + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24).
100
* Where sseq is their sequence number and count increases every
102
* As an extra hack, we add a small "data" value that encodes the
103
* MSS into the second hash value.
106
return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
107
sseq + (count << COOKIEBITS) +
108
((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
113
* This retrieves the small "data" value from the syncookie.
114
* If the syncookie is bad, the data returned will be out of
115
* range. This must be checked by the caller.
117
* The count value used to generate the cookie must be within
118
* "maxdiff" if the current (passed-in) "count". The return value
119
* is (__u32)-1 if this test fails.
121
static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
122
__be16 sport, __be16 dport, __u32 sseq,
123
__u32 count, __u32 maxdiff)
127
/* Strip away the layers from the cookie */
128
cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
130
/* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
131
diff = (count - (cookie >> COOKIEBITS)) & ((__u32) - 1 >> COOKIEBITS);
136
cookie_hash(saddr, daddr, sport, dport, count - diff, 1))
137
& COOKIEMASK; /* Leaving the data behind */
141
* MSS Values are taken from the 2009 paper
142
* 'Measuring TCP Maximum Segment Size' by S. Alcock and R. Nelson:
143
* - values 1440 to 1460 accounted for 80% of observed mss values
144
* - values outside the 536-1460 range are rare (<0.2%).
146
* Table must be sorted.
148
static __u16 const msstab[] = {
160
* Generate a syncookie. mssp points to the mss, which is returned
161
* rounded down to the value encoded in the cookie.
163
__u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
165
const struct iphdr *iph = ip_hdr(skb);
166
const struct tcphdr *th = tcp_hdr(skb);
168
const __u16 mss = *mssp;
170
tcp_synq_overflow(sk);
172
for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
173
if (mss >= msstab[mssind])
175
*mssp = msstab[mssind];
177
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);
179
return secure_tcp_syn_cookie(iph->saddr, iph->daddr,
180
th->source, th->dest, ntohl(th->seq),
181
jiffies / (HZ * 60), mssind);
185
* This (misnamed) value is the age of syncookie which is permitted.
186
* Its ideal value should be dependent on TCP_TIMEOUT_INIT and
187
* sysctl_tcp_retries1. It's a rather complicated formula (exponential
188
* backoff) to compute at runtime so it's currently hardcoded here.
190
#define COUNTER_TRIES 4
192
* Check if a ack sequence number is a valid syncookie.
193
* Return the decoded mss if it is, or 0 if not.
195
static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
197
const struct iphdr *iph = ip_hdr(skb);
198
const struct tcphdr *th = tcp_hdr(skb);
199
__u32 seq = ntohl(th->seq) - 1;
200
__u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,
201
th->source, th->dest, seq,
205
return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
208
static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
209
struct request_sock *req,
210
struct dst_entry *dst)
212
struct inet_connection_sock *icsk = inet_csk(sk);
215
child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst);
217
inet_csk_reqsk_queue_add(sk, req, child);
226
* when syncookies are in effect and tcp timestamps are enabled we stored
227
* additional tcp options in the timestamp.
228
* This extracts these options from the timestamp echo.
230
* The lowest 4 bits store snd_wscale.
231
* next 2 bits indicate SACK and ECN support.
233
* return false if we decode an option that should not be.
235
bool cookie_check_timestamp(struct tcp_options_received *tcp_opt, bool *ecn_ok)
237
/* echoed timestamp, lowest bits contain options */
238
u32 options = tcp_opt->rcv_tsecr & TSMASK;
240
if (!tcp_opt->saw_tstamp) {
241
tcp_clear_options(tcp_opt);
245
if (!sysctl_tcp_timestamps)
248
tcp_opt->sack_ok = (options >> 4) & 0x1;
249
*ecn_ok = (options >> 5) & 1;
250
if (*ecn_ok && !sysctl_tcp_ecn)
253
if (tcp_opt->sack_ok && !sysctl_tcp_sack)
256
if ((options & 0xf) == 0xf)
257
return true; /* no window scaling */
259
tcp_opt->wscale_ok = 1;
260
tcp_opt->snd_wscale = options & 0xf;
261
return sysctl_tcp_window_scaling != 0;
263
EXPORT_SYMBOL(cookie_check_timestamp);
265
struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
266
struct ip_options *opt)
268
struct tcp_options_received tcp_opt;
269
const u8 *hash_location;
270
struct inet_request_sock *ireq;
271
struct tcp_request_sock *treq;
272
struct tcp_sock *tp = tcp_sk(sk);
273
const struct tcphdr *th = tcp_hdr(skb);
274
__u32 cookie = ntohl(th->ack_seq) - 1;
275
struct sock *ret = sk;
276
struct request_sock *req;
282
if (!sysctl_tcp_syncookies || !th->ack || th->rst)
285
if (tcp_synq_no_recent_overflow(sk) ||
286
(mss = cookie_check(skb, cookie)) == 0) {
287
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
291
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
293
/* check for timestamp cookie support */
294
memset(&tcp_opt, 0, sizeof(tcp_opt));
295
tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
297
if (!cookie_check_timestamp(&tcp_opt, &ecn_ok))
301
req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
305
ireq = inet_rsk(req);
307
treq->rcv_isn = ntohl(th->seq) - 1;
308
treq->snt_isn = cookie;
310
ireq->loc_port = th->dest;
311
ireq->rmt_port = th->source;
312
ireq->loc_addr = ip_hdr(skb)->daddr;
313
ireq->rmt_addr = ip_hdr(skb)->saddr;
314
ireq->ecn_ok = ecn_ok;
315
ireq->snd_wscale = tcp_opt.snd_wscale;
316
ireq->sack_ok = tcp_opt.sack_ok;
317
ireq->wscale_ok = tcp_opt.wscale_ok;
318
ireq->tstamp_ok = tcp_opt.saw_tstamp;
319
req->ts_recent = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
320
treq->snt_synack = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsecr : 0;
322
/* We throwed the options of the initial SYN away, so we hope
323
* the ACK carries the same options again (see RFC1122 4.2.3.8)
325
if (opt && opt->optlen) {
326
int opt_size = sizeof(struct ip_options_rcu) + opt->optlen;
328
ireq->opt = kmalloc(opt_size, GFP_ATOMIC);
329
if (ireq->opt != NULL && ip_options_echo(&ireq->opt->opt, skb)) {
335
if (security_inet_conn_request(sk, skb, req)) {
344
* We need to lookup the route here to get at the correct
345
* window size. We should better make sure that the window size
346
* hasn't changed since we received the original syn, but I see
347
* no easy way to do this.
352
flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk),
353
RT_SCOPE_UNIVERSE, IPPROTO_TCP,
354
inet_sk_flowi_flags(sk),
355
(opt && opt->srr) ? opt->faddr : ireq->rmt_addr,
356
ireq->loc_addr, th->source, th->dest);
357
security_req_classify_flow(req, flowi4_to_flowi(&fl4));
358
rt = ip_route_output_key(sock_net(sk), &fl4);
365
/* Try to redo what tcp_v4_send_synack did. */
366
req->window_clamp = tp->window_clamp ? :dst_metric(&rt->dst, RTAX_WINDOW);
368
tcp_select_initial_window(tcp_full_space(sk), req->mss,
369
&req->rcv_wnd, &req->window_clamp,
370
ireq->wscale_ok, &rcv_wscale,
371
dst_metric(&rt->dst, RTAX_INITRWND));
373
ireq->rcv_wscale = rcv_wscale;
375
ret = get_cookie_sock(sk, skb, req, &rt->dst);