diff options
Diffstat (limited to 'net/ipv4/syncookies.c')
-rw-r--r-- | net/ipv4/syncookies.c | 58 |
1 files changed, 29 insertions, 29 deletions
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c index 6b19530905af..33016cc90f0b 100644 --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c | |||
@@ -2,16 +2,16 @@ | |||
2 | * Syncookies implementation for the Linux kernel | 2 | * Syncookies implementation for the Linux kernel |
3 | * | 3 | * |
4 | * Copyright (C) 1997 Andi Kleen | 4 | * Copyright (C) 1997 Andi Kleen |
5 | * Based on ideas by D.J.Bernstein and Eric Schenk. | 5 | * Based on ideas by D.J.Bernstein and Eric Schenk. |
6 | * | 6 | * |
7 | * This program is free software; you can redistribute it and/or | 7 | * This program is free software; you can redistribute it and/or |
8 | * modify it under the terms of the GNU General Public License | 8 | * modify it under the terms of the GNU General Public License |
9 | * as published by the Free Software Foundation; either version | 9 | * as published by the Free Software Foundation; either version |
10 | * 2 of the License, or (at your option) any later version. | 10 | * 2 of the License, or (at your option) any later version. |
11 | * | 11 | * |
12 | * $Id: syncookies.c,v 1.18 2002/02/01 22:01:04 davem Exp $ | 12 | * $Id: syncookies.c,v 1.18 2002/02/01 22:01:04 davem Exp $ |
13 | * | 13 | * |
14 | * Missing: IPv6 support. | 14 | * Missing: IPv6 support. |
15 | */ | 15 | */ |
16 | 16 | ||
17 | #include <linux/tcp.h> | 17 | #include <linux/tcp.h> |
@@ -57,7 +57,7 @@ static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport, | |||
57 | /* | 57 | /* |
58 | * Compute the secure sequence number. | 58 | * Compute the secure sequence number. |
59 | * The output should be: | 59 | * The output should be: |
60 | * HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24) | 60 | * HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24) |
61 | * + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24). | 61 | * + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24). |
62 | * Where sseq is their sequence number and count increases every | 62 | * Where sseq is their sequence number and count increases every |
63 | * minute by 1. | 63 | * minute by 1. |
@@ -99,17 +99,17 @@ static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr, | |||
99 | & COOKIEMASK; /* Leaving the data behind */ | 99 | & COOKIEMASK; /* Leaving the data behind */ |
100 | } | 100 | } |
101 | 101 | ||
102 | /* | 102 | /* |
103 | * This table has to be sorted and terminated with (__u16)-1. | 103 | * This table has to be sorted and terminated with (__u16)-1. |
104 | * XXX generate a better table. | 104 | * XXX generate a better table. |
105 | * Unresolved Issues: HIPPI with a 64k MSS is not well supported. | 105 | * Unresolved Issues: HIPPI with a 64k MSS is not well supported. |
106 | */ | 106 | */ |
107 | static __u16 const msstab[] = { | 107 | static __u16 const msstab[] = { |
108 | 64 - 1, | 108 | 64 - 1, |
109 | 256 - 1, | 109 | 256 - 1, |
110 | 512 - 1, | 110 | 512 - 1, |
111 | 536 - 1, | 111 | 536 - 1, |
112 | 1024 - 1, | 112 | 1024 - 1, |
113 | 1440 - 1, | 113 | 1440 - 1, |
114 | 1460 - 1, | 114 | 1460 - 1, |
115 | 4312 - 1, | 115 | 4312 - 1, |
@@ -128,7 +128,7 @@ __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp) | |||
128 | int mssind; | 128 | int mssind; |
129 | const __u16 mss = *mssp; | 129 | const __u16 mss = *mssp; |
130 | 130 | ||
131 | 131 | ||
132 | tp->last_synq_overflow = jiffies; | 132 | tp->last_synq_overflow = jiffies; |
133 | 133 | ||
134 | /* XXX sort msstab[] by probability? Binary search? */ | 134 | /* XXX sort msstab[] by probability? Binary search? */ |
@@ -144,23 +144,23 @@ __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp) | |||
144 | jiffies / (HZ * 60), mssind); | 144 | jiffies / (HZ * 60), mssind); |
145 | } | 145 | } |
146 | 146 | ||
147 | /* | 147 | /* |
148 | * This (misnamed) value is the age of syncookie which is permitted. | 148 | * This (misnamed) value is the age of syncookie which is permitted. |
149 | * Its ideal value should be dependent on TCP_TIMEOUT_INIT and | 149 | * Its ideal value should be dependent on TCP_TIMEOUT_INIT and |
150 | * sysctl_tcp_retries1. It's a rather complicated formula (exponential | 150 | * sysctl_tcp_retries1. It's a rather complicated formula (exponential |
151 | * backoff) to compute at runtime so it's currently hardcoded here. | 151 | * backoff) to compute at runtime so it's currently hardcoded here. |
152 | */ | 152 | */ |
153 | #define COUNTER_TRIES 4 | 153 | #define COUNTER_TRIES 4 |
154 | /* | 154 | /* |
155 | * Check if a ack sequence number is a valid syncookie. | 155 | * Check if a ack sequence number is a valid syncookie. |
156 | * Return the decoded mss if it is, or 0 if not. | 156 | * Return the decoded mss if it is, or 0 if not. |
157 | */ | 157 | */ |
158 | static inline int cookie_check(struct sk_buff *skb, __u32 cookie) | 158 | static inline int cookie_check(struct sk_buff *skb, __u32 cookie) |
159 | { | 159 | { |
160 | __u32 seq; | 160 | __u32 seq; |
161 | __u32 mssind; | 161 | __u32 mssind; |
162 | 162 | ||
163 | seq = ntohl(skb->h.th->seq)-1; | 163 | seq = ntohl(skb->h.th->seq)-1; |
164 | mssind = check_tcp_syn_cookie(cookie, | 164 | mssind = check_tcp_syn_cookie(cookie, |
165 | skb->nh.iph->saddr, skb->nh.iph->daddr, | 165 | skb->nh.iph->saddr, skb->nh.iph->daddr, |
166 | skb->h.th->source, skb->h.th->dest, | 166 | skb->h.th->source, skb->h.th->dest, |
@@ -191,19 +191,19 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, | |||
191 | struct inet_request_sock *ireq; | 191 | struct inet_request_sock *ireq; |
192 | struct tcp_request_sock *treq; | 192 | struct tcp_request_sock *treq; |
193 | struct tcp_sock *tp = tcp_sk(sk); | 193 | struct tcp_sock *tp = tcp_sk(sk); |
194 | __u32 cookie = ntohl(skb->h.th->ack_seq) - 1; | 194 | __u32 cookie = ntohl(skb->h.th->ack_seq) - 1; |
195 | struct sock *ret = sk; | 195 | struct sock *ret = sk; |
196 | struct request_sock *req; | 196 | struct request_sock *req; |
197 | int mss; | 197 | int mss; |
198 | struct rtable *rt; | 198 | struct rtable *rt; |
199 | __u8 rcv_wscale; | 199 | __u8 rcv_wscale; |
200 | 200 | ||
201 | if (!sysctl_tcp_syncookies || !skb->h.th->ack) | 201 | if (!sysctl_tcp_syncookies || !skb->h.th->ack) |
202 | goto out; | 202 | goto out; |
203 | 203 | ||
204 | if (time_after(jiffies, tp->last_synq_overflow + TCP_TIMEOUT_INIT) || | 204 | if (time_after(jiffies, tp->last_synq_overflow + TCP_TIMEOUT_INIT) || |
205 | (mss = cookie_check(skb, cookie)) == 0) { | 205 | (mss = cookie_check(skb, cookie)) == 0) { |
206 | NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESFAILED); | 206 | NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESFAILED); |
207 | goto out; | 207 | goto out; |
208 | } | 208 | } |
209 | 209 | ||
@@ -221,9 +221,9 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, | |||
221 | ireq = inet_rsk(req); | 221 | ireq = inet_rsk(req); |
222 | treq = tcp_rsk(req); | 222 | treq = tcp_rsk(req); |
223 | treq->rcv_isn = ntohl(skb->h.th->seq) - 1; | 223 | treq->rcv_isn = ntohl(skb->h.th->seq) - 1; |
224 | treq->snt_isn = cookie; | 224 | treq->snt_isn = cookie; |
225 | req->mss = mss; | 225 | req->mss = mss; |
226 | ireq->rmt_port = skb->h.th->source; | 226 | ireq->rmt_port = skb->h.th->source; |
227 | ireq->loc_addr = skb->nh.iph->daddr; | 227 | ireq->loc_addr = skb->nh.iph->daddr; |
228 | ireq->rmt_addr = skb->nh.iph->saddr; | 228 | ireq->rmt_addr = skb->nh.iph->saddr; |
229 | ireq->opt = NULL; | 229 | ireq->opt = NULL; |
@@ -242,15 +242,15 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, | |||
242 | } | 242 | } |
243 | 243 | ||
244 | ireq->snd_wscale = ireq->rcv_wscale = ireq->tstamp_ok = 0; | 244 | ireq->snd_wscale = ireq->rcv_wscale = ireq->tstamp_ok = 0; |
245 | ireq->wscale_ok = ireq->sack_ok = 0; | 245 | ireq->wscale_ok = ireq->sack_ok = 0; |
246 | req->expires = 0UL; | 246 | req->expires = 0UL; |
247 | req->retrans = 0; | 247 | req->retrans = 0; |
248 | 248 | ||
249 | /* | 249 | /* |
250 | * We need to lookup the route here to get at the correct | 250 | * We need to lookup the route here to get at the correct |
251 | * window size. We should better make sure that the window size | 251 | * window size. We should better make sure that the window size |
252 | * hasn't changed since we received the original syn, but I see | 252 | * hasn't changed since we received the original syn, but I see |
253 | * no easy way to do this. | 253 | * no easy way to do this. |
254 | */ | 254 | */ |
255 | { | 255 | { |
256 | struct flowi fl = { .nl_u = { .ip4_u = | 256 | struct flowi fl = { .nl_u = { .ip4_u = |
@@ -266,17 +266,17 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, | |||
266 | security_req_classify_flow(req, &fl); | 266 | security_req_classify_flow(req, &fl); |
267 | if (ip_route_output_key(&rt, &fl)) { | 267 | if (ip_route_output_key(&rt, &fl)) { |
268 | reqsk_free(req); | 268 | reqsk_free(req); |
269 | goto out; | 269 | goto out; |
270 | } | 270 | } |
271 | } | 271 | } |
272 | 272 | ||
273 | /* Try to redo what tcp_v4_send_synack did. */ | 273 | /* Try to redo what tcp_v4_send_synack did. */ |
274 | req->window_clamp = dst_metric(&rt->u.dst, RTAX_WINDOW); | 274 | req->window_clamp = dst_metric(&rt->u.dst, RTAX_WINDOW); |
275 | tcp_select_initial_window(tcp_full_space(sk), req->mss, | 275 | tcp_select_initial_window(tcp_full_space(sk), req->mss, |
276 | &req->rcv_wnd, &req->window_clamp, | 276 | &req->rcv_wnd, &req->window_clamp, |
277 | 0, &rcv_wscale); | 277 | 0, &rcv_wscale); |
278 | /* BTW win scale with syncookies is 0 by definition */ | 278 | /* BTW win scale with syncookies is 0 by definition */ |
279 | ireq->rcv_wscale = rcv_wscale; | 279 | ireq->rcv_wscale = rcv_wscale; |
280 | 280 | ||
281 | ret = get_cookie_sock(sk, skb, req, &rt->u.dst); | 281 | ret = get_cookie_sock(sk, skb, req, &rt->u.dst); |
282 | out: return ret; | 282 | out: return ret; |