1 files changed, 43 insertions, 4 deletions

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a2bcac9b388e..59c911f3889d 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1213,9 +1213,12 @@ static struct timewait_sock_ops tcp_timewait_sock_ops = {
 
 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 {
+        struct tcp_extend_values tmp_ext;
         struct tcp_options_received tmp_opt;
+        u8 *hash_location;
         struct request_sock *req;
         struct inet_request_sock *ireq;
+        struct tcp_sock *tp = tcp_sk(sk);
         struct dst_entry *dst = NULL;
         __be32 saddr = ip_hdr(skb)->saddr;
         __be32 daddr = ip_hdr(skb)->daddr;
@@ -1271,15 +1274,49 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = TCP_MSS_DEFAULT;
-        tmp_opt.user_mss  = tcp_sk(sk)->rx_opt.user_mss;
+        tmp_opt.user_mss  = tp->rx_opt.user_mss;
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, dst);
+
+        if (tmp_opt.cookie_plus > 0 &&
+            tmp_opt.saw_tstamp &&
+            !tp->rx_opt.cookie_out_never &&
+            (sysctl_tcp_cookie_size > 0 ||
+             (tp->cookie_values != NULL &&
+              tp->cookie_values->cookie_desired > 0))) {
+                u8 *c;
+                u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
+                int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
+
+                if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
+                        goto drop_and_release;
+
+                /* Secret recipe starts with IP addresses */
+                *mess++ ^= daddr;
+                *mess++ ^= saddr;
 
-        tcp_parse_options(skb, &tmp_opt, 0, dst);
+                /* plus variable length Initiator Cookie */
+                c = (u8 *)mess;
+                while (l-- > 0)
+                        *c++ ^= *hash_location++;
+
+#ifdef CONFIG_SYN_COOKIES
+                want_cookie = 0;        /* not our kind of cookie */
+#endif
+                tmp_ext.cookie_out_never = 0; /* false */
+                tmp_ext.cookie_plus = tmp_opt.cookie_plus;
+        } else if (!tp->rx_opt.cookie_in_always) {
+                /* redundant indications, but ensure initialization. */
+                tmp_ext.cookie_out_never = 1; /* true */
+                tmp_ext.cookie_plus = 0;
+        } else {
+                goto drop_and_release;
+        }
+        tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
 
         if (want_cookie && !tmp_opt.saw_tstamp)
                 tcp_clear_options(&tmp_opt);
 
         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
-
         tcp_openreq_init(req, &tmp_opt, skb);
 
         if (security_inet_conn_request(sk, skb, req))
@@ -1339,7 +1376,9 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         }
         tcp_rsk(req)->snt_isn = isn;
 
-        if (__tcp_v4_send_synack(sk, dst, req, NULL) || want_cookie)
+        if (__tcp_v4_send_synack(sk, dst, req,
+                                 (struct request_values *)&tmp_ext) ||
+            want_cookie)
                 goto drop_and_free;
 
         inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);