1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * INET		An implementation of the TCP/IP protocol suite for the LINUX
4  *		operating system.  INET is implemented using the  BSD Socket
5  *		interface as the means of communication with the user level.
6  *
7  *		Implementation of the Transmission Control Protocol(TCP).
8  *
9  * Authors:	Ross Biro
10  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
11  *		Mark Evans, <evansmp@uhura.aston.ac.uk>
12  *		Corey Minyard <wf-rch!minyard@relay.EU.net>
13  *		Florian La Roche, <flla@stud.uni-sb.de>
14  *		Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
15  *		Linus Torvalds, <torvalds@cs.helsinki.fi>
16  *		Alan Cox, <gw4pts@gw4pts.ampr.org>
17  *		Matthew Dillon, <dillon@apollo.west.oic.com>
18  *		Arnt Gulbrandsen, <agulbra@nvg.unit.no>
19  *		Jorge Cwik, <jorge@laser.satlink.net>
20  */
21 
22 #include <net/tcp.h>
23 #include <net/xfrm.h>
24 #include <net/busy_poll.h>
25 
tcp_in_window(u32 seq,u32 end_seq,u32 s_win,u32 e_win)26 static bool tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
27 {
28 	if (seq == s_win)
29 		return true;
30 	if (after(end_seq, s_win) && before(seq, e_win))
31 		return true;
32 	return seq == e_win && seq == end_seq;
33 }
34 
35 static enum tcp_tw_status
tcp_timewait_check_oow_rate_limit(struct inet_timewait_sock * tw,const struct sk_buff * skb,int mib_idx)36 tcp_timewait_check_oow_rate_limit(struct inet_timewait_sock *tw,
37 				  const struct sk_buff *skb, int mib_idx)
38 {
39 	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
40 
41 	if (!tcp_oow_rate_limited(twsk_net(tw), skb, mib_idx,
42 				  &tcptw->tw_last_oow_ack_time)) {
43 		/* Send ACK. Note, we do not put the bucket,
44 		 * it will be released by caller.
45 		 */
46 		return TCP_TW_ACK;
47 	}
48 
49 	/* We are rate-limiting, so just release the tw sock and drop skb. */
50 	inet_twsk_put(tw);
51 	return TCP_TW_SUCCESS;
52 }
53 
54 /*
55  * * Main purpose of TIME-WAIT state is to close connection gracefully,
56  *   when one of ends sits in LAST-ACK or CLOSING retransmitting FIN
57  *   (and, probably, tail of data) and one or more our ACKs are lost.
58  * * What is TIME-WAIT timeout? It is associated with maximal packet
59  *   lifetime in the internet, which results in wrong conclusion, that
60  *   it is set to catch "old duplicate segments" wandering out of their path.
61  *   It is not quite correct. This timeout is calculated so that it exceeds
62  *   maximal retransmission timeout enough to allow to lose one (or more)
63  *   segments sent by peer and our ACKs. This time may be calculated from RTO.
64  * * When TIME-WAIT socket receives RST, it means that another end
65  *   finally closed and we are allowed to kill TIME-WAIT too.
66  * * Second purpose of TIME-WAIT is catching old duplicate segments.
67  *   Well, certainly it is pure paranoia, but if we load TIME-WAIT
68  *   with this semantics, we MUST NOT kill TIME-WAIT state with RSTs.
69  * * If we invented some more clever way to catch duplicates
70  *   (f.e. based on PAWS), we could truncate TIME-WAIT to several RTOs.
71  *
72  * The algorithm below is based on FORMAL INTERPRETATION of RFCs.
73  * When you compare it to RFCs, please, read section SEGMENT ARRIVES
74  * from the very beginning.
75  *
76  * NOTE. With recycling (and later with fin-wait-2) TW bucket
77  * is _not_ stateless. It means, that strictly speaking we must
78  * spinlock it. I do not want! Well, probability of misbehaviour
79  * is ridiculously low and, seems, we could use some mb() tricks
80  * to avoid misread sequence numbers, states etc.  --ANK
81  *
82  * We don't need to initialize tmp_out.sack_ok as we don't use the results
83  */
84 enum tcp_tw_status
tcp_timewait_state_process(struct inet_timewait_sock * tw,struct sk_buff * skb,const struct tcphdr * th)85 tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
86 			   const struct tcphdr *th)
87 {
88 	struct tcp_options_received tmp_opt;
89 	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
90 	bool paws_reject = false;
91 
92 	tmp_opt.saw_tstamp = 0;
93 	if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
94 		tcp_parse_options(twsk_net(tw), skb, &tmp_opt, 0, NULL);
95 
96 		if (tmp_opt.saw_tstamp) {
97 			if (tmp_opt.rcv_tsecr)
98 				tmp_opt.rcv_tsecr -= tcptw->tw_ts_offset;
99 			tmp_opt.ts_recent	= tcptw->tw_ts_recent;
100 			tmp_opt.ts_recent_stamp	= tcptw->tw_ts_recent_stamp;
101 			paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
102 		}
103 	}
104 
105 	if (tw->tw_substate == TCP_FIN_WAIT2) {
106 		/* Just repeat all the checks of tcp_rcv_state_process() */
107 
108 		/* Out of window, send ACK */
109 		if (paws_reject ||
110 		    !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
111 				   tcptw->tw_rcv_nxt,
112 				   tcptw->tw_rcv_nxt + tcptw->tw_rcv_wnd))
113 			return tcp_timewait_check_oow_rate_limit(
114 				tw, skb, LINUX_MIB_TCPACKSKIPPEDFINWAIT2);
115 
116 		if (th->rst)
117 			goto kill;
118 
119 		if (th->syn && !before(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt))
120 			return TCP_TW_RST;
121 
122 		/* Dup ACK? */
123 		if (!th->ack ||
124 		    !after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
125 		    TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
126 			inet_twsk_put(tw);
127 			return TCP_TW_SUCCESS;
128 		}
129 
130 		/* New data or FIN. If new data arrive after half-duplex close,
131 		 * reset.
132 		 */
133 		if (!th->fin ||
134 		    TCP_SKB_CB(skb)->end_seq != tcptw->tw_rcv_nxt + 1)
135 			return TCP_TW_RST;
136 
137 		/* FIN arrived, enter true time-wait state. */
138 		tw->tw_substate	  = TCP_TIME_WAIT;
139 		tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
140 		if (tmp_opt.saw_tstamp) {
141 			tcptw->tw_ts_recent_stamp = ktime_get_seconds();
142 			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
143 		}
144 
145 		inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
146 		return TCP_TW_ACK;
147 	}
148 
149 	/*
150 	 *	Now real TIME-WAIT state.
151 	 *
152 	 *	RFC 1122:
153 	 *	"When a connection is [...] on TIME-WAIT state [...]
154 	 *	[a TCP] MAY accept a new SYN from the remote TCP to
155 	 *	reopen the connection directly, if it:
156 	 *
157 	 *	(1)  assigns its initial sequence number for the new
158 	 *	connection to be larger than the largest sequence
159 	 *	number it used on the previous connection incarnation,
160 	 *	and
161 	 *
162 	 *	(2)  returns to TIME-WAIT state if the SYN turns out
163 	 *	to be an old duplicate".
164 	 */
165 
166 	if (!paws_reject &&
167 	    (TCP_SKB_CB(skb)->seq == tcptw->tw_rcv_nxt &&
168 	     (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq || th->rst))) {
169 		/* In window segment, it may be only reset or bare ack. */
170 
171 		if (th->rst) {
172 			/* This is TIME_WAIT assassination, in two flavors.
173 			 * Oh well... nobody has a sufficient solution to this
174 			 * protocol bug yet.
175 			 */
176 			if (!READ_ONCE(twsk_net(tw)->ipv4.sysctl_tcp_rfc1337)) {
177 kill:
178 				inet_twsk_deschedule_put(tw);
179 				return TCP_TW_SUCCESS;
180 			}
181 		} else {
182 			inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
183 		}
184 
185 		if (tmp_opt.saw_tstamp) {
186 			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
187 			tcptw->tw_ts_recent_stamp = ktime_get_seconds();
188 		}
189 
190 		inet_twsk_put(tw);
191 		return TCP_TW_SUCCESS;
192 	}
193 
194 	/* Out of window segment.
195 
196 	   All the segments are ACKed immediately.
197 
198 	   The only exception is new SYN. We accept it, if it is
199 	   not old duplicate and we are not in danger to be killed
200 	   by delayed old duplicates. RFC check is that it has
201 	   newer sequence number works at rates <40Mbit/sec.
202 	   However, if paws works, it is reliable AND even more,
203 	   we even may relax silly seq space cutoff.
204 
205 	   RED-PEN: we violate main RFC requirement, if this SYN will appear
206 	   old duplicate (i.e. we receive RST in reply to SYN-ACK),
207 	   we must return socket to time-wait state. It is not good,
208 	   but not fatal yet.
209 	 */
210 
211 	if (th->syn && !th->rst && !th->ack && !paws_reject &&
212 	    (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) ||
213 	     (tmp_opt.saw_tstamp &&
214 	      (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) {
215 		u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
216 		if (isn == 0)
217 			isn++;
218 		TCP_SKB_CB(skb)->tcp_tw_isn = isn;
219 		return TCP_TW_SYN;
220 	}
221 
222 	if (paws_reject)
223 		__NET_INC_STATS(twsk_net(tw), LINUX_MIB_PAWSESTABREJECTED);
224 
225 	if (!th->rst) {
226 		/* In this case we must reset the TIMEWAIT timer.
227 		 *
228 		 * If it is ACKless SYN it may be both old duplicate
229 		 * and new good SYN with random sequence number <rcv_nxt.
230 		 * Do not reschedule in the last case.
231 		 */
232 		if (paws_reject || th->ack)
233 			inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
234 
235 		return tcp_timewait_check_oow_rate_limit(
236 			tw, skb, LINUX_MIB_TCPACKSKIPPEDTIMEWAIT);
237 	}
238 	inet_twsk_put(tw);
239 	return TCP_TW_SUCCESS;
240 }
241 EXPORT_SYMBOL(tcp_timewait_state_process);
242 
tcp_time_wait_init(struct sock * sk,struct tcp_timewait_sock * tcptw)243 static void tcp_time_wait_init(struct sock *sk, struct tcp_timewait_sock *tcptw)
244 {
245 #ifdef CONFIG_TCP_MD5SIG
246 	const struct tcp_sock *tp = tcp_sk(sk);
247 	struct tcp_md5sig_key *key;
248 
249 	/*
250 	 * The timewait bucket does not have the key DB from the
251 	 * sock structure. We just make a quick copy of the
252 	 * md5 key being used (if indeed we are using one)
253 	 * so the timewait ack generating code has the key.
254 	 */
255 	tcptw->tw_md5_key = NULL;
256 	if (!static_branch_unlikely(&tcp_md5_needed.key))
257 		return;
258 
259 	key = tp->af_specific->md5_lookup(sk, sk);
260 	if (key) {
261 		tcptw->tw_md5_key = kmemdup(key, sizeof(*key), GFP_ATOMIC);
262 		if (!tcptw->tw_md5_key)
263 			return;
264 		if (!tcp_alloc_md5sig_pool())
265 			goto out_free;
266 		if (!static_key_fast_inc_not_disabled(&tcp_md5_needed.key.key))
267 			goto out_free;
268 	}
269 	return;
270 out_free:
271 	WARN_ON_ONCE(1);
272 	kfree(tcptw->tw_md5_key);
273 	tcptw->tw_md5_key = NULL;
274 #endif
275 }
276 
277 /*
278  * Move a socket to time-wait or dead fin-wait-2 state.
279  */
tcp_time_wait(struct sock * sk,int state,int timeo)280 void tcp_time_wait(struct sock *sk, int state, int timeo)
281 {
282 	const struct inet_connection_sock *icsk = inet_csk(sk);
283 	const struct tcp_sock *tp = tcp_sk(sk);
284 	struct net *net = sock_net(sk);
285 	struct inet_timewait_sock *tw;
286 
287 	tw = inet_twsk_alloc(sk, &net->ipv4.tcp_death_row, state);
288 
289 	if (tw) {
290 		struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
291 		const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
292 
293 		tw->tw_transparent	= inet_test_bit(TRANSPARENT, sk);
294 		tw->tw_mark		= sk->sk_mark;
295 		tw->tw_priority		= sk->sk_priority;
296 		tw->tw_rcv_wscale	= tp->rx_opt.rcv_wscale;
297 		tcptw->tw_rcv_nxt	= tp->rcv_nxt;
298 		tcptw->tw_snd_nxt	= tp->snd_nxt;
299 		tcptw->tw_rcv_wnd	= tcp_receive_window(tp);
300 		tcptw->tw_ts_recent	= tp->rx_opt.ts_recent;
301 		tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
302 		tcptw->tw_ts_offset	= tp->tsoffset;
303 		tcptw->tw_last_oow_ack_time = 0;
304 		tcptw->tw_tx_delay	= tp->tcp_tx_delay;
305 		tw->tw_txhash		= sk->sk_txhash;
306 #if IS_ENABLED(CONFIG_IPV6)
307 		if (tw->tw_family == PF_INET6) {
308 			struct ipv6_pinfo *np = inet6_sk(sk);
309 
310 			tw->tw_v6_daddr = sk->sk_v6_daddr;
311 			tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
312 			tw->tw_tclass = np->tclass;
313 			tw->tw_flowlabel = be32_to_cpu(np->flow_label & IPV6_FLOWLABEL_MASK);
314 			tw->tw_ipv6only = sk->sk_ipv6only;
315 		}
316 #endif
317 
318 		tcp_time_wait_init(sk, tcptw);
319 
320 		/* Get the TIME_WAIT timeout firing. */
321 		if (timeo < rto)
322 			timeo = rto;
323 
324 		if (state == TCP_TIME_WAIT)
325 			timeo = TCP_TIMEWAIT_LEN;
326 
327 		/* tw_timer is pinned, so we need to make sure BH are disabled
328 		 * in following section, otherwise timer handler could run before
329 		 * we complete the initialization.
330 		 */
331 		local_bh_disable();
332 		inet_twsk_schedule(tw, timeo);
333 		/* Linkage updates.
334 		 * Note that access to tw after this point is illegal.
335 		 */
336 		inet_twsk_hashdance(tw, sk, net->ipv4.tcp_death_row.hashinfo);
337 		local_bh_enable();
338 	} else {
339 		/* Sorry, if we're out of memory, just CLOSE this
340 		 * socket up.  We've got bigger problems than
341 		 * non-graceful socket closings.
342 		 */
343 		NET_INC_STATS(net, LINUX_MIB_TCPTIMEWAITOVERFLOW);
344 	}
345 
346 	tcp_update_metrics(sk);
347 	tcp_done(sk);
348 }
349 EXPORT_SYMBOL(tcp_time_wait);
350 
tcp_twsk_destructor(struct sock * sk)351 void tcp_twsk_destructor(struct sock *sk)
352 {
353 #ifdef CONFIG_TCP_MD5SIG
354 	if (static_branch_unlikely(&tcp_md5_needed.key)) {
355 		struct tcp_timewait_sock *twsk = tcp_twsk(sk);
356 
357 		if (twsk->tw_md5_key) {
358 			kfree_rcu(twsk->tw_md5_key, rcu);
359 			static_branch_slow_dec_deferred(&tcp_md5_needed);
360 		}
361 	}
362 #endif
363 }
364 EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
365 
tcp_twsk_purge(struct list_head * net_exit_list,int family)366 void tcp_twsk_purge(struct list_head *net_exit_list, int family)
367 {
368 	bool purged_once = false;
369 	struct net *net;
370 
371 	list_for_each_entry(net, net_exit_list, exit_list) {
372 		if (net->ipv4.tcp_death_row.hashinfo->pernet) {
373 			/* Even if tw_refcount == 1, we must clean up kernel reqsk */
374 			inet_twsk_purge(net->ipv4.tcp_death_row.hashinfo, family);
375 		} else if (!purged_once) {
376 			/* The last refcount is decremented in tcp_sk_exit_batch() */
377 			if (refcount_read(&net->ipv4.tcp_death_row.tw_refcount) == 1)
378 				continue;
379 
380 			inet_twsk_purge(&tcp_hashinfo, family);
381 			purged_once = true;
382 		}
383 	}
384 }
385 EXPORT_SYMBOL_GPL(tcp_twsk_purge);
386 
387 /* Warning : This function is called without sk_listener being locked.
388  * Be sure to read socket fields once, as their value could change under us.
389  */
tcp_openreq_init_rwin(struct request_sock * req,const struct sock * sk_listener,const struct dst_entry * dst)390 void tcp_openreq_init_rwin(struct request_sock *req,
391 			   const struct sock *sk_listener,
392 			   const struct dst_entry *dst)
393 {
394 	struct inet_request_sock *ireq = inet_rsk(req);
395 	const struct tcp_sock *tp = tcp_sk(sk_listener);
396 	int full_space = tcp_full_space(sk_listener);
397 	u32 window_clamp;
398 	__u8 rcv_wscale;
399 	u32 rcv_wnd;
400 	int mss;
401 
402 	mss = tcp_mss_clamp(tp, dst_metric_advmss(dst));
403 	window_clamp = READ_ONCE(tp->window_clamp);
404 	/* Set this up on the first call only */
405 	req->rsk_window_clamp = window_clamp ? : dst_metric(dst, RTAX_WINDOW);
406 
407 	/* limit the window selection if the user enforce a smaller rx buffer */
408 	if (sk_listener->sk_userlocks & SOCK_RCVBUF_LOCK &&
409 	    (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
410 		req->rsk_window_clamp = full_space;
411 
412 	rcv_wnd = tcp_rwnd_init_bpf((struct sock *)req);
413 	if (rcv_wnd == 0)
414 		rcv_wnd = dst_metric(dst, RTAX_INITRWND);
415 	else if (full_space < rcv_wnd * mss)
416 		full_space = rcv_wnd * mss;
417 
418 	/* tcp_full_space because it is guaranteed to be the first packet */
419 	tcp_select_initial_window(sk_listener, full_space,
420 		mss - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
421 		&req->rsk_rcv_wnd,
422 		&req->rsk_window_clamp,
423 		ireq->wscale_ok,
424 		&rcv_wscale,
425 		rcv_wnd);
426 	ireq->rcv_wscale = rcv_wscale;
427 }
428 EXPORT_SYMBOL(tcp_openreq_init_rwin);
429 
tcp_ecn_openreq_child(struct tcp_sock * tp,const struct request_sock * req)430 static void tcp_ecn_openreq_child(struct tcp_sock *tp,
431 				  const struct request_sock *req)
432 {
433 	tp->ecn_flags = inet_rsk(req)->ecn_ok ? TCP_ECN_OK : 0;
434 }
435 
tcp_ca_openreq_child(struct sock * sk,const struct dst_entry * dst)436 void tcp_ca_openreq_child(struct sock *sk, const struct dst_entry *dst)
437 {
438 	struct inet_connection_sock *icsk = inet_csk(sk);
439 	u32 ca_key = dst_metric(dst, RTAX_CC_ALGO);
440 	bool ca_got_dst = false;
441 
442 	if (ca_key != TCP_CA_UNSPEC) {
443 		const struct tcp_congestion_ops *ca;
444 
445 		rcu_read_lock();
446 		ca = tcp_ca_find_key(ca_key);
447 		if (likely(ca && bpf_try_module_get(ca, ca->owner))) {
448 			icsk->icsk_ca_dst_locked = tcp_ca_dst_locked(dst);
449 			icsk->icsk_ca_ops = ca;
450 			ca_got_dst = true;
451 		}
452 		rcu_read_unlock();
453 	}
454 
455 	/* If no valid choice made yet, assign current system default ca. */
456 	if (!ca_got_dst &&
457 	    (!icsk->icsk_ca_setsockopt ||
458 	     !bpf_try_module_get(icsk->icsk_ca_ops, icsk->icsk_ca_ops->owner)))
459 		tcp_assign_congestion_control(sk);
460 
461 	tcp_set_ca_state(sk, TCP_CA_Open);
462 }
463 EXPORT_SYMBOL_GPL(tcp_ca_openreq_child);
464 
smc_check_reset_syn_req(const struct tcp_sock * oldtp,struct request_sock * req,struct tcp_sock * newtp)465 static void smc_check_reset_syn_req(const struct tcp_sock *oldtp,
466 				    struct request_sock *req,
467 				    struct tcp_sock *newtp)
468 {
469 #if IS_ENABLED(CONFIG_SMC)
470 	struct inet_request_sock *ireq;
471 
472 	if (static_branch_unlikely(&tcp_have_smc)) {
473 		ireq = inet_rsk(req);
474 		if (oldtp->syn_smc && !ireq->smc_ok)
475 			newtp->syn_smc = 0;
476 	}
477 #endif
478 }
479 
480 /* This is not only more efficient than what we used to do, it eliminates
481  * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM
482  *
483  * Actually, we could lots of memory writes here. tp of listening
484  * socket contains all necessary default parameters.
485  */
tcp_create_openreq_child(const struct sock * sk,struct request_sock * req,struct sk_buff * skb)486 struct sock *tcp_create_openreq_child(const struct sock *sk,
487 				      struct request_sock *req,
488 				      struct sk_buff *skb)
489 {
490 	struct sock *newsk = inet_csk_clone_lock(sk, req, GFP_ATOMIC);
491 	const struct inet_request_sock *ireq = inet_rsk(req);
492 	struct tcp_request_sock *treq = tcp_rsk(req);
493 	struct inet_connection_sock *newicsk;
494 	const struct tcp_sock *oldtp;
495 	struct tcp_sock *newtp;
496 	u32 seq;
497 
498 	if (!newsk)
499 		return NULL;
500 
501 	newicsk = inet_csk(newsk);
502 	newtp = tcp_sk(newsk);
503 	oldtp = tcp_sk(sk);
504 
505 	smc_check_reset_syn_req(oldtp, req, newtp);
506 
507 	/* Now setup tcp_sock */
508 	newtp->pred_flags = 0;
509 
510 	seq = treq->rcv_isn + 1;
511 	newtp->rcv_wup = seq;
512 	WRITE_ONCE(newtp->copied_seq, seq);
513 	WRITE_ONCE(newtp->rcv_nxt, seq);
514 	newtp->segs_in = 1;
515 
516 	seq = treq->snt_isn + 1;
517 	newtp->snd_sml = newtp->snd_una = seq;
518 	WRITE_ONCE(newtp->snd_nxt, seq);
519 	newtp->snd_up = seq;
520 
521 	INIT_LIST_HEAD(&newtp->tsq_node);
522 	INIT_LIST_HEAD(&newtp->tsorted_sent_queue);
523 
524 	tcp_init_wl(newtp, treq->rcv_isn);
525 
526 	minmax_reset(&newtp->rtt_min, tcp_jiffies32, ~0U);
527 	newicsk->icsk_ack.lrcvtime = tcp_jiffies32;
528 
529 	newtp->lsndtime = tcp_jiffies32;
530 	newsk->sk_txhash = READ_ONCE(treq->txhash);
531 	newtp->total_retrans = req->num_retrans;
532 
533 	tcp_init_xmit_timers(newsk);
534 	WRITE_ONCE(newtp->write_seq, newtp->pushed_seq = treq->snt_isn + 1);
535 
536 	if (sock_flag(newsk, SOCK_KEEPOPEN))
537 		inet_csk_reset_keepalive_timer(newsk,
538 					       keepalive_time_when(newtp));
539 
540 	newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
541 	newtp->rx_opt.sack_ok = ireq->sack_ok;
542 	newtp->window_clamp = req->rsk_window_clamp;
543 	newtp->rcv_ssthresh = req->rsk_rcv_wnd;
544 	newtp->rcv_wnd = req->rsk_rcv_wnd;
545 	newtp->rx_opt.wscale_ok = ireq->wscale_ok;
546 	if (newtp->rx_opt.wscale_ok) {
547 		newtp->rx_opt.snd_wscale = ireq->snd_wscale;
548 		newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
549 	} else {
550 		newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
551 		newtp->window_clamp = min(newtp->window_clamp, 65535U);
552 	}
553 	newtp->snd_wnd = ntohs(tcp_hdr(skb)->window) << newtp->rx_opt.snd_wscale;
554 	newtp->max_window = newtp->snd_wnd;
555 
556 	if (newtp->rx_opt.tstamp_ok) {
557 		newtp->rx_opt.ts_recent = READ_ONCE(req->ts_recent);
558 		newtp->rx_opt.ts_recent_stamp = ktime_get_seconds();
559 		newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
560 	} else {
561 		newtp->rx_opt.ts_recent_stamp = 0;
562 		newtp->tcp_header_len = sizeof(struct tcphdr);
563 	}
564 	if (req->num_timeout) {
565 		newtp->undo_marker = treq->snt_isn;
566 		newtp->retrans_stamp = div_u64(treq->snt_synack,
567 					       USEC_PER_SEC / TCP_TS_HZ);
568 	}
569 	newtp->tsoffset = treq->ts_off;
570 #ifdef CONFIG_TCP_MD5SIG
571 	newtp->md5sig_info = NULL;	/*XXX*/
572 #endif
573 	if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
574 		newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
575 	newtp->rx_opt.mss_clamp = req->mss;
576 	tcp_ecn_openreq_child(newtp, req);
577 	newtp->fastopen_req = NULL;
578 	RCU_INIT_POINTER(newtp->fastopen_rsk, NULL);
579 
580 	newtp->bpf_chg_cc_inprogress = 0;
581 	tcp_bpf_clone(sk, newsk);
582 
583 	__TCP_INC_STATS(sock_net(sk), TCP_MIB_PASSIVEOPENS);
584 
585 	return newsk;
586 }
587 EXPORT_SYMBOL(tcp_create_openreq_child);
588 
589 /*
590  * Process an incoming packet for SYN_RECV sockets represented as a
591  * request_sock. Normally sk is the listener socket but for TFO it
592  * points to the child socket.
593  *
594  * XXX (TFO) - The current impl contains a special check for ack
595  * validation and inside tcp_v4_reqsk_send_ack(). Can we do better?
596  *
597  * We don't need to initialize tmp_opt.sack_ok as we don't use the results
598  *
599  * Note: If @fastopen is true, this can be called from process context.
600  *       Otherwise, this is from BH context.
601  */
602 
tcp_check_req(struct sock * sk,struct sk_buff * skb,struct request_sock * req,bool fastopen,bool * req_stolen)603 struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
604 			   struct request_sock *req,
605 			   bool fastopen, bool *req_stolen)
606 {
607 	struct tcp_options_received tmp_opt;
608 	struct sock *child;
609 	const struct tcphdr *th = tcp_hdr(skb);
610 	__be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
611 	bool paws_reject = false;
612 	bool own_req;
613 
614 	tmp_opt.saw_tstamp = 0;
615 	if (th->doff > (sizeof(struct tcphdr)>>2)) {
616 		tcp_parse_options(sock_net(sk), skb, &tmp_opt, 0, NULL);
617 
618 		if (tmp_opt.saw_tstamp) {
619 			tmp_opt.ts_recent = READ_ONCE(req->ts_recent);
620 			if (tmp_opt.rcv_tsecr)
621 				tmp_opt.rcv_tsecr -= tcp_rsk(req)->ts_off;
622 			/* We do not store true stamp, but it is not required,
623 			 * it can be estimated (approximately)
624 			 * from another data.
625 			 */
626 			tmp_opt.ts_recent_stamp = ktime_get_seconds() - reqsk_timeout(req, TCP_RTO_MAX) / HZ;
627 			paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
628 		}
629 	}
630 
631 	/* Check for pure retransmitted SYN. */
632 	if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
633 	    flg == TCP_FLAG_SYN &&
634 	    !paws_reject) {
635 		/*
636 		 * RFC793 draws (Incorrectly! It was fixed in RFC1122)
637 		 * this case on figure 6 and figure 8, but formal
638 		 * protocol description says NOTHING.
639 		 * To be more exact, it says that we should send ACK,
640 		 * because this segment (at least, if it has no data)
641 		 * is out of window.
642 		 *
643 		 *  CONCLUSION: RFC793 (even with RFC1122) DOES NOT
644 		 *  describe SYN-RECV state. All the description
645 		 *  is wrong, we cannot believe to it and should
646 		 *  rely only on common sense and implementation
647 		 *  experience.
648 		 *
649 		 * Enforce "SYN-ACK" according to figure 8, figure 6
650 		 * of RFC793, fixed by RFC1122.
651 		 *
652 		 * Note that even if there is new data in the SYN packet
653 		 * they will be thrown away too.
654 		 *
655 		 * Reset timer after retransmitting SYNACK, similar to
656 		 * the idea of fast retransmit in recovery.
657 		 */
658 		if (!tcp_oow_rate_limited(sock_net(sk), skb,
659 					  LINUX_MIB_TCPACKSKIPPEDSYNRECV,
660 					  &tcp_rsk(req)->last_oow_ack_time) &&
661 
662 		    !inet_rtx_syn_ack(sk, req)) {
663 			unsigned long expires = jiffies;
664 
665 			expires += reqsk_timeout(req, TCP_RTO_MAX);
666 			if (!fastopen)
667 				mod_timer_pending(&req->rsk_timer, expires);
668 			else
669 				req->rsk_timer.expires = expires;
670 		}
671 		return NULL;
672 	}
673 
674 	/* Further reproduces section "SEGMENT ARRIVES"
675 	   for state SYN-RECEIVED of RFC793.
676 	   It is broken, however, it does not work only
677 	   when SYNs are crossed.
678 
679 	   You would think that SYN crossing is impossible here, since
680 	   we should have a SYN_SENT socket (from connect()) on our end,
681 	   but this is not true if the crossed SYNs were sent to both
682 	   ends by a malicious third party.  We must defend against this,
683 	   and to do that we first verify the ACK (as per RFC793, page
684 	   36) and reset if it is invalid.  Is this a true full defense?
685 	   To convince ourselves, let us consider a way in which the ACK
686 	   test can still pass in this 'malicious crossed SYNs' case.
687 	   Malicious sender sends identical SYNs (and thus identical sequence
688 	   numbers) to both A and B:
689 
690 		A: gets SYN, seq=7
691 		B: gets SYN, seq=7
692 
693 	   By our good fortune, both A and B select the same initial
694 	   send sequence number of seven :-)
695 
696 		A: sends SYN|ACK, seq=7, ack_seq=8
697 		B: sends SYN|ACK, seq=7, ack_seq=8
698 
699 	   So we are now A eating this SYN|ACK, ACK test passes.  So
700 	   does sequence test, SYN is truncated, and thus we consider
701 	   it a bare ACK.
702 
703 	   If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this
704 	   bare ACK.  Otherwise, we create an established connection.  Both
705 	   ends (listening sockets) accept the new incoming connection and try
706 	   to talk to each other. 8-)
707 
708 	   Note: This case is both harmless, and rare.  Possibility is about the
709 	   same as us discovering intelligent life on another plant tomorrow.
710 
711 	   But generally, we should (RFC lies!) to accept ACK
712 	   from SYNACK both here and in tcp_rcv_state_process().
713 	   tcp_rcv_state_process() does not, hence, we do not too.
714 
715 	   Note that the case is absolutely generic:
716 	   we cannot optimize anything here without
717 	   violating protocol. All the checks must be made
718 	   before attempt to create socket.
719 	 */
720 
721 	/* RFC793 page 36: "If the connection is in any non-synchronized state ...
722 	 *                  and the incoming segment acknowledges something not yet
723 	 *                  sent (the segment carries an unacceptable ACK) ...
724 	 *                  a reset is sent."
725 	 *
726 	 * Invalid ACK: reset will be sent by listening socket.
727 	 * Note that the ACK validity check for a Fast Open socket is done
728 	 * elsewhere and is checked directly against the child socket rather
729 	 * than req because user data may have been sent out.
730 	 */
731 	if ((flg & TCP_FLAG_ACK) && !fastopen &&
732 	    (TCP_SKB_CB(skb)->ack_seq !=
733 	     tcp_rsk(req)->snt_isn + 1))
734 		return sk;
735 
736 	/* Also, it would be not so bad idea to check rcv_tsecr, which
737 	 * is essentially ACK extension and too early or too late values
738 	 * should cause reset in unsynchronized states.
739 	 */
740 
741 	/* RFC793: "first check sequence number". */
742 
743 	if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
744 					  tcp_rsk(req)->rcv_nxt, tcp_rsk(req)->rcv_nxt + req->rsk_rcv_wnd)) {
745 		/* Out of window: send ACK and drop. */
746 		if (!(flg & TCP_FLAG_RST) &&
747 		    !tcp_oow_rate_limited(sock_net(sk), skb,
748 					  LINUX_MIB_TCPACKSKIPPEDSYNRECV,
749 					  &tcp_rsk(req)->last_oow_ack_time))
750 			req->rsk_ops->send_ack(sk, skb, req);
751 		if (paws_reject)
752 			NET_INC_STATS(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
753 		return NULL;
754 	}
755 
756 	/* In sequence, PAWS is OK. */
757 
758 	/* TODO: We probably should defer ts_recent change once
759 	 * we take ownership of @req.
760 	 */
761 	if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt))
762 		WRITE_ONCE(req->ts_recent, tmp_opt.rcv_tsval);
763 
764 	if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
765 		/* Truncate SYN, it is out of window starting
766 		   at tcp_rsk(req)->rcv_isn + 1. */
767 		flg &= ~TCP_FLAG_SYN;
768 	}
769 
770 	/* RFC793: "second check the RST bit" and
771 	 *	   "fourth, check the SYN bit"
772 	 */
773 	if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
774 		TCP_INC_STATS(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
775 		goto embryonic_reset;
776 	}
777 
778 	/* ACK sequence verified above, just make sure ACK is
779 	 * set.  If ACK not set, just silently drop the packet.
780 	 *
781 	 * XXX (TFO) - if we ever allow "data after SYN", the
782 	 * following check needs to be removed.
783 	 */
784 	if (!(flg & TCP_FLAG_ACK))
785 		return NULL;
786 
787 	/* For Fast Open no more processing is needed (sk is the
788 	 * child socket).
789 	 */
790 	if (fastopen)
791 		return sk;
792 
793 	/* While TCP_DEFER_ACCEPT is active, drop bare ACK. */
794 	if (req->num_timeout < READ_ONCE(inet_csk(sk)->icsk_accept_queue.rskq_defer_accept) &&
795 	    TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
796 		inet_rsk(req)->acked = 1;
797 		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPDEFERACCEPTDROP);
798 		return NULL;
799 	}
800 
801 	/* OK, ACK is valid, create big socket and
802 	 * feed this segment to it. It will repeat all
803 	 * the tests. THIS SEGMENT MUST MOVE SOCKET TO
804 	 * ESTABLISHED STATE. If it will be dropped after
805 	 * socket is created, wait for troubles.
806 	 */
807 	child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
808 							 req, &own_req);
809 	if (!child)
810 		goto listen_overflow;
811 
812 	if (own_req && rsk_drop_req(req)) {
813 		reqsk_queue_removed(&inet_csk(req->rsk_listener)->icsk_accept_queue, req);
814 		inet_csk_reqsk_queue_drop_and_put(req->rsk_listener, req);
815 		return child;
816 	}
817 
818 	sock_rps_save_rxhash(child, skb);
819 	tcp_synack_rtt_meas(child, req);
820 	*req_stolen = !own_req;
821 	return inet_csk_complete_hashdance(sk, child, req, own_req);
822 
823 listen_overflow:
824 	if (sk != req->rsk_listener)
825 		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMIGRATEREQFAILURE);
826 
827 	if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_abort_on_overflow)) {
828 		inet_rsk(req)->acked = 1;
829 		return NULL;
830 	}
831 
832 embryonic_reset:
833 	if (!(flg & TCP_FLAG_RST)) {
834 		/* Received a bad SYN pkt - for TFO We try not to reset
835 		 * the local connection unless it's really necessary to
836 		 * avoid becoming vulnerable to outside attack aiming at
837 		 * resetting legit local connections.
838 		 */
839 		req->rsk_ops->send_reset(sk, skb);
840 	} else if (fastopen) { /* received a valid RST pkt */
841 		reqsk_fastopen_remove(sk, req, true);
842 		tcp_reset(sk, skb);
843 	}
844 	if (!fastopen) {
845 		bool unlinked = inet_csk_reqsk_queue_drop(sk, req);
846 
847 		if (unlinked)
848 			__NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
849 		*req_stolen = !unlinked;
850 	}
851 	return NULL;
852 }
853 EXPORT_SYMBOL(tcp_check_req);
854 
855 /*
856  * Queue segment on the new socket if the new socket is active,
857  * otherwise we just shortcircuit this and continue with
858  * the new socket.
859  *
860  * For the vast majority of cases child->sk_state will be TCP_SYN_RECV
861  * when entering. But other states are possible due to a race condition
862  * where after __inet_lookup_established() fails but before the listener
863  * locked is obtained, other packets cause the same connection to
864  * be created.
865  */
866 
tcp_child_process(struct sock * parent,struct sock * child,struct sk_buff * skb)867 int tcp_child_process(struct sock *parent, struct sock *child,
868 		      struct sk_buff *skb)
869 	__releases(&((child)->sk_lock.slock))
870 {
871 	int ret = 0;
872 	int state = child->sk_state;
873 
874 	/* record sk_napi_id and sk_rx_queue_mapping of child. */
875 	sk_mark_napi_id_set(child, skb);
876 
877 	tcp_segs_in(tcp_sk(child), skb);
878 	if (!sock_owned_by_user(child)) {
879 		ret = tcp_rcv_state_process(child, skb);
880 		/* Wakeup parent, send SIGIO */
881 		if (state == TCP_SYN_RECV && child->sk_state != state)
882 			parent->sk_data_ready(parent);
883 	} else {
884 		/* Alas, it is possible again, because we do lookup
885 		 * in main socket hash table and lock on listening
886 		 * socket does not protect us more.
887 		 */
888 		__sk_add_backlog(child, skb);
889 	}
890 
891 	bh_unlock_sock(child);
892 	sock_put(child);
893 	return ret;
894 }
895 EXPORT_SYMBOL(tcp_child_process);
896