2 * INET An implementation of the TCP/IP protocol suite for the LINUX
3 * operating system. INET is implemented using the BSD Socket
4 * interface as the means of communication with the user level.
6 * Implementation of the Transmission Control Protocol(TCP).
8 * Version: $Id: tcp_ipv4.c,v 1.182 1999/07/05 01:34:07 davem Exp $
10 * IPv4 specific functions
15 * linux/ipv4/tcp_input.c
16 * linux/ipv4/tcp_output.c
18 * See tcp.c for author information
20 * This program is free software; you can redistribute it and/or
21 * modify it under the terms of the GNU General Public License
22 * as published by the Free Software Foundation; either version
23 * 2 of the License, or (at your option) any later version.
28 * David S. Miller : New socket lookup architecture.
29 * This code is dedicated to John Dyson.
30 * David S. Miller : Change semantics of established hash,
31 * half is devoted to TIME_WAIT sockets
32 * and the rest go in the other half.
33 * Andi Kleen : Add support for syncookies and fixed
34 * some bugs: ip options weren't passed to
35 * the TCP layer, missed a check for an ACK bit.
36 * Andi Kleen : Implemented fast path mtu discovery.
37 * Fixed many serious bugs in the
38 * open_request handling and moved
39 * most of it into the af independent code.
40 * Added tail drop and some other bugfixes.
41 * Added new listen sematics.
42 * Mike McLagan : Routing by source
43 * Juan Jose Ciarlante: ip_dynaddr bits
44 * Andi Kleen: various fixes.
45 * Vitaly E. Lavrov : Transparent proxy revived after year coma.
46 * Andi Kleen : Fix new listen.
47 * Andi Kleen : Fix accept error reporting.
50 #include <linux/config.h>
51 #include <linux/types.h>
52 #include <linux/fcntl.h>
53 #include <linux/random.h>
54 #include <linux/init.h>
55 #include <linux/ipsec.h>
61 #include <asm/segment.h>
63 #include <linux/inet.h>
64 #include <linux/stddef.h>
66 extern int sysctl_tcp_timestamps
;
67 extern int sysctl_tcp_window_scaling
;
68 extern int sysctl_tcp_sack
;
69 extern int sysctl_tcp_syncookies
;
70 extern int sysctl_ip_dynaddr
;
71 extern __u32 sysctl_wmem_max
;
72 extern __u32 sysctl_rmem_max
;
74 /* Check TCP sequence numbers in ICMP packets. */
75 #define ICMP_MIN_LENGTH 8
77 /* Socket used for sending RSTs */
78 struct inode tcp_inode
;
79 struct socket
*tcp_socket
=&tcp_inode
.u
.socket_i
;
81 static void tcp_v4_send_reset(struct sk_buff
*skb
);
83 void tcp_v4_send_check(struct sock
*sk
, struct tcphdr
*th
, int len
,
86 /* This is for sockets with full identity only. Sockets here will always
87 * be without wildcards and will have the following invariant:
88 * TCP_ESTABLISHED <= sk->state < TCP_CLOSE
90 * First half of the table is for sockets not in TIME_WAIT, second half
91 * is for TIME_WAIT sockets only.
93 struct sock
**tcp_ehash
;
96 /* Ok, let's try this, I give up, we do need a local binding
97 * TCP hash as well as the others for fast bind/connect.
99 struct tcp_bind_bucket
**tcp_bhash
;
102 /* All sockets in TCP_LISTEN state will be in here. This is the only table
103 * where wildcard'd TCP sockets can exist. Hash function here is just local
106 struct sock
*tcp_listening_hash
[TCP_LHTABLE_SIZE
];
108 /* Register cache. */
109 struct sock
*tcp_regs
[TCP_NUM_REGS
];
112 * This array holds the first and last local port number.
113 * For high-usage systems, use sysctl to change this to
116 int sysctl_local_port_range
[2] = { 1024, 4999 };
117 int tcp_port_rover
= (1024 - 1);
119 static __inline__
int tcp_hashfn(__u32 laddr
, __u16 lport
,
120 __u32 faddr
, __u16 fport
)
122 return ((laddr
^ lport
) ^ (faddr
^ fport
)) & ((tcp_ehash_size
>> 1) - 1);
125 static __inline__
int tcp_sk_hashfn(struct sock
*sk
)
127 __u32 laddr
= sk
->rcv_saddr
;
128 __u16 lport
= sk
->num
;
129 __u32 faddr
= sk
->daddr
;
130 __u16 fport
= sk
->dport
;
132 return tcp_hashfn(laddr
, lport
, faddr
, fport
);
135 /* Allocate and initialize a new TCP local port bind bucket.
136 * The sockhash lock must be held as a writer here.
138 struct tcp_bind_bucket
*tcp_bucket_create(unsigned short snum
)
140 struct tcp_bind_bucket
*tb
;
142 tb
= kmem_cache_alloc(tcp_bucket_cachep
, SLAB_ATOMIC
);
144 struct tcp_bind_bucket
**head
=
145 &tcp_bhash
[tcp_bhashfn(snum
)];
149 if((tb
->next
= *head
) != NULL
)
150 tb
->next
->pprev
= &tb
->next
;
157 #ifdef CONFIG_IP_TRANSPARENT_PROXY
158 /* Ensure that the bound bucket for the port exists.
159 * Return 0 on success.
161 static __inline__
int tcp_bucket_check(unsigned short snum
)
163 struct tcp_bind_bucket
*tb
;
166 SOCKHASH_LOCK_WRITE();
167 tb
= tcp_bhash
[tcp_bhashfn(snum
)];
168 for( ; (tb
&& (tb
->port
!= snum
)); tb
= tb
->next
)
172 if ((tb
= tcp_bucket_create(snum
)) == NULL
)
175 SOCKHASH_UNLOCK_WRITE();
181 static __inline__
void __tcp_inherit_port(struct sock
*sk
, struct sock
*child
)
183 struct tcp_bind_bucket
*tb
= (struct tcp_bind_bucket
*)sk
->prev
;
185 if ((child
->bind_next
= tb
->owners
) != NULL
)
186 tb
->owners
->bind_pprev
= &child
->bind_next
;
188 child
->bind_pprev
= &tb
->owners
;
189 child
->prev
= (struct sock
*) tb
;
192 __inline__
void tcp_inherit_port(struct sock
*sk
, struct sock
*child
)
194 SOCKHASH_LOCK_WRITE();
195 __tcp_inherit_port(sk
, child
);
196 SOCKHASH_UNLOCK_WRITE();
199 /* Obtain a reference to a local port for the given sock,
200 * if snum is zero it means select any available local port.
202 static int tcp_v4_get_port(struct sock
*sk
, unsigned short snum
)
204 struct tcp_bind_bucket
*tb
;
206 SOCKHASH_LOCK_WRITE();
208 int rover
= tcp_port_rover
;
209 int low
= sysctl_local_port_range
[0];
210 int high
= sysctl_local_port_range
[1];
211 int remaining
= (high
- low
) + 1;
214 if ((rover
< low
) || (rover
> high
))
216 tb
= tcp_bhash
[tcp_bhashfn(rover
)];
217 for ( ; tb
; tb
= tb
->next
)
218 if (tb
->port
== rover
)
222 } while (--remaining
> 0);
223 tcp_port_rover
= rover
;
225 /* Exhausted local port range during search? */
229 /* OK, here is the one we will use. */
233 for (tb
= tcp_bhash
[tcp_bhashfn(snum
)];
236 if (tb
->port
== snum
)
239 if (tb
!= NULL
&& tb
->owners
!= NULL
) {
240 if (tb
->fastreuse
!= 0 && sk
->reuse
!= 0) {
243 struct sock
*sk2
= tb
->owners
;
244 int sk_reuse
= sk
->reuse
;
246 for( ; sk2
!= NULL
; sk2
= sk2
->bind_next
) {
247 if (sk
->bound_dev_if
== sk2
->bound_dev_if
) {
250 sk2
->state
== TCP_LISTEN
) {
251 if (!sk2
->rcv_saddr
||
253 (sk2
->rcv_saddr
== sk
->rcv_saddr
))
258 /* If we found a conflict, fail. */
264 (tb
= tcp_bucket_create(snum
)) == NULL
)
266 if (tb
->owners
== NULL
) {
267 if (sk
->reuse
&& sk
->state
!= TCP_LISTEN
)
271 } else if (tb
->fastreuse
&&
272 ((sk
->reuse
== 0) || (sk
->state
== TCP_LISTEN
)))
276 if ((sk
->bind_next
= tb
->owners
) != NULL
)
277 tb
->owners
->bind_pprev
= &sk
->bind_next
;
279 sk
->bind_pprev
= &tb
->owners
;
280 sk
->prev
= (struct sock
*) tb
;
282 SOCKHASH_UNLOCK_WRITE();
286 SOCKHASH_UNLOCK_WRITE();
290 /* Get rid of any references to a local port held by the
293 __inline__
void __tcp_put_port(struct sock
*sk
)
295 struct tcp_bind_bucket
*tb
;
297 tb
= (struct tcp_bind_bucket
*) sk
->prev
;
299 sk
->bind_next
->bind_pprev
= sk
->bind_pprev
;
300 *(sk
->bind_pprev
) = sk
->bind_next
;
302 if (tb
->owners
== NULL
) {
304 tb
->next
->pprev
= tb
->pprev
;
305 *(tb
->pprev
) = tb
->next
;
306 kmem_cache_free(tcp_bucket_cachep
, tb
);
310 void tcp_put_port(struct sock
*sk
)
312 SOCKHASH_LOCK_WRITE();
314 SOCKHASH_UNLOCK_WRITE();
317 static __inline__
void __tcp_v4_hash(struct sock
*sk
)
321 if(sk
->state
== TCP_LISTEN
)
322 skp
= &tcp_listening_hash
[tcp_sk_listen_hashfn(sk
)];
324 skp
= &tcp_ehash
[(sk
->hashent
= tcp_sk_hashfn(sk
))];
326 if((sk
->next
= *skp
) != NULL
)
327 (*skp
)->pprev
= &sk
->next
;
331 if(sk
->prot
->highestinuse
< sk
->prot
->inuse
)
332 sk
->prot
->highestinuse
= sk
->prot
->inuse
;
335 static void tcp_v4_hash(struct sock
*sk
)
337 if (sk
->state
!= TCP_CLOSE
) {
338 SOCKHASH_LOCK_WRITE();
340 SOCKHASH_UNLOCK_WRITE();
344 static void tcp_v4_unhash(struct sock
*sk
)
346 SOCKHASH_LOCK_WRITE();
349 sk
->next
->pprev
= sk
->pprev
;
350 *sk
->pprev
= sk
->next
;
356 SOCKHASH_UNLOCK_WRITE();
359 /* Don't inline this cruft. Here are some nice properties to
360 * exploit here. The BSD API does not allow a listening TCP
361 * to specify the remote port nor the remote address for the
362 * connection. So always assume those are both wildcarded
363 * during the search since they can never be otherwise.
365 static struct sock
*tcp_v4_lookup_listener(u32 daddr
, unsigned short hnum
, int dif
)
368 struct sock
*result
= NULL
;
372 for(sk
= tcp_listening_hash
[tcp_lhashfn(hnum
)]; sk
; sk
= sk
->next
) {
373 if(sk
->num
== hnum
) {
374 __u32 rcv_saddr
= sk
->rcv_saddr
;
378 if (rcv_saddr
!= daddr
)
382 if (sk
->bound_dev_if
) {
383 if (sk
->bound_dev_if
!= dif
)
389 if (score
> hiscore
) {
398 /* Sockets in TCP_CLOSE state are _always_ taken out of the hash, so
399 * we need not check it for TCP lookups anymore, thanks Alexey. -DaveM
401 * The sockhash lock must be held as a reader here.
403 static inline struct sock
*__tcp_v4_lookup(u32 saddr
, u16 sport
,
404 u32 daddr
, u16 hnum
, int dif
)
406 TCP_V4_ADDR_COOKIE(acookie
, saddr
, daddr
)
407 __u32 ports
= TCP_COMBINED_PORTS(sport
, hnum
);
411 /* Check TCP register quick cache first. */
412 sk
= TCP_RHASH(sport
);
413 if(sk
&& TCP_IPV4_MATCH(sk
, acookie
, saddr
, daddr
, ports
, dif
))
416 /* Optimize here for direct hit, only listening connections can
417 * have wildcards anyways.
419 hash
= tcp_hashfn(daddr
, hnum
, saddr
, sport
);
420 for(sk
= tcp_ehash
[hash
]; sk
; sk
= sk
->next
) {
421 if(TCP_IPV4_MATCH(sk
, acookie
, saddr
, daddr
, ports
, dif
)) {
422 if (sk
->state
== TCP_ESTABLISHED
)
423 TCP_RHASH(sport
) = sk
;
424 goto hit
; /* You sunk my battleship! */
427 /* Must check for a TIME_WAIT'er before going to listener hash. */
428 for(sk
= tcp_ehash
[hash
+(tcp_ehash_size
>> 1)]; sk
; sk
= sk
->next
)
429 if(TCP_IPV4_MATCH(sk
, acookie
, saddr
, daddr
, ports
, dif
))
431 sk
= tcp_v4_lookup_listener(daddr
, hnum
, dif
);
436 __inline__
struct sock
*tcp_v4_lookup(u32 saddr
, u16 sport
, u32 daddr
, u16 dport
, int dif
)
440 SOCKHASH_LOCK_READ();
441 sk
= __tcp_v4_lookup(saddr
, sport
, daddr
, ntohs(dport
), dif
);
442 SOCKHASH_UNLOCK_READ();
447 #ifdef CONFIG_IP_TRANSPARENT_PROXY
448 /* Cleaned up a little and adapted to new bind bucket scheme.
449 * Oddly, this should increase performance here for
450 * transparent proxy, as tests within the inner loop have
451 * been eliminated. -DaveM
453 static struct sock
*tcp_v4_proxy_lookup(unsigned short num
, unsigned long raddr
,
454 unsigned short rnum
, unsigned long laddr
,
455 struct device
*dev
, unsigned short pnum
,
458 struct sock
*s
, *result
= NULL
;
461 unsigned short hnum
= ntohs(num
);
462 unsigned short hpnum
= ntohs(pnum
);
465 if(dev
&& dev
->ip_ptr
) {
466 struct in_device
*idev
= dev
->ip_ptr
;
469 paddr
= idev
->ifa_list
->ifa_local
;
472 /* We must obtain the sockhash lock here, we are always
475 SOCKHASH_LOCK_READ_BH();
477 struct tcp_bind_bucket
*tb
= tcp_bhash
[tcp_bhashfn(hnum
)];
478 for( ; (tb
&& tb
->port
!= hnum
); tb
= tb
->next
)
485 for(; s
; s
= s
->bind_next
) {
488 if((s
->num
!= hpnum
|| s
->rcv_saddr
!= paddr
) &&
489 (s
->num
!= hnum
|| s
->rcv_saddr
!= laddr
))
494 if(s
->daddr
!= raddr
)
503 if(s
->bound_dev_if
) {
504 if(s
->bound_dev_if
!= dif
)
508 if(score
== 4 && s
->num
== hnum
) {
511 } else if(score
> badness
&& (s
->num
== hpnum
|| s
->rcv_saddr
)) {
518 struct tcp_bind_bucket
*tb
= tcp_bhash
[tcp_bhashfn(hpnum
)];
519 for( ; (tb
&& tb
->port
!= hpnum
); tb
= tb
->next
)
527 SOCKHASH_UNLOCK_READ_BH();
530 #endif /* CONFIG_IP_TRANSPARENT_PROXY */
532 static inline __u32
tcp_v4_init_sequence(struct sock
*sk
, struct sk_buff
*skb
)
534 return secure_tcp_sequence_number(sk
->saddr
, sk
->daddr
,
539 /* Check that a TCP address is unique, don't allow multiple
540 * connects to/from the same address. Actually we can optimize
541 * quite a bit, since the socket about to connect is still
542 * in TCP_CLOSE, a tcp_bind_bucket for the local port he will
543 * use will exist, with a NULL owners list. So check for that.
544 * The good_socknum and verify_bind scheme we use makes this
547 static int tcp_v4_unique_address(struct sock
*sk
)
549 struct tcp_bind_bucket
*tb
;
550 unsigned short snum
= sk
->num
;
553 /* Freeze the hash while we snoop around. */
554 SOCKHASH_LOCK_READ();
555 tb
= tcp_bhash
[tcp_bhashfn(snum
)];
556 for(; tb
; tb
= tb
->next
) {
557 if(tb
->port
== snum
&& tb
->owners
!= NULL
) {
558 /* Almost certainly the re-use port case, search the real hashes
559 * so it actually scales.
561 sk
= __tcp_v4_lookup(sk
->daddr
, sk
->dport
,
562 sk
->rcv_saddr
, snum
, sk
->bound_dev_if
);
563 SOCKHASH_UNLOCK_READ();
565 if((sk
!= NULL
) && (sk
->state
!= TCP_LISTEN
))
570 SOCKHASH_UNLOCK_READ();
574 /* This will initiate an outgoing connection. */
575 int tcp_v4_connect(struct sock
*sk
, struct sockaddr
*uaddr
, int addr_len
)
577 struct tcp_opt
*tp
= &(sk
->tp_pinfo
.af_tcp
);
578 struct sockaddr_in
*usin
= (struct sockaddr_in
*) uaddr
;
579 struct sk_buff
*buff
;
584 if (sk
->state
!= TCP_CLOSE
)
587 /* Don't allow a double connect. */
591 if (addr_len
< sizeof(struct sockaddr_in
))
594 if (usin
->sin_family
!= AF_INET
) {
595 static int complained
;
596 if (usin
->sin_family
)
597 return(-EAFNOSUPPORT
);
599 printk(KERN_DEBUG
"%s forgot to set AF_INET in " __FUNCTION__
"\n", current
->comm
);
602 nexthop
= daddr
= usin
->sin_addr
.s_addr
;
603 if (sk
->opt
&& sk
->opt
->srr
) {
606 nexthop
= sk
->opt
->faddr
;
609 tmp
= ip_route_connect(&rt
, nexthop
, sk
->saddr
,
610 RT_TOS(sk
->ip_tos
)|RTO_CONN
|sk
->localroute
, sk
->bound_dev_if
);
614 if (rt
->rt_flags
&(RTCF_MULTICAST
|RTCF_BROADCAST
)) {
619 dst_release(xchg(&sk
->dst_cache
, rt
));
621 buff
= sock_wmalloc(sk
, (MAX_HEADER
+ sk
->prot
->max_header
),
627 /* Socket has no identity, so lock_sock() is useless. Also
628 * since state==TCP_CLOSE (checked above) the socket cannot
629 * possibly be in the hashes. TCP hash locking is only
630 * needed while checking quickly for a unique address.
631 * However, the socket does need to be (and is) locked
633 * Perhaps this addresses all of ANK's concerns. 8-) -DaveM
635 sk
->dport
= usin
->sin_port
;
636 sk
->daddr
= rt
->rt_dst
;
637 if (sk
->opt
&& sk
->opt
->srr
)
640 sk
->saddr
= rt
->rt_src
;
641 sk
->rcv_saddr
= sk
->saddr
;
643 if (!tcp_v4_unique_address(sk
)) {
646 return -EADDRNOTAVAIL
;
649 tp
->write_seq
= secure_tcp_sequence_number(sk
->saddr
, sk
->daddr
,
650 sk
->sport
, usin
->sin_port
);
652 tp
->ext_header_len
= 0;
654 tp
->ext_header_len
= sk
->opt
->optlen
;
656 /* Reset mss clamp */
659 if (!ip_dont_fragment(sk
, &rt
->u
.dst
) &&
660 rt
->u
.dst
.pmtu
> 576 && rt
->rt_dst
!= rt
->rt_gateway
) {
661 /* Clamp mss at maximum of 536 and user_mss.
662 Probably, user ordered to override tiny segment size
665 tp
->mss_clamp
= max(tp
->user_mss
, 536);
668 tcp_connect(sk
, buff
, rt
->u
.dst
.pmtu
);
672 static int tcp_v4_sendmsg(struct sock
*sk
, struct msghdr
*msg
, int len
)
674 int retval
= -EINVAL
;
676 /* Do sanity checking for sendmsg/sendto/send. */
677 if (msg
->msg_flags
& ~(MSG_OOB
|MSG_DONTROUTE
|MSG_DONTWAIT
|MSG_NOSIGNAL
))
680 struct sockaddr_in
*addr
=(struct sockaddr_in
*)msg
->msg_name
;
682 if (msg
->msg_namelen
< sizeof(*addr
))
684 if (addr
->sin_family
&& addr
->sin_family
!= AF_INET
)
687 if(sk
->state
== TCP_CLOSE
)
690 if (addr
->sin_port
!= sk
->dport
)
692 if (addr
->sin_addr
.s_addr
!= sk
->daddr
)
695 retval
= tcp_do_sendmsg(sk
, msg
);
703 * Do a linear search in the socket open_request list.
704 * This should be replaced with a global hash table.
706 static struct open_request
*tcp_v4_search_req(struct tcp_opt
*tp
,
709 struct open_request
**prevp
)
711 struct open_request
*req
, *prev
;
712 __u16 rport
= th
->source
;
714 /* assumption: the socket is not in use.
715 * as we checked the user count on tcp_rcv and we're
716 * running from a soft interrupt.
718 prev
= (struct open_request
*) (&tp
->syn_wait_queue
);
719 for (req
= prev
->dl_next
; req
; req
= req
->dl_next
) {
720 if (req
->af
.v4_req
.rmt_addr
== iph
->saddr
&&
721 req
->af
.v4_req
.loc_addr
== iph
->daddr
&&
722 req
->rmt_port
== rport
723 #ifdef CONFIG_IP_TRANSPARENT_PROXY
724 && req
->lcl_port
== th
->dest
737 * This routine does path mtu discovery as defined in RFC1191.
739 static inline void do_pmtu_discovery(struct sock
*sk
, struct iphdr
*ip
, unsigned mtu
)
741 struct tcp_opt
*tp
= &sk
->tp_pinfo
.af_tcp
;
743 /* We are not interested in TCP_LISTEN and open_requests (SYN-ACKs
744 * send out by Linux are always <576bytes so they should go through
747 if (sk
->state
== TCP_LISTEN
)
751 if(sk
->lock
.users
!= 0)
754 /* We don't check in the destentry if pmtu discovery is forbidden
755 * on this route. We just assume that no packet_to_big packets
756 * are send back when pmtu discovery is not active.
757 * There is a small race when the user changes this flag in the
758 * route, but I think that's acceptable.
760 if (sk
->dst_cache
== NULL
)
763 ip_rt_update_pmtu(sk
->dst_cache
, mtu
);
764 if (sk
->ip_pmtudisc
!= IP_PMTUDISC_DONT
&&
765 tp
->pmtu_cookie
> sk
->dst_cache
->pmtu
) {
766 tcp_sync_mss(sk
, sk
->dst_cache
->pmtu
);
768 /* Resend the TCP packet because it's
769 * clear that the old packet has been
770 * dropped. This is the new "fast" path mtu
773 tcp_simple_retransmit(sk
);
774 } /* else let the usual retransmit timer handle it */
780 * This routine is called by the ICMP module when it gets some
781 * sort of error condition. If err < 0 then the socket should
782 * be closed and the error returned to the user. If err > 0
783 * it's just the icmp type << 8 | icmp code. After adjustment
784 * header points to the first 8 bytes of the tcp header. We need
785 * to find the appropriate port.
787 * The locking strategy used here is very "optimistic". When
788 * someone else accesses the socket the ICMP is just dropped
789 * and for some paths there is no check at all.
790 * A more general error queue to queue errors for later handling
791 * is probably better.
793 * sk->err and sk->err_soft should be atomic_t.
796 void tcp_v4_err(struct sk_buff
*skb
, unsigned char *dp
, int len
)
798 struct iphdr
*iph
= (struct iphdr
*)dp
;
801 int type
= skb
->h
.icmph
->type
;
802 int code
= skb
->h
.icmph
->code
;
803 #if ICMP_MIN_LENGTH < 14
812 if (len
< (iph
->ihl
<< 2) + ICMP_MIN_LENGTH
) {
813 icmp_statistics
.IcmpInErrors
++;
816 #if ICMP_MIN_LENGTH < 14
817 if (len
< (iph
->ihl
<< 2) + 14)
821 th
= (struct tcphdr
*)(dp
+(iph
->ihl
<<2));
823 sk
= tcp_v4_lookup(iph
->daddr
, th
->dest
, iph
->saddr
, th
->source
, skb
->dev
->ifindex
);
824 if (sk
== NULL
|| sk
->state
== TCP_TIME_WAIT
) {
825 icmp_statistics
.IcmpInErrors
++;
829 tp
= &sk
->tp_pinfo
.af_tcp
;
830 seq
= ntohl(th
->seq
);
831 if (sk
->state
!= TCP_LISTEN
&& !between(seq
, tp
->snd_una
, tp
->snd_nxt
)) {
832 net_statistics
.OutOfWindowIcmps
++;
837 case ICMP_SOURCE_QUENCH
:
838 #ifndef OLD_SOURCE_QUENCH /* This is deprecated */
839 tp
->snd_ssthresh
= tcp_recalc_ssthresh(tp
);
840 tp
->snd_cwnd
= tp
->snd_ssthresh
;
841 tp
->snd_cwnd_cnt
= 0;
842 tp
->high_seq
= tp
->snd_nxt
;
845 case ICMP_PARAMETERPROB
:
848 case ICMP_DEST_UNREACH
:
849 if (code
> NR_ICMP_UNREACH
)
852 if (code
== ICMP_FRAG_NEEDED
) { /* PMTU discovery (RFC1191) */
853 do_pmtu_discovery(sk
, iph
, ntohs(skb
->h
.icmph
->un
.frag
.mtu
));
857 err
= icmp_err_convert
[code
].errno
;
859 case ICMP_TIME_EXCEEDED
:
867 struct open_request
*req
, *prev
;
869 /* The final ACK of the handshake should be already
870 * handled in the new socket context, not here.
871 * Strictly speaking - an ICMP error for the final
872 * ACK should set the opening flag, but that is too
873 * complicated right now.
875 if (!no_flags
&& !th
->syn
&& !th
->ack
)
878 /* Prevent race conditions with accept() -
879 * ICMP is unreliable.
882 if (sk
->lock
.users
!= 0) {
883 net_statistics
.LockDroppedIcmps
++;
884 /* If too many ICMPs get dropped on busy
885 * servers this needs to be solved differently.
890 req
= tcp_v4_search_req(tp
, iph
, th
, &prev
);
893 if (seq
!= req
->snt_isn
) {
894 net_statistics
.OutOfWindowIcmps
++;
899 * Already in ESTABLISHED and a big socket is created,
900 * set error code there.
901 * The error will _not_ be reported in the accept(),
902 * but only with the next operation on the socket after
909 * Still in SYN_RECV, just remove it silently.
910 * There is no good way to pass the error to the newly
911 * created socket, and POSIX does not want network
912 * errors returned from accept().
915 tcp_synq_unlink(tp
, req
, prev
);
916 req
->class->destructor(req
);
917 tcp_openreq_free(req
);
924 case TCP_SYN_RECV
: /* Cannot happen */
925 if (!no_flags
&& !th
->syn
)
927 tcp_statistics
.TcpAttemptFails
++;
931 sk
->error_report(sk
);
935 /* If we've already connected we will keep trying
936 * until we time out, or the user gives up.
938 * rfc1122 4.2.3.9 allows to consider as hard errors
939 * only PROTO_UNREACH and PORT_UNREACH (well, FRAG_FAILED too,
940 * but it is obsoleted by pmtu discovery).
942 * Note, that in modern internet, where routing is unreliable
943 * and in each dark corner broken firewalls sit, sending random
944 * errors ordered by their masters even this two messages finally lose
945 * their original sense (even Linux sends invalid PORT_UNREACHs)
947 * Now we are in compliance with RFCs.
951 if (sk
->ip_recverr
) {
952 /* This code isn't serialized with the socket code */
953 /* ANK (980927) ... which is harmless now,
954 sk->err's may be safely lost.
958 sk
->error_report(sk
); /* Wake people up to see the error (see connect in sock.c) */
959 } else { /* Only an error on timeout */
965 /* This routine computes an IPv4 TCP checksum. */
966 void tcp_v4_send_check(struct sock
*sk
, struct tcphdr
*th
, int len
,
970 th
->check
= tcp_v4_check(th
, len
, sk
->saddr
, sk
->daddr
,
971 csum_partial((char *)th
, th
->doff
<<2, skb
->csum
));
975 * This routine will send an RST to the other tcp.
977 * Someone asks: why I NEVER use socket parameters (TOS, TTL etc.)
979 * Answer: if a packet caused RST, it is not for a socket
980 * existing in our system, if it is matched to a socket,
981 * it is just duplicate segment or bug in other side's TCP.
982 * So that we build reply only basing on parameters
983 * arrived with segment.
984 * Exception: precedence violation. We do not implement it in any case.
987 static void tcp_v4_send_reset(struct sk_buff
*skb
)
989 struct tcphdr
*th
= skb
->h
.th
;
991 struct ip_reply_arg arg
;
993 /* Never send a reset in response to a reset. */
997 if (((struct rtable
*)skb
->dst
)->rt_type
!= RTN_LOCAL
) {
998 #ifdef CONFIG_IP_TRANSPARENT_PROXY
999 if (((struct rtable
*)skb
->dst
)->rt_type
== RTN_UNICAST
)
1000 icmp_send(skb
, ICMP_DEST_UNREACH
,
1001 ICMP_PORT_UNREACH
, 0);
1006 /* Swap the send and the receive. */
1007 memset(&rth
, 0, sizeof(struct tcphdr
));
1008 rth
.dest
= th
->source
;
1009 rth
.source
= th
->dest
;
1010 rth
.doff
= sizeof(struct tcphdr
)/4;
1014 rth
.seq
= th
->ack_seq
;
1017 rth
.ack_seq
= th
->syn
? htonl(ntohl(th
->seq
)+1) : th
->seq
;
1020 memset(&arg
, 0, sizeof arg
);
1021 arg
.iov
[0].iov_base
= (unsigned char *)&rth
;
1022 arg
.iov
[0].iov_len
= sizeof rth
;
1023 arg
.csum
= csum_tcpudp_nofold(skb
->nh
.iph
->daddr
,
1024 skb
->nh
.iph
->saddr
, /*XXX*/
1025 sizeof(struct tcphdr
),
1029 arg
.csumoffset
= offsetof(struct tcphdr
, check
) / 2;
1031 ip_send_reply(tcp_socket
->sk
, skb
, &arg
, sizeof rth
);
1033 tcp_statistics
.TcpOutSegs
++;
1034 tcp_statistics
.TcpOutRsts
++;
1037 #ifdef CONFIG_IP_TRANSPARENT_PROXY
1040 Seems, I never wrote nothing more stupid.
1041 I hope Gods will forgive me, but I cannot forgive myself 8)
1045 static struct sock
*tcp_v4_search_proxy_openreq(struct sk_buff
*skb
)
1047 struct iphdr
*iph
= skb
->nh
.iph
;
1048 struct tcphdr
*th
= (struct tcphdr
*)(skb
->nh
.raw
+ iph
->ihl
*4);
1049 struct sock
*sk
= NULL
;
1052 SOCKHASH_LOCK_READ();
1053 for (i
=0; i
<TCP_LHTABLE_SIZE
; i
++) {
1054 for(sk
= tcp_listening_hash
[i
]; sk
; sk
= sk
->next
) {
1055 struct open_request
*dummy
;
1056 if (tcp_v4_search_req(&sk
->tp_pinfo
.af_tcp
, iph
,
1058 (!sk
->bound_dev_if
||
1059 sk
->bound_dev_if
== skb
->dev
->ifindex
))
1064 SOCKHASH_UNLOCK_READ();
1069 * Check whether a received TCP packet might be for one of our
1073 int tcp_chkaddr(struct sk_buff
*skb
)
1075 struct iphdr
*iph
= skb
->nh
.iph
;
1076 struct tcphdr
*th
= (struct tcphdr
*)(skb
->nh
.raw
+ iph
->ihl
*4);
1079 sk
= tcp_v4_lookup(iph
->saddr
, th
->source
, iph
->daddr
,
1080 th
->dest
, skb
->dev
->ifindex
);
1083 return tcp_v4_search_proxy_openreq(skb
) != NULL
;
1085 if (sk
->state
== TCP_LISTEN
) {
1086 struct open_request
*dummy
;
1087 if (tcp_v4_search_req(&sk
->tp_pinfo
.af_tcp
, skb
->nh
.iph
,
1089 (!sk
->bound_dev_if
||
1090 sk
->bound_dev_if
== skb
->dev
->ifindex
))
1094 /* 0 means accept all LOCAL addresses here, not all the world... */
1096 if (sk
->rcv_saddr
== 0)
1104 * Send a SYN-ACK after having received an ACK.
1105 * This still operates on a open_request only, not on a big
1108 static void tcp_v4_send_synack(struct sock
*sk
, struct open_request
*req
)
1111 struct ip_options
*opt
;
1112 struct sk_buff
* skb
;
1115 /* First, grab a route. */
1116 opt
= req
->af
.v4_req
.opt
;
1117 if(ip_route_output(&rt
, ((opt
&& opt
->srr
) ?
1119 req
->af
.v4_req
.rmt_addr
),
1120 req
->af
.v4_req
.loc_addr
,
1121 RT_TOS(sk
->ip_tos
) | RTO_CONN
| sk
->localroute
,
1122 sk
->bound_dev_if
)) {
1123 ip_statistics
.IpOutNoRoutes
++;
1126 if(opt
&& opt
->is_strictroute
&& rt
->rt_dst
!= rt
->rt_gateway
) {
1128 ip_statistics
.IpOutNoRoutes
++;
1132 mss
= rt
->u
.dst
.pmtu
- sizeof(struct iphdr
) - sizeof(struct tcphdr
);
1134 skb
= tcp_make_synack(sk
, &rt
->u
.dst
, req
, mss
);
1136 struct tcphdr
*th
= skb
->h
.th
;
1138 #ifdef CONFIG_IP_TRANSPARENT_PROXY
1139 th
->source
= req
->lcl_port
; /* LVE */
1142 th
->check
= tcp_v4_check(th
, skb
->len
,
1143 req
->af
.v4_req
.loc_addr
, req
->af
.v4_req
.rmt_addr
,
1144 csum_partial((char *)th
, skb
->len
, skb
->csum
));
1146 ip_build_and_send_pkt(skb
, sk
, req
->af
.v4_req
.loc_addr
,
1147 req
->af
.v4_req
.rmt_addr
, req
->af
.v4_req
.opt
);
1153 * IPv4 open_request destructor.
1155 static void tcp_v4_or_free(struct open_request
*req
)
1157 if(!req
->sk
&& req
->af
.v4_req
.opt
)
1158 kfree_s(req
->af
.v4_req
.opt
, optlength(req
->af
.v4_req
.opt
));
1161 static inline void syn_flood_warning(struct sk_buff
*skb
)
1163 static unsigned long warntime
;
1165 if (jiffies
- warntime
> HZ
*60) {
1168 "possible SYN flooding on port %d. Sending cookies.\n",
1169 ntohs(skb
->h
.th
->dest
));
1174 * Save and compile IPv4 options into the open_request if needed.
1176 static inline struct ip_options
*
1177 tcp_v4_save_options(struct sock
*sk
, struct sk_buff
*skb
)
1179 struct ip_options
*opt
= &(IPCB(skb
)->opt
);
1180 struct ip_options
*dopt
= NULL
;
1182 if (opt
&& opt
->optlen
) {
1183 int opt_size
= optlength(opt
);
1184 dopt
= kmalloc(opt_size
, GFP_ATOMIC
);
1186 if (ip_options_echo(dopt
, skb
)) {
1187 kfree_s(dopt
, opt_size
);
1196 * Maximum number of SYN_RECV sockets in queue per LISTEN socket.
1197 * One SYN_RECV socket costs about 80bytes on a 32bit machine.
1198 * It would be better to replace it with a global counter for all sockets
1199 * but then some measure against one socket starving all other sockets
1202 int sysctl_max_syn_backlog
= 128;
1204 struct or_calltable or_ipv4
= {
1210 #define BACKLOG(sk) ((sk)->tp_pinfo.af_tcp.syn_backlog) /* lvalue! */
1211 #define BACKLOGMAX(sk) sysctl_max_syn_backlog
1213 int tcp_v4_conn_request(struct sock
*sk
, struct sk_buff
*skb
, __u32 isn
)
1216 struct open_request
*req
;
1217 struct tcphdr
*th
= skb
->h
.th
;
1218 __u32 saddr
= skb
->nh
.iph
->saddr
;
1219 __u32 daddr
= skb
->nh
.iph
->daddr
;
1220 #ifdef CONFIG_SYN_COOKIES
1221 int want_cookie
= 0;
1223 #define want_cookie 0 /* Argh, why doesn't gcc optimize this :( */
1226 /* If the socket is dead, don't accept the connection. */
1230 /* Never answer to SYNs send to broadcast or multicast */
1231 if (((struct rtable
*)skb
->dst
)->rt_flags
&
1232 (RTCF_BROADCAST
|RTCF_MULTICAST
))
1235 /* XXX: Check against a global syn pool counter. */
1236 if (BACKLOG(sk
) > BACKLOGMAX(sk
)) {
1237 #ifdef CONFIG_SYN_COOKIES
1238 if (sysctl_tcp_syncookies
) {
1239 syn_flood_warning(skb
);
1246 isn
= tcp_v4_init_sequence(sk
, skb
);
1250 req
= tcp_openreq_alloc();
1255 req
->rcv_wnd
= 0; /* So that tcp_send_synack() knows! */
1257 req
->rcv_isn
= TCP_SKB_CB(skb
)->seq
;
1258 tp
.tstamp_ok
= tp
.sack_ok
= tp
.wscale_ok
= tp
.snd_wscale
= 0;
1260 tp
.mss_clamp
= 65535;
1261 tcp_parse_options(NULL
, th
, &tp
, want_cookie
);
1262 if (tp
.mss_clamp
== 65535)
1263 tp
.mss_clamp
= 576 - sizeof(struct iphdr
) - sizeof(struct iphdr
);
1265 if (sk
->tp_pinfo
.af_tcp
.user_mss
&& sk
->tp_pinfo
.af_tcp
.user_mss
< tp
.mss_clamp
)
1266 tp
.mss_clamp
= sk
->tp_pinfo
.af_tcp
.user_mss
;
1267 req
->mss
= tp
.mss_clamp
;
1270 req
->ts_recent
= tp
.rcv_tsval
;
1271 req
->tstamp_ok
= tp
.tstamp_ok
;
1272 req
->sack_ok
= tp
.sack_ok
;
1273 req
->snd_wscale
= tp
.snd_wscale
;
1274 req
->wscale_ok
= tp
.wscale_ok
;
1275 req
->rmt_port
= th
->source
;
1276 #ifdef CONFIG_IP_TRANSPARENT_PROXY
1277 req
->lcl_port
= th
->dest
; /* LVE */
1279 req
->af
.v4_req
.loc_addr
= daddr
;
1280 req
->af
.v4_req
.rmt_addr
= saddr
;
1282 /* Note that we ignore the isn passed from the TIME_WAIT
1283 * state here. That's the price we pay for cookies.
1286 isn
= cookie_v4_init_sequence(sk
, skb
, &req
->mss
);
1290 req
->af
.v4_req
.opt
= tcp_v4_save_options(sk
, skb
);
1292 req
->class = &or_ipv4
;
1296 tcp_v4_send_synack(sk
, req
);
1299 if (req
->af
.v4_req
.opt
)
1300 kfree(req
->af
.v4_req
.opt
);
1301 tcp_v4_or_free(req
);
1302 tcp_openreq_free(req
);
1304 req
->expires
= jiffies
+ TCP_TIMEOUT_INIT
;
1305 tcp_inc_slow_timer(TCP_SLT_SYNACK
);
1306 tcp_synq_queue(&sk
->tp_pinfo
.af_tcp
, req
);
1312 SOCK_DEBUG(sk
, "Reset on %p: Connect on dead socket.\n",sk
);
1313 tcp_statistics
.TcpAttemptFails
++;
1314 return -ENOTCONN
; /* send reset */
1320 tcp_statistics
.TcpAttemptFails
++;
1324 /* This is not only more efficient than what we used to do, it eliminates
1325 * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM
1327 * This function wants to be moved to a common for IPv[46] file. --ANK
1329 struct sock
*tcp_create_openreq_child(struct sock
*sk
, struct open_request
*req
, struct sk_buff
*skb
)
1331 struct sock
*newsk
= sk_alloc(PF_INET
, GFP_ATOMIC
, 0);
1334 struct tcp_opt
*newtp
;
1335 #ifdef CONFIG_FILTER
1336 struct sk_filter
*filter
;
1339 memcpy(newsk
, sk
, sizeof(*newsk
));
1340 newsk
->state
= TCP_SYN_RECV
;
1342 /* Clone the TCP header template */
1343 newsk
->dport
= req
->rmt_port
;
1345 sock_lock_init(newsk
);
1347 atomic_set(&newsk
->rmem_alloc
, 0);
1348 skb_queue_head_init(&newsk
->receive_queue
);
1349 atomic_set(&newsk
->wmem_alloc
, 0);
1350 skb_queue_head_init(&newsk
->write_queue
);
1351 atomic_set(&newsk
->omem_alloc
, 0);
1355 newsk
->backlog
.head
= newsk
->backlog
.tail
= NULL
;
1356 skb_queue_head_init(&newsk
->error_queue
);
1357 newsk
->write_space
= tcp_write_space
;
1358 #ifdef CONFIG_FILTER
1359 if ((filter
= newsk
->filter
) != NULL
)
1360 sk_filter_charge(newsk
, filter
);
1363 /* Now setup tcp_opt */
1364 newtp
= &(newsk
->tp_pinfo
.af_tcp
);
1365 newtp
->pred_flags
= 0;
1366 newtp
->rcv_nxt
= req
->rcv_isn
+ 1;
1367 newtp
->snd_nxt
= req
->snt_isn
+ 1;
1368 newtp
->snd_una
= req
->snt_isn
+ 1;
1371 newtp
->snd_wl1
= req
->rcv_isn
;
1372 newtp
->snd_wl2
= req
->snt_isn
;
1374 /* RFC1323: The window in SYN & SYN/ACK segments
1377 newtp
->snd_wnd
= ntohs(skb
->h
.th
->window
);
1379 newtp
->max_window
= newtp
->snd_wnd
;
1381 newtp
->retransmits
= 0;
1382 newtp
->last_ack_sent
= req
->rcv_isn
+ 1;
1384 newtp
->mdev
= TCP_TIMEOUT_INIT
;
1386 /* So many TCP implementations out there (incorrectly) count the
1387 * initial SYN frame in their delayed-ACK and congestion control
1388 * algorithms that we must have the following bandaid to talk
1389 * efficiently to them. -DaveM
1391 newtp
->snd_cwnd
= 2;
1393 newtp
->rto
= TCP_TIMEOUT_INIT
;
1394 newtp
->packets_out
= 0;
1395 newtp
->fackets_out
= 0;
1396 newtp
->retrans_out
= 0;
1397 newtp
->high_seq
= 0;
1398 newtp
->snd_ssthresh
= 0x7fffffff;
1399 newtp
->snd_cwnd_cnt
= 0;
1400 newtp
->dup_acks
= 0;
1401 newtp
->delayed_acks
= 0;
1402 init_timer(&newtp
->retransmit_timer
);
1403 newtp
->retransmit_timer
.function
= &tcp_retransmit_timer
;
1404 newtp
->retransmit_timer
.data
= (unsigned long) newsk
;
1405 init_timer(&newtp
->delack_timer
);
1406 newtp
->delack_timer
.function
= &tcp_delack_timer
;
1407 newtp
->delack_timer
.data
= (unsigned long) newsk
;
1408 skb_queue_head_init(&newtp
->out_of_order_queue
);
1409 newtp
->send_head
= newtp
->retrans_head
= NULL
;
1410 newtp
->rcv_wup
= req
->rcv_isn
+ 1;
1411 newtp
->write_seq
= req
->snt_isn
+ 1;
1412 newtp
->copied_seq
= req
->rcv_isn
+ 1;
1414 newtp
->saw_tstamp
= 0;
1415 newtp
->mss_clamp
= req
->mss
;
1417 init_timer(&newtp
->probe_timer
);
1418 newtp
->probe_timer
.function
= &tcp_probe_timer
;
1419 newtp
->probe_timer
.data
= (unsigned long) newsk
;
1420 newtp
->probes_out
= 0;
1421 newtp
->syn_seq
= req
->rcv_isn
;
1422 newtp
->fin_seq
= req
->rcv_isn
;
1423 newtp
->urg_data
= 0;
1424 tcp_synq_init(newtp
);
1425 newtp
->syn_backlog
= 0;
1426 if (skb
->len
>= 536)
1427 newtp
->last_seg_size
= skb
->len
;
1429 /* Back to base struct sock members. */
1431 newsk
->ack_backlog
= 0;
1432 newsk
->max_ack_backlog
= SOMAXCONN
;
1433 newsk
->priority
= 0;
1435 /* IP layer stuff */
1437 init_timer(&newsk
->timer
);
1438 newsk
->timer
.function
= &net_timer
;
1439 newsk
->timer
.data
= (unsigned long) newsk
;
1440 newsk
->socket
= NULL
;
1442 newtp
->tstamp_ok
= req
->tstamp_ok
;
1443 if((newtp
->sack_ok
= req
->sack_ok
) != 0)
1444 newtp
->num_sacks
= 0;
1445 newtp
->window_clamp
= req
->window_clamp
;
1446 newtp
->rcv_wnd
= req
->rcv_wnd
;
1447 newtp
->wscale_ok
= req
->wscale_ok
;
1448 if (newtp
->wscale_ok
) {
1449 newtp
->snd_wscale
= req
->snd_wscale
;
1450 newtp
->rcv_wscale
= req
->rcv_wscale
;
1452 newtp
->snd_wscale
= newtp
->rcv_wscale
= 0;
1453 newtp
->window_clamp
= min(newtp
->window_clamp
,65535);
1455 if (newtp
->tstamp_ok
) {
1456 newtp
->ts_recent
= req
->ts_recent
;
1457 newtp
->ts_recent_stamp
= tcp_time_stamp
;
1458 newtp
->tcp_header_len
= sizeof(struct tcphdr
) + TCPOLEN_TSTAMP_ALIGNED
;
1460 newtp
->tcp_header_len
= sizeof(struct tcphdr
);
1467 * The three way handshake has completed - we got a valid synack -
1468 * now create the new socket.
1470 struct sock
* tcp_v4_syn_recv_sock(struct sock
*sk
, struct sk_buff
*skb
,
1471 struct open_request
*req
,
1472 struct dst_entry
*dst
)
1474 struct ip_options
*opt
= req
->af
.v4_req
.opt
;
1475 struct tcp_opt
*newtp
;
1478 if (sk
->ack_backlog
> sk
->max_ack_backlog
)
1479 goto exit
; /* head drop */
1483 if (ip_route_output(&rt
,
1484 opt
&& opt
->srr
? opt
->faddr
: req
->af
.v4_req
.rmt_addr
,
1485 req
->af
.v4_req
.loc_addr
, sk
->ip_tos
|RTO_CONN
, 0))
1489 #ifdef CONFIG_IP_TRANSPARENT_PROXY
1490 /* The new socket created for transparent proxy may fall
1491 * into a non-existed bind bucket because sk->num != newsk->num.
1492 * Ensure existance of the bucket now. The placement of the check
1493 * later will require to destroy just created newsk in the case of fail.
1494 * 1998/04/22 Andrey V. Savochkin <saw@msu.ru>
1496 if (tcp_bucket_check(ntohs(skb
->h
.th
->dest
)))
1500 newsk
= tcp_create_openreq_child(sk
, req
, skb
);
1504 sk
->tp_pinfo
.af_tcp
.syn_backlog
--;
1507 newsk
->dst_cache
= dst
;
1509 newtp
= &(newsk
->tp_pinfo
.af_tcp
);
1510 newsk
->daddr
= req
->af
.v4_req
.rmt_addr
;
1511 newsk
->saddr
= req
->af
.v4_req
.loc_addr
;
1512 newsk
->rcv_saddr
= req
->af
.v4_req
.loc_addr
;
1513 #ifdef CONFIG_IP_TRANSPARENT_PROXY
1514 newsk
->num
= ntohs(skb
->h
.th
->dest
);
1515 newsk
->sport
= req
->lcl_port
;
1517 newsk
->opt
= req
->af
.v4_req
.opt
;
1518 newtp
->ext_header_len
= 0;
1520 newtp
->ext_header_len
= newsk
->opt
->optlen
;
1522 tcp_sync_mss(newsk
, dst
->pmtu
);
1523 newtp
->rcv_mss
= newtp
->mss_clamp
;
1525 /* It would be better to use newtp->mss_clamp here */
1526 if (newsk
->rcvbuf
< (3 * newtp
->pmtu_cookie
))
1527 newsk
->rcvbuf
= min ((3 * newtp
->pmtu_cookie
), sysctl_rmem_max
);
1528 if (newsk
->sndbuf
< (3 * newtp
->pmtu_cookie
))
1529 newsk
->sndbuf
= min ((3 * newtp
->pmtu_cookie
), sysctl_wmem_max
);
1531 SOCKHASH_LOCK_WRITE();
1532 __tcp_v4_hash(newsk
);
1533 __tcp_inherit_port(sk
, newsk
);
1534 SOCKHASH_UNLOCK_WRITE();
1536 sk
->data_ready(sk
, 0); /* Deliver SIGIO */
1545 static void tcp_v4_rst_req(struct sock
*sk
, struct sk_buff
*skb
)
1547 struct tcp_opt
*tp
= &sk
->tp_pinfo
.af_tcp
;
1548 struct open_request
*req
, *prev
;
1550 req
= tcp_v4_search_req(tp
,skb
->nh
.iph
, skb
->h
.th
, &prev
);
1553 /* Sequence number check required by RFC793 */
1554 if (before(TCP_SKB_CB(skb
)->seq
, req
->rcv_isn
) ||
1555 after(TCP_SKB_CB(skb
)->seq
, req
->rcv_isn
+1))
1557 tcp_synq_unlink(tp
, req
, prev
);
1558 (req
->sk
? sk
->ack_backlog
: tp
->syn_backlog
)--;
1559 req
->class->destructor(req
);
1560 tcp_openreq_free(req
);
1562 net_statistics
.EmbryonicRsts
++;
1565 /* Check for embryonic sockets (open_requests) We check packets with
1566 * only the SYN bit set against the open_request queue too: This
1567 * increases connection latency a bit, but is required to detect
1568 * retransmitted SYNs.
1570 static inline struct sock
*tcp_v4_hnd_req(struct sock
*sk
,struct sk_buff
*skb
)
1572 struct tcphdr
*th
= skb
->h
.th
;
1573 u32 flg
= ((u32
*)th
)[3];
1576 if (flg
& __constant_htonl(0x00040000)) {
1577 tcp_v4_rst_req(sk
, skb
);
1581 /* Check for SYN|ACK */
1582 flg
&= __constant_htonl(0x00120000);
1584 struct open_request
*req
, *dummy
;
1585 struct tcp_opt
*tp
= &(sk
->tp_pinfo
.af_tcp
);
1587 /* Find possible connection requests. */
1588 req
= tcp_v4_search_req(tp
, skb
->nh
.iph
, th
, &dummy
);
1590 sk
= tcp_check_req(sk
, skb
, req
);
1592 #ifdef CONFIG_SYN_COOKIES
1594 sk
= cookie_v4_check(sk
, skb
, &(IPCB(skb
)->opt
));
1601 /* The socket must have it's spinlock held when we get
1604 * We have a potential double-lock case here, so even when
1605 * doing backlog processing we use the BH locking scheme.
1606 * This is because we cannot sleep with the original spinlock
1609 int tcp_v4_do_rcv(struct sock
*sk
, struct sk_buff
*skb
)
1611 int need_unlock
= 0;
1612 #ifdef CONFIG_FILTER
1613 struct sk_filter
*filter
= sk
->filter
;
1614 if (filter
&& sk_filter(skb
, filter
))
1616 #endif /* CONFIG_FILTER */
1619 * This doesn't check if the socket has enough room for the packet.
1620 * Either process the packet _without_ queueing it and then free it,
1621 * or do the check later.
1623 skb_set_owner_r(skb
, sk
);
1625 if (sk
->state
== TCP_ESTABLISHED
) { /* Fast path */
1626 if (tcp_rcv_established(sk
, skb
, skb
->h
.th
, skb
->len
))
1631 if (sk
->state
== TCP_LISTEN
) {
1634 nsk
= tcp_v4_hnd_req(sk
, skb
);
1639 * Queue it on the new socket if the new socket is active,
1640 * otherwise we just shortcircuit this and continue with
1645 if (nsk
->lock
.users
!= 0) {
1647 sk_add_backlog(nsk
, skb
);
1648 bh_unlock_sock(nsk
);
1656 if (tcp_rcv_state_process(sk
, skb
, skb
->h
.th
, skb
->len
))
1658 goto out_maybe_unlock
;
1661 tcp_v4_send_reset(skb
);
1664 /* Be careful here. If this function gets more complicated and
1665 * gcc suffers from register pressure on the x86, sk (in %ebx)
1666 * might be destroyed here. This current version compiles correctly,
1667 * but you have been warned.
1679 int tcp_v4_rcv(struct sk_buff
*skb
, unsigned short len
)
1685 if (skb
->pkt_type
!=PACKET_HOST
)
1690 /* Pull up the IP header. */
1691 __skb_pull(skb
, skb
->h
.raw
- skb
->data
);
1693 /* Count it even if it's bad */
1694 tcp_statistics
.TcpInSegs
++;
1696 if (len
< sizeof(struct tcphdr
))
1699 /* Try to use the device checksum if provided. */
1700 switch (skb
->ip_summed
) {
1702 skb
->csum
= csum_partial((char *)th
, len
, 0);
1704 if (tcp_v4_check(th
,len
,skb
->nh
.iph
->saddr
,skb
->nh
.iph
->daddr
,skb
->csum
)) {
1705 NETDEBUG(printk(KERN_DEBUG
"TCPv4 bad checksum "
1706 "from %d.%d.%d.%d:%04x to %d.%d.%d.%d:%04x, "
1708 NIPQUAD(skb
->nh
.iph
->saddr
),
1710 NIPQUAD(skb
->nh
.iph
->daddr
),
1713 ntohs(skb
->nh
.iph
->tot_len
)));
1715 tcp_statistics
.TcpInErrs
++;
1719 /* CHECKSUM_UNNECESSARY */
1722 #ifdef CONFIG_IP_TRANSPARENT_PROXY
1723 if (IPCB(skb
)->redirport
)
1724 sk
= tcp_v4_proxy_lookup(th
->dest
, skb
->nh
.iph
->saddr
, th
->source
,
1725 skb
->nh
.iph
->daddr
, skb
->dev
,
1726 IPCB(skb
)->redirport
, skb
->dev
->ifindex
);
1729 SOCKHASH_LOCK_READ_BH();
1730 sk
= __tcp_v4_lookup(skb
->nh
.iph
->saddr
, th
->source
,
1731 skb
->nh
.iph
->daddr
, ntohs(th
->dest
), skb
->dev
->ifindex
);
1732 SOCKHASH_UNLOCK_READ_BH();
1733 #ifdef CONFIG_IP_TRANSPARENT_PROXY
1735 sk
= tcp_v4_search_proxy_openreq(skb
);
1740 if(!ipsec_sk_policy(sk
,skb
))
1743 TCP_SKB_CB(skb
)->seq
= ntohl(th
->seq
);
1744 TCP_SKB_CB(skb
)->end_seq
= (TCP_SKB_CB(skb
)->seq
+ th
->syn
+ th
->fin
+
1746 TCP_SKB_CB(skb
)->ack_seq
= ntohl(th
->ack_seq
);
1750 if (sk
->state
== TCP_TIME_WAIT
)
1755 if (!sk
->lock
.users
)
1756 ret
= tcp_v4_do_rcv(sk
, skb
);
1758 sk_add_backlog(sk
, skb
);
1764 tcp_v4_send_reset(skb
);
1767 /* Discard frame. */
1772 if(tcp_timewait_state_process((struct tcp_tw_bucket
*)sk
,
1778 static void __tcp_v4_rehash(struct sock
*sk
)
1780 struct sock
**skp
= &tcp_ehash
[(sk
->hashent
= tcp_sk_hashfn(sk
))];
1782 SOCKHASH_LOCK_WRITE();
1785 sk
->next
->pprev
= sk
->pprev
;
1786 *sk
->pprev
= sk
->next
;
1790 if((sk
->next
= *skp
) != NULL
)
1791 (*skp
)->pprev
= &sk
->next
;
1794 SOCKHASH_UNLOCK_WRITE();
1797 int tcp_v4_rebuild_header(struct sock
*sk
)
1799 struct rtable
*rt
= (struct rtable
*)sk
->dst_cache
;
1801 int want_rewrite
= sysctl_ip_dynaddr
&& sk
->state
== TCP_SYN_SENT
;
1806 /* Force route checking if want_rewrite.
1807 * The idea is good, the implementation is disguisting.
1808 * Well, if I made bind on this socket, you cannot randomly ovewrite
1809 * its source address. --ANK
1813 struct rtable
*new_rt
;
1814 __u32 old_saddr
= rt
->rt_src
;
1816 /* Query new route using another rt buffer */
1817 tmp
= ip_route_connect(&new_rt
, rt
->rt_dst
, 0,
1818 RT_TOS(sk
->ip_tos
)|sk
->localroute
,
1821 /* Only useful if different source addrs */
1824 * Only useful if different source addrs
1826 if (new_rt
->rt_src
!= old_saddr
) {
1827 dst_release(sk
->dst_cache
);
1828 sk
->dst_cache
= &new_rt
->u
.dst
;
1832 dst_release(&new_rt
->u
.dst
);
1835 if (rt
->u
.dst
.obsolete
) {
1837 err
= ip_route_output(&rt
, rt
->rt_dst
, rt
->rt_src
, rt
->key
.tos
|RTO_CONN
, rt
->key
.oif
);
1840 sk
->error_report(sk
);
1843 dst_release(xchg(&sk
->dst_cache
, &rt
->u
.dst
));
1849 new_saddr
= rt
->rt_src
;
1851 /* Ouch!, this should not happen. */
1852 if (!sk
->saddr
|| !sk
->rcv_saddr
) {
1853 printk(KERN_WARNING
"tcp_v4_rebuild_header(): not valid sock addrs: "
1854 "saddr=%08lX rcv_saddr=%08lX\n",
1856 ntohl(sk
->rcv_saddr
));
1860 if (new_saddr
!= sk
->saddr
) {
1861 if (sysctl_ip_dynaddr
> 1) {
1862 printk(KERN_INFO
"tcp_v4_rebuild_header(): shifting sk->saddr "
1863 "from %d.%d.%d.%d to %d.%d.%d.%d\n",
1865 NIPQUAD(new_saddr
));
1868 sk
->saddr
= new_saddr
;
1869 sk
->rcv_saddr
= new_saddr
;
1871 /* XXX The only one ugly spot where we need to
1872 * XXX really change the sockets identity after
1873 * XXX it has entered the hashes. -DaveM
1875 __tcp_v4_rehash(sk
);
1881 static struct sock
* tcp_v4_get_sock(struct sk_buff
*skb
, struct tcphdr
*th
)
1883 return tcp_v4_lookup(skb
->nh
.iph
->saddr
, th
->source
,
1884 skb
->nh
.iph
->daddr
, th
->dest
, skb
->dev
->ifindex
);
1887 static void v4_addr2sockaddr(struct sock
*sk
, struct sockaddr
* uaddr
)
1889 struct sockaddr_in
*sin
= (struct sockaddr_in
*) uaddr
;
1891 sin
->sin_family
= AF_INET
;
1892 sin
->sin_addr
.s_addr
= sk
->daddr
;
1893 sin
->sin_port
= sk
->dport
;
1896 struct tcp_func ipv4_specific
= {
1899 tcp_v4_rebuild_header
,
1900 tcp_v4_conn_request
,
1901 tcp_v4_syn_recv_sock
,
1903 sizeof(struct iphdr
),
1908 sizeof(struct sockaddr_in
)
1911 /* NOTE: A lot of things set to zero explicitly by call to
1912 * sk_alloc() so need not be done here.
1914 static int tcp_v4_init_sock(struct sock
*sk
)
1916 struct tcp_opt
*tp
= &(sk
->tp_pinfo
.af_tcp
);
1918 skb_queue_head_init(&tp
->out_of_order_queue
);
1919 tcp_init_xmit_timers(sk
);
1921 tp
->rto
= TCP_TIMEOUT_INIT
; /*TCP_WRITE_TIME*/
1922 tp
->mdev
= TCP_TIMEOUT_INIT
;
1925 /* So many TCP implementations out there (incorrectly) count the
1926 * initial SYN frame in their delayed-ACK and congestion control
1927 * algorithms that we must have the following bandaid to talk
1928 * efficiently to them. -DaveM
1932 /* See draft-stevens-tcpca-spec-01 for discussion of the
1933 * initialization of these values.
1935 tp
->snd_cwnd_cnt
= 0;
1936 tp
->snd_ssthresh
= 0x7fffffff; /* Infinity */
1938 sk
->state
= TCP_CLOSE
;
1939 sk
->max_ack_backlog
= SOMAXCONN
;
1942 sk
->write_space
= tcp_write_space
;
1944 /* Init SYN queue. */
1947 sk
->tp_pinfo
.af_tcp
.af_specific
= &ipv4_specific
;
1952 static int tcp_v4_destroy_sock(struct sock
*sk
)
1954 struct tcp_opt
*tp
= &(sk
->tp_pinfo
.af_tcp
);
1955 struct sk_buff
*skb
;
1957 tcp_clear_xmit_timers(sk
);
1960 tcp_dec_slow_timer(TCP_SLT_KEEPALIVE
);
1962 /* Cleanup up the write buffer. */
1963 while((skb
= __skb_dequeue(&sk
->write_queue
)) != NULL
)
1966 /* Cleans up our, hopefuly empty, out_of_order_queue. */
1967 while((skb
= __skb_dequeue(&tp
->out_of_order_queue
)) != NULL
)
1970 /* Clean up a referenced TCP bind bucket, this only happens if a
1971 * port is allocated for a socket, but it never fully connects.
1973 if(sk
->prev
!= NULL
)
1979 /* Proc filesystem TCP sock list dumping. */
1980 static void get_openreq(struct sock
*sk
, struct open_request
*req
, char *tmpbuf
, int i
)
1982 sprintf(tmpbuf
, "%4d: %08lX:%04X %08lX:%04X"
1983 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u",
1985 (long unsigned int)req
->af
.v4_req
.loc_addr
,
1987 (long unsigned int)req
->af
.v4_req
.rmt_addr
,
1988 ntohs(req
->rmt_port
),
1990 0,0, /* could print option size, but that is af dependent. */
1991 1, /* timers active (only the expire timer) */
1992 (unsigned long)(req
->expires
- jiffies
),
1994 sk
->socket
? sk
->socket
->inode
->i_uid
: 0,
1995 0, /* non standard timer */
1996 0 /* open_requests have no inode */
2000 static void get_tcp_sock(struct sock
*sp
, char *tmpbuf
, int i
)
2002 unsigned int dest
, src
;
2004 int timer_active
, timer_active1
, timer_active2
;
2005 unsigned long timer_expires
;
2006 struct tcp_opt
*tp
= &sp
->tp_pinfo
.af_tcp
;
2009 src
= sp
->rcv_saddr
;
2010 destp
= ntohs(sp
->dport
);
2011 srcp
= ntohs(sp
->sport
);
2012 timer_active1
= tp
->retransmit_timer
.prev
!= NULL
;
2013 timer_active2
= sp
->timer
.prev
!= NULL
;
2015 timer_expires
= (unsigned) -1;
2016 if (timer_active1
&& tp
->retransmit_timer
.expires
< timer_expires
) {
2018 timer_expires
= tp
->retransmit_timer
.expires
;
2020 if (timer_active2
&& sp
->timer
.expires
< timer_expires
) {
2022 timer_expires
= sp
->timer
.expires
;
2024 if(timer_active
== 0)
2025 timer_expires
= jiffies
;
2027 sprintf(tmpbuf
, "%4d: %08X:%04X %08X:%04X"
2028 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %ld",
2029 i
, src
, srcp
, dest
, destp
, sp
->state
,
2030 tp
->write_seq
-tp
->snd_una
, tp
->rcv_nxt
-tp
->copied_seq
,
2031 timer_active
, timer_expires
-jiffies
,
2033 sp
->socket
? sp
->socket
->inode
->i_uid
: 0,
2034 timer_active
? sp
->timeout
: 0,
2035 sp
->socket
? sp
->socket
->inode
->i_ino
: 0);
2038 static void get_timewait_sock(struct tcp_tw_bucket
*tw
, char *tmpbuf
, int i
)
2040 extern int tcp_tw_death_row_slot
;
2041 unsigned int dest
, src
;
2046 src
= tw
->rcv_saddr
;
2047 destp
= ntohs(tw
->dport
);
2048 srcp
= ntohs(tw
->sport
);
2050 slot_dist
= tw
->death_slot
;
2051 if(slot_dist
> tcp_tw_death_row_slot
)
2052 slot_dist
= (TCP_TWKILL_SLOTS
- slot_dist
) + tcp_tw_death_row_slot
;
2054 slot_dist
= tcp_tw_death_row_slot
- slot_dist
;
2056 sprintf(tmpbuf
, "%4d: %08X:%04X %08X:%04X"
2057 " %02X %08X:%08X %02X:%08X %08X %5d %8d %d",
2058 i
, src
, srcp
, dest
, destp
, TCP_TIME_WAIT
, 0, 0,
2059 3, slot_dist
* TCP_TWKILL_PERIOD
, 0, 0, 0, 0);
2062 int tcp_get_info(char *buffer
, char **start
, off_t offset
, int length
, int dummy
)
2064 int len
= 0, num
= 0, i
;
2065 off_t begin
, pos
= 0;
2069 len
+= sprintf(buffer
, "%-127s\n",
2070 " sl local_address rem_address st tx_queue "
2071 "rx_queue tr tm->when retrnsmt uid timeout inode");
2074 SOCKHASH_LOCK_READ();
2076 /* First, walk listening socket table. */
2077 for(i
= 0; i
< TCP_LHTABLE_SIZE
; i
++) {
2078 struct sock
*sk
= tcp_listening_hash
[i
];
2080 for (sk
= tcp_listening_hash
[i
]; sk
; sk
= sk
->next
, num
++) {
2081 struct open_request
*req
;
2082 struct tcp_opt
*tp
= &(sk
->tp_pinfo
.af_tcp
);
2084 if (sk
->family
!= PF_INET
)
2087 if (pos
>= offset
) {
2088 get_tcp_sock(sk
, tmpbuf
, num
);
2089 len
+= sprintf(buffer
+len
, "%-127s\n", tmpbuf
);
2093 for (req
= tp
->syn_wait_queue
; req
; req
= req
->dl_next
, num
++) {
2099 get_openreq(sk
, req
, tmpbuf
, num
);
2100 len
+= sprintf(buffer
+len
, "%-127s\n", tmpbuf
);
2107 /* Next, walk established hash chain. */
2108 for (i
= 0; i
< (tcp_ehash_size
>> 1); i
++) {
2111 for(sk
= tcp_ehash
[i
]; sk
; sk
= sk
->next
, num
++) {
2112 if (sk
->family
!= PF_INET
)
2117 get_tcp_sock(sk
, tmpbuf
, num
);
2118 len
+= sprintf(buffer
+len
, "%-127s\n", tmpbuf
);
2124 /* Finally, walk time wait buckets. */
2125 for (i
= (tcp_ehash_size
>>1); i
< tcp_ehash_size
; i
++) {
2126 struct tcp_tw_bucket
*tw
;
2127 for (tw
= (struct tcp_tw_bucket
*)tcp_ehash
[i
];
2129 tw
= (struct tcp_tw_bucket
*)tw
->next
, num
++) {
2130 if (tw
->family
!= PF_INET
)
2135 get_timewait_sock(tw
, tmpbuf
, num
);
2136 len
+= sprintf(buffer
+len
, "%-127s\n", tmpbuf
);
2143 SOCKHASH_UNLOCK_READ();
2145 begin
= len
- (pos
- offset
);
2146 *start
= buffer
+ begin
;
2155 struct proto tcp_prot
= {
2156 tcp_close
, /* close */
2157 tcp_v4_connect
, /* connect */
2158 tcp_accept
, /* accept */
2159 NULL
, /* retransmit */
2160 tcp_write_wakeup
, /* write_wakeup */
2161 tcp_read_wakeup
, /* read_wakeup */
2162 tcp_poll
, /* poll */
2163 tcp_ioctl
, /* ioctl */
2164 tcp_v4_init_sock
, /* init */
2165 tcp_v4_destroy_sock
, /* destroy */
2166 tcp_shutdown
, /* shutdown */
2167 tcp_setsockopt
, /* setsockopt */
2168 tcp_getsockopt
, /* getsockopt */
2169 tcp_v4_sendmsg
, /* sendmsg */
2170 tcp_recvmsg
, /* recvmsg */
2172 tcp_v4_do_rcv
, /* backlog_rcv */
2173 tcp_v4_hash
, /* hash */
2174 tcp_v4_unhash
, /* unhash */
2175 tcp_v4_get_port
, /* get_port */
2176 128, /* max_header */
2177 0, /* retransmits */
2180 0 /* highestinuse */
2185 __initfunc(void tcp_v4_init(struct net_proto_family
*ops
))
2189 tcp_inode
.i_mode
= S_IFSOCK
;
2190 tcp_inode
.i_sock
= 1;
2191 tcp_inode
.i_uid
= 0;
2192 tcp_inode
.i_gid
= 0;
2193 init_waitqueue_head(&tcp_inode
.i_wait
);
2194 init_waitqueue_head(&tcp_inode
.u
.socket_i
.wait
);
2196 tcp_socket
->inode
= &tcp_inode
;
2197 tcp_socket
->state
= SS_UNCONNECTED
;
2198 tcp_socket
->type
=SOCK_RAW
;
2200 if ((err
=ops
->create(tcp_socket
, IPPROTO_TCP
))<0)
2201 panic("Failed to create the TCP control socket.\n");
2202 tcp_socket
->sk
->allocation
=GFP_ATOMIC
;
2203 tcp_socket
->sk
->ip_ttl
= MAXTTL
;
2205 /* Unhash it so that IP input processing does not even
2206 * see it, we do not wish this socket to see incoming
2209 tcp_socket
->sk
->prot
->unhash(tcp_socket
->sk
);