2 * Syncookies implementation for the Linux kernel
4 * Copyright (C) 1997 Andi Kleen
5 * Based on ideas by D.J.Bernstein and Eric Schenk.
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version
10 * 2 of the License, or (at your option) any later version.
13 #include <linux/tcp.h>
14 #include <linux/slab.h>
15 #include <linux/random.h>
16 #include <linux/cryptohash.h>
17 #include <linux/kernel.h>
20 /* Timestamps: lowest 9 bits store TCP options */
22 #define TSMASK (((__u32)1 << TSBITS) - 1)
24 extern int sysctl_tcp_syncookies
;
26 __u32 syncookie_secret
[2][16-4+SHA_DIGEST_WORDS
];
27 EXPORT_SYMBOL(syncookie_secret
);
29 static __init
int init_syncookies(void)
31 get_random_bytes(syncookie_secret
, sizeof(syncookie_secret
));
34 __initcall(init_syncookies
);
36 #define COOKIEBITS 24 /* Upper bits store count */
37 #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
39 static DEFINE_PER_CPU(__u32
, cookie_scratch
)[16 + 5 + SHA_WORKSPACE_WORDS
];
41 static u32
cookie_hash(__be32 saddr
, __be32 daddr
, __be16 sport
, __be16 dport
,
44 __u32
*tmp
= __get_cpu_var(cookie_scratch
);
46 memcpy(tmp
+ 4, syncookie_secret
[c
], sizeof(syncookie_secret
[c
]));
47 tmp
[0] = (__force u32
)saddr
;
48 tmp
[1] = (__force u32
)daddr
;
49 tmp
[2] = ((__force u32
)sport
<< 16) + (__force u32
)dport
;
51 sha_transform(tmp
+ 16, (__u8
*)tmp
, tmp
+ 16 + 5);
58 * when syncookies are in effect and tcp timestamps are enabled we encode
59 * tcp options in the lowest 9 bits of the timestamp value that will be
60 * sent in the syn-ack.
61 * Since subsequent timestamps use the normal tcp_time_stamp value, we
62 * must make sure that the resulting initial timestamp is <= tcp_time_stamp.
64 __u32
cookie_init_timestamp(struct request_sock
*req
)
66 struct inet_request_sock
*ireq
;
67 u32 ts
, ts_now
= tcp_time_stamp
;
71 if (ireq
->wscale_ok
) {
72 options
= ireq
->snd_wscale
;
73 options
|= ireq
->rcv_wscale
<< 4;
75 options
|= ireq
->sack_ok
<< 8;
77 ts
= ts_now
& ~TSMASK
;
89 static __u32
secure_tcp_syn_cookie(__be32 saddr
, __be32 daddr
, __be16 sport
,
90 __be16 dport
, __u32 sseq
, __u32 count
,
94 * Compute the secure sequence number.
95 * The output should be:
96 * HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24)
97 * + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24).
98 * Where sseq is their sequence number and count increases every
100 * As an extra hack, we add a small "data" value that encodes the
101 * MSS into the second hash value.
104 return (cookie_hash(saddr
, daddr
, sport
, dport
, 0, 0) +
105 sseq
+ (count
<< COOKIEBITS
) +
106 ((cookie_hash(saddr
, daddr
, sport
, dport
, count
, 1) + data
)
111 * This retrieves the small "data" value from the syncookie.
112 * If the syncookie is bad, the data returned will be out of
113 * range. This must be checked by the caller.
115 * The count value used to generate the cookie must be within
116 * "maxdiff" if the current (passed-in) "count". The return value
117 * is (__u32)-1 if this test fails.
119 static __u32
check_tcp_syn_cookie(__u32 cookie
, __be32 saddr
, __be32 daddr
,
120 __be16 sport
, __be16 dport
, __u32 sseq
,
121 __u32 count
, __u32 maxdiff
)
125 /* Strip away the layers from the cookie */
126 cookie
-= cookie_hash(saddr
, daddr
, sport
, dport
, 0, 0) + sseq
;
128 /* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
129 diff
= (count
- (cookie
>> COOKIEBITS
)) & ((__u32
) - 1 >> COOKIEBITS
);
134 cookie_hash(saddr
, daddr
, sport
, dport
, count
- diff
, 1))
135 & COOKIEMASK
; /* Leaving the data behind */
139 * This table has to be sorted and terminated with (__u16)-1.
140 * XXX generate a better table.
141 * Unresolved Issues: HIPPI with a 64k MSS is not well supported.
143 static __u16
const msstab
[] = {
154 /* The number doesn't include the -1 terminator */
155 #define NUM_MSS (ARRAY_SIZE(msstab) - 1)
158 * Generate a syncookie. mssp points to the mss, which is returned
159 * rounded down to the value encoded in the cookie.
161 __u32
cookie_v4_init_sequence(struct sock
*sk
, struct sk_buff
*skb
, __u16
*mssp
)
163 struct tcp_sock
*tp
= tcp_sk(sk
);
164 const struct iphdr
*iph
= ip_hdr(skb
);
165 const struct tcphdr
*th
= tcp_hdr(skb
);
167 const __u16 mss
= *mssp
;
169 tp
->last_synq_overflow
= jiffies
;
171 /* XXX sort msstab[] by probability? Binary search? */
172 for (mssind
= 0; mss
> msstab
[mssind
+ 1]; mssind
++)
174 *mssp
= msstab
[mssind
] + 1;
176 NET_INC_STATS_BH(sock_net(sk
), LINUX_MIB_SYNCOOKIESSENT
);
178 return secure_tcp_syn_cookie(iph
->saddr
, iph
->daddr
,
179 th
->source
, th
->dest
, ntohl(th
->seq
),
180 jiffies
/ (HZ
* 60), mssind
);
184 * This (misnamed) value is the age of syncookie which is permitted.
185 * Its ideal value should be dependent on TCP_TIMEOUT_INIT and
186 * sysctl_tcp_retries1. It's a rather complicated formula (exponential
187 * backoff) to compute at runtime so it's currently hardcoded here.
189 #define COUNTER_TRIES 4
191 * Check if a ack sequence number is a valid syncookie.
192 * Return the decoded mss if it is, or 0 if not.
194 static inline int cookie_check(struct sk_buff
*skb
, __u32 cookie
)
196 const struct iphdr
*iph
= ip_hdr(skb
);
197 const struct tcphdr
*th
= tcp_hdr(skb
);
198 __u32 seq
= ntohl(th
->seq
) - 1;
199 __u32 mssind
= check_tcp_syn_cookie(cookie
, iph
->saddr
, iph
->daddr
,
200 th
->source
, th
->dest
, seq
,
204 return mssind
< NUM_MSS
? msstab
[mssind
] + 1 : 0;
207 static inline struct sock
*get_cookie_sock(struct sock
*sk
, struct sk_buff
*skb
,
208 struct request_sock
*req
,
209 struct dst_entry
*dst
)
211 struct inet_connection_sock
*icsk
= inet_csk(sk
);
214 child
= icsk
->icsk_af_ops
->syn_recv_sock(sk
, skb
, req
, dst
);
216 inet_csk_reqsk_queue_add(sk
, req
, child
);
225 * when syncookies are in effect and tcp timestamps are enabled we stored
226 * additional tcp options in the timestamp.
227 * This extracts these options from the timestamp echo.
229 * The lowest 4 bits are for snd_wscale
230 * The next 4 lsb are for rcv_wscale
231 * The next lsb is for sack_ok
233 void cookie_check_timestamp(struct tcp_options_received
*tcp_opt
)
235 /* echoed timestamp, 9 lowest bits contain options */
236 u32 options
= tcp_opt
->rcv_tsecr
& TSMASK
;
238 tcp_opt
->snd_wscale
= options
& 0xf;
240 tcp_opt
->rcv_wscale
= options
& 0xf;
242 tcp_opt
->sack_ok
= (options
>> 4) & 0x1;
244 if (tcp_opt
->sack_ok
)
245 tcp_sack_reset(tcp_opt
);
247 if (tcp_opt
->snd_wscale
|| tcp_opt
->rcv_wscale
)
248 tcp_opt
->wscale_ok
= 1;
250 EXPORT_SYMBOL(cookie_check_timestamp
);
252 struct sock
*cookie_v4_check(struct sock
*sk
, struct sk_buff
*skb
,
253 struct ip_options
*opt
)
255 struct inet_request_sock
*ireq
;
256 struct tcp_request_sock
*treq
;
257 struct tcp_sock
*tp
= tcp_sk(sk
);
258 const struct tcphdr
*th
= tcp_hdr(skb
);
259 __u32 cookie
= ntohl(th
->ack_seq
) - 1;
260 struct sock
*ret
= sk
;
261 struct request_sock
*req
;
265 struct tcp_options_received tcp_opt
;
267 if (!sysctl_tcp_syncookies
|| !th
->ack
)
270 if (time_after(jiffies
, tp
->last_synq_overflow
+ TCP_TIMEOUT_INIT
) ||
271 (mss
= cookie_check(skb
, cookie
)) == 0) {
272 NET_INC_STATS_BH(sock_net(sk
), LINUX_MIB_SYNCOOKIESFAILED
);
276 NET_INC_STATS_BH(sock_net(sk
), LINUX_MIB_SYNCOOKIESRECV
);
278 /* check for timestamp cookie support */
279 memset(&tcp_opt
, 0, sizeof(tcp_opt
));
280 tcp_parse_options(skb
, &tcp_opt
, 0);
282 if (tcp_opt
.saw_tstamp
)
283 cookie_check_timestamp(&tcp_opt
);
286 req
= inet_reqsk_alloc(&tcp_request_sock_ops
); /* for safety */
290 if (security_inet_conn_request(sk
, skb
, req
)) {
294 ireq
= inet_rsk(req
);
296 treq
->rcv_isn
= ntohl(th
->seq
) - 1;
297 treq
->snt_isn
= cookie
;
299 ireq
->rmt_port
= th
->source
;
300 ireq
->loc_addr
= ip_hdr(skb
)->daddr
;
301 ireq
->rmt_addr
= ip_hdr(skb
)->saddr
;
302 ireq
->snd_wscale
= tcp_opt
.snd_wscale
;
303 ireq
->rcv_wscale
= tcp_opt
.rcv_wscale
;
304 ireq
->sack_ok
= tcp_opt
.sack_ok
;
305 ireq
->wscale_ok
= tcp_opt
.wscale_ok
;
306 ireq
->tstamp_ok
= tcp_opt
.saw_tstamp
;
307 req
->ts_recent
= tcp_opt
.saw_tstamp
? tcp_opt
.rcv_tsval
: 0;
309 /* We throwed the options of the initial SYN away, so we hope
310 * the ACK carries the same options again (see RFC1122 4.2.3.8)
312 if (opt
&& opt
->optlen
) {
313 int opt_size
= sizeof(struct ip_options
) + opt
->optlen
;
315 ireq
->opt
= kmalloc(opt_size
, GFP_ATOMIC
);
316 if (ireq
->opt
!= NULL
&& ip_options_echo(ireq
->opt
, skb
)) {
326 * We need to lookup the route here to get at the correct
327 * window size. We should better make sure that the window size
328 * hasn't changed since we received the original syn, but I see
329 * no easy way to do this.
332 struct flowi fl
= { .nl_u
= { .ip4_u
=
333 { .daddr
= ((opt
&& opt
->srr
) ?
336 .saddr
= ireq
->loc_addr
,
337 .tos
= RT_CONN_FLAGS(sk
) } },
338 .proto
= IPPROTO_TCP
,
341 .dport
= th
->source
} } };
342 security_req_classify_flow(req
, &fl
);
343 if (ip_route_output_key(&init_net
, &rt
, &fl
)) {
349 /* Try to redo what tcp_v4_send_synack did. */
350 req
->window_clamp
= tp
->window_clamp
? :dst_metric(&rt
->u
.dst
, RTAX_WINDOW
);
352 tcp_select_initial_window(tcp_full_space(sk
), req
->mss
,
353 &req
->rcv_wnd
, &req
->window_clamp
,
354 ireq
->wscale_ok
, &rcv_wscale
);
356 ireq
->rcv_wscale
= rcv_wscale
;
358 ret
= get_cookie_sock(sk
, skb
, req
, &rt
->u
.dst
);