syncookies.c 7.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283
  1. /*
  2. * Syncookies implementation for the Linux kernel
  3. *
  4. * Copyright (C) 1997 Andi Kleen
  5. * Based on ideas by D.J.Bernstein and Eric Schenk.
  6. *
  7. * This program is free software; you can redistribute it and/or
  8. * modify it under the terms of the GNU General Public License
  9. * as published by the Free Software Foundation; either version
  10. * 2 of the License, or (at your option) any later version.
  11. *
  12. * $Id: syncookies.c,v 1.1.1.1 2007/06/12 07:27:14 eyryu Exp $
  13. *
  14. * Missing: IPv6 support.
  15. */
  16. #include <linux/tcp.h>
  17. #include <linux/slab.h>
  18. #include <linux/random.h>
  19. #include <linux/cryptohash.h>
  20. #include <linux/kernel.h>
  21. #include <net/tcp.h>
  22. extern int sysctl_tcp_syncookies;
  23. static __u32 syncookie_secret[2][16-3+SHA_DIGEST_WORDS];
  24. static __init int init_syncookies(void)
  25. {
  26. get_random_bytes(syncookie_secret, sizeof(syncookie_secret));
  27. return 0;
  28. }
  29. module_init(init_syncookies);
  30. #define COOKIEBITS 24 /* Upper bits store count */
  31. #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
  32. static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
  33. u32 count, int c)
  34. {
  35. __u32 tmp[16 + 5 + SHA_WORKSPACE_WORDS];
  36. memcpy(tmp + 3, syncookie_secret[c], sizeof(syncookie_secret[c]));
  37. tmp[0] = (__force u32)saddr;
  38. tmp[1] = (__force u32)daddr;
  39. tmp[2] = ((__force u32)sport << 16) + (__force u32)dport;
  40. tmp[3] = count;
  41. sha_transform(tmp + 16, (__u8 *)tmp, tmp + 16 + 5);
  42. return tmp[17];
  43. }
  44. static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport,
  45. __be16 dport, __u32 sseq, __u32 count,
  46. __u32 data)
  47. {
  48. /*
  49. * Compute the secure sequence number.
  50. * The output should be:
  51. * HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24)
  52. * + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24).
  53. * Where sseq is their sequence number and count increases every
  54. * minute by 1.
  55. * As an extra hack, we add a small "data" value that encodes the
  56. * MSS into the second hash value.
  57. */
  58. return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
  59. sseq + (count << COOKIEBITS) +
  60. ((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
  61. & COOKIEMASK));
  62. }
  63. /*
  64. * This retrieves the small "data" value from the syncookie.
  65. * If the syncookie is bad, the data returned will be out of
  66. * range. This must be checked by the caller.
  67. *
  68. * The count value used to generate the cookie must be within
  69. * "maxdiff" if the current (passed-in) "count". The return value
  70. * is (__u32)-1 if this test fails.
  71. */
  72. static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
  73. __be16 sport, __be16 dport, __u32 sseq,
  74. __u32 count, __u32 maxdiff)
  75. {
  76. __u32 diff;
  77. /* Strip away the layers from the cookie */
  78. cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
  79. /* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
  80. diff = (count - (cookie >> COOKIEBITS)) & ((__u32) - 1 >> COOKIEBITS);
  81. if (diff >= maxdiff)
  82. return (__u32)-1;
  83. return (cookie -
  84. cookie_hash(saddr, daddr, sport, dport, count - diff, 1))
  85. & COOKIEMASK; /* Leaving the data behind */
  86. }
  87. /*
  88. * This table has to be sorted and terminated with (__u16)-1.
  89. * XXX generate a better table.
  90. * Unresolved Issues: HIPPI with a 64k MSS is not well supported.
  91. */
  92. static __u16 const msstab[] = {
  93. 64 - 1,
  94. 256 - 1,
  95. 512 - 1,
  96. 536 - 1,
  97. 1024 - 1,
  98. 1440 - 1,
  99. 1460 - 1,
  100. 4312 - 1,
  101. (__u16)-1
  102. };
  103. /* The number doesn't include the -1 terminator */
  104. #define NUM_MSS (ARRAY_SIZE(msstab) - 1)
  105. /*
  106. * Generate a syncookie. mssp points to the mss, which is returned
  107. * rounded down to the value encoded in the cookie.
  108. */
  109. __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
  110. {
  111. struct tcp_sock *tp = tcp_sk(sk);
  112. int mssind;
  113. const __u16 mss = *mssp;
  114. tp->last_synq_overflow = jiffies;
  115. /* XXX sort msstab[] by probability? Binary search? */
  116. for (mssind = 0; mss > msstab[mssind + 1]; mssind++)
  117. ;
  118. *mssp = msstab[mssind] + 1;
  119. NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESSENT);
  120. return secure_tcp_syn_cookie(skb->nh.iph->saddr, skb->nh.iph->daddr,
  121. skb->h.th->source, skb->h.th->dest,
  122. ntohl(skb->h.th->seq),
  123. jiffies / (HZ * 60), mssind);
  124. }
  125. /*
  126. * This (misnamed) value is the age of syncookie which is permitted.
  127. * Its ideal value should be dependent on TCP_TIMEOUT_INIT and
  128. * sysctl_tcp_retries1. It's a rather complicated formula (exponential
  129. * backoff) to compute at runtime so it's currently hardcoded here.
  130. */
  131. #define COUNTER_TRIES 4
  132. /*
  133. * Check if a ack sequence number is a valid syncookie.
  134. * Return the decoded mss if it is, or 0 if not.
  135. */
  136. static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
  137. {
  138. __u32 seq;
  139. __u32 mssind;
  140. seq = ntohl(skb->h.th->seq)-1;
  141. mssind = check_tcp_syn_cookie(cookie,
  142. skb->nh.iph->saddr, skb->nh.iph->daddr,
  143. skb->h.th->source, skb->h.th->dest,
  144. seq, jiffies / (HZ * 60), COUNTER_TRIES);
  145. return mssind < NUM_MSS ? msstab[mssind] + 1 : 0;
  146. }
  147. static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
  148. struct request_sock *req,
  149. struct dst_entry *dst)
  150. {
  151. struct inet_connection_sock *icsk = inet_csk(sk);
  152. struct sock *child;
  153. child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst);
  154. if (child)
  155. inet_csk_reqsk_queue_add(sk, req, child);
  156. else
  157. reqsk_free(req);
  158. return child;
  159. }
  160. struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
  161. struct ip_options *opt)
  162. {
  163. struct inet_request_sock *ireq;
  164. struct tcp_request_sock *treq;
  165. struct tcp_sock *tp = tcp_sk(sk);
  166. __u32 cookie = ntohl(skb->h.th->ack_seq) - 1;
  167. struct sock *ret = sk;
  168. struct request_sock *req;
  169. int mss;
  170. struct rtable *rt;
  171. __u8 rcv_wscale;
  172. if (!sysctl_tcp_syncookies || !skb->h.th->ack)
  173. goto out;
  174. if (time_after(jiffies, tp->last_synq_overflow + TCP_TIMEOUT_INIT) ||
  175. (mss = cookie_check(skb, cookie)) == 0) {
  176. NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESFAILED);
  177. goto out;
  178. }
  179. NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESRECV);
  180. ret = NULL;
  181. req = reqsk_alloc(&tcp_request_sock_ops); /* for safety */
  182. if (!req)
  183. goto out;
  184. if (security_inet_conn_request(sk, skb, req)) {
  185. reqsk_free(req);
  186. goto out;
  187. }
  188. ireq = inet_rsk(req);
  189. treq = tcp_rsk(req);
  190. treq->rcv_isn = ntohl(skb->h.th->seq) - 1;
  191. treq->snt_isn = cookie;
  192. req->mss = mss;
  193. ireq->rmt_port = skb->h.th->source;
  194. ireq->loc_addr = skb->nh.iph->daddr;
  195. ireq->rmt_addr = skb->nh.iph->saddr;
  196. ireq->opt = NULL;
  197. /* We throwed the options of the initial SYN away, so we hope
  198. * the ACK carries the same options again (see RFC1122 4.2.3.8)
  199. */
  200. if (opt && opt->optlen) {
  201. int opt_size = sizeof(struct ip_options) + opt->optlen;
  202. ireq->opt = kmalloc(opt_size, GFP_ATOMIC);
  203. if (ireq->opt != NULL && ip_options_echo(ireq->opt, skb)) {
  204. kfree(ireq->opt);
  205. ireq->opt = NULL;
  206. }
  207. }
  208. ireq->snd_wscale = ireq->rcv_wscale = ireq->tstamp_ok = 0;
  209. ireq->wscale_ok = ireq->sack_ok = 0;
  210. req->expires = 0UL;
  211. req->retrans = 0;
  212. /*
  213. * We need to lookup the route here to get at the correct
  214. * window size. We should better make sure that the window size
  215. * hasn't changed since we received the original syn, but I see
  216. * no easy way to do this.
  217. */
  218. {
  219. struct flowi fl = { .nl_u = { .ip4_u =
  220. { .daddr = ((opt && opt->srr) ?
  221. opt->faddr :
  222. ireq->rmt_addr),
  223. .saddr = ireq->loc_addr,
  224. .tos = RT_CONN_FLAGS(sk) } },
  225. .proto = IPPROTO_TCP,
  226. .uli_u = { .ports =
  227. { .sport = skb->h.th->dest,
  228. .dport = skb->h.th->source } } };
  229. security_req_classify_flow(req, &fl);
  230. if (ip_route_output_key(&rt, &fl)) {
  231. reqsk_free(req);
  232. goto out;
  233. }
  234. }
  235. /* Try to redo what tcp_v4_send_synack did. */
  236. req->window_clamp = dst_metric(&rt->u.dst, RTAX_WINDOW);
  237. tcp_select_initial_window(tcp_full_space(sk), req->mss,
  238. &req->rcv_wnd, &req->window_clamp,
  239. 0, &rcv_wscale);
  240. /* BTW win scale with syncookies is 0 by definition */
  241. ireq->rcv_wscale = rcv_wscale;
  242. ret = get_cookie_sock(sk, skb, req, &rt->u.dst);
  243. out: return ret;
  244. }