2 * Syncookies implementation for the Linux kernel
4 * Copyright (C) 1997 Andi Kleen
5 * Based on ideas by D.J.Bernstein and Eric Schenk.
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version
10 * 2 of the License, or (at your option) any later version.
12 * $Id: syncookies.c,v 1.18 2002/02/01 22:01:04 davem Exp $
15 #include <linux/tcp.h>
16 #include <linux/slab.h>
17 #include <linux/random.h>
18 #include <linux/cryptohash.h>
19 #include <linux/kernel.h>
22 extern int sysctl_tcp_syncookies
;
24 __u32 syncookie_secret
[2][16-3+SHA_DIGEST_WORDS
];
25 EXPORT_SYMBOL(syncookie_secret
);
27 static __init
int init_syncookies(void)
29 get_random_bytes(syncookie_secret
, sizeof(syncookie_secret
));
32 __initcall(init_syncookies
);
34 #define COOKIEBITS 24 /* Upper bits store count */
35 #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
37 static DEFINE_PER_CPU(__u32
, cookie_scratch
)[16 + 5 + SHA_WORKSPACE_WORDS
];
39 static u32
cookie_hash(__be32 saddr
, __be32 daddr
, __be16 sport
, __be16 dport
,
42 __u32
*tmp
= __get_cpu_var(cookie_scratch
);
44 memcpy(tmp
+ 3, syncookie_secret
[c
], sizeof(syncookie_secret
[c
]));
45 tmp
[0] = (__force u32
)saddr
;
46 tmp
[1] = (__force u32
)daddr
;
47 tmp
[2] = ((__force u32
)sport
<< 16) + (__force u32
)dport
;
49 sha_transform(tmp
+ 16, (__u8
*)tmp
, tmp
+ 16 + 5);
54 static __u32
secure_tcp_syn_cookie(__be32 saddr
, __be32 daddr
, __be16 sport
,
55 __be16 dport
, __u32 sseq
, __u32 count
,
59 * Compute the secure sequence number.
60 * The output should be:
61 * HASH(sec1,saddr,sport,daddr,dport,sec1) + sseq + (count * 2^24)
62 * + (HASH(sec2,saddr,sport,daddr,dport,count,sec2) % 2^24).
63 * Where sseq is their sequence number and count increases every
65 * As an extra hack, we add a small "data" value that encodes the
66 * MSS into the second hash value.
69 return (cookie_hash(saddr
, daddr
, sport
, dport
, 0, 0) +
70 sseq
+ (count
<< COOKIEBITS
) +
71 ((cookie_hash(saddr
, daddr
, sport
, dport
, count
, 1) + data
)
76 * This retrieves the small "data" value from the syncookie.
77 * If the syncookie is bad, the data returned will be out of
78 * range. This must be checked by the caller.
80 * The count value used to generate the cookie must be within
81 * "maxdiff" if the current (passed-in) "count". The return value
82 * is (__u32)-1 if this test fails.
84 static __u32
check_tcp_syn_cookie(__u32 cookie
, __be32 saddr
, __be32 daddr
,
85 __be16 sport
, __be16 dport
, __u32 sseq
,
86 __u32 count
, __u32 maxdiff
)
90 /* Strip away the layers from the cookie */
91 cookie
-= cookie_hash(saddr
, daddr
, sport
, dport
, 0, 0) + sseq
;
93 /* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
94 diff
= (count
- (cookie
>> COOKIEBITS
)) & ((__u32
) - 1 >> COOKIEBITS
);
99 cookie_hash(saddr
, daddr
, sport
, dport
, count
- diff
, 1))
100 & COOKIEMASK
; /* Leaving the data behind */
104 * This table has to be sorted and terminated with (__u16)-1.
105 * XXX generate a better table.
106 * Unresolved Issues: HIPPI with a 64k MSS is not well supported.
108 static __u16
const msstab
[] = {
119 /* The number doesn't include the -1 terminator */
120 #define NUM_MSS (ARRAY_SIZE(msstab) - 1)
123 * Generate a syncookie. mssp points to the mss, which is returned
124 * rounded down to the value encoded in the cookie.
126 __u32
cookie_v4_init_sequence(struct sock
*sk
, struct sk_buff
*skb
, __u16
*mssp
)
128 struct tcp_sock
*tp
= tcp_sk(sk
);
129 const struct iphdr
*iph
= ip_hdr(skb
);
130 const struct tcphdr
*th
= tcp_hdr(skb
);
132 const __u16 mss
= *mssp
;
134 tp
->last_synq_overflow
= jiffies
;
136 /* XXX sort msstab[] by probability? Binary search? */
137 for (mssind
= 0; mss
> msstab
[mssind
+ 1]; mssind
++)
139 *mssp
= msstab
[mssind
] + 1;
141 NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESSENT
);
143 return secure_tcp_syn_cookie(iph
->saddr
, iph
->daddr
,
144 th
->source
, th
->dest
, ntohl(th
->seq
),
145 jiffies
/ (HZ
* 60), mssind
);
149 * This (misnamed) value is the age of syncookie which is permitted.
150 * Its ideal value should be dependent on TCP_TIMEOUT_INIT and
151 * sysctl_tcp_retries1. It's a rather complicated formula (exponential
152 * backoff) to compute at runtime so it's currently hardcoded here.
154 #define COUNTER_TRIES 4
156 * Check if a ack sequence number is a valid syncookie.
157 * Return the decoded mss if it is, or 0 if not.
159 static inline int cookie_check(struct sk_buff
*skb
, __u32 cookie
)
161 const struct iphdr
*iph
= ip_hdr(skb
);
162 const struct tcphdr
*th
= tcp_hdr(skb
);
163 __u32 seq
= ntohl(th
->seq
) - 1;
164 __u32 mssind
= check_tcp_syn_cookie(cookie
, iph
->saddr
, iph
->daddr
,
165 th
->source
, th
->dest
, seq
,
169 return mssind
< NUM_MSS
? msstab
[mssind
] + 1 : 0;
172 static inline struct sock
*get_cookie_sock(struct sock
*sk
, struct sk_buff
*skb
,
173 struct request_sock
*req
,
174 struct dst_entry
*dst
)
176 struct inet_connection_sock
*icsk
= inet_csk(sk
);
179 child
= icsk
->icsk_af_ops
->syn_recv_sock(sk
, skb
, req
, dst
);
181 inet_csk_reqsk_queue_add(sk
, req
, child
);
188 struct sock
*cookie_v4_check(struct sock
*sk
, struct sk_buff
*skb
,
189 struct ip_options
*opt
)
191 struct inet_request_sock
*ireq
;
192 struct tcp_request_sock
*treq
;
193 struct tcp_sock
*tp
= tcp_sk(sk
);
194 const struct tcphdr
*th
= tcp_hdr(skb
);
195 __u32 cookie
= ntohl(th
->ack_seq
) - 1;
196 struct sock
*ret
= sk
;
197 struct request_sock
*req
;
202 if (!sysctl_tcp_syncookies
|| !th
->ack
)
205 if (time_after(jiffies
, tp
->last_synq_overflow
+ TCP_TIMEOUT_INIT
) ||
206 (mss
= cookie_check(skb
, cookie
)) == 0) {
207 NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESFAILED
);
211 NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESRECV
);
214 req
= reqsk_alloc(&tcp_request_sock_ops
); /* for safety */
218 if (security_inet_conn_request(sk
, skb
, req
)) {
222 ireq
= inet_rsk(req
);
224 treq
->rcv_isn
= ntohl(th
->seq
) - 1;
225 treq
->snt_isn
= cookie
;
227 ireq
->rmt_port
= th
->source
;
228 ireq
->loc_addr
= ip_hdr(skb
)->daddr
;
229 ireq
->rmt_addr
= ip_hdr(skb
)->saddr
;
232 /* We throwed the options of the initial SYN away, so we hope
233 * the ACK carries the same options again (see RFC1122 4.2.3.8)
235 if (opt
&& opt
->optlen
) {
236 int opt_size
= sizeof(struct ip_options
) + opt
->optlen
;
238 ireq
->opt
= kmalloc(opt_size
, GFP_ATOMIC
);
239 if (ireq
->opt
!= NULL
&& ip_options_echo(ireq
->opt
, skb
)) {
245 ireq
->snd_wscale
= ireq
->rcv_wscale
= ireq
->tstamp_ok
= 0;
246 ireq
->wscale_ok
= ireq
->sack_ok
= 0;
251 * We need to lookup the route here to get at the correct
252 * window size. We should better make sure that the window size
253 * hasn't changed since we received the original syn, but I see
254 * no easy way to do this.
257 struct flowi fl
= { .nl_u
= { .ip4_u
=
258 { .daddr
= ((opt
&& opt
->srr
) ?
261 .saddr
= ireq
->loc_addr
,
262 .tos
= RT_CONN_FLAGS(sk
) } },
263 .proto
= IPPROTO_TCP
,
266 .dport
= th
->source
} } };
267 security_req_classify_flow(req
, &fl
);
268 if (ip_route_output_key(&init_net
, &rt
, &fl
)) {
274 /* Try to redo what tcp_v4_send_synack did. */
275 req
->window_clamp
= dst_metric(&rt
->u
.dst
, RTAX_WINDOW
);
276 tcp_select_initial_window(tcp_full_space(sk
), req
->mss
,
277 &req
->rcv_wnd
, &req
->window_clamp
,
279 /* BTW win scale with syncookies is 0 by definition */
280 ireq
->rcv_wscale
= rcv_wscale
;
282 ret
= get_cookie_sock(sk
, skb
, req
, &rt
->u
.dst
);