syncookies.c 7.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264
  1. /*
  2. * IPv6 Syncookies implementation for the Linux kernel
  3. *
  4. * Authors:
  5. * Glenn Griffin <ggriffin.kernel@gmail.com>
  6. *
  7. * Based on IPv4 implementation by Andi Kleen
  8. * linux/net/ipv4/syncookies.c
  9. *
  10. * This program is free software; you can redistribute it and/or
  11. * modify it under the terms of the GNU General Public License
  12. * as published by the Free Software Foundation; either version
  13. * 2 of the License, or (at your option) any later version.
  14. *
  15. */
  16. #include <linux/tcp.h>
  17. #include <linux/random.h>
  18. #include <linux/cryptohash.h>
  19. #include <linux/kernel.h>
  20. #include <net/ipv6.h>
  21. #include <net/tcp.h>
  22. #define COOKIEBITS 24 /* Upper bits store count */
  23. #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
  24. /* RFC 2460, Section 8.3:
  25. * [ipv6 tcp] MSS must be computed as the maximum packet size minus 60 [..]
  26. *
  27. * Due to IPV6_MIN_MTU=1280 the lowest possible MSS is 1220, which allows
  28. * using higher values than ipv4 tcp syncookies.
  29. * The other values are chosen based on ethernet (1500 and 9k MTU), plus
  30. * one that accounts for common encap (PPPoe) overhead. Table must be sorted.
  31. */
  32. static __u16 const msstab[] = {
  33. 1280 - 60, /* IPV6_MIN_MTU - 60 */
  34. 1480 - 60,
  35. 1500 - 60,
  36. 9000 - 60,
  37. };
  38. static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
  39. struct request_sock *req,
  40. struct dst_entry *dst)
  41. {
  42. struct inet_connection_sock *icsk = inet_csk(sk);
  43. struct sock *child;
  44. child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst);
  45. if (child)
  46. inet_csk_reqsk_queue_add(sk, req, child);
  47. else
  48. reqsk_free(req);
  49. return child;
  50. }
  51. static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS],
  52. ipv6_cookie_scratch);
  53. static u32 cookie_hash(const struct in6_addr *saddr, const struct in6_addr *daddr,
  54. __be16 sport, __be16 dport, u32 count, int c)
  55. {
  56. __u32 *tmp = __get_cpu_var(ipv6_cookie_scratch);
  57. /*
  58. * we have 320 bits of information to hash, copy in the remaining
  59. * 192 bits required for sha_transform, from the syncookie_secret
  60. * and overwrite the digest with the secret
  61. */
  62. memcpy(tmp + 10, syncookie_secret[c], 44);
  63. memcpy(tmp, saddr, 16);
  64. memcpy(tmp + 4, daddr, 16);
  65. tmp[8] = ((__force u32)sport << 16) + (__force u32)dport;
  66. tmp[9] = count;
  67. sha_transform(tmp + 16, (__u8 *)tmp, tmp + 16 + 5);
  68. return tmp[17];
  69. }
  70. static __u32 secure_tcp_syn_cookie(const struct in6_addr *saddr,
  71. const struct in6_addr *daddr,
  72. __be16 sport, __be16 dport, __u32 sseq,
  73. __u32 data)
  74. {
  75. u32 count = tcp_cookie_time();
  76. return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
  77. sseq + (count << COOKIEBITS) +
  78. ((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
  79. & COOKIEMASK));
  80. }
  81. static __u32 check_tcp_syn_cookie(__u32 cookie, const struct in6_addr *saddr,
  82. const struct in6_addr *daddr, __be16 sport,
  83. __be16 dport, __u32 sseq)
  84. {
  85. __u32 diff, count = tcp_cookie_time();
  86. cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
  87. diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
  88. if (diff >= MAX_SYNCOOKIE_AGE)
  89. return (__u32)-1;
  90. return (cookie -
  91. cookie_hash(saddr, daddr, sport, dport, count - diff, 1))
  92. & COOKIEMASK;
  93. }
  94. u32 __cookie_v6_init_sequence(const struct ipv6hdr *iph,
  95. const struct tcphdr *th, __u16 *mssp)
  96. {
  97. int mssind;
  98. const __u16 mss = *mssp;
  99. for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
  100. if (mss >= msstab[mssind])
  101. break;
  102. *mssp = msstab[mssind];
  103. return secure_tcp_syn_cookie(&iph->saddr, &iph->daddr, th->source,
  104. th->dest, ntohl(th->seq), mssind);
  105. }
  106. EXPORT_SYMBOL_GPL(__cookie_v6_init_sequence);
  107. __u32 cookie_v6_init_sequence(struct sock *sk, const struct sk_buff *skb, __u16 *mssp)
  108. {
  109. const struct ipv6hdr *iph = ipv6_hdr(skb);
  110. const struct tcphdr *th = tcp_hdr(skb);
  111. tcp_synq_overflow(sk);
  112. NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);
  113. return __cookie_v6_init_sequence(iph, th, mssp);
  114. }
  115. int __cookie_v6_check(const struct ipv6hdr *iph, const struct tcphdr *th,
  116. __u32 cookie)
  117. {
  118. __u32 seq = ntohl(th->seq) - 1;
  119. __u32 mssind = check_tcp_syn_cookie(cookie, &iph->saddr, &iph->daddr,
  120. th->source, th->dest, seq);
  121. return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
  122. }
  123. EXPORT_SYMBOL_GPL(__cookie_v6_check);
  124. struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
  125. {
  126. struct tcp_options_received tcp_opt;
  127. struct inet_request_sock *ireq;
  128. struct tcp_request_sock *treq;
  129. struct ipv6_pinfo *np = inet6_sk(sk);
  130. struct tcp_sock *tp = tcp_sk(sk);
  131. const struct tcphdr *th = tcp_hdr(skb);
  132. __u32 cookie = ntohl(th->ack_seq) - 1;
  133. struct sock *ret = sk;
  134. struct request_sock *req;
  135. int mss;
  136. struct dst_entry *dst;
  137. __u8 rcv_wscale;
  138. bool ecn_ok = false;
  139. if (!sysctl_tcp_syncookies || !th->ack || th->rst)
  140. goto out;
  141. if (tcp_synq_no_recent_overflow(sk) ||
  142. (mss = __cookie_v6_check(ipv6_hdr(skb), th, cookie)) == 0) {
  143. NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
  144. goto out;
  145. }
  146. NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
  147. /* check for timestamp cookie support */
  148. memset(&tcp_opt, 0, sizeof(tcp_opt));
  149. tcp_parse_options(skb, &tcp_opt, 0, NULL);
  150. if (!cookie_check_timestamp(&tcp_opt, sock_net(sk), &ecn_ok))
  151. goto out;
  152. ret = NULL;
  153. req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
  154. if (!req)
  155. goto out;
  156. ireq = inet_rsk(req);
  157. treq = tcp_rsk(req);
  158. treq->listener = NULL;
  159. if (security_inet_conn_request(sk, skb, req))
  160. goto out_free;
  161. req->mss = mss;
  162. ireq->ir_rmt_port = th->source;
  163. ireq->ir_num = ntohs(th->dest);
  164. ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
  165. ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
  166. if (ipv6_opt_accepted(sk, skb) ||
  167. np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
  168. np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
  169. atomic_inc(&skb->users);
  170. ireq->pktopts = skb;
  171. }
  172. ireq->ir_iif = sk->sk_bound_dev_if;
  173. /* So that link locals have meaning */
  174. if (!sk->sk_bound_dev_if &&
  175. ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
  176. ireq->ir_iif = inet6_iif(skb);
  177. req->expires = 0UL;
  178. req->num_retrans = 0;
  179. ireq->ecn_ok = ecn_ok;
  180. ireq->snd_wscale = tcp_opt.snd_wscale;
  181. ireq->sack_ok = tcp_opt.sack_ok;
  182. ireq->wscale_ok = tcp_opt.wscale_ok;
  183. ireq->tstamp_ok = tcp_opt.saw_tstamp;
  184. req->ts_recent = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
  185. treq->snt_synack = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsecr : 0;
  186. treq->rcv_isn = ntohl(th->seq) - 1;
  187. treq->snt_isn = cookie;
  188. /*
  189. * We need to lookup the dst_entry to get the correct window size.
  190. * This is taken from tcp_v6_syn_recv_sock. Somebody please enlighten
  191. * me if there is a preferred way.
  192. */
  193. {
  194. struct in6_addr *final_p, final;
  195. struct flowi6 fl6;
  196. memset(&fl6, 0, sizeof(fl6));
  197. fl6.flowi6_proto = IPPROTO_TCP;
  198. fl6.daddr = ireq->ir_v6_rmt_addr;
  199. final_p = fl6_update_dst(&fl6, np->opt, &final);
  200. fl6.saddr = ireq->ir_v6_loc_addr;
  201. fl6.flowi6_oif = sk->sk_bound_dev_if;
  202. fl6.flowi6_mark = sk->sk_mark;
  203. fl6.fl6_dport = ireq->ir_rmt_port;
  204. fl6.fl6_sport = inet_sk(sk)->inet_sport;
  205. security_req_classify_flow(req, flowi6_to_flowi(&fl6));
  206. dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
  207. if (IS_ERR(dst))
  208. goto out_free;
  209. }
  210. req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
  211. tcp_select_initial_window(tcp_full_space(sk), req->mss,
  212. &req->rcv_wnd, &req->window_clamp,
  213. ireq->wscale_ok, &rcv_wscale,
  214. dst_metric(dst, RTAX_INITRWND));
  215. ireq->rcv_wscale = rcv_wscale;
  216. ret = get_cookie_sock(sk, skb, req, dst);
  217. out:
  218. return ret;
  219. out_free:
  220. reqsk_free(req);
  221. return NULL;
  222. }