net/ipv4/tcp_minisocks.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              Implementation of the Transmission Control Protocol(TCP).
   7  *
   8  * Version:     $Id: tcp_minisocks.c,v 1.15 2002/02/01 22:01:04 davem Exp $
   9  *
  10  * Authors:     Ross Biro
  11  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  12  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  13  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
  14  *              Florian La Roche, <flla@stud.uni-sb.de>
  15  *              Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
  16  *              Linus Torvalds, <torvalds@cs.helsinki.fi>
  17  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  18  *              Matthew Dillon, <dillon@apollo.west.oic.com>
  19  *              Arnt Gulbrandsen, <agulbra@nvg.unit.no>
  20  *              Jorge Cwik, <jorge@laser.satlink.net>
  21  */
  22
  23 #include <linux/mm.h>
  24 #include <linux/module.h>
  25 #include <linux/sysctl.h>
  26 #include <linux/workqueue.h>
  27 #include <net/tcp.h>
  28 #include <net/inet_common.h>
  29 #include <net/xfrm.h>
  30
  31 #include <linux/vs_limit.h>
  32 #include <linux/vs_socket.h>
  33 #include <linux/vs_context.h>
  34
  35 #ifdef CONFIG_SYSCTL
  36 #define SYNC_INIT 0 /* let the user enable it */
  37 #else
  38 #define SYNC_INIT 1
  39 #endif
  40
  41 int sysctl_tcp_syncookies = SYNC_INIT;
  42 int sysctl_tcp_abort_on_overflow;
  43
  44 struct inet_timewait_death_row tcp_death_row = {
  45         .sysctl_max_tw_buckets = NR_FILE * 2,
  46         .period         = TCP_TIMEWAIT_LEN / INET_TWDR_TWKILL_SLOTS,
  47         .death_lock     = __SPIN_LOCK_UNLOCKED(tcp_death_row.death_lock),
  48         .hashinfo       = &tcp_hashinfo,
  49         .tw_timer       = TIMER_INITIALIZER(inet_twdr_hangman, 0,
  50                                             (unsigned long)&tcp_death_row),
  51         .twkill_work    = __WORK_INITIALIZER(tcp_death_row.twkill_work,
  52                                              inet_twdr_twkill_work,
  53                                              &tcp_death_row),
  54 /* Short-time timewait calendar */
  55
  56         .twcal_hand     = -1,
  57         .twcal_timer    = TIMER_INITIALIZER(inet_twdr_twcal_tick, 0,
  58                                             (unsigned long)&tcp_death_row),
  59 };
  60
  61 EXPORT_SYMBOL_GPL(tcp_death_row);
  62
  63 static __inline__ int tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
  64 {
  65         if (seq == s_win)
  66                 return 1;
  67         if (after(end_seq, s_win) && before(seq, e_win))
  68                 return 1;
  69         return (seq == e_win && seq == end_seq);
  70 }
  71
  72 /*
  73  * * Main purpose of TIME-WAIT state is to close connection gracefully,
  74  *   when one of ends sits in LAST-ACK or CLOSING retransmitting FIN
  75  *   (and, probably, tail of data) and one or more our ACKs are lost.
  76  * * What is TIME-WAIT timeout? It is associated with maximal packet
  77  *   lifetime in the internet, which results in wrong conclusion, that
  78  *   it is set to catch "old duplicate segments" wandering out of their path.
  79  *   It is not quite correct. This timeout is calculated so that it exceeds
  80  *   maximal retransmission timeout enough to allow to lose one (or more)
  81  *   segments sent by peer and our ACKs. This time may be calculated from RTO.
  82  * * When TIME-WAIT socket receives RST, it means that another end
  83  *   finally closed and we are allowed to kill TIME-WAIT too.
  84  * * Second purpose of TIME-WAIT is catching old duplicate segments.
  85  *   Well, certainly it is pure paranoia, but if we load TIME-WAIT
  86  *   with this semantics, we MUST NOT kill TIME-WAIT state with RSTs.
  87  * * If we invented some more clever way to catch duplicates
  88  *   (f.e. based on PAWS), we could truncate TIME-WAIT to several RTOs.
  89  *
  90  * The algorithm below is based on FORMAL INTERPRETATION of RFCs.
  91  * When you compare it to RFCs, please, read section SEGMENT ARRIVES
  92  * from the very beginning.
  93  *
  94  * NOTE. With recycling (and later with fin-wait-2) TW bucket
  95  * is _not_ stateless. It means, that strictly speaking we must
  96  * spinlock it. I do not want! Well, probability of misbehaviour
  97  * is ridiculously low and, seems, we could use some mb() tricks
  98  * to avoid misread sequence numbers, states etc.  --ANK
  99  */
 100 enum tcp_tw_status
 101 tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
 102                            const struct tcphdr *th)
 103 {
 104         struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
 105         struct tcp_options_received tmp_opt;
 106         int paws_reject = 0;
 107
 108         tmp_opt.saw_tstamp = 0;
 109         if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
 110                 tcp_parse_options(skb, &tmp_opt, 0);
 111
 112                 if (tmp_opt.saw_tstamp) {
 113                         tmp_opt.ts_recent       = tcptw->tw_ts_recent;
 114                         tmp_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
 115                         paws_reject = tcp_paws_check(&tmp_opt, th->rst);
 116                 }
 117         }
 118
 119         if (tw->tw_substate == TCP_FIN_WAIT2) {
 120                 /* Just repeat all the checks of tcp_rcv_state_process() */
 121
 122                 /* Out of window, send ACK */
 123                 if (paws_reject ||
 124                     !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
 125                                    tcptw->tw_rcv_nxt,
 126                                    tcptw->tw_rcv_nxt + tcptw->tw_rcv_wnd))
 127                         return TCP_TW_ACK;
 128
 129                 if (th->rst)
 130                         goto kill;
 131
 132                 if (th->syn && !before(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt))
 133                         goto kill_with_rst;
 134
 135                 /* Dup ACK? */
 136                 if (!after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
 137                     TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
 138                         inet_twsk_put(tw);
 139                         return TCP_TW_SUCCESS;
 140                 }
 141
 142                 /* New data or FIN. If new data arrive after half-duplex close,
 143                  * reset.
 144                  */
 145                 if (!th->fin ||
 146                     TCP_SKB_CB(skb)->end_seq != tcptw->tw_rcv_nxt + 1) {
 147 kill_with_rst:
 148                         inet_twsk_deschedule(tw, &tcp_death_row);
 149                         inet_twsk_put(tw);
 150                         return TCP_TW_RST;
 151                 }
 152
 153                 /* FIN arrived, enter true time-wait state. */
 154                 tw->tw_substate   = TCP_TIME_WAIT;
 155                 tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
 156                 if (tmp_opt.saw_tstamp) {
 157                         tcptw->tw_ts_recent_stamp = xtime.tv_sec;
 158                         tcptw->tw_ts_recent       = tmp_opt.rcv_tsval;
 159                 }
 160
 161                 /* I am shamed, but failed to make it more elegant.
 162                  * Yes, it is direct reference to IP, which is impossible
 163                  * to generalize to IPv6. Taking into account that IPv6
 164                  * do not understand recycling in any case, it not
 165                  * a big problem in practice. --ANK */
 166                 if (tw->tw_family == AF_INET &&
 167                     tcp_death_row.sysctl_tw_recycle && tcptw->tw_ts_recent_stamp &&
 168                     tcp_v4_tw_remember_stamp(tw))
 169                         inet_twsk_schedule(tw, &tcp_death_row, tw->tw_timeout,
 170                                            TCP_TIMEWAIT_LEN);
 171                 else
 172                         inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
 173                                            TCP_TIMEWAIT_LEN);
 174                 return TCP_TW_ACK;
 175         }
 176
 177         /*
 178          *      Now real TIME-WAIT state.
 179          *
 180          *      RFC 1122:
 181          *      "When a connection is [...] on TIME-WAIT state [...]
 182          *      [a TCP] MAY accept a new SYN from the remote TCP to
 183          *      reopen the connection directly, if it:
 184          *
 185          *      (1)  assigns its initial sequence number for the new
 186          *      connection to be larger than the largest sequence
 187          *      number it used on the previous connection incarnation,
 188          *      and
 189          *
 190          *      (2)  returns to TIME-WAIT state if the SYN turns out
 191          *      to be an old duplicate".
 192          */
 193
 194         if (!paws_reject &&
 195             (TCP_SKB_CB(skb)->seq == tcptw->tw_rcv_nxt &&
 196              (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq || th->rst))) {
 197                 /* In window segment, it may be only reset or bare ack. */
 198
 199                 if (th->rst) {
 200                         /* This is TIME_WAIT assassination, in two flavors.
 201                          * Oh well... nobody has a sufficient solution to this
 202                          * protocol bug yet.
 203                          */
 204                         if (sysctl_tcp_rfc1337 == 0) {
 205 kill:
 206                                 inet_twsk_deschedule(tw, &tcp_death_row);
 207                                 inet_twsk_put(tw);
 208                                 return TCP_TW_SUCCESS;
 209                         }
 210                 }
 211                 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
 212                                    TCP_TIMEWAIT_LEN);
 213
 214                 if (tmp_opt.saw_tstamp) {
 215                         tcptw->tw_ts_recent       = tmp_opt.rcv_tsval;
 216                         tcptw->tw_ts_recent_stamp = xtime.tv_sec;
 217                 }
 218
 219                 inet_twsk_put(tw);
 220                 return TCP_TW_SUCCESS;
 221         }
 222
 223         /* Out of window segment.
 224
 225            All the segments are ACKed immediately.
 226
 227            The only exception is new SYN. We accept it, if it is
 228            not old duplicate and we are not in danger to be killed
 229            by delayed old duplicates. RFC check is that it has
 230            newer sequence number works at rates <40Mbit/sec.
 231            However, if paws works, it is reliable AND even more,
 232            we even may relax silly seq space cutoff.
 233
 234            RED-PEN: we violate main RFC requirement, if this SYN will appear
 235            old duplicate (i.e. we receive RST in reply to SYN-ACK),
 236            we must return socket to time-wait state. It is not good,
 237            but not fatal yet.
 238          */
 239
 240         if (th->syn && !th->rst && !th->ack && !paws_reject &&
 241             (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) ||
 242              (tmp_opt.saw_tstamp &&
 243               (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) {
 244                 u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
 245                 if (isn == 0)
 246                         isn++;
 247                 TCP_SKB_CB(skb)->when = isn;
 248                 return TCP_TW_SYN;
 249         }
 250
 251         if (paws_reject)
 252                 NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
 253
 254         if(!th->rst) {
 255                 /* In this case we must reset the TIMEWAIT timer.
 256                  *
 257                  * If it is ACKless SYN it may be both old duplicate
 258                  * and new good SYN with random sequence number <rcv_nxt.
 259                  * Do not reschedule in the last case.
 260                  */
 261                 if (paws_reject || th->ack)
 262                         inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
 263                                            TCP_TIMEWAIT_LEN);
 264
 265                 /* Send ACK. Note, we do not put the bucket,
 266                  * it will be released by caller.
 267                  */
 268                 return TCP_TW_ACK;
 269         }
 270         inet_twsk_put(tw);
 271         return TCP_TW_SUCCESS;
 272 }
 273
 274 /*
 275  * Move a socket to time-wait or dead fin-wait-2 state.
 276  */
 277 void tcp_time_wait(struct sock *sk, int state, int timeo)
 278 {
 279         struct inet_timewait_sock *tw = NULL;
 280         const struct inet_connection_sock *icsk = inet_csk(sk);
 281         const struct tcp_sock *tp = tcp_sk(sk);
 282         int recycle_ok = 0;
 283
 284         if (tcp_death_row.sysctl_tw_recycle && tp->rx_opt.ts_recent_stamp)
 285                 recycle_ok = icsk->icsk_af_ops->remember_stamp(sk);
 286
 287         if (tcp_death_row.tw_count < tcp_death_row.sysctl_max_tw_buckets)
 288                 tw = inet_twsk_alloc(sk, state);
 289
 290         if (tw != NULL) {
 291                 struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
 292                 const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
 293
 294                 tw->tw_rcv_wscale       = tp->rx_opt.rcv_wscale;
 295                 tcptw->tw_rcv_nxt       = tp->rcv_nxt;
 296                 tcptw->tw_snd_nxt       = tp->snd_nxt;
 297                 tcptw->tw_rcv_wnd       = tcp_receive_window(tp);
 298                 tcptw->tw_ts_recent     = tp->rx_opt.ts_recent;
 299                 tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
 300
 301                 tw->tw_xid              = sk->sk_xid;
 302                 tw->tw_vx_info          = NULL;
 303                 tw->tw_nid              = sk->sk_nid;
 304                 tw->tw_nx_info          = NULL;
 305
 306 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 307                 if (tw->tw_family == PF_INET6) {
 308                         struct ipv6_pinfo *np = inet6_sk(sk);
 309                         struct inet6_timewait_sock *tw6;
 310
 311                         tw->tw_ipv6_offset = inet6_tw_offset(sk->sk_prot);
 312                         tw6 = inet6_twsk((struct sock *)tw);
 313                         ipv6_addr_copy(&tw6->tw_v6_daddr, &np->daddr);
 314                         ipv6_addr_copy(&tw6->tw_v6_rcv_saddr, &np->rcv_saddr);
 315                         tw->tw_ipv6only = np->ipv6only;
 316                 }
 317 #endif
 318                 /* Linkage updates. */
 319                 __inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
 320
 321                 /* Get the TIME_WAIT timeout firing. */
 322                 if (timeo < rto)
 323                         timeo = rto;
 324
 325                 if (recycle_ok) {
 326                         tw->tw_timeout = rto;
 327                 } else {
 328                         tw->tw_timeout = TCP_TIMEWAIT_LEN;
 329                         if (state == TCP_TIME_WAIT)
 330                                 timeo = TCP_TIMEWAIT_LEN;
 331                 }
 332
 333                 inet_twsk_schedule(tw, &tcp_death_row, timeo,
 334                                    TCP_TIMEWAIT_LEN);
 335                 inet_twsk_put(tw);
 336         } else {
 337                 /* Sorry, if we're out of memory, just CLOSE this
 338                  * socket up.  We've got bigger problems than
 339                  * non-graceful socket closings.
 340                  */
 341                 if (net_ratelimit())
 342                         printk(KERN_INFO "TCP: time wait bucket table overflow\n");
 343         }
 344
 345         tcp_update_metrics(sk);
 346         tcp_done(sk);
 347 }
 348
 349 /* This is not only more efficient than what we used to do, it eliminates
 350  * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM
 351  *
 352  * Actually, we could lots of memory writes here. tp of listening
 353  * socket contains all necessary default parameters.
 354  */
 355 struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb)
 356 {
 357         struct sock *newsk = inet_csk_clone(sk, req, GFP_ATOMIC);
 358
 359         if (newsk != NULL) {
 360                 const struct inet_request_sock *ireq = inet_rsk(req);
 361                 struct tcp_request_sock *treq = tcp_rsk(req);
 362                 struct inet_connection_sock *newicsk = inet_csk(sk);
 363                 struct tcp_sock *newtp;
 364
 365                 /* Now setup tcp_sock */
 366                 newtp = tcp_sk(newsk);
 367                 newtp->pred_flags = 0;
 368                 newtp->rcv_nxt = treq->rcv_isn + 1;
 369                 newtp->snd_nxt = newtp->snd_una = newtp->snd_sml = treq->snt_isn + 1;
 370
 371                 tcp_prequeue_init(newtp);
 372
 373                 tcp_init_wl(newtp, treq->snt_isn, treq->rcv_isn);
 374
 375                 newtp->srtt = 0;
 376                 newtp->mdev = TCP_TIMEOUT_INIT;
 377                 newicsk->icsk_rto = TCP_TIMEOUT_INIT;
 378
 379                 newtp->packets_out = 0;
 380                 newtp->left_out = 0;
 381                 newtp->retrans_out = 0;
 382                 newtp->sacked_out = 0;
 383                 newtp->fackets_out = 0;
 384                 newtp->snd_ssthresh = 0x7fffffff;
 385
 386                 /* So many TCP implementations out there (incorrectly) count the
 387                  * initial SYN frame in their delayed-ACK and congestion control
 388                  * algorithms that we must have the following bandaid to talk
 389                  * efficiently to them.  -DaveM
 390                  */
 391                 newtp->snd_cwnd = 2;
 392                 newtp->snd_cwnd_cnt = 0;
 393                 newtp->bytes_acked = 0;
 394
 395                 newtp->frto_counter = 0;
 396                 newtp->frto_highmark = 0;
 397
 398                 newicsk->icsk_ca_ops = &tcp_init_congestion_ops;
 399
 400                 tcp_set_ca_state(newsk, TCP_CA_Open);
 401                 tcp_init_xmit_timers(newsk);
 402                 skb_queue_head_init(&newtp->out_of_order_queue);
 403                 newtp->rcv_wup = treq->rcv_isn + 1;
 404                 newtp->write_seq = treq->snt_isn + 1;
 405                 newtp->pushed_seq = newtp->write_seq;
 406                 newtp->copied_seq = treq->rcv_isn + 1;
 407
 408                 newtp->rx_opt.saw_tstamp = 0;
 409
 410                 newtp->rx_opt.dsack = 0;
 411                 newtp->rx_opt.eff_sacks = 0;
 412
 413                 newtp->rx_opt.num_sacks = 0;
 414                 newtp->urg_data = 0;
 415
 416                 if (sock_flag(newsk, SOCK_KEEPOPEN))
 417                         inet_csk_reset_keepalive_timer(newsk,
 418                                                        keepalive_time_when(newtp));
 419
 420                 newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
 421                 if((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
 422                         if (sysctl_tcp_fack)
 423                                 newtp->rx_opt.sack_ok |= 2;
 424                 }
 425                 newtp->window_clamp = req->window_clamp;
 426                 newtp->rcv_ssthresh = req->rcv_wnd;
 427                 newtp->rcv_wnd = req->rcv_wnd;
 428                 newtp->rx_opt.wscale_ok = ireq->wscale_ok;
 429                 if (newtp->rx_opt.wscale_ok) {
 430                         newtp->rx_opt.snd_wscale = ireq->snd_wscale;
 431                         newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
 432                 } else {
 433                         newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
 434                         newtp->window_clamp = min(newtp->window_clamp, 65535U);
 435                 }
 436                 newtp->snd_wnd = ntohs(skb->h.th->window) << newtp->rx_opt.snd_wscale;
 437                 newtp->max_window = newtp->snd_wnd;
 438
 439                 if (newtp->rx_opt.tstamp_ok) {
 440                         newtp->rx_opt.ts_recent = req->ts_recent;
 441                         newtp->rx_opt.ts_recent_stamp = xtime.tv_sec;
 442                         newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
 443                 } else {
 444                         newtp->rx_opt.ts_recent_stamp = 0;
 445                         newtp->tcp_header_len = sizeof(struct tcphdr);
 446                 }
 447                 if (skb->len >= TCP_MIN_RCVMSS+newtp->tcp_header_len)
 448                         newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
 449                 newtp->rx_opt.mss_clamp = req->mss;
 450                 TCP_ECN_openreq_child(newtp, req);
 451
 452                 TCP_INC_STATS_BH(TCP_MIB_PASSIVEOPENS);
 453         }
 454         return newsk;
 455 }
 456
 457 /*
 458  *      Process an incoming packet for SYN_RECV sockets represented
 459  *      as a request_sock.
 460  */
 461
 462 struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
 463                            struct request_sock *req,
 464                            struct request_sock **prev)
 465 {
 466         struct tcphdr *th = skb->h.th;
 467         u32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
 468         int paws_reject = 0;
 469         struct tcp_options_received tmp_opt;
 470         struct sock *child;
 471
 472         tmp_opt.saw_tstamp = 0;
 473         if (th->doff > (sizeof(struct tcphdr)>>2)) {
 474                 tcp_parse_options(skb, &tmp_opt, 0);
 475
 476                 if (tmp_opt.saw_tstamp) {
 477                         tmp_opt.ts_recent = req->ts_recent;
 478                         /* We do not store true stamp, but it is not required,
 479                          * it can be estimated (approximately)
 480                          * from another data.
 481                          */
 482                         tmp_opt.ts_recent_stamp = xtime.tv_sec - ((TCP_TIMEOUT_INIT/HZ)<<req->retrans);
 483                         paws_reject = tcp_paws_check(&tmp_opt, th->rst);
 484                 }
 485         }
 486
 487         /* Check for pure retransmitted SYN. */
 488         if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
 489             flg == TCP_FLAG_SYN &&
 490             !paws_reject) {
 491                 /*
 492                  * RFC793 draws (Incorrectly! It was fixed in RFC1122)
 493                  * this case on figure 6 and figure 8, but formal
 494                  * protocol description says NOTHING.
 495                  * To be more exact, it says that we should send ACK,
 496                  * because this segment (at least, if it has no data)
 497                  * is out of window.
 498                  *
 499                  *  CONCLUSION: RFC793 (even with RFC1122) DOES NOT
 500                  *  describe SYN-RECV state. All the description
 501                  *  is wrong, we cannot believe to it and should
 502                  *  rely only on common sense and implementation
 503                  *  experience.
 504                  *
 505                  * Enforce "SYN-ACK" according to figure 8, figure 6
 506                  * of RFC793, fixed by RFC1122.
 507                  */
 508                 req->rsk_ops->rtx_syn_ack(sk, req, NULL);
 509                 return NULL;
 510         }
 511
 512         /* Further reproduces section "SEGMENT ARRIVES"
 513            for state SYN-RECEIVED of RFC793.
 514            It is broken, however, it does not work only
 515            when SYNs are crossed.
 516
 517            You would think that SYN crossing is impossible here, since
 518            we should have a SYN_SENT socket (from connect()) on our end,
 519            but this is not true if the crossed SYNs were sent to both
 520            ends by a malicious third party.  We must defend against this,
 521            and to do that we first verify the ACK (as per RFC793, page
 522            36) and reset if it is invalid.  Is this a true full defense?
 523            To convince ourselves, let us consider a way in which the ACK
 524            test can still pass in this 'malicious crossed SYNs' case.
 525            Malicious sender sends identical SYNs (and thus identical sequence
 526            numbers) to both A and B:
 527
 528                 A: gets SYN, seq=7
 529                 B: gets SYN, seq=7
 530
 531            By our good fortune, both A and B select the same initial
 532            send sequence number of seven :-)
 533
 534                 A: sends SYN|ACK, seq=7, ack_seq=8
 535                 B: sends SYN|ACK, seq=7, ack_seq=8
 536
 537            So we are now A eating this SYN|ACK, ACK test passes.  So
 538            does sequence test, SYN is truncated, and thus we consider
 539            it a bare ACK.
 540
 541            If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this
 542            bare ACK.  Otherwise, we create an established connection.  Both
 543            ends (listening sockets) accept the new incoming connection and try
 544            to talk to each other. 8-)
 545
 546            Note: This case is both harmless, and rare.  Possibility is about the
 547            same as us discovering intelligent life on another plant tomorrow.
 548
 549            But generally, we should (RFC lies!) to accept ACK
 550            from SYNACK both here and in tcp_rcv_state_process().
 551            tcp_rcv_state_process() does not, hence, we do not too.
 552
 553            Note that the case is absolutely generic:
 554            we cannot optimize anything here without
 555            violating protocol. All the checks must be made
 556            before attempt to create socket.
 557          */
 558
 559         /* RFC793 page 36: "If the connection is in any non-synchronized state ...
 560          *                  and the incoming segment acknowledges something not yet
 561          *                  sent (the segment carries an unacceptable ACK) ...
 562          *                  a reset is sent."
 563          *
 564          * Invalid ACK: reset will be sent by listening socket
 565          */
 566         if ((flg & TCP_FLAG_ACK) &&
 567             (TCP_SKB_CB(skb)->ack_seq != tcp_rsk(req)->snt_isn + 1))
 568                 return sk;
 569
 570         /* Also, it would be not so bad idea to check rcv_tsecr, which
 571          * is essentially ACK extension and too early or too late values
 572          * should cause reset in unsynchronized states.
 573          */
 574
 575         /* RFC793: "first check sequence number". */
 576
 577         if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
 578                                           tcp_rsk(req)->rcv_isn + 1, tcp_rsk(req)->rcv_isn + 1 + req->rcv_wnd)) {
 579                 /* Out of window: send ACK and drop. */
 580                 if (!(flg & TCP_FLAG_RST))
 581                         req->rsk_ops->send_ack(skb, req);
 582                 if (paws_reject)
 583                         NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
 584                 return NULL;
 585         }
 586
 587         /* In sequence, PAWS is OK. */
 588
 589         if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_isn + 1))
 590                         req->ts_recent = tmp_opt.rcv_tsval;
 591
 592                 if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
 593                         /* Truncate SYN, it is out of window starting
 594                            at tcp_rsk(req)->rcv_isn + 1. */
 595                         flg &= ~TCP_FLAG_SYN;
 596                 }
 597
 598                 /* RFC793: "second check the RST bit" and
 599                  *         "fourth, check the SYN bit"
 600                  */
 601                 if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
 602                         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 603                         goto embryonic_reset;
 604                 }
 605
 606                 /* ACK sequence verified above, just make sure ACK is
 607                  * set.  If ACK not set, just silently drop the packet.
 608                  */
 609                 if (!(flg & TCP_FLAG_ACK))
 610                         return NULL;
 611
 612                 /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
 613                 if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
 614                     TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
 615                         inet_rsk(req)->acked = 1;
 616                         return NULL;
 617                 }
 618
 619                 /* OK, ACK is valid, create big socket and
 620                  * feed this segment to it. It will repeat all
 621                  * the tests. THIS SEGMENT MUST MOVE SOCKET TO
 622                  * ESTABLISHED STATE. If it will be dropped after
 623                  * socket is created, wait for troubles.
 624                  */
 625                 child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb,
 626                                                                  req, NULL);
 627                 if (child == NULL)
 628                         goto listen_overflow;
 629
 630                 inet_csk_reqsk_queue_unlink(sk, req, prev);
 631                 inet_csk_reqsk_queue_removed(sk, req);
 632
 633                 inet_csk_reqsk_queue_add(sk, req, child);
 634                 return child;
 635
 636         listen_overflow:
 637                 if (!sysctl_tcp_abort_on_overflow) {
 638                         inet_rsk(req)->acked = 1;
 639                         return NULL;
 640                 }
 641
 642         embryonic_reset:
 643                 NET_INC_STATS_BH(LINUX_MIB_EMBRYONICRSTS);
 644                 if (!(flg & TCP_FLAG_RST))
 645                         req->rsk_ops->send_reset(skb);
 646
 647                 inet_csk_reqsk_queue_drop(sk, req, prev);
 648                 return NULL;
 649 }
 650
 651 /*
 652  * Queue segment on the new socket if the new socket is active,
 653  * otherwise we just shortcircuit this and continue with
 654  * the new socket.
 655  */
 656
 657 int tcp_child_process(struct sock *parent, struct sock *child,
 658                       struct sk_buff *skb)
 659 {
 660         int ret = 0;
 661         int state = child->sk_state;
 662
 663         if (!sock_owned_by_user(child)) {
 664                 ret = tcp_rcv_state_process(child, skb, skb->h.th, skb->len);
 665
 666                 /* Wakeup parent, send SIGIO */
 667                 if (state == TCP_SYN_RECV && child->sk_state != state)
 668                         parent->sk_data_ready(parent, 0);
 669         } else {
 670                 /* Alas, it is possible again, because we do lookup
 671                  * in main socket hash table and lock on listening
 672                  * socket does not protect us more.
 673                  */
 674                 sk_add_backlog(child, skb);
 675         }
 676
 677         bh_unlock_sock(child);
 678         sock_put(child);
 679         return ret;
 680 }
 681
 682 EXPORT_SYMBOL(tcp_check_req);
 683 EXPORT_SYMBOL(tcp_child_process);
 684 EXPORT_SYMBOL(tcp_create_openreq_child);
 685 EXPORT_SYMBOL(tcp_timewait_state_process);