net/ipv4/tcp_minisocks.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              Implementation of the Transmission Control Protocol(TCP).
   7  *
   8  * Version:     $Id: tcp_minisocks.c,v 1.15 2002/02/01 22:01:04 davem Exp $
   9  *
  10  * Authors:     Ross Biro
  11  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  12  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  13  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
  14  *              Florian La Roche, <flla@stud.uni-sb.de>
  15  *              Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
  16  *              Linus Torvalds, <torvalds@cs.helsinki.fi>
  17  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  18  *              Matthew Dillon, <dillon@apollo.west.oic.com>
  19  *              Arnt Gulbrandsen, <agulbra@nvg.unit.no>
  20  *              Jorge Cwik, <jorge@laser.satlink.net>
  21  */
  22
  23 #include <linux/mm.h>
  24 #include <linux/module.h>
  25 #include <linux/sysctl.h>
  26 #include <linux/workqueue.h>
  27 #include <net/tcp.h>
  28 #include <net/inet_common.h>
  29 #include <net/xfrm.h>
  30
  31 #include <linux/vs_limit.h>
  32 #include <linux/vs_socket.h>
  33 #include <linux/vs_context.h>
  34
  35 #ifdef CONFIG_SYSCTL
  36 #define SYNC_INIT 0 /* let the user enable it */
  37 #else
  38 #define SYNC_INIT 1
  39 #endif
  40
  41 int sysctl_tcp_syncookies __read_mostly = SYNC_INIT;
  42 int sysctl_tcp_abort_on_overflow __read_mostly;
  43
  44 struct inet_timewait_death_row tcp_death_row = {
  45         .sysctl_max_tw_buckets = NR_FILE * 2,
  46         .period         = TCP_TIMEWAIT_LEN / INET_TWDR_TWKILL_SLOTS,
  47         .death_lock     = __SPIN_LOCK_UNLOCKED(tcp_death_row.death_lock),
  48         .hashinfo       = &tcp_hashinfo,
  49         .tw_timer       = TIMER_INITIALIZER(inet_twdr_hangman, 0,
  50                                             (unsigned long)&tcp_death_row),
  51         .twkill_work    = __WORK_INITIALIZER(tcp_death_row.twkill_work,
  52                                              inet_twdr_twkill_work),
  53 /* Short-time timewait calendar */
  54
  55         .twcal_hand     = -1,
  56         .twcal_timer    = TIMER_INITIALIZER(inet_twdr_twcal_tick, 0,
  57                                             (unsigned long)&tcp_death_row),
  58 };
  59
  60 EXPORT_SYMBOL_GPL(tcp_death_row);
  61
  62 static __inline__ int tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
  63 {
  64         if (seq == s_win)
  65                 return 1;
  66         if (after(end_seq, s_win) && before(seq, e_win))
  67                 return 1;
  68         return (seq == e_win && seq == end_seq);
  69 }
  70
  71 /*
  72  * * Main purpose of TIME-WAIT state is to close connection gracefully,
  73  *   when one of ends sits in LAST-ACK or CLOSING retransmitting FIN
  74  *   (and, probably, tail of data) and one or more our ACKs are lost.
  75  * * What is TIME-WAIT timeout? It is associated with maximal packet
  76  *   lifetime in the internet, which results in wrong conclusion, that
  77  *   it is set to catch "old duplicate segments" wandering out of their path.
  78  *   It is not quite correct. This timeout is calculated so that it exceeds
  79  *   maximal retransmission timeout enough to allow to lose one (or more)
  80  *   segments sent by peer and our ACKs. This time may be calculated from RTO.
  81  * * When TIME-WAIT socket receives RST, it means that another end
  82  *   finally closed and we are allowed to kill TIME-WAIT too.
  83  * * Second purpose of TIME-WAIT is catching old duplicate segments.
  84  *   Well, certainly it is pure paranoia, but if we load TIME-WAIT
  85  *   with this semantics, we MUST NOT kill TIME-WAIT state with RSTs.
  86  * * If we invented some more clever way to catch duplicates
  87  *   (f.e. based on PAWS), we could truncate TIME-WAIT to several RTOs.
  88  *
  89  * The algorithm below is based on FORMAL INTERPRETATION of RFCs.
  90  * When you compare it to RFCs, please, read section SEGMENT ARRIVES
  91  * from the very beginning.
  92  *
  93  * NOTE. With recycling (and later with fin-wait-2) TW bucket
  94  * is _not_ stateless. It means, that strictly speaking we must
  95  * spinlock it. I do not want! Well, probability of misbehaviour
  96  * is ridiculously low and, seems, we could use some mb() tricks
  97  * to avoid misread sequence numbers, states etc.  --ANK
  98  */
  99 enum tcp_tw_status
 100 tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
 101                            const struct tcphdr *th)
 102 {
 103         struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
 104         struct tcp_options_received tmp_opt;
 105         int paws_reject = 0;
 106
 107         tmp_opt.saw_tstamp = 0;
 108         if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
 109                 tcp_parse_options(skb, &tmp_opt, 0);
 110
 111                 if (tmp_opt.saw_tstamp) {
 112                         tmp_opt.ts_recent       = tcptw->tw_ts_recent;
 113                         tmp_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
 114                         paws_reject = tcp_paws_check(&tmp_opt, th->rst);
 115                 }
 116         }
 117
 118         if (tw->tw_substate == TCP_FIN_WAIT2) {
 119                 /* Just repeat all the checks of tcp_rcv_state_process() */
 120
 121                 /* Out of window, send ACK */
 122                 if (paws_reject ||
 123                     !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
 124                                    tcptw->tw_rcv_nxt,
 125                                    tcptw->tw_rcv_nxt + tcptw->tw_rcv_wnd))
 126                         return TCP_TW_ACK;
 127
 128                 if (th->rst)
 129                         goto kill;
 130
 131                 if (th->syn && !before(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt))
 132                         goto kill_with_rst;
 133
 134                 /* Dup ACK? */
 135                 if (!after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
 136                     TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
 137                         inet_twsk_put(tw);
 138                         return TCP_TW_SUCCESS;
 139                 }
 140
 141                 /* New data or FIN. If new data arrive after half-duplex close,
 142                  * reset.
 143                  */
 144                 if (!th->fin ||
 145                     TCP_SKB_CB(skb)->end_seq != tcptw->tw_rcv_nxt + 1) {
 146 kill_with_rst:
 147                         inet_twsk_deschedule(tw, &tcp_death_row);
 148                         inet_twsk_put(tw);
 149                         return TCP_TW_RST;
 150                 }
 151
 152                 /* FIN arrived, enter true time-wait state. */
 153                 tw->tw_substate   = TCP_TIME_WAIT;
 154                 tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
 155                 if (tmp_opt.saw_tstamp) {
 156                         tcptw->tw_ts_recent_stamp = xtime.tv_sec;
 157                         tcptw->tw_ts_recent       = tmp_opt.rcv_tsval;
 158                 }
 159
 160                 /* I am shamed, but failed to make it more elegant.
 161                  * Yes, it is direct reference to IP, which is impossible
 162                  * to generalize to IPv6. Taking into account that IPv6
 163                  * do not understand recycling in any case, it not
 164                  * a big problem in practice. --ANK */
 165                 if (tw->tw_family == AF_INET &&
 166                     tcp_death_row.sysctl_tw_recycle && tcptw->tw_ts_recent_stamp &&
 167                     tcp_v4_tw_remember_stamp(tw))
 168                         inet_twsk_schedule(tw, &tcp_death_row, tw->tw_timeout,
 169                                            TCP_TIMEWAIT_LEN);
 170                 else
 171                         inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
 172                                            TCP_TIMEWAIT_LEN);
 173                 return TCP_TW_ACK;
 174         }
 175
 176         /*
 177          *      Now real TIME-WAIT state.
 178          *
 179          *      RFC 1122:
 180          *      "When a connection is [...] on TIME-WAIT state [...]
 181          *      [a TCP] MAY accept a new SYN from the remote TCP to
 182          *      reopen the connection directly, if it:
 183          *
 184          *      (1)  assigns its initial sequence number for the new
 185          *      connection to be larger than the largest sequence
 186          *      number it used on the previous connection incarnation,
 187          *      and
 188          *
 189          *      (2)  returns to TIME-WAIT state if the SYN turns out
 190          *      to be an old duplicate".
 191          */
 192
 193         if (!paws_reject &&
 194             (TCP_SKB_CB(skb)->seq == tcptw->tw_rcv_nxt &&
 195              (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq || th->rst))) {
 196                 /* In window segment, it may be only reset or bare ack. */
 197
 198                 if (th->rst) {
 199                         /* This is TIME_WAIT assassination, in two flavors.
 200                          * Oh well... nobody has a sufficient solution to this
 201                          * protocol bug yet.
 202                          */
 203                         if (sysctl_tcp_rfc1337 == 0) {
 204 kill:
 205                                 inet_twsk_deschedule(tw, &tcp_death_row);
 206                                 inet_twsk_put(tw);
 207                                 return TCP_TW_SUCCESS;
 208                         }
 209                 }
 210                 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
 211                                    TCP_TIMEWAIT_LEN);
 212
 213                 if (tmp_opt.saw_tstamp) {
 214                         tcptw->tw_ts_recent       = tmp_opt.rcv_tsval;
 215                         tcptw->tw_ts_recent_stamp = xtime.tv_sec;
 216                 }
 217
 218                 inet_twsk_put(tw);
 219                 return TCP_TW_SUCCESS;
 220         }
 221
 222         /* Out of window segment.
 223
 224            All the segments are ACKed immediately.
 225
 226            The only exception is new SYN. We accept it, if it is
 227            not old duplicate and we are not in danger to be killed
 228            by delayed old duplicates. RFC check is that it has
 229            newer sequence number works at rates <40Mbit/sec.
 230            However, if paws works, it is reliable AND even more,
 231            we even may relax silly seq space cutoff.
 232
 233            RED-PEN: we violate main RFC requirement, if this SYN will appear
 234            old duplicate (i.e. we receive RST in reply to SYN-ACK),
 235            we must return socket to time-wait state. It is not good,
 236            but not fatal yet.
 237          */
 238
 239         if (th->syn && !th->rst && !th->ack && !paws_reject &&
 240             (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) ||
 241              (tmp_opt.saw_tstamp &&
 242               (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) {
 243                 u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
 244                 if (isn == 0)
 245                         isn++;
 246                 TCP_SKB_CB(skb)->when = isn;
 247                 return TCP_TW_SYN;
 248         }
 249
 250         if (paws_reject)
 251                 NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
 252
 253         if(!th->rst) {
 254                 /* In this case we must reset the TIMEWAIT timer.
 255                  *
 256                  * If it is ACKless SYN it may be both old duplicate
 257                  * and new good SYN with random sequence number <rcv_nxt.
 258                  * Do not reschedule in the last case.
 259                  */
 260                 if (paws_reject || th->ack)
 261                         inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
 262                                            TCP_TIMEWAIT_LEN);
 263
 264                 /* Send ACK. Note, we do not put the bucket,
 265                  * it will be released by caller.
 266                  */
 267                 return TCP_TW_ACK;
 268         }
 269         inet_twsk_put(tw);
 270         return TCP_TW_SUCCESS;
 271 }
 272
 273 /*
 274  * Move a socket to time-wait or dead fin-wait-2 state.
 275  */
 276 void tcp_time_wait(struct sock *sk, int state, int timeo)
 277 {
 278         struct inet_timewait_sock *tw = NULL;
 279         const struct inet_connection_sock *icsk = inet_csk(sk);
 280         const struct tcp_sock *tp = tcp_sk(sk);
 281         int recycle_ok = 0;
 282
 283         if (tcp_death_row.sysctl_tw_recycle && tp->rx_opt.ts_recent_stamp)
 284                 recycle_ok = icsk->icsk_af_ops->remember_stamp(sk);
 285
 286         if (tcp_death_row.tw_count < tcp_death_row.sysctl_max_tw_buckets)
 287                 tw = inet_twsk_alloc(sk, state);
 288
 289         if (tw != NULL) {
 290                 struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
 291                 const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
 292
 293                 tw->tw_rcv_wscale       = tp->rx_opt.rcv_wscale;
 294                 tcptw->tw_rcv_nxt       = tp->rcv_nxt;
 295                 tcptw->tw_snd_nxt       = tp->snd_nxt;
 296                 tcptw->tw_rcv_wnd       = tcp_receive_window(tp);
 297                 tcptw->tw_ts_recent     = tp->rx_opt.ts_recent;
 298                 tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
 299
 300                 tw->tw_xid              = sk->sk_xid;
 301                 tw->tw_vx_info          = NULL;
 302                 tw->tw_nid              = sk->sk_nid;
 303                 tw->tw_nx_info          = NULL;
 304
 305 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 306                 if (tw->tw_family == PF_INET6) {
 307                         struct ipv6_pinfo *np = inet6_sk(sk);
 308                         struct inet6_timewait_sock *tw6;
 309
 310                         tw->tw_ipv6_offset = inet6_tw_offset(sk->sk_prot);
 311                         tw6 = inet6_twsk((struct sock *)tw);
 312                         ipv6_addr_copy(&tw6->tw_v6_daddr, &np->daddr);
 313                         ipv6_addr_copy(&tw6->tw_v6_rcv_saddr, &np->rcv_saddr);
 314                         tw->tw_ipv6only = np->ipv6only;
 315                 }
 316 #endif
 317
 318 #ifdef CONFIG_TCP_MD5SIG
 319                 /*
 320                  * The timewait bucket does not have the key DB from the
 321                  * sock structure. We just make a quick copy of the
 322                  * md5 key being used (if indeed we are using one)
 323                  * so the timewait ack generating code has the key.
 324                  */
 325                 do {
 326                         struct tcp_md5sig_key *key;
 327                         memset(tcptw->tw_md5_key, 0, sizeof(tcptw->tw_md5_key));
 328                         tcptw->tw_md5_keylen = 0;
 329                         key = tp->af_specific->md5_lookup(sk, sk);
 330                         if (key != NULL) {
 331                                 memcpy(&tcptw->tw_md5_key, key->key, key->keylen);
 332                                 tcptw->tw_md5_keylen = key->keylen;
 333                                 if (tcp_alloc_md5sig_pool() == NULL)
 334                                         BUG();
 335                         }
 336                 } while(0);
 337 #endif
 338
 339                 /* Linkage updates. */
 340                 __inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
 341
 342                 /* Get the TIME_WAIT timeout firing. */
 343                 if (timeo < rto)
 344                         timeo = rto;
 345
 346                 if (recycle_ok) {
 347                         tw->tw_timeout = rto;
 348                 } else {
 349                         tw->tw_timeout = TCP_TIMEWAIT_LEN;
 350                         if (state == TCP_TIME_WAIT)
 351                                 timeo = TCP_TIMEWAIT_LEN;
 352                 }
 353
 354                 inet_twsk_schedule(tw, &tcp_death_row, timeo,
 355                                    TCP_TIMEWAIT_LEN);
 356                 inet_twsk_put(tw);
 357         } else {
 358                 /* Sorry, if we're out of memory, just CLOSE this
 359                  * socket up.  We've got bigger problems than
 360                  * non-graceful socket closings.
 361                  */
 362                 LIMIT_NETDEBUG(KERN_INFO "TCP: time wait bucket table overflow\n");
 363         }
 364
 365         tcp_update_metrics(sk);
 366         tcp_done(sk);
 367 }
 368
 369 void tcp_twsk_destructor(struct sock *sk)
 370 {
 371 #ifdef CONFIG_TCP_MD5SIG
 372         struct tcp_timewait_sock *twsk = tcp_twsk(sk);
 373         if (twsk->tw_md5_keylen)
 374                 tcp_put_md5sig_pool();
 375 #endif
 376 }
 377
 378 EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
 379
 380 /* This is not only more efficient than what we used to do, it eliminates
 381  * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM
 382  *
 383  * Actually, we could lots of memory writes here. tp of listening
 384  * socket contains all necessary default parameters.
 385  */
 386 struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb)
 387 {
 388         struct sock *newsk = inet_csk_clone(sk, req, GFP_ATOMIC);
 389
 390         if (newsk != NULL) {
 391                 const struct inet_request_sock *ireq = inet_rsk(req);
 392                 struct tcp_request_sock *treq = tcp_rsk(req);
 393                 struct inet_connection_sock *newicsk = inet_csk(newsk);
 394                 struct tcp_sock *newtp;
 395
 396                 /* Now setup tcp_sock */
 397                 newtp = tcp_sk(newsk);
 398                 newtp->pred_flags = 0;
 399                 newtp->rcv_nxt = treq->rcv_isn + 1;
 400                 newtp->snd_nxt = newtp->snd_una = newtp->snd_sml = treq->snt_isn + 1;
 401
 402                 tcp_prequeue_init(newtp);
 403
 404                 tcp_init_wl(newtp, treq->snt_isn, treq->rcv_isn);
 405
 406                 newtp->srtt = 0;
 407                 newtp->mdev = TCP_TIMEOUT_INIT;
 408                 newicsk->icsk_rto = TCP_TIMEOUT_INIT;
 409
 410                 newtp->packets_out = 0;
 411                 newtp->left_out = 0;
 412                 newtp->retrans_out = 0;
 413                 newtp->sacked_out = 0;
 414                 newtp->fackets_out = 0;
 415                 newtp->snd_ssthresh = 0x7fffffff;
 416
 417                 /* So many TCP implementations out there (incorrectly) count the
 418                  * initial SYN frame in their delayed-ACK and congestion control
 419                  * algorithms that we must have the following bandaid to talk
 420                  * efficiently to them.  -DaveM
 421                  */
 422                 newtp->snd_cwnd = 2;
 423                 newtp->snd_cwnd_cnt = 0;
 424                 newtp->bytes_acked = 0;
 425
 426                 newtp->frto_counter = 0;
 427                 newtp->frto_highmark = 0;
 428
 429                 newicsk->icsk_ca_ops = &tcp_init_congestion_ops;
 430
 431                 tcp_set_ca_state(newsk, TCP_CA_Open);
 432                 tcp_init_xmit_timers(newsk);
 433                 skb_queue_head_init(&newtp->out_of_order_queue);
 434                 newtp->rcv_wup = treq->rcv_isn + 1;
 435                 newtp->write_seq = treq->snt_isn + 1;
 436                 newtp->pushed_seq = newtp->write_seq;
 437                 newtp->copied_seq = treq->rcv_isn + 1;
 438
 439                 newtp->rx_opt.saw_tstamp = 0;
 440
 441                 newtp->rx_opt.dsack = 0;
 442                 newtp->rx_opt.eff_sacks = 0;
 443
 444                 newtp->rx_opt.num_sacks = 0;
 445                 newtp->urg_data = 0;
 446
 447                 if (sock_flag(newsk, SOCK_KEEPOPEN))
 448                         inet_csk_reset_keepalive_timer(newsk,
 449                                                        keepalive_time_when(newtp));
 450
 451                 newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
 452                 if((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
 453                         if (sysctl_tcp_fack)
 454                                 newtp->rx_opt.sack_ok |= 2;
 455                 }
 456                 newtp->window_clamp = req->window_clamp;
 457                 newtp->rcv_ssthresh = req->rcv_wnd;
 458                 newtp->rcv_wnd = req->rcv_wnd;
 459                 newtp->rx_opt.wscale_ok = ireq->wscale_ok;
 460                 if (newtp->rx_opt.wscale_ok) {
 461                         newtp->rx_opt.snd_wscale = ireq->snd_wscale;
 462                         newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
 463                 } else {
 464                         newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
 465                         newtp->window_clamp = min(newtp->window_clamp, 65535U);
 466                 }
 467                 newtp->snd_wnd = ntohs(skb->h.th->window) << newtp->rx_opt.snd_wscale;
 468                 newtp->max_window = newtp->snd_wnd;
 469
 470                 if (newtp->rx_opt.tstamp_ok) {
 471                         newtp->rx_opt.ts_recent = req->ts_recent;
 472                         newtp->rx_opt.ts_recent_stamp = xtime.tv_sec;
 473                         newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
 474                 } else {
 475                         newtp->rx_opt.ts_recent_stamp = 0;
 476                         newtp->tcp_header_len = sizeof(struct tcphdr);
 477                 }
 478 #ifdef CONFIG_TCP_MD5SIG
 479                 newtp->md5sig_info = NULL;      /*XXX*/
 480                 if (newtp->af_specific->md5_lookup(sk, newsk))
 481                         newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
 482 #endif
 483                 if (skb->len >= TCP_MIN_RCVMSS+newtp->tcp_header_len)
 484                         newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
 485                 newtp->rx_opt.mss_clamp = req->mss;
 486                 TCP_ECN_openreq_child(newtp, req);
 487
 488                 TCP_INC_STATS_BH(TCP_MIB_PASSIVEOPENS);
 489         }
 490         return newsk;
 491 }
 492
 493 /*
 494  *      Process an incoming packet for SYN_RECV sockets represented
 495  *      as a request_sock.
 496  */
 497
 498 struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
 499                            struct request_sock *req,
 500                            struct request_sock **prev)
 501 {
 502         struct tcphdr *th = skb->h.th;
 503         __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
 504         int paws_reject = 0;
 505         struct tcp_options_received tmp_opt;
 506         struct sock *child;
 507
 508         tmp_opt.saw_tstamp = 0;
 509         if (th->doff > (sizeof(struct tcphdr)>>2)) {
 510                 tcp_parse_options(skb, &tmp_opt, 0);
 511
 512                 if (tmp_opt.saw_tstamp) {
 513                         tmp_opt.ts_recent = req->ts_recent;
 514                         /* We do not store true stamp, but it is not required,
 515                          * it can be estimated (approximately)
 516                          * from another data.
 517                          */
 518                         tmp_opt.ts_recent_stamp = xtime.tv_sec - ((TCP_TIMEOUT_INIT/HZ)<<req->retrans);
 519                         paws_reject = tcp_paws_check(&tmp_opt, th->rst);
 520                 }
 521         }
 522
 523         /* Check for pure retransmitted SYN. */
 524         if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
 525             flg == TCP_FLAG_SYN &&
 526             !paws_reject) {
 527                 /*
 528                  * RFC793 draws (Incorrectly! It was fixed in RFC1122)
 529                  * this case on figure 6 and figure 8, but formal
 530                  * protocol description says NOTHING.
 531                  * To be more exact, it says that we should send ACK,
 532                  * because this segment (at least, if it has no data)
 533                  * is out of window.
 534                  *
 535                  *  CONCLUSION: RFC793 (even with RFC1122) DOES NOT
 536                  *  describe SYN-RECV state. All the description
 537                  *  is wrong, we cannot believe to it and should
 538                  *  rely only on common sense and implementation
 539                  *  experience.
 540                  *
 541                  * Enforce "SYN-ACK" according to figure 8, figure 6
 542                  * of RFC793, fixed by RFC1122.
 543                  */
 544                 req->rsk_ops->rtx_syn_ack(sk, req, NULL);
 545                 return NULL;
 546         }
 547
 548         /* Further reproduces section "SEGMENT ARRIVES"
 549            for state SYN-RECEIVED of RFC793.
 550            It is broken, however, it does not work only
 551            when SYNs are crossed.
 552
 553            You would think that SYN crossing is impossible here, since
 554            we should have a SYN_SENT socket (from connect()) on our end,
 555            but this is not true if the crossed SYNs were sent to both
 556            ends by a malicious third party.  We must defend against this,
 557            and to do that we first verify the ACK (as per RFC793, page
 558            36) and reset if it is invalid.  Is this a true full defense?
 559            To convince ourselves, let us consider a way in which the ACK
 560            test can still pass in this 'malicious crossed SYNs' case.
 561            Malicious sender sends identical SYNs (and thus identical sequence
 562            numbers) to both A and B:
 563
 564                 A: gets SYN, seq=7
 565                 B: gets SYN, seq=7
 566
 567            By our good fortune, both A and B select the same initial
 568            send sequence number of seven :-)
 569
 570                 A: sends SYN|ACK, seq=7, ack_seq=8
 571                 B: sends SYN|ACK, seq=7, ack_seq=8
 572
 573            So we are now A eating this SYN|ACK, ACK test passes.  So
 574            does sequence test, SYN is truncated, and thus we consider
 575            it a bare ACK.
 576
 577            If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this
 578            bare ACK.  Otherwise, we create an established connection.  Both
 579            ends (listening sockets) accept the new incoming connection and try
 580            to talk to each other. 8-)
 581
 582            Note: This case is both harmless, and rare.  Possibility is about the
 583            same as us discovering intelligent life on another plant tomorrow.
 584
 585            But generally, we should (RFC lies!) to accept ACK
 586            from SYNACK both here and in tcp_rcv_state_process().
 587            tcp_rcv_state_process() does not, hence, we do not too.
 588
 589            Note that the case is absolutely generic:
 590            we cannot optimize anything here without
 591            violating protocol. All the checks must be made
 592            before attempt to create socket.
 593          */
 594
 595         /* RFC793 page 36: "If the connection is in any non-synchronized state ...
 596          *                  and the incoming segment acknowledges something not yet
 597          *                  sent (the segment carries an unacceptable ACK) ...
 598          *                  a reset is sent."
 599          *
 600          * Invalid ACK: reset will be sent by listening socket
 601          */
 602         if ((flg & TCP_FLAG_ACK) &&
 603             (TCP_SKB_CB(skb)->ack_seq != tcp_rsk(req)->snt_isn + 1))
 604                 return sk;
 605
 606         /* Also, it would be not so bad idea to check rcv_tsecr, which
 607          * is essentially ACK extension and too early or too late values
 608          * should cause reset in unsynchronized states.
 609          */
 610
 611         /* RFC793: "first check sequence number". */
 612
 613         if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
 614                                           tcp_rsk(req)->rcv_isn + 1, tcp_rsk(req)->rcv_isn + 1 + req->rcv_wnd)) {
 615                 /* Out of window: send ACK and drop. */
 616                 if (!(flg & TCP_FLAG_RST))
 617                         req->rsk_ops->send_ack(skb, req);
 618                 if (paws_reject)
 619                         NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
 620                 return NULL;
 621         }
 622
 623         /* In sequence, PAWS is OK. */
 624
 625         if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_isn + 1))
 626                         req->ts_recent = tmp_opt.rcv_tsval;
 627
 628                 if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
 629                         /* Truncate SYN, it is out of window starting
 630                            at tcp_rsk(req)->rcv_isn + 1. */
 631                         flg &= ~TCP_FLAG_SYN;
 632                 }
 633
 634                 /* RFC793: "second check the RST bit" and
 635                  *         "fourth, check the SYN bit"
 636                  */
 637                 if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
 638                         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 639                         goto embryonic_reset;
 640                 }
 641
 642                 /* ACK sequence verified above, just make sure ACK is
 643                  * set.  If ACK not set, just silently drop the packet.
 644                  */
 645                 if (!(flg & TCP_FLAG_ACK))
 646                         return NULL;
 647
 648                 /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
 649                 if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
 650                     TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
 651                         inet_rsk(req)->acked = 1;
 652                         return NULL;
 653                 }
 654
 655                 /* OK, ACK is valid, create big socket and
 656                  * feed this segment to it. It will repeat all
 657                  * the tests. THIS SEGMENT MUST MOVE SOCKET TO
 658                  * ESTABLISHED STATE. If it will be dropped after
 659                  * socket is created, wait for troubles.
 660                  */
 661                 child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb,
 662                                                                  req, NULL);
 663                 if (child == NULL)
 664                         goto listen_overflow;
 665 #ifdef CONFIG_TCP_MD5SIG
 666                 else {
 667                         /* Copy over the MD5 key from the original socket */
 668                         struct tcp_md5sig_key *key;
 669                         struct tcp_sock *tp = tcp_sk(sk);
 670                         key = tp->af_specific->md5_lookup(sk, child);
 671                         if (key != NULL) {
 672                                 /*
 673                                  * We're using one, so create a matching key on the
 674                                  * newsk structure. If we fail to get memory then we
 675                                  * end up not copying the key across. Shucks.
 676                                  */
 677                                 char *newkey = kmemdup(key->key, key->keylen,
 678                                                        GFP_ATOMIC);
 679                                 if (newkey) {
 680                                         if (!tcp_alloc_md5sig_pool())
 681                                                 BUG();
 682                                         tp->af_specific->md5_add(child, child,
 683                                                                  newkey,
 684                                                                  key->keylen);
 685                                 }
 686                         }
 687                 }
 688 #endif
 689
 690                 inet_csk_reqsk_queue_unlink(sk, req, prev);
 691                 inet_csk_reqsk_queue_removed(sk, req);
 692
 693                 inet_csk_reqsk_queue_add(sk, req, child);
 694                 return child;
 695
 696         listen_overflow:
 697                 if (!sysctl_tcp_abort_on_overflow) {
 698                         inet_rsk(req)->acked = 1;
 699                         return NULL;
 700                 }
 701
 702         embryonic_reset:
 703                 NET_INC_STATS_BH(LINUX_MIB_EMBRYONICRSTS);
 704                 if (!(flg & TCP_FLAG_RST))
 705                         req->rsk_ops->send_reset(sk, skb);
 706
 707                 inet_csk_reqsk_queue_drop(sk, req, prev);
 708                 return NULL;
 709 }
 710
 711 /*
 712  * Queue segment on the new socket if the new socket is active,
 713  * otherwise we just shortcircuit this and continue with
 714  * the new socket.
 715  */
 716
 717 int tcp_child_process(struct sock *parent, struct sock *child,
 718                       struct sk_buff *skb)
 719 {
 720         int ret = 0;
 721         int state = child->sk_state;
 722
 723         if (!sock_owned_by_user(child)) {
 724                 ret = tcp_rcv_state_process(child, skb, skb->h.th, skb->len);
 725
 726                 /* Wakeup parent, send SIGIO */
 727                 if (state == TCP_SYN_RECV && child->sk_state != state)
 728                         parent->sk_data_ready(parent, 0);
 729         } else {
 730                 /* Alas, it is possible again, because we do lookup
 731                  * in main socket hash table and lock on listening
 732                  * socket does not protect us more.
 733                  */
 734                 sk_add_backlog(child, skb);
 735         }
 736
 737         bh_unlock_sock(child);
 738         sock_put(child);
 739         return ret;
 740 }
 741
 742 EXPORT_SYMBOL(tcp_check_req);
 743 EXPORT_SYMBOL(tcp_child_process);
 744 EXPORT_SYMBOL(tcp_create_openreq_child);
 745 EXPORT_SYMBOL(tcp_timewait_state_process);