Release 4.8 net/ipv6/syncookies.c
/*
* IPv6 Syncookies implementation for the Linux kernel
*
* Authors:
* Glenn Griffin <ggriffin.kernel@gmail.com>
*
* Based on IPv4 implementation by Andi Kleen
* linux/net/ipv4/syncookies.c
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version
* 2 of the License, or (at your option) any later version.
*
*/
#include <linux/tcp.h>
#include <linux/random.h>
#include <linux/cryptohash.h>
#include <linux/kernel.h>
#include <net/ipv6.h>
#include <net/tcp.h>
#define COOKIEBITS 24
/* Upper bits store count */
#define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
static u32 syncookie6_secret[2][16-4+SHA_DIGEST_WORDS] __read_mostly;
/* RFC 2460, Section 8.3:
* [ipv6 tcp] MSS must be computed as the maximum packet size minus 60 [..]
*
* Due to IPV6_MIN_MTU=1280 the lowest possible MSS is 1220, which allows
* using higher values than ipv4 tcp syncookies.
* The other values are chosen based on ethernet (1500 and 9k MTU), plus
* one that accounts for common encap (PPPoe) overhead. Table must be sorted.
*/
static __u16 const msstab[] = {
1280 - 60, /* IPV6_MIN_MTU - 60 */
1480 - 60,
1500 - 60,
9000 - 60,
};
static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS], ipv6_cookie_scratch);
static u32 cookie_hash(const struct in6_addr *saddr, const struct in6_addr *daddr,
__be16 sport, __be16 dport, u32 count, int c)
{
__u32 *tmp;
net_get_random_once(syncookie6_secret, sizeof(syncookie6_secret));
tmp = this_cpu_ptr(ipv6_cookie_scratch);
/*
* we have 320 bits of information to hash, copy in the remaining
* 192 bits required for sha_transform, from the syncookie6_secret
* and overwrite the digest with the secret
*/
memcpy(tmp + 10, syncookie6_secret[c], 44);
memcpy(tmp, saddr, 16);
memcpy(tmp + 4, daddr, 16);
tmp[8] = ((__force u32)sport << 16) + (__force u32)dport;
tmp[9] = count;
sha_transform(tmp + 16, (__u8 *)tmp, tmp + 16 + 5);
return tmp[17];
}
Contributors
| Person | Tokens | Prop | Commits | CommitProp |
| glenn griffin | glenn griffin | 119 | 85.61% | 1 | 20.00% |
| hannes frederic sowa | hannes frederic sowa | 16 | 11.51% | 1 | 20.00% |
| eric dumazet | eric dumazet | 2 | 1.44% | 1 | 20.00% |
| christoph lameter | christoph lameter | 1 | 0.72% | 1 | 20.00% |
| tejun heo | tejun heo | 1 | 0.72% | 1 | 20.00% |
| Total | 139 | 100.00% | 5 | 100.00% |
static __u32 secure_tcp_syn_cookie(const struct in6_addr *saddr,
const struct in6_addr *daddr,
__be16 sport, __be16 dport, __u32 sseq,
__u32 data)
{
u32 count = tcp_cookie_time();
return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
sseq + (count << COOKIEBITS) +
((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
& COOKIEMASK));
}
Contributors
| Person | Tokens | Prop | Commits | CommitProp |
| glenn griffin | glenn griffin | 77 | 90.59% | 1 | 33.33% |
| florian westphal | florian westphal | 6 | 7.06% | 1 | 33.33% |
| eric dumazet | eric dumazet | 2 | 2.35% | 1 | 33.33% |
| Total | 85 | 100.00% | 3 | 100.00% |
static __u32 check_tcp_syn_cookie(__u32 cookie, const struct in6_addr *saddr,
const struct in6_addr *daddr, __be16 sport,
__be16 dport, __u32 sseq)
{
__u32 diff, count = tcp_cookie_time();
cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
if (diff >= MAX_SYNCOOKIE_AGE)
return (__u32)-1;
return (cookie -
cookie_hash(saddr, daddr, sport, dport, count - diff, 1))
& COOKIEMASK;
}
Contributors
| Person | Tokens | Prop | Commits | CommitProp |
| glenn griffin | glenn griffin | 108 | 93.10% | 1 | 33.33% |
| florian westphal | florian westphal | 6 | 5.17% | 1 | 33.33% |
| eric dumazet | eric dumazet | 2 | 1.72% | 1 | 33.33% |
| Total | 116 | 100.00% | 3 | 100.00% |
u32 __cookie_v6_init_sequence(const struct ipv6hdr *iph,
const struct tcphdr *th, __u16 *mssp)
{
int mssind;
const __u16 mss = *mssp;
for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
if (mss >= msstab[mssind])
break;
*mssp = msstab[mssind];
return secure_tcp_syn_cookie(&iph->saddr, &iph->daddr, th->source,
th->dest, ntohl(th->seq), mssind);
}
Contributors
| Person | Tokens | Prop | Commits | CommitProp |
| glenn griffin | glenn griffin | 72 | 75.00% | 1 | 25.00% |
| florian westphal | florian westphal | 16 | 16.67% | 1 | 25.00% |
| patrick mchardy | patrick mchardy | 7 | 7.29% | 1 | 25.00% |
| eric dumazet | eric dumazet | 1 | 1.04% | 1 | 25.00% |
| Total | 96 | 100.00% | 4 | 100.00% |
EXPORT_SYMBOL_GPL(__cookie_v6_init_sequence);
__u32 cookie_v6_init_sequence(const struct sk_buff *skb, __u16 *mssp)
{
const struct ipv6hdr *iph = ipv6_hdr(skb);
const struct tcphdr *th = tcp_hdr(skb);
return __cookie_v6_init_sequence(iph, th, mssp);
}
Contributors
| Person | Tokens | Prop | Commits | CommitProp |
| glenn griffin | glenn griffin | 29 | 61.70% | 1 | 25.00% |
| patrick mchardy | patrick mchardy | 16 | 34.04% | 1 | 25.00% |
| eric dumazet | eric dumazet | 2 | 4.26% | 2 | 50.00% |
| Total | 47 | 100.00% | 4 | 100.00% |
int __cookie_v6_check(const struct ipv6hdr *iph, const struct tcphdr *th,
__u32 cookie)
{
__u32 seq = ntohl(th->seq) - 1;
__u32 mssind = check_tcp_syn_cookie(cookie, &iph->saddr, &iph->daddr,
th->source, th->dest, seq);
return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
}
Contributors
| Person | Tokens | Prop | Commits | CommitProp |
| glenn griffin | glenn griffin | 52 | 69.33% | 1 | 33.33% |
| patrick mchardy | patrick mchardy | 19 | 25.33% | 1 | 33.33% |
| florian westphal | florian westphal | 4 | 5.33% | 1 | 33.33% |
| Total | 75 | 100.00% | 3 | 100.00% |
EXPORT_SYMBOL_GPL(__cookie_v6_check);
struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
{
struct tcp_options_received tcp_opt;
struct inet_request_sock *ireq;
struct tcp_request_sock *treq;
struct ipv6_pinfo *np = inet6_sk(sk);
struct tcp_sock *tp = tcp_sk(sk);
const struct tcphdr *th = tcp_hdr(skb);
__u32 cookie = ntohl(th->ack_seq) - 1;
struct sock *ret = sk;
struct request_sock *req;
int mss;
struct dst_entry *dst;
__u8 rcv_wscale;
if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst)
goto out;
if (tcp_synq_no_recent_overflow(sk))
goto out;
mss = __cookie_v6_check(ipv6_hdr(skb), th, cookie);
if (mss == 0) {
__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
goto out;
}
__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
/* check for timestamp cookie support */
memset(&tcp_opt, 0, sizeof(tcp_opt));
tcp_parse_options(skb, &tcp_opt, 0, NULL);
if (!cookie_timestamp_decode(&tcp_opt))
goto out;
ret = NULL;
req = inet_reqsk_alloc(&tcp6_request_sock_ops, sk, false);
if (!req)
goto out;
ireq = inet_rsk(req);
treq = tcp_rsk(req);
treq->tfo_listener = false;
if (security_inet_conn_request(sk, skb, req))
goto out_free;
req->mss = mss;
ireq->ir_rmt_port = th->source;
ireq->ir_num = ntohs(th->dest);
ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
if (ipv6_opt_accepted(sk, skb, &TCP_SKB_CB(skb)->header.h6) ||
np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
atomic_inc(&skb->users);
ireq->pktopts = skb;
}
ireq->ir_iif = inet_request_bound_dev_if(sk, skb);
/* So that link locals have meaning */
if (!sk->sk_bound_dev_if &&
ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
ireq->ir_iif = tcp_v6_iif(skb);
ireq->ir_mark = inet_request_mark(sk, skb);
req->num_retrans = 0;
ireq->snd_wscale = tcp_opt.snd_wscale;
ireq->sack_ok = tcp_opt.sack_ok;
ireq->wscale_ok = tcp_opt.wscale_ok;
ireq->tstamp_ok = tcp_opt.saw_tstamp;
req->ts_recent = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
treq->snt_synack.v64 = 0;
treq->rcv_isn = ntohl(th->seq) - 1;
treq->snt_isn = cookie;
/*
* We need to lookup the dst_entry to get the correct window size.
* This is taken from tcp_v6_syn_recv_sock. Somebody please enlighten
* me if there is a preferred way.
*/
{
struct in6_addr *final_p, final;
struct flowi6 fl6;
memset(&fl6, 0, sizeof(fl6));
fl6.flowi6_proto = IPPROTO_TCP;
fl6.daddr = ireq->ir_v6_rmt_addr;
final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final);
fl6.saddr = ireq->ir_v6_loc_addr;
fl6.flowi6_oif = ireq->ir_iif;
fl6.flowi6_mark = ireq->ir_mark;
fl6.fl6_dport = ireq->ir_rmt_port;
fl6.fl6_sport = inet_sk(sk)->inet_sport;
security_req_classify_flow(req, flowi6_to_flowi(&fl6));
dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
if (IS_ERR(dst))
goto out_free;
}
req->rsk_window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
tcp_select_initial_window(tcp_full_space(sk), req->mss,
&req->rsk_rcv_wnd, &req->rsk_window_clamp,
ireq->wscale_ok, &rcv_wscale,
dst_metric(dst, RTAX_INITRWND));
ireq->rcv_wscale = rcv_wscale;
ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk), dst);
ret = tcp_get_cookie_sock(sk, skb, req, dst);
out:
return ret;
out_free:
reqsk_free(req);
return NULL;
}
Contributors
| Person | Tokens | Prop | Commits | CommitProp |
| glenn griffin | glenn griffin | 451 | 59.97% | 1 | 2.33% |
| david s. miller | david s. miller | 103 | 13.70% | 4 | 9.30% |
| florian westphal | florian westphal | 57 | 7.58% | 8 | 18.60% |
| eric dumazet | eric dumazet | 50 | 6.65% | 13 | 30.23% |
| lorenzo colitti | lorenzo colitti | 13 | 1.73% | 1 | 2.33% |
| jerry chu | jerry chu | 10 | 1.33% | 2 | 4.65% |
| pavel emelianov | pavel emelianov | 10 | 1.33% | 1 | 2.33% |
| nikolay borisov | nikolay borisov | 7 | 0.93% | 1 | 2.33% |
| david ahern | david ahern | 7 | 0.93% | 1 | 2.33% |
| arnaud ebalard | arnaud ebalard | 7 | 0.93% | 1 | 2.33% |
| kovacs krisztian | kovacs krisztian | 7 | 0.93% | 1 | 2.33% |
| laurent chavey | laurent chavey | 7 | 0.93% | 1 | 2.33% |
| patrick mchardy | patrick mchardy | 6 | 0.80% | 1 | 2.33% |
| alexey dobriyan | alexey dobriyan | 5 | 0.66% | 2 | 4.65% |
| yuchung cheng | yuchung cheng | 4 | 0.53% | 2 | 4.65% |
| william allen simpson | william allen simpson | 4 | 0.53% | 1 | 2.33% |
| brian haley | brian haley | 3 | 0.40% | 1 | 2.33% |
| octavian purdila | octavian purdila | 1 | 0.13% | 1 | 2.33% |
| Total | 752 | 100.00% | 43 | 100.00% |
Overall Contributors
| Person | Tokens | Prop | Commits | CommitProp |
| glenn griffin | glenn griffin | 963 | 68.59% | 1 | 1.89% |
| david s. miller | david s. miller | 103 | 7.34% | 4 | 7.55% |
| florian westphal | florian westphal | 101 | 7.19% | 12 | 22.64% |
| eric dumazet | eric dumazet | 59 | 4.20% | 15 | 28.30% |
| patrick mchardy | patrick mchardy | 58 | 4.13% | 1 | 1.89% |
| hannes frederic sowa | hannes frederic sowa | 30 | 2.14% | 1 | 1.89% |
| lorenzo colitti | lorenzo colitti | 13 | 0.93% | 1 | 1.89% |
| jerry chu | jerry chu | 10 | 0.71% | 2 | 3.77% |
| pavel emelianov | pavel emelianov | 10 | 0.71% | 1 | 1.89% |
| david ahern | david ahern | 7 | 0.50% | 1 | 1.89% |
| nikolay borisov | nikolay borisov | 7 | 0.50% | 1 | 1.89% |
| laurent chavey | laurent chavey | 7 | 0.50% | 1 | 1.89% |
| kovacs krisztian | kovacs krisztian | 7 | 0.50% | 1 | 1.89% |
| arnaud ebalard | arnaud ebalard | 7 | 0.50% | 1 | 1.89% |
| alexey dobriyan | alexey dobriyan | 5 | 0.36% | 2 | 3.77% |
| tejun heo | tejun heo | 4 | 0.28% | 2 | 3.77% |
| william allen simpson | william allen simpson | 4 | 0.28% | 1 | 1.89% |
| yuchung cheng | yuchung cheng | 4 | 0.28% | 2 | 3.77% |
| brian haley | brian haley | 3 | 0.21% | 1 | 1.89% |
| christoph lameter | christoph lameter | 1 | 0.07% | 1 | 1.89% |
| octavian purdila | octavian purdila | 1 | 0.07% | 1 | 1.89% |
| Total | 1404 | 100.00% | 53 | 100.00% |
Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.