2 * IPv6 Syncookies implementation for the Linux kernel
5 * Glenn Griffin <ggriffin.kernel@gmail.com>
7 * Based on IPv4 implementation by Andi Kleen
8 * linux/net/ipv4/syncookies.c
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
17 #include <linux/tcp.h>
18 #include <linux/random.h>
19 #include <linux/siphash.h>
20 #include <linux/kernel.h>
24 #define COOKIEBITS 24 /* Upper bits store count */
25 #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
27 static siphash_key_t syncookie6_secret
[2] __read_mostly
;
29 /* RFC 2460, Section 8.3:
30 * [ipv6 tcp] MSS must be computed as the maximum packet size minus 60 [..]
32 * Due to IPV6_MIN_MTU=1280 the lowest possible MSS is 1220, which allows
33 * using higher values than ipv4 tcp syncookies.
34 * The other values are chosen based on ethernet (1500 and 9k MTU), plus
35 * one that accounts for common encap (PPPoe) overhead. Table must be sorted.
37 static __u16
const msstab
[] = {
38 1280 - 60, /* IPV6_MIN_MTU - 60 */
44 static u32
cookie_hash(const struct in6_addr
*saddr
,
45 const struct in6_addr
*daddr
,
46 __be16 sport
, __be16 dport
, u32 count
, int c
)
49 struct in6_addr saddr
;
50 struct in6_addr daddr
;
54 } __aligned(SIPHASH_ALIGNMENT
) combined
= {
62 net_get_random_once(syncookie6_secret
, sizeof(syncookie6_secret
));
63 return siphash(&combined
, offsetofend(typeof(combined
), dport
),
64 &syncookie6_secret
[c
]);
67 static __u32
secure_tcp_syn_cookie(const struct in6_addr
*saddr
,
68 const struct in6_addr
*daddr
,
69 __be16 sport
, __be16 dport
, __u32 sseq
,
72 u32 count
= tcp_cookie_time();
73 return (cookie_hash(saddr
, daddr
, sport
, dport
, 0, 0) +
74 sseq
+ (count
<< COOKIEBITS
) +
75 ((cookie_hash(saddr
, daddr
, sport
, dport
, count
, 1) + data
)
79 static __u32
check_tcp_syn_cookie(__u32 cookie
, const struct in6_addr
*saddr
,
80 const struct in6_addr
*daddr
, __be16 sport
,
81 __be16 dport
, __u32 sseq
)
83 __u32 diff
, count
= tcp_cookie_time();
85 cookie
-= cookie_hash(saddr
, daddr
, sport
, dport
, 0, 0) + sseq
;
87 diff
= (count
- (cookie
>> COOKIEBITS
)) & ((__u32
) -1 >> COOKIEBITS
);
88 if (diff
>= MAX_SYNCOOKIE_AGE
)
92 cookie_hash(saddr
, daddr
, sport
, dport
, count
- diff
, 1))
96 u32
__cookie_v6_init_sequence(const struct ipv6hdr
*iph
,
97 const struct tcphdr
*th
, __u16
*mssp
)
100 const __u16 mss
= *mssp
;
102 for (mssind
= ARRAY_SIZE(msstab
) - 1; mssind
; mssind
--)
103 if (mss
>= msstab
[mssind
])
106 *mssp
= msstab
[mssind
];
108 return secure_tcp_syn_cookie(&iph
->saddr
, &iph
->daddr
, th
->source
,
109 th
->dest
, ntohl(th
->seq
), mssind
);
111 EXPORT_SYMBOL_GPL(__cookie_v6_init_sequence
);
113 __u32
cookie_v6_init_sequence(const struct sk_buff
*skb
, __u16
*mssp
)
115 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
116 const struct tcphdr
*th
= tcp_hdr(skb
);
118 return __cookie_v6_init_sequence(iph
, th
, mssp
);
121 int __cookie_v6_check(const struct ipv6hdr
*iph
, const struct tcphdr
*th
,
124 __u32 seq
= ntohl(th
->seq
) - 1;
125 __u32 mssind
= check_tcp_syn_cookie(cookie
, &iph
->saddr
, &iph
->daddr
,
126 th
->source
, th
->dest
, seq
);
128 return mssind
< ARRAY_SIZE(msstab
) ? msstab
[mssind
] : 0;
130 EXPORT_SYMBOL_GPL(__cookie_v6_check
);
132 struct sock
*cookie_v6_check(struct sock
*sk
, struct sk_buff
*skb
)
134 struct tcp_options_received tcp_opt
;
135 struct inet_request_sock
*ireq
;
136 struct tcp_request_sock
*treq
;
137 struct ipv6_pinfo
*np
= inet6_sk(sk
);
138 struct tcp_sock
*tp
= tcp_sk(sk
);
139 const struct tcphdr
*th
= tcp_hdr(skb
);
140 __u32 cookie
= ntohl(th
->ack_seq
) - 1;
141 struct sock
*ret
= sk
;
142 struct request_sock
*req
;
144 struct dst_entry
*dst
;
147 if (!sock_net(sk
)->ipv4
.sysctl_tcp_syncookies
|| !th
->ack
|| th
->rst
)
150 if (tcp_synq_no_recent_overflow(sk
))
153 mss
= __cookie_v6_check(ipv6_hdr(skb
), th
, cookie
);
155 __NET_INC_STATS(sock_net(sk
), LINUX_MIB_SYNCOOKIESFAILED
);
159 __NET_INC_STATS(sock_net(sk
), LINUX_MIB_SYNCOOKIESRECV
);
161 /* check for timestamp cookie support */
162 memset(&tcp_opt
, 0, sizeof(tcp_opt
));
163 tcp_parse_options(skb
, &tcp_opt
, 0, NULL
);
165 if (!cookie_timestamp_decode(&tcp_opt
))
169 req
= inet_reqsk_alloc(&tcp6_request_sock_ops
, sk
, false);
173 ireq
= inet_rsk(req
);
175 treq
->tfo_listener
= false;
177 if (security_inet_conn_request(sk
, skb
, req
))
181 ireq
->ir_rmt_port
= th
->source
;
182 ireq
->ir_num
= ntohs(th
->dest
);
183 ireq
->ir_v6_rmt_addr
= ipv6_hdr(skb
)->saddr
;
184 ireq
->ir_v6_loc_addr
= ipv6_hdr(skb
)->daddr
;
185 if (ipv6_opt_accepted(sk
, skb
, &TCP_SKB_CB(skb
)->header
.h6
) ||
186 np
->rxopt
.bits
.rxinfo
|| np
->rxopt
.bits
.rxoinfo
||
187 np
->rxopt
.bits
.rxhlim
|| np
->rxopt
.bits
.rxohlim
) {
188 atomic_inc(&skb
->users
);
192 ireq
->ir_iif
= inet_request_bound_dev_if(sk
, skb
);
193 /* So that link locals have meaning */
194 if (!sk
->sk_bound_dev_if
&&
195 ipv6_addr_type(&ireq
->ir_v6_rmt_addr
) & IPV6_ADDR_LINKLOCAL
)
196 ireq
->ir_iif
= tcp_v6_iif(skb
);
198 ireq
->ir_mark
= inet_request_mark(sk
, skb
);
200 req
->num_retrans
= 0;
201 ireq
->snd_wscale
= tcp_opt
.snd_wscale
;
202 ireq
->sack_ok
= tcp_opt
.sack_ok
;
203 ireq
->wscale_ok
= tcp_opt
.wscale_ok
;
204 ireq
->tstamp_ok
= tcp_opt
.saw_tstamp
;
205 req
->ts_recent
= tcp_opt
.saw_tstamp
? tcp_opt
.rcv_tsval
: 0;
206 treq
->snt_synack
.v64
= 0;
207 treq
->rcv_isn
= ntohl(th
->seq
) - 1;
208 treq
->snt_isn
= cookie
;
212 * We need to lookup the dst_entry to get the correct window size.
213 * This is taken from tcp_v6_syn_recv_sock. Somebody please enlighten
214 * me if there is a preferred way.
217 struct in6_addr
*final_p
, final
;
219 memset(&fl6
, 0, sizeof(fl6
));
220 fl6
.flowi6_proto
= IPPROTO_TCP
;
221 fl6
.daddr
= ireq
->ir_v6_rmt_addr
;
222 final_p
= fl6_update_dst(&fl6
, rcu_dereference(np
->opt
), &final
);
223 fl6
.saddr
= ireq
->ir_v6_loc_addr
;
224 fl6
.flowi6_oif
= ireq
->ir_iif
;
225 fl6
.flowi6_mark
= ireq
->ir_mark
;
226 fl6
.fl6_dport
= ireq
->ir_rmt_port
;
227 fl6
.fl6_sport
= inet_sk(sk
)->inet_sport
;
228 fl6
.flowi6_uid
= sk
->sk_uid
;
229 security_req_classify_flow(req
, flowi6_to_flowi(&fl6
));
231 dst
= ip6_dst_lookup_flow(sk
, &fl6
, final_p
);
236 req
->rsk_window_clamp
= tp
->window_clamp
? :dst_metric(dst
, RTAX_WINDOW
);
237 tcp_select_initial_window(tcp_full_space(sk
), req
->mss
,
238 &req
->rsk_rcv_wnd
, &req
->rsk_window_clamp
,
239 ireq
->wscale_ok
, &rcv_wscale
,
240 dst_metric(dst
, RTAX_INITRWND
));
242 ireq
->rcv_wscale
= rcv_wscale
;
243 ireq
->ecn_ok
= cookie_ecn_ok(&tcp_opt
, sock_net(sk
), dst
);
245 ret
= tcp_get_cookie_sock(sk
, skb
, req
, dst
);