blob: d2fe4e06b472d6f9ad69f1c31cfa510251096550 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * INET An implementation of the TCP/IP protocol suite for the LINUX
3 * operating system. INET is implemented using the BSD Socket
4 * interface as the means of communication with the user level.
5 *
6 * Implementation of the Transmission Control Protocol(TCP).
7 *
Jesper Juhl02c30a82005-05-05 16:16:16 -07008 * Authors: Ross Biro
Linus Torvalds1da177e2005-04-16 15:20:36 -07009 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10 * Mark Evans, <evansmp@uhura.aston.ac.uk>
11 * Corey Minyard <wf-rch!minyard@relay.EU.net>
12 * Florian La Roche, <flla@stud.uni-sb.de>
13 * Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
14 * Linus Torvalds, <torvalds@cs.helsinki.fi>
15 * Alan Cox, <gw4pts@gw4pts.ampr.org>
16 * Matthew Dillon, <dillon@apollo.west.oic.com>
17 * Arnt Gulbrandsen, <agulbra@nvg.unit.no>
18 * Jorge Cwik, <jorge@laser.satlink.net>
19 */
20
Linus Torvalds1da177e2005-04-16 15:20:36 -070021#include <linux/mm.h>
22#include <linux/module.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090023#include <linux/slab.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070024#include <linux/sysctl.h>
25#include <linux/workqueue.h>
26#include <net/tcp.h>
27#include <net/inet_common.h>
28#include <net/xfrm.h>
29
David S. Millere994b7c2009-11-21 11:22:25 -080030int sysctl_tcp_syncookies __read_mostly = 1;
Glenn Griffinc6aefaf2008-02-07 21:49:26 -080031EXPORT_SYMBOL(sysctl_tcp_syncookies);
32
Brian Haleyab32ea52006-09-22 14:15:41 -070033int sysctl_tcp_abort_on_overflow __read_mostly;
Linus Torvalds1da177e2005-04-16 15:20:36 -070034
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -070035struct inet_timewait_death_row tcp_death_row = {
36 .sysctl_max_tw_buckets = NR_FILE * 2,
37 .period = TCP_TIMEWAIT_LEN / INET_TWDR_TWKILL_SLOTS,
Ingo Molnare4d91912006-07-03 00:24:34 -070038 .death_lock = __SPIN_LOCK_UNLOCKED(tcp_death_row.death_lock),
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -070039 .hashinfo = &tcp_hashinfo,
40 .tw_timer = TIMER_INITIALIZER(inet_twdr_hangman, 0,
41 (unsigned long)&tcp_death_row),
42 .twkill_work = __WORK_INITIALIZER(tcp_death_row.twkill_work,
David Howells65f27f32006-11-22 14:55:48 +000043 inet_twdr_twkill_work),
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -070044/* Short-time timewait calendar */
45
46 .twcal_hand = -1,
47 .twcal_timer = TIMER_INITIALIZER(inet_twdr_twcal_tick, 0,
48 (unsigned long)&tcp_death_row),
49};
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -070050EXPORT_SYMBOL_GPL(tcp_death_row);
51
David S. Miller3f419d22010-11-29 13:37:14 -080052/* VJ's idea. Save last timestamp seen from this destination
53 * and hold it at least for normal timewait interval to use for duplicate
54 * segment detection in subsequent connections, before they enter synchronized
55 * state.
56 */
57
58static int tcp_remember_stamp(struct sock *sk)
59{
60 const struct inet_connection_sock *icsk = inet_csk(sk);
61 struct tcp_sock *tp = tcp_sk(sk);
62 struct inet_peer *peer;
63 bool release_it;
64
65 peer = icsk->icsk_af_ops->get_peer(sk, &release_it);
66 if (peer) {
67 if ((s32)(peer->tcp_ts - tp->rx_opt.ts_recent) <= 0 ||
68 ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
69 peer->tcp_ts_stamp <= (u32)tp->rx_opt.ts_recent_stamp)) {
70 peer->tcp_ts_stamp = (u32)tp->rx_opt.ts_recent_stamp;
71 peer->tcp_ts = tp->rx_opt.ts_recent;
72 }
73 if (release_it)
74 inet_putpeer(peer);
75 return 1;
76 }
77
78 return 0;
79}
80
David S. Millerccb7c412010-12-01 18:09:13 -080081static int tcp_tw_remember_stamp(struct inet_timewait_sock *tw)
82{
83 struct sock *sk = (struct sock *) tw;
84 struct inet_peer *peer;
85
86 peer = twsk_getpeer(sk);
87 if (peer) {
88 const struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
89
90 if ((s32)(peer->tcp_ts - tcptw->tw_ts_recent) <= 0 ||
91 ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
92 peer->tcp_ts_stamp <= (u32)tcptw->tw_ts_recent_stamp)) {
93 peer->tcp_ts_stamp = (u32)tcptw->tw_ts_recent_stamp;
94 peer->tcp_ts = tcptw->tw_ts_recent;
95 }
96 inet_putpeer(peer);
97 return 1;
98 }
99 return 0;
100}
101
Linus Torvalds1da177e2005-04-16 15:20:36 -0700102static __inline__ int tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
103{
104 if (seq == s_win)
105 return 1;
106 if (after(end_seq, s_win) && before(seq, e_win))
107 return 1;
Eric Dumazeta02cec22010-09-22 20:43:57 +0000108 return seq == e_win && seq == end_seq;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109}
110
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +0900111/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700112 * * Main purpose of TIME-WAIT state is to close connection gracefully,
113 * when one of ends sits in LAST-ACK or CLOSING retransmitting FIN
114 * (and, probably, tail of data) and one or more our ACKs are lost.
115 * * What is TIME-WAIT timeout? It is associated with maximal packet
116 * lifetime in the internet, which results in wrong conclusion, that
117 * it is set to catch "old duplicate segments" wandering out of their path.
118 * It is not quite correct. This timeout is calculated so that it exceeds
119 * maximal retransmission timeout enough to allow to lose one (or more)
120 * segments sent by peer and our ACKs. This time may be calculated from RTO.
121 * * When TIME-WAIT socket receives RST, it means that another end
122 * finally closed and we are allowed to kill TIME-WAIT too.
123 * * Second purpose of TIME-WAIT is catching old duplicate segments.
124 * Well, certainly it is pure paranoia, but if we load TIME-WAIT
125 * with this semantics, we MUST NOT kill TIME-WAIT state with RSTs.
126 * * If we invented some more clever way to catch duplicates
127 * (f.e. based on PAWS), we could truncate TIME-WAIT to several RTOs.
128 *
129 * The algorithm below is based on FORMAL INTERPRETATION of RFCs.
130 * When you compare it to RFCs, please, read section SEGMENT ARRIVES
131 * from the very beginning.
132 *
133 * NOTE. With recycling (and later with fin-wait-2) TW bucket
134 * is _not_ stateless. It means, that strictly speaking we must
135 * spinlock it. I do not want! Well, probability of misbehaviour
136 * is ridiculously low and, seems, we could use some mb() tricks
137 * to avoid misread sequence numbers, states etc. --ANK
138 */
139enum tcp_tw_status
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700140tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
141 const struct tcphdr *th)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700142{
143 struct tcp_options_received tmp_opt;
William Allen Simpson4957faade2009-12-02 18:25:27 +0000144 u8 *hash_location;
145 struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700146 int paws_reject = 0;
147
David S. Millerbb5b7c12009-12-15 20:56:42 -0800148 tmp_opt.saw_tstamp = 0;
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700149 if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
David S. Millerbb5b7c12009-12-15 20:56:42 -0800150 tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700151
152 if (tmp_opt.saw_tstamp) {
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700153 tmp_opt.ts_recent = tcptw->tw_ts_recent;
154 tmp_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
Ilpo Järvinenc887e6d2009-03-14 14:23:03 +0000155 paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700156 }
157 }
158
159 if (tw->tw_substate == TCP_FIN_WAIT2) {
160 /* Just repeat all the checks of tcp_rcv_state_process() */
161
162 /* Out of window, send ACK */
163 if (paws_reject ||
164 !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700165 tcptw->tw_rcv_nxt,
166 tcptw->tw_rcv_nxt + tcptw->tw_rcv_wnd))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700167 return TCP_TW_ACK;
168
169 if (th->rst)
170 goto kill;
171
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700172 if (th->syn && !before(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700173 goto kill_with_rst;
174
175 /* Dup ACK? */
Wei Yongjun1ac530b2009-06-24 22:29:31 +0000176 if (!th->ack ||
177 !after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -0700178 TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700179 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700180 return TCP_TW_SUCCESS;
181 }
182
183 /* New data or FIN. If new data arrive after half-duplex close,
184 * reset.
185 */
186 if (!th->fin ||
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700187 TCP_SKB_CB(skb)->end_seq != tcptw->tw_rcv_nxt + 1) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700188kill_with_rst:
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -0700189 inet_twsk_deschedule(tw, &tcp_death_row);
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700190 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700191 return TCP_TW_RST;
192 }
193
194 /* FIN arrived, enter true time-wait state. */
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700195 tw->tw_substate = TCP_TIME_WAIT;
196 tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700197 if (tmp_opt.saw_tstamp) {
James Morris9d729f72007-03-04 16:12:44 -0800198 tcptw->tw_ts_recent_stamp = get_seconds();
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700199 tcptw->tw_ts_recent = tmp_opt.rcv_tsval;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700200 }
201
David S. Millerccb7c412010-12-01 18:09:13 -0800202 if (tcp_death_row.sysctl_tw_recycle &&
203 tcptw->tw_ts_recent_stamp &&
204 tcp_tw_remember_stamp(tw))
Arnaldo Carvalho de Melo696ab2d2005-08-09 20:45:03 -0700205 inet_twsk_schedule(tw, &tcp_death_row, tw->tw_timeout,
206 TCP_TIMEWAIT_LEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700207 else
Arnaldo Carvalho de Melo696ab2d2005-08-09 20:45:03 -0700208 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
209 TCP_TIMEWAIT_LEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700210 return TCP_TW_ACK;
211 }
212
213 /*
214 * Now real TIME-WAIT state.
215 *
216 * RFC 1122:
217 * "When a connection is [...] on TIME-WAIT state [...]
218 * [a TCP] MAY accept a new SYN from the remote TCP to
219 * reopen the connection directly, if it:
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +0900220 *
Linus Torvalds1da177e2005-04-16 15:20:36 -0700221 * (1) assigns its initial sequence number for the new
222 * connection to be larger than the largest sequence
223 * number it used on the previous connection incarnation,
224 * and
225 *
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +0900226 * (2) returns to TIME-WAIT state if the SYN turns out
Linus Torvalds1da177e2005-04-16 15:20:36 -0700227 * to be an old duplicate".
228 */
229
230 if (!paws_reject &&
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700231 (TCP_SKB_CB(skb)->seq == tcptw->tw_rcv_nxt &&
Linus Torvalds1da177e2005-04-16 15:20:36 -0700232 (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq || th->rst))) {
233 /* In window segment, it may be only reset or bare ack. */
234
235 if (th->rst) {
Stephen Hemmingercaa20d9a2005-11-10 17:13:47 -0800236 /* This is TIME_WAIT assassination, in two flavors.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700237 * Oh well... nobody has a sufficient solution to this
238 * protocol bug yet.
239 */
240 if (sysctl_tcp_rfc1337 == 0) {
241kill:
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -0700242 inet_twsk_deschedule(tw, &tcp_death_row);
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700243 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700244 return TCP_TW_SUCCESS;
245 }
246 }
Arnaldo Carvalho de Melo696ab2d2005-08-09 20:45:03 -0700247 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
248 TCP_TIMEWAIT_LEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700249
250 if (tmp_opt.saw_tstamp) {
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700251 tcptw->tw_ts_recent = tmp_opt.rcv_tsval;
James Morris9d729f72007-03-04 16:12:44 -0800252 tcptw->tw_ts_recent_stamp = get_seconds();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700253 }
254
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700255 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700256 return TCP_TW_SUCCESS;
257 }
258
259 /* Out of window segment.
260
261 All the segments are ACKed immediately.
262
263 The only exception is new SYN. We accept it, if it is
264 not old duplicate and we are not in danger to be killed
265 by delayed old duplicates. RFC check is that it has
266 newer sequence number works at rates <40Mbit/sec.
267 However, if paws works, it is reliable AND even more,
268 we even may relax silly seq space cutoff.
269
270 RED-PEN: we violate main RFC requirement, if this SYN will appear
271 old duplicate (i.e. we receive RST in reply to SYN-ACK),
272 we must return socket to time-wait state. It is not good,
273 but not fatal yet.
274 */
275
276 if (th->syn && !th->rst && !th->ack && !paws_reject &&
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700277 (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) ||
278 (tmp_opt.saw_tstamp &&
279 (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) {
280 u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700281 if (isn == 0)
282 isn++;
283 TCP_SKB_CB(skb)->when = isn;
284 return TCP_TW_SYN;
285 }
286
287 if (paws_reject)
Pavel Emelyanovde0744a2008-07-16 20:31:16 -0700288 NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_PAWSESTABREJECTED);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700289
Stephen Hemminger2de979b2007-03-08 20:45:19 -0800290 if (!th->rst) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700291 /* In this case we must reset the TIMEWAIT timer.
292 *
293 * If it is ACKless SYN it may be both old duplicate
294 * and new good SYN with random sequence number <rcv_nxt.
295 * Do not reschedule in the last case.
296 */
297 if (paws_reject || th->ack)
Arnaldo Carvalho de Melo696ab2d2005-08-09 20:45:03 -0700298 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
299 TCP_TIMEWAIT_LEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700300
301 /* Send ACK. Note, we do not put the bucket,
302 * it will be released by caller.
303 */
304 return TCP_TW_ACK;
305 }
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700306 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700307 return TCP_TW_SUCCESS;
308}
Eric Dumazet4bc2f182010-07-09 21:22:10 +0000309EXPORT_SYMBOL(tcp_timewait_state_process);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700310
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +0900311/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700312 * Move a socket to time-wait or dead fin-wait-2 state.
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +0900313 */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700314void tcp_time_wait(struct sock *sk, int state, int timeo)
315{
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700316 struct inet_timewait_sock *tw = NULL;
Arnaldo Carvalho de Melo8292a172005-12-13 23:15:52 -0800317 const struct inet_connection_sock *icsk = inet_csk(sk);
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700318 const struct tcp_sock *tp = tcp_sk(sk);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700319 int recycle_ok = 0;
320
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -0700321 if (tcp_death_row.sysctl_tw_recycle && tp->rx_opt.ts_recent_stamp)
David S. Miller3f419d22010-11-29 13:37:14 -0800322 recycle_ok = tcp_remember_stamp(sk);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700323
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -0700324 if (tcp_death_row.tw_count < tcp_death_row.sysctl_max_tw_buckets)
Arnaldo Carvalho de Meloc6762702005-08-09 20:09:59 -0700325 tw = inet_twsk_alloc(sk, state);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700326
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700327 if (tw != NULL) {
328 struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
Arnaldo Carvalho de Melo463c84b2005-08-09 20:10:42 -0700329 const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700330
Linus Torvalds1da177e2005-04-16 15:20:36 -0700331 tw->tw_rcv_wscale = tp->rx_opt.rcv_wscale;
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700332 tcptw->tw_rcv_nxt = tp->rcv_nxt;
333 tcptw->tw_snd_nxt = tp->snd_nxt;
334 tcptw->tw_rcv_wnd = tcp_receive_window(tp);
335 tcptw->tw_ts_recent = tp->rx_opt.ts_recent;
336 tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700337
338#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
339 if (tw->tw_family == PF_INET6) {
340 struct ipv6_pinfo *np = inet6_sk(sk);
Arnaldo Carvalho de Melo0fa1a532005-12-13 23:23:09 -0800341 struct inet6_timewait_sock *tw6;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700342
Arnaldo Carvalho de Melo0fa1a532005-12-13 23:23:09 -0800343 tw->tw_ipv6_offset = inet6_tw_offset(sk->sk_prot);
344 tw6 = inet6_twsk((struct sock *)tw);
345 ipv6_addr_copy(&tw6->tw_v6_daddr, &np->daddr);
346 ipv6_addr_copy(&tw6->tw_v6_rcv_saddr, &np->rcv_saddr);
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700347 tw->tw_ipv6only = np->ipv6only;
Arnaldo Carvalho de Meloc6762702005-08-09 20:09:59 -0700348 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700349#endif
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800350
351#ifdef CONFIG_TCP_MD5SIG
352 /*
353 * The timewait bucket does not have the key DB from the
354 * sock structure. We just make a quick copy of the
355 * md5 key being used (if indeed we are using one)
356 * so the timewait ack generating code has the key.
357 */
358 do {
359 struct tcp_md5sig_key *key;
360 memset(tcptw->tw_md5_key, 0, sizeof(tcptw->tw_md5_key));
361 tcptw->tw_md5_keylen = 0;
362 key = tp->af_specific->md5_lookup(sk, sk);
363 if (key != NULL) {
364 memcpy(&tcptw->tw_md5_key, key->key, key->keylen);
365 tcptw->tw_md5_keylen = key->keylen;
Wu Fengguangaa133072009-09-02 23:45:45 -0700366 if (tcp_alloc_md5sig_pool(sk) == NULL)
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800367 BUG();
368 }
Stephen Hemminger2de979b2007-03-08 20:45:19 -0800369 } while (0);
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800370#endif
371
Linus Torvalds1da177e2005-04-16 15:20:36 -0700372 /* Linkage updates. */
Arnaldo Carvalho de Meloe48c4142005-08-09 20:09:46 -0700373 __inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700374
375 /* Get the TIME_WAIT timeout firing. */
376 if (timeo < rto)
377 timeo = rto;
378
379 if (recycle_ok) {
380 tw->tw_timeout = rto;
381 } else {
382 tw->tw_timeout = TCP_TIMEWAIT_LEN;
383 if (state == TCP_TIME_WAIT)
384 timeo = TCP_TIMEWAIT_LEN;
385 }
386
Arnaldo Carvalho de Melo696ab2d2005-08-09 20:45:03 -0700387 inet_twsk_schedule(tw, &tcp_death_row, timeo,
388 TCP_TIMEWAIT_LEN);
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700389 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700390 } else {
391 /* Sorry, if we're out of memory, just CLOSE this
392 * socket up. We've got bigger problems than
393 * non-graceful socket closings.
394 */
Tom Herbert67631512010-12-08 12:16:33 -0800395 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPTIMEWAITOVERFLOW);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700396 }
397
398 tcp_update_metrics(sk);
399 tcp_done(sk);
400}
401
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800402void tcp_twsk_destructor(struct sock *sk)
403{
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800404#ifdef CONFIG_TCP_MD5SIG
David S. Millera9286302006-11-14 19:53:22 -0800405 struct tcp_timewait_sock *twsk = tcp_twsk(sk);
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800406 if (twsk->tw_md5_keylen)
Robert Varga657e9642009-09-15 23:49:21 -0700407 tcp_free_md5sig_pool();
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800408#endif
409}
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800410EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
411
Ilpo Järvinenbdf1ee52007-05-27 02:04:16 -0700412static inline void TCP_ECN_openreq_child(struct tcp_sock *tp,
413 struct request_sock *req)
414{
415 tp->ecn_flags = inet_rsk(req)->ecn_ok ? TCP_ECN_OK : 0;
416}
417
Linus Torvalds1da177e2005-04-16 15:20:36 -0700418/* This is not only more efficient than what we used to do, it eliminates
419 * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM
420 *
421 * Actually, we could lots of memory writes here. tp of listening
422 * socket contains all necessary default parameters.
423 */
Arnaldo Carvalho de Melo60236fd2005-06-18 22:47:21 -0700424struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700425{
Arnaldo Carvalho de Melo9f1d2602005-08-09 20:11:24 -0700426 struct sock *newsk = inet_csk_clone(sk, req, GFP_ATOMIC);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700427
Arnaldo Carvalho de Melo87d11ce2005-08-09 20:10:12 -0700428 if (newsk != NULL) {
Arnaldo Carvalho de Melo9f1d2602005-08-09 20:11:24 -0700429 const struct inet_request_sock *ireq = inet_rsk(req);
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700430 struct tcp_request_sock *treq = tcp_rsk(req);
Arnaldo Carvalho de Meloa9948a72007-02-28 11:05:56 -0800431 struct inet_connection_sock *newicsk = inet_csk(newsk);
William Allen Simpson435cf552009-12-02 18:17:05 +0000432 struct tcp_sock *newtp = tcp_sk(newsk);
433 struct tcp_sock *oldtp = tcp_sk(sk);
434 struct tcp_cookie_values *oldcvp = oldtp->cookie_values;
435
436 /* TCP Cookie Transactions require space for the cookie pair,
437 * as it differs for each connection. There is no need to
438 * copy any s_data_payload stored at the original socket.
439 * Failure will prevent resuming the connection.
440 *
441 * Presumed copied, in order of appearance:
442 * cookie_in_always, cookie_out_never
443 */
444 if (oldcvp != NULL) {
445 struct tcp_cookie_values *newcvp =
446 kzalloc(sizeof(*newtp->cookie_values),
447 GFP_ATOMIC);
448
449 if (newcvp != NULL) {
450 kref_init(&newcvp->kref);
451 newcvp->cookie_desired =
452 oldcvp->cookie_desired;
453 newtp->cookie_values = newcvp;
454 } else {
455 /* Not Yet Implemented */
456 newtp->cookie_values = NULL;
457 }
458 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700459
Linus Torvalds1da177e2005-04-16 15:20:36 -0700460 /* Now setup tcp_sock */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700461 newtp->pred_flags = 0;
William Allen Simpson435cf552009-12-02 18:17:05 +0000462
463 newtp->rcv_wup = newtp->copied_seq =
464 newtp->rcv_nxt = treq->rcv_isn + 1;
465
466 newtp->snd_sml = newtp->snd_una =
467 newtp->snd_nxt = newtp->snd_up =
468 treq->snt_isn + 1 + tcp_s_data_size(oldtp);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700469
470 tcp_prequeue_init(newtp);
471
Hantzis Fotisee7537b2009-03-02 22:42:02 -0800472 tcp_init_wl(newtp, treq->rcv_isn);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700473
Linus Torvalds1da177e2005-04-16 15:20:36 -0700474 newtp->srtt = 0;
475 newtp->mdev = TCP_TIMEOUT_INIT;
Arnaldo Carvalho de Melo463c84b2005-08-09 20:10:42 -0700476 newicsk->icsk_rto = TCP_TIMEOUT_INIT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700477
478 newtp->packets_out = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700479 newtp->retrans_out = 0;
480 newtp->sacked_out = 0;
481 newtp->fackets_out = 0;
Ilpo Järvinen0b6a05c2009-09-15 01:30:10 -0700482 newtp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700483
484 /* So many TCP implementations out there (incorrectly) count the
485 * initial SYN frame in their delayed-ACK and congestion control
486 * algorithms that we must have the following bandaid to talk
487 * efficiently to them. -DaveM
488 */
Jerry Chu9ad7c042011-06-08 11:08:38 +0000489 newtp->snd_cwnd = TCP_INIT_CWND;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700490 newtp->snd_cwnd_cnt = 0;
Stephen Hemminger9772efb2005-11-10 17:09:53 -0800491 newtp->bytes_acked = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700492
493 newtp->frto_counter = 0;
494 newtp->frto_highmark = 0;
495
Stephen Hemminger7957aed2005-09-21 00:19:46 -0700496 newicsk->icsk_ca_ops = &tcp_init_congestion_ops;
Stephen Hemminger317a76f2005-06-23 12:19:55 -0700497
Arnaldo Carvalho de Melo6687e982005-08-10 04:03:31 -0300498 tcp_set_ca_state(newsk, TCP_CA_Open);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700499 tcp_init_xmit_timers(newsk);
500 skb_queue_head_init(&newtp->out_of_order_queue);
William Allen Simpson435cf552009-12-02 18:17:05 +0000501 newtp->write_seq = newtp->pushed_seq =
502 treq->snt_isn + 1 + tcp_s_data_size(oldtp);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700503
504 newtp->rx_opt.saw_tstamp = 0;
505
506 newtp->rx_opt.dsack = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700507 newtp->rx_opt.num_sacks = 0;
Ilpo Järvinencabeccb2009-02-28 04:44:38 +0000508
Linus Torvalds1da177e2005-04-16 15:20:36 -0700509 newtp->urg_data = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700510
Linus Torvalds1da177e2005-04-16 15:20:36 -0700511 if (sock_flag(newsk, SOCK_KEEPOPEN))
Arnaldo Carvalho de Melo463c84b2005-08-09 20:10:42 -0700512 inet_csk_reset_keepalive_timer(newsk,
513 keepalive_time_when(newtp));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700514
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700515 newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
Stephen Hemminger2de979b2007-03-08 20:45:19 -0800516 if ((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700517 if (sysctl_tcp_fack)
Ilpo Järvinene60402d2007-08-09 15:14:46 +0300518 tcp_enable_fack(newtp);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700519 }
520 newtp->window_clamp = req->window_clamp;
521 newtp->rcv_ssthresh = req->rcv_wnd;
522 newtp->rcv_wnd = req->rcv_wnd;
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700523 newtp->rx_opt.wscale_ok = ireq->wscale_ok;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700524 if (newtp->rx_opt.wscale_ok) {
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700525 newtp->rx_opt.snd_wscale = ireq->snd_wscale;
526 newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700527 } else {
528 newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
529 newtp->window_clamp = min(newtp->window_clamp, 65535U);
530 }
Arnaldo Carvalho de Meloaa8223c2007-04-10 21:04:22 -0700531 newtp->snd_wnd = (ntohs(tcp_hdr(skb)->window) <<
532 newtp->rx_opt.snd_wscale);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700533 newtp->max_window = newtp->snd_wnd;
534
535 if (newtp->rx_opt.tstamp_ok) {
536 newtp->rx_opt.ts_recent = req->ts_recent;
James Morris9d729f72007-03-04 16:12:44 -0800537 newtp->rx_opt.ts_recent_stamp = get_seconds();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700538 newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
539 } else {
540 newtp->rx_opt.ts_recent_stamp = 0;
541 newtp->tcp_header_len = sizeof(struct tcphdr);
542 }
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800543#ifdef CONFIG_TCP_MD5SIG
544 newtp->md5sig_info = NULL; /*XXX*/
545 if (newtp->af_specific->md5_lookup(sk, newsk))
546 newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
547#endif
William Allen Simpsonbee7ca92009-11-10 09:51:18 +0000548 if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
Arnaldo Carvalho de Melo463c84b2005-08-09 20:10:42 -0700549 newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700550 newtp->rx_opt.mss_clamp = req->mss;
551 TCP_ECN_openreq_child(newtp, req);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700552
Pavel Emelyanov63231bd2008-07-16 20:22:25 -0700553 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_PASSIVEOPENS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700554 }
555 return newsk;
556}
Eric Dumazet4bc2f182010-07-09 21:22:10 +0000557EXPORT_SYMBOL(tcp_create_openreq_child);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700558
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +0900559/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700560 * Process an incoming packet for SYN_RECV sockets represented
Arnaldo Carvalho de Melo60236fd2005-06-18 22:47:21 -0700561 * as a request_sock.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700562 */
563
Jianjun Kong5a5f3a82008-11-03 00:24:34 -0800564struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
Arnaldo Carvalho de Melo60236fd2005-06-18 22:47:21 -0700565 struct request_sock *req,
566 struct request_sock **prev)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700567{
William Allen Simpson4957faade2009-12-02 18:25:27 +0000568 struct tcp_options_received tmp_opt;
569 u8 *hash_location;
570 struct sock *child;
Arnaldo Carvalho de Meloaa8223c2007-04-10 21:04:22 -0700571 const struct tcphdr *th = tcp_hdr(skb);
Al Viro714e85b2006-11-14 20:51:49 -0800572 __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700573 int paws_reject = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700574
David S. Millerbb5b7c12009-12-15 20:56:42 -0800575 tmp_opt.saw_tstamp = 0;
576 if (th->doff > (sizeof(struct tcphdr)>>2)) {
577 tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700578
579 if (tmp_opt.saw_tstamp) {
580 tmp_opt.ts_recent = req->ts_recent;
581 /* We do not store true stamp, but it is not required,
582 * it can be estimated (approximately)
583 * from another data.
584 */
James Morris9d729f72007-03-04 16:12:44 -0800585 tmp_opt.ts_recent_stamp = get_seconds() - ((TCP_TIMEOUT_INIT/HZ)<<req->retrans);
Ilpo Järvinenc887e6d2009-03-14 14:23:03 +0000586 paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700587 }
588 }
589
590 /* Check for pure retransmitted SYN. */
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700591 if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
Linus Torvalds1da177e2005-04-16 15:20:36 -0700592 flg == TCP_FLAG_SYN &&
593 !paws_reject) {
594 /*
595 * RFC793 draws (Incorrectly! It was fixed in RFC1122)
596 * this case on figure 6 and figure 8, but formal
597 * protocol description says NOTHING.
598 * To be more exact, it says that we should send ACK,
599 * because this segment (at least, if it has no data)
600 * is out of window.
601 *
602 * CONCLUSION: RFC793 (even with RFC1122) DOES NOT
603 * describe SYN-RECV state. All the description
604 * is wrong, we cannot believe to it and should
605 * rely only on common sense and implementation
606 * experience.
607 *
608 * Enforce "SYN-ACK" according to figure 8, figure 6
609 * of RFC793, fixed by RFC1122.
610 */
William Allen Simpsone6b4d112009-12-02 18:07:39 +0000611 req->rsk_ops->rtx_syn_ack(sk, req, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700612 return NULL;
613 }
614
615 /* Further reproduces section "SEGMENT ARRIVES"
616 for state SYN-RECEIVED of RFC793.
617 It is broken, however, it does not work only
618 when SYNs are crossed.
619
620 You would think that SYN crossing is impossible here, since
621 we should have a SYN_SENT socket (from connect()) on our end,
622 but this is not true if the crossed SYNs were sent to both
623 ends by a malicious third party. We must defend against this,
624 and to do that we first verify the ACK (as per RFC793, page
625 36) and reset if it is invalid. Is this a true full defense?
626 To convince ourselves, let us consider a way in which the ACK
627 test can still pass in this 'malicious crossed SYNs' case.
628 Malicious sender sends identical SYNs (and thus identical sequence
629 numbers) to both A and B:
630
631 A: gets SYN, seq=7
632 B: gets SYN, seq=7
633
634 By our good fortune, both A and B select the same initial
635 send sequence number of seven :-)
636
637 A: sends SYN|ACK, seq=7, ack_seq=8
638 B: sends SYN|ACK, seq=7, ack_seq=8
639
640 So we are now A eating this SYN|ACK, ACK test passes. So
641 does sequence test, SYN is truncated, and thus we consider
642 it a bare ACK.
643
David S. Millerec0a1962008-06-12 16:31:35 -0700644 If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this
645 bare ACK. Otherwise, we create an established connection. Both
646 ends (listening sockets) accept the new incoming connection and try
647 to talk to each other. 8-)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700648
649 Note: This case is both harmless, and rare. Possibility is about the
650 same as us discovering intelligent life on another plant tomorrow.
651
652 But generally, we should (RFC lies!) to accept ACK
653 from SYNACK both here and in tcp_rcv_state_process().
654 tcp_rcv_state_process() does not, hence, we do not too.
655
656 Note that the case is absolutely generic:
657 we cannot optimize anything here without
658 violating protocol. All the checks must be made
659 before attempt to create socket.
660 */
661
662 /* RFC793 page 36: "If the connection is in any non-synchronized state ...
663 * and the incoming segment acknowledges something not yet
Stephen Hemmingercaa20d9a2005-11-10 17:13:47 -0800664 * sent (the segment carries an unacceptable ACK) ...
Linus Torvalds1da177e2005-04-16 15:20:36 -0700665 * a reset is sent."
666 *
667 * Invalid ACK: reset will be sent by listening socket
668 */
669 if ((flg & TCP_FLAG_ACK) &&
William Allen Simpson435cf552009-12-02 18:17:05 +0000670 (TCP_SKB_CB(skb)->ack_seq !=
671 tcp_rsk(req)->snt_isn + 1 + tcp_s_data_size(tcp_sk(sk))))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700672 return sk;
673
674 /* Also, it would be not so bad idea to check rcv_tsecr, which
675 * is essentially ACK extension and too early or too late values
676 * should cause reset in unsynchronized states.
677 */
678
679 /* RFC793: "first check sequence number". */
680
681 if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700682 tcp_rsk(req)->rcv_isn + 1, tcp_rsk(req)->rcv_isn + 1 + req->rcv_wnd)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700683 /* Out of window: send ACK and drop. */
684 if (!(flg & TCP_FLAG_RST))
Gui Jianfeng6edafaa2008-08-06 23:50:04 -0700685 req->rsk_ops->send_ack(sk, skb, req);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700686 if (paws_reject)
Pavel Emelyanovde0744a2008-07-16 20:31:16 -0700687 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700688 return NULL;
689 }
690
691 /* In sequence, PAWS is OK. */
692
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700693 if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_isn + 1))
Adam Langley2aaab9a2008-08-07 20:27:45 -0700694 req->ts_recent = tmp_opt.rcv_tsval;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700695
Adam Langley2aaab9a2008-08-07 20:27:45 -0700696 if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
697 /* Truncate SYN, it is out of window starting
698 at tcp_rsk(req)->rcv_isn + 1. */
699 flg &= ~TCP_FLAG_SYN;
700 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700701
Adam Langley2aaab9a2008-08-07 20:27:45 -0700702 /* RFC793: "second check the RST bit" and
703 * "fourth, check the SYN bit"
704 */
705 if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
706 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
707 goto embryonic_reset;
708 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700709
Adam Langley2aaab9a2008-08-07 20:27:45 -0700710 /* ACK sequence verified above, just make sure ACK is
711 * set. If ACK not set, just silently drop the packet.
712 */
713 if (!(flg & TCP_FLAG_ACK))
714 return NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700715
Julian Anastasovd1b99ba2009-10-19 10:01:56 +0000716 /* While TCP_DEFER_ACCEPT is active, drop bare ACK. */
717 if (req->retrans < inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
Adam Langley2aaab9a2008-08-07 20:27:45 -0700718 TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
719 inet_rsk(req)->acked = 1;
Eric Dumazet907cdda2010-03-19 05:37:18 +0000720 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPDEFERACCEPTDROP);
Adam Langley2aaab9a2008-08-07 20:27:45 -0700721 return NULL;
722 }
Jerry Chu9ad7c042011-06-08 11:08:38 +0000723 if (tmp_opt.saw_tstamp && tmp_opt.rcv_tsecr)
724 tcp_rsk(req)->snt_synack = tmp_opt.rcv_tsecr;
725 else if (req->retrans) /* don't take RTT sample if retrans && ~TS */
726 tcp_rsk(req)->snt_synack = 0;
David S. Millerec0a1962008-06-12 16:31:35 -0700727
Adam Langley2aaab9a2008-08-07 20:27:45 -0700728 /* OK, ACK is valid, create big socket and
729 * feed this segment to it. It will repeat all
730 * the tests. THIS SEGMENT MUST MOVE SOCKET TO
731 * ESTABLISHED STATE. If it will be dropped after
732 * socket is created, wait for troubles.
733 */
734 child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL);
735 if (child == NULL)
736 goto listen_overflow;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700737
Adam Langley2aaab9a2008-08-07 20:27:45 -0700738 inet_csk_reqsk_queue_unlink(sk, req, prev);
739 inet_csk_reqsk_queue_removed(sk, req);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700740
Adam Langley2aaab9a2008-08-07 20:27:45 -0700741 inet_csk_reqsk_queue_add(sk, req, child);
742 return child;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700743
Adam Langley2aaab9a2008-08-07 20:27:45 -0700744listen_overflow:
745 if (!sysctl_tcp_abort_on_overflow) {
746 inet_rsk(req)->acked = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700747 return NULL;
Adam Langley2aaab9a2008-08-07 20:27:45 -0700748 }
749
750embryonic_reset:
751 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
752 if (!(flg & TCP_FLAG_RST))
753 req->rsk_ops->send_reset(sk, skb);
754
755 inet_csk_reqsk_queue_drop(sk, req, prev);
756 return NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700757}
Eric Dumazet4bc2f182010-07-09 21:22:10 +0000758EXPORT_SYMBOL(tcp_check_req);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700759
760/*
761 * Queue segment on the new socket if the new socket is active,
762 * otherwise we just shortcircuit this and continue with
763 * the new socket.
764 */
765
766int tcp_child_process(struct sock *parent, struct sock *child,
767 struct sk_buff *skb)
768{
769 int ret = 0;
770 int state = child->sk_state;
771
772 if (!sock_owned_by_user(child)) {
Arnaldo Carvalho de Meloaa8223c2007-04-10 21:04:22 -0700773 ret = tcp_rcv_state_process(child, skb, tcp_hdr(skb),
774 skb->len);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700775 /* Wakeup parent, send SIGIO */
776 if (state == TCP_SYN_RECV && child->sk_state != state)
777 parent->sk_data_ready(parent, 0);
778 } else {
779 /* Alas, it is possible again, because we do lookup
780 * in main socket hash table and lock on listening
781 * socket does not protect us more.
782 */
Zhu Yia3a858f2010-03-04 18:01:47 +0000783 __sk_add_backlog(child, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700784 }
785
786 bh_unlock_sock(child);
787 sock_put(child);
788 return ret;
789}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700790EXPORT_SYMBOL(tcp_child_process);