Arnaldo Carvalho de Melo | 0e87506 | 2005-06-18 22:47:59 -0700 | [diff] [blame] | 1 | /* |
| 2 | * NET Generic infrastructure for Network protocols. |
| 3 | * |
| 4 | * Authors: Arnaldo Carvalho de Melo <acme@conectiva.com.br> |
| 5 | * |
| 6 | * From code originally in include/net/tcp.h |
| 7 | * |
| 8 | * This program is free software; you can redistribute it and/or |
| 9 | * modify it under the terms of the GNU General Public License |
| 10 | * as published by the Free Software Foundation; either version |
| 11 | * 2 of the License, or (at your option) any later version. |
| 12 | */ |
| 13 | |
| 14 | #include <linux/module.h> |
| 15 | #include <linux/random.h> |
| 16 | #include <linux/slab.h> |
| 17 | #include <linux/string.h> |
Jerry Chu | 8336886 | 2012-08-31 12:29:12 +0000 | [diff] [blame^] | 18 | #include <linux/tcp.h> |
Eric Dumazet | 72a3eff | 2006-11-16 02:30:37 -0800 | [diff] [blame] | 19 | #include <linux/vmalloc.h> |
Arnaldo Carvalho de Melo | 0e87506 | 2005-06-18 22:47:59 -0700 | [diff] [blame] | 20 | |
| 21 | #include <net/request_sock.h> |
| 22 | |
David S. Miller | e52c1f1 | 2005-06-18 22:49:40 -0700 | [diff] [blame] | 23 | /* |
| 24 | * Maximum number of SYN_RECV sockets in queue per LISTEN socket. |
| 25 | * One SYN_RECV socket costs about 80bytes on a 32bit machine. |
| 26 | * It would be better to replace it with a global counter for all sockets |
| 27 | * but then some measure against one socket starving all other sockets |
| 28 | * would be needed. |
| 29 | * |
Peter Pan(潘卫平) | 99b53bd | 2011-12-05 21:39:41 +0000 | [diff] [blame] | 30 | * The minimum value of it is 128. Experiments with real servers show that |
David S. Miller | e52c1f1 | 2005-06-18 22:49:40 -0700 | [diff] [blame] | 31 | * it is absolutely not enough even at 100conn/sec. 256 cures most |
Peter Pan(潘卫平) | 99b53bd | 2011-12-05 21:39:41 +0000 | [diff] [blame] | 32 | * of problems. |
| 33 | * This value is adjusted to 128 for low memory machines, |
| 34 | * and it will increase in proportion to the memory of machine. |
Eric Dumazet | 72a3eff | 2006-11-16 02:30:37 -0800 | [diff] [blame] | 35 | * Note : Dont forget somaxconn that may limit backlog too. |
David S. Miller | e52c1f1 | 2005-06-18 22:49:40 -0700 | [diff] [blame] | 36 | */ |
| 37 | int sysctl_max_syn_backlog = 256; |
David S. Miller | 493f377 | 2010-12-02 12:14:29 -0800 | [diff] [blame] | 38 | EXPORT_SYMBOL(sysctl_max_syn_backlog); |
David S. Miller | e52c1f1 | 2005-06-18 22:49:40 -0700 | [diff] [blame] | 39 | |
Arnaldo Carvalho de Melo | 0e87506 | 2005-06-18 22:47:59 -0700 | [diff] [blame] | 40 | int reqsk_queue_alloc(struct request_sock_queue *queue, |
Eric Dumazet | 72a3eff | 2006-11-16 02:30:37 -0800 | [diff] [blame] | 41 | unsigned int nr_table_entries) |
Arnaldo Carvalho de Melo | 0e87506 | 2005-06-18 22:47:59 -0700 | [diff] [blame] | 42 | { |
Eric Dumazet | 72a3eff | 2006-11-16 02:30:37 -0800 | [diff] [blame] | 43 | size_t lopt_size = sizeof(struct listen_sock); |
| 44 | struct listen_sock *lopt; |
Arnaldo Carvalho de Melo | 0e87506 | 2005-06-18 22:47:59 -0700 | [diff] [blame] | 45 | |
Eric Dumazet | 72a3eff | 2006-11-16 02:30:37 -0800 | [diff] [blame] | 46 | nr_table_entries = min_t(u32, nr_table_entries, sysctl_max_syn_backlog); |
| 47 | nr_table_entries = max_t(u32, nr_table_entries, 8); |
| 48 | nr_table_entries = roundup_pow_of_two(nr_table_entries + 1); |
| 49 | lopt_size += nr_table_entries * sizeof(struct request_sock *); |
| 50 | if (lopt_size > PAGE_SIZE) |
Eric Dumazet | 7a1c8e5 | 2010-11-20 07:46:35 +0000 | [diff] [blame] | 51 | lopt = vzalloc(lopt_size); |
Eric Dumazet | 72a3eff | 2006-11-16 02:30:37 -0800 | [diff] [blame] | 52 | else |
| 53 | lopt = kzalloc(lopt_size, GFP_KERNEL); |
Arnaldo Carvalho de Melo | 0e87506 | 2005-06-18 22:47:59 -0700 | [diff] [blame] | 54 | if (lopt == NULL) |
| 55 | return -ENOMEM; |
| 56 | |
Eric Dumazet | 72a3eff | 2006-11-16 02:30:37 -0800 | [diff] [blame] | 57 | for (lopt->max_qlen_log = 3; |
| 58 | (1 << lopt->max_qlen_log) < nr_table_entries; |
Arnaldo Carvalho de Melo | 0e87506 | 2005-06-18 22:47:59 -0700 | [diff] [blame] | 59 | lopt->max_qlen_log++); |
| 60 | |
| 61 | get_random_bytes(&lopt->hash_rnd, sizeof(lopt->hash_rnd)); |
| 62 | rwlock_init(&queue->syn_wait_lock); |
Norbert Kiesel | 3eb4801 | 2006-03-26 17:39:55 -0800 | [diff] [blame] | 63 | queue->rskq_accept_head = NULL; |
Arnaldo Carvalho de Melo | 83e3609 | 2005-08-09 19:33:31 -0700 | [diff] [blame] | 64 | lopt->nr_table_entries = nr_table_entries; |
Arnaldo Carvalho de Melo | 0e87506 | 2005-06-18 22:47:59 -0700 | [diff] [blame] | 65 | |
| 66 | write_lock_bh(&queue->syn_wait_lock); |
| 67 | queue->listen_opt = lopt; |
| 68 | write_unlock_bh(&queue->syn_wait_lock); |
| 69 | |
| 70 | return 0; |
| 71 | } |
| 72 | |
Pavel Emelyanov | dab6ba3 | 2007-11-15 02:57:06 -0800 | [diff] [blame] | 73 | void __reqsk_queue_destroy(struct request_sock_queue *queue) |
| 74 | { |
| 75 | struct listen_sock *lopt; |
| 76 | size_t lopt_size; |
| 77 | |
| 78 | /* |
| 79 | * this is an error recovery path only |
| 80 | * no locking needed and the lopt is not NULL |
| 81 | */ |
| 82 | |
| 83 | lopt = queue->listen_opt; |
| 84 | lopt_size = sizeof(struct listen_sock) + |
| 85 | lopt->nr_table_entries * sizeof(struct request_sock *); |
| 86 | |
| 87 | if (lopt_size > PAGE_SIZE) |
| 88 | vfree(lopt); |
| 89 | else |
| 90 | kfree(lopt); |
| 91 | } |
| 92 | |
Pavel Emelyanov | dab6ba3 | 2007-11-15 02:57:06 -0800 | [diff] [blame] | 93 | static inline struct listen_sock *reqsk_queue_yank_listen_sk( |
| 94 | struct request_sock_queue *queue) |
| 95 | { |
| 96 | struct listen_sock *lopt; |
| 97 | |
| 98 | write_lock_bh(&queue->syn_wait_lock); |
| 99 | lopt = queue->listen_opt; |
| 100 | queue->listen_opt = NULL; |
| 101 | write_unlock_bh(&queue->syn_wait_lock); |
| 102 | |
| 103 | return lopt; |
| 104 | } |
| 105 | |
Arnaldo Carvalho de Melo | 83e3609 | 2005-08-09 19:33:31 -0700 | [diff] [blame] | 106 | void reqsk_queue_destroy(struct request_sock_queue *queue) |
| 107 | { |
| 108 | /* make all the listen_opt local to us */ |
| 109 | struct listen_sock *lopt = reqsk_queue_yank_listen_sk(queue); |
Eric Dumazet | 72a3eff | 2006-11-16 02:30:37 -0800 | [diff] [blame] | 110 | size_t lopt_size = sizeof(struct listen_sock) + |
| 111 | lopt->nr_table_entries * sizeof(struct request_sock *); |
Arnaldo Carvalho de Melo | 83e3609 | 2005-08-09 19:33:31 -0700 | [diff] [blame] | 112 | |
| 113 | if (lopt->qlen != 0) { |
Eric Dumazet | 72a3eff | 2006-11-16 02:30:37 -0800 | [diff] [blame] | 114 | unsigned int i; |
Arnaldo Carvalho de Melo | 83e3609 | 2005-08-09 19:33:31 -0700 | [diff] [blame] | 115 | |
| 116 | for (i = 0; i < lopt->nr_table_entries; i++) { |
| 117 | struct request_sock *req; |
| 118 | |
| 119 | while ((req = lopt->syn_table[i]) != NULL) { |
| 120 | lopt->syn_table[i] = req->dl_next; |
| 121 | lopt->qlen--; |
| 122 | reqsk_free(req); |
| 123 | } |
| 124 | } |
| 125 | } |
| 126 | |
Ilpo Järvinen | 547b792 | 2008-07-25 21:43:18 -0700 | [diff] [blame] | 127 | WARN_ON(lopt->qlen != 0); |
Eric Dumazet | 72a3eff | 2006-11-16 02:30:37 -0800 | [diff] [blame] | 128 | if (lopt_size > PAGE_SIZE) |
| 129 | vfree(lopt); |
| 130 | else |
| 131 | kfree(lopt); |
Arnaldo Carvalho de Melo | 83e3609 | 2005-08-09 19:33:31 -0700 | [diff] [blame] | 132 | } |
| 133 | |
Jerry Chu | 8336886 | 2012-08-31 12:29:12 +0000 | [diff] [blame^] | 134 | /* |
| 135 | * This function is called to set a Fast Open socket's "fastopen_rsk" field |
| 136 | * to NULL when a TFO socket no longer needs to access the request_sock. |
| 137 | * This happens only after 3WHS has been either completed or aborted (e.g., |
| 138 | * RST is received). |
| 139 | * |
| 140 | * Before TFO, a child socket is created only after 3WHS is completed, |
| 141 | * hence it never needs to access the request_sock. things get a lot more |
| 142 | * complex with TFO. A child socket, accepted or not, has to access its |
| 143 | * request_sock for 3WHS processing, e.g., to retransmit SYN-ACK pkts, |
| 144 | * until 3WHS is either completed or aborted. Afterwards the req will stay |
| 145 | * until either the child socket is accepted, or in the rare case when the |
| 146 | * listener is closed before the child is accepted. |
| 147 | * |
| 148 | * In short, a request socket is only freed after BOTH 3WHS has completed |
| 149 | * (or aborted) and the child socket has been accepted (or listener closed). |
| 150 | * When a child socket is accepted, its corresponding req->sk is set to |
| 151 | * NULL since it's no longer needed. More importantly, "req->sk == NULL" |
| 152 | * will be used by the code below to determine if a child socket has been |
| 153 | * accepted or not, and the check is protected by the fastopenq->lock |
| 154 | * described below. |
| 155 | * |
| 156 | * Note that fastopen_rsk is only accessed from the child socket's context |
| 157 | * with its socket lock held. But a request_sock (req) can be accessed by |
| 158 | * both its child socket through fastopen_rsk, and a listener socket through |
| 159 | * icsk_accept_queue.rskq_accept_head. To protect the access a simple spin |
| 160 | * lock per listener "icsk->icsk_accept_queue.fastopenq->lock" is created. |
| 161 | * only in the rare case when both the listener and the child locks are held, |
| 162 | * e.g., in inet_csk_listen_stop() do we not need to acquire the lock. |
| 163 | * The lock also protects other fields such as fastopenq->qlen, which is |
| 164 | * decremented by this function when fastopen_rsk is no longer needed. |
| 165 | * |
| 166 | * Note that another solution was to simply use the existing socket lock |
| 167 | * from the listener. But first socket lock is difficult to use. It is not |
| 168 | * a simple spin lock - one must consider sock_owned_by_user() and arrange |
| 169 | * to use sk_add_backlog() stuff. But what really makes it infeasible is the |
| 170 | * locking hierarchy violation. E.g., inet_csk_listen_stop() may try to |
| 171 | * acquire a child's lock while holding listener's socket lock. A corner |
| 172 | * case might also exist in tcp_v4_hnd_req() that will trigger this locking |
| 173 | * order. |
| 174 | * |
| 175 | * When a TFO req is created, it needs to sock_hold its listener to prevent |
| 176 | * the latter data structure from going away. |
| 177 | * |
| 178 | * This function also sets "treq->listener" to NULL and unreference listener |
| 179 | * socket. treq->listener is used by the listener so it is protected by the |
| 180 | * fastopenq->lock in this function. |
| 181 | */ |
| 182 | void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req, |
| 183 | bool reset) |
| 184 | { |
| 185 | struct sock *lsk = tcp_rsk(req)->listener; |
| 186 | struct fastopen_queue *fastopenq = |
| 187 | inet_csk(lsk)->icsk_accept_queue.fastopenq; |
| 188 | |
| 189 | BUG_ON(!spin_is_locked(&sk->sk_lock.slock) && !sock_owned_by_user(sk)); |
| 190 | |
| 191 | tcp_sk(sk)->fastopen_rsk = NULL; |
| 192 | spin_lock_bh(&fastopenq->lock); |
| 193 | fastopenq->qlen--; |
| 194 | tcp_rsk(req)->listener = NULL; |
| 195 | if (req->sk) /* the child socket hasn't been accepted yet */ |
| 196 | goto out; |
| 197 | |
| 198 | if (!reset || lsk->sk_state != TCP_LISTEN) { |
| 199 | /* If the listener has been closed don't bother with the |
| 200 | * special RST handling below. |
| 201 | */ |
| 202 | spin_unlock_bh(&fastopenq->lock); |
| 203 | sock_put(lsk); |
| 204 | reqsk_free(req); |
| 205 | return; |
| 206 | } |
| 207 | /* Wait for 60secs before removing a req that has triggered RST. |
| 208 | * This is a simple defense against TFO spoofing attack - by |
| 209 | * counting the req against fastopen.max_qlen, and disabling |
| 210 | * TFO when the qlen exceeds max_qlen. |
| 211 | * |
| 212 | * For more details see CoNext'11 "TCP Fast Open" paper. |
| 213 | */ |
| 214 | req->expires = jiffies + 60*HZ; |
| 215 | if (fastopenq->rskq_rst_head == NULL) |
| 216 | fastopenq->rskq_rst_head = req; |
| 217 | else |
| 218 | fastopenq->rskq_rst_tail->dl_next = req; |
| 219 | |
| 220 | req->dl_next = NULL; |
| 221 | fastopenq->rskq_rst_tail = req; |
| 222 | fastopenq->qlen++; |
| 223 | out: |
| 224 | spin_unlock_bh(&fastopenq->lock); |
| 225 | sock_put(lsk); |
| 226 | return; |
| 227 | } |