blob: ab1c08658528e7737fd1683841a4d11701cbc0bb [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * INET An implementation of the TCP/IP protocol suite for the LINUX
3 * operating system. INET is implemented using the BSD Socket
4 * interface as the means of communication with the user level.
5 *
6 * Implementation of the Transmission Control Protocol(TCP).
7 *
Jesper Juhl02c30a82005-05-05 16:16:16 -07008 * Authors: Ross Biro
Linus Torvalds1da177e2005-04-16 15:20:36 -07009 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10 * Mark Evans, <evansmp@uhura.aston.ac.uk>
11 * Corey Minyard <wf-rch!minyard@relay.EU.net>
12 * Florian La Roche, <flla@stud.uni-sb.de>
13 * Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
14 * Linus Torvalds, <torvalds@cs.helsinki.fi>
15 * Alan Cox, <gw4pts@gw4pts.ampr.org>
16 * Matthew Dillon, <dillon@apollo.west.oic.com>
17 * Arnt Gulbrandsen, <agulbra@nvg.unit.no>
18 * Jorge Cwik, <jorge@laser.satlink.net>
19 */
20
Linus Torvalds1da177e2005-04-16 15:20:36 -070021#include <linux/mm.h>
22#include <linux/module.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090023#include <linux/slab.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070024#include <linux/sysctl.h>
25#include <linux/workqueue.h>
26#include <net/tcp.h>
27#include <net/inet_common.h>
28#include <net/xfrm.h>
29
David S. Millere994b7c2009-11-21 11:22:25 -080030int sysctl_tcp_syncookies __read_mostly = 1;
Glenn Griffinc6aefaf2008-02-07 21:49:26 -080031EXPORT_SYMBOL(sysctl_tcp_syncookies);
32
Brian Haleyab32ea52006-09-22 14:15:41 -070033int sysctl_tcp_abort_on_overflow __read_mostly;
Linus Torvalds1da177e2005-04-16 15:20:36 -070034
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -070035struct inet_timewait_death_row tcp_death_row = {
36 .sysctl_max_tw_buckets = NR_FILE * 2,
37 .period = TCP_TIMEWAIT_LEN / INET_TWDR_TWKILL_SLOTS,
Ingo Molnare4d91912006-07-03 00:24:34 -070038 .death_lock = __SPIN_LOCK_UNLOCKED(tcp_death_row.death_lock),
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -070039 .hashinfo = &tcp_hashinfo,
40 .tw_timer = TIMER_INITIALIZER(inet_twdr_hangman, 0,
41 (unsigned long)&tcp_death_row),
42 .twkill_work = __WORK_INITIALIZER(tcp_death_row.twkill_work,
David Howells65f27f32006-11-22 14:55:48 +000043 inet_twdr_twkill_work),
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -070044/* Short-time timewait calendar */
45
46 .twcal_hand = -1,
47 .twcal_timer = TIMER_INITIALIZER(inet_twdr_twcal_tick, 0,
48 (unsigned long)&tcp_death_row),
49};
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -070050EXPORT_SYMBOL_GPL(tcp_death_row);
51
Eric Dumazeta2a385d2012-05-16 23:15:34 +000052static bool tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
Linus Torvalds1da177e2005-04-16 15:20:36 -070053{
54 if (seq == s_win)
Eric Dumazeta2a385d2012-05-16 23:15:34 +000055 return true;
Linus Torvalds1da177e2005-04-16 15:20:36 -070056 if (after(end_seq, s_win) && before(seq, e_win))
Eric Dumazeta2a385d2012-05-16 23:15:34 +000057 return true;
Eric Dumazeta02cec22010-09-22 20:43:57 +000058 return seq == e_win && seq == end_seq;
Linus Torvalds1da177e2005-04-16 15:20:36 -070059}
60
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +090061/*
Linus Torvalds1da177e2005-04-16 15:20:36 -070062 * * Main purpose of TIME-WAIT state is to close connection gracefully,
63 * when one of ends sits in LAST-ACK or CLOSING retransmitting FIN
64 * (and, probably, tail of data) and one or more our ACKs are lost.
65 * * What is TIME-WAIT timeout? It is associated with maximal packet
66 * lifetime in the internet, which results in wrong conclusion, that
67 * it is set to catch "old duplicate segments" wandering out of their path.
68 * It is not quite correct. This timeout is calculated so that it exceeds
69 * maximal retransmission timeout enough to allow to lose one (or more)
70 * segments sent by peer and our ACKs. This time may be calculated from RTO.
71 * * When TIME-WAIT socket receives RST, it means that another end
72 * finally closed and we are allowed to kill TIME-WAIT too.
73 * * Second purpose of TIME-WAIT is catching old duplicate segments.
74 * Well, certainly it is pure paranoia, but if we load TIME-WAIT
75 * with this semantics, we MUST NOT kill TIME-WAIT state with RSTs.
76 * * If we invented some more clever way to catch duplicates
77 * (f.e. based on PAWS), we could truncate TIME-WAIT to several RTOs.
78 *
79 * The algorithm below is based on FORMAL INTERPRETATION of RFCs.
80 * When you compare it to RFCs, please, read section SEGMENT ARRIVES
81 * from the very beginning.
82 *
83 * NOTE. With recycling (and later with fin-wait-2) TW bucket
84 * is _not_ stateless. It means, that strictly speaking we must
85 * spinlock it. I do not want! Well, probability of misbehaviour
86 * is ridiculously low and, seems, we could use some mb() tricks
87 * to avoid misread sequence numbers, states etc. --ANK
Alan Cox4308fc52012-09-19 15:46:06 +010088 *
89 * We don't need to initialize tmp_out.sack_ok as we don't use the results
Linus Torvalds1da177e2005-04-16 15:20:36 -070090 */
91enum tcp_tw_status
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -070092tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
93 const struct tcphdr *th)
Linus Torvalds1da177e2005-04-16 15:20:36 -070094{
95 struct tcp_options_received tmp_opt;
William Allen Simpson4957faade2009-12-02 18:25:27 +000096 struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
Eric Dumazeta2a385d2012-05-16 23:15:34 +000097 bool paws_reject = false;
Linus Torvalds1da177e2005-04-16 15:20:36 -070098
David S. Millerbb5b7c12009-12-15 20:56:42 -080099 tmp_opt.saw_tstamp = 0;
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700100 if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
Christoph Paasch1a2c6182013-03-17 08:23:34 +0000101 tcp_parse_options(skb, &tmp_opt, 0, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700102
103 if (tmp_opt.saw_tstamp) {
Andrey Vaginee684b62013-02-11 05:50:19 +0000104 tmp_opt.rcv_tsecr -= tcptw->tw_ts_offset;
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700105 tmp_opt.ts_recent = tcptw->tw_ts_recent;
106 tmp_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
Ilpo Järvinenc887e6d2009-03-14 14:23:03 +0000107 paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700108 }
109 }
110
111 if (tw->tw_substate == TCP_FIN_WAIT2) {
112 /* Just repeat all the checks of tcp_rcv_state_process() */
113
114 /* Out of window, send ACK */
115 if (paws_reject ||
116 !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700117 tcptw->tw_rcv_nxt,
118 tcptw->tw_rcv_nxt + tcptw->tw_rcv_wnd))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700119 return TCP_TW_ACK;
120
121 if (th->rst)
122 goto kill;
123
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700124 if (th->syn && !before(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700125 goto kill_with_rst;
126
127 /* Dup ACK? */
Wei Yongjun1ac530b2009-06-24 22:29:31 +0000128 if (!th->ack ||
129 !after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -0700130 TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700131 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700132 return TCP_TW_SUCCESS;
133 }
134
135 /* New data or FIN. If new data arrive after half-duplex close,
136 * reset.
137 */
138 if (!th->fin ||
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700139 TCP_SKB_CB(skb)->end_seq != tcptw->tw_rcv_nxt + 1) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700140kill_with_rst:
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -0700141 inet_twsk_deschedule(tw, &tcp_death_row);
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700142 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700143 return TCP_TW_RST;
144 }
145
146 /* FIN arrived, enter true time-wait state. */
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700147 tw->tw_substate = TCP_TIME_WAIT;
148 tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700149 if (tmp_opt.saw_tstamp) {
James Morris9d729f72007-03-04 16:12:44 -0800150 tcptw->tw_ts_recent_stamp = get_seconds();
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700151 tcptw->tw_ts_recent = tmp_opt.rcv_tsval;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700152 }
153
David S. Millerccb7c412010-12-01 18:09:13 -0800154 if (tcp_death_row.sysctl_tw_recycle &&
155 tcptw->tw_ts_recent_stamp &&
156 tcp_tw_remember_stamp(tw))
Arnaldo Carvalho de Melo696ab2d2005-08-09 20:45:03 -0700157 inet_twsk_schedule(tw, &tcp_death_row, tw->tw_timeout,
158 TCP_TIMEWAIT_LEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700159 else
Arnaldo Carvalho de Melo696ab2d2005-08-09 20:45:03 -0700160 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
161 TCP_TIMEWAIT_LEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700162 return TCP_TW_ACK;
163 }
164
165 /*
166 * Now real TIME-WAIT state.
167 *
168 * RFC 1122:
169 * "When a connection is [...] on TIME-WAIT state [...]
170 * [a TCP] MAY accept a new SYN from the remote TCP to
171 * reopen the connection directly, if it:
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +0900172 *
Linus Torvalds1da177e2005-04-16 15:20:36 -0700173 * (1) assigns its initial sequence number for the new
174 * connection to be larger than the largest sequence
175 * number it used on the previous connection incarnation,
176 * and
177 *
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +0900178 * (2) returns to TIME-WAIT state if the SYN turns out
Linus Torvalds1da177e2005-04-16 15:20:36 -0700179 * to be an old duplicate".
180 */
181
182 if (!paws_reject &&
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700183 (TCP_SKB_CB(skb)->seq == tcptw->tw_rcv_nxt &&
Linus Torvalds1da177e2005-04-16 15:20:36 -0700184 (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq || th->rst))) {
185 /* In window segment, it may be only reset or bare ack. */
186
187 if (th->rst) {
Stephen Hemmingercaa20d9a2005-11-10 17:13:47 -0800188 /* This is TIME_WAIT assassination, in two flavors.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700189 * Oh well... nobody has a sufficient solution to this
190 * protocol bug yet.
191 */
192 if (sysctl_tcp_rfc1337 == 0) {
193kill:
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -0700194 inet_twsk_deschedule(tw, &tcp_death_row);
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700195 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700196 return TCP_TW_SUCCESS;
197 }
198 }
Arnaldo Carvalho de Melo696ab2d2005-08-09 20:45:03 -0700199 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
200 TCP_TIMEWAIT_LEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700201
202 if (tmp_opt.saw_tstamp) {
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700203 tcptw->tw_ts_recent = tmp_opt.rcv_tsval;
James Morris9d729f72007-03-04 16:12:44 -0800204 tcptw->tw_ts_recent_stamp = get_seconds();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700205 }
206
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700207 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700208 return TCP_TW_SUCCESS;
209 }
210
211 /* Out of window segment.
212
213 All the segments are ACKed immediately.
214
215 The only exception is new SYN. We accept it, if it is
216 not old duplicate and we are not in danger to be killed
217 by delayed old duplicates. RFC check is that it has
218 newer sequence number works at rates <40Mbit/sec.
219 However, if paws works, it is reliable AND even more,
220 we even may relax silly seq space cutoff.
221
222 RED-PEN: we violate main RFC requirement, if this SYN will appear
223 old duplicate (i.e. we receive RST in reply to SYN-ACK),
224 we must return socket to time-wait state. It is not good,
225 but not fatal yet.
226 */
227
228 if (th->syn && !th->rst && !th->ack && !paws_reject &&
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700229 (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) ||
230 (tmp_opt.saw_tstamp &&
231 (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) {
232 u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700233 if (isn == 0)
234 isn++;
235 TCP_SKB_CB(skb)->when = isn;
236 return TCP_TW_SYN;
237 }
238
239 if (paws_reject)
Pavel Emelyanovde0744a2008-07-16 20:31:16 -0700240 NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_PAWSESTABREJECTED);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700241
Stephen Hemminger2de979b2007-03-08 20:45:19 -0800242 if (!th->rst) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700243 /* In this case we must reset the TIMEWAIT timer.
244 *
245 * If it is ACKless SYN it may be both old duplicate
246 * and new good SYN with random sequence number <rcv_nxt.
247 * Do not reschedule in the last case.
248 */
249 if (paws_reject || th->ack)
Arnaldo Carvalho de Melo696ab2d2005-08-09 20:45:03 -0700250 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
251 TCP_TIMEWAIT_LEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700252
253 /* Send ACK. Note, we do not put the bucket,
254 * it will be released by caller.
255 */
256 return TCP_TW_ACK;
257 }
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700258 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700259 return TCP_TW_SUCCESS;
260}
Eric Dumazet4bc2f182010-07-09 21:22:10 +0000261EXPORT_SYMBOL(tcp_timewait_state_process);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700262
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +0900263/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700264 * Move a socket to time-wait or dead fin-wait-2 state.
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +0900265 */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700266void tcp_time_wait(struct sock *sk, int state, int timeo)
267{
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700268 struct inet_timewait_sock *tw = NULL;
Arnaldo Carvalho de Melo8292a172005-12-13 23:15:52 -0800269 const struct inet_connection_sock *icsk = inet_csk(sk);
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700270 const struct tcp_sock *tp = tcp_sk(sk);
Eric Dumazeta2a385d2012-05-16 23:15:34 +0000271 bool recycle_ok = false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700272
David S. Millerb6242b92012-07-10 03:27:56 -0700273 if (tcp_death_row.sysctl_tw_recycle && tp->rx_opt.ts_recent_stamp)
David S. Miller3f419d22010-11-29 13:37:14 -0800274 recycle_ok = tcp_remember_stamp(sk);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700275
Arnaldo Carvalho de Melo295ff7e2005-08-09 20:44:40 -0700276 if (tcp_death_row.tw_count < tcp_death_row.sysctl_max_tw_buckets)
Arnaldo Carvalho de Meloc6762702005-08-09 20:09:59 -0700277 tw = inet_twsk_alloc(sk, state);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700278
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700279 if (tw != NULL) {
280 struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
Arnaldo Carvalho de Melo463c84b2005-08-09 20:10:42 -0700281 const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
David S. Miller23978492012-06-09 14:56:12 -0700282 struct inet_sock *inet = inet_sk(sk);
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700283
David S. Miller23978492012-06-09 14:56:12 -0700284 tw->tw_transparent = inet->transparent;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700285 tw->tw_rcv_wscale = tp->rx_opt.rcv_wscale;
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700286 tcptw->tw_rcv_nxt = tp->rcv_nxt;
287 tcptw->tw_snd_nxt = tp->snd_nxt;
288 tcptw->tw_rcv_wnd = tcp_receive_window(tp);
289 tcptw->tw_ts_recent = tp->rx_opt.ts_recent;
290 tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
Andrey Vaginceaa1fe2013-02-11 05:50:17 +0000291 tcptw->tw_ts_offset = tp->tsoffset;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700292
Eric Dumazetdfd56b82011-12-10 09:48:31 +0000293#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700294 if (tw->tw_family == PF_INET6) {
295 struct ipv6_pinfo *np = inet6_sk(sk);
Arnaldo Carvalho de Melo0fa1a532005-12-13 23:23:09 -0800296 struct inet6_timewait_sock *tw6;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700297
Arnaldo Carvalho de Melo0fa1a532005-12-13 23:23:09 -0800298 tw->tw_ipv6_offset = inet6_tw_offset(sk->sk_prot);
299 tw6 = inet6_twsk((struct sock *)tw);
Alexey Dobriyan4e3fd7a2011-11-21 03:39:03 +0000300 tw6->tw_v6_daddr = np->daddr;
301 tw6->tw_v6_rcv_saddr = np->rcv_saddr;
Eric Dumazetb903d322011-10-27 00:44:35 -0400302 tw->tw_tclass = np->tclass;
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700303 tw->tw_ipv6only = np->ipv6only;
Arnaldo Carvalho de Meloc6762702005-08-09 20:09:59 -0700304 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700305#endif
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800306
307#ifdef CONFIG_TCP_MD5SIG
308 /*
309 * The timewait bucket does not have the key DB from the
310 * sock structure. We just make a quick copy of the
311 * md5 key being used (if indeed we are using one)
312 * so the timewait ack generating code has the key.
313 */
314 do {
315 struct tcp_md5sig_key *key;
Eric Dumazeta915da9b2012-01-31 05:18:33 +0000316 tcptw->tw_md5_key = NULL;
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800317 key = tp->af_specific->md5_lookup(sk, sk);
318 if (key != NULL) {
Eric Dumazeta915da9b2012-01-31 05:18:33 +0000319 tcptw->tw_md5_key = kmemdup(key, sizeof(*key), GFP_ATOMIC);
Eric Dumazet71cea172013-05-20 06:52:26 +0000320 if (tcptw->tw_md5_key && !tcp_alloc_md5sig_pool())
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800321 BUG();
322 }
Stephen Hemminger2de979b2007-03-08 20:45:19 -0800323 } while (0);
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800324#endif
325
Linus Torvalds1da177e2005-04-16 15:20:36 -0700326 /* Linkage updates. */
Arnaldo Carvalho de Meloe48c4142005-08-09 20:09:46 -0700327 __inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700328
329 /* Get the TIME_WAIT timeout firing. */
330 if (timeo < rto)
331 timeo = rto;
332
333 if (recycle_ok) {
334 tw->tw_timeout = rto;
335 } else {
336 tw->tw_timeout = TCP_TIMEWAIT_LEN;
337 if (state == TCP_TIME_WAIT)
338 timeo = TCP_TIMEWAIT_LEN;
339 }
340
Arnaldo Carvalho de Melo696ab2d2005-08-09 20:45:03 -0700341 inet_twsk_schedule(tw, &tcp_death_row, timeo,
342 TCP_TIMEWAIT_LEN);
Arnaldo Carvalho de Melo8feaf0c02005-08-09 20:09:30 -0700343 inet_twsk_put(tw);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700344 } else {
345 /* Sorry, if we're out of memory, just CLOSE this
346 * socket up. We've got bigger problems than
347 * non-graceful socket closings.
348 */
Tom Herbert67631512010-12-08 12:16:33 -0800349 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPTIMEWAITOVERFLOW);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700350 }
351
352 tcp_update_metrics(sk);
353 tcp_done(sk);
354}
355
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800356void tcp_twsk_destructor(struct sock *sk)
357{
David S. Millerb6242b92012-07-10 03:27:56 -0700358#ifdef CONFIG_TCP_MD5SIG
David S. Millera9286302006-11-14 19:53:22 -0800359 struct tcp_timewait_sock *twsk = tcp_twsk(sk);
David S. Miller23978492012-06-09 14:56:12 -0700360
Eric Dumazet71cea172013-05-20 06:52:26 +0000361 if (twsk->tw_md5_key)
Eric Dumazeta915da9b2012-01-31 05:18:33 +0000362 kfree_rcu(twsk->tw_md5_key, rcu);
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800363#endif
364}
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800365EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
366
Ilpo Järvinenbdf1ee52007-05-27 02:04:16 -0700367static inline void TCP_ECN_openreq_child(struct tcp_sock *tp,
368 struct request_sock *req)
369{
370 tp->ecn_flags = inet_rsk(req)->ecn_ok ? TCP_ECN_OK : 0;
371}
372
Linus Torvalds1da177e2005-04-16 15:20:36 -0700373/* This is not only more efficient than what we used to do, it eliminates
374 * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM
375 *
376 * Actually, we could lots of memory writes here. tp of listening
377 * socket contains all necessary default parameters.
378 */
Arnaldo Carvalho de Melo60236fd2005-06-18 22:47:21 -0700379struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700380{
Eric Dumazete56c57d2011-11-08 17:07:07 -0500381 struct sock *newsk = inet_csk_clone_lock(sk, req, GFP_ATOMIC);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700382
Arnaldo Carvalho de Melo87d11ce2005-08-09 20:10:12 -0700383 if (newsk != NULL) {
Arnaldo Carvalho de Melo9f1d2602005-08-09 20:11:24 -0700384 const struct inet_request_sock *ireq = inet_rsk(req);
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700385 struct tcp_request_sock *treq = tcp_rsk(req);
Arnaldo Carvalho de Meloa9948a72007-02-28 11:05:56 -0800386 struct inet_connection_sock *newicsk = inet_csk(newsk);
William Allen Simpson435cf552009-12-02 18:17:05 +0000387 struct tcp_sock *newtp = tcp_sk(newsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700388
Linus Torvalds1da177e2005-04-16 15:20:36 -0700389 /* Now setup tcp_sock */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700390 newtp->pred_flags = 0;
William Allen Simpson435cf552009-12-02 18:17:05 +0000391
392 newtp->rcv_wup = newtp->copied_seq =
393 newtp->rcv_nxt = treq->rcv_isn + 1;
394
395 newtp->snd_sml = newtp->snd_una =
Christoph Paasch1a2c6182013-03-17 08:23:34 +0000396 newtp->snd_nxt = newtp->snd_up = treq->snt_isn + 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397
398 tcp_prequeue_init(newtp);
Eric Dumazet46d3cea2012-07-11 05:50:31 +0000399 INIT_LIST_HEAD(&newtp->tsq_node);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700400
Hantzis Fotisee7537b2009-03-02 22:42:02 -0800401 tcp_init_wl(newtp, treq->rcv_isn);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700402
Linus Torvalds1da177e2005-04-16 15:20:36 -0700403 newtp->srtt = 0;
404 newtp->mdev = TCP_TIMEOUT_INIT;
Arnaldo Carvalho de Melo463c84b2005-08-09 20:10:42 -0700405 newicsk->icsk_rto = TCP_TIMEOUT_INIT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700406
407 newtp->packets_out = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700408 newtp->retrans_out = 0;
409 newtp->sacked_out = 0;
410 newtp->fackets_out = 0;
Ilpo Järvinen0b6a05c2009-09-15 01:30:10 -0700411 newtp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
Yuchung Chengeed530b2012-05-02 13:30:03 +0000412 tcp_enable_early_retrans(newtp);
Nandita Dukkipati9b717a82013-03-11 10:00:44 +0000413 newtp->tlp_high_seq = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700414
415 /* So many TCP implementations out there (incorrectly) count the
416 * initial SYN frame in their delayed-ACK and congestion control
417 * algorithms that we must have the following bandaid to talk
418 * efficiently to them. -DaveM
419 */
Jerry Chu9ad7c042011-06-08 11:08:38 +0000420 newtp->snd_cwnd = TCP_INIT_CWND;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700421 newtp->snd_cwnd_cnt = 0;
422
Eric Dumazetd8a6e652011-11-30 01:02:41 +0000423 if (newicsk->icsk_ca_ops != &tcp_init_congestion_ops &&
424 !try_module_get(newicsk->icsk_ca_ops->owner))
425 newicsk->icsk_ca_ops = &tcp_init_congestion_ops;
Stephen Hemminger317a76f2005-06-23 12:19:55 -0700426
Arnaldo Carvalho de Melo6687e982005-08-10 04:03:31 -0300427 tcp_set_ca_state(newsk, TCP_CA_Open);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700428 tcp_init_xmit_timers(newsk);
429 skb_queue_head_init(&newtp->out_of_order_queue);
Christoph Paasch1a2c6182013-03-17 08:23:34 +0000430 newtp->write_seq = newtp->pushed_seq = treq->snt_isn + 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700431
432 newtp->rx_opt.saw_tstamp = 0;
433
434 newtp->rx_opt.dsack = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700435 newtp->rx_opt.num_sacks = 0;
Ilpo Järvinencabeccb2009-02-28 04:44:38 +0000436
Linus Torvalds1da177e2005-04-16 15:20:36 -0700437 newtp->urg_data = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700438
Linus Torvalds1da177e2005-04-16 15:20:36 -0700439 if (sock_flag(newsk, SOCK_KEEPOPEN))
Arnaldo Carvalho de Melo463c84b2005-08-09 20:10:42 -0700440 inet_csk_reset_keepalive_timer(newsk,
441 keepalive_time_when(newtp));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700442
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700443 newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
Stephen Hemminger2de979b2007-03-08 20:45:19 -0800444 if ((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700445 if (sysctl_tcp_fack)
Ilpo Järvinene60402d2007-08-09 15:14:46 +0300446 tcp_enable_fack(newtp);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700447 }
448 newtp->window_clamp = req->window_clamp;
449 newtp->rcv_ssthresh = req->rcv_wnd;
450 newtp->rcv_wnd = req->rcv_wnd;
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700451 newtp->rx_opt.wscale_ok = ireq->wscale_ok;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700452 if (newtp->rx_opt.wscale_ok) {
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700453 newtp->rx_opt.snd_wscale = ireq->snd_wscale;
454 newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700455 } else {
456 newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
457 newtp->window_clamp = min(newtp->window_clamp, 65535U);
458 }
Arnaldo Carvalho de Meloaa8223c2007-04-10 21:04:22 -0700459 newtp->snd_wnd = (ntohs(tcp_hdr(skb)->window) <<
460 newtp->rx_opt.snd_wscale);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700461 newtp->max_window = newtp->snd_wnd;
462
463 if (newtp->rx_opt.tstamp_ok) {
464 newtp->rx_opt.ts_recent = req->ts_recent;
James Morris9d729f72007-03-04 16:12:44 -0800465 newtp->rx_opt.ts_recent_stamp = get_seconds();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700466 newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
467 } else {
468 newtp->rx_opt.ts_recent_stamp = 0;
469 newtp->tcp_header_len = sizeof(struct tcphdr);
470 }
Andrey Vaginceaa1fe2013-02-11 05:50:17 +0000471 newtp->tsoffset = 0;
YOSHIFUJI Hideakicfb6eeb2006-11-14 19:07:45 -0800472#ifdef CONFIG_TCP_MD5SIG
473 newtp->md5sig_info = NULL; /*XXX*/
474 if (newtp->af_specific->md5_lookup(sk, newsk))
475 newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
476#endif
William Allen Simpsonbee7ca92009-11-10 09:51:18 +0000477 if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
Arnaldo Carvalho de Melo463c84b2005-08-09 20:10:42 -0700478 newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700479 newtp->rx_opt.mss_clamp = req->mss;
480 TCP_ECN_openreq_child(newtp, req);
Jerry Chu83368862012-08-31 12:29:12 +0000481 newtp->fastopen_rsk = NULL;
Yuchung Cheng6f736012012-10-19 15:14:44 +0000482 newtp->syn_data_acked = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700483
Pavel Emelyanov63231bd2008-07-16 20:22:25 -0700484 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_PASSIVEOPENS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700485 }
486 return newsk;
487}
Eric Dumazet4bc2f182010-07-09 21:22:10 +0000488EXPORT_SYMBOL(tcp_create_openreq_child);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700489
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +0900490/*
Jerry Chu83368862012-08-31 12:29:12 +0000491 * Process an incoming packet for SYN_RECV sockets represented as a
492 * request_sock. Normally sk is the listener socket but for TFO it
493 * points to the child socket.
494 *
495 * XXX (TFO) - The current impl contains a special check for ack
496 * validation and inside tcp_v4_reqsk_send_ack(). Can we do better?
Alan Cox4308fc52012-09-19 15:46:06 +0100497 *
498 * We don't need to initialize tmp_opt.sack_ok as we don't use the results
Linus Torvalds1da177e2005-04-16 15:20:36 -0700499 */
500
Jianjun Kong5a5f3a82008-11-03 00:24:34 -0800501struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
Arnaldo Carvalho de Melo60236fd2005-06-18 22:47:21 -0700502 struct request_sock *req,
Jerry Chu83368862012-08-31 12:29:12 +0000503 struct request_sock **prev,
504 bool fastopen)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700505{
William Allen Simpson4957faade2009-12-02 18:25:27 +0000506 struct tcp_options_received tmp_opt;
William Allen Simpson4957faade2009-12-02 18:25:27 +0000507 struct sock *child;
Arnaldo Carvalho de Meloaa8223c2007-04-10 21:04:22 -0700508 const struct tcphdr *th = tcp_hdr(skb);
Al Viro714e85b2006-11-14 20:51:49 -0800509 __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
Eric Dumazeta2a385d2012-05-16 23:15:34 +0000510 bool paws_reject = false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700511
Jerry Chu83368862012-08-31 12:29:12 +0000512 BUG_ON(fastopen == (sk->sk_state == TCP_LISTEN));
513
David S. Millerbb5b7c12009-12-15 20:56:42 -0800514 tmp_opt.saw_tstamp = 0;
515 if (th->doff > (sizeof(struct tcphdr)>>2)) {
Christoph Paasch1a2c6182013-03-17 08:23:34 +0000516 tcp_parse_options(skb, &tmp_opt, 0, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700517
518 if (tmp_opt.saw_tstamp) {
519 tmp_opt.ts_recent = req->ts_recent;
520 /* We do not store true stamp, but it is not required,
521 * it can be estimated (approximately)
522 * from another data.
523 */
Eric Dumazete6c022a2012-10-27 23:16:46 +0000524 tmp_opt.ts_recent_stamp = get_seconds() - ((TCP_TIMEOUT_INIT/HZ)<<req->num_timeout);
Ilpo Järvinenc887e6d2009-03-14 14:23:03 +0000525 paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700526 }
527 }
528
529 /* Check for pure retransmitted SYN. */
Arnaldo Carvalho de Melo2e6599c2005-06-18 22:46:52 -0700530 if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
Linus Torvalds1da177e2005-04-16 15:20:36 -0700531 flg == TCP_FLAG_SYN &&
532 !paws_reject) {
533 /*
534 * RFC793 draws (Incorrectly! It was fixed in RFC1122)
535 * this case on figure 6 and figure 8, but formal
536 * protocol description says NOTHING.
537 * To be more exact, it says that we should send ACK,
538 * because this segment (at least, if it has no data)
539 * is out of window.
540 *
541 * CONCLUSION: RFC793 (even with RFC1122) DOES NOT
542 * describe SYN-RECV state. All the description
543 * is wrong, we cannot believe to it and should
544 * rely only on common sense and implementation
545 * experience.
546 *
547 * Enforce "SYN-ACK" according to figure 8, figure 6
548 * of RFC793, fixed by RFC1122.
Jerry Chu83368862012-08-31 12:29:12 +0000549 *
550 * Note that even if there is new data in the SYN packet
551 * they will be thrown away too.
Yuchung Chengcd75eff2013-04-29 08:44:51 +0000552 *
553 * Reset timer after retransmitting SYNACK, similar to
554 * the idea of fast retransmit in recovery.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700555 */
Yuchung Chengcd75eff2013-04-29 08:44:51 +0000556 if (!inet_rtx_syn_ack(sk, req))
557 req->expires = min(TCP_TIMEOUT_INIT << req->num_timeout,
558 TCP_RTO_MAX) + jiffies;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700559 return NULL;
560 }
561
562 /* Further reproduces section "SEGMENT ARRIVES"
563 for state SYN-RECEIVED of RFC793.
564 It is broken, however, it does not work only
565 when SYNs are crossed.
566
567 You would think that SYN crossing is impossible here, since
568 we should have a SYN_SENT socket (from connect()) on our end,
569 but this is not true if the crossed SYNs were sent to both
570 ends by a malicious third party. We must defend against this,
571 and to do that we first verify the ACK (as per RFC793, page
572 36) and reset if it is invalid. Is this a true full defense?
573 To convince ourselves, let us consider a way in which the ACK
574 test can still pass in this 'malicious crossed SYNs' case.
575 Malicious sender sends identical SYNs (and thus identical sequence
576 numbers) to both A and B:
577
578 A: gets SYN, seq=7
579 B: gets SYN, seq=7
580
581 By our good fortune, both A and B select the same initial
582 send sequence number of seven :-)
583
584 A: sends SYN|ACK, seq=7, ack_seq=8
585 B: sends SYN|ACK, seq=7, ack_seq=8
586
587 So we are now A eating this SYN|ACK, ACK test passes. So
588 does sequence test, SYN is truncated, and thus we consider
589 it a bare ACK.
590
David S. Millerec0a1962008-06-12 16:31:35 -0700591 If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this
592 bare ACK. Otherwise, we create an established connection. Both
593 ends (listening sockets) accept the new incoming connection and try
594 to talk to each other. 8-)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700595
596 Note: This case is both harmless, and rare. Possibility is about the
597 same as us discovering intelligent life on another plant tomorrow.
598
599 But generally, we should (RFC lies!) to accept ACK
600 from SYNACK both here and in tcp_rcv_state_process().
601 tcp_rcv_state_process() does not, hence, we do not too.
602
603 Note that the case is absolutely generic:
604 we cannot optimize anything here without
605 violating protocol. All the checks must be made
606 before attempt to create socket.
607 */
608
609 /* RFC793 page 36: "If the connection is in any non-synchronized state ...
610 * and the incoming segment acknowledges something not yet
Stephen Hemmingercaa20d9a2005-11-10 17:13:47 -0800611 * sent (the segment carries an unacceptable ACK) ...
Linus Torvalds1da177e2005-04-16 15:20:36 -0700612 * a reset is sent."
613 *
Jerry Chu83368862012-08-31 12:29:12 +0000614 * Invalid ACK: reset will be sent by listening socket.
615 * Note that the ACK validity check for a Fast Open socket is done
616 * elsewhere and is checked directly against the child socket rather
617 * than req because user data may have been sent out.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700618 */
Jerry Chu83368862012-08-31 12:29:12 +0000619 if ((flg & TCP_FLAG_ACK) && !fastopen &&
William Allen Simpson435cf552009-12-02 18:17:05 +0000620 (TCP_SKB_CB(skb)->ack_seq !=
Christoph Paasch1a2c6182013-03-17 08:23:34 +0000621 tcp_rsk(req)->snt_isn + 1))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700622 return sk;
623
624 /* Also, it would be not so bad idea to check rcv_tsecr, which
625 * is essentially ACK extension and too early or too late values
626 * should cause reset in unsynchronized states.
627 */
628
629 /* RFC793: "first check sequence number". */
630
631 if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
Jerry Chu83368862012-08-31 12:29:12 +0000632 tcp_rsk(req)->rcv_nxt, tcp_rsk(req)->rcv_nxt + req->rcv_wnd)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700633 /* Out of window: send ACK and drop. */
634 if (!(flg & TCP_FLAG_RST))
Gui Jianfeng6edafaa2008-08-06 23:50:04 -0700635 req->rsk_ops->send_ack(sk, skb, req);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700636 if (paws_reject)
Pavel Emelyanovde0744a2008-07-16 20:31:16 -0700637 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700638 return NULL;
639 }
640
641 /* In sequence, PAWS is OK. */
642
Jerry Chu83368862012-08-31 12:29:12 +0000643 if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt))
Adam Langley2aaab9a2008-08-07 20:27:45 -0700644 req->ts_recent = tmp_opt.rcv_tsval;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700645
Adam Langley2aaab9a2008-08-07 20:27:45 -0700646 if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
647 /* Truncate SYN, it is out of window starting
648 at tcp_rsk(req)->rcv_isn + 1. */
649 flg &= ~TCP_FLAG_SYN;
650 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700651
Adam Langley2aaab9a2008-08-07 20:27:45 -0700652 /* RFC793: "second check the RST bit" and
653 * "fourth, check the SYN bit"
654 */
655 if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
656 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
657 goto embryonic_reset;
658 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700659
Adam Langley2aaab9a2008-08-07 20:27:45 -0700660 /* ACK sequence verified above, just make sure ACK is
661 * set. If ACK not set, just silently drop the packet.
Jerry Chu83368862012-08-31 12:29:12 +0000662 *
663 * XXX (TFO) - if we ever allow "data after SYN", the
664 * following check needs to be removed.
Adam Langley2aaab9a2008-08-07 20:27:45 -0700665 */
666 if (!(flg & TCP_FLAG_ACK))
667 return NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700668
Neal Cardwell07253982012-09-22 04:18:56 +0000669 /* Got ACK for our SYNACK, so update baseline for SYNACK RTT sample. */
670 if (tmp_opt.saw_tstamp && tmp_opt.rcv_tsecr)
671 tcp_rsk(req)->snt_synack = tmp_opt.rcv_tsecr;
Eric Dumazete6c022a2012-10-27 23:16:46 +0000672 else if (req->num_retrans) /* don't take RTT sample if retrans && ~TS */
Neal Cardwell07253982012-09-22 04:18:56 +0000673 tcp_rsk(req)->snt_synack = 0;
674
Jerry Chu83368862012-08-31 12:29:12 +0000675 /* For Fast Open no more processing is needed (sk is the
676 * child socket).
677 */
678 if (fastopen)
679 return sk;
680
Julian Anastasovd1b99ba2009-10-19 10:01:56 +0000681 /* While TCP_DEFER_ACCEPT is active, drop bare ACK. */
Eric Dumazete6c022a2012-10-27 23:16:46 +0000682 if (req->num_timeout < inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
Adam Langley2aaab9a2008-08-07 20:27:45 -0700683 TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
684 inet_rsk(req)->acked = 1;
Eric Dumazet907cdda2010-03-19 05:37:18 +0000685 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPDEFERACCEPTDROP);
Adam Langley2aaab9a2008-08-07 20:27:45 -0700686 return NULL;
687 }
David S. Millerec0a1962008-06-12 16:31:35 -0700688
Adam Langley2aaab9a2008-08-07 20:27:45 -0700689 /* OK, ACK is valid, create big socket and
690 * feed this segment to it. It will repeat all
691 * the tests. THIS SEGMENT MUST MOVE SOCKET TO
692 * ESTABLISHED STATE. If it will be dropped after
693 * socket is created, wait for troubles.
694 */
695 child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL);
696 if (child == NULL)
697 goto listen_overflow;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700698
Adam Langley2aaab9a2008-08-07 20:27:45 -0700699 inet_csk_reqsk_queue_unlink(sk, req, prev);
700 inet_csk_reqsk_queue_removed(sk, req);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700701
Adam Langley2aaab9a2008-08-07 20:27:45 -0700702 inet_csk_reqsk_queue_add(sk, req, child);
703 return child;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700704
Adam Langley2aaab9a2008-08-07 20:27:45 -0700705listen_overflow:
706 if (!sysctl_tcp_abort_on_overflow) {
707 inet_rsk(req)->acked = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700708 return NULL;
Adam Langley2aaab9a2008-08-07 20:27:45 -0700709 }
710
711embryonic_reset:
Jerry Chu83368862012-08-31 12:29:12 +0000712 if (!(flg & TCP_FLAG_RST)) {
713 /* Received a bad SYN pkt - for TFO We try not to reset
714 * the local connection unless it's really necessary to
715 * avoid becoming vulnerable to outside attack aiming at
716 * resetting legit local connections.
717 */
Adam Langley2aaab9a2008-08-07 20:27:45 -0700718 req->rsk_ops->send_reset(sk, skb);
Jerry Chu83368862012-08-31 12:29:12 +0000719 } else if (fastopen) { /* received a valid RST pkt */
720 reqsk_fastopen_remove(sk, req, true);
721 tcp_reset(sk);
722 }
723 if (!fastopen) {
724 inet_csk_reqsk_queue_drop(sk, req, prev);
725 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
726 }
Adam Langley2aaab9a2008-08-07 20:27:45 -0700727 return NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700728}
Eric Dumazet4bc2f182010-07-09 21:22:10 +0000729EXPORT_SYMBOL(tcp_check_req);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700730
731/*
732 * Queue segment on the new socket if the new socket is active,
733 * otherwise we just shortcircuit this and continue with
734 * the new socket.
Jerry Chu83368862012-08-31 12:29:12 +0000735 *
736 * For the vast majority of cases child->sk_state will be TCP_SYN_RECV
737 * when entering. But other states are possible due to a race condition
738 * where after __inet_lookup_established() fails but before the listener
739 * locked is obtained, other packets cause the same connection to
740 * be created.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700741 */
742
743int tcp_child_process(struct sock *parent, struct sock *child,
744 struct sk_buff *skb)
745{
746 int ret = 0;
747 int state = child->sk_state;
748
749 if (!sock_owned_by_user(child)) {
Arnaldo Carvalho de Meloaa8223c2007-04-10 21:04:22 -0700750 ret = tcp_rcv_state_process(child, skb, tcp_hdr(skb),
751 skb->len);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700752 /* Wakeup parent, send SIGIO */
753 if (state == TCP_SYN_RECV && child->sk_state != state)
754 parent->sk_data_ready(parent, 0);
755 } else {
756 /* Alas, it is possible again, because we do lookup
757 * in main socket hash table and lock on listening
758 * socket does not protect us more.
759 */
Zhu Yia3a858f2010-03-04 18:01:47 +0000760 __sk_add_backlog(child, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700761 }
762
763 bh_unlock_sock(child);
764 sock_put(child);
765 return ret;
766}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700767EXPORT_SYMBOL(tcp_child_process);