35 */
36
37#include "opt_inet6.h"
38#include "opt_ipsec.h"
39#include "opt_mac.h"
40
41#include <sys/param.h>
42#include <sys/systm.h>
43#include <sys/kernel.h>
44#include <sys/sysctl.h>
45#include <sys/malloc.h>
46#include <sys/mac.h>
47#include <sys/mbuf.h>
48#include <sys/md5.h>
49#include <sys/proc.h> /* for proc0 declaration */
50#include <sys/random.h>
51#include <sys/socket.h>
52#include <sys/socketvar.h>
53
54#include <net/if.h>
55#include <net/route.h>
56
57#include <netinet/in.h>
58#include <netinet/in_systm.h>
59#include <netinet/ip.h>
60#include <netinet/in_var.h>
61#include <netinet/in_pcb.h>
62#include <netinet/ip_var.h>
63#ifdef INET6
64#include <netinet/ip6.h>
65#include <netinet/icmp6.h>
66#include <netinet6/nd6.h>
67#include <netinet6/ip6_var.h>
68#include <netinet6/in6_pcb.h>
69#endif
70#include <netinet/tcp.h>
71#include <netinet/tcp_fsm.h>
72#include <netinet/tcp_seq.h>
73#include <netinet/tcp_timer.h>
74#include <netinet/tcp_var.h>
75#ifdef INET6
76#include <netinet6/tcp6_var.h>
77#endif
78
79#ifdef IPSEC
80#include <netinet6/ipsec.h>
81#ifdef INET6
82#include <netinet6/ipsec6.h>
83#endif
84#include <netkey/key.h>
85#endif /*IPSEC*/
86
87#include <machine/in_cksum.h>
88#include <vm/uma.h>
89
90static int tcp_syncookies = 1;
91SYSCTL_INT(_net_inet_tcp, OID_AUTO, syncookies, CTLFLAG_RW,
92 &tcp_syncookies, 0,
93 "Use TCP SYN cookies if the syncache overflows");
94
95static void syncache_drop(struct syncache *, struct syncache_head *);
96static void syncache_free(struct syncache *);
97static void syncache_insert(struct syncache *, struct syncache_head *);
98struct syncache *syncache_lookup(struct in_conninfo *, struct syncache_head **);
99static int syncache_respond(struct syncache *, struct mbuf *);
100static struct socket *syncache_socket(struct syncache *, struct socket *,
101 struct mbuf *m);
102static void syncache_timer(void *);
103static u_int32_t syncookie_generate(struct syncache *);
104static struct syncache *syncookie_lookup(struct in_conninfo *,
105 struct tcphdr *, struct socket *);
106
107/*
108 * Transmit the SYN,ACK fewer times than TCP_MAXRXTSHIFT specifies.
109 * 3 retransmits corresponds to a timeout of (1 + 2 + 4 + 8 == 15) seconds,
110 * the odds are that the user has given up attempting to connect by then.
111 */
112#define SYNCACHE_MAXREXMTS 3
113
114/* Arbitrary values */
115#define TCP_SYNCACHE_HASHSIZE 512
116#define TCP_SYNCACHE_BUCKETLIMIT 30
117
118struct tcp_syncache {
119 struct syncache_head *hashbase;
120 uma_zone_t zone;
121 u_int hashsize;
122 u_int hashmask;
123 u_int bucket_limit;
124 u_int cache_count;
125 u_int cache_limit;
126 u_int rexmt_limit;
127 u_int hash_secret;
128 u_int next_reseed;
129 TAILQ_HEAD(, syncache) timerq[SYNCACHE_MAXREXMTS + 1];
130 struct callout tt_timerq[SYNCACHE_MAXREXMTS + 1];
131};
132static struct tcp_syncache tcp_syncache;
133
134SYSCTL_NODE(_net_inet_tcp, OID_AUTO, syncache, CTLFLAG_RW, 0, "TCP SYN cache");
135
136SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, bucketlimit, CTLFLAG_RD,
137 &tcp_syncache.bucket_limit, 0, "Per-bucket hash limit for syncache");
138
139SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, cachelimit, CTLFLAG_RD,
140 &tcp_syncache.cache_limit, 0, "Overall entry limit for syncache");
141
142SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, count, CTLFLAG_RD,
143 &tcp_syncache.cache_count, 0, "Current number of entries in syncache");
144
145SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, hashsize, CTLFLAG_RD,
146 &tcp_syncache.hashsize, 0, "Size of TCP syncache hashtable");
147
148SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, rexmtlimit, CTLFLAG_RW,
149 &tcp_syncache.rexmt_limit, 0, "Limit on SYN/ACK retransmissions");
150
151static MALLOC_DEFINE(M_SYNCACHE, "syncache", "TCP syncache");
152
153#define SYNCACHE_HASH(inc, mask) \
154 ((tcp_syncache.hash_secret ^ \
155 (inc)->inc_faddr.s_addr ^ \
156 ((inc)->inc_faddr.s_addr >> 16) ^ \
157 (inc)->inc_fport ^ (inc)->inc_lport) & mask)
158
159#define SYNCACHE_HASH6(inc, mask) \
160 ((tcp_syncache.hash_secret ^ \
161 (inc)->inc6_faddr.s6_addr32[0] ^ \
162 (inc)->inc6_faddr.s6_addr32[3] ^ \
163 (inc)->inc_fport ^ (inc)->inc_lport) & mask)
164
165#define ENDPTS_EQ(a, b) ( \
166 (a)->ie_fport == (b)->ie_fport && \
167 (a)->ie_lport == (b)->ie_lport && \
168 (a)->ie_faddr.s_addr == (b)->ie_faddr.s_addr && \
169 (a)->ie_laddr.s_addr == (b)->ie_laddr.s_addr \
170)
171
172#define ENDPTS6_EQ(a, b) (memcmp(a, b, sizeof(*a)) == 0)
173
174#define SYNCACHE_TIMEOUT(sc, slot) do { \
175 sc->sc_rxtslot = slot; \
176 sc->sc_rxttime = ticks + TCPTV_RTOBASE * tcp_backoff[slot]; \
177 TAILQ_INSERT_TAIL(&tcp_syncache.timerq[slot], sc, sc_timerq); \
178 if (!callout_active(&tcp_syncache.tt_timerq[slot])) \
179 callout_reset(&tcp_syncache.tt_timerq[slot], \
180 TCPTV_RTOBASE * tcp_backoff[slot], \
181 syncache_timer, (void *)((intptr_t)slot)); \
182} while (0)
183
184static void
185syncache_free(struct syncache *sc)
186{
187 struct rtentry *rt;
188
189 if (sc->sc_ipopts)
190 (void) m_free(sc->sc_ipopts);
191#ifdef INET6
192 if (sc->sc_inc.inc_isipv6)
193 rt = sc->sc_route6.ro_rt;
194 else
195#endif
196 rt = sc->sc_route.ro_rt;
197 if (rt != NULL) {
198 /*
199 * If this is the only reference to a protocol cloned
200 * route, remove it immediately.
201 */
202 if (rt->rt_flags & RTF_WASCLONED &&
203 (sc->sc_flags & SCF_KEEPROUTE) == 0 &&
204 rt->rt_refcnt == 1)
205 rtrequest(RTM_DELETE, rt_key(rt),
206 rt->rt_gateway, rt_mask(rt),
207 rt->rt_flags, NULL);
208 RTFREE(rt);
209 }
210 uma_zfree(tcp_syncache.zone, sc);
211}
212
213void
214syncache_init(void)
215{
216 int i;
217
218 tcp_syncache.cache_count = 0;
219 tcp_syncache.hashsize = TCP_SYNCACHE_HASHSIZE;
220 tcp_syncache.bucket_limit = TCP_SYNCACHE_BUCKETLIMIT;
221 tcp_syncache.cache_limit =
222 tcp_syncache.hashsize * tcp_syncache.bucket_limit;
223 tcp_syncache.rexmt_limit = SYNCACHE_MAXREXMTS;
224 tcp_syncache.next_reseed = 0;
225 tcp_syncache.hash_secret = arc4random();
226
227 TUNABLE_INT_FETCH("net.inet.tcp.syncache.hashsize",
228 &tcp_syncache.hashsize);
229 TUNABLE_INT_FETCH("net.inet.tcp.syncache.cachelimit",
230 &tcp_syncache.cache_limit);
231 TUNABLE_INT_FETCH("net.inet.tcp.syncache.bucketlimit",
232 &tcp_syncache.bucket_limit);
233 if (!powerof2(tcp_syncache.hashsize)) {
234 printf("WARNING: syncache hash size is not a power of 2.\n");
235 tcp_syncache.hashsize = 512; /* safe default */
236 }
237 tcp_syncache.hashmask = tcp_syncache.hashsize - 1;
238
239 /* Allocate the hash table. */
240 MALLOC(tcp_syncache.hashbase, struct syncache_head *,
241 tcp_syncache.hashsize * sizeof(struct syncache_head),
242 M_SYNCACHE, M_WAITOK);
243
244 /* Initialize the hash buckets. */
245 for (i = 0; i < tcp_syncache.hashsize; i++) {
246 TAILQ_INIT(&tcp_syncache.hashbase[i].sch_bucket);
247 tcp_syncache.hashbase[i].sch_length = 0;
248 }
249
250 /* Initialize the timer queues. */
251 for (i = 0; i <= SYNCACHE_MAXREXMTS; i++) {
252 TAILQ_INIT(&tcp_syncache.timerq[i]);
253 callout_init(&tcp_syncache.tt_timerq[i], 0);
254 }
255
256 /*
257 * Allocate the syncache entries. Allow the zone to allocate one
258 * more entry than cache limit, so a new entry can bump out an
259 * older one.
260 */
261 tcp_syncache.cache_limit -= 1;
262 tcp_syncache.zone = uma_zcreate("syncache", sizeof(struct syncache),
263 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
264 uma_zone_set_max(tcp_syncache.zone, tcp_syncache.cache_limit);
265}
266
267static void
268syncache_insert(sc, sch)
269 struct syncache *sc;
270 struct syncache_head *sch;
271{
272 struct syncache *sc2;
273 int s, i;
274
275 /*
276 * Make sure that we don't overflow the per-bucket
277 * limit or the total cache size limit.
278 */
279 s = splnet();
280 if (sch->sch_length >= tcp_syncache.bucket_limit) {
281 /*
282 * The bucket is full, toss the oldest element.
283 */
284 sc2 = TAILQ_FIRST(&sch->sch_bucket);
285 sc2->sc_tp->ts_recent = ticks;
286 syncache_drop(sc2, sch);
287 tcpstat.tcps_sc_bucketoverflow++;
288 } else if (tcp_syncache.cache_count >= tcp_syncache.cache_limit) {
289 /*
290 * The cache is full. Toss the oldest entry in the
291 * entire cache. This is the front entry in the
292 * first non-empty timer queue with the largest
293 * timeout value.
294 */
295 for (i = SYNCACHE_MAXREXMTS; i >= 0; i--) {
296 sc2 = TAILQ_FIRST(&tcp_syncache.timerq[i]);
297 if (sc2 != NULL)
298 break;
299 }
300 sc2->sc_tp->ts_recent = ticks;
301 syncache_drop(sc2, NULL);
302 tcpstat.tcps_sc_cacheoverflow++;
303 }
304
305 /* Initialize the entry's timer. */
306 SYNCACHE_TIMEOUT(sc, 0);
307
308 /* Put it into the bucket. */
309 TAILQ_INSERT_TAIL(&sch->sch_bucket, sc, sc_hash);
310 sch->sch_length++;
311 tcp_syncache.cache_count++;
312 tcpstat.tcps_sc_added++;
313 splx(s);
314}
315
316static void
317syncache_drop(sc, sch)
318 struct syncache *sc;
319 struct syncache_head *sch;
320{
321 int s;
322
323 if (sch == NULL) {
324#ifdef INET6
325 if (sc->sc_inc.inc_isipv6) {
326 sch = &tcp_syncache.hashbase[
327 SYNCACHE_HASH6(&sc->sc_inc, tcp_syncache.hashmask)];
328 } else
329#endif
330 {
331 sch = &tcp_syncache.hashbase[
332 SYNCACHE_HASH(&sc->sc_inc, tcp_syncache.hashmask)];
333 }
334 }
335
336 s = splnet();
337
338 TAILQ_REMOVE(&sch->sch_bucket, sc, sc_hash);
339 sch->sch_length--;
340 tcp_syncache.cache_count--;
341
342 TAILQ_REMOVE(&tcp_syncache.timerq[sc->sc_rxtslot], sc, sc_timerq);
343 if (TAILQ_EMPTY(&tcp_syncache.timerq[sc->sc_rxtslot]))
344 callout_stop(&tcp_syncache.tt_timerq[sc->sc_rxtslot]);
345 splx(s);
346
347 syncache_free(sc);
348}
349
350/*
351 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted.
352 * If we have retransmitted an entry the maximum number of times, expire it.
353 */
354static void
355syncache_timer(xslot)
356 void *xslot;
357{
358 intptr_t slot = (intptr_t)xslot;
359 struct syncache *sc, *nsc;
360 struct inpcb *inp;
361 int s;
362
363 s = splnet();
364 if (callout_pending(&tcp_syncache.tt_timerq[slot]) ||
365 !callout_active(&tcp_syncache.tt_timerq[slot])) {
366 splx(s);
367 return;
368 }
369 callout_deactivate(&tcp_syncache.tt_timerq[slot]);
370
371 nsc = TAILQ_FIRST(&tcp_syncache.timerq[slot]);
372 INP_INFO_RLOCK(&tcbinfo);
373 while (nsc != NULL) {
374 if (ticks < nsc->sc_rxttime)
375 break;
376 sc = nsc;
377 inp = sc->sc_tp->t_inpcb;
378 INP_LOCK(inp);
379 if (slot == SYNCACHE_MAXREXMTS ||
380 slot >= tcp_syncache.rexmt_limit ||
381 inp->inp_gencnt != sc->sc_inp_gencnt) {
382 nsc = TAILQ_NEXT(sc, sc_timerq);
383 syncache_drop(sc, NULL);
384 tcpstat.tcps_sc_stale++;
385 INP_UNLOCK(inp);
386 continue;
387 }
388 /*
389 * syncache_respond() may call back into the syncache to
390 * to modify another entry, so do not obtain the next
391 * entry on the timer chain until it has completed.
392 */
393 (void) syncache_respond(sc, NULL);
394 INP_UNLOCK(inp);
395 nsc = TAILQ_NEXT(sc, sc_timerq);
396 tcpstat.tcps_sc_retransmitted++;
397 TAILQ_REMOVE(&tcp_syncache.timerq[slot], sc, sc_timerq);
398 SYNCACHE_TIMEOUT(sc, slot + 1);
399 }
400 INP_INFO_RUNLOCK(&tcbinfo);
401 if (nsc != NULL)
402 callout_reset(&tcp_syncache.tt_timerq[slot],
403 nsc->sc_rxttime - ticks, syncache_timer, (void *)(slot));
404 splx(s);
405}
406
407/*
408 * Find an entry in the syncache.
409 */
410struct syncache *
411syncache_lookup(inc, schp)
412 struct in_conninfo *inc;
413 struct syncache_head **schp;
414{
415 struct syncache *sc;
416 struct syncache_head *sch;
417 int s;
418
419#ifdef INET6
420 if (inc->inc_isipv6) {
421 sch = &tcp_syncache.hashbase[
422 SYNCACHE_HASH6(inc, tcp_syncache.hashmask)];
423 *schp = sch;
424 s = splnet();
425 TAILQ_FOREACH(sc, &sch->sch_bucket, sc_hash) {
426 if (ENDPTS6_EQ(&inc->inc_ie, &sc->sc_inc.inc_ie)) {
427 splx(s);
428 return (sc);
429 }
430 }
431 splx(s);
432 } else
433#endif
434 {
435 sch = &tcp_syncache.hashbase[
436 SYNCACHE_HASH(inc, tcp_syncache.hashmask)];
437 *schp = sch;
438 s = splnet();
439 TAILQ_FOREACH(sc, &sch->sch_bucket, sc_hash) {
440#ifdef INET6
441 if (sc->sc_inc.inc_isipv6)
442 continue;
443#endif
444 if (ENDPTS_EQ(&inc->inc_ie, &sc->sc_inc.inc_ie)) {
445 splx(s);
446 return (sc);
447 }
448 }
449 splx(s);
450 }
451 return (NULL);
452}
453
454/*
455 * This function is called when we get a RST for a
456 * non-existent connection, so that we can see if the
457 * connection is in the syn cache. If it is, zap it.
458 */
459void
460syncache_chkrst(inc, th)
461 struct in_conninfo *inc;
462 struct tcphdr *th;
463{
464 struct syncache *sc;
465 struct syncache_head *sch;
466
467 sc = syncache_lookup(inc, &sch);
468 if (sc == NULL)
469 return;
470 /*
471 * If the RST bit is set, check the sequence number to see
472 * if this is a valid reset segment.
473 * RFC 793 page 37:
474 * In all states except SYN-SENT, all reset (RST) segments
475 * are validated by checking their SEQ-fields. A reset is
476 * valid if its sequence number is in the window.
477 *
478 * The sequence number in the reset segment is normally an
479 * echo of our outgoing acknowlegement numbers, but some hosts
480 * send a reset with the sequence number at the rightmost edge
481 * of our receive window, and we have to handle this case.
482 */
483 if (SEQ_GEQ(th->th_seq, sc->sc_irs) &&
484 SEQ_LEQ(th->th_seq, sc->sc_irs + sc->sc_wnd)) {
485 syncache_drop(sc, sch);
486 tcpstat.tcps_sc_reset++;
487 }
488}
489
490void
491syncache_badack(inc)
492 struct in_conninfo *inc;
493{
494 struct syncache *sc;
495 struct syncache_head *sch;
496
497 sc = syncache_lookup(inc, &sch);
498 if (sc != NULL) {
499 syncache_drop(sc, sch);
500 tcpstat.tcps_sc_badack++;
501 }
502}
503
504void
505syncache_unreach(inc, th)
506 struct in_conninfo *inc;
507 struct tcphdr *th;
508{
509 struct syncache *sc;
510 struct syncache_head *sch;
511
512 /* we are called at splnet() here */
513 sc = syncache_lookup(inc, &sch);
514 if (sc == NULL)
515 return;
516
517 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */
518 if (ntohl(th->th_seq) != sc->sc_iss)
519 return;
520
521 /*
522 * If we've rertransmitted 3 times and this is our second error,
523 * we remove the entry. Otherwise, we allow it to continue on.
524 * This prevents us from incorrectly nuking an entry during a
525 * spurious network outage.
526 *
527 * See tcp_notify().
528 */
529 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtslot < 3) {
530 sc->sc_flags |= SCF_UNREACH;
531 return;
532 }
533 syncache_drop(sc, sch);
534 tcpstat.tcps_sc_unreach++;
535}
536
537/*
538 * Build a new TCP socket structure from a syncache entry.
539 */
540static struct socket *
541syncache_socket(sc, lso, m)
542 struct syncache *sc;
543 struct socket *lso;
544 struct mbuf *m;
545{
546 struct inpcb *inp = NULL;
547 struct socket *so;
548 struct tcpcb *tp;
549
550 /*
551 * Ok, create the full blown connection, and set things up
552 * as they would have been set up if we had created the
553 * connection when the SYN arrived. If we can't create
554 * the connection, abort it.
555 */
556 so = sonewconn(lso, SS_ISCONNECTED);
557 if (so == NULL) {
558 /*
559 * Drop the connection; we will send a RST if the peer
560 * retransmits the ACK,
561 */
562 tcpstat.tcps_listendrop++;
563 goto abort;
564 }
565#ifdef MAC
566 mac_set_socket_peer_from_mbuf(m, so);
567#endif
568
569 inp = sotoinpcb(so);
570
571 /*
572 * Insert new socket into hash list.
573 */
574 inp->inp_inc.inc_isipv6 = sc->sc_inc.inc_isipv6;
575#ifdef INET6
576 if (sc->sc_inc.inc_isipv6) {
577 inp->in6p_laddr = sc->sc_inc.inc6_laddr;
578 } else {
579 inp->inp_vflag &= ~INP_IPV6;
580 inp->inp_vflag |= INP_IPV4;
581#endif
582 inp->inp_laddr = sc->sc_inc.inc_laddr;
583#ifdef INET6
584 }
585#endif
586 inp->inp_lport = sc->sc_inc.inc_lport;
587 if (in_pcbinshash(inp) != 0) {
588 /*
589 * Undo the assignments above if we failed to
590 * put the PCB on the hash lists.
591 */
592#ifdef INET6
593 if (sc->sc_inc.inc_isipv6)
594 inp->in6p_laddr = in6addr_any;
595 else
596#endif
597 inp->inp_laddr.s_addr = INADDR_ANY;
598 inp->inp_lport = 0;
599 goto abort;
600 }
601#ifdef IPSEC
602 /* copy old policy into new socket's */
603 if (ipsec_copy_policy(sotoinpcb(lso)->inp_sp, inp->inp_sp))
604 printf("syncache_expand: could not copy policy\n");
605#endif
606#ifdef INET6
607 if (sc->sc_inc.inc_isipv6) {
608 struct inpcb *oinp = sotoinpcb(lso);
609 struct in6_addr laddr6;
610 struct sockaddr_in6 *sin6;
611 /*
612 * Inherit socket options from the listening socket.
613 * Note that in6p_inputopts are not (and should not be)
614 * copied, since it stores previously received options and is
615 * used to detect if each new option is different than the
616 * previous one and hence should be passed to a user.
617 * If we copied in6p_inputopts, a user would not be able to
618 * receive options just after calling the accept system call.
619 */
620 inp->inp_flags |= oinp->inp_flags & INP_CONTROLOPTS;
621 if (oinp->in6p_outputopts)
622 inp->in6p_outputopts =
623 ip6_copypktopts(oinp->in6p_outputopts, M_NOWAIT);
624 inp->in6p_route = sc->sc_route6;
625 sc->sc_route6.ro_rt = NULL;
626
627 MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6,
628 M_SONAME, M_NOWAIT | M_ZERO);
629 if (sin6 == NULL)
630 goto abort;
631 sin6->sin6_family = AF_INET6;
632 sin6->sin6_len = sizeof(*sin6);
633 sin6->sin6_addr = sc->sc_inc.inc6_faddr;
634 sin6->sin6_port = sc->sc_inc.inc_fport;
635 laddr6 = inp->in6p_laddr;
636 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
637 inp->in6p_laddr = sc->sc_inc.inc6_laddr;
638 if (in6_pcbconnect(inp, (struct sockaddr *)sin6, &thread0)) {
639 inp->in6p_laddr = laddr6;
640 FREE(sin6, M_SONAME);
641 goto abort;
642 }
643 FREE(sin6, M_SONAME);
644 } else
645#endif
646 {
647 struct in_addr laddr;
648 struct sockaddr_in *sin;
649
650 inp->inp_options = ip_srcroute();
651 if (inp->inp_options == NULL) {
652 inp->inp_options = sc->sc_ipopts;
653 sc->sc_ipopts = NULL;
654 }
655 inp->inp_route = sc->sc_route;
656 sc->sc_route.ro_rt = NULL;
657
658 MALLOC(sin, struct sockaddr_in *, sizeof *sin,
659 M_SONAME, M_NOWAIT | M_ZERO);
660 if (sin == NULL)
661 goto abort;
662 sin->sin_family = AF_INET;
663 sin->sin_len = sizeof(*sin);
664 sin->sin_addr = sc->sc_inc.inc_faddr;
665 sin->sin_port = sc->sc_inc.inc_fport;
666 bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));
667 laddr = inp->inp_laddr;
668 if (inp->inp_laddr.s_addr == INADDR_ANY)
669 inp->inp_laddr = sc->sc_inc.inc_laddr;
670 if (in_pcbconnect(inp, (struct sockaddr *)sin, &thread0)) {
671 inp->inp_laddr = laddr;
672 FREE(sin, M_SONAME);
673 goto abort;
674 }
675 FREE(sin, M_SONAME);
676 }
677
678 tp = intotcpcb(inp);
679 tp->t_state = TCPS_SYN_RECEIVED;
680 tp->iss = sc->sc_iss;
681 tp->irs = sc->sc_irs;
682 tcp_rcvseqinit(tp);
683 tcp_sendseqinit(tp);
684 tp->snd_wl1 = sc->sc_irs;
685 tp->rcv_up = sc->sc_irs + 1;
686 tp->rcv_wnd = sc->sc_wnd;
687 tp->rcv_adv += tp->rcv_wnd;
688
689 tp->t_flags = sototcpcb(lso)->t_flags & (TF_NOPUSH|TF_NODELAY);
690 if (sc->sc_flags & SCF_NOOPT)
691 tp->t_flags |= TF_NOOPT;
692 if (sc->sc_flags & SCF_WINSCALE) {
693 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE;
694 tp->requested_s_scale = sc->sc_requested_s_scale;
695 tp->request_r_scale = sc->sc_request_r_scale;
696 }
697 if (sc->sc_flags & SCF_TIMESTAMP) {
698 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP;
699 tp->ts_recent = sc->sc_tsrecent;
700 tp->ts_recent_age = ticks;
701 }
702 if (sc->sc_flags & SCF_CC) {
703 /*
704 * Initialization of the tcpcb for transaction;
705 * set SND.WND = SEG.WND,
706 * initialize CCsend and CCrecv.
707 */
708 tp->t_flags |= TF_REQ_CC|TF_RCVD_CC;
709 tp->cc_send = sc->sc_cc_send;
710 tp->cc_recv = sc->sc_cc_recv;
711 }
712
713 tcp_mss(tp, sc->sc_peer_mss);
714
715 /*
716 * If the SYN,ACK was retransmitted, reset cwnd to 1 segment.
717 */
718 if (sc->sc_rxtslot != 0)
719 tp->snd_cwnd = tp->t_maxseg;
720 callout_reset(tp->tt_keep, tcp_keepinit, tcp_timer_keep, tp);
721
722 tcpstat.tcps_accepts++;
723 return (so);
724
725abort:
726 if (so != NULL)
727 (void) soabort(so);
728 return (NULL);
729}
730
731/*
732 * This function gets called when we receive an ACK for a
733 * socket in the LISTEN state. We look up the connection
734 * in the syncache, and if its there, we pull it out of
735 * the cache and turn it into a full-blown connection in
736 * the SYN-RECEIVED state.
737 */
738int
739syncache_expand(inc, th, sop, m)
740 struct in_conninfo *inc;
741 struct tcphdr *th;
742 struct socket **sop;
743 struct mbuf *m;
744{
745 struct syncache *sc;
746 struct syncache_head *sch;
747 struct socket *so;
748
749 sc = syncache_lookup(inc, &sch);
750 if (sc == NULL) {
751 /*
752 * There is no syncache entry, so see if this ACK is
753 * a returning syncookie. To do this, first:
754 * A. See if this socket has had a syncache entry dropped in
755 * the past. We don't want to accept a bogus syncookie
756 * if we've never received a SYN.
757 * B. check that the syncookie is valid. If it is, then
758 * cobble up a fake syncache entry, and return.
759 */
760 if (!tcp_syncookies)
761 return (0);
762 sc = syncookie_lookup(inc, th, *sop);
763 if (sc == NULL)
764 return (0);
765 sch = NULL;
766 tcpstat.tcps_sc_recvcookie++;
767 }
768
769 /*
770 * If seg contains an ACK, but not for our SYN/ACK, send a RST.
771 */
772 if (th->th_ack != sc->sc_iss + 1)
773 return (0);
774
775 so = syncache_socket(sc, *sop, m);
776 if (so == NULL) {
777#if 0
778resetandabort:
779 /* XXXjlemon check this - is this correct? */
780 (void) tcp_respond(NULL, m, m, th,
781 th->th_seq + tlen, (tcp_seq)0, TH_RST|TH_ACK);
782#endif
783 m_freem(m); /* XXX only needed for above */
784 tcpstat.tcps_sc_aborted++;
785 } else {
786 sc->sc_flags |= SCF_KEEPROUTE;
787 tcpstat.tcps_sc_completed++;
788 }
789 if (sch == NULL)
790 syncache_free(sc);
791 else
792 syncache_drop(sc, sch);
793 *sop = so;
794 return (1);
795}
796
797/*
798 * Given a LISTEN socket and an inbound SYN request, add
799 * this to the syn cache, and send back a segment:
800 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
801 * to the source.
802 *
803 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN.
804 * Doing so would require that we hold onto the data and deliver it
805 * to the application. However, if we are the target of a SYN-flood
806 * DoS attack, an attacker could send data which would eventually
807 * consume all available buffer space if it were ACKed. By not ACKing
808 * the data, we avoid this DoS scenario.
809 */
810int
811syncache_add(inc, to, th, sop, m)
812 struct in_conninfo *inc;
813 struct tcpopt *to;
814 struct tcphdr *th;
815 struct socket **sop;
816 struct mbuf *m;
817{
818 struct tcpcb *tp;
819 struct socket *so;
820 struct syncache *sc = NULL;
821 struct syncache_head *sch;
822 struct mbuf *ipopts = NULL;
823 struct rmxp_tao *taop;
824 int i, s, win;
825
826 so = *sop;
827 tp = sototcpcb(so);
828
829 /*
830 * Remember the IP options, if any.
831 */
832#ifdef INET6
833 if (!inc->inc_isipv6)
834#endif
835 ipopts = ip_srcroute();
836
837 /*
838 * See if we already have an entry for this connection.
839 * If we do, resend the SYN,ACK, and reset the retransmit timer.
840 *
841 * XXX
842 * should the syncache be re-initialized with the contents
843 * of the new SYN here (which may have different options?)
844 */
845 sc = syncache_lookup(inc, &sch);
846 if (sc != NULL) {
847 tcpstat.tcps_sc_dupsyn++;
848 if (ipopts) {
849 /*
850 * If we were remembering a previous source route,
851 * forget it and use the new one we've been given.
852 */
853 if (sc->sc_ipopts)
854 (void) m_free(sc->sc_ipopts);
855 sc->sc_ipopts = ipopts;
856 }
857 /*
858 * Update timestamp if present.
859 */
860 if (sc->sc_flags & SCF_TIMESTAMP)
861 sc->sc_tsrecent = to->to_tsval;
862 /*
863 * PCB may have changed, pick up new values.
864 */
865 sc->sc_tp = tp;
866 sc->sc_inp_gencnt = tp->t_inpcb->inp_gencnt;
867 if (syncache_respond(sc, m) == 0) {
868 s = splnet();
869 TAILQ_REMOVE(&tcp_syncache.timerq[sc->sc_rxtslot],
870 sc, sc_timerq);
871 SYNCACHE_TIMEOUT(sc, sc->sc_rxtslot);
872 splx(s);
873 tcpstat.tcps_sndacks++;
874 tcpstat.tcps_sndtotal++;
875 }
876 *sop = NULL;
877 return (1);
878 }
879
880 sc = uma_zalloc(tcp_syncache.zone, M_NOWAIT);
881 if (sc == NULL) {
882 /*
883 * The zone allocator couldn't provide more entries.
884 * Treat this as if the cache was full; drop the oldest
885 * entry and insert the new one.
886 */
887 s = splnet();
888 for (i = SYNCACHE_MAXREXMTS; i >= 0; i--) {
889 sc = TAILQ_FIRST(&tcp_syncache.timerq[i]);
890 if (sc != NULL)
891 break;
892 }
893 sc->sc_tp->ts_recent = ticks;
894 syncache_drop(sc, NULL);
895 splx(s);
896 tcpstat.tcps_sc_zonefail++;
897 sc = uma_zalloc(tcp_syncache.zone, M_NOWAIT);
898 if (sc == NULL) {
899 if (ipopts)
900 (void) m_free(ipopts);
901 return (0);
902 }
903 }
904
905 /*
906 * Fill in the syncache values.
907 */
908 bzero(sc, sizeof(*sc));
909 sc->sc_tp = tp;
910 sc->sc_inp_gencnt = tp->t_inpcb->inp_gencnt;
911 sc->sc_ipopts = ipopts;
912 sc->sc_inc.inc_fport = inc->inc_fport;
913 sc->sc_inc.inc_lport = inc->inc_lport;
914#ifdef INET6
915 sc->sc_inc.inc_isipv6 = inc->inc_isipv6;
916 if (inc->inc_isipv6) {
917 sc->sc_inc.inc6_faddr = inc->inc6_faddr;
918 sc->sc_inc.inc6_laddr = inc->inc6_laddr;
919 sc->sc_route6.ro_rt = NULL;
920 } else
921#endif
922 {
923 sc->sc_inc.inc_faddr = inc->inc_faddr;
924 sc->sc_inc.inc_laddr = inc->inc_laddr;
925 sc->sc_route.ro_rt = NULL;
926 }
927 sc->sc_irs = th->th_seq;
928 if (tcp_syncookies)
929 sc->sc_iss = syncookie_generate(sc);
930 else
931 sc->sc_iss = arc4random();
932
933 /* Initial receive window: clip sbspace to [0 .. TCP_MAXWIN] */
934 win = sbspace(&so->so_rcv);
935 win = imax(win, 0);
936 win = imin(win, TCP_MAXWIN);
937 sc->sc_wnd = win;
938
939 sc->sc_flags = 0;
940 sc->sc_peer_mss = to->to_flags & TOF_MSS ? to->to_mss : 0;
941 if (tcp_do_rfc1323) {
942 /*
943 * A timestamp received in a SYN makes
944 * it ok to send timestamp requests and replies.
945 */
946 if (to->to_flags & TOF_TS) {
947 sc->sc_tsrecent = to->to_tsval;
948 sc->sc_flags |= SCF_TIMESTAMP;
949 }
950 if (to->to_flags & TOF_SCALE) {
951 int wscale = 0;
952
953 /* Compute proper scaling value from buffer space */
954 while (wscale < TCP_MAX_WINSHIFT &&
955 (TCP_MAXWIN << wscale) < so->so_rcv.sb_hiwat)
956 wscale++;
957 sc->sc_request_r_scale = wscale;
958 sc->sc_requested_s_scale = to->to_requested_s_scale;
959 sc->sc_flags |= SCF_WINSCALE;
960 }
961 }
962 if (tcp_do_rfc1644) {
963 /*
964 * A CC or CC.new option received in a SYN makes
965 * it ok to send CC in subsequent segments.
966 */
967 if (to->to_flags & (TOF_CC|TOF_CCNEW)) {
968 sc->sc_cc_recv = to->to_cc;
969 sc->sc_cc_send = CC_INC(tcp_ccgen);
970 sc->sc_flags |= SCF_CC;
971 }
972 }
973 if (tp->t_flags & TF_NOOPT)
974 sc->sc_flags = SCF_NOOPT;
975
976 /*
977 * XXX
978 * We have the option here of not doing TAO (even if the segment
979 * qualifies) and instead fall back to a normal 3WHS via the syncache.
980 * This allows us to apply synflood protection to TAO-qualifying SYNs
981 * also. However, there should be a hueristic to determine when to
982 * do this, and is not present at the moment.
983 */
984
985 /*
986 * Perform TAO test on incoming CC (SEG.CC) option, if any.
987 * - compare SEG.CC against cached CC from the same host, if any.
988 * - if SEG.CC > chached value, SYN must be new and is accepted
989 * immediately: save new CC in the cache, mark the socket
990 * connected, enter ESTABLISHED state, turn on flag to
991 * send a SYN in the next segment.
992 * A virtual advertised window is set in rcv_adv to
993 * initialize SWS prevention. Then enter normal segment
994 * processing: drop SYN, process data and FIN.
995 * - otherwise do a normal 3-way handshake.
996 */
997 taop = tcp_gettaocache(&sc->sc_inc);
998 if ((to->to_flags & TOF_CC) != 0) {
999 if (((tp->t_flags & TF_NOPUSH) != 0) &&
1000 sc->sc_flags & SCF_CC &&
1001 taop != NULL && taop->tao_cc != 0 &&
1002 CC_GT(to->to_cc, taop->tao_cc)) {
1003 sc->sc_rxtslot = 0;
1004 so = syncache_socket(sc, *sop, m);
1005 if (so != NULL) {
1006 sc->sc_flags |= SCF_KEEPROUTE;
1007 taop->tao_cc = to->to_cc;
1008 *sop = so;
1009 }
1010 syncache_free(sc);
1011 return (so != NULL);
1012 }
1013 } else {
1014 /*
1015 * No CC option, but maybe CC.NEW: invalidate cached value.
1016 */
1017 if (taop != NULL)
1018 taop->tao_cc = 0;
1019 }
1020 /*
1021 * TAO test failed or there was no CC option,
1022 * do a standard 3-way handshake.
1023 */
1024 if (syncache_respond(sc, m) == 0) {
1025 syncache_insert(sc, sch);
1026 tcpstat.tcps_sndacks++;
1027 tcpstat.tcps_sndtotal++;
1028 } else {
1029 syncache_free(sc);
1030 tcpstat.tcps_sc_dropped++;
1031 }
1032 *sop = NULL;
1033 return (1);
1034}
1035
1036static int
1037syncache_respond(sc, m)
1038 struct syncache *sc;
1039 struct mbuf *m;
1040{
1041 u_int8_t *optp;
1042 int optlen, error;
1043 u_int16_t tlen, hlen, mssopt;
1044 struct ip *ip = NULL;
1045 struct rtentry *rt;
1046 struct tcphdr *th;
1047#ifdef INET6
1048 struct ip6_hdr *ip6 = NULL;
1049#endif
1050
1051#ifdef INET6
1052 if (sc->sc_inc.inc_isipv6) {
1053 rt = tcp_rtlookup6(&sc->sc_inc);
1054 if (rt != NULL)
1055 mssopt = rt->rt_ifp->if_mtu -
1056 (sizeof(struct ip6_hdr) + sizeof(struct tcphdr));
1057 else
1058 mssopt = tcp_v6mssdflt;
1059 hlen = sizeof(struct ip6_hdr);
1060 } else
1061#endif
1062 {
1063 rt = tcp_rtlookup(&sc->sc_inc);
1064 if (rt != NULL)
1065 mssopt = rt->rt_ifp->if_mtu -
1066 (sizeof(struct ip) + sizeof(struct tcphdr));
1067 else
1068 mssopt = tcp_mssdflt;
1069 hlen = sizeof(struct ip);
1070 }
1071
1072 /* Compute the size of the TCP options. */
1073 if (sc->sc_flags & SCF_NOOPT) {
1074 optlen = 0;
1075 } else {
1076 optlen = TCPOLEN_MAXSEG +
1077 ((sc->sc_flags & SCF_WINSCALE) ? 4 : 0) +
1078 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0) +
1079 ((sc->sc_flags & SCF_CC) ? TCPOLEN_CC_APPA * 2 : 0);
1080 }
1081 tlen = hlen + sizeof(struct tcphdr) + optlen;
1082
1083 /*
1084 * XXX
1085 * assume that the entire packet will fit in a header mbuf
1086 */
1087 KASSERT(max_linkhdr + tlen <= MHLEN, ("syncache: mbuf too small"));
1088
1089 /*
1090 * XXX shouldn't this reuse the mbuf if possible ?
1091 * Create the IP+TCP header from scratch.
1092 */
1093 if (m)
1094 m_freem(m);
1095
1096 m = m_gethdr(M_DONTWAIT, MT_HEADER);
1097 if (m == NULL)
1098 return (ENOBUFS);
1099 m->m_data += max_linkhdr;
1100 m->m_len = tlen;
1101 m->m_pkthdr.len = tlen;
1102 m->m_pkthdr.rcvif = NULL;
1103#ifdef MAC
1104 mac_create_mbuf_from_socket(sc->sc_tp->t_inpcb->inp_socket, m);
1105#endif
1106
| 35 */
36
37#include "opt_inet6.h"
38#include "opt_ipsec.h"
39#include "opt_mac.h"
40
41#include <sys/param.h>
42#include <sys/systm.h>
43#include <sys/kernel.h>
44#include <sys/sysctl.h>
45#include <sys/malloc.h>
46#include <sys/mac.h>
47#include <sys/mbuf.h>
48#include <sys/md5.h>
49#include <sys/proc.h> /* for proc0 declaration */
50#include <sys/random.h>
51#include <sys/socket.h>
52#include <sys/socketvar.h>
53
54#include <net/if.h>
55#include <net/route.h>
56
57#include <netinet/in.h>
58#include <netinet/in_systm.h>
59#include <netinet/ip.h>
60#include <netinet/in_var.h>
61#include <netinet/in_pcb.h>
62#include <netinet/ip_var.h>
63#ifdef INET6
64#include <netinet/ip6.h>
65#include <netinet/icmp6.h>
66#include <netinet6/nd6.h>
67#include <netinet6/ip6_var.h>
68#include <netinet6/in6_pcb.h>
69#endif
70#include <netinet/tcp.h>
71#include <netinet/tcp_fsm.h>
72#include <netinet/tcp_seq.h>
73#include <netinet/tcp_timer.h>
74#include <netinet/tcp_var.h>
75#ifdef INET6
76#include <netinet6/tcp6_var.h>
77#endif
78
79#ifdef IPSEC
80#include <netinet6/ipsec.h>
81#ifdef INET6
82#include <netinet6/ipsec6.h>
83#endif
84#include <netkey/key.h>
85#endif /*IPSEC*/
86
87#include <machine/in_cksum.h>
88#include <vm/uma.h>
89
90static int tcp_syncookies = 1;
91SYSCTL_INT(_net_inet_tcp, OID_AUTO, syncookies, CTLFLAG_RW,
92 &tcp_syncookies, 0,
93 "Use TCP SYN cookies if the syncache overflows");
94
95static void syncache_drop(struct syncache *, struct syncache_head *);
96static void syncache_free(struct syncache *);
97static void syncache_insert(struct syncache *, struct syncache_head *);
98struct syncache *syncache_lookup(struct in_conninfo *, struct syncache_head **);
99static int syncache_respond(struct syncache *, struct mbuf *);
100static struct socket *syncache_socket(struct syncache *, struct socket *,
101 struct mbuf *m);
102static void syncache_timer(void *);
103static u_int32_t syncookie_generate(struct syncache *);
104static struct syncache *syncookie_lookup(struct in_conninfo *,
105 struct tcphdr *, struct socket *);
106
107/*
108 * Transmit the SYN,ACK fewer times than TCP_MAXRXTSHIFT specifies.
109 * 3 retransmits corresponds to a timeout of (1 + 2 + 4 + 8 == 15) seconds,
110 * the odds are that the user has given up attempting to connect by then.
111 */
112#define SYNCACHE_MAXREXMTS 3
113
114/* Arbitrary values */
115#define TCP_SYNCACHE_HASHSIZE 512
116#define TCP_SYNCACHE_BUCKETLIMIT 30
117
118struct tcp_syncache {
119 struct syncache_head *hashbase;
120 uma_zone_t zone;
121 u_int hashsize;
122 u_int hashmask;
123 u_int bucket_limit;
124 u_int cache_count;
125 u_int cache_limit;
126 u_int rexmt_limit;
127 u_int hash_secret;
128 u_int next_reseed;
129 TAILQ_HEAD(, syncache) timerq[SYNCACHE_MAXREXMTS + 1];
130 struct callout tt_timerq[SYNCACHE_MAXREXMTS + 1];
131};
132static struct tcp_syncache tcp_syncache;
133
134SYSCTL_NODE(_net_inet_tcp, OID_AUTO, syncache, CTLFLAG_RW, 0, "TCP SYN cache");
135
136SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, bucketlimit, CTLFLAG_RD,
137 &tcp_syncache.bucket_limit, 0, "Per-bucket hash limit for syncache");
138
139SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, cachelimit, CTLFLAG_RD,
140 &tcp_syncache.cache_limit, 0, "Overall entry limit for syncache");
141
142SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, count, CTLFLAG_RD,
143 &tcp_syncache.cache_count, 0, "Current number of entries in syncache");
144
145SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, hashsize, CTLFLAG_RD,
146 &tcp_syncache.hashsize, 0, "Size of TCP syncache hashtable");
147
148SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, rexmtlimit, CTLFLAG_RW,
149 &tcp_syncache.rexmt_limit, 0, "Limit on SYN/ACK retransmissions");
150
151static MALLOC_DEFINE(M_SYNCACHE, "syncache", "TCP syncache");
152
153#define SYNCACHE_HASH(inc, mask) \
154 ((tcp_syncache.hash_secret ^ \
155 (inc)->inc_faddr.s_addr ^ \
156 ((inc)->inc_faddr.s_addr >> 16) ^ \
157 (inc)->inc_fport ^ (inc)->inc_lport) & mask)
158
159#define SYNCACHE_HASH6(inc, mask) \
160 ((tcp_syncache.hash_secret ^ \
161 (inc)->inc6_faddr.s6_addr32[0] ^ \
162 (inc)->inc6_faddr.s6_addr32[3] ^ \
163 (inc)->inc_fport ^ (inc)->inc_lport) & mask)
164
165#define ENDPTS_EQ(a, b) ( \
166 (a)->ie_fport == (b)->ie_fport && \
167 (a)->ie_lport == (b)->ie_lport && \
168 (a)->ie_faddr.s_addr == (b)->ie_faddr.s_addr && \
169 (a)->ie_laddr.s_addr == (b)->ie_laddr.s_addr \
170)
171
172#define ENDPTS6_EQ(a, b) (memcmp(a, b, sizeof(*a)) == 0)
173
174#define SYNCACHE_TIMEOUT(sc, slot) do { \
175 sc->sc_rxtslot = slot; \
176 sc->sc_rxttime = ticks + TCPTV_RTOBASE * tcp_backoff[slot]; \
177 TAILQ_INSERT_TAIL(&tcp_syncache.timerq[slot], sc, sc_timerq); \
178 if (!callout_active(&tcp_syncache.tt_timerq[slot])) \
179 callout_reset(&tcp_syncache.tt_timerq[slot], \
180 TCPTV_RTOBASE * tcp_backoff[slot], \
181 syncache_timer, (void *)((intptr_t)slot)); \
182} while (0)
183
184static void
185syncache_free(struct syncache *sc)
186{
187 struct rtentry *rt;
188
189 if (sc->sc_ipopts)
190 (void) m_free(sc->sc_ipopts);
191#ifdef INET6
192 if (sc->sc_inc.inc_isipv6)
193 rt = sc->sc_route6.ro_rt;
194 else
195#endif
196 rt = sc->sc_route.ro_rt;
197 if (rt != NULL) {
198 /*
199 * If this is the only reference to a protocol cloned
200 * route, remove it immediately.
201 */
202 if (rt->rt_flags & RTF_WASCLONED &&
203 (sc->sc_flags & SCF_KEEPROUTE) == 0 &&
204 rt->rt_refcnt == 1)
205 rtrequest(RTM_DELETE, rt_key(rt),
206 rt->rt_gateway, rt_mask(rt),
207 rt->rt_flags, NULL);
208 RTFREE(rt);
209 }
210 uma_zfree(tcp_syncache.zone, sc);
211}
212
213void
214syncache_init(void)
215{
216 int i;
217
218 tcp_syncache.cache_count = 0;
219 tcp_syncache.hashsize = TCP_SYNCACHE_HASHSIZE;
220 tcp_syncache.bucket_limit = TCP_SYNCACHE_BUCKETLIMIT;
221 tcp_syncache.cache_limit =
222 tcp_syncache.hashsize * tcp_syncache.bucket_limit;
223 tcp_syncache.rexmt_limit = SYNCACHE_MAXREXMTS;
224 tcp_syncache.next_reseed = 0;
225 tcp_syncache.hash_secret = arc4random();
226
227 TUNABLE_INT_FETCH("net.inet.tcp.syncache.hashsize",
228 &tcp_syncache.hashsize);
229 TUNABLE_INT_FETCH("net.inet.tcp.syncache.cachelimit",
230 &tcp_syncache.cache_limit);
231 TUNABLE_INT_FETCH("net.inet.tcp.syncache.bucketlimit",
232 &tcp_syncache.bucket_limit);
233 if (!powerof2(tcp_syncache.hashsize)) {
234 printf("WARNING: syncache hash size is not a power of 2.\n");
235 tcp_syncache.hashsize = 512; /* safe default */
236 }
237 tcp_syncache.hashmask = tcp_syncache.hashsize - 1;
238
239 /* Allocate the hash table. */
240 MALLOC(tcp_syncache.hashbase, struct syncache_head *,
241 tcp_syncache.hashsize * sizeof(struct syncache_head),
242 M_SYNCACHE, M_WAITOK);
243
244 /* Initialize the hash buckets. */
245 for (i = 0; i < tcp_syncache.hashsize; i++) {
246 TAILQ_INIT(&tcp_syncache.hashbase[i].sch_bucket);
247 tcp_syncache.hashbase[i].sch_length = 0;
248 }
249
250 /* Initialize the timer queues. */
251 for (i = 0; i <= SYNCACHE_MAXREXMTS; i++) {
252 TAILQ_INIT(&tcp_syncache.timerq[i]);
253 callout_init(&tcp_syncache.tt_timerq[i], 0);
254 }
255
256 /*
257 * Allocate the syncache entries. Allow the zone to allocate one
258 * more entry than cache limit, so a new entry can bump out an
259 * older one.
260 */
261 tcp_syncache.cache_limit -= 1;
262 tcp_syncache.zone = uma_zcreate("syncache", sizeof(struct syncache),
263 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
264 uma_zone_set_max(tcp_syncache.zone, tcp_syncache.cache_limit);
265}
266
267static void
268syncache_insert(sc, sch)
269 struct syncache *sc;
270 struct syncache_head *sch;
271{
272 struct syncache *sc2;
273 int s, i;
274
275 /*
276 * Make sure that we don't overflow the per-bucket
277 * limit or the total cache size limit.
278 */
279 s = splnet();
280 if (sch->sch_length >= tcp_syncache.bucket_limit) {
281 /*
282 * The bucket is full, toss the oldest element.
283 */
284 sc2 = TAILQ_FIRST(&sch->sch_bucket);
285 sc2->sc_tp->ts_recent = ticks;
286 syncache_drop(sc2, sch);
287 tcpstat.tcps_sc_bucketoverflow++;
288 } else if (tcp_syncache.cache_count >= tcp_syncache.cache_limit) {
289 /*
290 * The cache is full. Toss the oldest entry in the
291 * entire cache. This is the front entry in the
292 * first non-empty timer queue with the largest
293 * timeout value.
294 */
295 for (i = SYNCACHE_MAXREXMTS; i >= 0; i--) {
296 sc2 = TAILQ_FIRST(&tcp_syncache.timerq[i]);
297 if (sc2 != NULL)
298 break;
299 }
300 sc2->sc_tp->ts_recent = ticks;
301 syncache_drop(sc2, NULL);
302 tcpstat.tcps_sc_cacheoverflow++;
303 }
304
305 /* Initialize the entry's timer. */
306 SYNCACHE_TIMEOUT(sc, 0);
307
308 /* Put it into the bucket. */
309 TAILQ_INSERT_TAIL(&sch->sch_bucket, sc, sc_hash);
310 sch->sch_length++;
311 tcp_syncache.cache_count++;
312 tcpstat.tcps_sc_added++;
313 splx(s);
314}
315
316static void
317syncache_drop(sc, sch)
318 struct syncache *sc;
319 struct syncache_head *sch;
320{
321 int s;
322
323 if (sch == NULL) {
324#ifdef INET6
325 if (sc->sc_inc.inc_isipv6) {
326 sch = &tcp_syncache.hashbase[
327 SYNCACHE_HASH6(&sc->sc_inc, tcp_syncache.hashmask)];
328 } else
329#endif
330 {
331 sch = &tcp_syncache.hashbase[
332 SYNCACHE_HASH(&sc->sc_inc, tcp_syncache.hashmask)];
333 }
334 }
335
336 s = splnet();
337
338 TAILQ_REMOVE(&sch->sch_bucket, sc, sc_hash);
339 sch->sch_length--;
340 tcp_syncache.cache_count--;
341
342 TAILQ_REMOVE(&tcp_syncache.timerq[sc->sc_rxtslot], sc, sc_timerq);
343 if (TAILQ_EMPTY(&tcp_syncache.timerq[sc->sc_rxtslot]))
344 callout_stop(&tcp_syncache.tt_timerq[sc->sc_rxtslot]);
345 splx(s);
346
347 syncache_free(sc);
348}
349
350/*
351 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted.
352 * If we have retransmitted an entry the maximum number of times, expire it.
353 */
354static void
355syncache_timer(xslot)
356 void *xslot;
357{
358 intptr_t slot = (intptr_t)xslot;
359 struct syncache *sc, *nsc;
360 struct inpcb *inp;
361 int s;
362
363 s = splnet();
364 if (callout_pending(&tcp_syncache.tt_timerq[slot]) ||
365 !callout_active(&tcp_syncache.tt_timerq[slot])) {
366 splx(s);
367 return;
368 }
369 callout_deactivate(&tcp_syncache.tt_timerq[slot]);
370
371 nsc = TAILQ_FIRST(&tcp_syncache.timerq[slot]);
372 INP_INFO_RLOCK(&tcbinfo);
373 while (nsc != NULL) {
374 if (ticks < nsc->sc_rxttime)
375 break;
376 sc = nsc;
377 inp = sc->sc_tp->t_inpcb;
378 INP_LOCK(inp);
379 if (slot == SYNCACHE_MAXREXMTS ||
380 slot >= tcp_syncache.rexmt_limit ||
381 inp->inp_gencnt != sc->sc_inp_gencnt) {
382 nsc = TAILQ_NEXT(sc, sc_timerq);
383 syncache_drop(sc, NULL);
384 tcpstat.tcps_sc_stale++;
385 INP_UNLOCK(inp);
386 continue;
387 }
388 /*
389 * syncache_respond() may call back into the syncache to
390 * to modify another entry, so do not obtain the next
391 * entry on the timer chain until it has completed.
392 */
393 (void) syncache_respond(sc, NULL);
394 INP_UNLOCK(inp);
395 nsc = TAILQ_NEXT(sc, sc_timerq);
396 tcpstat.tcps_sc_retransmitted++;
397 TAILQ_REMOVE(&tcp_syncache.timerq[slot], sc, sc_timerq);
398 SYNCACHE_TIMEOUT(sc, slot + 1);
399 }
400 INP_INFO_RUNLOCK(&tcbinfo);
401 if (nsc != NULL)
402 callout_reset(&tcp_syncache.tt_timerq[slot],
403 nsc->sc_rxttime - ticks, syncache_timer, (void *)(slot));
404 splx(s);
405}
406
407/*
408 * Find an entry in the syncache.
409 */
410struct syncache *
411syncache_lookup(inc, schp)
412 struct in_conninfo *inc;
413 struct syncache_head **schp;
414{
415 struct syncache *sc;
416 struct syncache_head *sch;
417 int s;
418
419#ifdef INET6
420 if (inc->inc_isipv6) {
421 sch = &tcp_syncache.hashbase[
422 SYNCACHE_HASH6(inc, tcp_syncache.hashmask)];
423 *schp = sch;
424 s = splnet();
425 TAILQ_FOREACH(sc, &sch->sch_bucket, sc_hash) {
426 if (ENDPTS6_EQ(&inc->inc_ie, &sc->sc_inc.inc_ie)) {
427 splx(s);
428 return (sc);
429 }
430 }
431 splx(s);
432 } else
433#endif
434 {
435 sch = &tcp_syncache.hashbase[
436 SYNCACHE_HASH(inc, tcp_syncache.hashmask)];
437 *schp = sch;
438 s = splnet();
439 TAILQ_FOREACH(sc, &sch->sch_bucket, sc_hash) {
440#ifdef INET6
441 if (sc->sc_inc.inc_isipv6)
442 continue;
443#endif
444 if (ENDPTS_EQ(&inc->inc_ie, &sc->sc_inc.inc_ie)) {
445 splx(s);
446 return (sc);
447 }
448 }
449 splx(s);
450 }
451 return (NULL);
452}
453
454/*
455 * This function is called when we get a RST for a
456 * non-existent connection, so that we can see if the
457 * connection is in the syn cache. If it is, zap it.
458 */
459void
460syncache_chkrst(inc, th)
461 struct in_conninfo *inc;
462 struct tcphdr *th;
463{
464 struct syncache *sc;
465 struct syncache_head *sch;
466
467 sc = syncache_lookup(inc, &sch);
468 if (sc == NULL)
469 return;
470 /*
471 * If the RST bit is set, check the sequence number to see
472 * if this is a valid reset segment.
473 * RFC 793 page 37:
474 * In all states except SYN-SENT, all reset (RST) segments
475 * are validated by checking their SEQ-fields. A reset is
476 * valid if its sequence number is in the window.
477 *
478 * The sequence number in the reset segment is normally an
479 * echo of our outgoing acknowlegement numbers, but some hosts
480 * send a reset with the sequence number at the rightmost edge
481 * of our receive window, and we have to handle this case.
482 */
483 if (SEQ_GEQ(th->th_seq, sc->sc_irs) &&
484 SEQ_LEQ(th->th_seq, sc->sc_irs + sc->sc_wnd)) {
485 syncache_drop(sc, sch);
486 tcpstat.tcps_sc_reset++;
487 }
488}
489
490void
491syncache_badack(inc)
492 struct in_conninfo *inc;
493{
494 struct syncache *sc;
495 struct syncache_head *sch;
496
497 sc = syncache_lookup(inc, &sch);
498 if (sc != NULL) {
499 syncache_drop(sc, sch);
500 tcpstat.tcps_sc_badack++;
501 }
502}
503
504void
505syncache_unreach(inc, th)
506 struct in_conninfo *inc;
507 struct tcphdr *th;
508{
509 struct syncache *sc;
510 struct syncache_head *sch;
511
512 /* we are called at splnet() here */
513 sc = syncache_lookup(inc, &sch);
514 if (sc == NULL)
515 return;
516
517 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */
518 if (ntohl(th->th_seq) != sc->sc_iss)
519 return;
520
521 /*
522 * If we've rertransmitted 3 times and this is our second error,
523 * we remove the entry. Otherwise, we allow it to continue on.
524 * This prevents us from incorrectly nuking an entry during a
525 * spurious network outage.
526 *
527 * See tcp_notify().
528 */
529 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtslot < 3) {
530 sc->sc_flags |= SCF_UNREACH;
531 return;
532 }
533 syncache_drop(sc, sch);
534 tcpstat.tcps_sc_unreach++;
535}
536
537/*
538 * Build a new TCP socket structure from a syncache entry.
539 */
540static struct socket *
541syncache_socket(sc, lso, m)
542 struct syncache *sc;
543 struct socket *lso;
544 struct mbuf *m;
545{
546 struct inpcb *inp = NULL;
547 struct socket *so;
548 struct tcpcb *tp;
549
550 /*
551 * Ok, create the full blown connection, and set things up
552 * as they would have been set up if we had created the
553 * connection when the SYN arrived. If we can't create
554 * the connection, abort it.
555 */
556 so = sonewconn(lso, SS_ISCONNECTED);
557 if (so == NULL) {
558 /*
559 * Drop the connection; we will send a RST if the peer
560 * retransmits the ACK,
561 */
562 tcpstat.tcps_listendrop++;
563 goto abort;
564 }
565#ifdef MAC
566 mac_set_socket_peer_from_mbuf(m, so);
567#endif
568
569 inp = sotoinpcb(so);
570
571 /*
572 * Insert new socket into hash list.
573 */
574 inp->inp_inc.inc_isipv6 = sc->sc_inc.inc_isipv6;
575#ifdef INET6
576 if (sc->sc_inc.inc_isipv6) {
577 inp->in6p_laddr = sc->sc_inc.inc6_laddr;
578 } else {
579 inp->inp_vflag &= ~INP_IPV6;
580 inp->inp_vflag |= INP_IPV4;
581#endif
582 inp->inp_laddr = sc->sc_inc.inc_laddr;
583#ifdef INET6
584 }
585#endif
586 inp->inp_lport = sc->sc_inc.inc_lport;
587 if (in_pcbinshash(inp) != 0) {
588 /*
589 * Undo the assignments above if we failed to
590 * put the PCB on the hash lists.
591 */
592#ifdef INET6
593 if (sc->sc_inc.inc_isipv6)
594 inp->in6p_laddr = in6addr_any;
595 else
596#endif
597 inp->inp_laddr.s_addr = INADDR_ANY;
598 inp->inp_lport = 0;
599 goto abort;
600 }
601#ifdef IPSEC
602 /* copy old policy into new socket's */
603 if (ipsec_copy_policy(sotoinpcb(lso)->inp_sp, inp->inp_sp))
604 printf("syncache_expand: could not copy policy\n");
605#endif
606#ifdef INET6
607 if (sc->sc_inc.inc_isipv6) {
608 struct inpcb *oinp = sotoinpcb(lso);
609 struct in6_addr laddr6;
610 struct sockaddr_in6 *sin6;
611 /*
612 * Inherit socket options from the listening socket.
613 * Note that in6p_inputopts are not (and should not be)
614 * copied, since it stores previously received options and is
615 * used to detect if each new option is different than the
616 * previous one and hence should be passed to a user.
617 * If we copied in6p_inputopts, a user would not be able to
618 * receive options just after calling the accept system call.
619 */
620 inp->inp_flags |= oinp->inp_flags & INP_CONTROLOPTS;
621 if (oinp->in6p_outputopts)
622 inp->in6p_outputopts =
623 ip6_copypktopts(oinp->in6p_outputopts, M_NOWAIT);
624 inp->in6p_route = sc->sc_route6;
625 sc->sc_route6.ro_rt = NULL;
626
627 MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6,
628 M_SONAME, M_NOWAIT | M_ZERO);
629 if (sin6 == NULL)
630 goto abort;
631 sin6->sin6_family = AF_INET6;
632 sin6->sin6_len = sizeof(*sin6);
633 sin6->sin6_addr = sc->sc_inc.inc6_faddr;
634 sin6->sin6_port = sc->sc_inc.inc_fport;
635 laddr6 = inp->in6p_laddr;
636 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
637 inp->in6p_laddr = sc->sc_inc.inc6_laddr;
638 if (in6_pcbconnect(inp, (struct sockaddr *)sin6, &thread0)) {
639 inp->in6p_laddr = laddr6;
640 FREE(sin6, M_SONAME);
641 goto abort;
642 }
643 FREE(sin6, M_SONAME);
644 } else
645#endif
646 {
647 struct in_addr laddr;
648 struct sockaddr_in *sin;
649
650 inp->inp_options = ip_srcroute();
651 if (inp->inp_options == NULL) {
652 inp->inp_options = sc->sc_ipopts;
653 sc->sc_ipopts = NULL;
654 }
655 inp->inp_route = sc->sc_route;
656 sc->sc_route.ro_rt = NULL;
657
658 MALLOC(sin, struct sockaddr_in *, sizeof *sin,
659 M_SONAME, M_NOWAIT | M_ZERO);
660 if (sin == NULL)
661 goto abort;
662 sin->sin_family = AF_INET;
663 sin->sin_len = sizeof(*sin);
664 sin->sin_addr = sc->sc_inc.inc_faddr;
665 sin->sin_port = sc->sc_inc.inc_fport;
666 bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));
667 laddr = inp->inp_laddr;
668 if (inp->inp_laddr.s_addr == INADDR_ANY)
669 inp->inp_laddr = sc->sc_inc.inc_laddr;
670 if (in_pcbconnect(inp, (struct sockaddr *)sin, &thread0)) {
671 inp->inp_laddr = laddr;
672 FREE(sin, M_SONAME);
673 goto abort;
674 }
675 FREE(sin, M_SONAME);
676 }
677
678 tp = intotcpcb(inp);
679 tp->t_state = TCPS_SYN_RECEIVED;
680 tp->iss = sc->sc_iss;
681 tp->irs = sc->sc_irs;
682 tcp_rcvseqinit(tp);
683 tcp_sendseqinit(tp);
684 tp->snd_wl1 = sc->sc_irs;
685 tp->rcv_up = sc->sc_irs + 1;
686 tp->rcv_wnd = sc->sc_wnd;
687 tp->rcv_adv += tp->rcv_wnd;
688
689 tp->t_flags = sototcpcb(lso)->t_flags & (TF_NOPUSH|TF_NODELAY);
690 if (sc->sc_flags & SCF_NOOPT)
691 tp->t_flags |= TF_NOOPT;
692 if (sc->sc_flags & SCF_WINSCALE) {
693 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE;
694 tp->requested_s_scale = sc->sc_requested_s_scale;
695 tp->request_r_scale = sc->sc_request_r_scale;
696 }
697 if (sc->sc_flags & SCF_TIMESTAMP) {
698 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP;
699 tp->ts_recent = sc->sc_tsrecent;
700 tp->ts_recent_age = ticks;
701 }
702 if (sc->sc_flags & SCF_CC) {
703 /*
704 * Initialization of the tcpcb for transaction;
705 * set SND.WND = SEG.WND,
706 * initialize CCsend and CCrecv.
707 */
708 tp->t_flags |= TF_REQ_CC|TF_RCVD_CC;
709 tp->cc_send = sc->sc_cc_send;
710 tp->cc_recv = sc->sc_cc_recv;
711 }
712
713 tcp_mss(tp, sc->sc_peer_mss);
714
715 /*
716 * If the SYN,ACK was retransmitted, reset cwnd to 1 segment.
717 */
718 if (sc->sc_rxtslot != 0)
719 tp->snd_cwnd = tp->t_maxseg;
720 callout_reset(tp->tt_keep, tcp_keepinit, tcp_timer_keep, tp);
721
722 tcpstat.tcps_accepts++;
723 return (so);
724
725abort:
726 if (so != NULL)
727 (void) soabort(so);
728 return (NULL);
729}
730
731/*
732 * This function gets called when we receive an ACK for a
733 * socket in the LISTEN state. We look up the connection
734 * in the syncache, and if its there, we pull it out of
735 * the cache and turn it into a full-blown connection in
736 * the SYN-RECEIVED state.
737 */
738int
739syncache_expand(inc, th, sop, m)
740 struct in_conninfo *inc;
741 struct tcphdr *th;
742 struct socket **sop;
743 struct mbuf *m;
744{
745 struct syncache *sc;
746 struct syncache_head *sch;
747 struct socket *so;
748
749 sc = syncache_lookup(inc, &sch);
750 if (sc == NULL) {
751 /*
752 * There is no syncache entry, so see if this ACK is
753 * a returning syncookie. To do this, first:
754 * A. See if this socket has had a syncache entry dropped in
755 * the past. We don't want to accept a bogus syncookie
756 * if we've never received a SYN.
757 * B. check that the syncookie is valid. If it is, then
758 * cobble up a fake syncache entry, and return.
759 */
760 if (!tcp_syncookies)
761 return (0);
762 sc = syncookie_lookup(inc, th, *sop);
763 if (sc == NULL)
764 return (0);
765 sch = NULL;
766 tcpstat.tcps_sc_recvcookie++;
767 }
768
769 /*
770 * If seg contains an ACK, but not for our SYN/ACK, send a RST.
771 */
772 if (th->th_ack != sc->sc_iss + 1)
773 return (0);
774
775 so = syncache_socket(sc, *sop, m);
776 if (so == NULL) {
777#if 0
778resetandabort:
779 /* XXXjlemon check this - is this correct? */
780 (void) tcp_respond(NULL, m, m, th,
781 th->th_seq + tlen, (tcp_seq)0, TH_RST|TH_ACK);
782#endif
783 m_freem(m); /* XXX only needed for above */
784 tcpstat.tcps_sc_aborted++;
785 } else {
786 sc->sc_flags |= SCF_KEEPROUTE;
787 tcpstat.tcps_sc_completed++;
788 }
789 if (sch == NULL)
790 syncache_free(sc);
791 else
792 syncache_drop(sc, sch);
793 *sop = so;
794 return (1);
795}
796
797/*
798 * Given a LISTEN socket and an inbound SYN request, add
799 * this to the syn cache, and send back a segment:
800 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
801 * to the source.
802 *
803 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN.
804 * Doing so would require that we hold onto the data and deliver it
805 * to the application. However, if we are the target of a SYN-flood
806 * DoS attack, an attacker could send data which would eventually
807 * consume all available buffer space if it were ACKed. By not ACKing
808 * the data, we avoid this DoS scenario.
809 */
810int
811syncache_add(inc, to, th, sop, m)
812 struct in_conninfo *inc;
813 struct tcpopt *to;
814 struct tcphdr *th;
815 struct socket **sop;
816 struct mbuf *m;
817{
818 struct tcpcb *tp;
819 struct socket *so;
820 struct syncache *sc = NULL;
821 struct syncache_head *sch;
822 struct mbuf *ipopts = NULL;
823 struct rmxp_tao *taop;
824 int i, s, win;
825
826 so = *sop;
827 tp = sototcpcb(so);
828
829 /*
830 * Remember the IP options, if any.
831 */
832#ifdef INET6
833 if (!inc->inc_isipv6)
834#endif
835 ipopts = ip_srcroute();
836
837 /*
838 * See if we already have an entry for this connection.
839 * If we do, resend the SYN,ACK, and reset the retransmit timer.
840 *
841 * XXX
842 * should the syncache be re-initialized with the contents
843 * of the new SYN here (which may have different options?)
844 */
845 sc = syncache_lookup(inc, &sch);
846 if (sc != NULL) {
847 tcpstat.tcps_sc_dupsyn++;
848 if (ipopts) {
849 /*
850 * If we were remembering a previous source route,
851 * forget it and use the new one we've been given.
852 */
853 if (sc->sc_ipopts)
854 (void) m_free(sc->sc_ipopts);
855 sc->sc_ipopts = ipopts;
856 }
857 /*
858 * Update timestamp if present.
859 */
860 if (sc->sc_flags & SCF_TIMESTAMP)
861 sc->sc_tsrecent = to->to_tsval;
862 /*
863 * PCB may have changed, pick up new values.
864 */
865 sc->sc_tp = tp;
866 sc->sc_inp_gencnt = tp->t_inpcb->inp_gencnt;
867 if (syncache_respond(sc, m) == 0) {
868 s = splnet();
869 TAILQ_REMOVE(&tcp_syncache.timerq[sc->sc_rxtslot],
870 sc, sc_timerq);
871 SYNCACHE_TIMEOUT(sc, sc->sc_rxtslot);
872 splx(s);
873 tcpstat.tcps_sndacks++;
874 tcpstat.tcps_sndtotal++;
875 }
876 *sop = NULL;
877 return (1);
878 }
879
880 sc = uma_zalloc(tcp_syncache.zone, M_NOWAIT);
881 if (sc == NULL) {
882 /*
883 * The zone allocator couldn't provide more entries.
884 * Treat this as if the cache was full; drop the oldest
885 * entry and insert the new one.
886 */
887 s = splnet();
888 for (i = SYNCACHE_MAXREXMTS; i >= 0; i--) {
889 sc = TAILQ_FIRST(&tcp_syncache.timerq[i]);
890 if (sc != NULL)
891 break;
892 }
893 sc->sc_tp->ts_recent = ticks;
894 syncache_drop(sc, NULL);
895 splx(s);
896 tcpstat.tcps_sc_zonefail++;
897 sc = uma_zalloc(tcp_syncache.zone, M_NOWAIT);
898 if (sc == NULL) {
899 if (ipopts)
900 (void) m_free(ipopts);
901 return (0);
902 }
903 }
904
905 /*
906 * Fill in the syncache values.
907 */
908 bzero(sc, sizeof(*sc));
909 sc->sc_tp = tp;
910 sc->sc_inp_gencnt = tp->t_inpcb->inp_gencnt;
911 sc->sc_ipopts = ipopts;
912 sc->sc_inc.inc_fport = inc->inc_fport;
913 sc->sc_inc.inc_lport = inc->inc_lport;
914#ifdef INET6
915 sc->sc_inc.inc_isipv6 = inc->inc_isipv6;
916 if (inc->inc_isipv6) {
917 sc->sc_inc.inc6_faddr = inc->inc6_faddr;
918 sc->sc_inc.inc6_laddr = inc->inc6_laddr;
919 sc->sc_route6.ro_rt = NULL;
920 } else
921#endif
922 {
923 sc->sc_inc.inc_faddr = inc->inc_faddr;
924 sc->sc_inc.inc_laddr = inc->inc_laddr;
925 sc->sc_route.ro_rt = NULL;
926 }
927 sc->sc_irs = th->th_seq;
928 if (tcp_syncookies)
929 sc->sc_iss = syncookie_generate(sc);
930 else
931 sc->sc_iss = arc4random();
932
933 /* Initial receive window: clip sbspace to [0 .. TCP_MAXWIN] */
934 win = sbspace(&so->so_rcv);
935 win = imax(win, 0);
936 win = imin(win, TCP_MAXWIN);
937 sc->sc_wnd = win;
938
939 sc->sc_flags = 0;
940 sc->sc_peer_mss = to->to_flags & TOF_MSS ? to->to_mss : 0;
941 if (tcp_do_rfc1323) {
942 /*
943 * A timestamp received in a SYN makes
944 * it ok to send timestamp requests and replies.
945 */
946 if (to->to_flags & TOF_TS) {
947 sc->sc_tsrecent = to->to_tsval;
948 sc->sc_flags |= SCF_TIMESTAMP;
949 }
950 if (to->to_flags & TOF_SCALE) {
951 int wscale = 0;
952
953 /* Compute proper scaling value from buffer space */
954 while (wscale < TCP_MAX_WINSHIFT &&
955 (TCP_MAXWIN << wscale) < so->so_rcv.sb_hiwat)
956 wscale++;
957 sc->sc_request_r_scale = wscale;
958 sc->sc_requested_s_scale = to->to_requested_s_scale;
959 sc->sc_flags |= SCF_WINSCALE;
960 }
961 }
962 if (tcp_do_rfc1644) {
963 /*
964 * A CC or CC.new option received in a SYN makes
965 * it ok to send CC in subsequent segments.
966 */
967 if (to->to_flags & (TOF_CC|TOF_CCNEW)) {
968 sc->sc_cc_recv = to->to_cc;
969 sc->sc_cc_send = CC_INC(tcp_ccgen);
970 sc->sc_flags |= SCF_CC;
971 }
972 }
973 if (tp->t_flags & TF_NOOPT)
974 sc->sc_flags = SCF_NOOPT;
975
976 /*
977 * XXX
978 * We have the option here of not doing TAO (even if the segment
979 * qualifies) and instead fall back to a normal 3WHS via the syncache.
980 * This allows us to apply synflood protection to TAO-qualifying SYNs
981 * also. However, there should be a hueristic to determine when to
982 * do this, and is not present at the moment.
983 */
984
985 /*
986 * Perform TAO test on incoming CC (SEG.CC) option, if any.
987 * - compare SEG.CC against cached CC from the same host, if any.
988 * - if SEG.CC > chached value, SYN must be new and is accepted
989 * immediately: save new CC in the cache, mark the socket
990 * connected, enter ESTABLISHED state, turn on flag to
991 * send a SYN in the next segment.
992 * A virtual advertised window is set in rcv_adv to
993 * initialize SWS prevention. Then enter normal segment
994 * processing: drop SYN, process data and FIN.
995 * - otherwise do a normal 3-way handshake.
996 */
997 taop = tcp_gettaocache(&sc->sc_inc);
998 if ((to->to_flags & TOF_CC) != 0) {
999 if (((tp->t_flags & TF_NOPUSH) != 0) &&
1000 sc->sc_flags & SCF_CC &&
1001 taop != NULL && taop->tao_cc != 0 &&
1002 CC_GT(to->to_cc, taop->tao_cc)) {
1003 sc->sc_rxtslot = 0;
1004 so = syncache_socket(sc, *sop, m);
1005 if (so != NULL) {
1006 sc->sc_flags |= SCF_KEEPROUTE;
1007 taop->tao_cc = to->to_cc;
1008 *sop = so;
1009 }
1010 syncache_free(sc);
1011 return (so != NULL);
1012 }
1013 } else {
1014 /*
1015 * No CC option, but maybe CC.NEW: invalidate cached value.
1016 */
1017 if (taop != NULL)
1018 taop->tao_cc = 0;
1019 }
1020 /*
1021 * TAO test failed or there was no CC option,
1022 * do a standard 3-way handshake.
1023 */
1024 if (syncache_respond(sc, m) == 0) {
1025 syncache_insert(sc, sch);
1026 tcpstat.tcps_sndacks++;
1027 tcpstat.tcps_sndtotal++;
1028 } else {
1029 syncache_free(sc);
1030 tcpstat.tcps_sc_dropped++;
1031 }
1032 *sop = NULL;
1033 return (1);
1034}
1035
1036static int
1037syncache_respond(sc, m)
1038 struct syncache *sc;
1039 struct mbuf *m;
1040{
1041 u_int8_t *optp;
1042 int optlen, error;
1043 u_int16_t tlen, hlen, mssopt;
1044 struct ip *ip = NULL;
1045 struct rtentry *rt;
1046 struct tcphdr *th;
1047#ifdef INET6
1048 struct ip6_hdr *ip6 = NULL;
1049#endif
1050
1051#ifdef INET6
1052 if (sc->sc_inc.inc_isipv6) {
1053 rt = tcp_rtlookup6(&sc->sc_inc);
1054 if (rt != NULL)
1055 mssopt = rt->rt_ifp->if_mtu -
1056 (sizeof(struct ip6_hdr) + sizeof(struct tcphdr));
1057 else
1058 mssopt = tcp_v6mssdflt;
1059 hlen = sizeof(struct ip6_hdr);
1060 } else
1061#endif
1062 {
1063 rt = tcp_rtlookup(&sc->sc_inc);
1064 if (rt != NULL)
1065 mssopt = rt->rt_ifp->if_mtu -
1066 (sizeof(struct ip) + sizeof(struct tcphdr));
1067 else
1068 mssopt = tcp_mssdflt;
1069 hlen = sizeof(struct ip);
1070 }
1071
1072 /* Compute the size of the TCP options. */
1073 if (sc->sc_flags & SCF_NOOPT) {
1074 optlen = 0;
1075 } else {
1076 optlen = TCPOLEN_MAXSEG +
1077 ((sc->sc_flags & SCF_WINSCALE) ? 4 : 0) +
1078 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0) +
1079 ((sc->sc_flags & SCF_CC) ? TCPOLEN_CC_APPA * 2 : 0);
1080 }
1081 tlen = hlen + sizeof(struct tcphdr) + optlen;
1082
1083 /*
1084 * XXX
1085 * assume that the entire packet will fit in a header mbuf
1086 */
1087 KASSERT(max_linkhdr + tlen <= MHLEN, ("syncache: mbuf too small"));
1088
1089 /*
1090 * XXX shouldn't this reuse the mbuf if possible ?
1091 * Create the IP+TCP header from scratch.
1092 */
1093 if (m)
1094 m_freem(m);
1095
1096 m = m_gethdr(M_DONTWAIT, MT_HEADER);
1097 if (m == NULL)
1098 return (ENOBUFS);
1099 m->m_data += max_linkhdr;
1100 m->m_len = tlen;
1101 m->m_pkthdr.len = tlen;
1102 m->m_pkthdr.rcvif = NULL;
1103#ifdef MAC
1104 mac_create_mbuf_from_socket(sc->sc_tp->t_inpcb->inp_socket, m);
1105#endif
1106
|