mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 02:30:34 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

syncookies: add support for ECN

Browse source 
Allows use of ECN when syncookies are in effect by encoding ecn_ok
into the syn-ack tcp timestamp.

While at it, remove a uneeded #ifdef CONFIG_SYN_COOKIES.
With CONFIG_SYN_COOKIES=nm want_cookie is ifdef'd to 0 and gcc
removes the "if (0)".

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Florian Westphal 2010-06-21 11:48:45 +00:00 committed by David S. Miller
parent 734f614bc1
commit 172d69e63c
5 changed files with 17 additions and 13 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

2
include/net/tcp.h
View file

@ -464,7 +464,7 @@ extern __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb,
__u16 *mss); __u16 *mss);
extern __u32 cookie_init_timestamp(struct request_sock *req); extern __u32 cookie_init_timestamp(struct request_sock *req);
extern bool cookie_check_timestamp(struct tcp_options_received *tcp_opt); extern bool cookie_check_timestamp(struct tcp_options_received *opt, bool *);
/* From net/ipv6/syncookies.c */ /* From net/ipv6/syncookies.c */
extern struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb); extern struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb);

15
net/ipv4/syncookies.c
View file

@ -19,7 +19,7 @@
#include <net/route.h> #include <net/route.h>
/* Timestamps: lowest bits store TCP options */ /* Timestamps: lowest bits store TCP options */
#define TSBITS 5 #define TSBITS 6
#define TSMASK (((__u32)1 << TSBITS) - 1) #define TSMASK (((__u32)1 << TSBITS) - 1)
extern int sysctl_tcp_syncookies; extern int sysctl_tcp_syncookies;
@ -73,6 +73,7 @@ __u32 cookie_init_timestamp(struct request_sock *req)
options = ireq->wscale_ok ? ireq->snd_wscale : 0xf; options = ireq->wscale_ok ? ireq->snd_wscale : 0xf;
options |= ireq->sack_ok << 4; options |= ireq->sack_ok << 4;
options |= ireq->ecn_ok << 5;
ts = ts_now & ~TSMASK; ts = ts_now & ~TSMASK;
ts |= options; ts |= options;
@ -226,11 +227,11 @@ static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
* This extracts these options from the timestamp echo. * This extracts these options from the timestamp echo.
* *
* The lowest 4 bits store snd_wscale. * The lowest 4 bits store snd_wscale.
* The next lsb is for sack_ok * next 2 bits indicate SACK and ECN support.
* *
* return false if we decode an option that should not be. * return false if we decode an option that should not be.
*/ */
bool cookie_check_timestamp(struct tcp_options_received *tcp_opt) bool cookie_check_timestamp(struct tcp_options_received *tcp_opt, bool *ecn_ok)
{ {
/* echoed timestamp, lowest bits contain options */ /* echoed timestamp, lowest bits contain options */
u32 options = tcp_opt->rcv_tsecr & TSMASK; u32 options = tcp_opt->rcv_tsecr & TSMASK;
@ -244,6 +245,9 @@ bool cookie_check_timestamp(struct tcp_options_received *tcp_opt)
return false; return false;
tcp_opt->sack_ok = (options >> 4) & 0x1; tcp_opt->sack_ok = (options >> 4) & 0x1;
*ecn_ok = (options >> 5) & 1;
if (*ecn_ok && !sysctl_tcp_ecn)
return false;
if (tcp_opt->sack_ok && !sysctl_tcp_sack) if (tcp_opt->sack_ok && !sysctl_tcp_sack)
return false; return false;
@ -272,6 +276,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
int mss; int mss;
struct rtable *rt; struct rtable *rt;
__u8 rcv_wscale; __u8 rcv_wscale;
bool ecn_ok;
if (!sysctl_tcp_syncookies || !th->ack || th->rst) if (!sysctl_tcp_syncookies || !th->ack || th->rst)
goto out; goto out;
@ -288,7 +293,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
memset(&tcp_opt, 0, sizeof(tcp_opt)); memset(&tcp_opt, 0, sizeof(tcp_opt));
tcp_parse_options(skb, &tcp_opt, &hash_location, 0); tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
if (!cookie_check_timestamp(&tcp_opt)) if (!cookie_check_timestamp(&tcp_opt, &ecn_ok))
goto out; goto out;
ret = NULL; ret = NULL;
@ -305,7 +310,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
ireq->rmt_port = th->source; ireq->rmt_port = th->source;
ireq->loc_addr = ip_hdr(skb)->daddr; ireq->loc_addr = ip_hdr(skb)->daddr;
ireq->rmt_addr = ip_hdr(skb)->saddr; ireq->rmt_addr = ip_hdr(skb)->saddr;
ireq->ecn_ok = 0; ireq->ecn_ok = ecn_ok;
ireq->snd_wscale = tcp_opt.snd_wscale; ireq->snd_wscale = tcp_opt.snd_wscale;
ireq->sack_ok = tcp_opt.sack_ok; ireq->sack_ok = tcp_opt.sack_ok;
ireq->wscale_ok = tcp_opt.wscale_ok; ireq->wscale_ok = tcp_opt.wscale_ok;

6
net/ipv4/tcp_ipv4.c
View file

@ -1328,14 +1328,12 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
if (security_inet_conn_request(sk, skb, req)) if (security_inet_conn_request(sk, skb, req))
goto drop_and_free; goto drop_and_free;
if (!want_cookie) if (!want_cookie || tmp_opt.tstamp_ok)
TCP_ECN_create_request(req, tcp_hdr(skb)); TCP_ECN_create_request(req, tcp_hdr(skb));
if (want_cookie) { if (want_cookie) {
#ifdef CONFIG_SYN_COOKIES
req->cookie_ts = tmp_opt.tstamp_ok;
#endif
isn = cookie_v4_init_sequence(sk, skb, &req->mss); isn = cookie_v4_init_sequence(sk, skb, &req->mss);
req->cookie_ts = tmp_opt.tstamp_ok;
} else if (!isn) { } else if (!isn) {
struct inet_peer *peer = NULL; struct inet_peer *peer = NULL;

5
net/ipv6/syncookies.c
View file

@ -164,6 +164,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
int mss; int mss;
struct dst_entry *dst; struct dst_entry *dst;
__u8 rcv_wscale; __u8 rcv_wscale;
bool ecn_ok;
if (!sysctl_tcp_syncookies || !th->ack || th->rst) if (!sysctl_tcp_syncookies || !th->ack || th->rst)
goto out; goto out;
@ -180,7 +181,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
memset(&tcp_opt, 0, sizeof(tcp_opt)); memset(&tcp_opt, 0, sizeof(tcp_opt));
tcp_parse_options(skb, &tcp_opt, &hash_location, 0); tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
if (!cookie_check_timestamp(&tcp_opt)) if (!cookie_check_timestamp(&tcp_opt, &ecn_ok))
goto out; goto out;
ret = NULL; ret = NULL;
@ -215,7 +216,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
req->expires = 0UL; req->expires = 0UL;
req->retrans = 0; req->retrans = 0;
ireq->ecn_ok = 0; ireq->ecn_ok = ecn_ok;
ireq->snd_wscale = tcp_opt.snd_wscale; ireq->snd_wscale = tcp_opt.snd_wscale;
ireq->sack_ok = tcp_opt.sack_ok; ireq->sack_ok = tcp_opt.sack_ok;
ireq->wscale_ok = tcp_opt.wscale_ok; ireq->wscale_ok = tcp_opt.wscale_ok;

2
net/ipv6/tcp_ipv6.c
View file

@ -1269,7 +1269,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
treq = inet6_rsk(req); treq = inet6_rsk(req);
ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr); ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr); ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
if (!want_cookie) if (!want_cookie || tmp_opt.tstamp_ok)
TCP_ECN_create_request(req, tcp_hdr(skb)); TCP_ECN_create_request(req, tcp_hdr(skb));
if (!isn) { if (!isn) {