Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0198230b authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso
Browse files

net: syncookies: export cookie_v4_init_sequence/cookie_v4_check 



Extract the local TCP stack independant parts of tcp_v4_init_sequence()
and cookie_v4_check() and export them for use by the upcoming SYNPROXY
target.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
Tested-by: default avatarMartin Topholm <mph@one.com>
Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 41d73ec0

include/net/tcp.h

+4 −0
Original line number Original line Diff line number Diff line
@@ -476,9 +476,13 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb); 




/* From syncookies.c */

/* From syncookies.c */

extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];

extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];

extern int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,

			     u32 cookie);

extern struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, 

extern struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, 

				    struct ip_options *opt);

				    struct ip_options *opt);

#ifdef CONFIG_SYN_COOKIES

#ifdef CONFIG_SYN_COOKIES

extern u32 __cookie_v4_init_sequence(const struct iphdr *iph,

				     const struct tcphdr *th, u16 *mssp);

extern __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, 

extern __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, 

				     __u16 *mss);

				     __u16 *mss);

#else

#else

net/ipv4/syncookies.c

+18 −11
Original line number Original line Diff line number Diff line
@@ -160,26 +160,33 @@ static __u16 const msstab[] = { 
 * Generate a syncookie.  mssp points to the mss, which is returned

 * Generate a syncookie.  mssp points to the mss, which is returned

 * rounded down to the value encoded in the cookie.

 * rounded down to the value encoded in the cookie.

 */

 */

__u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)

u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,

			      u16 *mssp)

{

{

	const struct iphdr *iph = ip_hdr(skb);

	const struct tcphdr *th = tcp_hdr(skb);

	int mssind;

	int mssind;

	const __u16 mss = *mssp;

	const __u16 mss = *mssp;





	tcp_synq_overflow(sk);



	for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)

	for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)

		if (mss >= msstab[mssind])

		if (mss >= msstab[mssind])

			break;

			break;

	*mssp = msstab[mssind];

	*mssp = msstab[mssind];





	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);



	return secure_tcp_syn_cookie(iph->saddr, iph->daddr,

	return secure_tcp_syn_cookie(iph->saddr, iph->daddr,

				     th->source, th->dest, ntohl(th->seq),

				     th->source, th->dest, ntohl(th->seq),

				     jiffies / (HZ * 60), mssind);

				     jiffies / (HZ * 60), mssind);

}

}

EXPORT_SYMBOL_GPL(__cookie_v4_init_sequence);



__u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)

{

	const struct iphdr *iph = ip_hdr(skb);

	const struct tcphdr *th = tcp_hdr(skb);



	tcp_synq_overflow(sk);

	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);



	return __cookie_v4_init_sequence(iph, th, mssp);

}





/*

/*

 * This (misnamed) value is the age of syncookie which is permitted.

 * This (misnamed) value is the age of syncookie which is permitted.
@@ -192,10 +199,9 @@ __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp) 
 * Check if a ack sequence number is a valid syncookie.

 * Check if a ack sequence number is a valid syncookie.

 * Return the decoded mss if it is, or 0 if not.

 * Return the decoded mss if it is, or 0 if not.

 */

 */

static inline int cookie_check(struct sk_buff *skb, __u32 cookie)

int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,

		      u32 cookie)

{

{

	const struct iphdr *iph = ip_hdr(skb);

	const struct tcphdr *th = tcp_hdr(skb);

	__u32 seq = ntohl(th->seq) - 1;

	__u32 seq = ntohl(th->seq) - 1;

	__u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,

	__u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,

					    th->source, th->dest, seq,

					    th->source, th->dest, seq,
@@ -204,6 +210,7 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie) 




	return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;

	return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;

}

}

EXPORT_SYMBOL_GPL(__cookie_v4_check);





static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,

static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,

					   struct request_sock *req,

					   struct request_sock *req,
@@ -284,7 +291,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, 
		goto out;

		goto out;





	if (tcp_synq_no_recent_overflow(sk) ||

	if (tcp_synq_no_recent_overflow(sk) ||

	    (mss = cookie_check(skb, cookie)) == 0) {

	    (mss = __cookie_v4_check(ip_hdr(skb), th, cookie)) == 0) {

		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);

		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);

		goto out;

		goto out;

	}

	}