Line data    Source code

       1             : // SPDX-License-Identifier: GPL-2.0-or-later
       2             : /*
       3             :  * NET          Generic infrastructure for Network protocols.
       4             :  *
       5             :  * Authors:     Arnaldo Carvalho de Melo <acme@conectiva.com.br>
       6             :  *
       7             :  *              From code originally in include/net/tcp.h
       8             :  */
       9             : 
      10             : #include <linux/module.h>
      11             : #include <linux/random.h>
      12             : #include <linux/slab.h>
      13             : #include <linux/string.h>
      14             : #include <linux/tcp.h>
      15             : #include <linux/vmalloc.h>
      16             : 
      17             : #include <net/request_sock.h>
      18             : 
      19             : /*
      20             :  * Maximum number of SYN_RECV sockets in queue per LISTEN socket.
      21             :  * One SYN_RECV socket costs about 80bytes on a 32bit machine.
      22             :  * It would be better to replace it with a global counter for all sockets
      23             :  * but then some measure against one socket starving all other sockets
      24             :  * would be needed.
      25             :  *
      26             :  * The minimum value of it is 128. Experiments with real servers show that
      27             :  * it is absolutely not enough even at 100conn/sec. 256 cures most
      28             :  * of problems.
      29             :  * This value is adjusted to 128 for low memory machines,
      30             :  * and it will increase in proportion to the memory of machine.
      31             :  * Note : Dont forget somaxconn that may limit backlog too.
      32             :  */
      33             : 
      34           3 : void reqsk_queue_alloc(struct request_sock_queue *queue)
      35             : {
      36           3 :         spin_lock_init(&queue->rskq_lock);
      37             : 
      38           3 :         spin_lock_init(&queue->fastopenq.lock);
      39           3 :         queue->fastopenq.rskq_rst_head = NULL;
      40           3 :         queue->fastopenq.rskq_rst_tail = NULL;
      41           3 :         queue->fastopenq.qlen = 0;
      42             : 
      43           3 :         queue->rskq_accept_head = NULL;
      44           3 : }
      45             : 
      46             : /*
      47             :  * This function is called to set a Fast Open socket's "fastopen_rsk" field
      48             :  * to NULL when a TFO socket no longer needs to access the request_sock.
      49             :  * This happens only after 3WHS has been either completed or aborted (e.g.,
      50             :  * RST is received).
      51             :  *
      52             :  * Before TFO, a child socket is created only after 3WHS is completed,
      53             :  * hence it never needs to access the request_sock. things get a lot more
      54             :  * complex with TFO. A child socket, accepted or not, has to access its
      55             :  * request_sock for 3WHS processing, e.g., to retransmit SYN-ACK pkts,
      56             :  * until 3WHS is either completed or aborted. Afterwards the req will stay
      57             :  * until either the child socket is accepted, or in the rare case when the
      58             :  * listener is closed before the child is accepted.
      59             :  *
      60             :  * In short, a request socket is only freed after BOTH 3WHS has completed
      61             :  * (or aborted) and the child socket has been accepted (or listener closed).
      62             :  * When a child socket is accepted, its corresponding req->sk is set to
      63             :  * NULL since it's no longer needed. More importantly, "req->sk == NULL"
      64             :  * will be used by the code below to determine if a child socket has been
      65             :  * accepted or not, and the check is protected by the fastopenq->lock
      66             :  * described below.
      67             :  *
      68             :  * Note that fastopen_rsk is only accessed from the child socket's context
      69             :  * with its socket lock held. But a request_sock (req) can be accessed by
      70             :  * both its child socket through fastopen_rsk, and a listener socket through
      71             :  * icsk_accept_queue.rskq_accept_head. To protect the access a simple spin
      72             :  * lock per listener "icsk->icsk_accept_queue.fastopenq->lock" is created.
      73             :  * only in the rare case when both the listener and the child locks are held,
      74             :  * e.g., in inet_csk_listen_stop() do we not need to acquire the lock.
      75             :  * The lock also protects other fields such as fastopenq->qlen, which is
      76             :  * decremented by this function when fastopen_rsk is no longer needed.
      77             :  *
      78             :  * Note that another solution was to simply use the existing socket lock
      79             :  * from the listener. But first socket lock is difficult to use. It is not
      80             :  * a simple spin lock - one must consider sock_owned_by_user() and arrange
      81             :  * to use sk_add_backlog() stuff. But what really makes it infeasible is the
      82             :  * locking hierarchy violation. E.g., inet_csk_listen_stop() may try to
      83             :  * acquire a child's lock while holding listener's socket lock. A corner
      84             :  * case might also exist in tcp_v4_hnd_req() that will trigger this locking
      85             :  * order.
      86             :  *
      87             :  * This function also sets "treq->tfo_listener" to false.
      88             :  * treq->tfo_listener is used by the listener so it is protected by the
      89             :  * fastopenq->lock in this function.
      90             :  */
      91           0 : void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req,
      92             :                            bool reset)
      93             : {
      94           0 :         struct sock *lsk = req->rsk_listener;
      95           0 :         struct fastopen_queue *fastopenq;
      96             : 
      97           0 :         fastopenq = &inet_csk(lsk)->icsk_accept_queue.fastopenq;
      98             : 
      99           0 :         RCU_INIT_POINTER(tcp_sk(sk)->fastopen_rsk, NULL);
     100           0 :         spin_lock_bh(&fastopenq->lock);
     101           0 :         fastopenq->qlen--;
     102           0 :         tcp_rsk(req)->tfo_listener = false;
     103           0 :         if (req->sk) /* the child socket hasn't been accepted yet */
     104           0 :                 goto out;
     105             : 
     106           0 :         if (!reset || lsk->sk_state != TCP_LISTEN) {
     107             :                 /* If the listener has been closed don't bother with the
     108             :                  * special RST handling below.
     109             :                  */
     110           0 :                 spin_unlock_bh(&fastopenq->lock);
     111           0 :                 reqsk_put(req);
     112           0 :                 return;
     113             :         }
     114             :         /* Wait for 60secs before removing a req that has triggered RST.
     115             :          * This is a simple defense against TFO spoofing attack - by
     116             :          * counting the req against fastopen.max_qlen, and disabling
     117             :          * TFO when the qlen exceeds max_qlen.
     118             :          *
     119             :          * For more details see CoNext'11 "TCP Fast Open" paper.
     120             :          */
     121           0 :         req->rsk_timer.expires = jiffies + 60*HZ;
     122           0 :         if (fastopenq->rskq_rst_head == NULL)
     123           0 :                 fastopenq->rskq_rst_head = req;
     124             :         else
     125           0 :                 fastopenq->rskq_rst_tail->dl_next = req;
     126             : 
     127           0 :         req->dl_next = NULL;
     128           0 :         fastopenq->rskq_rst_tail = req;
     129           0 :         fastopenq->qlen++;
     130           0 : out:
     131           0 :         spin_unlock_bh(&fastopenq->lock);
     132             : }