1 // SPDX-License-Identifier: GPL-2.0 1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/skbuff.h> 2 #include <linux/skbuff.h>
3 3
4 #include "protocol.h" 4 #include "protocol.h"
5 5
6 /* Syncookies do not work for JOIN requests. 6 /* Syncookies do not work for JOIN requests.
7 * 7 *
8 * Unlike MP_CAPABLE, where the ACK cookie con 8 * Unlike MP_CAPABLE, where the ACK cookie contains the needed MPTCP
9 * options to reconstruct the initial syn stat 9 * options to reconstruct the initial syn state, MP_JOIN does not contain
10 * the token to obtain the mptcp socket nor th 10 * the token to obtain the mptcp socket nor the server-generated nonce
11 * that was used in the cookie SYN/ACK respons 11 * that was used in the cookie SYN/ACK response.
12 * 12 *
13 * Keep a small best effort state table to sto 13 * Keep a small best effort state table to store the syn/synack data,
14 * indexed by skb hash. 14 * indexed by skb hash.
15 * 15 *
16 * A MP_JOIN SYN packet handled by syn cookies 16 * A MP_JOIN SYN packet handled by syn cookies is only stored if the 32bit
17 * token matches a known mptcp connection that 17 * token matches a known mptcp connection that can still accept more subflows.
18 * 18 *
19 * There is no timeout handling -- state is on 19 * There is no timeout handling -- state is only re-constructed
20 * when the TCP ACK passed the cookie validati 20 * when the TCP ACK passed the cookie validation check.
21 */ 21 */
22 22
23 struct join_entry { 23 struct join_entry {
24 u32 token; 24 u32 token;
25 u32 remote_nonce; 25 u32 remote_nonce;
26 u32 local_nonce; 26 u32 local_nonce;
27 u8 join_id; 27 u8 join_id;
28 u8 local_id; 28 u8 local_id;
29 u8 backup; 29 u8 backup;
30 u8 valid; 30 u8 valid;
31 }; 31 };
32 32
33 #define COOKIE_JOIN_SLOTS 1024 33 #define COOKIE_JOIN_SLOTS 1024
34 34
35 static struct join_entry join_entries[COOKIE_J 35 static struct join_entry join_entries[COOKIE_JOIN_SLOTS] __cacheline_aligned_in_smp;
36 static spinlock_t join_entry_locks[COOKIE_JOIN 36 static spinlock_t join_entry_locks[COOKIE_JOIN_SLOTS] __cacheline_aligned_in_smp;
37 37
38 static u32 mptcp_join_entry_hash(struct sk_buf 38 static u32 mptcp_join_entry_hash(struct sk_buff *skb, struct net *net)
39 { 39 {
40 static u32 mptcp_join_hash_secret __re 40 static u32 mptcp_join_hash_secret __read_mostly;
41 struct tcphdr *th = tcp_hdr(skb); 41 struct tcphdr *th = tcp_hdr(skb);
42 u32 seq, i; 42 u32 seq, i;
43 43
44 net_get_random_once(&mptcp_join_hash_s 44 net_get_random_once(&mptcp_join_hash_secret,
45 sizeof(mptcp_join_ 45 sizeof(mptcp_join_hash_secret));
46 46
47 if (th->syn) 47 if (th->syn)
48 seq = TCP_SKB_CB(skb)->seq; 48 seq = TCP_SKB_CB(skb)->seq;
49 else 49 else
50 seq = TCP_SKB_CB(skb)->seq - 1 50 seq = TCP_SKB_CB(skb)->seq - 1;
51 51
52 i = jhash_3words(seq, net_hash_mix(net 52 i = jhash_3words(seq, net_hash_mix(net),
53 (__force __u32)th->so 53 (__force __u32)th->source << 16 | (__force __u32)th->dest,
54 mptcp_join_hash_secre 54 mptcp_join_hash_secret);
55 55
56 return i % ARRAY_SIZE(join_entries); 56 return i % ARRAY_SIZE(join_entries);
57 } 57 }
58 58
59 static void mptcp_join_store_state(struct join 59 static void mptcp_join_store_state(struct join_entry *entry,
60 const struc 60 const struct mptcp_subflow_request_sock *subflow_req)
61 { 61 {
62 entry->token = subflow_req->token; 62 entry->token = subflow_req->token;
63 entry->remote_nonce = subflow_req->rem 63 entry->remote_nonce = subflow_req->remote_nonce;
64 entry->local_nonce = subflow_req->loca 64 entry->local_nonce = subflow_req->local_nonce;
65 entry->backup = subflow_req->backup; 65 entry->backup = subflow_req->backup;
66 entry->join_id = subflow_req->remote_i 66 entry->join_id = subflow_req->remote_id;
67 entry->local_id = subflow_req->local_i 67 entry->local_id = subflow_req->local_id;
68 entry->valid = 1; 68 entry->valid = 1;
69 } 69 }
70 70
71 void subflow_init_req_cookie_join_save(const s 71 void subflow_init_req_cookie_join_save(const struct mptcp_subflow_request_sock *subflow_req,
72 struct 72 struct sk_buff *skb)
73 { 73 {
74 struct net *net = read_pnet(&subflow_r 74 struct net *net = read_pnet(&subflow_req->sk.req.ireq_net);
75 u32 i = mptcp_join_entry_hash(skb, net 75 u32 i = mptcp_join_entry_hash(skb, net);
76 76
77 /* No use in waiting if other cpu is a 77 /* No use in waiting if other cpu is already using this slot --
78 * would overwrite the data that got s 78 * would overwrite the data that got stored.
79 */ 79 */
80 spin_lock_bh(&join_entry_locks[i]); 80 spin_lock_bh(&join_entry_locks[i]);
81 mptcp_join_store_state(&join_entries[i 81 mptcp_join_store_state(&join_entries[i], subflow_req);
82 spin_unlock_bh(&join_entry_locks[i]); 82 spin_unlock_bh(&join_entry_locks[i]);
83 } 83 }
84 84
85 /* Called for a cookie-ack with MP_JOIN option 85 /* Called for a cookie-ack with MP_JOIN option present.
86 * Look up the saved state based on skb hash & 86 * Look up the saved state based on skb hash & check token matches msk
87 * in same netns. 87 * in same netns.
88 * 88 *
89 * Caller will check msk can still accept anot 89 * Caller will check msk can still accept another subflow. The hmac
90 * present in the cookie ACK mptcp option spac 90 * present in the cookie ACK mptcp option space will be checked later.
91 */ 91 */
92 bool mptcp_token_join_cookie_init_state(struct 92 bool mptcp_token_join_cookie_init_state(struct mptcp_subflow_request_sock *subflow_req,
93 struct 93 struct sk_buff *skb)
94 { 94 {
95 struct net *net = read_pnet(&subflow_r 95 struct net *net = read_pnet(&subflow_req->sk.req.ireq_net);
96 u32 i = mptcp_join_entry_hash(skb, net 96 u32 i = mptcp_join_entry_hash(skb, net);
97 struct mptcp_sock *msk; 97 struct mptcp_sock *msk;
98 struct join_entry *e; 98 struct join_entry *e;
99 99
100 e = &join_entries[i]; 100 e = &join_entries[i];
101 101
102 spin_lock_bh(&join_entry_locks[i]); 102 spin_lock_bh(&join_entry_locks[i]);
103 103
104 if (e->valid == 0) { 104 if (e->valid == 0) {
105 spin_unlock_bh(&join_entry_loc 105 spin_unlock_bh(&join_entry_locks[i]);
106 return false; 106 return false;
107 } 107 }
108 108
109 e->valid = 0; 109 e->valid = 0;
110 110
111 msk = mptcp_token_get_sock(net, e->tok 111 msk = mptcp_token_get_sock(net, e->token);
112 if (!msk) { 112 if (!msk) {
113 spin_unlock_bh(&join_entry_loc 113 spin_unlock_bh(&join_entry_locks[i]);
114 return false; 114 return false;
115 } 115 }
116 116
117 subflow_req->remote_nonce = e->remote_ 117 subflow_req->remote_nonce = e->remote_nonce;
118 subflow_req->local_nonce = e->local_no 118 subflow_req->local_nonce = e->local_nonce;
119 subflow_req->backup = e->backup; 119 subflow_req->backup = e->backup;
120 subflow_req->remote_id = e->join_id; 120 subflow_req->remote_id = e->join_id;
121 subflow_req->token = e->token; 121 subflow_req->token = e->token;
122 subflow_req->msk = msk; 122 subflow_req->msk = msk;
123 spin_unlock_bh(&join_entry_locks[i]); 123 spin_unlock_bh(&join_entry_locks[i]);
124 return true; 124 return true;
125 } 125 }
126 126
127 void __init mptcp_join_cookie_init(void) 127 void __init mptcp_join_cookie_init(void)
128 { 128 {
129 int i; 129 int i;
130 130
131 for (i = 0; i < COOKIE_JOIN_SLOTS; i++ 131 for (i = 0; i < COOKIE_JOIN_SLOTS; i++)
132 spin_lock_init(&join_entry_loc 132 spin_lock_init(&join_entry_locks[i]);
133 } 133 }
134 134
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.