Commit 0198230b authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso

net: syncookies: export cookie_v4_init_sequence/cookie_v4_check

Extract the local TCP stack independant parts of tcp_v4_init_sequence()
and cookie_v4_check() and export them for use by the upcoming SYNPROXY
target.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
Tested-by: default avatarMartin Topholm <mph@one.com>
Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 41d73ec0
...@@ -476,9 +476,13 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb); ...@@ -476,9 +476,13 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb);
/* From syncookies.c */ /* From syncookies.c */
extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS]; extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
extern int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,
u32 cookie);
extern struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, extern struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
struct ip_options *opt); struct ip_options *opt);
#ifdef CONFIG_SYN_COOKIES #ifdef CONFIG_SYN_COOKIES
extern u32 __cookie_v4_init_sequence(const struct iphdr *iph,
const struct tcphdr *th, u16 *mssp);
extern __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, extern __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb,
__u16 *mss); __u16 *mss);
#else #else
......
...@@ -160,26 +160,33 @@ static __u16 const msstab[] = { ...@@ -160,26 +160,33 @@ static __u16 const msstab[] = {
* Generate a syncookie. mssp points to the mss, which is returned * Generate a syncookie. mssp points to the mss, which is returned
* rounded down to the value encoded in the cookie. * rounded down to the value encoded in the cookie.
*/ */
__u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp) u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
u16 *mssp)
{ {
const struct iphdr *iph = ip_hdr(skb);
const struct tcphdr *th = tcp_hdr(skb);
int mssind; int mssind;
const __u16 mss = *mssp; const __u16 mss = *mssp;
tcp_synq_overflow(sk);
for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--) for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
if (mss >= msstab[mssind]) if (mss >= msstab[mssind])
break; break;
*mssp = msstab[mssind]; *mssp = msstab[mssind];
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);
return secure_tcp_syn_cookie(iph->saddr, iph->daddr, return secure_tcp_syn_cookie(iph->saddr, iph->daddr,
th->source, th->dest, ntohl(th->seq), th->source, th->dest, ntohl(th->seq),
jiffies / (HZ * 60), mssind); jiffies / (HZ * 60), mssind);
} }
EXPORT_SYMBOL_GPL(__cookie_v4_init_sequence);
__u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
{
const struct iphdr *iph = ip_hdr(skb);
const struct tcphdr *th = tcp_hdr(skb);
tcp_synq_overflow(sk);
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);
return __cookie_v4_init_sequence(iph, th, mssp);
}
/* /*
* This (misnamed) value is the age of syncookie which is permitted. * This (misnamed) value is the age of syncookie which is permitted.
...@@ -192,10 +199,9 @@ __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp) ...@@ -192,10 +199,9 @@ __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
* Check if a ack sequence number is a valid syncookie. * Check if a ack sequence number is a valid syncookie.
* Return the decoded mss if it is, or 0 if not. * Return the decoded mss if it is, or 0 if not.
*/ */
static inline int cookie_check(struct sk_buff *skb, __u32 cookie) int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,
u32 cookie)
{ {
const struct iphdr *iph = ip_hdr(skb);
const struct tcphdr *th = tcp_hdr(skb);
__u32 seq = ntohl(th->seq) - 1; __u32 seq = ntohl(th->seq) - 1;
__u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr, __u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,
th->source, th->dest, seq, th->source, th->dest, seq,
...@@ -204,6 +210,7 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie) ...@@ -204,6 +210,7 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0; return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
} }
EXPORT_SYMBOL_GPL(__cookie_v4_check);
static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb, static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
struct request_sock *req, struct request_sock *req,
...@@ -284,7 +291,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, ...@@ -284,7 +291,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
goto out; goto out;
if (tcp_synq_no_recent_overflow(sk) || if (tcp_synq_no_recent_overflow(sk) ||
(mss = cookie_check(skb, cookie)) == 0) { (mss = __cookie_v4_check(ip_hdr(skb), th, cookie)) == 0) {
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED); NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
goto out; goto out;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment