net: syncookies: export cookie_v4_init_sequence/cookie_v4_check (0198230b) · Commits · 戴 / test

include/net/tcp.h

+4 −0

Original line number	Diff line number	Diff line
		@@ -476,9 +476,13 @@ void inet_sk_rx_dst_set(struct sock sk, const struct sk_buff skb);

		/* From syncookies.c */
		extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
		extern int __cookie_v4_check(const struct iphdr iph, const struct tcphdr th,
		u32 cookie);
		extern struct sock cookie_v4_check(struct sock sk, struct sk_buff *skb,
		struct ip_options *opt);
		#ifdef CONFIG_SYN_COOKIES
		extern u32 __cookie_v4_init_sequence(const struct iphdr *iph,
		const struct tcphdr th, u16 mssp);
		extern __u32 cookie_v4_init_sequence(struct sock sk, struct sk_buff skb,
		__u16 *mss);
		#else

net/ipv4/syncookies.c

+18 −11

Original line number	Diff line number	Diff line
		@@ -160,26 +160,33 @@ static __u16 const msstab[] = {
		* Generate a syncookie. mssp points to the mss, which is returned
		* rounded down to the value encoded in the cookie.
		*/
		__u32 cookie_v4_init_sequence(struct sock sk, struct sk_buff skb, __u16 *mssp)
		u32 __cookie_v4_init_sequence(const struct iphdr iph, const struct tcphdr th,
		u16 *mssp)
		{
		const struct iphdr *iph = ip_hdr(skb);
		const struct tcphdr *th = tcp_hdr(skb);
		int mssind;
		const __u16 mss = *mssp;

		tcp_synq_overflow(sk);

		for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
		if (mss >= msstab[mssind])
		break;
		*mssp = msstab[mssind];

		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);

		return secure_tcp_syn_cookie(iph->saddr, iph->daddr,
		th->source, th->dest, ntohl(th->seq),
		jiffies / (HZ * 60), mssind);
		}
		EXPORT_SYMBOL_GPL(__cookie_v4_init_sequence);

		__u32 cookie_v4_init_sequence(struct sock sk, struct sk_buff skb, __u16 *mssp)
		{
		const struct iphdr *iph = ip_hdr(skb);
		const struct tcphdr *th = tcp_hdr(skb);

		tcp_synq_overflow(sk);
		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);

		return __cookie_v4_init_sequence(iph, th, mssp);
		}

		/*
		* This (misnamed) value is the age of syncookie which is permitted.
		@@ -192,10 +199,9 @@ __u32 cookie_v4_init_sequence(struct sock sk, struct sk_buff skb, __u16 *mssp)
		* Check if a ack sequence number is a valid syncookie.
		* Return the decoded mss if it is, or 0 if not.
		*/
		static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
		int __cookie_v4_check(const struct iphdr iph, const struct tcphdr th,
		u32 cookie)
		{
		const struct iphdr *iph = ip_hdr(skb);
		const struct tcphdr *th = tcp_hdr(skb);
		__u32 seq = ntohl(th->seq) - 1;
		__u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,
		th->source, th->dest, seq,
		@@ -204,6 +210,7 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie)

		return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
		}
		EXPORT_SYMBOL_GPL(__cookie_v4_check);

		static inline struct sock get_cookie_sock(struct sock sk, struct sk_buff *skb,
		struct request_sock *req,
		@@ -284,7 +291,7 @@ struct sock cookie_v4_check(struct sock sk, struct sk_buff *skb,
		goto out;

		if (tcp_synq_no_recent_overflow(sk) \|\|
		(mss = cookie_check(skb, cookie)) == 0) {
		(mss = __cookie_v4_check(ip_hdr(skb), th, cookie)) == 0) {
		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
		goto out;
		}

Admin message