Commit 9466a1cc authored by Florian Westphal's avatar Florian Westphal Committed by David S. Miller
Browse files

mptcp: enable JOIN requests even if cookies are in use 



JOIN requests do not work in syncookie mode -- for HMAC validation, the
peers nonce and the mptcp token (to obtain the desired connection socket
the join is for) are required, but this information is only present in the
initial syn.

So either we need to drop all JOIN requests once a listening socket enters
syncookie mode, or we need to store enough state to reconstruct the request
socket later.

This adds a state table (1024 entries) to store the data present in the
MP_JOIN syn request and the random nonce used for the cookie syn/ack.

When a MP_JOIN ACK passed cookie validation, the table is consulted
to rebuild the request socket from it.

An alternate approach would be to "cancel" syn-cookie mode and force
MP_JOIN to always use a syn queue entry.

However, doing so brings the backlog over the configured queue limit.

v2: use req->syncookie, not (removed) want_cookie arg

Suggested-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Reviewed-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6fc8c827

net/ipv4/syncookies.c

+6 −0
Original line number Diff line number Diff line
@@ -212,6 +212,12 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb, 
		refcount_set(&req->rsk_refcnt, 1);

		tcp_sk(child)->tsoffset = tsoff;

		sock_rps_save_rxhash(child, skb);



		if (tcp_rsk(req)->drop_req) {

			refcount_set(&req->rsk_refcnt, 2);

			return child;

		}



		if (inet_csk_reqsk_queue_add(sk, req, child))

			return child;

net/mptcp/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -4,6 +4,7 @@ obj-$(CONFIG_MPTCP) += mptcp.o 
mptcp-y := protocol.o subflow.o options.o token.o crypto.o ctrl.o pm.o diag.o \

	   mib.o pm_netlink.o



obj-$(CONFIG_SYN_COOKIES) += syncookies.o

obj-$(CONFIG_INET_MPTCP_DIAG) += mptcp_diag.o



mptcp_crypto_test-objs := crypto_test.o

net/mptcp/ctrl.c

+1 −0
Original line number Diff line number Diff line
@@ -112,6 +112,7 @@ static struct pernet_operations mptcp_pernet_ops = { 


void __init mptcp_init(void)

{

	mptcp_join_cookie_init();

	mptcp_proto_init();



	if (register_pernet_subsys(&mptcp_pernet_ops) < 0)

net/mptcp/protocol.h

+20 −0
Original line number Diff line number Diff line
@@ -506,4 +506,24 @@ static inline bool subflow_simultaneous_connect(struct sock *sk) 
	       !subflow->conn_finished;

}



#ifdef CONFIG_SYN_COOKIES

void subflow_init_req_cookie_join_save(const struct mptcp_subflow_request_sock *subflow_req,

				       struct sk_buff *skb);

bool mptcp_token_join_cookie_init_state(struct mptcp_subflow_request_sock *subflow_req,

					struct sk_buff *skb);

void __init mptcp_join_cookie_init(void);

#else

static inline void

subflow_init_req_cookie_join_save(const struct mptcp_subflow_request_sock *subflow_req,

				  struct sk_buff *skb) {}

static inline bool

mptcp_token_join_cookie_init_state(struct mptcp_subflow_request_sock *subflow_req,

				   struct sk_buff *skb)

{

	return false;

}



static inline void mptcp_join_cookie_init(void) {}

#endif



#endif /* __MPTCP_PROTOCOL_H */

net/mptcp/subflow.c

+14 −0
Original line number Diff line number Diff line
@@ -173,6 +173,12 @@ again: 
		subflow_req->token = mp_opt.token;

		subflow_req->remote_nonce = mp_opt.nonce;

		subflow_req->msk = subflow_token_join_request(req, skb);



		if (unlikely(req->syncookie) && subflow_req->msk) {

			if (mptcp_can_accept_new_subflow(subflow_req->msk))

				subflow_init_req_cookie_join_save(subflow_req, skb);

		}



		pr_debug("token=%u, remote_nonce=%u msk=%p", subflow_req->token,

			 subflow_req->remote_nonce, subflow_req->msk);

	}
@@ -207,6 +213,14 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req, 


		subflow_req->mp_capable = 1;

		subflow_req->ssn_offset = TCP_SKB_CB(skb)->seq - 1;

	} else if (mp_opt.mp_join && listener->request_mptcp) {

		if (!mptcp_token_join_cookie_init_state(subflow_req, skb))

			return -EINVAL;



		if (mptcp_can_accept_new_subflow(subflow_req->msk))

			subflow_req->mp_join = 1;



		subflow_req->ssn_offset = TCP_SKB_CB(skb)->seq - 1;

	}



	return 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE