Commit cd8ae852 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

tcp: provide SYN headers for passive connections 



This patch allows a server application to get the TCP SYN headers for
its passive connections.  This is useful if the server is doing
fingerprinting of clients based on SYN packet contents.

Two socket options are added: TCP_SAVE_SYN and TCP_SAVED_SYN.

The first is used on a socket to enable saving the SYN headers
for child connections. This can be set before or after the listen()
call.

The latter is used to retrieve the SYN headers for passive connections,
if the parent listener has enabled TCP_SAVE_SYN.

TCP_SAVED_SYN is read once, it frees the saved SYN headers.

The data returned in TCP_SAVED_SYN are network (IPv4/IPv6) and TCP
headers.

Original patch was written by Tom Herbert, I changed it to not hold
a full skb (and associated dst and conntracking reference).

We have used such patch for about 3 years at Google.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
Tested-by: default avatarNeal Cardwell <ncardwell@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fcba67c9

include/linux/tcp.h

+8 −0
Original line number Diff line number Diff line
@@ -199,6 +199,7 @@ struct tcp_sock { 
		syn_fastopen:1,	/* SYN includes Fast Open option */

		syn_fastopen_exp:1,/* SYN includes Fast Open exp. option */

		syn_data_acked:1,/* data in SYN is acked by SYN-ACK */

		save_syn:1,	/* Save headers of SYN packet */

		is_cwnd_limited:1;/* forward progress limited by snd_cwnd? */

	u32	tlp_high_seq;	/* snd_nxt at the time of TLP retransmit. */
@@ -326,6 +327,7 @@ struct tcp_sock { 
	 * socket. Used to retransmit SYNACKs etc.

	 */

	struct request_sock *fastopen_rsk;

	u32	*saved_syn;

};



enum tsq_flags {
@@ -393,4 +395,10 @@ static inline int fastopen_init_queue(struct sock *sk, int backlog) 
	return 0;

}



static inline void tcp_saved_syn_free(struct tcp_sock *tp)

{

	kfree(tp->saved_syn);

	tp->saved_syn = NULL;

}



#endif	/* _LINUX_TCP_H */

include/net/request_sock.h

+3 −1
Original line number Diff line number Diff line
@@ -64,6 +64,7 @@ struct request_sock { 
	struct timer_list		rsk_timer;

	const struct request_sock_ops	*rsk_ops;

	struct sock			*sk;

	u32				*saved_syn;

	u32				secid;

	u32				peer_secid;

};
@@ -77,7 +78,7 @@ reqsk_alloc(const struct request_sock_ops *ops, struct sock *sk_listener) 
		req->rsk_ops = ops;

		sock_hold(sk_listener);

		req->rsk_listener = sk_listener;



		req->saved_syn = NULL;

		/* Following is temporary. It is coupled with debugging

		 * helpers in reqsk_put() & reqsk_free()

		 */
@@ -104,6 +105,7 @@ static inline void reqsk_free(struct request_sock *req) 
	req->rsk_ops->destructor(req);

	if (req->rsk_listener)

		sock_put(req->rsk_listener);

	kfree(req->saved_syn);

	kmem_cache_free(req->rsk_ops->slab, req);

}

include/uapi/linux/tcp.h

+2 −0
Original line number Diff line number Diff line
@@ -113,6 +113,8 @@ enum { 
#define TCP_TIMESTAMP		24

#define TCP_NOTSENT_LOWAT	25	/* limit number of unsent bytes in write queue */

#define TCP_CC_INFO		26	/* Get Congestion Control (optional) info */

#define TCP_SAVE_SYN		27	/* Record SYN headers for new connections */

#define TCP_SAVED_SYN		28	/* Get SYN headers recorded for connection */



struct tcp_repair_opt {

	__u32	opt_code;

net/ipv4/tcp.c

+35 −0
Original line number Diff line number Diff line
@@ -2482,6 +2482,13 @@ static int do_tcp_setsockopt(struct sock *sk, int level, 
			icsk->icsk_syn_retries = val;

		break;



	case TCP_SAVE_SYN:

		if (val < 0 || val > 1)

			err = -EINVAL;

		else

			tp->save_syn = val;

		break;



	case TCP_LINGER2:

		if (val < 0)

			tp->linger2 = -1;
@@ -2818,6 +2825,34 @@ static int do_tcp_getsockopt(struct sock *sk, int level, 
	case TCP_NOTSENT_LOWAT:

		val = tp->notsent_lowat;

		break;

	case TCP_SAVE_SYN:

		val = tp->save_syn;

		break;

	case TCP_SAVED_SYN: {

		if (get_user(len, optlen))

			return -EFAULT;



		lock_sock(sk);

		if (tp->saved_syn) {

			len = min_t(unsigned int, tp->saved_syn[0], len);

			if (put_user(len, optlen)) {

				release_sock(sk);

				return -EFAULT;

			}

			if (copy_to_user(optval, tp->saved_syn + 1, len)) {

				release_sock(sk);

				return -EFAULT;

			}

			tcp_saved_syn_free(tp);

			release_sock(sk);

		} else {

			release_sock(sk);

			len = 0;

			if (put_user(len, optlen))

				return -EFAULT;

		}

		return 0;

	}

	default:

		return -ENOPROTOOPT;

	}

net/ipv4/tcp_input.c

+18 −0
Original line number Diff line number Diff line
@@ -6060,6 +6060,23 @@ static bool tcp_syn_flood_action(struct sock *sk, 
	return want_cookie;

}



static void tcp_reqsk_record_syn(const struct sock *sk,

				 struct request_sock *req,

				 const struct sk_buff *skb)

{

	if (tcp_sk(sk)->save_syn) {

		u32 len = skb_network_header_len(skb) + tcp_hdrlen(skb);

		u32 *copy;



		copy = kmalloc(len + sizeof(u32), GFP_ATOMIC);

		if (copy) {

			copy[0] = len;

			memcpy(&copy[1], skb_network_header(skb), len);

			req->saved_syn = copy;

		}

	}

}



int tcp_conn_request(struct request_sock_ops *rsk_ops,

		     const struct tcp_request_sock_ops *af_ops,

		     struct sock *sk, struct sk_buff *skb)
@@ -6192,6 +6209,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, 
		tcp_rsk(req)->tfo_listener = false;

		af_ops->queue_hash_add(sk, req, TCP_TIMEOUT_INIT);

	}

	tcp_reqsk_record_syn(sk, req, skb);



	return 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE