blob: 31b08ec38cb8aeb95601076213fcd9612d8f979b [file] [log] [blame]
Herbert Xucf80e0e2016-01-24 21:20:23 +08001#include <linux/crypto.h>
Jerry Chu10467162012-08-31 12:29:11 +00002#include <linux/err.h>
Yuchung Cheng2100c8d2012-07-19 06:43:05 +00003#include <linux/init.h>
4#include <linux/kernel.h>
Jerry Chu10467162012-08-31 12:29:11 +00005#include <linux/list.h>
6#include <linux/tcp.h>
7#include <linux/rcupdate.h>
8#include <linux/rculist.h>
9#include <net/inetpeer.h>
10#include <net/tcp.h>
Yuchung Cheng2100c8d2012-07-19 06:43:05 +000011
Jerry Chu10467162012-08-31 12:29:11 +000012struct tcp_fastopen_context __rcu *tcp_fastopen_ctx;
13
14static DEFINE_SPINLOCK(tcp_fastopen_ctx_lock);
15
Hannes Frederic Sowa222e83d2013-10-19 21:48:58 +020016void tcp_fastopen_init_key_once(bool publish)
17{
18 static u8 key[TCP_FASTOPEN_KEY_LENGTH];
19
20 /* tcp_fastopen_reset_cipher publishes the new context
21 * atomically, so we allow this race happening here.
22 *
23 * All call sites of tcp_fastopen_cookie_gen also check
24 * for a valid cookie, so this is an acceptable risk.
25 */
26 if (net_get_random_once(key, sizeof(key)) && publish)
27 tcp_fastopen_reset_cipher(key, sizeof(key));
28}
29
Jerry Chu10467162012-08-31 12:29:11 +000030static void tcp_fastopen_ctx_free(struct rcu_head *head)
31{
32 struct tcp_fastopen_context *ctx =
33 container_of(head, struct tcp_fastopen_context, rcu);
34 crypto_free_cipher(ctx->tfm);
35 kfree(ctx);
36}
37
38int tcp_fastopen_reset_cipher(void *key, unsigned int len)
39{
40 int err;
41 struct tcp_fastopen_context *ctx, *octx;
42
43 ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
44 if (!ctx)
45 return -ENOMEM;
46 ctx->tfm = crypto_alloc_cipher("aes", 0, 0);
47
48 if (IS_ERR(ctx->tfm)) {
49 err = PTR_ERR(ctx->tfm);
50error: kfree(ctx);
51 pr_err("TCP: TFO aes cipher alloc error: %d\n", err);
52 return err;
53 }
54 err = crypto_cipher_setkey(ctx->tfm, key, len);
55 if (err) {
56 pr_err("TCP: TFO cipher key error: %d\n", err);
57 crypto_free_cipher(ctx->tfm);
58 goto error;
59 }
60 memcpy(ctx->key, key, len);
61
62 spin_lock(&tcp_fastopen_ctx_lock);
63
64 octx = rcu_dereference_protected(tcp_fastopen_ctx,
65 lockdep_is_held(&tcp_fastopen_ctx_lock));
66 rcu_assign_pointer(tcp_fastopen_ctx, ctx);
67 spin_unlock(&tcp_fastopen_ctx_lock);
68
69 if (octx)
70 call_rcu(&octx->rcu, tcp_fastopen_ctx_free);
71 return err;
72}
73
Daniel Lee3a19ce02014-05-11 20:22:13 -070074static bool __tcp_fastopen_cookie_gen(const void *path,
75 struct tcp_fastopen_cookie *foc)
Jerry Chu10467162012-08-31 12:29:11 +000076{
Jerry Chu10467162012-08-31 12:29:11 +000077 struct tcp_fastopen_context *ctx;
Daniel Lee3a19ce02014-05-11 20:22:13 -070078 bool ok = false;
Jerry Chu10467162012-08-31 12:29:11 +000079
80 rcu_read_lock();
81 ctx = rcu_dereference(tcp_fastopen_ctx);
82 if (ctx) {
Daniel Lee3a19ce02014-05-11 20:22:13 -070083 crypto_cipher_encrypt_one(ctx->tfm, foc->val, path);
Jerry Chu10467162012-08-31 12:29:11 +000084 foc->len = TCP_FASTOPEN_COOKIE_SIZE;
Daniel Lee3a19ce02014-05-11 20:22:13 -070085 ok = true;
Jerry Chu10467162012-08-31 12:29:11 +000086 }
87 rcu_read_unlock();
Daniel Lee3a19ce02014-05-11 20:22:13 -070088 return ok;
89}
90
91/* Generate the fastopen cookie by doing aes128 encryption on both
92 * the source and destination addresses. Pad 0s for IPv4 or IPv4-mapped-IPv6
93 * addresses. For the longer IPv6 addresses use CBC-MAC.
94 *
95 * XXX (TFO) - refactor when TCP_FASTOPEN_COOKIE_SIZE != AES_BLOCK_SIZE.
96 */
97static bool tcp_fastopen_cookie_gen(struct request_sock *req,
98 struct sk_buff *syn,
99 struct tcp_fastopen_cookie *foc)
100{
101 if (req->rsk_ops->family == AF_INET) {
102 const struct iphdr *iph = ip_hdr(syn);
103
104 __be32 path[4] = { iph->saddr, iph->daddr, 0, 0 };
105 return __tcp_fastopen_cookie_gen(path, foc);
106 }
107
108#if IS_ENABLED(CONFIG_IPV6)
109 if (req->rsk_ops->family == AF_INET6) {
110 const struct ipv6hdr *ip6h = ipv6_hdr(syn);
111 struct tcp_fastopen_cookie tmp;
112
113 if (__tcp_fastopen_cookie_gen(&ip6h->saddr, &tmp)) {
Shannon Nelson003c9412017-01-12 14:24:58 -0800114 struct in6_addr *buf = &tmp.addr;
Li RongQing41c91992014-09-29 15:04:37 +0800115 int i;
Daniel Lee3a19ce02014-05-11 20:22:13 -0700116
117 for (i = 0; i < 4; i++)
118 buf->s6_addr32[i] ^= ip6h->daddr.s6_addr32[i];
119 return __tcp_fastopen_cookie_gen(buf, foc);
120 }
121 }
122#endif
123 return false;
Jerry Chu10467162012-08-31 12:29:11 +0000124}
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700125
Eric Dumazet61d2bca2016-02-01 21:03:07 -0800126
127/* If an incoming SYN or SYNACK frame contains a payload and/or FIN,
128 * queue this additional data / FIN.
129 */
130void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb)
131{
132 struct tcp_sock *tp = tcp_sk(sk);
133
134 if (TCP_SKB_CB(skb)->end_seq == tp->rcv_nxt)
135 return;
136
137 skb = skb_clone(skb, GFP_ATOMIC);
138 if (!skb)
139 return;
140
141 skb_dst_drop(skb);
Martin KaFai Laua44d6ea2016-03-14 10:52:15 -0700142 /* segs_in has been initialized to 1 in tcp_create_openreq_child().
143 * Hence, reset segs_in to 0 before calling tcp_segs_in()
144 * to avoid double counting. Also, tcp_segs_in() expects
145 * skb->len to include the tcp_hdrlen. Hence, it should
146 * be called before __skb_pull().
147 */
148 tp->segs_in = 0;
149 tcp_segs_in(tp, skb);
Eric Dumazet61d2bca2016-02-01 21:03:07 -0800150 __skb_pull(skb, tcp_hdrlen(skb));
Eric Dumazet76061f62016-09-07 08:34:11 -0700151 sk_forced_mem_schedule(sk, skb->truesize);
Eric Dumazet61d2bca2016-02-01 21:03:07 -0800152 skb_set_owner_r(skb, sk);
153
Eric Dumazet9d691532016-02-01 21:03:08 -0800154 TCP_SKB_CB(skb)->seq++;
155 TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_SYN;
156
Eric Dumazet61d2bca2016-02-01 21:03:07 -0800157 tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
158 __skb_queue_tail(&sk->sk_receive_queue, skb);
159 tp->syn_data_acked = 1;
160
161 /* u64_stats_update_begin(&tp->syncp) not needed here,
162 * as we certainly are not changing upper 32bit value (0)
163 */
164 tp->bytes_received = skb->len;
Eric Dumazete3e17b72016-02-06 11:16:28 -0800165
166 if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
167 tcp_fin(sk);
Eric Dumazet61d2bca2016-02-01 21:03:07 -0800168}
169
Eric Dumazet7c85af82015-09-24 17:16:05 -0700170static struct sock *tcp_fastopen_create_child(struct sock *sk,
171 struct sk_buff *skb,
Eric Dumazet7c85af82015-09-24 17:16:05 -0700172 struct request_sock *req)
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700173{
Dave Jones17846372014-06-16 16:30:36 -0400174 struct tcp_sock *tp;
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700175 struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700176 struct sock *child;
Eric Dumazet5e0724d2015-10-22 08:20:46 -0700177 bool own_req;
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700178
179 req->num_retrans = 0;
180 req->num_timeout = 0;
181 req->sk = NULL;
182
Eric Dumazet5e0724d2015-10-22 08:20:46 -0700183 child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
184 NULL, &own_req);
Ian Morris51456b22015-04-03 09:17:26 +0100185 if (!child)
Eric Dumazet7c85af82015-09-24 17:16:05 -0700186 return NULL;
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700187
Eric Dumazet0536fcc2015-09-29 07:42:52 -0700188 spin_lock(&queue->fastopenq.lock);
189 queue->fastopenq.qlen++;
190 spin_unlock(&queue->fastopenq.lock);
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700191
192 /* Initialize the child socket. Have to fix some values to take
193 * into account the child is a Fast Open socket and is created
194 * only out of the bits carried in the SYN packet.
195 */
196 tp = tcp_sk(child);
197
198 tp->fastopen_rsk = req;
Eric Dumazet9439ce02015-03-17 18:32:29 -0700199 tcp_rsk(req)->tfo_listener = true;
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700200
201 /* RFC1323: The window in SYN & SYN/ACK segments is never
202 * scaled. So correct it appropriately.
203 */
204 tp->snd_wnd = ntohs(tcp_hdr(skb)->window);
Alexey Kodanev0dbd7ff2017-01-19 16:36:39 +0300205 tp->max_window = tp->snd_wnd;
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700206
207 /* Activate the retrans timer so that SYNACK can be retransmitted.
Eric Dumazetca6fb062015-10-02 11:43:35 -0700208 * The request socket is not added to the ehash
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700209 * because it's been added to the accept queue directly.
210 */
211 inet_csk_reset_xmit_timer(child, ICSK_TIME_RETRANS,
212 TCP_TIMEOUT_INIT, TCP_RTO_MAX);
213
Reshetova, Elena41c6d652017-06-30 13:08:01 +0300214 refcount_set(&req->rsk_refcnt, 2);
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700215
216 /* Now finish processing the fastopen child socket. */
217 inet_csk(child)->icsk_af_ops->rebuild_header(child);
218 tcp_init_congestion_control(child);
219 tcp_mtup_init(child);
220 tcp_init_metrics(child);
Lawrence Brakmo9872a4b2017-06-30 20:02:47 -0700221 tcp_call_bpf(child, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB);
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700222 tcp_init_buffer_space(child);
223
Eric Dumazet61d2bca2016-02-01 21:03:07 -0800224 tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
Eric Dumazetba34e6d2015-02-13 04:47:12 -0800225
Eric Dumazet61d2bca2016-02-01 21:03:07 -0800226 tcp_fastopen_add_skb(child, skb);
Eric Dumazetd6549762015-05-21 21:51:19 -0700227
Eric Dumazet61d2bca2016-02-01 21:03:07 -0800228 tcp_rsk(req)->rcv_nxt = tp->rcv_nxt;
Neal Cardwell28b346c2016-08-30 11:55:23 -0400229 tp->rcv_wup = tp->rcv_nxt;
Eric Dumazet7656d842015-10-04 21:08:07 -0700230 /* tcp_conn_request() is sending the SYNACK,
231 * and queues the child into listener accept queue.
Eric Dumazet7c85af82015-09-24 17:16:05 -0700232 */
Eric Dumazet7c85af82015-09-24 17:16:05 -0700233 return child;
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700234}
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700235
236static bool tcp_fastopen_queue_check(struct sock *sk)
237{
238 struct fastopen_queue *fastopenq;
239
240 /* Make sure the listener has enabled fastopen, and we don't
241 * exceed the max # of pending TFO requests allowed before trying
242 * to validating the cookie in order to avoid burning CPU cycles
243 * unnecessarily.
244 *
245 * XXX (TFO) - The implication of checking the max_qlen before
246 * processing a cookie request is that clients can't differentiate
247 * between qlen overflow causing Fast Open to be disabled
248 * temporarily vs a server not supporting Fast Open at all.
249 */
Eric Dumazet0536fcc2015-09-29 07:42:52 -0700250 fastopenq = &inet_csk(sk)->icsk_accept_queue.fastopenq;
251 if (fastopenq->max_qlen == 0)
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700252 return false;
253
254 if (fastopenq->qlen >= fastopenq->max_qlen) {
255 struct request_sock *req1;
256 spin_lock(&fastopenq->lock);
257 req1 = fastopenq->rskq_rst_head;
Eric Dumazetfa76ce732015-03-19 19:04:20 -0700258 if (!req1 || time_after(req1->rsk_timer.expires, jiffies)) {
Eric Dumazet02a1d6e2016-04-27 16:44:39 -0700259 __NET_INC_STATS(sock_net(sk),
260 LINUX_MIB_TCPFASTOPENLISTENOVERFLOW);
Eric Dumazetc10d9312016-04-29 14:16:47 -0700261 spin_unlock(&fastopenq->lock);
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700262 return false;
263 }
264 fastopenq->rskq_rst_head = req1->dl_next;
265 fastopenq->qlen--;
266 spin_unlock(&fastopenq->lock);
Eric Dumazet13854e52015-03-15 21:12:16 -0700267 reqsk_put(req1);
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700268 }
269 return true;
270}
271
Yuchung Cheng89278c92014-05-11 20:22:10 -0700272/* Returns true if we should perform Fast Open on the SYN. The cookie (foc)
273 * may be updated and return the client in the SYN-ACK later. E.g., Fast Open
274 * cookie request (foc->len == 0).
275 */
Eric Dumazet7c85af82015-09-24 17:16:05 -0700276struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
277 struct request_sock *req,
Tonghao Zhang11199362017-08-21 23:33:49 -0700278 struct tcp_fastopen_cookie *foc)
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700279{
Yuchung Cheng89278c92014-05-11 20:22:10 -0700280 bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1;
Haishuang Yane1cfcbe2017-09-27 11:35:40 +0800281 int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen;
282 struct tcp_fastopen_cookie valid_foc = { .len = -1 };
Eric Dumazet7c85af82015-09-24 17:16:05 -0700283 struct sock *child;
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700284
Yuchung Cheng531c94a2015-02-09 12:35:23 -0800285 if (foc->len == 0) /* Client requests a cookie */
Eric Dumazetc10d9312016-04-29 14:16:47 -0700286 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENCOOKIEREQD);
Yuchung Cheng531c94a2015-02-09 12:35:23 -0800287
Haishuang Yane1cfcbe2017-09-27 11:35:40 +0800288 if (!((tcp_fastopen & TFO_SERVER_ENABLE) &&
Yuchung Cheng89278c92014-05-11 20:22:10 -0700289 (syn_data || foc->len >= 0) &&
290 tcp_fastopen_queue_check(sk))) {
291 foc->len = -1;
Eric Dumazet7c85af82015-09-24 17:16:05 -0700292 return NULL;
Yuchung Cheng89278c92014-05-11 20:22:10 -0700293 }
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700294
Haishuang Yane1cfcbe2017-09-27 11:35:40 +0800295 if (syn_data && (tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD))
Yuchung Cheng89278c92014-05-11 20:22:10 -0700296 goto fastopen;
297
Yuchung Cheng531c94a2015-02-09 12:35:23 -0800298 if (foc->len >= 0 && /* Client presents or requests a cookie */
299 tcp_fastopen_cookie_gen(req, skb, &valid_foc) &&
Daniel Lee3a19ce02014-05-11 20:22:13 -0700300 foc->len == TCP_FASTOPEN_COOKIE_SIZE &&
Yuchung Cheng89278c92014-05-11 20:22:10 -0700301 foc->len == valid_foc.len &&
302 !memcmp(foc->val, valid_foc.val, foc->len)) {
Yuchung Cheng843f4a52014-05-11 20:22:11 -0700303 /* Cookie is valid. Create a (full) child socket to accept
304 * the data in SYN before returning a SYN-ACK to ack the
305 * data. If we fail to create the socket, fall back and
306 * ack the ISN only but includes the same cookie.
307 *
308 * Note: Data-less SYN with valid cookie is allowed to send
309 * data in SYN_RECV state.
310 */
Yuchung Cheng89278c92014-05-11 20:22:10 -0700311fastopen:
Tonghao Zhang11199362017-08-21 23:33:49 -0700312 child = tcp_fastopen_create_child(sk, skb, req);
Eric Dumazet7c85af82015-09-24 17:16:05 -0700313 if (child) {
Yuchung Cheng843f4a52014-05-11 20:22:11 -0700314 foc->len = -1;
Eric Dumazetc10d9312016-04-29 14:16:47 -0700315 NET_INC_STATS(sock_net(sk),
316 LINUX_MIB_TCPFASTOPENPASSIVE);
Eric Dumazet7c85af82015-09-24 17:16:05 -0700317 return child;
Yuchung Cheng843f4a52014-05-11 20:22:11 -0700318 }
Eric Dumazetc10d9312016-04-29 14:16:47 -0700319 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENPASSIVEFAIL);
Yuchung Cheng531c94a2015-02-09 12:35:23 -0800320 } else if (foc->len > 0) /* Client presents an invalid cookie */
Eric Dumazetc10d9312016-04-29 14:16:47 -0700321 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENPASSIVEFAIL);
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700322
Daniel Lee7f9b8382015-04-06 14:37:26 -0700323 valid_foc.exp = foc->exp;
Yuchung Cheng89278c92014-05-11 20:22:10 -0700324 *foc = valid_foc;
Eric Dumazet7c85af82015-09-24 17:16:05 -0700325 return NULL;
Yuchung Cheng5b7ed082014-05-11 20:22:09 -0700326}
Wei Wang065263f2017-01-23 10:59:20 -0800327
328bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
329 struct tcp_fastopen_cookie *cookie)
330{
331 unsigned long last_syn_loss = 0;
332 int syn_loss = 0;
333
334 tcp_fastopen_cache_get(sk, mss, cookie, &syn_loss, &last_syn_loss);
335
336 /* Recurring FO SYN losses: no cookie or data in SYN */
337 if (syn_loss > 1 &&
338 time_before(jiffies, last_syn_loss + (60*HZ << syn_loss))) {
339 cookie->len = -1;
340 return false;
341 }
Wei Wangcf1ef3f2017-04-20 14:45:46 -0700342
343 /* Firewall blackhole issue check */
344 if (tcp_fastopen_active_should_disable(sk)) {
345 cookie->len = -1;
346 return false;
347 }
348
Haishuang Yane1cfcbe2017-09-27 11:35:40 +0800349 if (sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE) {
Wei Wang065263f2017-01-23 10:59:20 -0800350 cookie->len = -1;
351 return true;
352 }
353 return cookie->len > 0;
354}
Wei Wang19f6d3f2017-01-23 10:59:22 -0800355
356/* This function checks if we want to defer sending SYN until the first
357 * write(). We defer under the following conditions:
358 * 1. fastopen_connect sockopt is set
359 * 2. we have a valid cookie
360 * Return value: return true if we want to defer until application writes data
361 * return false if we want to send out SYN immediately
362 */
363bool tcp_fastopen_defer_connect(struct sock *sk, int *err)
364{
365 struct tcp_fastopen_cookie cookie = { .len = 0 };
366 struct tcp_sock *tp = tcp_sk(sk);
367 u16 mss;
368
369 if (tp->fastopen_connect && !tp->fastopen_req) {
370 if (tcp_fastopen_cookie_check(sk, &mss, &cookie)) {
371 inet_sk(sk)->defer_connect = 1;
372 return true;
373 }
374
375 /* Alloc fastopen_req in order for FO option to be included
376 * in SYN
377 */
378 tp->fastopen_req = kzalloc(sizeof(*tp->fastopen_req),
379 sk->sk_allocation);
380 if (tp->fastopen_req)
381 tp->fastopen_req->cookie = cookie;
382 else
383 *err = -ENOBUFS;
384 }
385 return false;
386}
387EXPORT_SYMBOL(tcp_fastopen_defer_connect);
Wei Wangcf1ef3f2017-04-20 14:45:46 -0700388
389/*
390 * The following code block is to deal with middle box issues with TFO:
391 * Middlebox firewall issues can potentially cause server's data being
392 * blackholed after a successful 3WHS using TFO.
393 * The proposed solution is to disable active TFO globally under the
394 * following circumstances:
395 * 1. client side TFO socket receives out of order FIN
396 * 2. client side TFO socket receives out of order RST
397 * We disable active side TFO globally for 1hr at first. Then if it
398 * happens again, we disable it for 2h, then 4h, 8h, ...
399 * And we reset the timeout back to 1hr when we see a successful active
400 * TFO connection with data exchanges.
401 */
402
403/* Default to 1hr */
404unsigned int sysctl_tcp_fastopen_blackhole_timeout __read_mostly = 60 * 60;
405static atomic_t tfo_active_disable_times __read_mostly = ATOMIC_INIT(0);
406static unsigned long tfo_active_disable_stamp __read_mostly;
407
408/* Disable active TFO and record current jiffies and
409 * tfo_active_disable_times
410 */
Wei Wang46c2fa32017-04-20 14:45:47 -0700411void tcp_fastopen_active_disable(struct sock *sk)
Wei Wangcf1ef3f2017-04-20 14:45:46 -0700412{
413 atomic_inc(&tfo_active_disable_times);
414 tfo_active_disable_stamp = jiffies;
Wei Wang46c2fa32017-04-20 14:45:47 -0700415 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENBLACKHOLE);
Wei Wangcf1ef3f2017-04-20 14:45:46 -0700416}
417
418/* Reset tfo_active_disable_times to 0 */
419void tcp_fastopen_active_timeout_reset(void)
420{
421 atomic_set(&tfo_active_disable_times, 0);
422}
423
424/* Calculate timeout for tfo active disable
425 * Return true if we are still in the active TFO disable period
426 * Return false if timeout already expired and we should use active TFO
427 */
428bool tcp_fastopen_active_should_disable(struct sock *sk)
429{
430 int tfo_da_times = atomic_read(&tfo_active_disable_times);
431 int multiplier;
432 unsigned long timeout;
433
434 if (!tfo_da_times)
435 return false;
436
437 /* Limit timout to max: 2^6 * initial timeout */
438 multiplier = 1 << min(tfo_da_times - 1, 6);
439 timeout = multiplier * sysctl_tcp_fastopen_blackhole_timeout * HZ;
440 if (time_before(jiffies, tfo_active_disable_stamp + timeout))
441 return true;
442
443 /* Mark check bit so we can check for successful active TFO
444 * condition and reset tfo_active_disable_times
445 */
446 tcp_sk(sk)->syn_fastopen_ch = 1;
447 return false;
448}
449
450/* Disable active TFO if FIN is the only packet in the ofo queue
451 * and no data is received.
452 * Also check if we can reset tfo_active_disable_times if data is
453 * received successfully on a marked active TFO sockets opened on
454 * a non-loopback interface
455 */
456void tcp_fastopen_active_disable_ofo_check(struct sock *sk)
457{
458 struct tcp_sock *tp = tcp_sk(sk);
459 struct rb_node *p;
460 struct sk_buff *skb;
461 struct dst_entry *dst;
462
463 if (!tp->syn_fastopen)
464 return;
465
466 if (!tp->data_segs_in) {
467 p = rb_first(&tp->out_of_order_queue);
468 if (p && !rb_next(p)) {
469 skb = rb_entry(p, struct sk_buff, rbnode);
470 if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) {
Wei Wang46c2fa32017-04-20 14:45:47 -0700471 tcp_fastopen_active_disable(sk);
Wei Wangcf1ef3f2017-04-20 14:45:46 -0700472 return;
473 }
474 }
475 } else if (tp->syn_fastopen_ch &&
476 atomic_read(&tfo_active_disable_times)) {
477 dst = sk_dst_get(sk);
478 if (!(dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK)))
479 tcp_fastopen_active_timeout_reset();
480 dst_release(dst);
481 }
482}