2 * INET An implementation of the TCP/IP protocol suite for the LINUX
3 * operating system. INET is implemented using the BSD Socket
4 * interface as the means of communication with the user level.
6 * Support for INET connection oriented protocols.
8 * Authors: See the TCP sources
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or(at your option) any later version.
16 #include <linux/module.h>
17 #include <linux/jhash.h>
19 #include <net/inet_connection_sock.h>
20 #include <net/inet_hashtables.h>
21 #include <net/inet_timewait_sock.h>
23 #include <net/route.h>
24 #include <net/tcp_states.h>
28 const char inet_csk_timer_bug_msg[] = "inet_csk BUG: unknown timer value\n";
29 EXPORT_SYMBOL(inet_csk_timer_bug_msg);
33 * This struct holds the first and last local port number.
35 struct local_ports sysctl_local_ports __read_mostly = {
36 .lock = __SEQLOCK_UNLOCKED(sysctl_local_ports.lock),
37 .range = { 32768, 61000 },
40 unsigned long *sysctl_local_reserved_ports;
41 EXPORT_SYMBOL(sysctl_local_reserved_ports);
43 void inet_get_local_port_range(int *low, int *high)
47 seq = read_seqbegin(&sysctl_local_ports.lock);
49 *low = sysctl_local_ports.range[0];
50 *high = sysctl_local_ports.range[1];
51 } while (read_seqretry(&sysctl_local_ports.lock, seq));
53 EXPORT_SYMBOL(inet_get_local_port_range);
55 int inet_csk_bind_conflict(const struct sock *sk,
56 const struct inet_bind_bucket *tb)
59 struct hlist_node *node;
60 int reuse = sk->sk_reuse;
63 * Unlike other sk lookup places we do not check
64 * for sk_net here, since _all_ the socks listed
65 * in tb->owners list belong to the same net - the
66 * one this bucket belongs to.
69 sk_for_each_bound(sk2, node, &tb->owners) {
71 !inet_v6_ipv6only(sk2) &&
72 (!sk->sk_bound_dev_if ||
73 !sk2->sk_bound_dev_if ||
74 sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
75 if (!reuse || !sk2->sk_reuse ||
76 sk2->sk_state == TCP_LISTEN) {
77 const __be32 sk2_rcv_saddr = sk_rcv_saddr(sk2);
78 if (!sk2_rcv_saddr || !sk_rcv_saddr(sk) ||
79 sk2_rcv_saddr == sk_rcv_saddr(sk))
86 EXPORT_SYMBOL_GPL(inet_csk_bind_conflict);
88 /* Obtain a reference to a local port for the given sock,
89 * if snum is zero it means select any available local port.
91 int inet_csk_get_port(struct sock *sk, unsigned short snum)
93 struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
94 struct inet_bind_hashbucket *head;
95 struct hlist_node *node;
96 struct inet_bind_bucket *tb;
97 int ret, attempts = 5;
98 struct net *net = sock_net(sk);
99 int smallest_size = -1, smallest_rover;
103 int remaining, rover, low, high;
106 inet_get_local_port_range(&low, &high);
107 remaining = (high - low) + 1;
108 smallest_rover = rover = net_random() % remaining + low;
112 if (inet_is_reserved_local_port(rover))
114 head = &hashinfo->bhash[inet_bhashfn(net, rover,
115 hashinfo->bhash_size)];
116 spin_lock(&head->lock);
117 inet_bind_bucket_for_each(tb, node, &head->chain)
118 if (net_eq(ib_net(tb), net) && tb->port == rover) {
119 if (tb->fastreuse > 0 &&
121 sk->sk_state != TCP_LISTEN &&
122 (tb->num_owners < smallest_size || smallest_size == -1)) {
123 smallest_size = tb->num_owners;
124 smallest_rover = rover;
125 if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
126 spin_unlock(&head->lock);
127 snum = smallest_rover;
131 if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
132 spin_unlock(&head->lock);
140 spin_unlock(&head->lock);
144 } while (--remaining > 0);
146 /* Exhausted local port range during search? It is not
147 * possible for us to be holding one of the bind hash
148 * locks if this test triggers, because if 'remaining'
149 * drops to zero, we broke out of the do/while loop at
150 * the top level, not from the 'break;' statement.
153 if (remaining <= 0) {
154 if (smallest_size != -1) {
155 snum = smallest_rover;
160 /* OK, here is the one we will use. HEAD is
161 * non-NULL and we hold it's mutex.
166 head = &hashinfo->bhash[inet_bhashfn(net, snum,
167 hashinfo->bhash_size)];
168 spin_lock(&head->lock);
169 inet_bind_bucket_for_each(tb, node, &head->chain)
170 if (net_eq(ib_net(tb), net) && tb->port == snum)
176 if (!hlist_empty(&tb->owners)) {
177 if (tb->fastreuse > 0 &&
178 sk->sk_reuse && sk->sk_state != TCP_LISTEN &&
179 smallest_size == -1) {
183 if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
184 if (sk->sk_reuse && sk->sk_state != TCP_LISTEN &&
185 smallest_size != -1 && --attempts >= 0) {
186 spin_unlock(&head->lock);
195 if (!tb && (tb = inet_bind_bucket_create(hashinfo->bind_bucket_cachep,
196 net, head, snum)) == NULL)
198 if (hlist_empty(&tb->owners)) {
199 if (sk->sk_reuse && sk->sk_state != TCP_LISTEN)
203 } else if (tb->fastreuse &&
204 (!sk->sk_reuse || sk->sk_state == TCP_LISTEN))
207 if (!inet_csk(sk)->icsk_bind_hash)
208 inet_bind_hash(sk, tb, snum);
209 WARN_ON(inet_csk(sk)->icsk_bind_hash != tb);
213 spin_unlock(&head->lock);
218 EXPORT_SYMBOL_GPL(inet_csk_get_port);
221 * Wait for an incoming connection, avoid race conditions. This must be called
222 * with the socket locked.
224 static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
226 struct inet_connection_sock *icsk = inet_csk(sk);
231 * True wake-one mechanism for incoming connections: only
232 * one process gets woken up, not the 'whole herd'.
233 * Since we do not 'race & poll' for established sockets
234 * anymore, the common case will execute the loop only once.
236 * Subtle issue: "add_wait_queue_exclusive()" will be added
237 * after any current non-exclusive waiters, and we know that
238 * it will always _stay_ after any new non-exclusive waiters
239 * because all non-exclusive waiters are added at the
240 * beginning of the wait-queue. As such, it's ok to "drop"
241 * our exclusiveness temporarily when we get woken up without
242 * having to remove and re-insert us on the wait queue.
245 prepare_to_wait_exclusive(sk_sleep(sk), &wait,
248 if (reqsk_queue_empty(&icsk->icsk_accept_queue))
249 timeo = schedule_timeout(timeo);
252 if (!reqsk_queue_empty(&icsk->icsk_accept_queue))
255 if (sk->sk_state != TCP_LISTEN)
257 err = sock_intr_errno(timeo);
258 if (signal_pending(current))
264 finish_wait(sk_sleep(sk), &wait);
269 * This will accept the next outstanding connection.
271 struct sock *inet_csk_accept(struct sock *sk, int flags, int *err)
273 struct inet_connection_sock *icsk = inet_csk(sk);
279 /* We need to make sure that this socket is listening,
280 * and that it has something pending.
283 if (sk->sk_state != TCP_LISTEN)
286 /* Find already established connection */
287 if (reqsk_queue_empty(&icsk->icsk_accept_queue)) {
288 long timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
290 /* If this is a non blocking socket don't sleep */
295 error = inet_csk_wait_for_connect(sk, timeo);
300 newsk = reqsk_queue_get_child(&icsk->icsk_accept_queue, sk);
301 WARN_ON(newsk->sk_state == TCP_SYN_RECV);
310 EXPORT_SYMBOL(inet_csk_accept);
313 * Using different timers for retransmit, delayed acks and probes
314 * We may wish use just one timer maintaining a list of expire jiffies
317 void inet_csk_init_xmit_timers(struct sock *sk,
318 void (*retransmit_handler)(unsigned long),
319 void (*delack_handler)(unsigned long),
320 void (*keepalive_handler)(unsigned long))
322 struct inet_connection_sock *icsk = inet_csk(sk);
324 setup_timer(&icsk->icsk_retransmit_timer, retransmit_handler,
326 setup_timer(&icsk->icsk_delack_timer, delack_handler,
328 setup_timer(&sk->sk_timer, keepalive_handler, (unsigned long)sk);
329 icsk->icsk_pending = icsk->icsk_ack.pending = 0;
331 EXPORT_SYMBOL(inet_csk_init_xmit_timers);
333 void inet_csk_clear_xmit_timers(struct sock *sk)
335 struct inet_connection_sock *icsk = inet_csk(sk);
337 icsk->icsk_pending = icsk->icsk_ack.pending = icsk->icsk_ack.blocked = 0;
339 sk_stop_timer(sk, &icsk->icsk_retransmit_timer);
340 sk_stop_timer(sk, &icsk->icsk_delack_timer);
341 sk_stop_timer(sk, &sk->sk_timer);
343 EXPORT_SYMBOL(inet_csk_clear_xmit_timers);
345 void inet_csk_delete_keepalive_timer(struct sock *sk)
347 sk_stop_timer(sk, &sk->sk_timer);
349 EXPORT_SYMBOL(inet_csk_delete_keepalive_timer);
351 void inet_csk_reset_keepalive_timer(struct sock *sk, unsigned long len)
353 sk_reset_timer(sk, &sk->sk_timer, jiffies + len);
355 EXPORT_SYMBOL(inet_csk_reset_keepalive_timer);
357 struct dst_entry *inet_csk_route_req(struct sock *sk,
359 const struct request_sock *req)
362 const struct inet_request_sock *ireq = inet_rsk(req);
363 struct ip_options_rcu *opt = inet_rsk(req)->opt;
364 struct net *net = sock_net(sk);
366 flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
367 RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
368 sk->sk_protocol, inet_sk_flowi_flags(sk),
369 (opt && opt->opt.srr) ? opt->opt.faddr : ireq->rmt_addr,
370 ireq->loc_addr, ireq->rmt_port, inet_sk(sk)->inet_sport);
371 security_req_classify_flow(req, flowi4_to_flowi(fl4));
372 rt = ip_route_output_flow(net, fl4, sk);
375 if (opt && opt->opt.is_strictroute && fl4->daddr != rt->rt_gateway)
382 IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
385 EXPORT_SYMBOL_GPL(inet_csk_route_req);
387 struct dst_entry *inet_csk_route_child_sock(struct sock *sk,
389 const struct request_sock *req)
391 const struct inet_request_sock *ireq = inet_rsk(req);
392 struct inet_sock *newinet = inet_sk(newsk);
393 struct ip_options_rcu *opt = ireq->opt;
394 struct net *net = sock_net(sk);
398 fl4 = &newinet->cork.fl.u.ip4;
399 flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
400 RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
401 sk->sk_protocol, inet_sk_flowi_flags(sk),
402 (opt && opt->opt.srr) ? opt->opt.faddr : ireq->rmt_addr,
403 ireq->loc_addr, ireq->rmt_port, inet_sk(sk)->inet_sport);
404 security_req_classify_flow(req, flowi4_to_flowi(fl4));
405 rt = ip_route_output_flow(net, fl4, sk);
408 if (opt && opt->opt.is_strictroute && fl4->daddr != rt->rt_gateway)
415 IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
418 EXPORT_SYMBOL_GPL(inet_csk_route_child_sock);
420 static inline u32 inet_synq_hash(const __be32 raddr, const __be16 rport,
421 const u32 rnd, const u32 synq_hsize)
423 return jhash_2words((__force u32)raddr, (__force u32)rport, rnd) & (synq_hsize - 1);
426 #if IS_ENABLED(CONFIG_IPV6)
427 #define AF_INET_FAMILY(fam) ((fam) == AF_INET)
429 #define AF_INET_FAMILY(fam) 1
432 struct request_sock *inet_csk_search_req(const struct sock *sk,
433 struct request_sock ***prevp,
434 const __be16 rport, const __be32 raddr,
437 const struct inet_connection_sock *icsk = inet_csk(sk);
438 struct listen_sock *lopt = icsk->icsk_accept_queue.listen_opt;
439 struct request_sock *req, **prev;
441 for (prev = &lopt->syn_table[inet_synq_hash(raddr, rport, lopt->hash_rnd,
442 lopt->nr_table_entries)];
443 (req = *prev) != NULL;
444 prev = &req->dl_next) {
445 const struct inet_request_sock *ireq = inet_rsk(req);
447 if (ireq->rmt_port == rport &&
448 ireq->rmt_addr == raddr &&
449 ireq->loc_addr == laddr &&
450 AF_INET_FAMILY(req->rsk_ops->family)) {
459 EXPORT_SYMBOL_GPL(inet_csk_search_req);
461 void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req,
462 unsigned long timeout)
464 struct inet_connection_sock *icsk = inet_csk(sk);
465 struct listen_sock *lopt = icsk->icsk_accept_queue.listen_opt;
466 const u32 h = inet_synq_hash(inet_rsk(req)->rmt_addr, inet_rsk(req)->rmt_port,
467 lopt->hash_rnd, lopt->nr_table_entries);
469 reqsk_queue_hash_req(&icsk->icsk_accept_queue, h, req, timeout);
470 inet_csk_reqsk_queue_added(sk, timeout);
472 EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add);
474 /* Only thing we need from tcp.h */
475 extern int sysctl_tcp_synack_retries;
478 /* Decide when to expire the request and when to resend SYN-ACK */
479 static inline void syn_ack_recalc(struct request_sock *req, const int thresh,
480 const int max_retries,
481 const u8 rskq_defer_accept,
482 int *expire, int *resend)
484 if (!rskq_defer_accept) {
485 *expire = req->retrans >= thresh;
489 *expire = req->retrans >= thresh &&
490 (!inet_rsk(req)->acked || req->retrans >= max_retries);
492 * Do not resend while waiting for data after ACK,
493 * start to resend on end of deferring period to give
494 * last chance for data or ACK to create established socket.
496 *resend = !inet_rsk(req)->acked ||
497 req->retrans >= rskq_defer_accept - 1;
500 void inet_csk_reqsk_queue_prune(struct sock *parent,
501 const unsigned long interval,
502 const unsigned long timeout,
503 const unsigned long max_rto)
505 struct inet_connection_sock *icsk = inet_csk(parent);
506 struct request_sock_queue *queue = &icsk->icsk_accept_queue;
507 struct listen_sock *lopt = queue->listen_opt;
508 int max_retries = icsk->icsk_syn_retries ? : sysctl_tcp_synack_retries;
509 int thresh = max_retries;
510 unsigned long now = jiffies;
511 struct request_sock **reqp, *req;
514 if (lopt == NULL || lopt->qlen == 0)
517 /* Normally all the openreqs are young and become mature
518 * (i.e. converted to established socket) for first timeout.
519 * If synack was not acknowledged for 3 seconds, it means
520 * one of the following things: synack was lost, ack was lost,
521 * rtt is high or nobody planned to ack (i.e. synflood).
522 * When server is a bit loaded, queue is populated with old
523 * open requests, reducing effective size of queue.
524 * When server is well loaded, queue size reduces to zero
525 * after several minutes of work. It is not synflood,
526 * it is normal operation. The solution is pruning
527 * too old entries overriding normal timeout, when
528 * situation becomes dangerous.
530 * Essentially, we reserve half of room for young
531 * embrions; and abort old ones without pity, if old
532 * ones are about to clog our table.
534 if (lopt->qlen>>(lopt->max_qlen_log-1)) {
535 int young = (lopt->qlen_young<<1);
538 if (lopt->qlen < young)
545 if (queue->rskq_defer_accept)
546 max_retries = queue->rskq_defer_accept;
548 budget = 2 * (lopt->nr_table_entries / (timeout / interval));
549 i = lopt->clock_hand;
552 reqp=&lopt->syn_table[i];
553 while ((req = *reqp) != NULL) {
554 if (time_after_eq(now, req->expires)) {
555 int expire = 0, resend = 0;
557 syn_ack_recalc(req, thresh, max_retries,
558 queue->rskq_defer_accept,
560 if (req->rsk_ops->syn_ack_timeout)
561 req->rsk_ops->syn_ack_timeout(parent, req);
564 !req->rsk_ops->rtx_syn_ack(parent, req, NULL) ||
565 inet_rsk(req)->acked)) {
568 if (req->retrans++ == 0)
570 timeo = min((timeout << req->retrans), max_rto);
571 req->expires = now + timeo;
572 reqp = &req->dl_next;
576 /* Drop this request */
577 inet_csk_reqsk_queue_unlink(parent, req, reqp);
578 reqsk_queue_removed(queue, req);
582 reqp = &req->dl_next;
585 i = (i + 1) & (lopt->nr_table_entries - 1);
587 } while (--budget > 0);
589 lopt->clock_hand = i;
592 inet_csk_reset_keepalive_timer(parent, interval);
594 EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_prune);
597 * inet_csk_clone_lock - clone an inet socket, and lock its clone
598 * @sk: the socket to clone
600 * @priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
602 * Caller must unlock socket even in error path (bh_unlock_sock(newsk))
604 struct sock *inet_csk_clone_lock(const struct sock *sk,
605 const struct request_sock *req,
606 const gfp_t priority)
608 struct sock *newsk = sk_clone_lock(sk, priority);
611 struct inet_connection_sock *newicsk = inet_csk(newsk);
613 newsk->sk_state = TCP_SYN_RECV;
614 newicsk->icsk_bind_hash = NULL;
616 inet_sk(newsk)->inet_dport = inet_rsk(req)->rmt_port;
617 inet_sk(newsk)->inet_num = ntohs(inet_rsk(req)->loc_port);
618 inet_sk(newsk)->inet_sport = inet_rsk(req)->loc_port;
619 newsk->sk_write_space = sk_stream_write_space;
621 newicsk->icsk_retransmits = 0;
622 newicsk->icsk_backoff = 0;
623 newicsk->icsk_probes_out = 0;
625 /* Deinitialize accept_queue to trap illegal accesses. */
626 memset(&newicsk->icsk_accept_queue, 0, sizeof(newicsk->icsk_accept_queue));
628 security_inet_csk_clone(newsk, req);
632 EXPORT_SYMBOL_GPL(inet_csk_clone_lock);
635 * At this point, there should be no process reference to this
636 * socket, and thus no user references at all. Therefore we
637 * can assume the socket waitqueue is inactive and nobody will
638 * try to jump onto it.
640 void inet_csk_destroy_sock(struct sock *sk)
642 WARN_ON(sk->sk_state != TCP_CLOSE);
643 WARN_ON(!sock_flag(sk, SOCK_DEAD));
645 /* It cannot be in hash table! */
646 WARN_ON(!sk_unhashed(sk));
648 /* If it has not 0 inet_sk(sk)->inet_num, it must be bound */
649 WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);
651 sk->sk_prot->destroy(sk);
653 sk_stream_kill_queues(sk);
655 xfrm_sk_free_policy(sk);
657 sk_refcnt_debug_release(sk);
659 percpu_counter_dec(sk->sk_prot->orphan_count);
662 EXPORT_SYMBOL(inet_csk_destroy_sock);
664 int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
666 struct inet_sock *inet = inet_sk(sk);
667 struct inet_connection_sock *icsk = inet_csk(sk);
668 int rc = reqsk_queue_alloc(&icsk->icsk_accept_queue, nr_table_entries);
673 sk->sk_max_ack_backlog = 0;
674 sk->sk_ack_backlog = 0;
675 inet_csk_delack_init(sk);
677 /* There is race window here: we announce ourselves listening,
678 * but this transition is still not validated by get_port().
679 * It is OK, because this socket enters to hash table only
680 * after validation is complete.
682 sk->sk_state = TCP_LISTEN;
683 if (!sk->sk_prot->get_port(sk, inet->inet_num)) {
684 inet->inet_sport = htons(inet->inet_num);
687 sk->sk_prot->hash(sk);
692 sk->sk_state = TCP_CLOSE;
693 __reqsk_queue_destroy(&icsk->icsk_accept_queue);
696 EXPORT_SYMBOL_GPL(inet_csk_listen_start);
699 * This routine closes sockets which have been at least partially
700 * opened, but not yet accepted.
702 void inet_csk_listen_stop(struct sock *sk)
704 struct inet_connection_sock *icsk = inet_csk(sk);
705 struct request_sock *acc_req;
706 struct request_sock *req;
708 inet_csk_delete_keepalive_timer(sk);
710 /* make all the listen_opt local to us */
711 acc_req = reqsk_queue_yank_acceptq(&icsk->icsk_accept_queue);
713 /* Following specs, it would be better either to send FIN
714 * (and enter FIN-WAIT-1, it is normal close)
715 * or to send active reset (abort).
716 * Certainly, it is pretty dangerous while synflood, but it is
717 * bad justification for our negligence 8)
718 * To be honest, we are not able to make either
719 * of the variants now. --ANK
721 reqsk_queue_destroy(&icsk->icsk_accept_queue);
723 while ((req = acc_req) != NULL) {
724 struct sock *child = req->sk;
726 acc_req = req->dl_next;
730 WARN_ON(sock_owned_by_user(child));
733 sk->sk_prot->disconnect(child, O_NONBLOCK);
737 percpu_counter_inc(sk->sk_prot->orphan_count);
739 inet_csk_destroy_sock(child);
741 bh_unlock_sock(child);
745 sk_acceptq_removed(sk);
748 WARN_ON(sk->sk_ack_backlog);
750 EXPORT_SYMBOL_GPL(inet_csk_listen_stop);
752 void inet_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr)
754 struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
755 const struct inet_sock *inet = inet_sk(sk);
757 sin->sin_family = AF_INET;
758 sin->sin_addr.s_addr = inet->inet_daddr;
759 sin->sin_port = inet->inet_dport;
761 EXPORT_SYMBOL_GPL(inet_csk_addr2sockaddr);
764 int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname,
765 char __user *optval, int __user *optlen)
767 const struct inet_connection_sock *icsk = inet_csk(sk);
769 if (icsk->icsk_af_ops->compat_getsockopt != NULL)
770 return icsk->icsk_af_ops->compat_getsockopt(sk, level, optname,
772 return icsk->icsk_af_ops->getsockopt(sk, level, optname,
775 EXPORT_SYMBOL_GPL(inet_csk_compat_getsockopt);
777 int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname,
778 char __user *optval, unsigned int optlen)
780 const struct inet_connection_sock *icsk = inet_csk(sk);
782 if (icsk->icsk_af_ops->compat_setsockopt != NULL)
783 return icsk->icsk_af_ops->compat_setsockopt(sk, level, optname,
785 return icsk->icsk_af_ops->setsockopt(sk, level, optname,
788 EXPORT_SYMBOL_GPL(inet_csk_compat_setsockopt);