@ -655,48 +655,77 @@ static unsigned tcp_synack_options(struct sock *sk,
struct request_sock * req ,
unsigned mss , struct sk_buff * skb ,
struct tcp_out_options * opts ,
struct tcp_md5sig_key * * md5 ) {
unsigned size = 0 ;
struct tcp_md5sig_key * * md5 ,
struct tcp_extend_values * xvp )
{
struct inet_request_sock * ireq = inet_rsk ( req ) ;
char doing_ts ;
unsigned remaining = MAX_TCP_OPTION_SPACE ;
u8 cookie_plus = ( xvp ! = NULL & & ! xvp - > cookie_out_never ) ?
xvp - > cookie_plus :
0 ;
bool doing_ts = ireq - > tstamp_ok ;
# ifdef CONFIG_TCP_MD5SIG
* md5 = tcp_rsk ( req ) - > af_specific - > md5_lookup ( sk , req ) ;
if ( * md5 ) {
opts - > options | = OPTION_MD5 ;
size + = TCPOLEN_MD5SIG_ALIGNED ;
remaining - = TCPOLEN_MD5SIG_ALIGNED ;
/* We can't fit any SACK blocks in a packet with MD5 + TS
* options . There was discussion about disabling SACK
* rather than TS in order to fit in better with old ,
* buggy kernels , but that was deemed to be unnecessary .
*/
doing_ts & = ! ireq - > sack_ok ;
}
# else
* md5 = NULL ;
# endif
/* we can't fit any SACK blocks in a packet with MD5 + TS
options . There was discussion about disabling SACK rather than TS in
order to fit in better with old , buggy kernels , but that was deemed
to be unnecessary . */
doing_ts = ireq - > tstamp_ok & & ! ( * md5 & & ireq - > sack_ok ) ;
/* We always send an MSS option. */
opts - > mss = mss ;
size + = TCPOLEN_MSS_ALIGNED ;
remaining - = TCPOLEN_MSS_ALIGNED ;
if ( likely ( ireq - > wscale_ok ) ) {
opts - > ws = ireq - > rcv_wscale ;
opts - > options | = OPTION_WSCALE ;
size + = TCPOLEN_WSCALE_ALIGNED ;
remaining - = TCPOLEN_WSCALE_ALIGNED ;
}
if ( likely ( doing_ts ) ) {
opts - > options | = OPTION_TS ;
opts - > tsval = TCP_SKB_CB ( skb ) - > when ;
opts - > tsecr = req - > ts_recent ;
size + = TCPOLEN_TSTAMP_ALIGNED ;
remaining - = TCPOLEN_TSTAMP_ALIGNED ;
}
if ( likely ( ireq - > sack_ok ) ) {
opts - > options | = OPTION_SACK_ADVERTISE ;
if ( unlikely ( ! doing_ts ) )
size + = TCPOLEN_SACKPERM_ALIGNED ;
remaining - = TCPOLEN_SACKPERM_ALIGNED ;
}
return size ;
/* Similar rationale to tcp_syn_options() applies here, too.
* If the < SYN > options fit , the same options should fit now !
*/
if ( * md5 = = NULL & &
doing_ts & &
cookie_plus > TCPOLEN_COOKIE_BASE ) {
int need = cookie_plus ; /* has TCPOLEN_COOKIE_BASE */
if ( 0x2 & need ) {
/* 32-bit multiple */
need + = 2 ; /* NOPs */
}
if ( need < = remaining ) {
opts - > options | = OPTION_COOKIE_EXTENSION ;
opts - > hash_size = cookie_plus - TCPOLEN_COOKIE_BASE ;
remaining - = need ;
} else {
/* There's no error return, so flag it. */
xvp - > cookie_out_never = 1 ; /* true */
opts - > hash_size = 0 ;
}
}
return MAX_TCP_OPTION_SPACE - remaining ;
}
/* Compute TCP options for ESTABLISHED sockets. This is not the
@ -2365,6 +2394,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
struct request_values * rvp )
{
struct tcp_out_options opts ;
struct tcp_extend_values * xvp = tcp_xv ( rvp ) ;
struct inet_request_sock * ireq = inet_rsk ( req ) ;
struct tcp_sock * tp = tcp_sk ( sk ) ;
struct tcphdr * th ;
@ -2408,8 +2438,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
# endif
TCP_SKB_CB ( skb ) - > when = tcp_time_stamp ;
tcp_header_size = tcp_synack_options ( sk , req , mss ,
skb , & opts , & md5 ) +
sizeof ( struct tcphdr ) ;
skb , & opts , & md5 , xvp )
+ sizeof ( * th ) ;
skb_push ( skb , tcp_header_size ) ;
skb_reset_transport_header ( skb ) ;
@ -2426,6 +2456,45 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
*/
tcp_init_nondata_skb ( skb , tcp_rsk ( req ) - > snt_isn ,
TCPCB_FLAG_SYN | TCPCB_FLAG_ACK ) ;
if ( OPTION_COOKIE_EXTENSION & opts . options ) {
const struct tcp_cookie_values * cvp = tp - > cookie_values ;
if ( cvp ! = NULL & &
cvp - > s_data_constant & &
cvp - > s_data_desired > 0 ) {
u8 * buf = skb_put ( skb , cvp - > s_data_desired ) ;
/* copy data directly from the listening socket. */
memcpy ( buf , cvp - > s_data_payload , cvp - > s_data_desired ) ;
TCP_SKB_CB ( skb ) - > end_seq + = cvp - > s_data_desired ;
}
if ( opts . hash_size > 0 ) {
__u32 workspace [ SHA_WORKSPACE_WORDS ] ;
u32 * mess = & xvp - > cookie_bakery [ COOKIE_DIGEST_WORDS ] ;
u32 * tail = & mess [ COOKIE_MESSAGE_WORDS - 1 ] ;
/* Secret recipe depends on the Timestamp, (future)
* Sequence and Acknowledgment Numbers , Initiator
* Cookie , and others handled by IP variant caller .
*/
* tail - - ^ = opts . tsval ;
* tail - - ^ = tcp_rsk ( req ) - > rcv_isn + 1 ;
* tail - - ^ = TCP_SKB_CB ( skb ) - > seq + 1 ;
/* recommended */
* tail - - ^ = ( ( th - > dest < < 16 ) | th - > source ) ;
* tail - - ^ = ( u32 ) cvp ; /* per sockopt */
sha_transform ( ( __u32 * ) & xvp - > cookie_bakery [ 0 ] ,
( char * ) mess ,
& workspace [ 0 ] ) ;
opts . hash_location =
( __u8 * ) & xvp - > cookie_bakery [ 0 ] ;
}
}
th - > seq = htonl ( TCP_SKB_CB ( skb ) - > seq ) ;
th - > ack_seq = htonl ( tcp_rsk ( req ) - > rcv_isn + 1 ) ;
William Allen Simpson
15 years ago
committed by