学步园

2010-01-30 21:34:55

和前面一样，被动连接方也进入tcp_v4_hnd_req函数处理，不过由于前面受到SYN时已经建立了连接请求（假设SYNCOOKIES没启用），

inet_csk_search_req函数返回建立的连接请求结构request_sock。

流程进入tcp_check_req处理

/*<br /> * Process an incoming packet for SYN_RECV sockets represented<br /> * as a request_sock.<br /> */</p> <p>struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,<br /> struct request_sock *req,<br /> struct request_sock **prev)<br /> {<br /> const struct tcphdr *th = tcp_hdr(skb);<br /> __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);<br /> int paws_reject = 0;<br /> struct tcp_options_received tmp_opt;<br /> struct sock *child;</p> <p> tmp_opt.saw_tstamp = 0;<br /> /* 如果存在TCP选项，解析它 */<br /> if (th->doff > (sizeof(struct tcphdr)>>2)) {<br /> tcp_parse_options(skb, &tmp_opt, 0);</p> <p> if (tmp_opt.saw_tstamp) {<br /> tmp_opt.ts_recent = req->ts_recent;<br /> /* We do not store true stamp, but it is not required,<br /> * it can be estimated (approximately)<br /> * from another data.<br /> */<br /> tmp_opt.ts_recent_stamp = get_seconds() - ((TCP_TIMEOUT_INIT/HZ)<<req->retrans);<br /> paws_reject = tcp_paws_check(&tmp_opt, th->rst);<br /> }<br /> }</p> <p> /* Check for pure retransmitted SYN. */<br /> if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&<br /> flg == TCP_FLAG_SYN &&<br /> !paws_reject) {<br /> /*<br /> * RFC793 draws (Incorrectly! It was fixed in RFC1122)<br /> * this case on figure 6 and figure 8, but formal<br /> * protocol description says NOTHING.<br /> * To be more exact, it says that we should send ACK,<br /> * because this segment (at least, if it has no data)<br /> * is out of window.<br /> *<br /> * CONCLUSION: RFC793 (even with RFC1122) DOES NOT<br /> * describe SYN-RECV state. All the description<br /> * is wrong, we cannot believe to it and should<br /> * rely only on common sense and implementation<br /> * experience.<br /> *<br /> * Enforce "SYN-ACK" according to figure 8, figure 6<br /> * of RFC793, fixed by RFC1122.<br /> */<br /> req->rsk_ops->rtx_syn_ack(sk, req);<br /> return NULL;<br /> }</p> <p> /* Further reproduces section "SEGMENT ARRIVES"<br /> for state SYN-RECEIVED of RFC793.<br /> It is broken, however, it does not work only<br /> when SYNs are crossed.</p> <p> You would think that SYN crossing is impossible here, since<br /> we should have a SYN_SENT socket (from connect()) on our end,<br /> but this is not true if the crossed SYNs were sent to both<br /> ends by a malicious third party. We must defend against this,<br /> and to do that we first verify the ACK (as per RFC793, page<br /> 36) and reset if it is invalid. Is this a true full defense?<br /> To convince ourselves, let us consider a way in which the ACK<br /> test can still pass in this 'malicious crossed SYNs' case.<br /> Malicious sender sends identical SYNs (and thus identical sequence<br /> numbers) to both A and B:</p> <p> A: gets SYN, seq=7<br /> B: gets SYN, seq=7</p> <p> By our good fortune, both A and B select the same initial<br /> send sequence number of seven <img src="https://admin.xuebuyuan.com/wp-includes/images/smilies/icon_smile.gif" alt=":-)" class="wp-smiley" /> </p> <p> A: sends SYN|ACK, seq=7, ack_seq=8<br /> B: sends SYN|ACK, seq=7, ack_seq=8</p> <p> So we are now A eating this SYN|ACK, ACK test passes. So<br /> does sequence test, SYN is truncated, and thus we consider<br /> it a bare ACK.</p> <p> If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this<br /> bare ACK. Otherwise, we create an established connection. Both<br /> ends (listening sockets) accept the new incoming connection and try<br /> to talk to each other. <img src="https://admin.xuebuyuan.com/wp-includes/images/smilies/icon_cool.gif" alt="8-)" class="wp-smiley" /> </p> <p> Note: This case is both harmless, and rare. Possibility is about the<br /> same as us discovering intelligent life on another plant tomorrow.</p> <p> But generally, we should (RFC lies!) to accept ACK<br /> from SYNACK both here and in tcp_rcv_state_process().<br /> tcp_rcv_state_process() does not, hence, we do not too.</p> <p> Note that the case is absolutely generic:<br /> we cannot optimize anything here without<br /> violating protocol. All the checks must be made<br /> before attempt to create socket.<br /> */</p> <p> /* RFC793 page 36: "If the connection is in any non-synchronized state ...<br /> * and the incoming segment acknowledges something not yet<br /> * sent (the segment carries an unacceptable ACK) ...<br /> * a reset is sent."<br /> *<br /> * Invalid ACK: reset will be sent by listening socket<br /> */<br /> if ((flg & TCP_FLAG_ACK) &&<br /> (TCP_SKB_CB(skb)->ack_seq != tcp_rsk(req)->snt_isn + 1))<br /> return sk;</p> <p> /* Also, it would be not so bad idea to check rcv_tsecr, which<br /> * is essentially ACK extension and too early or too late values<br /> * should cause reset in unsynchronized states.<br /> */</p> <p> /* RFC793: "first check sequence number". */</p> <p> if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,<br /> tcp_rsk(req)->rcv_isn + 1, tcp_rsk(req)->rcv_isn + 1 + req->rcv_wnd)) {<br /> /* Out of window: send ACK and drop. */<br /> if (!(flg & TCP_FLAG_RST))<br /> req->rsk_ops->send_ack(sk, skb, req);<br /> if (paws_reject)<br /> NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);<br /> return NULL;<br /> }</p> <p> /* In sequence, PAWS is OK. */</p> <p> if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_isn + 1))<br /> req->ts_recent = tmp_opt.rcv_tsval;</p> <p> if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {<br /> /* Truncate SYN, it is out of window starting<br /> at tcp_rsk(req)->rcv_isn + 1. */<br /> flg &= ~TCP_FLAG_SYN;<br /> }</p> <p> /* RFC793: "second check the RST bit" and<br /> * "fourth, check the SYN bit"<br /> */<br /> if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {<br /> TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_ATTEMPTFAILS);<br /> goto embryonic_reset;<br /> }</p> <p> /* ACK sequence verified above, just make sure ACK is<br /> * set. If ACK not set, just silently drop the packet.<br /> */<br /> if (!(flg & TCP_FLAG_ACK))<br /> return NULL;</p> <p> /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */<br /> if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&<br /> TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {<br /> inet_rsk(req)->acked = 1;<br /> return NULL;<br /> }</p> <p> /* OK, ACK is valid, create big socket and<br /> * feed this segment to it. It will repeat all<br /> * the tests. THIS SEGMENT MUST MOVE SOCKET TO<br /> * ESTABLISHED STATE. If it will be dropped after<br /> * socket is created, wait for troubles.<br /> */<br /> child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL);<br /> if (child == NULL)<br /> goto listen_overflow;<br /> #ifdef CONFIG_TCP_MD5SIG<br /> else {<br /> /* Copy over the MD5 key from the original socket */<br /> struct tcp_md5sig_key *key;<br /> struct tcp_sock *tp = tcp_sk(sk);<br /> key = tp->af_specific->md5_lookup(sk, child);<br /> if (key != NULL) {<br /> /*<br /> * We're using one, so create a matching key on the<br /> * newsk structure. If we fail to get memory then we<br /> * end up not copying the key across. Shucks.<br /> */<br /> char *newkey = kmemdup(key->key, key->keylen,<br /> GFP_ATOMIC);<br /> if (newkey) {<br /> if (!tcp_alloc_md5sig_pool())<br /> BUG();<br /> tp->af_specific->md5_add(child, child, newkey,<br /> key->keylen);<br /> }<br /> }<br /> }<br /> #endif</p> <p> inet_csk_reqsk_queue_unlink(sk, req, prev);<br /> inet_csk_reqsk_queue_removed(sk, req);</p> <p> inet_csk_reqsk_queue_add(sk, req, child);<br /> return child;</p> <p>listen_overflow:<br /> if (!sysctl_tcp_abort_on_overflow) {<br /> inet_rsk(req)->acked = 1;<br /> return NULL;<br /> }</p> <p>embryonic_reset:<br /> NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);<br /> if (!(flg & TCP_FLAG_RST))<br /> req->rsk_ops->send_reset(sk, skb);</p> <p> inet_csk_reqsk_queue_drop(sk, req, prev);<br /> return NULL;<br /> }<br />

该函数的前面部分进行各种检查，然后通过后调用icsk_af_ops的syn_recv_sock操作符也即tcp_v4_syn_recv_sock函数，它的主要作用是

从request_sock中构造新的sock结构，并赋值相应的成员。

/*<br /> * The three way handshake has completed - we got a valid synack -<br /> * now create the new socket.<br /> */<br /> struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,<br /> struct request_sock *req,<br /> struct dst_entry *dst)<br /> {<br /> struct inet_request_sock *ireq;<br /> struct inet_sock *newinet;<br /> struct tcp_sock *newtp;<br /> struct sock *newsk;<br /> #ifdef CONFIG_TCP_MD5SIG<br /> struct tcp_md5sig_key *key;<br /> #endif<br /> /* 接收队列已满 */<br /> if (sk_acceptq_is_full(sk))<br /> goto exit_overflow;</p> <p> if (!dst && (dst = inet_csk_route_req(sk, req)) == NULL)<br /> goto exit;<br /> /* 创建新的sock结构，并用req和skb来初始化 */<br /> newsk = tcp_create_openreq_child(sk, req, skb);<br /> if (!newsk)<br /> goto exit;</p> <p> newsk->sk_gso_type = SKB_GSO_TCPV4;<br /> sk_setup_caps(newsk, dst);<br /> /* 相关赋值 */<br /> newtp = tcp_sk(newsk);<br /> newinet = inet_sk(newsk);<br /> ireq = inet_rsk(req);<br /> newinet->daddr = ireq->rmt_addr;<br /> newinet->rcv_saddr = ireq->loc_addr;<br /> newinet->saddr = ireq->loc_addr;<br /> newinet->opt = ireq->opt;<br /> ireq->opt = NULL;<br /> newinet->mc_index = inet_iif(skb);<br /> newinet->mc_ttl = ip_hdr(skb)->ttl;<br /> inet_csk(newsk)->icsk_ext_hdr_len = 0;<br /> if (newinet->opt)<br /> inet_csk(newsk)->icsk_ext_hdr_len = newinet->opt->optlen;<br /> newinet->id = newtp->write_seq ^ jiffies;</p> <p> tcp_mtup_init(newsk);<br /> tcp_sync_mss(newsk, dst_mtu(dst));<br /> newtp->advmss = dst_metric(dst, RTAX_ADVMSS);<br /> if (tcp_sk(sk)->rx_opt.user_mss &&<br /> tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)<br /> newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;</p> <p> tcp_initialize_rcv_mss(newsk);</p> <p>#ifdef CONFIG_TCP_MD5SIG<br /> /* Copy over the MD5 key from the original socket */<br /> if ((key = tcp_v4_md5_do_lookup(sk, newinet->daddr)) != NULL) {<br /> /*<br /> * We're using one, so create a matching key<br /> * on the newsk structure. If we fail to get<br /> * memory, then we end up not copying the key<br /> * across. Shucks.<br /> */<br /> char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);<br /> if (newkey != NULL)<br /> tcp_v4_md5_do_add(newsk, inet_sk(sk)->daddr,<br /> newkey, key->keylen);<br /> newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;<br /> }<br /> #endif<br /> /* 将该sock加入到nolisten的hash表中，以供查询*/<br /> __inet_hash_nolisten(newsk);<br /> /* 和sk共有端口，直接加入对应的hash桶的owner列表中 */<br /> __inet_inherit_port(sk, newsk);</p> <p> return newsk;</p> <p>exit_overflow:<br /> NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);<br /> exit:<br /> NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);<br /> dst_release(dst);<br /> return NULL;<br /> }

再看看tcp_create_openreq_child函数

/* This is not only more efficient than what we used to do, it eliminates<br /> * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM<br /> *<br /> * Actually, we could lots of memory writes here. tp of listening<br /> * socket contains all necessary default parameters.<br /> */<br /> struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb)<br /> {<br /> struct sock *newsk = inet_csk_clone(sk, req, GFP_ATOMIC);</p> <p> if (newsk != NULL) {<br /> const struct inet_request_sock *ireq = inet_rsk(req);<br /> struct tcp_request_sock *treq = tcp_rsk(req);<br /> struct inet_connection_sock *newicsk = inet_csk(newsk);<br /> struct tcp_sock *newtp;</p> <p> /* Now setup tcp_sock */<br /> newtp = tcp_sk(newsk);<br /> newtp->pred_flags = 0;<br /> /* 更新滑动窗口 */<br /> newtp->rcv_wup = newtp->copied_seq = newtp->rcv_nxt = treq->rcv_isn + 1;<br /> newtp->snd_sml = newtp->snd_una = newtp->snd_nxt = treq->snt_isn + 1;<br /> newtp->snd_up = treq->snt_isn + 1;</p> <p> tcp_prequeue_init(newtp);</p> <p> tcp_init_wl(newtp, treq->snt_isn, treq->rcv_isn);</p> <p> newtp->srtt = 0;<br /> newtp->mdev = TCP_TIMEOUT_INIT;<br /> newicsk->icsk_rto = TCP_TIMEOUT_INIT;</p> <p> newtp->packets_out = 0;<br /> newtp->retrans_out = 0;<br /> newtp->sacked_out = 0;<br /> newtp->fackets_out = 0;<br /> newtp->snd_ssthresh = 0x7fffffff;</p> <p> /* So many TCP implementations out there (incorrectly) count the<br /> * initial SYN frame in their delayed-ACK and congestion control<br /> * algorithms that we must have the following bandaid to talk<br /> * efficiently to them. -DaveM<br /> */<br /> newtp->snd_cwnd = 2;<br /> newtp->snd_cwnd_cnt = 0;<br /> newtp->bytes_acked = 0;</p> <p> newtp->frto_counter = 0;<br /> newtp->frto_highmark = 0;</p> <p> newicsk->icsk_ca_ops = &tcp_init_congestion_ops;</p> <p> tcp_set_ca_state(newsk, TCP_CA_Open);<br /> tcp_init_xmit_timers(newsk);<br /> skb_queue_head_init(&newtp->out_of_order_queue);<br /> newtp->write_seq = treq->snt_isn + 1;<br /> newtp->pushed_seq = newtp->write_seq;</p> <p> newtp->rx_opt.saw_tstamp = 0;</p> <p> newtp->rx_opt.dsack = 0;<br /> newtp->rx_opt.eff_sacks = 0;</p> <p> newtp->rx_opt.num_sacks = 0;<br /> newtp->urg_data = 0;</p> <p> if (sock_flag(newsk, SOCK_KEEPOPEN))<br /> inet_csk_reset_keepalive_timer(newsk,<br /> keepalive_time_when(newtp));</p> <p> newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;<br /> if ((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {<br /> if (sysctl_tcp_fack)<br /> tcp_enable_fack(newtp);<br /> }<br /> newtp->window_clamp = req->window_clamp;<br /> newtp->rcv_ssthresh = req->rcv_wnd;<br /> newtp->rcv_wnd = req->rcv_wnd;<br /> newtp->rx_opt.wscale_ok = ireq->wscale_ok;<br /> if (newtp->rx_opt.wscale_ok) {<br /> newtp->rx_opt.snd_wscale = ireq->snd_wscale;<br /> newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;<br /> } else {<br /> newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;<br /> newtp->window_clamp = min(newtp->window_clamp, 65535U);<br /> }<br /> newtp->snd_wnd = (ntohs(tcp_hdr(skb)->window) <<<br /> newtp->rx_opt.snd_wscale);<br /> newtp->max_window = newtp->snd_wnd;</p> <p> if (newtp->rx_opt.tstamp_ok) {<br /> newtp->rx_opt.ts_recent = req->ts_recent;<br /> newtp->rx_opt.ts_recent_stamp = get_seconds();<br /> newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;<br /> } else {<br /> newtp->rx_opt.ts_recent_stamp = 0;<br /> newtp->tcp_header_len = sizeof(struct tcphdr);<br /> }<br /> #ifdef CONFIG_TCP_MD5SIG<br /> newtp->md5sig_info = NULL; /*XXX*/<br /> if (newtp->af_specific->md5_lookup(sk, newsk))<br /> newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;<br /> #endif<br /> if (skb->len >= TCP_MIN_RCVMSS+newtp->tcp_header_len)<br /> newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;<br /> newtp->rx_opt.mss_clamp = req->mss;<br /> TCP_ECN_openreq_child(newtp, req);</p> <p> TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_PASSIVEOPENS);<br /> }<br /> return newsk;<br /> }<br />

从tcp_check_req返回后，流程进入tcp_child_process

/*<br /> * Queue segment on the new socket if the new socket is active,<br /> * otherwise we just shortcircuit this and continue with<br /> * the new socket.<br /> */</p> <p>int tcp_child_process(struct sock *parent, struct sock *child,<br /> struct sk_buff *skb)<br /> {<br /> int ret = 0;<br /> int state = child->sk_state;</p> <p> if (!sock_owned_by_user(child)) {<br /> ret = tcp_rcv_state_process(child, skb, tcp_hdr(skb),<br /> skb->len);<br /> /* Wakeup parent, send SIGIO */<br /> if (state == TCP_SYN_RECV && child->sk_state != state)<br /> parent->sk_data_ready(parent, 0);<br /> } else {<br /> /* Alas, it is possible again, because we do lookup<br /> * in main socket hash table and lock on listening<br /> * socket does not protect us more.<br /> */<br /> sk_add_backlog(child, skb);<br /> }</p> <p> bh_unlock_sock(child);<br /> sock_put(child);<br /> return ret;<br /> }<br />

随后再次进入tcp_recv_state_process

res = tcp_validate_incoming(sk, skb, th, 0);<br /> if (res <= 0)<br /> return -res;</p> <p> /* step 5: check the ACK field */<br /> if (th->ack) {<br /> int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH);</p> <p> switch (sk->sk_state) {<br /> case TCP_SYN_RECV:<br /> if (acceptable) {<br /> tp->copied_seq = tp->rcv_nxt;<br /> smp_mb();<br /> tcp_set_state(sk, TCP_ESTABLISHED);<br /> sk->sk_state_change(sk);</p> <p> /* Note, that this wakeup is only for marginal<br /> * crossed SYN case. Passively open sockets<br /> * are not waked up, because sk->sk_sleep ==<br /> * NULL and sk->sk_socket == NULL.<br /> */<br /> if (sk->sk_socket)<br /> sk_wake_async(sk,<br /> SOCK_WAKE_IO, POLL_OUT);</p> <p> tp->snd_una = TCP_SKB_CB(skb)->ack_seq;<br /> tp->snd_wnd = ntohs(th->window) <<<br /> tp->rx_opt.snd_wscale;<br /> tcp_init_wl(tp, TCP_SKB_CB(skb)->ack_seq,<br /> TCP_SKB_CB(skb)->seq);</p> <p> /* tcp_ack considers this ACK as duplicate<br /> * and does not calculate rtt.<br /> * Fix it at least with timestamps.<br /> */<br /> if (tp->rx_opt.saw_tstamp &&<br /> tp->rx_opt.rcv_tsecr && !tp->srtt)<br /> tcp_ack_saw_tstamp(sk, 0);</p> <p> if (tp->rx_opt.tstamp_ok)<br /> tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;</p> <p> /* Make sure socket is routed, for<br /> * correct metrics.<br /> */<br /> icsk->icsk_af_ops->rebuild_header(sk);</p> <p> tcp_init_metrics(sk);</p> <p> tcp_init_congestion_control(sk);</p> <p> /* Prevent spurious tcp_cwnd_restart() on<br /> * first data packet.<br /> */<br /> tp->lsndtime = tcp_time_stamp;</p> <p> tcp_mtup_init(sk);<br /> tcp_initialize_rcv_mss(sk);<br /> tcp_init_buffer_space(sk);<br /> tcp_fast_path_on(tp);