1 | /* SPDX-License-Identifier: GPL-2.0-or-later */ |
2 | /* |
3 | * INET An implementation of the TCP/IP protocol suite for the LINUX |
4 | * operating system. INET is implemented using the BSD Socket |
5 | * interface as the means of communication with the user level. |
6 | * |
7 | * Authors: Lotsa people, from code originally in tcp |
8 | */ |
9 | |
10 | #ifndef _INET_HASHTABLES_H |
11 | #define _INET_HASHTABLES_H |
12 | |
13 | |
14 | #include <linux/interrupt.h> |
15 | #include <linux/ip.h> |
16 | #include <linux/ipv6.h> |
17 | #include <linux/list.h> |
18 | #include <linux/slab.h> |
19 | #include <linux/socket.h> |
20 | #include <linux/spinlock.h> |
21 | #include <linux/types.h> |
22 | #include <linux/wait.h> |
23 | |
24 | #include <net/inet_connection_sock.h> |
25 | #include <net/inet_sock.h> |
26 | #include <net/ip.h> |
27 | #include <net/sock.h> |
28 | #include <net/route.h> |
29 | #include <net/tcp_states.h> |
30 | #include <net/netns/hash.h> |
31 | |
32 | #include <linux/refcount.h> |
33 | #include <asm/byteorder.h> |
34 | |
35 | /* This is for all connections with a full identity, no wildcards. |
36 | * The 'e' prefix stands for Establish, but we really put all sockets |
37 | * but LISTEN ones. |
38 | */ |
39 | struct inet_ehash_bucket { |
40 | struct hlist_nulls_head chain; |
41 | }; |
42 | |
43 | /* There are a few simple rules, which allow for local port reuse by |
44 | * an application. In essence: |
45 | * |
46 | * 1) Sockets bound to different interfaces may share a local port. |
47 | * Failing that, goto test 2. |
48 | * 2) If all sockets have sk->sk_reuse set, and none of them are in |
49 | * TCP_LISTEN state, the port may be shared. |
50 | * Failing that, goto test 3. |
51 | * 3) If all sockets are bound to a specific inet_sk(sk)->rcv_saddr local |
52 | * address, and none of them are the same, the port may be |
53 | * shared. |
54 | * Failing this, the port cannot be shared. |
55 | * |
56 | * The interesting point, is test #2. This is what an FTP server does |
57 | * all day. To optimize this case we use a specific flag bit defined |
58 | * below. As we add sockets to a bind bucket list, we perform a |
59 | * check of: (newsk->sk_reuse && (newsk->sk_state != TCP_LISTEN)) |
60 | * As long as all sockets added to a bind bucket pass this test, |
61 | * the flag bit will be set. |
62 | * The resulting situation is that tcp_v[46]_verify_bind() can just check |
63 | * for this flag bit, if it is set and the socket trying to bind has |
64 | * sk->sk_reuse set, we don't even have to walk the owners list at all, |
65 | * we return that it is ok to bind this socket to the requested local port. |
66 | * |
67 | * Sounds like a lot of work, but it is worth it. In a more naive |
68 | * implementation (ie. current FreeBSD etc.) the entire list of ports |
69 | * must be walked for each data port opened by an ftp server. Needless |
70 | * to say, this does not scale at all. With a couple thousand FTP |
71 | * users logged onto your box, isn't it nice to know that new data |
72 | * ports are created in O(1) time? I thought so. ;-) -DaveM |
73 | */ |
74 | #define FASTREUSEPORT_ANY 1 |
75 | #define FASTREUSEPORT_STRICT 2 |
76 | |
77 | struct inet_bind_bucket { |
78 | possible_net_t ib_net; |
79 | int l3mdev; |
80 | unsigned short port; |
81 | signed char fastreuse; |
82 | signed char fastreuseport; |
83 | kuid_t fastuid; |
84 | #if IS_ENABLED(CONFIG_IPV6) |
85 | struct in6_addr fast_v6_rcv_saddr; |
86 | #endif |
87 | __be32 fast_rcv_saddr; |
88 | unsigned short fast_sk_family; |
89 | bool fast_ipv6_only; |
90 | struct hlist_node node; |
91 | struct hlist_head owners; |
92 | }; |
93 | |
94 | struct inet_bind2_bucket { |
95 | possible_net_t ib_net; |
96 | int l3mdev; |
97 | unsigned short port; |
98 | #if IS_ENABLED(CONFIG_IPV6) |
99 | unsigned short family; |
100 | #endif |
101 | union { |
102 | #if IS_ENABLED(CONFIG_IPV6) |
103 | struct in6_addr v6_rcv_saddr; |
104 | #endif |
105 | __be32 rcv_saddr; |
106 | }; |
107 | /* Node in the bhash2 inet_bind_hashbucket chain */ |
108 | struct hlist_node node; |
109 | /* List of sockets hashed to this bucket */ |
110 | struct hlist_head owners; |
111 | /* bhash has twsk in owners, but bhash2 has twsk in |
112 | * deathrow not to add a member in struct sock_common. |
113 | */ |
114 | struct hlist_head deathrow; |
115 | }; |
116 | |
117 | static inline struct net *ib_net(const struct inet_bind_bucket *ib) |
118 | { |
119 | return read_pnet(pnet: &ib->ib_net); |
120 | } |
121 | |
122 | static inline struct net *ib2_net(const struct inet_bind2_bucket *ib) |
123 | { |
124 | return read_pnet(pnet: &ib->ib_net); |
125 | } |
126 | |
127 | #define inet_bind_bucket_for_each(tb, head) \ |
128 | hlist_for_each_entry(tb, head, node) |
129 | |
130 | struct inet_bind_hashbucket { |
131 | spinlock_t lock; |
132 | struct hlist_head chain; |
133 | }; |
134 | |
135 | /* Sockets can be hashed in established or listening table. |
136 | * We must use different 'nulls' end-of-chain value for all hash buckets : |
137 | * A socket might transition from ESTABLISH to LISTEN state without |
138 | * RCU grace period. A lookup in ehash table needs to handle this case. |
139 | */ |
140 | #define LISTENING_NULLS_BASE (1U << 29) |
141 | struct inet_listen_hashbucket { |
142 | spinlock_t lock; |
143 | struct hlist_nulls_head nulls_head; |
144 | }; |
145 | |
146 | /* This is for listening sockets, thus all sockets which possess wildcards. */ |
147 | #define INET_LHTABLE_SIZE 32 /* Yes, really, this is all you need. */ |
148 | |
149 | struct inet_hashinfo { |
150 | /* This is for sockets with full identity only. Sockets here will |
151 | * always be without wildcards and will have the following invariant: |
152 | * |
153 | * TCP_ESTABLISHED <= sk->sk_state < TCP_CLOSE |
154 | * |
155 | */ |
156 | struct inet_ehash_bucket *ehash; |
157 | spinlock_t *ehash_locks; |
158 | unsigned int ehash_mask; |
159 | unsigned int ehash_locks_mask; |
160 | |
161 | /* Ok, let's try this, I give up, we do need a local binding |
162 | * TCP hash as well as the others for fast bind/connect. |
163 | */ |
164 | struct kmem_cache *bind_bucket_cachep; |
165 | /* This bind table is hashed by local port */ |
166 | struct inet_bind_hashbucket *bhash; |
167 | struct kmem_cache *bind2_bucket_cachep; |
168 | /* This bind table is hashed by local port and sk->sk_rcv_saddr (ipv4) |
169 | * or sk->sk_v6_rcv_saddr (ipv6). This 2nd bind table is used |
170 | * primarily for expediting bind conflict resolution. |
171 | */ |
172 | struct inet_bind_hashbucket *bhash2; |
173 | unsigned int bhash_size; |
174 | |
175 | /* The 2nd listener table hashed by local port and address */ |
176 | unsigned int lhash2_mask; |
177 | struct inet_listen_hashbucket *lhash2; |
178 | |
179 | bool pernet; |
180 | } ____cacheline_aligned_in_smp; |
181 | |
182 | static inline struct inet_hashinfo *tcp_or_dccp_get_hashinfo(const struct sock *sk) |
183 | { |
184 | #if IS_ENABLED(CONFIG_IP_DCCP) |
185 | return sk->sk_prot->h.hashinfo ? : |
186 | sock_net(sk)->ipv4.tcp_death_row.hashinfo; |
187 | #else |
188 | return sock_net(sk)->ipv4.tcp_death_row.hashinfo; |
189 | #endif |
190 | } |
191 | |
192 | static inline struct inet_listen_hashbucket * |
193 | inet_lhash2_bucket(struct inet_hashinfo *h, u32 hash) |
194 | { |
195 | return &h->lhash2[hash & h->lhash2_mask]; |
196 | } |
197 | |
198 | static inline struct inet_ehash_bucket *inet_ehash_bucket( |
199 | struct inet_hashinfo *hashinfo, |
200 | unsigned int hash) |
201 | { |
202 | return &hashinfo->ehash[hash & hashinfo->ehash_mask]; |
203 | } |
204 | |
205 | static inline spinlock_t *inet_ehash_lockp( |
206 | struct inet_hashinfo *hashinfo, |
207 | unsigned int hash) |
208 | { |
209 | return &hashinfo->ehash_locks[hash & hashinfo->ehash_locks_mask]; |
210 | } |
211 | |
212 | int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo); |
213 | |
214 | static inline void inet_hashinfo2_free_mod(struct inet_hashinfo *h) |
215 | { |
216 | kfree(objp: h->lhash2); |
217 | h->lhash2 = NULL; |
218 | } |
219 | |
220 | static inline void inet_ehash_locks_free(struct inet_hashinfo *hashinfo) |
221 | { |
222 | kvfree(addr: hashinfo->ehash_locks); |
223 | hashinfo->ehash_locks = NULL; |
224 | } |
225 | |
226 | struct inet_hashinfo *inet_pernet_hashinfo_alloc(struct inet_hashinfo *hashinfo, |
227 | unsigned int ehash_entries); |
228 | void inet_pernet_hashinfo_free(struct inet_hashinfo *hashinfo); |
229 | |
230 | struct inet_bind_bucket * |
231 | inet_bind_bucket_create(struct kmem_cache *cachep, struct net *net, |
232 | struct inet_bind_hashbucket *head, |
233 | const unsigned short snum, int l3mdev); |
234 | void inet_bind_bucket_destroy(struct kmem_cache *cachep, |
235 | struct inet_bind_bucket *tb); |
236 | |
237 | bool inet_bind_bucket_match(const struct inet_bind_bucket *tb, |
238 | const struct net *net, unsigned short port, |
239 | int l3mdev); |
240 | |
241 | struct inet_bind2_bucket * |
242 | inet_bind2_bucket_create(struct kmem_cache *cachep, struct net *net, |
243 | struct inet_bind_hashbucket *head, |
244 | unsigned short port, int l3mdev, |
245 | const struct sock *sk); |
246 | |
247 | void inet_bind2_bucket_destroy(struct kmem_cache *cachep, |
248 | struct inet_bind2_bucket *tb); |
249 | |
250 | struct inet_bind2_bucket * |
251 | inet_bind2_bucket_find(const struct inet_bind_hashbucket *head, |
252 | const struct net *net, |
253 | unsigned short port, int l3mdev, |
254 | const struct sock *sk); |
255 | |
256 | bool inet_bind2_bucket_match_addr_any(const struct inet_bind2_bucket *tb, |
257 | const struct net *net, unsigned short port, |
258 | int l3mdev, const struct sock *sk); |
259 | |
260 | static inline u32 inet_bhashfn(const struct net *net, const __u16 lport, |
261 | const u32 bhash_size) |
262 | { |
263 | return (lport + net_hash_mix(net)) & (bhash_size - 1); |
264 | } |
265 | |
266 | static inline struct inet_bind_hashbucket * |
267 | inet_bhashfn_portaddr(const struct inet_hashinfo *hinfo, const struct sock *sk, |
268 | const struct net *net, unsigned short port) |
269 | { |
270 | u32 hash; |
271 | |
272 | #if IS_ENABLED(CONFIG_IPV6) |
273 | if (sk->sk_family == AF_INET6) |
274 | hash = ipv6_portaddr_hash(net, addr6: &sk->sk_v6_rcv_saddr, port); |
275 | else |
276 | #endif |
277 | hash = ipv4_portaddr_hash(net, saddr: sk->sk_rcv_saddr, port); |
278 | return &hinfo->bhash2[hash & (hinfo->bhash_size - 1)]; |
279 | } |
280 | |
281 | struct inet_bind_hashbucket * |
282 | inet_bhash2_addr_any_hashbucket(const struct sock *sk, const struct net *net, int port); |
283 | |
284 | /* This should be called whenever a socket's sk_rcv_saddr (ipv4) or |
285 | * sk_v6_rcv_saddr (ipv6) changes after it has been binded. The socket's |
286 | * rcv_saddr field should already have been updated when this is called. |
287 | */ |
288 | int inet_bhash2_update_saddr(struct sock *sk, void *saddr, int family); |
289 | void inet_bhash2_reset_saddr(struct sock *sk); |
290 | |
291 | void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb, |
292 | struct inet_bind2_bucket *tb2, unsigned short port); |
293 | |
294 | /* Caller must disable local BH processing. */ |
295 | int __inet_inherit_port(const struct sock *sk, struct sock *child); |
296 | |
297 | void inet_put_port(struct sock *sk); |
298 | |
299 | void inet_hashinfo2_init(struct inet_hashinfo *h, const char *name, |
300 | unsigned long numentries, int scale, |
301 | unsigned long low_limit, |
302 | unsigned long high_limit); |
303 | int inet_hashinfo2_init_mod(struct inet_hashinfo *h); |
304 | |
305 | bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk); |
306 | bool inet_ehash_nolisten(struct sock *sk, struct sock *osk, |
307 | bool *found_dup_sk); |
308 | int __inet_hash(struct sock *sk, struct sock *osk); |
309 | int inet_hash(struct sock *sk); |
310 | void inet_unhash(struct sock *sk); |
311 | |
312 | struct sock *__inet_lookup_listener(struct net *net, |
313 | struct inet_hashinfo *hashinfo, |
314 | struct sk_buff *skb, int doff, |
315 | const __be32 saddr, const __be16 sport, |
316 | const __be32 daddr, |
317 | const unsigned short hnum, |
318 | const int dif, const int sdif); |
319 | |
320 | static inline struct sock *inet_lookup_listener(struct net *net, |
321 | struct inet_hashinfo *hashinfo, |
322 | struct sk_buff *skb, int doff, |
323 | __be32 saddr, __be16 sport, |
324 | __be32 daddr, __be16 dport, int dif, int sdif) |
325 | { |
326 | return __inet_lookup_listener(net, hashinfo, skb, doff, saddr, sport, |
327 | daddr, ntohs(dport), dif, sdif); |
328 | } |
329 | |
330 | /* Socket demux engine toys. */ |
331 | /* What happens here is ugly; there's a pair of adjacent fields in |
332 | struct inet_sock; __be16 dport followed by __u16 num. We want to |
333 | search by pair, so we combine the keys into a single 32bit value |
334 | and compare with 32bit value read from &...->dport. Let's at least |
335 | make sure that it's not mixed with anything else... |
336 | On 64bit targets we combine comparisons with pair of adjacent __be32 |
337 | fields in the same way. |
338 | */ |
339 | #ifdef __BIG_ENDIAN |
340 | #define INET_COMBINED_PORTS(__sport, __dport) \ |
341 | ((__force __portpair)(((__force __u32)(__be16)(__sport) << 16) | (__u32)(__dport))) |
342 | #else /* __LITTLE_ENDIAN */ |
343 | #define INET_COMBINED_PORTS(__sport, __dport) \ |
344 | ((__force __portpair)(((__u32)(__dport) << 16) | (__force __u32)(__be16)(__sport))) |
345 | #endif |
346 | |
347 | #ifdef __BIG_ENDIAN |
348 | #define INET_ADDR_COOKIE(__name, __saddr, __daddr) \ |
349 | const __addrpair __name = (__force __addrpair) ( \ |
350 | (((__force __u64)(__be32)(__saddr)) << 32) | \ |
351 | ((__force __u64)(__be32)(__daddr))) |
352 | #else /* __LITTLE_ENDIAN */ |
353 | #define INET_ADDR_COOKIE(__name, __saddr, __daddr) \ |
354 | const __addrpair __name = (__force __addrpair) ( \ |
355 | (((__force __u64)(__be32)(__daddr)) << 32) | \ |
356 | ((__force __u64)(__be32)(__saddr))) |
357 | #endif /* __BIG_ENDIAN */ |
358 | |
359 | static inline bool inet_match(struct net *net, const struct sock *sk, |
360 | const __addrpair cookie, const __portpair ports, |
361 | int dif, int sdif) |
362 | { |
363 | if (!net_eq(net1: sock_net(sk), net2: net) || |
364 | sk->sk_portpair != ports || |
365 | sk->sk_addrpair != cookie) |
366 | return false; |
367 | |
368 | /* READ_ONCE() paired with WRITE_ONCE() in sock_bindtoindex_locked() */ |
369 | return inet_sk_bound_dev_eq(net, READ_ONCE(sk->sk_bound_dev_if), dif, |
370 | sdif); |
371 | } |
372 | |
373 | /* Sockets in TCP_CLOSE state are _always_ taken out of the hash, so we need |
374 | * not check it for lookups anymore, thanks Alexey. -DaveM |
375 | */ |
376 | struct sock *__inet_lookup_established(struct net *net, |
377 | struct inet_hashinfo *hashinfo, |
378 | const __be32 saddr, const __be16 sport, |
379 | const __be32 daddr, const u16 hnum, |
380 | const int dif, const int sdif); |
381 | |
382 | typedef u32 (inet_ehashfn_t)(const struct net *net, |
383 | const __be32 laddr, const __u16 lport, |
384 | const __be32 faddr, const __be16 fport); |
385 | |
386 | inet_ehashfn_t inet_ehashfn; |
387 | |
388 | INDIRECT_CALLABLE_DECLARE(inet_ehashfn_t udp_ehashfn); |
389 | |
390 | struct sock *inet_lookup_reuseport(struct net *net, struct sock *sk, |
391 | struct sk_buff *skb, int doff, |
392 | __be32 saddr, __be16 sport, |
393 | __be32 daddr, unsigned short hnum, |
394 | inet_ehashfn_t *ehashfn); |
395 | |
396 | struct sock *inet_lookup_run_sk_lookup(struct net *net, |
397 | int protocol, |
398 | struct sk_buff *skb, int doff, |
399 | __be32 saddr, __be16 sport, |
400 | __be32 daddr, u16 hnum, const int dif, |
401 | inet_ehashfn_t *ehashfn); |
402 | |
403 | static inline struct sock * |
404 | inet_lookup_established(struct net *net, struct inet_hashinfo *hashinfo, |
405 | const __be32 saddr, const __be16 sport, |
406 | const __be32 daddr, const __be16 dport, |
407 | const int dif) |
408 | { |
409 | return __inet_lookup_established(net, hashinfo, saddr, sport, daddr, |
410 | ntohs(dport), dif, sdif: 0); |
411 | } |
412 | |
413 | static inline struct sock *__inet_lookup(struct net *net, |
414 | struct inet_hashinfo *hashinfo, |
415 | struct sk_buff *skb, int doff, |
416 | const __be32 saddr, const __be16 sport, |
417 | const __be32 daddr, const __be16 dport, |
418 | const int dif, const int sdif, |
419 | bool *refcounted) |
420 | { |
421 | u16 hnum = ntohs(dport); |
422 | struct sock *sk; |
423 | |
424 | sk = __inet_lookup_established(net, hashinfo, saddr, sport, |
425 | daddr, hnum, dif, sdif); |
426 | *refcounted = true; |
427 | if (sk) |
428 | return sk; |
429 | *refcounted = false; |
430 | return __inet_lookup_listener(net, hashinfo, skb, doff, saddr, |
431 | sport, daddr, hnum, dif, sdif); |
432 | } |
433 | |
434 | static inline struct sock *inet_lookup(struct net *net, |
435 | struct inet_hashinfo *hashinfo, |
436 | struct sk_buff *skb, int doff, |
437 | const __be32 saddr, const __be16 sport, |
438 | const __be32 daddr, const __be16 dport, |
439 | const int dif) |
440 | { |
441 | struct sock *sk; |
442 | bool refcounted; |
443 | |
444 | sk = __inet_lookup(net, hashinfo, skb, doff, saddr, sport, daddr, |
445 | dport, dif, sdif: 0, refcounted: &refcounted); |
446 | |
447 | if (sk && !refcounted && !refcount_inc_not_zero(r: &sk->sk_refcnt)) |
448 | sk = NULL; |
449 | return sk; |
450 | } |
451 | |
452 | static inline |
453 | struct sock *inet_steal_sock(struct net *net, struct sk_buff *skb, int doff, |
454 | const __be32 saddr, const __be16 sport, |
455 | const __be32 daddr, const __be16 dport, |
456 | bool *refcounted, inet_ehashfn_t *ehashfn) |
457 | { |
458 | struct sock *sk, *reuse_sk; |
459 | bool prefetched; |
460 | |
461 | sk = skb_steal_sock(skb, refcounted, prefetched: &prefetched); |
462 | if (!sk) |
463 | return NULL; |
464 | |
465 | if (!prefetched || !sk_fullsock(sk)) |
466 | return sk; |
467 | |
468 | if (sk->sk_protocol == IPPROTO_TCP) { |
469 | if (sk->sk_state != TCP_LISTEN) |
470 | return sk; |
471 | } else if (sk->sk_protocol == IPPROTO_UDP) { |
472 | if (sk->sk_state != TCP_CLOSE) |
473 | return sk; |
474 | } else { |
475 | return sk; |
476 | } |
477 | |
478 | reuse_sk = inet_lookup_reuseport(net, sk, skb, doff, |
479 | saddr, sport, daddr, ntohs(dport), |
480 | ehashfn); |
481 | if (!reuse_sk) |
482 | return sk; |
483 | |
484 | /* We've chosen a new reuseport sock which is never refcounted. This |
485 | * implies that sk also isn't refcounted. |
486 | */ |
487 | WARN_ON_ONCE(*refcounted); |
488 | |
489 | return reuse_sk; |
490 | } |
491 | |
492 | static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo, |
493 | struct sk_buff *skb, |
494 | int doff, |
495 | const __be16 sport, |
496 | const __be16 dport, |
497 | const int sdif, |
498 | bool *refcounted) |
499 | { |
500 | struct net *net = dev_net(dev: skb_dst(skb)->dev); |
501 | const struct iphdr *iph = ip_hdr(skb); |
502 | struct sock *sk; |
503 | |
504 | sk = inet_steal_sock(net, skb, doff, saddr: iph->saddr, sport, daddr: iph->daddr, dport, |
505 | refcounted, ehashfn: inet_ehashfn); |
506 | if (IS_ERR(ptr: sk)) |
507 | return NULL; |
508 | if (sk) |
509 | return sk; |
510 | |
511 | return __inet_lookup(net, hashinfo, skb, |
512 | doff, saddr: iph->saddr, sport, |
513 | daddr: iph->daddr, dport, dif: inet_iif(skb), sdif, |
514 | refcounted); |
515 | } |
516 | |
517 | static inline void sk_daddr_set(struct sock *sk, __be32 addr) |
518 | { |
519 | sk->sk_daddr = addr; /* alias of inet_daddr */ |
520 | #if IS_ENABLED(CONFIG_IPV6) |
521 | ipv6_addr_set_v4mapped(addr, v4mapped: &sk->sk_v6_daddr); |
522 | #endif |
523 | } |
524 | |
525 | static inline void sk_rcv_saddr_set(struct sock *sk, __be32 addr) |
526 | { |
527 | sk->sk_rcv_saddr = addr; /* alias of inet_rcv_saddr */ |
528 | #if IS_ENABLED(CONFIG_IPV6) |
529 | ipv6_addr_set_v4mapped(addr, v4mapped: &sk->sk_v6_rcv_saddr); |
530 | #endif |
531 | } |
532 | |
533 | int __inet_hash_connect(struct inet_timewait_death_row *death_row, |
534 | struct sock *sk, u64 port_offset, |
535 | int (*check_established)(struct inet_timewait_death_row *, |
536 | struct sock *, __u16, |
537 | struct inet_timewait_sock **)); |
538 | |
539 | int inet_hash_connect(struct inet_timewait_death_row *death_row, |
540 | struct sock *sk); |
541 | #endif /* _INET_HASHTABLES_H */ |
542 | |