| 2235 | } |
| 2236 | |
| 2237 | static tcp_seq |
| 2238 | syncookie_generate(struct syncache_head *sch, struct syncache *sc) |
| 2239 | { |
| 2240 | u_int i, secbit, wscale; |
| 2241 | uint32_t iss, hash; |
| 2242 | uint8_t *secbits; |
| 2243 | union syncookie cookie; |
| 2244 | |
| 2245 | cookie.cookie = 0; |
| 2246 | |
| 2247 | /* Map our computed MSS into the 3-bit index. */ |
| 2248 | for (i = nitems(tcp_sc_msstab) - 1; |
| 2249 | tcp_sc_msstab[i] > sc->sc_peer_mss && i > 0; |
| 2250 | i--) |
| 2251 | ; |
| 2252 | cookie.flags.mss_idx = i; |
| 2253 | |
| 2254 | /* |
| 2255 | * Map the send window scale into the 3-bit index but only if |
| 2256 | * the wscale option was received. |
| 2257 | */ |
| 2258 | if (sc->sc_flags & SCF_WINSCALE) { |
| 2259 | wscale = sc->sc_requested_s_scale; |
| 2260 | for (i = nitems(tcp_sc_wstab) - 1; |
| 2261 | tcp_sc_wstab[i] > wscale && i > 0; |
| 2262 | i--) |
| 2263 | ; |
| 2264 | cookie.flags.wscale_idx = i; |
| 2265 | } |
| 2266 | |
| 2267 | /* Can we do SACK? */ |
| 2268 | if (sc->sc_flags & SCF_SACK) |
| 2269 | cookie.flags.sack_ok = 1; |
| 2270 | |
| 2271 | /* Which of the two secrets to use. */ |
| 2272 | secbit = V_tcp_syncache.secret.oddeven & 0x1; |
| 2273 | cookie.flags.odd_even = secbit; |
| 2274 | |
| 2275 | secbits = V_tcp_syncache.secret.key[secbit]; |
| 2276 | hash = syncookie_mac(&sc->sc_inc, sc->sc_irs, cookie.cookie, secbits, |
| 2277 | (uintptr_t)sch); |
| 2278 | |
| 2279 | /* |
| 2280 | * Put the flags into the hash and XOR them to get better ISS number |
| 2281 | * variance. This doesn't enhance the cryptographic strength and is |
| 2282 | * done to prevent the 8 cookie bits from showing up directly on the |
| 2283 | * wire. |
| 2284 | */ |
| 2285 | iss = hash & ~0xff; |
| 2286 | iss |= cookie.cookie ^ (hash >> 24); |
| 2287 | |
| 2288 | TCPSTAT_INC(tcps_sc_sendcookie); |
| 2289 | return (iss); |
| 2290 | } |
| 2291 | |
| 2292 | static struct syncache * |
| 2293 | syncookie_lookup(struct in_conninfo *inc, struct syncache_head *sch, |
no test coverage detected