From: Jason Xing <kerneljasonxing@gmail.com>
To: edumazet@google.com, dsahern@kernel.org, kuba@kernel.org,
pabeni@redhat.com, davem@davemloft.net
Cc: netdev@vger.kernel.org, kerneljasonxing@gmail.com,
Jason Xing <kernelxing@tencent.com>
Subject: [PATCH net-next v2 5/5] tcp: rstreason: fully support in tcp_check_req()
Date: Fri, 10 May 2024 20:25:02 +0800 [thread overview]
Message-ID: <20240510122502.27850-6-kerneljasonxing@gmail.com> (raw)
In-Reply-To: <20240510122502.27850-1-kerneljasonxing@gmail.com>
From: Jason Xing <kernelxing@tencent.com>
We're going to send an RST due to invalid syn packet which is already
checked whether 1) it is in sequence, 2) it is a retransmitted skb.
As RFC 793 says, if the state of socket is not CLOSED/LISTEN/SYN-SENT,
then we should send an RST when receiving bad syn packet:
"fourth, check the SYN bit,...If the SYN is in the window it is an
error, send a reset"
Signed-off-by: Jason Xing <kernelxing@tencent.com>
---
include/net/rstreason.h | 8 ++++++++
net/ipv4/tcp_minisocks.c | 2 +-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/include/net/rstreason.h b/include/net/rstreason.h
index 7ae5bb55559b..2575c85d7f7a 100644
--- a/include/net/rstreason.h
+++ b/include/net/rstreason.h
@@ -16,6 +16,7 @@
FN(TCP_OLD_ACK) \
FN(TCP_ABORT_ON_DATA) \
FN(TCP_TIMEWAIT_SOCKET) \
+ FN(INVALID_SYN) \
FN(MPTCP_RST_EUNSPEC) \
FN(MPTCP_RST_EMPTCP) \
FN(MPTCP_RST_ERESOURCE) \
@@ -76,6 +77,13 @@ enum sk_rst_reason {
/* Here start with the independent reasons */
/** @SK_RST_REASON_TCP_TIMEWAIT_SOCKET: happen on the timewait socket */
SK_RST_REASON_TCP_TIMEWAIT_SOCKET,
+ /**
+ * @SK_RST_REASON_INVALID_SYN: receive bad syn packet
+ * RFC 793 says if the state is not CLOSED/LISTEN/SYN-SENT then
+ * "fourth, check the SYN bit,...If the SYN is in the window it is
+ * an error, send a reset"
+ */
+ SK_RST_REASON_INVALID_SYN,
/* Copy from include/uapi/linux/mptcp.h.
* These reset fields will not be changed since they adhere to
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 7d543569a180..b93619b2384b 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -879,7 +879,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
* avoid becoming vulnerable to outside attack aiming at
* resetting legit local connections.
*/
- req->rsk_ops->send_reset(sk, skb, SK_RST_REASON_NOT_SPECIFIED);
+ req->rsk_ops->send_reset(sk, skb, SK_RST_REASON_INVALID_SYN);
} else if (fastopen) { /* received a valid RST pkt */
reqsk_fastopen_remove(sk, req, true);
tcp_reset(sk, skb);
--
2.37.3
next prev parent reply other threads:[~2024-05-10 12:25 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-10 12:24 [PATCH net-next v2 0/5] tcp: support rstreasons in the passive logic Jason Xing
2024-05-10 12:24 ` [PATCH net-next v2 1/5] tcp: rstreason: fully support in tcp_rcv_synsent_state_process() Jason Xing
2024-05-10 12:24 ` [PATCH net-next v2 2/5] tcp: rstreason: fully support in tcp_ack() Jason Xing
2024-05-10 12:25 ` [PATCH net-next v2 3/5] tcp: rstreason: fully support in tcp_rcv_state_process() Jason Xing
2024-05-10 12:25 ` [PATCH net-next v2 4/5] tcp: rstreason: handle timewait cases in the receive path Jason Xing
2024-05-10 12:25 ` Jason Xing [this message]
2024-05-14 0:50 ` [PATCH net-next v2 0/5] tcp: support rstreasons in the passive logic patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240510122502.27850-6-kerneljasonxing@gmail.com \
--to=kerneljasonxing@gmail.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=kernelxing@tencent.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).