linux-kernel - [PATCH net-next 8/9] net: tcp: store drop reasons in route

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 29 Oct 2022 21:09:56 +0800
From:   menglong8.dong@...il.com
To:     edumazet@...gle.com, kuba@...nel.org
Cc:     davem@...emloft.net, pabeni@...hat.com, yoshfuji@...ux-ipv6.org,
        dsahern@...nel.org, imagedong@...cent.com, kafai@...com,
        asml.silence@...il.com, keescook@...omium.org,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: [PATCH net-next 8/9] net: tcp: store drop reasons in route_req

From: Menglong Dong <imagedong@...cent.com>

Add skb drop reasons to tcp_v4_route_req() and tcp_v6_route_req().

And the new reason SKB_DROP_REASON_LSM is added, which is used when
skb is dropped by LSM.

Signed-off-by: Menglong Dong <imagedong@...cent.com>
---
 include/net/dropreason.h |  5 +++++
 net/ipv4/tcp_ipv4.c      | 11 +++++++++--
 net/ipv6/tcp_ipv6.c      | 11 +++++++++--
 3 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/include/net/dropreason.h b/include/net/dropreason.h
index 364811bce63f..a5de00d02213 100644
--- a/include/net/dropreason.h
+++ b/include/net/dropreason.h
@@ -74,6 +74,7 @@
 	FN(TCP_REQQFULLDROP)		\
 	FN(TCP_ABORTONDATA)		\
 	FN(TCP_ABORTONLINGER)		\
+	FN(LSM)				\
 	FNe(MAX)
 
 /**
@@ -336,6 +337,10 @@ enum skb_drop_reason {
 	 * LINUX_MIB_TCPABORTONLINGER
 	 */
 	SKB_DROP_REASON_TCP_ABORTONLINGER,
+	/**
+	 * @SKB_DROP_REASON_LSM: dropped by LSM
+	 */
+	SKB_DROP_REASON_LSM,
 	/**
 	 * @SKB_DROP_REASON_MAX: the maximum of drop reason, which shouldn't be
 	 * used as a real 'reason'
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a85bc7483c5a..8fdea8e6207f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1447,12 +1447,19 @@ static struct dst_entry *tcp_v4_route_req(const struct sock *sk,
 					  struct flowi *fl,
 					  struct request_sock *req)
 {
+	struct dst_entry *dst;
+
 	tcp_v4_init_req(req, sk, skb);
 
-	if (security_inet_conn_request(sk, skb, req))
+	if (security_inet_conn_request(sk, skb, req)) {
+		TCP_SKB_DR(skb, LSM);
 		return NULL;
+	}
 
-	return inet_csk_route_req(sk, &fl->u.ip4, req);
+	dst = inet_csk_route_req(sk, &fl->u.ip4, req);
+	if (!dst)
+		TCP_SKB_DR(skb, IP_OUTNOROUTES);
+	return dst;
 }
 
 struct request_sock_ops tcp_request_sock_ops __read_mostly = {
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2c2048832714..44c4aa2789d6 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -823,12 +823,19 @@ static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 					  struct flowi *fl,
 					  struct request_sock *req)
 {
+	struct dst_entry *dst;
+
 	tcp_v6_init_req(req, sk, skb);
 
-	if (security_inet_conn_request(sk, skb, req))
+	if (security_inet_conn_request(sk, skb, req)) {
+		TCP_SKB_DR(skb, LSM);
 		return NULL;
+	}
 
-	return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
+	dst = inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
+	if (!dst)
+		TCP_SKB_DR(skb, IP_OUTNOROUTES);
+	return dst;
 }
 
 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
-- 
2.37.2