linux-kernel - Re: [PATCH net-next v2] tcp: Support skb PAWS drop reason when TIME-WAIT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5cdc1bdd9caee92a6ae932638a862fd5c67630e8@linux.dev>
Date: Tue, 25 Mar 2025 12:20:18 +0000
From: "Jiayuan Chen" <jiayuan.chen@...ux.dev>
To: "Eric Dumazet" <edumazet@...gle.com>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org, kuniyu@...zon.com,
 davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com,
 horms@...nel.org, dsahern@...nel.org, ncardwell@...gle.com, mrpre@....com
Subject: Re: [PATCH net-next v2] tcp: Support skb PAWS drop reason when
 TIME-WAIT

March 25, 2025 at 19:29, "Eric Dumazet" <edumazet@...gle.com> wrote:

> >  ---
> > 
> >  include/net/tcp.h | 3 ++-
> > 
> >  net/ipv4/tcp_ipv4.c | 2 +-
> > 
> >  net/ipv4/tcp_minisocks.c | 7 +++++--
> > 
> >  net/ipv6/tcp_ipv6.c | 2 +-
> > 
> >  4 files changed, 9 insertions(+), 5 deletions(-)
> > 
> >  diff --git a/include/net/tcp.h b/include/net/tcp.h
> > 
> >  index f8efe56bbccb..e1574e804530 100644
> > 
> >  --- a/include/net/tcp.h
> > 
> >  +++ b/include/net/tcp.h
> > 
> >  @@ -427,7 +427,8 @@ enum tcp_tw_status {
> > 
> >  enum tcp_tw_status tcp_timewait_state_process(struct inet_timewait_sock *tw,
> > 
> >  struct sk_buff *skb,
> > 
> >  const struct tcphdr *th,
> > 
> >  - u32 *tw_isn);
> > 
> >  + u32 *tw_isn,
> > 
> >  + enum skb_drop_reason *drop_reason);
> > 
> >  struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
> > 
> >  struct request_sock *req, bool fastopen,
> > 
> >  bool *lost_race, enum skb_drop_reason *drop_reason);
> > 
> >  diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> > 
> >  index 1cd0938d47e0..a9dde473a23f 100644
> > 
> >  --- a/net/ipv4/tcp_ipv4.c
> > 
> >  +++ b/net/ipv4/tcp_ipv4.c
> > 
> >  @@ -2417,7 +2417,7 @@ int tcp_v4_rcv(struct sk_buff *skb)
> > 
> >  goto csum_error;
> > 
> >  }
> > 
> >  - tw_status = tcp_timewait_state_process(inet_twsk(sk), skb, th, &isn);
> > 
> >  + tw_status = tcp_timewait_state_process(inet_twsk(sk), skb, th, &isn, &drop_reason);
> > 
> >  switch (tw_status) {
> > 
> >  case TCP_TW_SYN: {
> > 
> >  struct sock *sk2 = inet_lookup_listener(net,
> > 
> >  diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
> > 
> >  index fb9349be36b8..d16dfd41397e 100644
> > 
> >  --- a/net/ipv4/tcp_minisocks.c
> > 
> >  +++ b/net/ipv4/tcp_minisocks.c
> > 
> >  @@ -97,7 +97,8 @@ static void twsk_rcv_nxt_update(struct tcp_timewait_sock *tcptw, u32 seq,
> > 
> >  */
> > 
> >  enum tcp_tw_status
> > 
> >  tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
> > 
> >  - const struct tcphdr *th, u32 *tw_isn)
> > 
> >  + const struct tcphdr *th, u32 *tw_isn,
> > 
> >  + enum skb_drop_reason *drop_reason)
> > 
> >  {
> > 
> >  struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
> > 
> >  u32 rcv_nxt = READ_ONCE(tcptw->tw_rcv_nxt);
> > 
> >  @@ -245,8 +246,10 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
> > 
> >  return TCP_TW_SYN;
> > 
> >  }
> > 
> >  - if (paws_reject)
> > 
> >  + if (paws_reject) {
> > 
> >  + *drop_reason = SKB_DROP_REASON_TCP_RFC7323_PAWS;
> > 
> >  __NET_INC_STATS(twsk_net(tw), LINUX_MIB_PAWSESTABREJECTED);
> > 
> 
> I think we should add a new SNMP value and drop reason for TW sockets.
> 
> SNMP_MIB_ITEM("PAWSTimewait", LINUX_MIB_PAWSTIMEWAIT),
> 
> and SKB_DROP_REASON_TCP_RFC7323_TW_PAWS ?
>

That makes sense, we've done similar things before, such as adding
PAWS_OLD_ACK previously.

Thanks for the suggestion!
-- 
pw-bot: cr