netdev - Re: [PATCH v2] tcp: Use BPF timeout setting for SYN ACK RTO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAK6E8=df3ZCt=tBDZHs8OEXWvnWpihxBr0x2+WP+smE+DXB9qQ@mail.gmail.com>
Date:   Tue, 2 Nov 2021 11:57:22 -0700
From:   Yuchung Cheng <ycheng@...gle.com>
To:     Akhmat Karakotov <hmukos@...dex-team.ru>
Cc:     eric.dumazet@...il.com, brakmo@...com, mitradir@...dex-team.ru,
        ncardwell@...gle.com, netdev@...r.kernel.org, zeil@...dex-team.ru
Subject: Re: [PATCH v2] tcp: Use BPF timeout setting for SYN ACK RTO

On Tue, Nov 2, 2021 at 11:33 AM Akhmat Karakotov <hmukos@...dex-team.ru> wrote:
>
> When setting RTO through BPF program, some SYN ACK packets were unaffected
> and continued to use TCP_TIMEOUT_INIT constant. This patch adds timeout
> option to struct request_sock. Option is initialized with TCP_TIMEOUT_INIT
> and is reassigned through BPF using tcp_timeout_init call. SYN ACK
> retransmits now use newly added timeout option.
>
> Signed-off-by: Akhmat Karakotov <hmukos@...dex-team.ru>
> ---
>  include/net/request_sock.h      | 2 ++
>  net/ipv4/inet_connection_sock.c | 2 +-
>  net/ipv4/tcp_input.c            | 8 +++++---
>  net/ipv4/tcp_minisocks.c        | 4 ++--
>  4 files changed, 10 insertions(+), 6 deletions(-)
>
> diff --git a/include/net/request_sock.h b/include/net/request_sock.h
> index 29e41ff3ec93..144c39db9898 100644
> --- a/include/net/request_sock.h
> +++ b/include/net/request_sock.h
> @@ -70,6 +70,7 @@ struct request_sock {
>         struct saved_syn                *saved_syn;
>         u32                             secid;
>         u32                             peer_secid;
> +       u32                             timeout;
>  };
>
>  static inline struct request_sock *inet_reqsk(const struct sock *sk)
> @@ -104,6 +105,7 @@ reqsk_alloc(const struct request_sock_ops *ops, struct sock *sk_listener,
>         sk_node_init(&req_to_sk(req)->sk_node);
>         sk_tx_queue_clear(req_to_sk(req));
>         req->saved_syn = NULL;
> +       req->timeout = 0;
why not just set to TCP_TIMEOUT_INIT to avoid setting it again in
inet_reqsk_alloc?

>         req->num_timeout = 0;
>         req->num_retrans = 0;
>         req->sk = NULL;
> diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
> index 0d477c816309..c43cc1f22092 100644
> --- a/net/ipv4/inet_connection_sock.c
> +++ b/net/ipv4/inet_connection_sock.c
> @@ -870,7 +870,7 @@ static void reqsk_timer_handler(struct timer_list *t)
>
>                 if (req->num_timeout++ == 0)
>                         atomic_dec(&queue->young);
> -               timeo = min(TCP_TIMEOUT_INIT << req->num_timeout, TCP_RTO_MAX);
> +               timeo = min(req->timeout << req->num_timeout, TCP_RTO_MAX);
>                 mod_timer(&req->rsk_timer, jiffies + timeo);
>
>                 if (!nreq)
> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
> index 3f7bd7ae7d7a..5c181dc4e96f 100644
> --- a/net/ipv4/tcp_input.c
> +++ b/net/ipv4/tcp_input.c
> @@ -6706,6 +6706,7 @@ struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
>                 ireq->ireq_state = TCP_NEW_SYN_RECV;
>                 write_pnet(&ireq->ireq_net, sock_net(sk_listener));
>                 ireq->ireq_family = sk_listener->sk_family;
> +               req->timeout = TCP_TIMEOUT_INIT;
>         }
>
>         return req;
> @@ -6922,9 +6923,10 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
>                 sock_put(fastopen_sk);
>         } else {
>                 tcp_rsk(req)->tfo_listener = false;
> -               if (!want_cookie)
> -                       inet_csk_reqsk_queue_hash_add(sk, req,
> -                               tcp_timeout_init((struct sock *)req));
> +               if (!want_cookie) {
> +                       req->timeout = tcp_timeout_init((struct sock *)req);
> +                       inet_csk_reqsk_queue_hash_add(sk, req, req->timeout);
> +               }
>                 af_ops->send_synack(sk, dst, &fl, req, &foc,
>                                     !want_cookie ? TCP_SYNACK_NORMAL :
>                                                    TCP_SYNACK_COOKIE,
> diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
> index 0a4f3f16140a..9724c9c6d331 100644
> --- a/net/ipv4/tcp_minisocks.c
> +++ b/net/ipv4/tcp_minisocks.c
> @@ -590,7 +590,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
>                          * it can be estimated (approximately)
>                          * from another data.
>                          */
> -                       tmp_opt.ts_recent_stamp = ktime_get_seconds() - ((TCP_TIMEOUT_INIT/HZ)<<req->num_timeout);
> +                       tmp_opt.ts_recent_stamp = ktime_get_seconds() - (req->timeout << req->num_timeout) / HZ;
>                         paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
>                 }
>         }
> @@ -629,7 +629,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
>                     !inet_rtx_syn_ack(sk, req)) {
>                         unsigned long expires = jiffies;
>
> -                       expires += min(TCP_TIMEOUT_INIT << req->num_timeout,
> +                       expires += min(req->timeout << req->num_timeout,
>                                        TCP_RTO_MAX);
>                         if (!fastopen)
>                                 mod_timer_pending(&req->rsk_timer, expires);
> --
> 2.17.1
>