| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20231013220433.70792-11-kuniyu@amazon.com>
Date: Fri, 13 Oct 2023 15:04:32 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: "David S. Miller" <davem@...emloft.net>, Eric Dumazet
<edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
<pabeni@...hat.com>, David Ahern <dsahern@...nel.org>, Alexei Starovoitov
<ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, Andrii Nakryiko
<andrii@...nel.org>, Martin KaFai Lau <martin.lau@...ux.dev>, Song Liu
<song@...nel.org>, Yonghong Song <yonghong.song@...ux.dev>, John Fastabend
<john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>, Stanislav Fomichev
<sdf@...gle.com>, Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
Mykola Lysenko <mykolal@...com>
CC: Kuniyuki Iwashima <kuniyu@...zon.com>, Kuniyuki Iwashima
<kuni1840@...il.com>, <bpf@...r.kernel.org>, <netdev@...r.kernel.org>
Subject: [PATCH v1 bpf-next 10/11] bpf: tcp: Make WS, SACK, ECN configurable from BPF SYN Cookie.
This patch allows BPF_SOCK_OPS_CHECK_SYNCOOKIE_CB hook to enable WScale,
SACK, and ECN by passing corresponding flags to bpf_sock_ops.replylong[1].
The same flags are passed to BPF_SOCK_OPS_GEN_SYNCOOKIE_CB hook as
bpf_sock_ops.args[1] so that the BPF prog need not parse the TCP header to
check if WScale, SACK, ECN, and TS are available in SYN.
Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>
---
include/uapi/linux/bpf.h | 18 ++++++++++++++++++
net/ipv4/syncookies.c | 20 ++++++++++++++++++++
net/ipv4/tcp_input.c | 11 +++++++++++
tools/include/uapi/linux/bpf.h | 18 ++++++++++++++++++
4 files changed, 67 insertions(+)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 24f673d88c0d..cdae4dd5d797 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -6869,6 +6869,7 @@ enum {
* option.
*
* args[0]: MSS
+ * args[1]: BPF_SYNCOOKIE_XXX
*
* replylong[0]: ISN
* replylong[1]: TS
@@ -6883,6 +6884,7 @@ enum {
* args[1]: TS
*
* replylong[0]: MSS
+ * replylong[1]: BPF_SYNCOOKIE_XXX
*/
};
@@ -6970,6 +6972,22 @@ enum {
*/
};
+/* arg[1] value for BPF_SOCK_OPS_GEN_SYNCOOKIE_CB and
+ * replylong[1] for BPF_SOCK_OPS_CHECK_SYNCOOKIE_CB.
+ *
+ * MSB LSB
+ * | 31 ... | 6 | 5 | 4 | 3 2 1 0 |
+ * | ... | TS | ECN | SACK | WScale |
+ */
+enum {
+ /* 0xf is invalid thus means that SYN did not have WScale. */
+ BPF_SYNCOOKIE_WSCALE_MASK = (1 << 4) - 1,
+ BPF_SYNCOOKIE_SACK = (1 << 4),
+ BPF_SYNCOOKIE_ECN = (1 << 5),
+ /* Only available for BPF_SOCK_OPS_GEN_SYNCOOKIE_CB to check if SYN has TS */
+ BPF_SYNCOOKIE_TS = (1 << 6),
+};
+
struct bpf_perf_event_value {
__u64 counter;
__u64 enabled;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index ff979cc314da..22353a9af52d 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -286,6 +286,7 @@ int bpf_skops_cookie_check(struct sock *sk, struct request_sock *req, struct sk_
{
struct bpf_sock_ops_kern sock_ops;
struct net *net = sock_net(sk);
+ u32 options;
if (tcp_opt->saw_tstamp) {
if (!READ_ONCE(net->ipv4.sysctl_tcp_timestamps))
@@ -309,6 +310,25 @@ int bpf_skops_cookie_check(struct sock *sk, struct request_sock *req, struct sk_
if (!sock_ops.replylong[0])
goto err;
+ options = sock_ops.replylong[1];
+
+ if ((options & BPF_SYNCOOKIE_WSCALE_MASK) != BPF_SYNCOOKIE_WSCALE_MASK) {
+ if (!READ_ONCE(net->ipv4.sysctl_tcp_window_scaling))
+ goto err;
+
+ tcp_opt->wscale_ok = 1;
+ tcp_opt->snd_wscale = options & BPF_SYNCOOKIE_WSCALE_MASK;
+ }
+
+ if (options & BPF_SYNCOOKIE_SACK) {
+ if (!READ_ONCE(net->ipv4.sysctl_tcp_sack))
+ goto err;
+
+ tcp_opt->sack_ok = 1;
+ }
+
+ inet_rsk(req)->ecn_ok = options & BPF_SYNCOOKIE_ECN;
+
__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
return sock_ops.replylong[0];
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index feb44bff29ef..483e2f36afe5 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6970,14 +6970,25 @@ EXPORT_SYMBOL_GPL(tcp_get_syncookie_mss);
static int bpf_skops_cookie_init_sequence(struct sock *sk, struct request_sock *req,
struct sk_buff *skb, __u32 *isn)
{
+ struct inet_request_sock *ireq = inet_rsk(req);
struct bpf_sock_ops_kern sock_ops;
+ u32 options;
int ret;
+ options = ireq->wscale_ok ? ireq->snd_wscale : BPF_SYNCOOKIE_WSCALE_MASK;
+ if (ireq->sack_ok)
+ options |= BPF_SYNCOOKIE_SACK;
+ if (ireq->ecn_ok)
+ options |= BPF_SYNCOOKIE_ECN;
+ if (ireq->tstamp_ok)
+ options |= BPF_SYNCOOKIE_TS;
+
memset(&sock_ops, 0, offsetof(struct bpf_sock_ops_kern, temp));
sock_ops.op = BPF_SOCK_OPS_GEN_SYNCOOKIE_CB;
sock_ops.sk = req_to_sk(req);
sock_ops.args[0] = req->mss;
+ sock_ops.args[1] = options;
bpf_skops_init_skb(&sock_ops, skb, tcp_hdrlen(skb));
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 24f673d88c0d..cdae4dd5d797 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -6869,6 +6869,7 @@ enum {
* option.
*
* args[0]: MSS
+ * args[1]: BPF_SYNCOOKIE_XXX
*
* replylong[0]: ISN
* replylong[1]: TS
@@ -6883,6 +6884,7 @@ enum {
* args[1]: TS
*
* replylong[0]: MSS
+ * replylong[1]: BPF_SYNCOOKIE_XXX
*/
};
@@ -6970,6 +6972,22 @@ enum {
*/
};
+/* arg[1] value for BPF_SOCK_OPS_GEN_SYNCOOKIE_CB and
+ * replylong[1] for BPF_SOCK_OPS_CHECK_SYNCOOKIE_CB.
+ *
+ * MSB LSB
+ * | 31 ... | 6 | 5 | 4 | 3 2 1 0 |
+ * | ... | TS | ECN | SACK | WScale |
+ */
+enum {
+ /* 0xf is invalid thus means that SYN did not have WScale. */
+ BPF_SYNCOOKIE_WSCALE_MASK = (1 << 4) - 1,
+ BPF_SYNCOOKIE_SACK = (1 << 4),
+ BPF_SYNCOOKIE_ECN = (1 << 5),
+ /* Only available for BPF_SOCK_OPS_GEN_SYNCOOKIE_CB to check if SYN has TS */
+ BPF_SYNCOOKIE_TS = (1 << 6),
+};
+
struct bpf_perf_event_value {
__u64 counter;
__u64 enabled;
--
2.30.2
Powered by blists - more mailing lists