netdev - Re: [PATCH net-next v9 02/10] tcp: directly drop skb in cookie check for ipv4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240223192138.4702-1-kuniyu@amazon.com>
Date: Fri, 23 Feb 2024 11:21:38 -0800
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <kuniyu@...zon.com>
CC: <davem@...emloft.net>, <dsahern@...nel.org>, <edumazet@...gle.com>,
	<kerneljasonxing@...il.com>, <kernelxing@...cent.com>, <kuba@...nel.org>,
	<netdev@...r.kernel.org>, <pabeni@...hat.com>
Subject: Re: [PATCH net-next v9 02/10] tcp: directly drop skb in cookie check for ipv4

From: Kuniyuki Iwashima <kuniyu@...zon.com>
Date: Fri, 23 Feb 2024 11:17:36 -0800
> From: Jason Xing <kerneljasonxing@...il.com>
> Date: Fri, 23 Feb 2024 18:28:43 +0800
> > From: Jason Xing <kernelxing@...cent.com>
> > 
> > Only move the skb drop from tcp_v4_do_rcv() to cookie_v4_check() itself,
> > no other changes made. It can help us refine the specific drop reasons
> > later.
> > 
> > Signed-off-by: Jason Xing <kernelxing@...cent.com>
> > Reviewed-by: Kuniyuki Iwashima <kuniyu@...zon.com>
> > Reviewed-by: Eric Dumazet <edumazet@...gle.com>
> > Reviewed-by: David Ahern <dsahern@...nel.org>
> > --
> > v9
> > Link: https://lore.kernel.org/netdev/c5640fc4-16dc-4058-97c6-bd84bae4fda1@kernel.org/
> > 1. add reviewed-by tag (David)
> > 
> > v8
> > Link: https://lore.kernel.org/netdev/CANn89i+foA-AW3KCNw232eCC5GDi_3O0JG-mpvyiQJYuxKxnRA@mail.gmail.com/
> > 1. add reviewed-by tag (Eric)
> > 
> > v7
> > Link: https://lore.kernel.org/all/20240219041350.95304-1-kuniyu@amazon.com/
> > 1. add reviewed-by tag (Kuniyuki)
> > ---
> >  net/ipv4/syncookies.c | 4 ++++
> >  net/ipv4/tcp_ipv4.c   | 2 +-
> >  2 files changed, 5 insertions(+), 1 deletion(-)
> > 
> > diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
> > index be88bf586ff9..38f331da6677 100644
> > --- a/net/ipv4/syncookies.c
> > +++ b/net/ipv4/syncookies.c
> > @@ -408,6 +408,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
> >  	struct rtable *rt;
> >  	__u8 rcv_wscale;
> >  	int full_space;
> > +	SKB_DR(reason);
> >  
> >  	if (!READ_ONCE(net->ipv4.sysctl_tcp_syncookies) ||
> >  	    !th->ack || th->rst)
> > @@ -477,10 +478,13 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
> >  	 */
> >  	if (ret)
> >  		inet_sk(ret)->cork.fl.u.ip4 = fl4;
> > +	else
> > +		goto out_drop;
> 
> nit: It would be nice to use the same style with IPv6 change.
> 
> 	if (!ret)
> 		goto out_drop;
> 
> 	inet_sk(ret)->cork.fl.u.ip4 = fl4;

I just noticed you changed so in the next patch, so please
ignore my comment.