[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240509131306.92931-6-kerneljasonxing@gmail.com>
Date: Thu, 9 May 2024 21:13:06 +0800
From: Jason Xing <kerneljasonxing@...il.com>
To: edumazet@...gle.com,
dsahern@...nel.org,
kuba@...nel.org,
pabeni@...hat.com,
davem@...emloft.net
Cc: netdev@...r.kernel.org,
kerneljasonxing@...il.com,
Jason Xing <kernelxing@...cent.com>
Subject: [PATCH net-next 5/5] tcp: handle rstreason in tcp_check_req()
From: Jason Xing <kernelxing@...cent.com>
We're going to send an RST due to invalid syn packet which is already
checked whether 1) it is in sequence, 2) it is a retransmitted skb.
As RFC 793 says, if the state of socket is not CLOSED/LISTEN/SYN-SENT,
then we should send an RST when receiving bad syn packet:
"fourth, check the SYN bit,...If the SYN is in the window it is an
error, send a reset"
Signed-off-by: Jason Xing <kernelxing@...cent.com>
---
include/net/rstreason.h | 8 ++++++++
net/ipv4/tcp_minisocks.c | 2 +-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/include/net/rstreason.h b/include/net/rstreason.h
index 62e869089da4..bfea05ff8d88 100644
--- a/include/net/rstreason.h
+++ b/include/net/rstreason.h
@@ -16,6 +16,7 @@
FN(TCP_OLD_ACK) \
FN(TCP_ABORT_ON_DATA) \
FN(TCP_TIMEWAIT_SOCKET) \
+ FN(INVALID_SYN) \
FN(MPTCP_RST_EUNSPEC) \
FN(MPTCP_RST_EMPTCP) \
FN(MPTCP_RST_ERESOURCE) \
@@ -73,6 +74,13 @@ enum sk_rst_reason {
/* Here start with the independent reasons */
/** @SK_RST_REASON_TCP_TIMEWAIT_SOCKET: happen on the timewait socket */
SK_RST_REASON_TCP_TIMEWAIT_SOCKET,
+ /**
+ * @SK_RST_REASON_INVALID_SYN: receive bad syn packet
+ * RFC 793 says if the state is not CLOSED/LISTEN/SYN-SENT then
+ * "fourth, check the SYN bit,...If the SYN is in the window it is
+ * an error, send a reset"
+ */
+ SK_RST_REASON_INVALID_SYN,
/* Copy from include/uapi/linux/mptcp.h.
* These reset fields will not be changed since they adhere to
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 7d543569a180..b93619b2384b 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -879,7 +879,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
* avoid becoming vulnerable to outside attack aiming at
* resetting legit local connections.
*/
- req->rsk_ops->send_reset(sk, skb, SK_RST_REASON_NOT_SPECIFIED);
+ req->rsk_ops->send_reset(sk, skb, SK_RST_REASON_INVALID_SYN);
} else if (fastopen) { /* received a valid RST pkt */
reqsk_fastopen_remove(sk, req, true);
tcp_reset(sk, skb);
--
2.37.3
Powered by blists - more mailing lists