netdev - Re: [PATCH net-next 2/3] bpf: add TCP_BPF_RTO_MAX for bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250213022501.76123-1-kuniyu@amazon.com>
Date: Thu, 13 Feb 2025 11:25:01 +0900
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <kerneljasonxing@...il.com>
CC: <andrii@...nel.org>, <ast@...nel.org>, <bpf@...r.kernel.org>,
	<daniel@...earbox.net>, <davem@...emloft.net>, <dsahern@...nel.org>,
	<eddyz87@...il.com>, <edumazet@...gle.com>, <haoluo@...gle.com>,
	<horms@...nel.org>, <john.fastabend@...il.com>, <jolsa@...nel.org>,
	<kpsingh@...nel.org>, <kuba@...nel.org>, <kuniyu@...zon.com>,
	<martin.lau@...ux.dev>, <ncardwell@...gle.com>, <netdev@...r.kernel.org>,
	<pabeni@...hat.com>, <sdf@...ichev.me>, <song@...nel.org>,
	<yonghong.song@...ux.dev>
Subject: Re: [PATCH net-next 2/3] bpf: add TCP_BPF_RTO_MAX for bpf_setsockopt

From: Jason Xing <kerneljasonxing@...il.com>
Date: Thu, 13 Feb 2025 08:43:53 +0800
> Support bpf_setsockopt() to set the maximum value of RTO for
> BPF program.
> 
> Signed-off-by: Jason Xing <kerneljasonxing@...il.com>
> ---
>  Documentation/networking/ip-sysctl.rst | 3 ++-
>  include/uapi/linux/bpf.h               | 2 ++
>  net/core/filter.c                      | 6 ++++++
>  tools/include/uapi/linux/bpf.h         | 2 ++
>  4 files changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
> index 054561f8dcae..78eb0959438a 100644
> --- a/Documentation/networking/ip-sysctl.rst
> +++ b/Documentation/networking/ip-sysctl.rst
> @@ -1241,7 +1241,8 @@ tcp_rto_min_us - INTEGER
>  
>  tcp_rto_max_ms - INTEGER
>  	Maximal TCP retransmission timeout (in ms).
> -	Note that TCP_RTO_MAX_MS socket option has higher precedence.
> +	Note that TCP_BPF_RTO_MAX and TCP_RTO_MAX_MS socket option have the
> +	higher precedence for configuring this setting.
>  
>  	When changing tcp_rto_max_ms, it is important to understand
>  	that tcp_retries2 might need a change.
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index 2acf9b336371..8ab6ef144217 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -2868,6 +2868,7 @@ union bpf_attr {
>   * 		  **TCP_NODELAY**, **TCP_MAXSEG**, **TCP_WINDOW_CLAMP**,
>   * 		  **TCP_THIN_LINEAR_TIMEOUTS**, **TCP_BPF_DELACK_MAX**,
>   *		  **TCP_BPF_RTO_MIN**, **TCP_BPF_SOCK_OPS_CB_FLAGS**.
> + *		  **TCP_BPF_RTO_MAX**
>   * 		* **IPPROTO_IP**, which supports *optname* **IP_TOS**.
>   * 		* **IPPROTO_IPV6**, which supports the following *optname*\ s:
>   * 		  **IPV6_TCLASS**, **IPV6_AUTOFLOWLABEL**.
> @@ -7091,6 +7092,7 @@ enum {
>  	TCP_BPF_SYN_IP		= 1006, /* Copy the IP[46] and TCP header */
>  	TCP_BPF_SYN_MAC         = 1007, /* Copy the MAC, IP[46], and TCP header */
>  	TCP_BPF_SOCK_OPS_CB_FLAGS = 1008, /* Get or Set TCP sock ops flags */
> +	TCP_BPF_RTO_MAX		= 1009, /* Max delay ack in msecs */
>  };
>  
>  enum {
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 2ec162dd83c4..a21a147e0a86 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -5303,6 +5303,12 @@ static int bpf_sol_tcp_setsockopt(struct sock *sk, int optname,
>  			return -EINVAL;
>  		tp->bpf_sock_ops_cb_flags = val;
>  		break;
> +	case TCP_BPF_RTO_MAX:
> +		if (val > TCP_RTO_MAX_SEC * MSEC_PER_SEC ||
> +		    val < TCP_RTO_MAX_MIN_SEC * MSEC_PER_SEC)
> +			return -EINVAL;
> +		inet_csk(sk)->icsk_rto_max = msecs_to_jiffies(val);
> +		break;
>  	default:
>  		return -EINVAL;
>  	}

You need not define TCP_BPF_RTO_MAX because TCP_RTO_MAX is not a
BPF specific option, and you can just reuse do_tcp_setsockopt(),
then bpf_getsockopt() also works.

---8<---
diff --git a/net/core/filter.c b/net/core/filter.c
index 2ec162dd83c4..77732f10097c 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5382,6 +5382,7 @@ static int sol_tcp_sockopt(struct sock *sk, int optname,
 	case TCP_USER_TIMEOUT:
 	case TCP_NOTSENT_LOWAT:
 	case TCP_SAVE_SYN:
+	case TCP_RTO_MAX:
 		if (*optlen != sizeof(int))
 			return -EINVAL;
 		break;
---8<---