Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'tcp-make-simultaneous-connect-rfc-compliant'
Kuniyuki Iwashima says:
====================
tcp: Make simultaneous connect() RFC-compliant.
Patch 1 fixes an issue that BPF TCP option parser is triggered for ACK
instead of SYN+ACK in the case of simultaneous connect().
Patch 2 removes an wrong assumption in tcp_ao/self-connnect tests.
v2: https://lore.kernel.org/netdev/20240708180852.92919-1-kuniyu@amazon.com/
v1: https://lore.kernel.org/netdev/20240704035703.95065-1-kuniyu@amazon.com/
====================
Link: https://patch.msgid.link/20240710171246.87533-1-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+9
-18
+9
net/ipv4/tcp_input.c
+9
net/ipv4/tcp_input.c
···
5998
5998
* RFC 5961 4.2 : Send a challenge ack
5999
5999
*/
6000
6000
if (th->syn) {
6001
+
if (sk->sk_state == TCP_SYN_RECV && sk->sk_socket && th->ack &&
6002
+
TCP_SKB_CB(skb)->seq + 1 == TCP_SKB_CB(skb)->end_seq &&
6003
+
TCP_SKB_CB(skb)->seq + 1 == tp->rcv_nxt &&
6004
+
TCP_SKB_CB(skb)->ack_seq == tp->snd_nxt)
6005
+
goto pass;
6001
6006
syn_challenge:
6002
6007
if (syn_inerr)
6003
6008
TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
···
6012
6007
goto discard;
6013
6008
}
6014
6009
6010
+
pass:
6015
6011
bpf_skops_parse_hdr(sk, skb);
6016
6012
6017
6013
return true;
···
6819
6813
tcp_fast_path_on(tp);
6820
6814
if (sk->sk_shutdown & SEND_SHUTDOWN)
6821
6815
tcp_shutdown(sk, SEND_SHUTDOWN);
6816
+
6817
+
if (sk->sk_socket)
6818
+
goto consume;
6822
6819
break;
6823
6820
6824
6821
case TCP_FIN_WAIT1: {
-18
tools/testing/selftests/net/tcp_ao/self-connect.c
-18
tools/testing/selftests/net/tcp_ao/self-connect.c
···
30
30
static void tcp_self_connect(const char *tst, unsigned int port,
31
31
bool different_keyids, bool check_restore)
32
32
{
33
-
uint64_t before_challenge_ack, after_challenge_ack;
34
-
uint64_t before_syn_challenge, after_syn_challenge;
35
33
struct tcp_ao_counters before_ao, after_ao;
36
34
uint64_t before_aogood, after_aogood;
37
35
struct netstat *ns_before, *ns_after;
···
60
62
61
63
ns_before = netstat_read();
62
64
before_aogood = netstat_get(ns_before, "TCPAOGood", NULL);
63
-
before_challenge_ack = netstat_get(ns_before, "TCPChallengeACK", NULL);
64
-
before_syn_challenge = netstat_get(ns_before, "TCPSYNChallenge", NULL);
65
65
if (test_get_tcp_ao_counters(sk, &before_ao))
66
66
test_error("test_get_tcp_ao_counters()");
67
67
···
78
82
79
83
ns_after = netstat_read();
80
84
after_aogood = netstat_get(ns_after, "TCPAOGood", NULL);
81
-
after_challenge_ack = netstat_get(ns_after, "TCPChallengeACK", NULL);
82
-
after_syn_challenge = netstat_get(ns_after, "TCPSYNChallenge", NULL);
83
85
if (test_get_tcp_ao_counters(sk, &after_ao))
84
86
test_error("test_get_tcp_ao_counters()");
85
87
if (!check_restore) {
···
89
95
if (after_aogood <= before_aogood) {
90
96
test_fail("%s: TCPAOGood counter mismatch: %zu <= %zu",
91
97
tst, after_aogood, before_aogood);
92
-
close(sk);
93
-
return;
94
-
}
95
-
if (after_challenge_ack <= before_challenge_ack ||
96
-
after_syn_challenge <= before_syn_challenge) {
97
-
/*
98
-
* It's also meant to test simultaneous open, so check
99
-
* these counters as well.
100
-
*/
101
-
test_fail("%s: Didn't challenge SYN or ACK: %zu <= %zu OR %zu <= %zu",
102
-
tst, after_challenge_ack, before_challenge_ack,
103
-
after_syn_challenge, before_syn_challenge);
104
98
close(sk);
105
99
return;
106
100
}