From: Eric Dumazet <eduma...@google.com>
Creates four new drop reasons for the following cases:
1) packet being rejected by RFC 7323 PAWS check
2) packet being rejected by SEQUENCE check
3) Invalid RST packet
4) Invalid SYN packet
Signed-off-by: Eric Dumazet <eduma...@google.com>
Signed-off-by: David S. Miller <da...@davemloft.net>
Acked-by: Nikolay Borisov <nbori...@suse.com>
Signed-off-by: Nikolay Borisov <nikolay.bori...@virtuozzo.com>
---
include/linux/skbuff.h | 6 ++++++
include/trace/events/skb.h | 5 +++++
net/ipv4/tcp_input.c | 7 ++++++-
3 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 6f96ee788d99..dc38a214eee4 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -379,6 +379,12 @@ enum skb_drop_reason {
* the ofo queue, corresponding to
* LINUX_MIB_TCPOFOMERGE
*/
+ SKB_DROP_REASON_TCP_RFC7323_PAWS, /* PAWS check, corresponding to
+ * LINUX_MIB_PAWSESTABREJECTED
+ */
+ SKB_DROP_REASON_TCP_INVALID_SEQUENCE, /* Not acceptable SEQ field */
+ SKB_DROP_REASON_TCP_RESET, /* Invalid RST packet */
+ SKB_DROP_REASON_TCP_INVALID_SYN, /* Incoming packet has unexpected SYN
flag */
SKB_DROP_REASON_IP_OUTNOROUTES, /* route lookup failed */
SKB_DROP_REASON_BPF_CGROUP_EGRESS, /* dropped by
* BPF_PROG_TYPE_CGROUP_SKB
diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h
index 3357b2aec05b..bb704d7ea8c9 100644
--- a/include/trace/events/skb.h
+++ b/include/trace/events/skb.h
@@ -37,6 +37,11 @@
EM(SKB_DROP_REASON_TCP_OLD_DATA, TCP_OLD_DATA) \
EM(SKB_DROP_REASON_TCP_OVERWINDOW, TCP_OVERWINDOW) \
EM(SKB_DROP_REASON_TCP_OFOMERGE, TCP_OFOMERGE) \
+ EM(SKB_DROP_REASON_TCP_RFC7323_PAWS, TCP_RFC7323_PAWS) \
+ EM(SKB_DROP_REASON_TCP_INVALID_SEQUENCE, \
+ TCP_INVALID_SEQUENCE) \
+ EM(SKB_DROP_REASON_TCP_RESET, TCP_RESET) \
+ EM(SKB_DROP_REASON_TCP_INVALID_SYN, TCP_INVALID_SYN) \
EM(SKB_DROP_REASON_IP_OUTNOROUTES, IP_OUTNOROUTES) \
EM(SKB_DROP_REASON_BPF_CGROUP_EGRESS, \
BPF_CGROUP_EGRESS) \
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a21a4b5602c0..9db35e8fe894 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5630,6 +5630,7 @@ static bool tcp_validate_incoming(struct sock *sk, struct
sk_buff *skb,
{
struct tcp_sock *tp = tcp_sk(sk);
bool rst_seq_match = false;
+ SKB_DR(reason);
/* RFC1323: H1. Apply PAWS check first. */
if (tcp_fast_parse_options(sock_net(sk), skb, th, tp) &&
@@ -5641,6 +5642,7 @@ static bool tcp_validate_incoming(struct sock *sk, struct
sk_buff *skb,
LINUX_MIB_TCPACKSKIPPEDPAWS,
&tp->last_oow_ack_time))
tcp_send_dupack(sk, skb);
+ SKB_DR_SET(reason, TCP_RFC7323_PAWS);
goto discard;
}
/* Reset is accepted even if it did not pass PAWS. */
@@ -5664,6 +5666,7 @@ static bool tcp_validate_incoming(struct sock *sk, struct
sk_buff *skb,
} else if (tcp_reset_check(sk, skb)) {
tcp_reset(sk, skb);
}
+ SKB_DR_SET(reason, TCP_INVALID_SEQUENCE);
goto discard;
}
@@ -5709,6 +5712,7 @@ static bool tcp_validate_incoming(struct sock *sk, struct
sk_buff *skb,
tcp_fastopen_active_disable(sk);
tcp_send_challenge_ack(sk, skb);
}
+ SKB_DR_SET(reason, TCP_RESET);
goto discard;
}
@@ -5723,6 +5727,7 @@ static bool tcp_validate_incoming(struct sock *sk, struct
sk_buff *skb,
TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNCHALLENGE);
tcp_send_challenge_ack(sk, skb);
+ SKB_DR_SET(reason, TCP_INVALID_SYN);
goto discard;
}
@@ -5731,7 +5736,7 @@ static bool tcp_validate_incoming(struct sock *sk, struct
sk_buff *skb,
return true;
discard:
- tcp_drop(sk, skb);
+ tcp_drop_reason(sk, skb, reason);
return false;
}
--
2.34.1
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
