1. Replace IS_ENABLED(CONFIG_BPF) with CONFIG_BPF_SYSCALL for cookie_bpf_ok() and cookie_bpf_check(). CONFIG_BPF is selected by CONFIG_NET unconditionally, so IS_ENABLED(CONFIG_BPF) is always true and provides no real guard. CONFIG_BPF_SYSCALL is the correct config for BPF program functionality.
2. Remove the CONFIG_BPF guard around struct bpf_tcp_req_attrs. Since CONFIG_BPF is always selected by CONFIG_NET the guard is a no-op, and the struct is referenced by bpf_sk_assign_tcp_reqsk() in net/core/filter.c which is compiled unconditionally, so its visibility is not actually conditional on BPF being enabled. 3. Fix mismatched declaration of cookie_bpf_check() between the CONFIG_BPF_SYSCALL and stub paths: the real definition takes 'struct net *net' but the declaration in the header did not. Add the net parameter to the declaration and all call sites. 4. Add missing LINUX_MIB_SYNCOOKIESRECV and LINUX_MIB_SYNCOOKIESFAILED statistics in cookie_bpf_check(), so that BPF custom syncookie validation is accounted for in SNMP counters just like the non-BPF path. Compile-tested with CONFIG_BPF_SYSCALL=y and CONFIG_BPF_SYSCALL not set. Signed-off-by: Jiayuan Chen <[email protected]> Reviewed-by: Kuniyuki Iwashima <[email protected]> --- include/net/tcp.h | 7 +++---- net/ipv4/syncookies.c | 10 +++++++--- net/ipv6/syncookies.c | 2 +- 3 files changed, 11 insertions(+), 8 deletions(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index dfa52ceefd23b..0e3e43c7a89ce 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -599,7 +599,6 @@ struct request_sock *cookie_tcp_reqsk_alloc(const struct request_sock_ops *ops, struct tcp_options_received *tcp_opt, int mss, u32 tsoff); -#if IS_ENABLED(CONFIG_BPF) struct bpf_tcp_req_attrs { u32 rcv_tsval; u32 rcv_tsecr; @@ -613,7 +612,6 @@ struct bpf_tcp_req_attrs { u8 usec_ts_ok; u8 reserved[3]; }; -#endif #ifdef CONFIG_SYN_COOKIES @@ -716,13 +714,14 @@ static inline bool cookie_ecn_ok(const struct net *net, const struct dst_entry * dst_feature(dst, RTAX_FEATURE_ECN); } -#if IS_ENABLED(CONFIG_BPF) +#ifdef CONFIG_BPF_SYSCALL static inline bool cookie_bpf_ok(struct sk_buff *skb) { return skb->sk; } -struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb); +struct request_sock *cookie_bpf_check(struct net *net, struct sock *sk, + struct sk_buff *skb); #else static inline bool cookie_bpf_ok(struct sk_buff *skb) { diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c index df479277fb801..9251d4a15c888 100644 --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c @@ -294,8 +294,9 @@ static int cookie_tcp_reqsk_init(struct sock *sk, struct sk_buff *skb, return 0; } -#if IS_ENABLED(CONFIG_BPF) -struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb) +#ifdef CONFIG_BPF_SYSCALL +struct request_sock *cookie_bpf_check(struct net *net, struct sock *sk, + struct sk_buff *skb) { struct request_sock *req = inet_reqsk(skb->sk); @@ -305,6 +306,9 @@ struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb) if (cookie_tcp_reqsk_init(sk, skb, req)) { reqsk_free(req); req = NULL; + __NET_INC_STATS(net, LINUX_MIB_SYNCOOKIESFAILED); + } else { + __NET_INC_STATS(net, LINUX_MIB_SYNCOOKIESRECV); } return req; @@ -419,7 +423,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) goto out; if (cookie_bpf_ok(skb)) { - req = cookie_bpf_check(sk, skb); + req = cookie_bpf_check(net, sk, skb); } else { req = cookie_tcp_check(net, sk, skb); if (IS_ERR(req)) diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c index 4f6f0d751d6c5..111d7a41d9573 100644 --- a/net/ipv6/syncookies.c +++ b/net/ipv6/syncookies.c @@ -190,7 +190,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) goto out; if (cookie_bpf_ok(skb)) { - req = cookie_bpf_check(sk, skb); + req = cookie_bpf_check(net, sk, skb); } else { req = cookie_tcp_check(net, sk, skb); if (IS_ERR(req)) -- 2.43.0
