lkml.org 
[lkml]   [2021]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 51/74] tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD
    Date
    From: Luke Hsiao <lukehsiao@google.com>

    [ Upstream commit e3faa49bcecdfcc80e94dd75709d6acb1a5d89f6 ]

    Since the original TFO server code was implemented in commit
    168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef ("tcp: TCP Fast Open Server -
    main code path") the TFO server code has supported the sysctl bit flag
    TFO_SERVER_COOKIE_NOT_REQD. Currently, when the TFO_SERVER_ENABLE and
    TFO_SERVER_COOKIE_NOT_REQD sysctl bit flags are set, a server connection
    will accept a SYN with N bytes of data (N > 0) that has no TFO cookie,
    create a new fast open connection, process the incoming data in the SYN,
    and make the connection ready for accepting. After accepting, the
    connection is ready for read()/recvmsg() to read the N bytes of data in
    the SYN, ready for write()/sendmsg() calls and data transmissions to
    transmit data.

    This commit changes an edge case in this feature by changing this
    behavior to apply to (N >= 0) bytes of data in the SYN rather than only
    (N > 0) bytes of data in the SYN. Now, a server will accept a data-less
    SYN without a TFO cookie if TFO_SERVER_COOKIE_NOT_REQD is set.

    Caveat! While this enables a new kind of TFO (data-less empty-cookie
    SYN), some firewall rules setup may not work if they assume such packets
    are not legit TFOs and will filter them.

    Signed-off-by: Luke Hsiao <lukehsiao@google.com>
    Acked-by: Neal Cardwell <ncardwell@google.com>
    Acked-by: Yuchung Cheng <ycheng@google.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Link: https://lore.kernel.org/r/20210816205105.2533289-1-luke.w.hsiao@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ipv4/tcp_fastopen.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
    index 2ab371f55525..119d2c2f3b04 100644
    --- a/net/ipv4/tcp_fastopen.c
    +++ b/net/ipv4/tcp_fastopen.c
    @@ -342,8 +342,7 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
    return NULL;
    }

    - if (syn_data &&
    - tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD))
    + if (tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD))
    goto fastopen;

    if (foc->len >= 0 && /* Client presents or requests a cookie */
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-09-09 15:40    [W:2.807 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site