d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

The sysctl variable net.inet.tcp.drop_synfin is not honored in all states,

Browse Source 
for example not in SYN-SENT.
This patch adds code to check the sysctl variable in other states than
LISTEN.
Thanks to ae and gnn for providing comments.
Reviewed by:		gnn
MFC after:		1 week
Sponsored by:		Netflix, Inc.
Differential Revision:	https://reviews.freebsd.org/D9894
This commit is contained in:
Michael Tuexen 2017-04-12 20:27:15 +00:00
parent 397b5714d3
commit 013f4df643
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=316743
2 changed files with 46 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/netinet/tcp_input.c
View File

@ -1613,6 +1613,16 @@ tcp_do_segment(struct mbuf *m, struct tcphdr *th, struct socket *so,
tcp_pcap_add(th, m, &(tp->t_inpkts));
#endif
if ((thflags & TH_SYN) && (thflags & TH_FIN) && V_drop_synfin) {
if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
log(LOG_DEBUG, "%s; %s: "
"SYN|FIN segment ignored (based on "
"sysctl setting)\n", s, __func__);
free(s, M_TCPLOG);
}
goto drop;
}
/*
* Segment received on connection.
* Reset idle time and keep-alive timer.

38
sys/netinet/tcp_stacks/fastpath.c
View File

@ -132,6 +132,8 @@ VNET_DECLARE(int, tcp_insecure_rst);
#define V_tcp_insecure_rst VNET(tcp_insecure_rst)
VNET_DECLARE(int, tcp_insecure_syn);
#define V_tcp_insecure_syn VNET(tcp_insecure_syn)
VNET_DECLARE(int, drop_synfin);
#define V_drop_synfin VNET(drop_synfin)
static void tcp_do_segment_fastslow(struct mbuf *, struct tcphdr *,
struct socket *, struct tcpcb *, int, int, uint8_t,
@ -1729,7 +1731,6 @@ tcp_do_segment_fastslow(struct mbuf *m, struct tcphdr *th, struct socket *so,
struct tcpopt to;
thflags = th->th_flags;
tp->sackhint.last_sack_ack = 0;
inc = &tp->t_inpcb->inp_inc;
nsegs = max(1, m->m_pkthdr.lro_nsegs);
/*
@ -1760,6 +1761,23 @@ tcp_do_segment_fastslow(struct mbuf *m, struct tcphdr *th, struct socket *so,
KASSERT(tp->t_state != TCPS_TIME_WAIT, ("%s: TCPS_TIME_WAIT",
__func__));
if ((thflags & TH_SYN) && (thflags & TH_FIN) && V_drop_synfin) {
if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
log(LOG_DEBUG, "%s; %s: "
"SYN|FIN segment ignored (based on "
"sysctl setting)\n", s, __func__);
free(s, M_TCPLOG);
}
if (ti_locked == TI_RLOCKED) {
INP_INFO_RUNLOCK(&V_tcbinfo);
}
INP_WUNLOCK(tp->t_inpcb);
m_freem(m);
return;
}
tp->sackhint.last_sack_ack = 0;
/*
* Segment received on connection.
* Reset idle time and keep-alive timer.
@ -2175,7 +2193,6 @@ tcp_do_segment_fastack(struct mbuf *m, struct tcphdr *th, struct socket *so,
struct tcpopt to;
thflags = th->th_flags;
tp->sackhint.last_sack_ack = 0;
inc = &tp->t_inpcb->inp_inc;
/*
* If this is either a state-changing packet or current state isn't
@ -2205,6 +2222,23 @@ tcp_do_segment_fastack(struct mbuf *m, struct tcphdr *th, struct socket *so,
KASSERT(tp->t_state != TCPS_TIME_WAIT, ("%s: TCPS_TIME_WAIT",
__func__));
if ((thflags & TH_SYN) && (thflags & TH_FIN) && V_drop_synfin) {
if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
log(LOG_DEBUG, "%s; %s: "
"SYN|FIN segment ignored (based on "
"sysctl setting)\n", s, __func__);
free(s, M_TCPLOG);
}
if (ti_locked == TI_RLOCKED) {
INP_INFO_RUNLOCK(&V_tcbinfo);
}
INP_WUNLOCK(tp->t_inpcb);
m_freem(m);
return;
}
tp->sackhint.last_sack_ack = 0;
/*
* Segment received on connection.
* Reset idle time and keep-alive timer.