Date: Fri, 4 May 2018 09:28:12 +0000 (UTC) From: "Andrey V. Elsukov" <ae@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r333244 - head/sys/netinet Message-ID: <201805040928.w449SCdA088586@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ae Date: Fri May 4 09:28:12 2018 New Revision: 333244 URL: https://svnweb.freebsd.org/changeset/base/333244 Log: Immediately propagate EACCES error code to application from tcp_output. In r309610 and r315514 the behavior of handling EACCES was changed, and tcp_output() now returns zero when EACCES happens. The reason of this change was a hesitation that applications that use TCP-MD5 will be affected by changes in project/ipsec. TCP-MD5 code returns EACCES when security assocition for given connection is not configured. But the same error code can return pfil(9), and this change has affected connections blocked by pfil(9). E.g. application doesn't return immediately when SYN segment is blocked, instead it waits when several tries will be failed. Actually, for TCP-MD5 application it doesn't matter will it get EACCES after first SYN, or after several tries. Security associtions must be configured before initiating TCP connection. I left the EACCES in the switch() to show that it has special handling. Reported by: Andreas Longwitz <longwitz at incore dot de> MFC after: 10 days Modified: head/sys/netinet/tcp_output.c Modified: head/sys/netinet/tcp_output.c ============================================================================== --- head/sys/netinet/tcp_output.c Fri May 4 07:28:01 2018 (r333243) +++ head/sys/netinet/tcp_output.c Fri May 4 09:28:12 2018 (r333244) @@ -1586,8 +1586,6 @@ timer: SOCKBUF_UNLOCK_ASSERT(&so->so_snd); /* Check gotos. */ switch (error) { case EACCES: - tp->t_softerror = error; - return (0); case EPERM: tp->t_softerror = error; return (error);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201805040928.w449SCdA088586>