From owner-svn-src-head@freebsd.org Wed Apr 12 20:27:17 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id F2282D3AD79; Wed, 12 Apr 2017 20:27:16 +0000 (UTC) (envelope-from tuexen@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id CF44C321; Wed, 12 Apr 2017 20:27:16 +0000 (UTC) (envelope-from tuexen@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v3CKRF3x023860; Wed, 12 Apr 2017 20:27:15 GMT (envelope-from tuexen@FreeBSD.org) Received: (from tuexen@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v3CKRFTn023858; Wed, 12 Apr 2017 20:27:15 GMT (envelope-from tuexen@FreeBSD.org) Message-Id: <201704122027.v3CKRFTn023858@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: tuexen set sender to tuexen@FreeBSD.org using -f From: Michael Tuexen Date: Wed, 12 Apr 2017 20:27:15 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r316743 - in head/sys/netinet: . tcp_stacks X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Apr 2017 20:27:17 -0000 Author: tuexen Date: Wed Apr 12 20:27:15 2017 New Revision: 316743 URL: https://svnweb.freebsd.org/changeset/base/316743 Log: The sysctl variable net.inet.tcp.drop_synfin is not honored in all states, for example not in SYN-SENT. This patch adds code to check the sysctl variable in other states than LISTEN. Thanks to ae and gnn for providing comments. Reviewed by: gnn MFC after: 1 week Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D9894 Modified: head/sys/netinet/tcp_input.c head/sys/netinet/tcp_stacks/fastpath.c Modified: head/sys/netinet/tcp_input.c ============================================================================== --- head/sys/netinet/tcp_input.c Wed Apr 12 20:20:04 2017 (r316742) +++ head/sys/netinet/tcp_input.c Wed Apr 12 20:27:15 2017 (r316743) @@ -1613,6 +1613,16 @@ tcp_do_segment(struct mbuf *m, struct tc tcp_pcap_add(th, m, &(tp->t_inpkts)); #endif + if ((thflags & TH_SYN) && (thflags & TH_FIN) && V_drop_synfin) { + if ((s = tcp_log_addrs(inc, th, NULL, NULL))) { + log(LOG_DEBUG, "%s; %s: " + "SYN|FIN segment ignored (based on " + "sysctl setting)\n", s, __func__); + free(s, M_TCPLOG); + } + goto drop; + } + /* * Segment received on connection. * Reset idle time and keep-alive timer. Modified: head/sys/netinet/tcp_stacks/fastpath.c ============================================================================== --- head/sys/netinet/tcp_stacks/fastpath.c Wed Apr 12 20:20:04 2017 (r316742) +++ head/sys/netinet/tcp_stacks/fastpath.c Wed Apr 12 20:27:15 2017 (r316743) @@ -132,6 +132,8 @@ VNET_DECLARE(int, tcp_insecure_rst); #define V_tcp_insecure_rst VNET(tcp_insecure_rst) VNET_DECLARE(int, tcp_insecure_syn); #define V_tcp_insecure_syn VNET(tcp_insecure_syn) +VNET_DECLARE(int, drop_synfin); +#define V_drop_synfin VNET(drop_synfin) static void tcp_do_segment_fastslow(struct mbuf *, struct tcphdr *, struct socket *, struct tcpcb *, int, int, uint8_t, @@ -1729,7 +1731,6 @@ tcp_do_segment_fastslow(struct mbuf *m, struct tcpopt to; thflags = th->th_flags; - tp->sackhint.last_sack_ack = 0; inc = &tp->t_inpcb->inp_inc; nsegs = max(1, m->m_pkthdr.lro_nsegs); /* @@ -1760,6 +1761,23 @@ tcp_do_segment_fastslow(struct mbuf *m, KASSERT(tp->t_state != TCPS_TIME_WAIT, ("%s: TCPS_TIME_WAIT", __func__)); + if ((thflags & TH_SYN) && (thflags & TH_FIN) && V_drop_synfin) { + if ((s = tcp_log_addrs(inc, th, NULL, NULL))) { + log(LOG_DEBUG, "%s; %s: " + "SYN|FIN segment ignored (based on " + "sysctl setting)\n", s, __func__); + free(s, M_TCPLOG); + } + if (ti_locked == TI_RLOCKED) { + INP_INFO_RUNLOCK(&V_tcbinfo); + } + INP_WUNLOCK(tp->t_inpcb); + m_freem(m); + return; + } + + tp->sackhint.last_sack_ack = 0; + /* * Segment received on connection. * Reset idle time and keep-alive timer. @@ -2175,7 +2193,6 @@ tcp_do_segment_fastack(struct mbuf *m, s struct tcpopt to; thflags = th->th_flags; - tp->sackhint.last_sack_ack = 0; inc = &tp->t_inpcb->inp_inc; /* * If this is either a state-changing packet or current state isn't @@ -2205,6 +2222,23 @@ tcp_do_segment_fastack(struct mbuf *m, s KASSERT(tp->t_state != TCPS_TIME_WAIT, ("%s: TCPS_TIME_WAIT", __func__)); + if ((thflags & TH_SYN) && (thflags & TH_FIN) && V_drop_synfin) { + if ((s = tcp_log_addrs(inc, th, NULL, NULL))) { + log(LOG_DEBUG, "%s; %s: " + "SYN|FIN segment ignored (based on " + "sysctl setting)\n", s, __func__); + free(s, M_TCPLOG); + } + if (ti_locked == TI_RLOCKED) { + INP_INFO_RUNLOCK(&V_tcbinfo); + } + INP_WUNLOCK(tp->t_inpcb); + m_freem(m); + return; + } + + tp->sackhint.last_sack_ack = 0; + /* * Segment received on connection. * Reset idle time and keep-alive timer.