aboutsummaryrefslogtreecommitdiff
path: root/net/openvswitch
diff options
context:
space:
mode:
authorJakub Kicinski2020-12-03 12:56:05 -0800
committerJakub Kicinski2020-12-03 12:56:05 -0800
commita4390e966f952510808b10ce7ae2a7dd2a08c0e5 (patch)
treebec485d2c0cb9f248bf75e81ad8c073b3a256b5b /net/openvswitch
parentd4bff72c8401e6f56194ecf455db70ebc22929e2 (diff)
parent3ecfbe3e820997033beb4181c95d80d5c9ac6f85 (diff)
Merge branch 'mptcp-reject-invalid-mp_join-requests-right-away'
Florian Westphal says: ==================== mptcp: reject invalid mp_join requests right away At the moment MPTCP can detect an invalid join request (invalid token, max number of subflows reached, and so on) right away but cannot reject the connection until the 3WHS has completed. Instead the connection will complete and the subflow is reset afterwards. To send the reset most information is already available, but we don't have good spot where the reset could be sent: 1. The ->init_req callback is too early and also doesn't allow to return an error that could be used to inform the TCP stack that the SYN should be dropped. 2. The ->route_req callback lacks the skb needed to send a reset. 3. The ->send_synack callback is the best fit from the available hooks, but its called after the request socket has been inserted into the queue already. This means we'd have to remove it again right away. From a technical point of view, the second hook would be best: 1. Its before insertion into listener queue. 2. If it returns NULL TCP will drop the packet for us. Problem is that we'd have to pass the skb to the function just for MPTCP. Paolo suggested to merge init_req and route_req callbacks instead: This makes all info available to MPTCP -- a return value of NULL drops the packet and MPTCP can send the reset if needed. Because 'route_req' has a 'const struct sock *', this means either removal of const qualifier, or a bit of code churn to pass 'const' in security land. This does the latter; I did not find any spots that need write access to struct sock. To recap, the two alternatives are: 1. Solve it entirely in MPTCP: use the ->send_synack callback to unlink the request socket from the listener & drop it. 2. Avoid 'security' churn by removing the const qualifier. ==================== Link: https://lore.kernel.org/r/20201130153631.21872-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/openvswitch')
0 files changed, 0 insertions, 0 deletions