linux.git/include/linux/tcp.h, branch v5.7-rc2

mptcp: Add handling of incoming MP_JOIN requests

2020-03-30T05:14:48+00:00

Process the MP_JOIN option in a SYN packet with the same flow
as MP_CAPABLE but when the third ACK is received add the
subflow to the MPTCP socket subflow list instead of adding it to
the TCP socket accept queue.

The subflow is added at the end of the subflow list so it will not
interfere with the existing subflows operation and no data is
expected to be transmitted on it.

Co-developed-by: Florian Westphal 
Signed-off-by: Florian Westphal 
Co-developed-by: Paolo Abeni 
Signed-off-by: Paolo Abeni 
Signed-off-by: Peter Krystad 
Signed-off-by: Mat Martineau 
Signed-off-by: David S. Miller

mptcp: Add ADD_ADDR handling

2020-03-30T05:14:48+00:00

Add handling for sending and receiving the ADD_ADDR, ADD_ADDR6,
and RM_ADDR suboptions.

Co-developed-by: Matthieu Baerts 
Signed-off-by: Matthieu Baerts 
Co-developed-by: Paolo Abeni 
Signed-off-by: Paolo Abeni 
Signed-off-by: Peter Krystad 
Signed-off-by: Mat Martineau 
Signed-off-by: David S. Miller

mptcp: handle tcp fallback when using syn cookies

2020-01-29T16:45:20+00:00

We can't deal with syncookie mode yet, the syncookie rx path will create
tcp reqsk, i.e. we get OOB access because we treat tcp reqsk as mptcp reqsk one:

TCP: SYN flooding on port 20002. Sending cookies.
BUG: KASAN: slab-out-of-bounds in subflow_syn_recv_sock+0x451/0x4d0 net/mptcp/subflow.c:191
Read of size 1 at addr ffff8881167bc148 by task syz-executor099/2120
 subflow_syn_recv_sock+0x451/0x4d0 net/mptcp/subflow.c:191
 tcp_get_cookie_sock+0xcf/0x520 net/ipv4/syncookies.c:209
 cookie_v6_check+0x15a5/0x1e90 net/ipv6/syncookies.c:252
 tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1123 [inline]
 [..]

Bug can be reproduced via "sysctl net.ipv4.tcp_syncookies=2".

Note that MPTCP should work with syncookies (4th ack would carry needed
state), but it appears better to sort that out in -next so do tcp
fallback for now.

I removed the MPTCP ifdef for tcp_rsk "is_mptcp" member because
if (IS_ENABLED()) is easier to read than "#ifdef IS_ENABLED()/#endif" pair.

Cc: Eric Dumazet 
Fixes: cec37a6e41aae7bf ("mptcp: Handle MP_CAPABLE options for outgoing connections")
Reported-by: Christoph Paasch 
Tested-by: Christoph Paasch 
Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller

tcp: export count for rehash attempts

2020-01-26T14:28:47+00:00

Using IPv6 flow-label to swiftly route around avoid congested or
disconnected network path can greatly improve TCP reliability.

This patch adds SNMP counters and a OPT_STATS counter to track both
host-level and connection-level statistics. Network administrators
can use these counters to evaluate the impact of this new ability better.

Export count for rehash attempts to
1) two SNMP counters: TcpTimeoutRehash (rehash due to timeouts),
   and TcpDuplicateDataRehash (rehash due to receiving duplicate
   packets)
2) Timestamping API SOF_TIMESTAMPING_OPT_STATS.

Signed-off-by: Abdul Kabbani 
Signed-off-by: Neal Cardwell 
Signed-off-by: Yuchung Cheng 
Signed-off-by: Kevin(Yudong) Yang 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

mptcp: parse and emit MP_CAPABLE option according to v1 spec

2020-01-24T12:44:08+00:00

This implements MP_CAPABLE options parsing and writing according
to RFC 6824 bis / RFC 8684: MPTCP v1.

Local key is sent on syn/ack, and both keys are sent on 3rd ack.
MP_CAPABLE messages len are updated accordingly. We need the skbuff to
correctly emit the above, so we push the skbuff struct as an argument
all the way from tcp code to the relevant mptcp callbacks.

When processing incoming MP_CAPABLE + data, build a full blown DSS-like
map info, to simplify later processing.  On child socket creation, we
need to record the remote key, if available.

Signed-off-by: Christoph Paasch 
Signed-off-by: David S. Miller

mptcp: Implement MPTCP receive path

2020-01-24T12:44:07+00:00

Parses incoming DSS options and populates outgoing MPTCP ACK
fields. MPTCP fields are parsed from the TCP option header and placed in
an skb extension, allowing the upper MPTCP layer to access MPTCP
options after the skb has gone through the TCP stack.

The subflow implements its own data_ready() ops, which ensures that the
pending data is in sequence - according to MPTCP seq number - dropping
out-of-seq skbs. The DATA_READY bit flag is set if this is the case.
This allows the MPTCP socket layer to determine if more data is
available without having to consult the individual subflows.

It additionally validates the current mapping and propagates EoF events
to the connection socket.

Co-developed-by: Paolo Abeni 
Signed-off-by: Paolo Abeni 
Co-developed-by: Peter Krystad 
Signed-off-by: Peter Krystad 
Co-developed-by: Davide Caratti 
Signed-off-by: Davide Caratti 
Co-developed-by: Matthieu Baerts 
Signed-off-by: Matthieu Baerts 
Co-developed-by: Florian Westphal 
Signed-off-by: Florian Westphal 
Signed-off-by: Mat Martineau 
Signed-off-by: Christoph Paasch 
Signed-off-by: David S. Miller

mptcp: Handle MP_CAPABLE options for outgoing connections

2020-01-24T12:44:07+00:00

Add hooks to tcp_output.c to add MP_CAPABLE to an outgoing SYN request,
to capture the MP_CAPABLE in the received SYN-ACK, to add MP_CAPABLE to
the final ACK of the three-way handshake.

Use the .sk_rx_dst_set() handler in the subflow proto to capture when the
responding SYN-ACK is received and notify the MPTCP connection layer.

Co-developed-by: Paolo Abeni 
Signed-off-by: Paolo Abeni 
Co-developed-by: Florian Westphal 
Signed-off-by: Florian Westphal 
Signed-off-by: Peter Krystad 
Signed-off-by: Christoph Paasch 
Signed-off-by: David S. Miller

mptcp: Associate MPTCP context with TCP socket

2020-01-24T12:44:07+00:00

Use ULP to associate a subflow_context structure with each TCP subflow
socket. Creating these sockets requires new bind and connect functions
to make sure ULP is set up immediately when the subflow sockets are
created.

Co-developed-by: Florian Westphal 
Signed-off-by: Florian Westphal 
Co-developed-by: Matthieu Baerts 
Signed-off-by: Matthieu Baerts 
Co-developed-by: Davide Caratti 
Signed-off-by: Davide Caratti 
Co-developed-by: Paolo Abeni 
Signed-off-by: Paolo Abeni 
Signed-off-by: Peter Krystad 
Signed-off-by: Christoph Paasch 
Signed-off-by: David S. Miller

mptcp: Handle MPTCP TCP options

2020-01-24T12:44:07+00:00

Add hooks to parse and format the MP_CAPABLE option.

This option is handled according to MPTCP version 0 (RFC6824).
MPTCP version 1 MP_CAPABLE (RFC6824bis/RFC8684) will be added later in
coordination with related code changes.

Co-developed-by: Matthieu Baerts 
Signed-off-by: Matthieu Baerts 
Co-developed-by: Florian Westphal 
Signed-off-by: Florian Westphal 
Co-developed-by: Davide Caratti 
Signed-off-by: Davide Caratti 
Signed-off-by: Peter Krystad 
Signed-off-by: Christoph Paasch 
Signed-off-by: David S. Miller

tcp: add TCP_INFO status for failed client TFO

2019-10-26T02:25:37+00:00

The TCPI_OPT_SYN_DATA bit as part of tcpi_options currently reports whether
or not data-in-SYN was ack'd on both the client and server side. We'd like
to gather more information on the client-side in the failure case in order
to indicate the reason for the failure. This can be useful for not only
debugging TFO, but also for creating TFO socket policies. For example, if
a middle box removes the TFO option or drops a data-in-SYN, we can
can detect this case, and turn off TFO for these connections saving the
extra retransmits.

The newly added tcpi_fastopen_client_fail status is 2 bits and has the
following 4 states:

1) TFO_STATUS_UNSPEC

Catch-all state which includes when TFO is disabled via black hole
detection, which is indicated via LINUX_MIB_TCPFASTOPENBLACKHOLE.

2) TFO_COOKIE_UNAVAILABLE

If TFO_CLIENT_NO_COOKIE mode is off, this state indicates that no cookie
is available in the cache.

3) TFO_DATA_NOT_ACKED

Data was sent with SYN, we received a SYN/ACK but it did not cover the data
portion. Cookie is not accepted by server because the cookie may be invalid
or the server may be overloaded.

4) TFO_SYN_RETRANSMITTED

Data was sent with SYN, we received a SYN/ACK which did not cover the data
after at least 1 additional SYN was sent (without data). It may be the case
that a middle-box is dropping data-in-SYN packets. Thus, it would be more
efficient to not use TFO on this connection to avoid extra retransmits
during connection establishment.

These new fields do not cover all the cases where TFO may fail, but other
failures, such as SYN/ACK + data being dropped, will result in the
connection not becoming established. And a connection blackhole after
session establishment shows up as a stalled connection.

Signed-off-by: Jason Baron 
Cc: Eric Dumazet 
Cc: Neal Cardwell 
Cc: Christoph Paasch 
Cc: Yuchung Cheng 
Acked-by: Yuchung Cheng 
Signed-off-by: David S. Miller