Skip to content

TCP connection repair (v3)

Pavel Emelyanov netdev 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest3 patches 8 repliesIn review

Changes since v2 from the cover letter

* The CAP_NET_ADMIN is required to turn repair on, not CAP_SYS_ADMIN

* Changed read queue seq sockoption to work on the rcv_nxt, not the copied_seq to address the issue with syn flag in the fake header (see below).

* Resolved issues with syn and fin flags in fake headers.

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/3tcp: Move code aroundinclude/net/tcp.h net/ipv4/tcp.c net/ipv4/tcp_input.c +1 more+54 -360 replies
2/3tcp: Initial repair modeinclude/linux/tcp.h include/net/tcp.h net/ipv4/inet_connection_sock.c +3 more+114 -84 replies
3/3tcp: Repair socket queuesnet/ipv4/tcp.c net/ipv4/tcp_output.c+87 -34 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH net-next 0/3] TCP connection repair (v3)

Hi!

Attempt #3 with transparent TCP connection hijacking (previous one is here http://lists.openwall.net/netdev/2012/03/06/65).

Changes since v2:

* The CAP_NET_ADMIN is required to turn repair on, not CAP_SYS_ADMIN

* Changed read queue seq sockoption to work on the rcv_nxt, not the copied_seq to address the issue with syn flag in the fake header (see below).

* Resolved issues with syn and fin flags in fake headers.

Fin can and should be dropped. The repair mode is currently allowed only for closed and established sockets and thus we cannot meet an skb with this flag in the original socket (queuing fin to receive queue switches the established state to the close-wait one).

Syn can also be dropped. This flag in the recv queue's skb means the respective skb's seq is off-by-one relative to the actual amount of data on it. Thus, removing the flag from fake skb and fixing the seq respectively solves the issue.

However, in order to do so it's not enough to know the copied_seq and recv queue length only (rcv_nxt should be copied_seq plus data length plus "syn-is-there"). Thus, the rcv queue seq get/set sockoption is changed to work on the rcv_nxt itself. IOW I emulate the situation when the packet with data and syn is splitted into two -- a packet with syn and a packet with data and the former one is already "eaten".

Thanks,
Pavel

Read the cover letter in its thread