When spitting an RSM containing the SYN and data, honor the
sequence number used by the SYN flag when computing the offset
in the socket buffer.
PR: 297006
Reviewed by: rrs, Peter Lei
MFC after: 3 days
MFC to: stable/15
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D61149
The RACK stack's path capacity measurement module maintains an array of
samples, updated when the stack receives an ACK. The array grows as
needed, but code which handles the expansion is susceptible to remotely
triggerable overflow. This could lead to underallocation and a ~512KB
out-of-bounds write.
Fix this by bounding the sample array size.
Approved by: so
Security: FreeBSD-SA-26:70.tcp
Security: CVE-2026-101307
Reviewed by: glebius, markj
Reported by: Nozomi Networks Security Research
When userland_sysctl() experiences EAGAIN, don't loop internally but
leave retrying to the caller.
Looping was a problem in case of using tcpsso(8) to switch a TCP stack
where the acceptance check of the new TCP stack results in EAGAIN.
Reviewed by: kib, glebius
MFC after: 1 week
MFC to: stable/15
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D60444
Since the struct inpcb in embedded in the struct tcpcb, the
relationship can't change. So there is no need to reassign the tp
anymore.
No functional change intended.
Reported by: Hannes Elfert
Reviewed by: glebius
MFC after: 1 week
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D59384
All other usages of SCF_SIGNATURE are protected by IPSEC_SUPPORT
or TCP_SIGNATURE.
No functional change intended.
Reported by: Hannes Elfert
MFC after: 1 week
MFC to: stable/14
MFC to: stable/15
When processing the ACK of the initial TCP handshake using the
SYN cookie, don't increment the counter for unexpected
signatures (tcps_sig_err_sigopt). The correct
counter (tcps_sig_rcvbadsig) for bad signatures is already
incremented in TCPMD5_INPUT().
Reported by: Hannes Elfert
Reviewed by: rscheff
MFC after: 1 week
MFC to: stable/14
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D59302
When receiving a SYN segment with an MD5 option on a listening socket,
which has not enabled TCP MD5 support, increment the counter for
unexpected signatures (tcps_sig_err_sigopt).
Reviewed by: rscheff
MFC after: 1 week
MFC to: stable/14
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D59303
For non listening TCP endpoints, increment the tcps_sig_err_sigopt
counter when TCP MD5 is not enabled in the TCP connection, but a
segment containing a TCP MD5 option is received.
Also increment the counter when using the RACK or BBR stack.
Reported by: Hannes Elfert
Reviewed by: rrs
MFC after: 1 week
MFC to: stable/14
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D59249
When using -b, provide in addition to the BBLog state also the number
of entries stored at the endpoint, the corresponding upper limit and
the next sequence number to be assigned.
Reviewed by: rrs
MFC after: 1 week
MFC to: stable/15
MFC to: stable/14
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D59131
Several cleanups in tcp_input_with_port():
* Don't assign m twice.
* Don't reassign pointers without having done pullup().
* While there, change the type of isipv6 to bool, since it is used
that way.
No functional change intended.
Reported by: Hannes Elfert
Reviewed by: pouria, Timo Völker, Nick Banks
MFC after: 1 week
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D59142
Include the entries of the BBLOG STATE column in the computation
of the column width as done also for other columns.
Also set first to falso only when needed.
MFC after: 3 days
MFC to: stable/15
MFC to: stable/14
Sponsored by: Netflix, Inc.
A RST segment can be sent in response to
(a) received segment or
(b) by the upper layer protocol.
The SEG.SEQ validation consists of two checks:
(1) the in-window check of SEG.SEQ and
(2) the exact match check of SEG.SEQ.
For the in-window check (1), the left edge of the window needs to be
based on tp->last_ack_sent to cover the delayed ACK case, whereas the
right edge needs to be based on tp->rcv_nxt + tp->rcv_wnd. This both
assumes that tp->rcv_wnd is not zero. For the special case of
tp->rcv_wnd being zero, add checks against tp->last_ack_sent for (a)
and on tp->rcv_nxt for (b). This applies to all TCP stacks.
When the exact match (2) of SEG.SEQ is performed, it should be based
on tp->last_ack_sent for (a) and on tp->rcv_nxt for (b). To cover both,
check for both. Add this only to the base stack, since the RACK and
BBR stacks already do this.
PR: 296594
Reviewed by: rscheff
MFC after: 3 days
MFC to: stable/14
MFC to: stable/15
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D58594
When a TCP timer is stopped, t_timers[] is set to SBT_MAX. Adding the
corresponding t_precisions[], if it is not zero, would result in
overflows in tcp_timer_next(). To avoid this, skip stopped timers.
The problem was identified while debugging uperf by Lukas Book and
an initial patch was provided by him. The committed patch was
suggested by glebius.
The problem can be observed by running netstat -nxptcp and looking for
negative timer values and by observing very long running timers in
some cases.
Reported by: Lukas Book <[email protected]>
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58484
The latest version of draft-ietf-tcpm-tcp-ghost-acks changed
a condition. This should make no substantial difference, but makei
it compliant to the latest version of the specification.
Reviewed by: rscheff, Peter Lei
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D58411
This fixes an endianness bug in sys/netinet/ip_reass_test.
Just use the code from RFC 1071.
Reported by: glebius
Reviewed by: glebius, Timo Völker
MFC after: 1 week
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D57988
Handle cred, ipopts, and maclabel using the same pattern:
allocate at the beginning and set to NULL when the object is
transferred to a struct syncache. When exiting the function, free
these objects if not transferred or when transferred to the on-stack
struct syncache. This makes use of a new function syncache_release().
This fixes a use after free problem: ipopts should only be freed,
if the on-stack struct syncache is used and the pointer in this
structure still points to the allocated ipopts. If the ipopts
are moved from the struct syncache to the struct inpcb in
syncache_socket(), which is called by syncache_tfo_expand(),
the pointer in the struct syncache is set to NULL.
In a FreeBSD default setup this problem is mitigated by
1. TCP fast open support on the server side not being enabled
(the sysctl-variable net.inet.tcp.fastopen.server_enable is 0).
2. Incoming IP packet with source routing options are not being
processed by the host stack
(the sysctl-variable net.inet.ip.accept_sourceroute is 0).
Only if these two sysctl-variables are changed, a FreeBSD system
is affected, if a server actually using TCP fast open is running.
Reported by: Yuxiang Yang, Yizhou Zhao, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM5.1 from Z.ai
Reviewed by: markj, rscheff
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D57374
Add an example for allowing members of the network group to read from
bpf devices. In particular, this allows members of the network group
to monitor traffic without running with root privileges.
Reviewed by: markj, glebius
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D56742
iflib_txq_drain() returns the number of consumed entries. In the case
of TSO, a single entry can contain multiple TCP packets.
Reported by: Ricardo Branco, David Wolfskill
Reviewed by: gallatin
Fixes: 3fade68cfd ("iflib: accurately count bytes/segments for TSO")
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D56509
Implement the criteria specified in RFC 6191 for recycling TCP
connections in TIME-WAIT.
Reviewed by: rscheff, Marius Halden
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D56321
On platforms other than amd64, BIOCSRTIMEOUT is equal to
BIOCSRTIMEOUT32. Therefore, running the COMPAT_FREEBSD32 code
basically clears tv_usec on big endian platforms. When tcpdump is
used, the timeout requested is 100ms, which gets cleared to 0 on
ppc64 platforms. This results in tcpdump showing the packets only
when the read buffer is full.
Thanks to kib for guiding me to the correct fix.
Reported by: ivy
Reviewed by: adrian, kib
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D56399
This TF_-flag is only used in the RACK stack and not really needed.
So replace it, since glebius@ needs a TF_ flag and right now all
of them are taken.
No functional change intended.
Reviewed by: rrs, glebius, rscheff, Nick Banks
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D56025
When a challenge ACK should be sent via tcp_send_challenge_ack(),
but the rate limiter suppresses the sending, free the mbuf chain.
The caller of tcp_send_challenge_ack() expects this similar to the
callers of tcp_respond().
Approved by: so
Security: FreeBSD-SA-26:06.tcp
Security: CVE-2026-4247
Reviewed by: lstewart
Tested by: lstewart
Sponsored by: Netflix, Inc.
The check for excluding duplicate ACKs needs to consider only TH_SYN
and TH_FIN. We know that TH_ACK is set and TH_RST is cleared. All
other flags, in particular TH_ECE, TH_CWR, and TH_AE needs to be
ignored for the check.
PR: 292293
Reviewed by: rrs
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D55489
PR: 292293
Reviewed by: rrs, rscheff, pouria, Nick Banks, Peter Lei
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D5546
Let the receive checksum offload for TCP/IPv6 and UDP/IPv6 be
controlled by ifconfig rxcsum6 and not by ifconfig rxcsum.
While there, make the code more compact and improve stlye.9
conformity.
Reviewed by: Timo Völker
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D55188
Apparently, the name of the variable l4off was correct. Providing the
offset to the TCP or UDP header allows the transmit checksum offload to
work for TCP/IPv4, TCP/IPv6, UDP/IPv4, and UDP/IPv6.
Reported by: vishwin
Reviewed by: vishwin
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D55187
When calling sctp_peeloff() on a SOCK_SEQPACKET socket, the created
and returned socket has the type SOCK_STREAM.
This is specified in section 9.2 of RFC 6458.
Reported by: Xin Long
MFC after: 3 days
This patch fixes three issues:
(1) Initially, set the hwassist flags correctly when enabling
transmit checksum offload for TCP/IPv6 and UDP/IPv6.
(2) Keep the hwassist flags in sync with the capabilities when
changing txcsum.
(3) Keep the hwasssit flags in sync with the capabilities when
changing txcsum6.
Without this patch, transmit checksum offloading for TCP/IPv6 and
UDP/IPv6 is never used and transmit checksum offloading for IPv4,
TCP/IPv4 and UDP/IPv4 is always used, even if disabled via
ifconfig ue? -txcsum.
Reviewed by: Timo Völker
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D54974
Add support for IFCOUNTER_IPACKETS, IFCOUNTER_OPACKETS,
IFCOUNTER_OBYTES, IFCOUNTER_OMCASTS, IFCOUNTER_OERRORS, and
IFCOUNTER_OQDROPS.
This allows tools like systat to report the incoming and outgoing
bandwidth.
Reviewed by: dsl, Timo Völker
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D54893
Let the network stack know that the NIC supports checksum offloading
for the IPv4 header checksum and the TCP and UDP transport checksum.
This avoids the computation in software and therefore provides the
expected performance gain.
PR: 292006
Reviewed by: dsl, Timo Völker
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D54809
When compiling SCTP as a module, don't compile sctp_crc32.c into
the module. This avoids code and variable duplication since
sctp_crc32.c is compiled into the kernel. In particular, the variable
system_base_info is not duplicated. This fixes the handling of the
statistic counters sctps_sendhwcrc and sctps_sendswcrc when using
sctp_delayed_cksum.
MFC after: 3 days
This patch adds support for receive checksum offload for TCP/IPv6
and UDP/IPv6. Since receive checksum offload can't be configured
separately for IPv4 and IPv6, IFCAP_RXCSUM and IFCAP_RXCSUM_IPV6
can't be changed independently.
Reviewed by: Timo Völker
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D54756
This patch adds support for transmit checksum offload for TCP/IPv6
and UDP/IPv6.
Reviewed by: Timo Völker
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D54754
The bge interface is special with respect to transmit checksumi
offloading. In the default settings, an bge interface announces TXCSUM
capabilities, but only supports TCP/IPv4 and not UDP/IPv4 due to
limitations of some of the NICs. This results in problems when the bge
interface becomes a member of a bridge. Since currently only the
TXCSUM capabilities are synced when a member is added to a bridge and
not the protocol specific capabilities, this can result in a situation
where UDP packets are sent out using a bge interface without having a
correct checksum.
To mitigate this problem, initially don't announce TXCSUM capabilities,
when UDP transmit checksum is disabled. It is still possible to enable
TXCSUM capabilities via ifconfig.
PR: 291420
Reviewed by: Timo Voelker
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D54486
If a jumbo payload option is added, the length of the mbuf chain is
increased by 8 but the actual hop-by-hop extension header with the
jumbo playload option is only inserted in the packet if there are
other options. Therefore, adjust optlen to reflect the actual size
of IPv6 extension headers including the hop-by-hop extension header
containing the jumbo payload option.
Reported by: [email protected]
Reviewed by: markj, Timo Voelker
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D54394
This patch provides two improvements for TCP/IPv4 and UDP/IPv4
transmit checksum offloading:
(1) Use *CIC_SEG instead of *CIC_FULL, since FreeBSD always provides
a pseudo header checksum.
(2) Don't make transmit IPv4 header checksum offloading a prerequisite
for TCP/IPv4 or UDP/IPv4 transmit checksum offloading.
This is the root cause of PR 291696, since right now the epair
interface does not support transmit IPv4 header checksum offloading,
but TCP/IPv4 and UDP/IPv4 transmit checksum offloading.
PR: 291696
Reviewed by: Timo Voelker
Tested by: Marek Benc
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D54395
Right now the 64-bit flags field needs to be casted to a 32-bit field,
because clang warns if more than 32-bits are used.
Once clang is fixed, this restriction will be removed and more bits
will be added.
Reviewed by: markj, Timo Völker
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D54288
This will be usable after clang has been extended to accept length
modifiers for %b when compiling kernel code.
But we need FreeBSD to support it first...
Reviewed by: markj, Timo Völker
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D54286
Provide the flags used for a vtnet interface via the sysctl tree.
This is mostly used for debugging purposes.
Reviewed by: Timo Völker
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D54283
Transmit segment offloading depends on transmit checksum offloading.
Enforce that constraint. This also fixes a bug, since if_hwassist bits
are from the CSUM_ space, not from the IFCAP_ space.
PR: 290773
Reviewed by: Timo Völker
Tested by: [email protected]
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D53629
According to section 5.1.6.2.1 of version 1.3 of the virtio
specification, the driver MUST NOT set VIRTIO_NET_HDR_F_DATA_VALID in
the flags. So don't do that.
Reviewed by: Timo Völker
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D53650
Add a comment explaining why syncache entries are dropped and fix a
typo in a comment.
Reviewed by: rrs, glebius
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53564
When a SYN ACK is received for a listening socket, just drop it
instead of killing the SYN-cache entry and send a RST.
This closes the possibility to kill a TCP connection during its
handling in the SYN-cache.
Reviewed by: Nick Banks, Peter Lei
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53540
* shuffle around the inp_label to give inp_flags more space since it
can become long.
* fix the indentation of in6p_icmp6filt, in6p_cksum, and in6p_hops.
Reviewed by: Peter Lei
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53541
This is much more compact. Thanks to markj@ for suggesting the change.
Reviewed by: markj, Peter Lei, imp, Nick Banks
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53510
This is much more compact. Thanks to markj@ for suggesting the change.
Reviewed by: markj
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53507
Add /i option to the ddb commands show tcpcb and show all tcpcbs,
which enables the printing of the t_inpcb.
Reviewed by: markj
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53497
Add four missing flags (INP_BINDANY, INP_INHASHLIST, INP_RESERVED_0,
INP_BOUNDFIB) used in inp_flags and remove one flag (INP_ORIGDSTADDR),
which is actually a flag used in inp_flags2 and not in inp_flags.
Reviewed by: markj
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53498
When adding a syncache entry, take a reference count of the
credentials while the inp is still locked.
Thanks to markj@ for providing a hint regarding the root cause.
Reported by: David Marker
Reviewed by: glebius
Tested by: David Marker
Fixes: cbc9438f05 ("tcp: improve ref count handling when processing SYN")
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53380
Honor the IPPROTO_IPV6-level cmsg of type IPV6_TCLASS when sending
an UDP/IPv4 packet on an AF_INET6 socket.
Reviewed by: bz
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53347
Honor the IPPROTO_IPV6-level socket option IPV6_TCLASS when sending
an UDP/IPv4 packet on an AF_INET6 socket.
Reviewed by: bz, glebius
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53346
When copying the data in the first mbuf to get rid of the UDP
header, use the correct length. It was copying too much (8 bytes,
the length of the UDP header).
This only applies to handling TCP over UDP packets. The support for
TCP over UDP is disabled by default.
Reported by: jtl
Reviewed by: Peter Lei
MFC after: 3 days
Sponsored by: Netflix, Inc.
With this patch UDP-Lite endpoints are also shown per default.
Reviewed by: Nick Banks
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D53252
With this patch UDP-Lite endpoints are also show per default.
Reviewed by: Peter Lei, Nick Banks
MFC after: 3 days
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D53230
Export the list of pcbs for UDP-Lite to be consumed by sockstat and
netstat.
Reviewed by: Peter Lei, Nick Banks
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D53229
Provide the IPPROTO_UDP in the arg2 parameter of udp_pcblist() and use
this to determine the inpcbinfo. This allows the same function to be
used in an upcoming commit to provide the list of pcbs for UDP-Lite
just by providing IPPROTO_UDPLITE in the arg2 parameter.
Reviewed by: rrs
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D53218
Provide the IPPROTO_UDP in the arg2 parameter of udp_pcblist() and use
this to determine the inpcbinfo. This allows the same function to be
used in an upcoming commit to provide the list of pcbs for UDP-Lite
just by providing IPPROTO_UDPLITE in the arg2 parameter.
Reviewed by: rrs
MFC after: 3 days
Pull Request: https://reviews.freebsd.org/D53218
The computation of the length was not taking into account that IPv6
endpoints, which are not IPv6 only, have a suffix of 46.
For UDP and TCP this bug was not relevant, since tcp46 and udp46
has the same length as PROTO, but sctp46 is longer. Upcoming
udplite support will also be affected.
Reviewed by: asomers
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D53212
* Consistently free the string after unlocking the sch, if possible.
* Remove the failure handling in case of sc != NULL, since this is
not possible anymore.
* Remove the use of goto and instead return 0 in the three cases.
The only change in behavior is that in three out of the four cases,
where 0 is returned, *lsop is not set to NULL anymore. So the behavior
is now consistent and also documented in a comment. The current in
tree callers only look at *lsop, if and only if syncache_expand()
returns 1.
Reviewed by: Peter Lei
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52948
This allows in higher throughput values with default settings.
In the review I was proposing using 16 MB, but in the transport
call today we settled on a more conservative value of 8.
Bumping it further will be done in combination with mitigations
for mbuf exhaustion attacks.
Reviewed by: rscheff, Peter Lei, jtl, thj
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52871
This allows in higher throughput values with default settings.
In the review I was proposing using 16 MB, but in the transport
call today we settled on a more conservative value of 8.
Bumping it further will be done in combination with mitigations
for mbuf exhaustion attacks.
Reviewed by: rscheff, cc, glebius, Nick Banks, Peter Lei, jtl, thj, rrs
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52872
Bump the socket buffer limit from 2 MB to 8MB.
In particular, this allows to use larger values for TCP sockets,
which may result in higher throughput values with default settings.
In the review I was proposing using 16 MB, but in the transport
call today we settled on a more conservative value of 8.
Bumping it further will be done in combination with mitigations
for mbuf exhaustion attacks.
Reviewed by: rscheff, Peter Lei, jtl, thj
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52873
Enable the kernel build option TCP_HPTS_KTEST on debug builds and
disable it on non-debug builds.
PR: 290234
Reviewed by: Nick Banks, glebius
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53108
Only suppress the path state column when producing traditional text
output. When generating html output, always include the column.
Please note that when generating json or xml output, optional fields
like the path state are only generated if they is applicable. This
has not been changed.
The changes in this patch were suggested by asomers.
Reviewed by: asomers
Fixes: 746eadecaa ("sockstat: show path state column only when useful")
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D53005
Showing the path state column is only useful, if there is at least one
SCTP endpoint shown, which is not in the state CLOSED or LISTEN.
Don't show it when it is not useful.
Reviewed by: rrs
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52986
Fix the format when the output for a socket spans multiple lines.
Reviewed by: rrs
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52984
When a packet is provided to LRO using tcp_lro_queue_mbuf(), a
sequence number is computed based on the m_pkthdr.flowid provided
by he driver. The implicit assumption is that the m_pkthdr.flowid
has hash properties.
The recent use of tcp_lro_queue_mbuf() in iflib exposed a bug in at
least one driver (igc) , which
* reports always that is uses M_HASHTYPE_OPAQUE.
* sets in some cases m_pkthdr.flowid not consistently for packets
belonging to the same TCP connection.
This results in severe performance problems for the base TCP stack,
since it handles the packets in the wrong sequence, although they were
received in the correct sequence.
To protect against such misbehaving drivers, just take the
m_pkthdr.flowid only into account, if it has hash properties.
The performance problems were observed by gallatin@ and analyzed
together with rrs@.
Reviewed by: gallatin
Tested by: gallatin
MFC after: 5 Minutes
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52989
Add a -b option to print the BBLog state for TCP sockets.
Reviewed by: jtl, rrs
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52944
According to the fifth step in SEGMENT ARRIVES, send a RST segment in
response to an ACK segment which fails the SEG.ACK check, but leave
the endpoint state unchanged.
FreeBSD handles this correctly when entering the SYN-RECEIVED state via
the SYN-SENT state, but not in the SYN-cache code, which handles the
SYN-RECEIVED state via the LISTEN state.
This also fixes a panic reported by Alexander Leidinger.
Reviewed by: jtl, glebius
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52934
The validation of SEG.SEQ (first step in SEGMENT ARRIVES of RFC 9293)
should be done before the validation of SEG.ACK (fifth step in
SEGMENT ARRIVES in RFC 9293).
Furthermore, when the SEG.SEQ validation fails, a challenge ACK
should be sent instead of sending a RST-segment and moving the
endpoint to CLOSED.
Reported by: Tilnel on freebsd-net
Reviewed by: Nick Banks
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52849
Don't drop a SYN-cache entry just because a challenge ACK couldn't
be sent. This might only be a temporary failure.
Reviewed by: Nick Banks, glebius, jtl
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52840
Only validate SEG.SEQ and SEG.ACK when processing a real SYN-cache
entry. In the SYN-cookie case, these conditions are always true, since
the SYN-cache entry on the stack is constructed from the incoming
TCP segment.
While there, fix the logging messages.
Reviewed by: Nick Banks
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52816
When sending challenge ACKs from the SYN-cache, apply the same rate
limiting as in other states.
Reviewed by: cc, rrs
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D52754
Michael Tuexen