bpf_tcp_check_syncookie returns errors when SYN cookie generation is
disabled (EINVAL) or when no cookies were recently generated (ENOENT).
The same error codes are used for other kinds of errors: invalid
parameters (EINVAL), invalid packet (EINVAL, ENOENT), bad cookie
(ENOENT). Such an overlap makes it impossible for a BPF program to
distinguish different cases that may require different handling.
For a BPF program that accelerates generating and checking SYN cookies,
typical logic looks like this (with current error codes annotated):
1. Drop invalid packets (EINVAL, ENOENT).
2. Drop packets with bad cookies (ENOENT).
3. Pass packets with good cookies (0).
4. Pass all packets when cookies are not in use (EINVAL, ENOENT).
The last point also matches the behavior of cookie_v4_check and
cookie_v6_check that skip all checks if cookie generation is disabled or
no cookies were recently generated. Overlapping error codes, however,
make it impossible to distinguish case 4 from cases 1 and 2.
The original commit message of commit 399040847084 ("bpf: add helper to
check for a valid SYN cookie") mentions another use case, though:
traffic classification, where it's important to distinguish new
connections from existing ones, and case 4 should be distinguishable
from case 3.
To match the requirements of both use cases, this patch reassigns error
codes of bpf_tcp_check_syncookie and adds missing documentation:
1. EINVAL: Invalid packets.
2. EACCES: Packets with bad cookies.
3. 0: Packets with good cookies.
4. ENOENT: Cookies are not in use.
This way all four cases are easily distinguishable.
Signed-off-by: Maxim Mikityanskiy <maximmi@xxxxxxxxxx>
Reviewed-by: Tariq Toukan <tariqt@xxxxxxxxxx>
---
include/uapi/linux/bpf.h | 18 ++++++++++++++++--
net/core/filter.c | 6 +++---
tools/include/uapi/linux/bpf.h | 18 ++++++++++++++++--
3 files changed, 35 insertions(+), 7 deletions(-)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 6fc59d61937a..2f12b11f1259 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -3545,8 +3545,22 @@ union bpf_attr {
* *th* points to the start of the TCP header, while *th_len*
* contains **sizeof**\ (**struct tcphdr**).
* Return
- * 0 if *iph* and *th* are a valid SYN cookie ACK, or a negative
- * error otherwise.
+ * 0 if *iph* and *th* are a valid SYN cookie ACK.
+ *
+ * On failure, the returned value is one of the following:
+ *
+ * **-EACCES** if the SYN cookie is not valid.
+ *
+ * **-EINVAL** if the packet or input arguments are invalid.
+ *
+ * **-ENOENT** if SYN cookies are not issued (no SYN flood, or SYN
+ * cookies are disabled in sysctl).
+ *
+ * **-EOPNOTSUPP** if the kernel configuration does not enable SYN
+ * cookies (CONFIG_SYN_COOKIES is off).
+ *
+ * **-EPROTONOSUPPORT** if the IP version is not 4 or 6 (or 6, but
+ * CONFIG_IPV6 is disabled).
*
* long bpf_sysctl_get_name(struct bpf_sysctl *ctx, char *buf, size_t buf_len, u64 flags)
* Description
diff --git a/net/core/filter.c b/net/core/filter.c
index 2c5877b775d9..d04988e67640 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6709,10 +6709,10 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len
return -EINVAL;
if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies)
- return -EINVAL;
+ return -ENOENT;
if (!th->ack || th->rst || th->syn)
- return -ENOENT;
+ return -EINVAL;
if (unlikely(iph_len < sizeof(struct iphdr)))
return -EINVAL;
@@ -6752,7 +6752,7 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len
if (ret > 0)
return 0;
- return -ENOENT;
+ return -EACCES;
#else
return -EOPNOTSUPP;
#endif
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 6fc59d61937a..2f12b11f1259 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -3545,8 +3545,22 @@ union bpf_attr {
* *th* points to the start of the TCP header, while *th_len*
* contains **sizeof**\ (**struct tcphdr**).
* Return
- * 0 if *iph* and *th* are a valid SYN cookie ACK, or a negative
- * error otherwise.
+ * 0 if *iph* and *th* are a valid SYN cookie ACK.
+ *
+ * On failure, the returned value is one of the following:
+ *
+ * **-EACCES** if the SYN cookie is not valid.
+ *
+ * **-EINVAL** if the packet or input arguments are invalid.
+ *
+ * **-ENOENT** if SYN cookies are not issued (no SYN flood, or SYN
+ * cookies are disabled in sysctl).
+ *
+ * **-EOPNOTSUPP** if the kernel configuration does not enable SYN
+ * cookies (CONFIG_SYN_COOKIES is off).
+ *
+ * **-EPROTONOSUPPORT** if the IP version is not 4 or 6 (or 6, but
+ * CONFIG_IPV6 is disabled).
*
* long bpf_sysctl_get_name(struct bpf_sysctl *ctx, char *buf, size_t buf_len, u64 flags)
* Description
--
2.30.2
