From nobody Sun May 10 19:14:14 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 49170C433F5 for ; Tue, 26 Apr 2022 08:07:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344464AbiDZIKy (ORCPT ); Tue, 26 Apr 2022 04:10:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59366 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233430AbiDZIKs (ORCPT ); Tue, 26 Apr 2022 04:10:48 -0400 Received: from mail-pj1-x1041.google.com (mail-pj1-x1041.google.com [IPv6:2607:f8b0:4864:20::1041]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DD2F747AF2; Tue, 26 Apr 2022 01:07:41 -0700 (PDT) Received: by mail-pj1-x1041.google.com with SMTP id iq2-20020a17090afb4200b001d93cf33ae9so1558543pjb.5; Tue, 26 Apr 2022 01:07:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=dd4CplGAbksfC5dSDV3nqHK5N6BzoTPgvkV6PlzyYHU=; b=nwyYhMG/Np7gtkQJrKyMEC0oOoHlEi32qb2InZhCnKj6GDzINXvMz5gcu7DzO3T7mo bI5yL2w3+Wu1WFADum/TFh/9qonyIhmM1zFyXeLimIRANIk5A80Wj0gwc1h9a3sA5LZP 6fGluRVsv9DnqXniVjOVN0pStP+87PH8byCG3Q7RJIx9oLVkHAQoyYwKDmxrRGAO9YMN Xk1qkqoZqurLXgh4mV3LmiIWSSIRezGfK/UGQooQVp4m9iSkX+g1zYHFRoxBEZj8qvWn y6BDS3BlUiekRUa7Mp1uWJuEQoPY6EKWXdDba3NNxRxkQFpBiaG7CdgLtgDkbNzmS+Ft j3TQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=dd4CplGAbksfC5dSDV3nqHK5N6BzoTPgvkV6PlzyYHU=; b=jYUpysBZ0T9u9nvJzfvjXw+eJ5FUrZ8/afDFLXt1FWi/GBneDQVzQrnnRumyu8BDZo GB7XCcQKUKQ51yBiR0TjexyGzMbLsK0W5erw2vMjzszJt9UIPuyNV4q57YIDZ4BjokGF crz8fknPq8mk6DJ15lrCKnYyxEL0we3zvUtTMeMcAlgM+Z7hsJ+j0/oinjMjdG5va6wq Q3iOCX/4ruNebvOs2EoHVBjAVe17RGeGKUHwFFTboRTMi/7ETdmqLN6ARCCpA8OuJeSa UjSBLdhUDtqnlstp6Y0Skyjoo0ohgNgMm7sezYRGOeAEVmgLWHk498MsVOWjuo1UD0mn sqIg== X-Gm-Message-State: AOAM533BUzTJ57IeTexnGkr7jNs0OiDWyX59vDgzvB2XGd8w/RoiFZOo 8QJ7T/PCz6iXjQr8otuDi3rgvCxIbt4= X-Google-Smtp-Source: ABdhPJyt27IvCxS9J0SslONRIGiqY/kWa3aEY1EWyEQQ/mNhOyId4wwuKZ4P0SVnD7cy5ALW/MsOaA== X-Received: by 2002:a17:902:d58a:b0:15d:1da8:81fb with SMTP id k10-20020a170902d58a00b0015d1da881fbmr7822396plh.133.1650960461428; Tue, 26 Apr 2022 01:07:41 -0700 (PDT) Received: from localhost.localdomain ([203.205.141.119]) by smtp.gmail.com with ESMTPSA id l4-20020a056a0016c400b004f79504ef9csm15134951pfc.3.2022.04.26.01.07.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 Apr 2022 01:07:40 -0700 (PDT) From: menglong8.dong@gmail.com X-Google-Original-From: imagedong@tencent.com To: kuba@kernel.org Cc: rostedt@goodmis.org, mingo@redhat.com, davem@davemloft.net, yoshfuji@linux-ipv6.org, dsahern@kernel.org, pabeni@redhat.com, benbjiang@tencent.com, flyingpeng@tencent.com, imagedong@tencent.com, edumazet@google.com, kafai@fb.com, talalahmad@google.com, keescook@chromium.org, mengensun@tencent.com, dongli.zhang@oracle.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH net-next 1/2] net: add skb drop reasons to inet connect request Date: Tue, 26 Apr 2022 16:07:08 +0800 Message-Id: <20220426080709.6504-2-imagedong@tencent.com> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220426080709.6504-1-imagedong@tencent.com> References: <20220426080709.6504-1-imagedong@tencent.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Menglong Dong The 'conn_request()' in struct inet_connection_sock_af_ops is used to process connection requesting for TCP/DCCP. Take TCP for example, it is just 'tcp_v4_conn_request()'. When non-zero value is returned by 'tcp_v4_conn_request()', the skb will be freed by kfree_skb() and a 'reset' packet will be send. Otherwise, it will be freed normally. In this code path, 'consume_skb()' is used in many abnormal cases, such as the accept queue of the listen socket full, which should be 'kfree_skb()'. Therefore, we make a little change to the 'conn_request()' interface. When 0 is returned, we call 'consume_skb()' as usual; when negative is returned, we call 'kfree_skb()' and send a 'reset' as usual; when positive is returned, which has not happened yet, we do nothing, and skb will be freed in 'conn_request()'. Then, we can use drop reasons in 'conn_request()'. Following new drop reasons are added: SKB_DROP_REASON_LISTENOVERFLOWS SKB_DROP_REASON_TCP_REQQFULLDROP Reviewed-by: Jiang Biao Reviewed-by: Hao Peng Signed-off-by: Menglong Dong --- include/linux/skbuff.h | 4 ++++ include/trace/events/skb.h | 2 ++ net/dccp/input.c | 12 +++++------- net/ipv4/tcp_input.c | 21 +++++++++++++-------- net/ipv4/tcp_ipv4.c | 3 ++- 5 files changed, 26 insertions(+), 16 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 84d78df60453..f33b3636bbce 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -469,6 +469,10 @@ enum skb_drop_reason { SKB_DROP_REASON_PKT_TOO_BIG, /* packet size is too big (maybe exceed * the MTU) */ + SKB_DROP_REASON_LISTENOVERFLOWS, /* accept queue of the listen socket is = full */ + SKB_DROP_REASON_TCP_REQQFULLDROP, /* request queue of the listen + * socket is full + */ SKB_DROP_REASON_MAX, }; =20 diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h index a477bf907498..de6c93670437 100644 --- a/include/trace/events/skb.h +++ b/include/trace/events/skb.h @@ -80,6 +80,8 @@ EM(SKB_DROP_REASON_IP_INADDRERRORS, IP_INADDRERRORS) \ EM(SKB_DROP_REASON_IP_INNOROUTES, IP_INNOROUTES) \ EM(SKB_DROP_REASON_PKT_TOO_BIG, PKT_TOO_BIG) \ + EM(SKB_DROP_REASON_LISTENOVERFLOWS, LISTENOVERFLOWS) \ + EM(SKB_DROP_REASON_TCP_REQQFULLDROP, TCP_REQQFULLDROP) \ EMe(SKB_DROP_REASON_MAX, MAX) =20 #undef EM diff --git a/net/dccp/input.c b/net/dccp/input.c index 2cbb757a894f..ed20dfe83f66 100644 --- a/net/dccp/input.c +++ b/net/dccp/input.c @@ -574,8 +574,7 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_b= uff *skb, struct dccp_sock *dp =3D dccp_sk(sk); struct dccp_skb_cb *dcb =3D DCCP_SKB_CB(skb); const int old_state =3D sk->sk_state; - bool acceptable; - int queued =3D 0; + int err, queued =3D 0; =20 /* * Step 3: Process LISTEN state @@ -606,13 +605,12 @@ int dccp_rcv_state_process(struct sock *sk, struct sk= _buff *skb, */ rcu_read_lock(); local_bh_disable(); - acceptable =3D inet_csk(sk)->icsk_af_ops->conn_request(sk, skb) >=3D 0; + err =3D inet_csk(sk)->icsk_af_ops->conn_request(sk, skb); local_bh_enable(); rcu_read_unlock(); - if (!acceptable) - return 1; - consume_skb(skb); - return 0; + if (!err) + consume_skb(skb); + return err < 0; } if (dh->dccph_type =3D=3D DCCP_PKT_RESET) goto discard; diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index daff631b9486..e0bbbd624246 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -6411,7 +6411,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_= buff *skb) struct inet_connection_sock *icsk =3D inet_csk(sk); const struct tcphdr *th =3D tcp_hdr(skb); struct request_sock *req; - int queued =3D 0; + int err, queued =3D 0; bool acceptable; SKB_DR(reason); =20 @@ -6438,14 +6438,13 @@ int tcp_rcv_state_process(struct sock *sk, struct s= k_buff *skb) */ rcu_read_lock(); local_bh_disable(); - acceptable =3D icsk->icsk_af_ops->conn_request(sk, skb) >=3D 0; + err =3D icsk->icsk_af_ops->conn_request(sk, skb); local_bh_enable(); rcu_read_unlock(); =20 - if (!acceptable) - return 1; - consume_skb(skb); - return 0; + if (!err) + consume_skb(skb); + return err < 0; } SKB_DR_SET(reason, TCP_FLAGS); goto discard; @@ -6878,6 +6877,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, bool want_cookie =3D false; struct dst_entry *dst; struct flowi fl; + SKB_DR(reason); =20 /* TW buckets are converted to open requests without * limitations, they conserve resources and peer is @@ -6886,12 +6886,15 @@ int tcp_conn_request(struct request_sock_ops *rsk_o= ps, if ((net->ipv4.sysctl_tcp_syncookies =3D=3D 2 || inet_csk_reqsk_queue_is_full(sk)) && !isn) { want_cookie =3D tcp_syn_flood_action(sk, rsk_ops->slab_name); - if (!want_cookie) + if (!want_cookie) { + SKB_DR_SET(reason, TCP_REQQFULLDROP); goto drop; + } } =20 if (sk_acceptq_is_full(sk)) { NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS); + SKB_DR_SET(reason, LISTENOVERFLOWS); goto drop; } =20 @@ -6947,6 +6950,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, */ pr_drop_req(req, ntohs(tcp_hdr(skb)->source), rsk_ops->family); + SKB_DR_SET(reason, TCP_REQQFULLDROP); goto drop_and_release; } =20 @@ -7006,7 +7010,8 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, drop_and_free: __reqsk_free(req); drop: + kfree_skb_reason(skb, reason); tcp_listendrop(sk); - return 0; + return 1; } EXPORT_SYMBOL(tcp_conn_request); diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 157265aecbed..b8daf49f54a5 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1470,7 +1470,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_bu= ff *skb) =20 drop: tcp_listendrop(sk); - return 0; + kfree_skb_reason(skb, SKB_DROP_REASON_IP_INADDRERRORS); + return 1; } EXPORT_SYMBOL(tcp_v4_conn_request); =20 --=20 2.36.0 From nobody Sun May 10 19:14:14 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 349C5C433F5 for ; Tue, 26 Apr 2022 08:08:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344490AbiDZILE (ORCPT ); Tue, 26 Apr 2022 04:11:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60408 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344467AbiDZILB (ORCPT ); Tue, 26 Apr 2022 04:11:01 -0400 Received: from mail-pl1-x641.google.com (mail-pl1-x641.google.com [IPv6:2607:f8b0:4864:20::641]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6861748E50; Tue, 26 Apr 2022 01:07:46 -0700 (PDT) Received: by mail-pl1-x641.google.com with SMTP id d15so15063231plh.2; Tue, 26 Apr 2022 01:07:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=to+ZeGhLxQcAid0Ufscg8bv/YvTBm1/R7BRG+txDPzM=; b=SxQSXbCWPSYBlG3D1ymX4EnX3akJzKF1gfr3UwRqJCQSH5xVMvHQUVX/8ar5HI4N2B 7g92iGNC6M7i/l8cKOpoPrEDSSc8O058UCKivXYCWWWuwPO6F7Tm2Yjr+e75A6lQfx8c 2b3V8DWUaY4oqyT/Vyd2Jjz/m/BvBoOGOpKtYGJPeoscac686fvSOyUaMhkBDS8Q/YAY Az66+HrcTzCLdPZB7yJXXlcmG+olgHvSRbTRaB/5qg6WXI5PJqGdv+xqfgo3WOSCgAua un1QKL9xJ02q9NZ3W0rqgYDYonhaaBCNXTqqpcpg/SIG65qhrQGr0y7H0jj6ZV2emcUw Uivw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=to+ZeGhLxQcAid0Ufscg8bv/YvTBm1/R7BRG+txDPzM=; b=5ckMHO6Hn+bgk/2OpOJZ1OAcR9pdmW7xoSEeXzMMkQNuzJuQJUhxwvc/ZRJEZrjkAO +VP3EE/cF6SJGJ4WHAC5NiL7K9LvEW7O7S98LIIrDoFNtVS7RhwVB5YlOSk2KW2JZyRP +4CIM9ahsjWxuw3v50RTgO/lb45AJyhZqzs4NDrNfs7kq2dnDg0aC6DS+ttPEqvXDgD0 v+JukmjrI9Gjtf31E1pKWMbqhZg3pZya18lEhtuaHnBXXyHWVJsBcZ4oFbQDbAddomhX oY9L8R6xBMkp4TVr8No+A6tjRQNB8GXj0jVaMru3YWQ6WI/QutogbGJeO7xIGGJGdktc g4MQ== X-Gm-Message-State: AOAM530cdKLL9D4PvTDIiwjF9XEU2gK9M4Dqe+w+hZvgaQeAt6kX84cG j2+JxsZEmJVqAQGnUaihA28= X-Google-Smtp-Source: ABdhPJwE5FdzKKcQmRuv2uacm4y/xT6q2GjcUORzi1wkxmdqNmAR0tZSEAI/JZRZ+qYtuUmtMtXA7w== X-Received: by 2002:a17:902:9696:b0:158:f809:310e with SMTP id n22-20020a170902969600b00158f809310emr22626342plp.16.1650960465953; Tue, 26 Apr 2022 01:07:45 -0700 (PDT) Received: from localhost.localdomain ([203.205.141.119]) by smtp.gmail.com with ESMTPSA id l4-20020a056a0016c400b004f79504ef9csm15134951pfc.3.2022.04.26.01.07.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 Apr 2022 01:07:45 -0700 (PDT) From: menglong8.dong@gmail.com X-Google-Original-From: imagedong@tencent.com To: kuba@kernel.org Cc: rostedt@goodmis.org, mingo@redhat.com, davem@davemloft.net, yoshfuji@linux-ipv6.org, dsahern@kernel.org, pabeni@redhat.com, benbjiang@tencent.com, flyingpeng@tencent.com, imagedong@tencent.com, edumazet@google.com, kafai@fb.com, talalahmad@google.com, keescook@chromium.org, mengensun@tencent.com, dongli.zhang@oracle.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH net-next 2/2] net: tcp: add skb drop reasons to route_req() Date: Tue, 26 Apr 2022 16:07:09 +0800 Message-Id: <20220426080709.6504-3-imagedong@tencent.com> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220426080709.6504-1-imagedong@tencent.com> References: <20220426080709.6504-1-imagedong@tencent.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Menglong Dong Add skb drop reasons to the route_req() in struct tcp_request_sock_ops. Following functions are involved: tcp_v4_route_req() tcp_v6_route_req() subflow_v4_route_req() subflow_v6_route_req() And the new reason SKB_DROP_REASON_SECURITY is added, which is used when skb is dropped by LSM. Reviewed-by: Jiang Biao Reviewed-by: Hao Peng Signed-off-by: Menglong Dong --- include/linux/skbuff.h | 1 + include/net/tcp.h | 3 ++- include/trace/events/skb.h | 1 + net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 14 +++++++++++--- net/ipv6/tcp_ipv6.c | 14 +++++++++++--- net/mptcp/subflow.c | 10 ++++++---- 7 files changed, 33 insertions(+), 12 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index f33b3636bbce..5909759e1b95 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -473,6 +473,7 @@ enum skb_drop_reason { SKB_DROP_REASON_TCP_REQQFULLDROP, /* request queue of the listen * socket is full */ + SKB_DROP_REASON_SECURITY, /* dropped by LSM */ SKB_DROP_REASON_MAX, }; =20 diff --git a/include/net/tcp.h b/include/net/tcp.h index 679b1964d494..01f841611895 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -2075,7 +2075,8 @@ struct tcp_request_sock_ops { struct dst_entry *(*route_req)(const struct sock *sk, struct sk_buff *skb, struct flowi *fl, - struct request_sock *req); + struct request_sock *req, + enum skb_drop_reason *reason); u32 (*init_seq)(const struct sk_buff *skb); u32 (*init_ts_off)(const struct net *net, const struct sk_buff *skb); int (*send_synack)(const struct sock *sk, struct dst_entry *dst, diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h index de6c93670437..aff57cd43e85 100644 --- a/include/trace/events/skb.h +++ b/include/trace/events/skb.h @@ -82,6 +82,7 @@ EM(SKB_DROP_REASON_PKT_TOO_BIG, PKT_TOO_BIG) \ EM(SKB_DROP_REASON_LISTENOVERFLOWS, LISTENOVERFLOWS) \ EM(SKB_DROP_REASON_TCP_REQQFULLDROP, TCP_REQQFULLDROP) \ + EM(SKB_DROP_REASON_SECURITY, SECURITY) \ EMe(SKB_DROP_REASON_MAX, MAX) =20 #undef EM diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index e0bbbd624246..2c158593dc37 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -6928,7 +6928,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, /* Note: tcp_v6_init_req() might override ir_iif for link locals */ inet_rsk(req)->ir_iif =3D inet_request_bound_dev_if(sk, skb); =20 - dst =3D af_ops->route_req(sk, skb, &fl, req); + dst =3D af_ops->route_req(sk, skb, &fl, req, &reason); if (!dst) goto drop_and_free; =20 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index b8daf49f54a5..12acf4823488 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1424,14 +1424,22 @@ static void tcp_v4_init_req(struct request_sock *re= q, static struct dst_entry *tcp_v4_route_req(const struct sock *sk, struct sk_buff *skb, struct flowi *fl, - struct request_sock *req) + struct request_sock *req, + enum skb_drop_reason *reason) { + struct dst_entry *dst; + tcp_v4_init_req(req, sk, skb); =20 - if (security_inet_conn_request(sk, skb, req)) + if (security_inet_conn_request(sk, skb, req)) { + SKB_DR_SET(*reason, SECURITY); return NULL; + } =20 - return inet_csk_route_req(sk, &fl->u.ip4, req); + dst =3D inet_csk_route_req(sk, &fl->u.ip4, req); + if (!dst) + SKB_DR_SET(*reason, IP_OUTNOROUTES); + return dst; } =20 struct request_sock_ops tcp_request_sock_ops __read_mostly =3D { diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 782df529ff69..d69fef0e0892 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -802,14 +802,22 @@ static void tcp_v6_init_req(struct request_sock *req, static struct dst_entry *tcp_v6_route_req(const struct sock *sk, struct sk_buff *skb, struct flowi *fl, - struct request_sock *req) + struct request_sock *req, + enum skb_drop_reason *reason) { + struct dst_entry *dst; + tcp_v6_init_req(req, sk, skb); =20 - if (security_inet_conn_request(sk, skb, req)) + if (security_inet_conn_request(sk, skb, req)) { + SKB_DR_SET(*reason, SECURITY); return NULL; + } =20 - return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP); + dst =3D inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP); + if (!dst) + SKB_DR_SET(*reason, IP_OUTNOROUTES); + return dst; } =20 struct request_sock_ops tcp6_request_sock_ops __read_mostly =3D { diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index aba260f547da..03d07165cda6 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -283,7 +283,8 @@ EXPORT_SYMBOL_GPL(mptcp_subflow_init_cookie_req); static struct dst_entry *subflow_v4_route_req(const struct sock *sk, struct sk_buff *skb, struct flowi *fl, - struct request_sock *req) + struct request_sock *req, + enum skb_drop_reason *reason) { struct dst_entry *dst; int err; @@ -291,7 +292,7 @@ static struct dst_entry *subflow_v4_route_req(const str= uct sock *sk, tcp_rsk(req)->is_mptcp =3D 1; subflow_init_req(req, sk); =20 - dst =3D tcp_request_sock_ipv4_ops.route_req(sk, skb, fl, req); + dst =3D tcp_request_sock_ipv4_ops.route_req(sk, skb, fl, req, reason); if (!dst) return NULL; =20 @@ -309,7 +310,8 @@ static struct dst_entry *subflow_v4_route_req(const str= uct sock *sk, static struct dst_entry *subflow_v6_route_req(const struct sock *sk, struct sk_buff *skb, struct flowi *fl, - struct request_sock *req) + struct request_sock *req, + enum skb_drop_reason *reason) { struct dst_entry *dst; int err; @@ -317,7 +319,7 @@ static struct dst_entry *subflow_v6_route_req(const str= uct sock *sk, tcp_rsk(req)->is_mptcp =3D 1; subflow_init_req(req, sk); =20 - dst =3D tcp_request_sock_ipv6_ops.route_req(sk, skb, fl, req); + dst =3D tcp_request_sock_ipv6_ops.route_req(sk, skb, fl, req, reason); if (!dst) return NULL; =20 --=20 2.36.0