Re: [PATCH v2 net-next] tcp: be less liberal in TSEcr received while in SYN_RECV state

[Matthieu Baerts <matttbe@kernel.org>]

Hi Eric,

On 25/02/2025 18:10, Eric Dumazet wrote:
> Yong-Hao Zou mentioned that linux was not strict as other OS in 3WHS,
> for flows using TCP TS option (RFC 7323)
> 
> As hinted by an old comment in tcp_check_req(),
> we can check the TSEcr value in the incoming packet corresponds
> to one of the SYNACK TSval values we have sent.
> 
> In this patch, I record the oldest and most recent values
> that SYNACK packets have used.
> 
> Send a challenge ACK if we receive a TSEcr outside
> of this range, and increase a new SNMP counter.
> 
> nstat -az | grep TSEcrRejected
> TcpExtTSEcrRejected            0                  0.0
> 
> Due to TCP fastopen implementation, do not apply yet these checks
> for fastopen flows.
> 
> v2: No longer use req->num_timeout, but treq->snt_tsval_first
>     to detect when first SYNACK is prepared. This means
>     we make sure to not send an initial zero TSval.
>     Make sure MPTCP and TCP selftests are passing.
>     Change MIB name to TcpExtTSEcrRejected

Thank you for the v2, and for having ran the MPTCP selftests!

And sorry if my previous replies on the v1 felt like I was rushing you
to send a v2, that was absolutely not my intension!

The v2 looks good to me, just a small detail in the doc. Apart from that:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

(...)

> diff --git a/Documentation/networking/net_cachelines/snmp.rst b/Documentation/networking/net_cachelines/snmp.rst
> index 90ca2d92547d44fa5b4d28cb9d00820662c3f0fd..bc96efc92cf5b888c1e441412c78f3974be1f587 100644
> --- a/Documentation/networking/net_cachelines/snmp.rst
> +++ b/Documentation/networking/net_cachelines/snmp.rst
> @@ -36,6 +36,7 @@ unsigned_long  LINUX_MIB_TIMEWAITRECYCLED
>  unsigned_long  LINUX_MIB_TIMEWAITKILLED
>  unsigned_long  LINUX_MIB_PAWSACTIVEREJECTED
>  unsigned_long  LINUX_MIB_PAWSESTABREJECTED
> +unsigned_long  LINUX_MIB_TSECR_REJECTED

Small detail, I guess it should be without the extra underscore:
LINUX_MIB_TSECRREJECTED.

>  unsigned_long  LINUX_MIB_DELAYEDACKLOST
>  unsigned_long  LINUX_MIB_LISTENOVERFLOWS
>  unsigned_long  LINUX_MIB_LISTENDROPS
(...)

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.