aboutsummaryrefslogtreecommitdiff
path: root/sys/netinet/tcp_input.c
diff options
context:
space:
mode:
Diffstat (limited to 'sys/netinet/tcp_input.c')
-rw-r--r--sys/netinet/tcp_input.c59
1 files changed, 21 insertions, 38 deletions
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index d58cc69b7625..6492495dc583 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -609,7 +609,6 @@ tcp_input_with_port(struct mbuf **mp, int *offp, int proto, uint16_t port)
int tlen = 0, off;
int drop_hdrlen;
int thflags;
- int rstreason = 0; /* For badport_bandlim accounting purposes */
int lookupflag;
uint8_t iptos;
struct m_tag *fwd_tag = NULL;
@@ -905,23 +904,22 @@ findpcb:
* XXX MRT Send RST using which routing table?
*/
if (inp == NULL) {
- if (rstreason != 0) {
+ if ((lookupflag & INPLOOKUP_WILDCARD) == 0) {
/* We came here after second (safety) lookup. */
- MPASS((lookupflag & INPLOOKUP_WILDCARD) == 0);
- goto dropwithreset;
- }
- /*
- * Log communication attempts to ports that are not
- * in use.
- */
- if ((V_tcp_log_in_vain == 1 && (thflags & TH_SYN)) ||
- V_tcp_log_in_vain == 2) {
- if ((s = tcp_log_vain(NULL, th, (void *)ip, ip6)))
+ MPASS(!closed_port);
+ } else {
+ /*
+ * Log communication attempts to ports that are not
+ * in use.
+ */
+ if (((V_tcp_log_in_vain == 1 && (thflags & TH_SYN)) ||
+ V_tcp_log_in_vain == 2) &&
+ (s = tcp_log_vain(NULL, th, (void *)ip, ip6))) {
log(LOG_INFO, "%s; %s: Connection attempt "
"to closed port\n", s, __func__);
+ }
+ closed_port = true;
}
- rstreason = BANDLIM_TCP_RST;
- closed_port = true;
goto dropwithreset;
}
INP_LOCK_ASSERT(inp);
@@ -1012,13 +1010,11 @@ findpcb:
* down or it is in the CLOSED state. Either way we drop the
* segment and send an appropriate response.
*/
- rstreason = BANDLIM_TCP_RST;
closed_port = true;
goto dropwithreset;
}
if ((tp->t_port != port) && (tp->t_state > TCPS_LISTEN)) {
- rstreason = BANDLIM_TCP_RST;
closed_port = true;
goto dropwithreset;
}
@@ -1102,7 +1098,8 @@ findpcb:
* don't want to sent RST for the second ACK,
* so we perform second lookup without wildcard
* match, hoping to find the new socket. If
- * the ACK is stray indeed, rstreason would
+ * the ACK is stray indeed, the missing
+ * INPLOOKUP_WILDCARD flag in lookupflag would
* hint the above code that the lookup was a
* second attempt.
*
@@ -1110,7 +1107,6 @@ findpcb:
* of the failure cause.
*/
INP_WUNLOCK(inp);
- rstreason = BANDLIM_TCP_RST;
lookupflag &= ~INPLOOKUP_WILDCARD;
goto findpcb;
}
@@ -1134,7 +1130,6 @@ tfo_socket_result:
V_tcp_sc_rst_sock_fail ?
"sending RST" : "try again");
if (V_tcp_sc_rst_sock_fail) {
- rstreason = BANDLIM_UNLIMITED;
goto dropwithreset;
} else
goto dropunlock;
@@ -1201,7 +1196,6 @@ tfo_socket_result:
s, __func__);
syncache_badack(&inc, port); /* XXX: Not needed! */
TCPSTAT_INC(tcps_badsyn);
- rstreason = BANDLIM_TCP_RST;
goto dropwithreset;
}
/*
@@ -1277,7 +1271,6 @@ tfo_socket_result:
"Connection attempt to deprecated "
"IPv6 address rejected\n",
s, __func__);
- rstreason = BANDLIM_TCP_RST;
goto dropwithreset;
}
}
@@ -1398,8 +1391,7 @@ dropwithreset:
* When blackholing do not respond with a RST but
* completely ignore the segment and drop it.
*/
- if (rstreason == BANDLIM_TCP_RST &&
- ((!closed_port && V_blackhole == 3) ||
+ if (((!closed_port && V_blackhole == 3) ||
(closed_port &&
((V_blackhole == 1 && (thflags & TH_SYN)) || V_blackhole > 1))) &&
(V_blackhole_local || (
@@ -1414,7 +1406,7 @@ dropwithreset:
)))
goto dropunlock;
TCP_PROBE5(receive, NULL, tp, m, tp, th);
- tcp_dropwithreset(m, th, tp, tlen, rstreason);
+ tcp_dropwithreset(m, th, tp, tlen);
m = NULL; /* mbuf chain got consumed. */
dropunlock:
@@ -1523,7 +1515,7 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
uint16_t thflags;
int acked, ourfinisacked, needoutput = 0;
sackstatus_t sack_changed;
- int rstreason, todrop, win, incforsyn = 0;
+ int todrop, win, incforsyn = 0;
uint32_t tiwin;
uint16_t nsegs;
char *s;
@@ -1568,7 +1560,6 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
*/
if ((tp->t_state == TCPS_SYN_SENT) && (thflags & TH_ACK) &&
(SEQ_LEQ(th->th_ack, tp->iss) || SEQ_GT(th->th_ack, tp->snd_max))) {
- rstreason = BANDLIM_UNLIMITED;
tcp_log_end_status(tp, TCP_EI_STATUS_RST_IN_FRONT);
goto dropwithreset;
}
@@ -1984,7 +1975,6 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
if ((thflags & TH_ACK) &&
(SEQ_LEQ(th->th_ack, tp->snd_una) ||
SEQ_GT(th->th_ack, tp->snd_max))) {
- rstreason = BANDLIM_TCP_RST;
tcp_log_end_status(tp, TCP_EI_STATUS_RST_IN_FRONT);
goto dropwithreset;
}
@@ -1997,7 +1987,6 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
* FIN, or a RST.
*/
if ((thflags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)) {
- rstreason = BANDLIM_TCP_RST;
tcp_log_end_status(tp, TCP_EI_STATUS_RST_IN_FRONT);
goto dropwithreset;
} else if (thflags & TH_SYN) {
@@ -2218,7 +2207,6 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) {
tcp_log_end_status(tp, TCP_EI_STATUS_RST_IN_FRONT);
tp = tcp_drop(tp, ECONNRESET);
- rstreason = BANDLIM_UNLIMITED;
} else {
tcp_ecn_input_syn_sent(tp, thflags, iptos);
tcp_send_challenge_ack(tp, th, m);
@@ -2265,7 +2253,6 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
* for the "LAND" DoS attack.
*/
if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) {
- rstreason = BANDLIM_TCP_RST;
tcp_log_end_status(tp, TCP_EI_STATUS_RST_IN_FRONT);
goto dropwithreset;
}
@@ -2347,7 +2334,6 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
tcp_log_end_status(tp, TCP_EI_STATUS_SERVER_RST);
tp = tcp_close(tp);
TCPSTAT_INC(tcps_rcvafterclose);
- rstreason = BANDLIM_UNLIMITED;
goto dropwithreset;
}
@@ -3444,7 +3430,6 @@ dropafterack:
if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) &&
(SEQ_GT(tp->snd_una, th->th_ack) ||
SEQ_GT(th->th_ack, tp->snd_max)) ) {
- rstreason = BANDLIM_TCP_RST;
tcp_log_end_status(tp, TCP_EI_STATUS_RST_IN_FRONT);
goto dropwithreset;
}
@@ -3456,11 +3441,10 @@ dropafterack:
return;
dropwithreset:
+ tcp_dropwithreset(m, th, NULL, tlen);
if (tp != NULL) {
- tcp_dropwithreset(m, th, tp, tlen, rstreason);
INP_WUNLOCK(inp);
- } else
- tcp_dropwithreset(m, th, NULL, tlen, rstreason);
+ }
return;
drop:
@@ -3480,8 +3464,7 @@ drop:
* tp may be NULL.
*/
void
-tcp_dropwithreset(struct mbuf *m, struct tcphdr *th, struct tcpcb *tp,
- int tlen, int rstreason)
+tcp_dropwithreset(struct mbuf *m, struct tcphdr *th, struct tcpcb *tp, int tlen)
{
#ifdef INET
struct ip *ip;
@@ -3521,7 +3504,7 @@ tcp_dropwithreset(struct mbuf *m, struct tcphdr *th, struct tcpcb *tp,
#endif
/* Perform bandwidth limiting. */
- if (badport_bandlim(rstreason) < 0)
+ if (badport_bandlim(BANDLIM_TCP_RST) < 0)
goto drop;
/* tcp_respond consumes the mbuf chain. */
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-15 10:37:17 +0000