This helper function allows BPF programs to try to generate SYN cookies, given a reference to a listener socket. The function works from XDP and with an skb context since bpf_skc_lookup_tcp can lookup a socket in both cases.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -2714,6 +2714,33 @@ union bpf_attr { · 2713 unmodified lines | |||
| 2714 | * **-EPERM** if no permission to send the *sig*. | 2714 | * **-EPERM** if no permission to send the *sig*. |
| 2715 | * | 2715 | * |
| 2716 | * **-EAGAIN** if bpf program can try again. | 2716 | * **-EAGAIN** if bpf program can try again. |
| 2717 | * | ||
| 2718 | * s64 bpf_tcp_gen_syncookie(struct bpf_sock *sk, void *iph, u32 iph_len, struct tcphdr *th, u32 th_len) | ||
| 2719 | * Description | ||
| 2720 | * Try to issue a SYN cookie for the packet with corresponding | ||
| 2721 | * IP/TCP headers, *iph* and *th*, on the listening socket in *sk*. | ||
| 2722 | * | ||
| 2723 | * *iph* points to the start of the IPv4 or IPv6 header, while | ||
| 2724 | * *iph_len* contains **sizeof**\ (**struct iphdr**) or | ||
| 2725 | * **sizeof**\ (**struct ip6hdr**). | ||
| 2726 | * | ||
| 2727 | * *th* points to the start of the TCP header, while *th_len* | ||
| 2728 | * contains the length of the TCP header. | ||
| 2729 | * | ||
| 2730 | * Return | ||
| 2731 | * On success, lower 32 bits hold the generated SYN cookie in | ||
| 2732 | * followed by 16 bits which hold the MSS value for that cookie, | ||
| 2733 | * and the top 16 bits are unused. | ||
| 2734 | * | ||
| 2735 | * On failure, the returned value is one of the following: | ||
| 2736 | * | ||
| 2737 | * **-EINVAL** SYN cookie cannot be issued due to error | ||
| 2738 | * | ||
| 2739 | * **-ENOENT** SYN cookie should not be issued (no SYN flood) | ||
| 2740 | * | ||
| 2741 | * **-EOPNOTSUPP** kernel configuration does not enable SYN cookies | ||
| 2742 | * | ||
| 2743 | * **-EPROTONOSUPPORT** IP packet version is not 4 or 6 | ||
| 2717 | */ | 2744 | */ |
| 2718 | #define __BPF_FUNC_MAPPER(FN) \ | 2745 | #define __BPF_FUNC_MAPPER(FN) \ |
| 2719 | FN(unspec), \ | 2746 | FN(unspec), \ |
| @@ -2825,7 +2852,8 @@ union bpf_attr { · 105 unmodified lines | |||
| 2825 | FN(strtoul), \ | 2852 | FN(strtoul), \ |
| 2826 | FN(sk_storage_get), \ | 2853 | FN(sk_storage_get), \ |
| 2827 | FN(sk_storage_delete), \ | 2854 | FN(sk_storage_delete), \ |
| 2828 | FN(send_signal), | 2855 | FN(send_signal), \ |
| 2856 | FN(tcp_gen_syncookie), | ||
| 2829 | 2857 | ||
| 2830 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper | 2858 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper |
| 2831 | * function eBPF program intends to call | 2859 | * function eBPF program intends to call |