This helper function allows BPF programs to try to generate SYN cookies, given a reference to a listener socket. The function works from XDP and with an skb context since bpf_skc_lookup_tcp can lookup a socket in both cases.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -2714,6 +2714,33 @@ union bpf_attr { · 2713 unmodified lines | ||
| 2714 | 2714 | * **-EPERM** if no permission to send the *sig*. |
| 2715 | 2715 | * |
| 2716 | 2716 | * **-EAGAIN** if bpf program can try again. |
| 2717 | + * | |
| 2718 | + * s64 bpf_tcp_gen_syncookie(struct bpf_sock *sk, void *iph, u32 iph_len, struct tcphdr *th, u32 th_len) | |
| 2719 | + * Description | |
| 2720 | + * Try to issue a SYN cookie for the packet with corresponding | |
| 2721 | + * IP/TCP headers, *iph* and *th*, on the listening socket in *sk*. | |
| 2722 | + * | |
| 2723 | + * *iph* points to the start of the IPv4 or IPv6 header, while | |
| 2724 | + * *iph_len* contains **sizeof**\ (**struct iphdr**) or | |
| 2725 | + * **sizeof**\ (**struct ip6hdr**). | |
| 2726 | + * | |
| 2727 | + * *th* points to the start of the TCP header, while *th_len* | |
| 2728 | + * contains the length of the TCP header. | |
| 2729 | + * | |
| 2730 | + * Return | |
| 2731 | + * On success, lower 32 bits hold the generated SYN cookie in | |
| 2732 | + * followed by 16 bits which hold the MSS value for that cookie, | |
| 2733 | + * and the top 16 bits are unused. | |
| 2734 | + * | |
| 2735 | + * On failure, the returned value is one of the following: | |
| 2736 | + * | |
| 2737 | + * **-EINVAL** SYN cookie cannot be issued due to error | |
| 2738 | + * | |
| 2739 | + * **-ENOENT** SYN cookie should not be issued (no SYN flood) | |
| 2740 | + * | |
| 2741 | + * **-EOPNOTSUPP** kernel configuration does not enable SYN cookies | |
| 2742 | + * | |
| 2743 | + * **-EPROTONOSUPPORT** IP packet version is not 4 or 6 | |
| 2717 | 2744 | */ |
| 2718 | 2745 | #define __BPF_FUNC_MAPPER(FN) \ |
| 2719 | 2746 | FN(unspec), \ |
| @@ -2825,7 +2852,8 @@ union bpf_attr { · 105 unmodified lines | ||
| 2825 | 2852 | FN(strtoul), \ |
| 2826 | 2853 | FN(sk_storage_get), \ |
| 2827 | 2854 | FN(sk_storage_delete), \ |
| 2828 | − FN(send_signal), | |
| 2855 | + FN(send_signal), \ | |
| 2856 | + FN(tcp_gen_syncookie), | |
| 2829 | 2857 | |
| 2830 | 2858 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper |
| 2831 | 2859 | * function eBPF program intends to call |