From e023c2fa4a5c2c2fc131250438b356e1aa69b158 Mon Sep 17 00:00:00 2001 From: Auke Kok Date: Mon, 5 May 2025 08:11:21 -0700 Subject: [PATCH] Do not fence connections without valid greeting. There is no reason to fence any connection that hasn't sent a valid greeting, since they haven't progressed far enough for it to make sense. We remove the connection from the list of accepted clients, which then removes the need for fencing, and the server won't need to restart. Adds a test script that makes sure that we didn't actually restart the server while this was happening. Signed-off-by: Auke Kok --- kmod/src/net.c | 11 +++++++++++ tests/golden/portscan | 7 +++++++ tests/sequence | 1 + tests/tests/portscan.sh | 24 ++++++++++++++++++++++++ 4 files changed, 43 insertions(+) create mode 100644 tests/golden/portscan create mode 100644 tests/tests/portscan.sh diff --git a/kmod/src/net.c b/kmod/src/net.c index 8ff4a22d..6acf6019 100644 --- a/kmod/src/net.c +++ b/kmod/src/net.c @@ -1452,6 +1452,17 @@ restart: set_conn_fl(acc, reconn_freeing); spin_unlock(&conn->lock); if (!test_conn_fl(conn, shutting_down)) { + /* + * If we haven't seen a vg for this connection, don't bother fencing + * it - instead just drop it. If this was a real client, it will try + * again to connect. + */ + if (!test_conn_fl(acc, valid_greeting)) { + /* delete the conn */ + list_del_init(&acc->accepted_head); + goto restart; + } + scoutfs_info(sb, "client "SIN_FMT" reconnect timed out, fencing", SIN_ARG(&acc->last_peername)); ret = scoutfs_fence_start(sb, acc->rid, diff --git a/tests/golden/portscan b/tests/golden/portscan new file mode 100644 index 00000000..4b7509b2 --- /dev/null +++ b/tests/golden/portscan @@ -0,0 +1,7 @@ +== empty packets +Ncat: Connection refused. +Ncat: Connection refused. +== find portscan in connections + +== find portscan in connections + diff --git a/tests/sequence b/tests/sequence index 401b36a4..05e9c1e5 100644 --- a/tests/sequence +++ b/tests/sequence @@ -65,4 +65,5 @@ block-stale-reads.sh freed-list-wedge.sh inode-deletion.sh renameat2-noreplace.sh +portscan.sh xfstests.sh diff --git a/tests/tests/portscan.sh b/tests/tests/portscan.sh new file mode 100644 index 00000000..873ec8d8 --- /dev/null +++ b/tests/tests/portscan.sh @@ -0,0 +1,24 @@ +# +# portscan tests - assure malformed packets do not cause issues +# + +t_require_commands scoutfs nc + +echo "== empty packets" +sleep 1 +echo " " | nc -p 33033 127.0.0.1 $T_PORT_START +echo " " | nc -p 33133 127.0.0.1 $((T_PORT_START+1)) +echo " " | nc -p 33233 127.0.0.1 $((T_PORT_START+2)) + +echo "== find portscan in connections" +L=$(grep 'peer 127.0.0.1:33.33' /sys/kernel/debug/scoutfs/*/connections) +echo $L + +# wait for fencing timeout (20s) +sleep 30 + +echo "== find portscan in connections" +L=$(grep 'peer 127.0.0.1:33.33' /sys/kernel/debug/scoutfs/*/connections) +echo $L + +t_pass