tcp: add TCP_RFC7323_TW_PAWS drop reason

JIRA: https://issues.redhat.com/browse/RHEL-88890
Upstream Status: net-next.git
Conflicts:\
- Small code differences due to missing upstream commit 4618e19
  ("tcp: add new TCP_TW_ACK_OOW state and allow ECN bits in TOS") in
  c9s.

commit 0427141
Author: Jiayuan Chen <jiayuan.chen@linux.dev>
Date:   Wed Apr 9 19:26:04 2025 +0800

    tcp: add TCP_RFC7323_TW_PAWS drop reason

    Devices in the networking path, such as firewalls, NATs, or routers, which
    can perform SNAT or DNAT, use addresses from their own limited address
    pools to masquerade the source address during forwarding, causing PAWS
    verification to fail more easily.

    Currently, packet loss statistics for PAWS can only be viewed through MIB,
    which is a global metric and cannot be precisely obtained through tracing
    to get the specific 4-tuple of the dropped packet. In the past, we had to
    use kprobe ret to retrieve relevant skb information from
    tcp_timewait_state_process().

    We add a drop_reason pointer, similar to what previous commit does:
    commit e34100c ("tcp: add a drop_reason pointer to tcp_check_req()")

    This commit addresses the PAWSESTABREJECTED case and also sets the
    corresponding drop reason.

    We use 'pwru' to test.

    Before this commit:
    ''''
    ./pwru 'port 9999'
    2025/04/07 13:40:19 Listening for events..
    TUPLE                                        FUNC
    172.31.75.115:12345->172.31.75.114:9999(tcp) sk_skb_reason_drop(SKB_DROP_REASON_NOT_SPECIFIED)
    '''

    After this commit:
    '''
    ./pwru 'port 9999'
    2025/04/07 13:51:34 Listening for events..
    TUPLE                                        FUNC
    172.31.75.115:12345->172.31.75.114:9999(tcp) sk_skb_reason_drop(SKB_DROP_REASON_TCP_RFC7323_TW_PAWS)
    '''

    Suggested-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20250409112614.16153-2-jiayuan.chen@linux.dev
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Antoine Tenart <atenart@redhat.com>

Author: atenart

include/net/dropreason-core.h

@@ -34,6 +34,7 @@
 	FN(TCP_OFOMERGE)		\
 	FN(TCP_RFC7323_PAWS)		\
 	FN(TCP_RFC7323_PAWS_ACK)	\
+	FN(TCP_RFC7323_TW_PAWS)		\
 	FN(TCP_RFC7323_TSECR)		\
 	FN(TCP_LISTEN_OVERFLOW)		\
 	FN(TCP_OLD_SEQUENCE)		\
@@ -241,6 +242,11 @@ enum skb_drop_reason {
 	 * Corresponds to LINUX_MIB_PAWS_OLD_ACK.
 	 */
 	SKB_DROP_REASON_TCP_RFC7323_PAWS_ACK,
+	/**
+	 * @SKB_DROP_REASON_TCP_RFC7323_TW_PAWS: PAWS check, socket is in
+	 * TIME_WAIT state.
+	 */
+	SKB_DROP_REASON_TCP_RFC7323_TW_PAWS,
 	/**
 	 * @SKB_DROP_REASON_TCP_RFC7323_TSECR: PAWS check, invalid TSEcr.
 	 * Corresponds to LINUX_MIB_TSECRREJECTED.

include/net/tcp.h

@@ -392,7 +392,8 @@ enum tcp_tw_status {
 enum tcp_tw_status tcp_timewait_state_process(struct inet_timewait_sock *tw,
 					      struct sk_buff *skb,
 					      const struct tcphdr *th,
-					      u32 *tw_isn);
+					      u32 *tw_isn,
+					      enum skb_drop_reason *drop_reason);
 struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
 			   struct request_sock *req, bool fastopen,
 			   bool *lost_race, enum skb_drop_reason *drop_reason);

net/ipv4/tcp_ipv4.c

@@ -2150,7 +2150,8 @@ int tcp_v4_rcv(struct sk_buff *skb)
 		inet_twsk_put(inet_twsk(sk));
 		goto csum_error;
 	}
-	switch (tcp_timewait_state_process(inet_twsk(sk), skb, th, &isn)) {
+	switch (tcp_timewait_state_process(inet_twsk(sk), skb, th, &isn,
+					   &drop_reason)) {
 	case TCP_TW_SYN: {
 		struct sock *sk2 = inet_lookup_listener(net,
 							net->ipv4.tcp_death_row.hashinfo,

net/ipv4/tcp_minisocks.c

@@ -91,7 +91,8 @@ tcp_timewait_check_oow_rate_limit(struct inet_timewait_sock *tw,
  */
 enum tcp_tw_status
 tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
-			   const struct tcphdr *th, u32 *tw_isn)
+			   const struct tcphdr *th, u32 *tw_isn,
+			   enum skb_drop_reason *drop_reason)
 {
 	struct tcp_options_received tmp_opt;
 	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
@@ -233,8 +234,10 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
 		return TCP_TW_SYN;
 	}
 
-	if (paws_reject)
+	if (paws_reject) {
+		*drop_reason = SKB_DROP_REASON_TCP_RFC7323_TW_PAWS;
 		__NET_INC_STATS(twsk_net(tw), LINUX_MIB_PAWSESTABREJECTED);
+	}
 
 	if (!th->rst) {
 		/* In this case we must reset the TIMEWAIT timer.

net/ipv6/tcp_ipv6.c

@@ -1793,7 +1793,8 @@ INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb)
 		goto csum_error;
 	}
 
-	switch (tcp_timewait_state_process(inet_twsk(sk), skb, th, &isn)) {
+	switch (tcp_timewait_state_process(inet_twsk(sk), skb, th, &isn,
+					   &drop_reason)) {
 	case TCP_TW_SYN:
 	{
 		struct sock *sk2;