lib/csu: Ensure that ELF notes are retained with -Wl,--gc-sections

[arichardson]

Summary

This requires a rather recent clang (https://reviews.llvm.org/D95730),
so I'm not sure if we can commit this as-is now.

Test Plan

previously building a binary with -static and -Wl,--gc-sections on
would not have the FreeBSD ABI note, and on some architectures (e.g. aarch64)
this would result in the kernel ELF loader rejecting the file with:
ELF binary type "0" not known.
This patch is based on CheriBSD (first patch submitted from my Morello board), but I will update to drop the non-upstream parts if this is considered the correct approach to work around this problem.

[jrtc27]

This was considered but not done as it requires the linker to support SHF_RETAIN. The best option is to move the note to just crti and have a dummy crti for CHERI downstream rather than omit it

[arichardson]

In D35534#805923, @jrtc27 wrote:

This was considered but not done as it requires the linker to support SHF_RETAIN. The best option is to move the note to just crti and have a dummy crti for CHERI downstream rather than omit it

Makes sense, it is I was concerned about. How about downstream though, we don't have the old linker constraint there.

[emaste]

I think binutils allows (or allowed) SHF_GNU_RETAIN only with ELFOSABI_GNU or ELFOSABI_FREEBSD, and if we have that then this change is less important.

lib/csu/common/crtbrand.S

SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_syn, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_insecure_syn), 0,
     "Follow RFC793 instead of RFC5961 criteria for accepting SYN packets");
 
 VNET_DEFINE(int, tcp_insecure_rst) = 0;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_rst, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_insecure_rst), 0,
     "Follow RFC793 instead of RFC5961 criteria for accepting RST packets");
 
+VNET_DEFINE(int, tcp_insecure_ack) = 0;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_ack, CTLFLAG_VNET | CTLFLAG_RW,
+    &VNET_NAME(tcp_insecure_ack), 0,
+    "Follow RFC793 criteria for validating SEG.ACK");
+
 VNET_DEFINE(int, tcp_recvspace) = 1024*64;
 #define V_tcp_recvspace VNET(tcp_recvspace)
 SYSCTL_INT(_net_inet_tcp, TCPCTL_RECVSPACE, recvspace, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_recvspace), 0, "Initial receive socket buffer size");
 
 VNET_DEFINE(int, tcp_do_autorcvbuf) = 1;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, recvbuf_auto, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_do_autorcvbuf), 0,
if (V_tcp_insecure_syn &&
                         /* Send challenge ACK. */
                         tcp_respond(tp, mtod(m, void *), th, m, tp->rcv_nxt,
                             tp->snd_nxt, TH_ACK);
                         tp->last_ack_sent = tp->rcv_nxt;
                         m = NULL;
                 }
                 goto drop;
         }
 
         /*
          * RFC 1323 PAWS: If we have a timestamp reply on this segment
          * and it's less than ts_recent, drop it.
          */
         if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
             TSTMP_LT(to.to_tsval, tp->ts_recent)) {
                 /* Check to see if ts_recent is over 24 days old.  */
                 if (tcp_ts_getticks() - tp->ts_recent_age > TCP_PAWS_IDLE) {
if (tp->t_state == TCPS_SYN_RECEIVED ||
                         goto dropafterack;
                 else
                         goto drop;
         }
 
         /*
          * Ack processing.
          */
+        if (SEQ_GEQ(tp->snd_una, tp->iss + (65535 << tp->snd_scale))) {
+                /* Checking SEG.ACK against ISS is definitely redundant. */
+                tp->t_flags2 |= TF2_NO_ISS_CHECK;
+        }
+        if (!V_tcp_insecure_ack) {
+                tcp_seq seq_min;
+                bool ghost_ack_check;
+
+                if (tp->t_flags2 & TF2_NO_ISS_CHECK) {
+                        /* Check for too old ACKs (RFC 5961, Section 5.2). */
+                        seq_min = tp->snd_una - tp->max_sndwnd;
+                        ghost_ack_check = false;
+                } else {
+                        if (SEQ_GT(tp->iss + 1, tp->snd_una - tp->max_sndwnd)) {
+                                /* Checking for ghost ACKs is stricter. */
+                                seq_min = tp->iss + 1;
+                                ghost_ack_check = true;
+                        } else {
+                                /*
+                                 * Checking for too old ACKs (RFC 5961,
+                                 * Section 5.2) is stricter.
+                                 */
+                                seq_min = tp->snd_una - tp->max_sndwnd;
+                                ghost_ack_check = false;
+                        }
+                }
+                if (SEQ_LT(th->th_ack, seq_min)) {
+                        if (ghost_ack_check)
+                                TCPSTAT_INC(tcps_rcvghostack);
+                        else
+                                TCPSTAT_INC(tcps_rcvacktooold);
+                        /* Send a challenge ACK. */
+                        tcp_respond(tp, mtod(m, void *), th, m,
+                            tp->rcv_nxt, tp->snd_nxt, TH_ACK);
+                        tp->last_ack_sent = tp->rcv_nxt;
+                        m = NULL;
+                        goto drop;
+                }
+        }
         switch (tp->t_state) {
         /*
          * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
          * ESTABLISHED state and continue processing.
          * The ACK was checked above.
          */
         case TCPS_SYN_RECEIVED:
 

lib/csu/common/feature_note.S

SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_syn, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_insecure_syn), 0,
     "Follow RFC793 instead of RFC5961 criteria for accepting SYN packets");
 
 VNET_DEFINE(int, tcp_insecure_rst) = 0;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_rst, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_insecure_rst), 0,
     "Follow RFC793 instead of RFC5961 criteria for accepting RST packets");
 
+VNET_DEFINE(int, tcp_insecure_ack) = 0;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_ack, CTLFLAG_VNET | CTLFLAG_RW,
+    &VNET_NAME(tcp_insecure_ack), 0,
+    "Follow RFC793 criteria for validating SEG.ACK");
+
 VNET_DEFINE(int, tcp_recvspace) = 1024*64;
 #define V_tcp_recvspace VNET(tcp_recvspace)
 SYSCTL_INT(_net_inet_tcp, TCPCTL_RECVSPACE, recvspace, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_recvspace), 0, "Initial receive socket buffer size");
 
 VNET_DEFINE(int, tcp_do_autorcvbuf) = 1;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, recvbuf_auto, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_do_autorcvbuf), 0,
if (V_tcp_insecure_syn &&
                         /* Send challenge ACK. */
                         tcp_respond(tp, mtod(m, void *), th, m, tp->rcv_nxt,
                             tp->snd_nxt, TH_ACK);
                         tp->last_ack_sent = tp->rcv_nxt;
                         m = NULL;
                 }
                 goto drop;
         }
 
         /*
          * RFC 1323 PAWS: If we have a timestamp reply on this segment
          * and it's less than ts_recent, drop it.
          */
         if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
             TSTMP_LT(to.to_tsval, tp->ts_recent)) {
                 /* Check to see if ts_recent is over 24 days old.  */
                 if (tcp_ts_getticks() - tp->ts_recent_age > TCP_PAWS_IDLE) {
if (tp->t_state == TCPS_SYN_RECEIVED ||
                         goto dropafterack;
                 else
                         goto drop;
         }
 
         /*
          * Ack processing.
          */
+        if (SEQ_GEQ(tp->snd_una, tp->iss + (65535 << tp->snd_scale))) {
+                /* Checking SEG.ACK against ISS is definitely redundant. */
+                tp->t_flags2 |= TF2_NO_ISS_CHECK;
+        }
+        if (!V_tcp_insecure_ack) {
+                tcp_seq seq_min;
+                bool ghost_ack_check;
+
+                if (tp->t_flags2 & TF2_NO_ISS_CHECK) {
+                        /* Check for too old ACKs (RFC 5961, Section 5.2). */
+                        seq_min = tp->snd_una - tp->max_sndwnd;
+                        ghost_ack_check = false;
+                } else {
+                        if (SEQ_GT(tp->iss + 1, tp->snd_una - tp->max_sndwnd)) {
+                                /* Checking for ghost ACKs is stricter. */
+                                seq_min = tp->iss + 1;
+                                ghost_ack_check = true;
+                        } else {
+                                /*
+                                 * Checking for too old ACKs (RFC 5961,
+                                 * Section 5.2) is stricter.
+                                 */
+                                seq_min = tp->snd_una - tp->max_sndwnd;
+                                ghost_ack_check = false;
+                        }
+                }
+                if (SEQ_LT(th->th_ack, seq_min)) {
+                        if (ghost_ack_check)
+                                TCPSTAT_INC(tcps_rcvghostack);
+                        else
+                                TCPSTAT_INC(tcps_rcvacktooold);
+                        /* Send a challenge ACK. */
+                        tcp_respond(tp, mtod(m, void *), th, m,
+                            tp->rcv_nxt, tp->snd_nxt, TH_ACK);
+                        tp->last_ack_sent = tp->rcv_nxt;
+                        m = NULL;
+                        goto drop;
+                }
+        }
         switch (tp->t_state) {
         /*
          * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
          * ESTABLISHED state and continue processing.
          * The ACK was checked above.
          */
         case TCPS_SYN_RECEIVED:
 

lib/csu/common/ignore_init_note.S

SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_syn, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_insecure_syn), 0,
     "Follow RFC793 instead of RFC5961 criteria for accepting SYN packets");
 
 VNET_DEFINE(int, tcp_insecure_rst) = 0;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_rst, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_insecure_rst), 0,
     "Follow RFC793 instead of RFC5961 criteria for accepting RST packets");
 
+VNET_DEFINE(int, tcp_insecure_ack) = 0;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_ack, CTLFLAG_VNET | CTLFLAG_RW,
+    &VNET_NAME(tcp_insecure_ack), 0,
+    "Follow RFC793 criteria for validating SEG.ACK");
+
 VNET_DEFINE(int, tcp_recvspace) = 1024*64;
 #define V_tcp_recvspace VNET(tcp_recvspace)
 SYSCTL_INT(_net_inet_tcp, TCPCTL_RECVSPACE, recvspace, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_recvspace), 0, "Initial receive socket buffer size");
 
 VNET_DEFINE(int, tcp_do_autorcvbuf) = 1;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, recvbuf_auto, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_do_autorcvbuf), 0,
if (V_tcp_insecure_syn &&
                         /* Send challenge ACK. */
                         tcp_respond(tp, mtod(m, void *), th, m, tp->rcv_nxt,
                             tp->snd_nxt, TH_ACK);
                         tp->last_ack_sent = tp->rcv_nxt;
                         m = NULL;
                 }
                 goto drop;
         }
 
         /*
          * RFC 1323 PAWS: If we have a timestamp reply on this segment
          * and it's less than ts_recent, drop it.
          */
         if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
             TSTMP_LT(to.to_tsval, tp->ts_recent)) {
                 /* Check to see if ts_recent is over 24 days old.  */
                 if (tcp_ts_getticks() - tp->ts_recent_age > TCP_PAWS_IDLE) {
if (tp->t_state == TCPS_SYN_RECEIVED ||
                         goto dropafterack;
                 else
                         goto drop;
         }
 
         /*
          * Ack processing.
          */
+        if (SEQ_GEQ(tp->snd_una, tp->iss + (65535 << tp->snd_scale))) {
+                /* Checking SEG.ACK against ISS is definitely redundant. */
+                tp->t_flags2 |= TF2_NO_ISS_CHECK;
+        }
+        if (!V_tcp_insecure_ack) {
+                tcp_seq seq_min;
+                bool ghost_ack_check;
+
+                if (tp->t_flags2 & TF2_NO_ISS_CHECK) {
+                        /* Check for too old ACKs (RFC 5961, Section 5.2). */
+                        seq_min = tp->snd_una - tp->max_sndwnd;
+                        ghost_ack_check = false;
+                } else {
+                        if (SEQ_GT(tp->iss + 1, tp->snd_una - tp->max_sndwnd)) {
+                                /* Checking for ghost ACKs is stricter. */
+                                seq_min = tp->iss + 1;
+                                ghost_ack_check = true;
+                        } else {
+                                /*
+                                 * Checking for too old ACKs (RFC 5961,
+                                 * Section 5.2) is stricter.
+                                 */
+                                seq_min = tp->snd_una - tp->max_sndwnd;
+                                ghost_ack_check = false;
+                        }
+                }
+                if (SEQ_LT(th->th_ack, seq_min)) {
+                        if (ghost_ack_check)
+                                TCPSTAT_INC(tcps_rcvghostack);
+                        else
+                                TCPSTAT_INC(tcps_rcvacktooold);
+                        /* Send a challenge ACK. */
+                        tcp_respond(tp, mtod(m, void *), th, m,
+                            tp->rcv_nxt, tp->snd_nxt, TH_ACK);
+                        tp->last_ack_sent = tp->rcv_nxt;
+                        m = NULL;
+                        goto drop;
+                }
+        }
         switch (tp->t_state) {
         /*
          * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
          * ESTABLISHED state and continue processing.
          * The ACK was checked above.
          */
         case TCPS_SYN_RECEIVED: