niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

net/tcp: Don't store TCP-AO maclen on reqsk

Browse source 
This extra check doesn't work for a handshake when SYN segment has
(current_key.maclen != rnext_key.maclen). It could be amended to
preserve rnext_key.maclen instead of current_key.maclen, but that
requires a lookup on listen socket.

Originally, this extra maclen check was introduced just because it was
cheap. Drop it and convert tcp_request_sock::maclen into boolean
tcp_request_sock::used_tcp_ao.

Fixes: 06b22ef295 ("net/tcp: Wire TCP-AO to request sockets")
Signed-off-by: Dmitry Safonov <dima@arista.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Dmitry Safonov 2023-12-04 19:00:44 +00:00 • committed by Paolo Abeni
parent 12083d7282
commit 9396c4ee93
4 changed files with 10 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
include/linux/tcp.h
View file

@ -169,7 +169,7 @@ struct tcp_request_sock {
#ifdef CONFIG_TCP_AO #ifdef CONFIG_TCP_AO
u8 ao_keyid; u8 ao_keyid;
u8 ao_rcv_next; u8 ao_rcv_next;
u8 maclen; bool used_tcp_ao;
#endif #endif
}; };
@ -180,14 +180,10 @@ static inline struct tcp_request_sock *tcp_rsk(const struct request_sock *req)
static inline bool tcp_rsk_used_ao(const struct request_sock *req) static inline bool tcp_rsk_used_ao(const struct request_sock *req)
{ {
/* The real length of MAC is saved in the request socket,
* signing anything with zero-length makes no sense, so here is
* a little hack..
*/
#ifndef CONFIG_TCP_AO #ifndef CONFIG_TCP_AO
return false; return false;
#else #else
return tcp_rsk(req)->maclen != 0; return tcp_rsk(req)->used_tcp_ao;
#endif #endif
} }

4
net/ipv4/tcp_ao.c
View file

@ -851,7 +851,7 @@ void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
const struct tcp_ao_hdr *aoh; const struct tcp_ao_hdr *aoh;
struct tcp_ao_key *key; struct tcp_ao_key *key;
treq->maclen = 0; treq->used_tcp_ao = false;
if (tcp_parse_auth_options(th, NULL, &aoh) || !aoh) if (tcp_parse_auth_options(th, NULL, &aoh) || !aoh)
return; return;
@ -863,7 +863,7 @@ void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
treq->ao_rcv_next = aoh->keyid; treq->ao_rcv_next = aoh->keyid;
treq->ao_keyid = aoh->rnext_keyid; treq->ao_keyid = aoh->rnext_keyid;
treq->maclen = tcp_ao_maclen(key); treq->used_tcp_ao = true;
} }
static enum skb_drop_reason static enum skb_drop_reason

5
net/ipv4/tcp_input.c
View file

@ -7182,11 +7182,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh)) if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh))
goto drop_and_release; /* Invalid TCP options */ goto drop_and_release; /* Invalid TCP options */
if (aoh) { if (aoh) {
tcp_rsk(req)->maclen = aoh->length - sizeof(struct tcp_ao_hdr); tcp_rsk(req)->used_tcp_ao = true;
tcp_rsk(req)->ao_rcv_next = aoh->keyid; tcp_rsk(req)->ao_rcv_next = aoh->keyid;
tcp_rsk(req)->ao_keyid = aoh->rnext_keyid; tcp_rsk(req)->ao_keyid = aoh->rnext_keyid;
} else { } else {
tcp_rsk(req)->maclen = 0; tcp_rsk(req)->used_tcp_ao = false;
} }
#endif #endif
tcp_rsk(req)->snt_isn = isn; tcp_rsk(req)->snt_isn = isn;

9
net/ipv4/tcp_output.c
View file

@ -3720,7 +3720,6 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst,
if (tcp_rsk_used_ao(req)) { if (tcp_rsk_used_ao(req)) {
#ifdef CONFIG_TCP_AO #ifdef CONFIG_TCP_AO
struct tcp_ao_key *ao_key = NULL; struct tcp_ao_key *ao_key = NULL;
u8 maclen = tcp_rsk(req)->maclen;
u8 keyid = tcp_rsk(req)->ao_keyid; u8 keyid = tcp_rsk(req)->ao_keyid;
ao_key = tcp_sk(sk)->af_specific->ao_lookup(sk, req_to_sk(req), ao_key = tcp_sk(sk)->af_specific->ao_lookup(sk, req_to_sk(req),
@ -3730,13 +3729,11 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst,
* for another peer-matching key, but the peer has requested * for another peer-matching key, but the peer has requested
* ao_keyid (RFC5925 RNextKeyID), so let's keep it simple here. * ao_keyid (RFC5925 RNextKeyID), so let's keep it simple here.
*/ */
if (unlikely(!ao_key || tcp_ao_maclen(ao_key) != maclen)) { if (unlikely(!ao_key)) {
u8 key_maclen = ao_key ? tcp_ao_maclen(ao_key) : 0;
rcu_read_unlock(); rcu_read_unlock();
kfree_skb(skb); kfree_skb(skb);
net_warn_ratelimited("TCP-AO: the keyid %u with maclen %u|%u from SYN packet is not present - not sending SYNACK\n", net_warn_ratelimited("TCP-AO: the keyid %u from SYN packet is not present - not sending SYNACK\n",
keyid, maclen, key_maclen); keyid);
return NULL; return NULL;
} }
key.ao_key = ao_key; key.ao_key = ao_key;