@@ -38,10 +38,11 @@ new flags.
* Address binding is optional, by default keys match all addresses
* Local address is ignored, matching is done by remote address
* Ports are ignored
* It is possible to match a specific VRF by l3index (default is to ignore)
+ * It is possible to match with a fixed prefixlen (default is full address)
RFC5925 requires that key ids do not overlap when tcp identifiers (addr/port)
overlap. This is not enforced by linux, configuring ambiguous keys will result
in packet drops and lost connections.
@@ -47,10 +47,12 @@ struct tcp_authopt_key_info {
u8 keylen;
/** @key: Same as &tcp_authopt_key.key */
u8 key[TCP_AUTHOPT_MAXKEYLEN];
/** @l3index: Same as &tcp_authopt_key.ifindex */
int l3index;
+ /** @prefixlen: Length of addr match (default full) */
+ int prefixlen;
/** @addr: Same as &tcp_authopt_key.addr */
struct sockaddr_storage addr;
/** @alg: Algorithm implementation matching alg_id */
struct tcp_authopt_alg_imp *alg;
};
@@ -403,18 +403,21 @@ struct tcp_authopt {
* @TCP_AUTHOPT_KEY_EXCLUDE_OPTS: Exclude TCP options from signature
* @TCP_AUTHOPT_KEY_ADDR_BIND: Key only valid for `tcp_authopt.addr`
* @TCP_AUTHOPT_KEY_IFINDEX: Key only valid for `tcp_authopt.ifindex`
* @TCP_AUTHOPT_KEY_NOSEND: Key invalid for send (expired)
* @TCP_AUTHOPT_KEY_NORECV: Key invalid for recv (expired)
+ * @TCP_AUTHOPT_KEY_PREFIXLEN: Valid value in `tcp_authopt.prefixlen`, otherwise
+ * match full address length
*/
enum tcp_authopt_key_flag {
TCP_AUTHOPT_KEY_DEL = (1 << 0),
TCP_AUTHOPT_KEY_EXCLUDE_OPTS = (1 << 1),
TCP_AUTHOPT_KEY_ADDR_BIND = (1 << 2),
TCP_AUTHOPT_KEY_IFINDEX = (1 << 3),
TCP_AUTHOPT_KEY_NOSEND = (1 << 4),
TCP_AUTHOPT_KEY_NORECV = (1 << 5),
+ TCP_AUTHOPT_KEY_PREFIXLEN = (1 << 6),
};
/**
* enum tcp_authopt_alg - Algorithms for TCP Authentication Option
*/
@@ -465,10 +468,17 @@ struct tcp_authopt_key {
* connections through this interface. Interface must be an vrf master.
*
* This is similar to `tcp_msg5sig.tcpm_ifindex`
*/
int ifindex;
+ /**
+ * @prefixlen: length of prefix to match
+ *
+ * Without the TCP_AUTHOPT_KEY_PREFIXLEN flag this is ignored and a full
+ * address match is performed.
+ */
+ int prefixlen;
};
/* setsockopt(fd, IPPROTO_TCP, TCP_ZEROCOPY_RECEIVE, ...) */
#define TCP_RECEIVE_ZEROCOPY_FLAG_TLB_CLEAN_HINT 0x1
@@ -4,10 +4,11 @@
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/tcp.h>
#include <linux/kref.h>
#include <crypto/hash.h>
+#include <linux/inetdevice.h>
/* This is mainly intended to protect against local privilege escalations through
* a rarely used feature so it is deliberately not namespaced.
*/
int sysctl_tcp_authopt;
@@ -269,10 +270,14 @@ static bool tcp_authopt_key_match_exact(struct tcp_authopt_key_info *info,
return false;
if ((info->flags & TCP_AUTHOPT_KEY_IFINDEX) != (key->flags & TCP_AUTHOPT_KEY_IFINDEX))
return false;
if ((info->flags & TCP_AUTHOPT_KEY_IFINDEX) && info->l3index != key->ifindex)
return false;
+ if ((info->flags & TCP_AUTHOPT_KEY_PREFIXLEN) != (key->flags & TCP_AUTHOPT_KEY_PREFIXLEN))
+ return false;
+ if ((info->flags & TCP_AUTHOPT_KEY_PREFIXLEN) && info->prefixlen != key->prefixlen)
+ return false;
if ((info->flags & TCP_AUTHOPT_KEY_ADDR_BIND) != (key->flags & TCP_AUTHOPT_KEY_ADDR_BIND))
return false;
if (info->flags & TCP_AUTHOPT_KEY_ADDR_BIND)
if (!ipvx_addr_match(&info->addr, &key->addr))
return false;
@@ -286,17 +291,20 @@ static bool tcp_authopt_key_match_skb_addr(struct tcp_authopt_key_info *key,
u16 keyaf = key->addr.ss_family;
struct iphdr *iph = (struct iphdr *)skb_network_header(skb);
if (keyaf == AF_INET && iph->version == 4) {
struct sockaddr_in *key_addr = (struct sockaddr_in *)&key->addr;
+ __be32 mask = inet_make_mask(key->prefixlen);
- return iph->saddr == key_addr->sin_addr.s_addr;
+ return (iph->saddr & mask) == key_addr->sin_addr.s_addr;
} else if (keyaf == AF_INET6 && iph->version == 6) {
struct ipv6hdr *ip6h = (struct ipv6hdr *)skb_network_header(skb);
struct sockaddr_in6 *key_addr = (struct sockaddr_in6 *)&key->addr;
- return ipv6_addr_equal(&ip6h->saddr, &key_addr->sin6_addr);
+ return ipv6_prefix_equal(&ip6h->saddr,
+ &key_addr->sin6_addr,
+ key->prefixlen);
}
/* This actually happens with ipv6-mapped-ipv4-addresses
* IPv6 listen sockets will be asked to validate ipv4 packets.
*/
@@ -312,17 +320,20 @@ static bool tcp_authopt_key_match_sk_addr(struct tcp_authopt_key_info *key,
if (keyaf != addr_sk->sk_family)
return false;
if (keyaf == AF_INET) {
struct sockaddr_in *key_addr = (struct sockaddr_in *)&key->addr;
+ __be32 mask = inet_make_mask(key->prefixlen);
- return addr_sk->sk_daddr == key_addr->sin_addr.s_addr;
+ return (addr_sk->sk_daddr & mask) == key_addr->sin_addr.s_addr;
#if IS_ENABLED(CONFIG_IPV6)
} else if (keyaf == AF_INET6) {
struct sockaddr_in6 *key_addr = (struct sockaddr_in6 *)&key->addr;
- return ipv6_addr_equal(&addr_sk->sk_v6_daddr, &key_addr->sin6_addr);
+ return ipv6_prefix_equal(&addr_sk->sk_v6_daddr,
+ &key_addr->sin6_addr,
+ key->prefixlen);
#endif
}
return false;
}
@@ -348,10 +359,16 @@ static bool better_key_match(struct tcp_authopt_key_info *old, struct tcp_authop
/* l3index always overrides non-l3index */
if (old->l3index && new->l3index == 0)
return false;
if (old->l3index == 0 && new->l3index)
return true;
+ /* Full address match overrides match by prefixlen */
+ if (!(new->flags & TCP_AUTHOPT_KEY_PREFIXLEN) && (old->flags & TCP_AUTHOPT_KEY_PREFIXLEN))
+ return false;
+ /* Longer prefixes are better matches */
+ if (new->prefixlen > old->prefixlen)
+ return true;
return false;
}
/**
@@ -626,21 +643,32 @@ int tcp_get_authopt_val(struct sock *sk, struct tcp_authopt *opt)
#define TCP_AUTHOPT_KEY_KNOWN_FLAGS ( \
TCP_AUTHOPT_KEY_DEL | \
TCP_AUTHOPT_KEY_EXCLUDE_OPTS | \
TCP_AUTHOPT_KEY_ADDR_BIND | \
TCP_AUTHOPT_KEY_IFINDEX | \
+ TCP_AUTHOPT_KEY_PREFIXLEN | \
TCP_AUTHOPT_KEY_NOSEND | \
TCP_AUTHOPT_KEY_NORECV)
+static bool ipv6_addr_is_prefix(struct in6_addr *addr, int plen)
+{
+ struct in6_addr copy;
+
+ ipv6_addr_prefix(©, addr, plen);
+
+ return !memcmp(©, addr, sizeof(*addr));
+}
+
int tcp_set_authopt_key(struct sock *sk, sockptr_t optval, unsigned int optlen)
{
struct tcp_authopt_key opt;
struct tcp_authopt_info *info;
struct tcp_authopt_key_info *key_info, *old_key_info;
struct netns_tcp_authopt *net = sock_net_tcp_authopt(sk);
struct tcp_authopt_alg_imp *alg;
int l3index = 0;
+ int prefixlen;
int err;
sock_owned_by_me(sk);
err = check_sysctl_tcp_authopt();
if (err)
@@ -676,10 +704,36 @@ int tcp_set_authopt_key(struct sock *sk, sockptr_t optval, unsigned int optlen)
if (opt.flags & TCP_AUTHOPT_KEY_ADDR_BIND) {
if (sk->sk_family != opt.addr.ss_family)
return -EINVAL;
}
+ /* check prefixlen */
+ if (opt.flags & TCP_AUTHOPT_KEY_PREFIXLEN) {
+ prefixlen = opt.prefixlen;
+ if (sk->sk_family == AF_INET) {
+ if (prefixlen < 0 || prefixlen > 32)
+ return -EINVAL;
+ if (((struct sockaddr_in *)&opt.addr)->sin_addr.s_addr &
+ ~inet_make_mask(prefixlen))
+ return -EINVAL;
+ }
+ if (sk->sk_family == AF_INET6) {
+ if (prefixlen < 0 || prefixlen > 128)
+ return -EINVAL;
+ if (!ipv6_addr_is_prefix(&((struct sockaddr_in6 *)&opt.addr)->sin6_addr,
+ prefixlen))
+ return -EINVAL;
+ }
+ } else {
+ if (sk->sk_family == AF_INET)
+ prefixlen = 32;
+ else if (sk->sk_family == AF_INET6)
+ prefixlen = 128;
+ else
+ return -EINVAL;
+ }
+
/* Initialize tcp_authopt_info if not already set */
info = __tcp_authopt_info_get_or_create(sk);
if (IS_ERR(info))
return PTR_ERR(info);
@@ -725,10 +779,11 @@ int tcp_set_authopt_key(struct sock *sk, sockptr_t optval, unsigned int optlen)
key_info->alg = alg;
key_info->keylen = opt.keylen;
memcpy(key_info->key, opt.key, opt.keylen);
memcpy(&key_info->addr, &opt.addr, sizeof(key_info->addr));
key_info->l3index = l3index;
+ key_info->prefixlen = prefixlen;
hlist_add_head_rcu(&key_info->node, &net->head);
mutex_unlock(&net->mutex);
return 0;
}
This allows making a key apply to an addr/prefix instead of just the full addr. This is enabled through a custom flag, default behavior is still full address match. This is equivalent to TCP_MD5SIG_FLAG_PREFIX from TCP_MD5SIG and has the same use-cases. Signed-off-by: Leonard Crestez <cdleonard@gmail.com> --- Documentation/networking/tcp_authopt.rst | 1 + include/net/tcp_authopt.h | 2 + include/uapi/linux/tcp.h | 10 ++++ net/ipv4/tcp_authopt.c | 63 ++++++++++++++++++++++-- 4 files changed, 72 insertions(+), 4 deletions(-)