mbox series

[0/5] net/tcp-md5: Verify segments on TIME_WAIT sockets

Message ID 20230509221608.2569333-1-dima@arista.com (mailing list archive)
Headers show
Series net/tcp-md5: Verify segments on TIME_WAIT sockets | expand

Message

Dmitry Safonov May 9, 2023, 10:16 p.m. UTC 
Hi,

Started as a refactoring of tcp_v{4,6}_send_reset(), in order to prepare
it for TCP-AO signing for RST segments. As you can see the previous
TCP-AO-v5 [1] version of those functions, they get too big and nasty.
Patches 1 and 2 seem more-or-less straight-forward to me.

But then another thing that I wanted to fix for TCP-AO-version6 was
accepting of unsigned or incorrectly signed segments on twsk, which is
against RFC5925 (7.2) that requires checking the signature. So, I decided
to give it a shot and fix twsk for TCP-MD5 as well.
That seems more questionable, that's why I'm sending patch 3 as RFC.

And the last part, patches 4 and 5 are paranoid checks made to minimize
cases when inbound segment's signature and RST/ACK reply aren't consistent.
This is direct result of RFC2385 that lacks key rotation mechanism.
Probably, patches 4 and 5 are a bit too much, sending them for review
anyway in case such paranoia makes sense.

Thanks,
          Dmitry

Cc: David Ahern <dsahern@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Leonard Crestez <cdleonard@gmail.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Salam Noureddine <noureddine@arista.com>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org

[1]: https://lore.kernel.org/all/20230403213420.1576559-9-dima@arista.com/T/#u

Dmitry Safonov (5):
  net/tcp: Separate TCP-MD5 signing from tcp_v{4,6}_send_reset()
  net/tcp: Use tcp_v6_md5_hash_skb() instead of .calc_md5_hash()
  [RFC] net/tcp-md5: Verify inbound segments on twsk
  [RFC] net/tcp-md5: Don't send RST if key (dis)appeared
  [RFC] net/tcp-md5: Don't send ACK if key (dis)appears

 include/net/tcp.h   |  18 +++-
 net/ipv4/tcp.c      |   9 +-
 net/ipv4/tcp_ipv4.c | 196 +++++++++++++++++++++++++-------------------
 net/ipv6/tcp_ipv6.c | 130 +++++++++++++++++------------
 4 files changed, 207 insertions(+), 146 deletions(-)


base-commit: ba0ad6ed89fd5dada3b7b65ef2b08e95d449d4ab