From patchwork Mon Dec 4 19:00:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 13478980 X-Patchwork-Delegate: kuba@kernel.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=arista.com header.i=@arista.com header.b="LJ1MGQVl" Received: from mail-ej1-x630.google.com (mail-ej1-x630.google.com [IPv6:2a00:1450:4864:20::630]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DD1C2107 for ; Mon, 4 Dec 2023 11:00:55 -0800 (PST) Received: by mail-ej1-x630.google.com with SMTP id a640c23a62f3a-a186e5d1056so619368366b.0 for ; Mon, 04 Dec 2023 11:00:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1701716454; x=1702321254; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=haVpn9fvl3FQKPXQqTZq8l5X+Z7fEQLSNTR+x6poikY=; b=LJ1MGQVlwAtkjU4Ku120jh+vw9q8rexA2ETFL/QP+d/i8tjeMk9bzZSmMhk3Cj7RXs 1NTGAEv31a2k8mGm0RSMe6CRyA5Vh4r6U5nA665TYS2yug/w4bdqShqYTq07Te4bNbi+ yX8ZCHjOeuOClFtMCBIIF622wlbmYWqLSmv4ji4DpGR61kqaa9bVPzmkE7oqe/2VWBAT S68z299WZJvA/bTCVUbRUD2d1MdvRRvQXLfu/taF17hiQNm49fIyyEWU3v+SppxJyHqN UT+yNFlKf0gWBLTs8lXbnjID7V08/E2a6ryQDCqzdVtTfcUtHu7VTfCvCNncNRdP/NWZ 8oKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701716454; x=1702321254; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=haVpn9fvl3FQKPXQqTZq8l5X+Z7fEQLSNTR+x6poikY=; b=fObj/a5WAR398ZOr+sAve9BoBcz77fgWYYWzSwKPFubizBlHWGr2wQVZAPlpztNtfn 8zKUqpH7BEKZN7/2ScCfSQVOqem0ukgQGF9W4yK2ODdfxXYzCUYVDrph3ElIff58o3Sl /hWUNwZDwvIBs92fJgrLJ3blBaH62mBIMuaU+nCJ6whtzPdv0tNFzseYwW+Qv/nbzjUM ElcEr5yp2MYDNB7e/AeCcGs0enOMlkWDAXUiGElBQwtkxHhJJq4n+pr8vGGZgYGXf7RS aPLZb8nvcjnq1J3L4NlY7v3b0rDoRSGFxFVWJ6lSZ9WYoUshjqF77hj+N/mtcatGd7SQ mwkA== X-Gm-Message-State: AOJu0YwGFdblfVHWZb30bMORvZhBQv4vzSquP5Uf30I3cNld02yVXS22 1FT+LFujgxVnbZCZivjT+3j63w== X-Google-Smtp-Source: AGHT+IEBSRn3oKvt5apwbQOiHdDXP4js5GvWCvcA+RT5ywwGc9MIO2ZiEaQ9HWp6znRjwgNDnQys6g== X-Received: by 2002:a17:907:38f:b0:a19:a19b:55c2 with SMTP id ss15-20020a170907038f00b00a19a19b55c2mr3409428ejb.82.1701716454475; Mon, 04 Dec 2023 11:00:54 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id dx9-20020a170906a84900b009fbc655335dsm5577614ejb.27.2023.12.04.11.00.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:00:53 -0800 (PST) From: Dmitry Safonov To: David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri , Salam Noureddine , Simon Horman , netdev@vger.kernel.org, Markus Elfring , Jonathan Corbet , linux-doc@vger.kernel.org Subject: [PATCH v5 1/5] Documentation/tcp: Fix an obvious typo Date: Mon, 4 Dec 2023 19:00:40 +0000 Message-ID: <20231204190044.450107-2-dima@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231204190044.450107-1-dima@arista.com> References: <20231204190044.450107-1-dima@arista.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org Yep, my VIM spellchecker is not good enough for typos like this one. Fixes: 7fe0e38bb669 ("Documentation/tcp: Add TCP-AO documentation") Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Reported-by: Markus Elfring Closes: https://lore.kernel.org/all/2745ab4e-acac-40d4-83bf-37f2600d0c3d@web.de/ Signed-off-by: Dmitry Safonov --- Documentation/networking/tcp_ao.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Documentation/networking/tcp_ao.rst b/Documentation/networking/tcp_ao.rst index cfa5bf1cc542..8a58321acce7 100644 --- a/Documentation/networking/tcp_ao.rst +++ b/Documentation/networking/tcp_ao.rst @@ -99,7 +99,7 @@ also [6.1]:: when it is no longer considered permitted. Linux TCP-AO will try its best to prevent you from removing a key that's -being used, considering it a key management failure. But sine keeping +being used, considering it a key management failure. But since keeping an outdated key may become a security issue and as a peer may unintentionally prevent the removal of an old key by always setting it as RNextKeyID - a forced key removal mechanism is provided, where From patchwork Mon Dec 4 19:00:41 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 13478981 X-Patchwork-Delegate: kuba@kernel.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=arista.com header.i=@arista.com header.b="hmPYgw4n" Received: from mail-wm1-x32d.google.com (mail-wm1-x32d.google.com [IPv6:2a00:1450:4864:20::32d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 90B88FA for ; Mon, 4 Dec 2023 11:00:58 -0800 (PST) Received: by mail-wm1-x32d.google.com with SMTP id 5b1f17b1804b1-40c09ba723eso18214925e9.2 for ; Mon, 04 Dec 2023 11:00:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1701716457; x=1702321257; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=jdHJo0WMEGa5+mwV0AKy7FBmTBpRdeoVEnNhqPa4lAk=; b=hmPYgw4neECuep8CTszJYHorbPIMNyKvwPd8QocsrH+MQ3g4OOvnYSqKfJmZDUXvaT j5+VWjKYrNaZBgTUw8PD3KtATc6EdsNPycSzj/2S9Lzm4joCNwfXZ1G4T3/vOTMY5HMg fUKae9XK7ZTMhaDR1dQqCCm5o8IKPrwmuCDiwu+uFqRnPwSLl0BYnBlc3/cuzqke55yo aSqhg0RowDUmSqHRz2eUsCfeUt++OqJ7NbikcApQz9jMnHl/2BTBB9/JGQsg+JyqaLqO 5s4FF+CrTOm4IWJnvoDGIpBll4kjmtbfX0bfwAiXyq61kbUcNRBLQ8bjFVUhLruodPU7 OdOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701716457; x=1702321257; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=jdHJo0WMEGa5+mwV0AKy7FBmTBpRdeoVEnNhqPa4lAk=; b=uHNBZGX1o2MPNtAWLEeNR6YTHZvF22n12r+d9uOZI3aWHgTTS+UyjCtFo9wFyfsvds W835Er7534UQV6sZkoScxbWzL2mpGcXy3Mnlix3whALn8sQZshWQgT9uhUSLVArrg2Rh iXuiaylYlDTxy+8lQxXt+Z6tGUDt4B+ylTrS5n40JvncZ9ZhV2MdkXQYVFPjCVUPJc1o AaHrNjeonBF6JiI0r511yaMLYMjQNzBl/7bZ22Umn6mAUZkQxuwoMGFx1osZHiY3Ww+i Ug2C0QUj13q6XWOTVq6YGVAmOjYqMwo0Uv2Gml0n798xHYFmNcGPqf7gu3iufKX4W+O4 7YAg== X-Gm-Message-State: AOJu0Yz8ieSSx5gYmRnR8ChnFiUXef8tB+Dg7XSfHQW0YecVWcOp5Rm1 /TUIKn6sCOhjQ0Osw8dNwVRWRg== X-Google-Smtp-Source: AGHT+IEbseGRWNDQnfaHWUe+nALrTQ8Hd81yOwkJCwpCs8zLEfj5ZCf0HHEc6LozQhFjQ/OtwixBwA== X-Received: by 2002:a05:600c:289:b0:40b:5e21:bde3 with SMTP id 9-20020a05600c028900b0040b5e21bde3mr2506590wmk.114.1701716456477; Mon, 04 Dec 2023 11:00:56 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id dx9-20020a170906a84900b009fbc655335dsm5577614ejb.27.2023.12.04.11.00.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:00:55 -0800 (PST) From: Dmitry Safonov To: David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri , Salam Noureddine , Simon Horman , netdev@vger.kernel.org Subject: [PATCH v5 2/5] net/tcp: Consistently align TCP-AO option in the header Date: Mon, 4 Dec 2023 19:00:41 +0000 Message-ID: <20231204190044.450107-3-dima@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231204190044.450107-1-dima@arista.com> References: <20231204190044.450107-1-dima@arista.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org Currently functions that pre-calculate TCP header options length use unaligned TCP-AO header + MAC-length for skb reservation. And the functions that actually write TCP-AO options into skb do align the header. Nothing good can come out of this for ((maclen % 4) != 0). Provide tcp_ao_len_aligned() helper and use it everywhere for TCP header options space calculations. Fixes: 1e03d32bea8e ("net/tcp: Add TCP-AO sign to outgoing packets") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet --- include/net/tcp_ao.h | 6 ++++++ net/ipv4/tcp_ao.c | 4 ++-- net/ipv4/tcp_ipv4.c | 4 ++-- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +++--- net/ipv6/tcp_ipv6.c | 2 +- 6 files changed, 15 insertions(+), 9 deletions(-) diff --git a/include/net/tcp_ao.h b/include/net/tcp_ao.h index b56be10838f0..647781080613 100644 --- a/include/net/tcp_ao.h +++ b/include/net/tcp_ao.h @@ -62,11 +62,17 @@ static inline int tcp_ao_maclen(const struct tcp_ao_key *key) return key->maclen; } +/* Use tcp_ao_len_aligned() for TCP header calculations */ static inline int tcp_ao_len(const struct tcp_ao_key *key) { return tcp_ao_maclen(key) + sizeof(struct tcp_ao_hdr); } +static inline int tcp_ao_len_aligned(const struct tcp_ao_key *key) +{ + return round_up(tcp_ao_len(key), 4); +} + static inline unsigned int tcp_ao_digest_size(struct tcp_ao_key *key) { return key->digest_size; diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c index 7696417d0640..c8be1d526eac 100644 --- a/net/ipv4/tcp_ao.c +++ b/net/ipv4/tcp_ao.c @@ -1100,7 +1100,7 @@ void tcp_ao_connect_init(struct sock *sk) ao_info->current_key = key; if (!ao_info->rnext_key) ao_info->rnext_key = key; - tp->tcp_header_len += tcp_ao_len(key); + tp->tcp_header_len += tcp_ao_len_aligned(key); ao_info->lisn = htonl(tp->write_seq); ao_info->snd_sne = 0; @@ -1346,7 +1346,7 @@ static int tcp_ao_parse_crypto(struct tcp_ao_add *cmd, struct tcp_ao_key *key) syn_tcp_option_space -= TCPOLEN_MSS_ALIGNED; syn_tcp_option_space -= TCPOLEN_TSTAMP_ALIGNED; syn_tcp_option_space -= TCPOLEN_WSCALE_ALIGNED; - if (tcp_ao_len(key) > syn_tcp_option_space) { + if (tcp_ao_len_aligned(key) > syn_tcp_option_space) { err = -EMSGSIZE; goto err_kfree; } diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 5f693bbd578d..0c50c5a32b84 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -690,7 +690,7 @@ static bool tcp_v4_ao_sign_reset(const struct sock *sk, struct sk_buff *skb, reply_options[0] = htonl((TCPOPT_AO << 24) | (tcp_ao_len(key) << 16) | (aoh->rnext_keyid << 8) | keyid); - arg->iov[0].iov_len += round_up(tcp_ao_len(key), 4); + arg->iov[0].iov_len += tcp_ao_len_aligned(key); reply->doff = arg->iov[0].iov_len / 4; if (tcp_ao_hash_hdr(AF_INET, (char *)&reply_options[1], @@ -978,7 +978,7 @@ static void tcp_v4_send_ack(const struct sock *sk, (tcp_ao_len(key->ao_key) << 16) | (key->ao_key->sndid << 8) | key->rcv_next); - arg.iov[0].iov_len += round_up(tcp_ao_len(key->ao_key), 4); + arg.iov[0].iov_len += tcp_ao_len_aligned(key->ao_key); rep.th.doff = arg.iov[0].iov_len / 4; tcp_ao_hash_hdr(AF_INET, (char *)&rep.opt[offset], diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index a9807eeb311c..9e85f2a0bddd 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -615,7 +615,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, ao_key = treq->af_specific->ao_lookup(sk, req, tcp_rsk(req)->ao_keyid, -1); if (ao_key) - newtp->tcp_header_len += tcp_ao_len(ao_key); + newtp->tcp_header_len += tcp_ao_len_aligned(ao_key); #endif if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len) newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len; diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index eb13a55d660c..93eef1dbbc55 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -825,7 +825,7 @@ static unsigned int tcp_syn_options(struct sock *sk, struct sk_buff *skb, timestamps = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_timestamps); if (tcp_key_is_ao(key)) { opts->options |= OPTION_AO; - remaining -= tcp_ao_len(key->ao_key); + remaining -= tcp_ao_len_aligned(key->ao_key); } } @@ -915,7 +915,7 @@ static unsigned int tcp_synack_options(const struct sock *sk, ireq->tstamp_ok &= !ireq->sack_ok; } else if (tcp_key_is_ao(key)) { opts->options |= OPTION_AO; - remaining -= tcp_ao_len(key->ao_key); + remaining -= tcp_ao_len_aligned(key->ao_key); ireq->tstamp_ok &= !ireq->sack_ok; } @@ -982,7 +982,7 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb size += TCPOLEN_MD5SIG_ALIGNED; } else if (tcp_key_is_ao(key)) { opts->options |= OPTION_AO; - size += tcp_ao_len(key->ao_key); + size += tcp_ao_len_aligned(key->ao_key); } if (likely(tp->rx_opt.tstamp_ok)) { diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 937a02c2e534..8c6623496dd7 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -881,7 +881,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 if (tcp_key_is_md5(key)) tot_len += TCPOLEN_MD5SIG_ALIGNED; if (tcp_key_is_ao(key)) - tot_len += tcp_ao_len(key->ao_key); + tot_len += tcp_ao_len_aligned(key->ao_key); #ifdef CONFIG_MPTCP if (rst && !tcp_key_is_md5(key)) { From patchwork Mon Dec 4 19:00:42 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 13478982 X-Patchwork-Delegate: kuba@kernel.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=arista.com header.i=@arista.com header.b="AAGtKnHI" Received: from mail-lj1-x22d.google.com (mail-lj1-x22d.google.com [IPv6:2a00:1450:4864:20::22d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 75325D7 for ; Mon, 4 Dec 2023 11:01:00 -0800 (PST) Received: by mail-lj1-x22d.google.com with SMTP id 38308e7fff4ca-2ca02def690so17821001fa.3 for ; Mon, 04 Dec 2023 11:01:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1701716459; x=1702321259; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=oUFbq/Bpf84kUYD5hi1tJcGjiTvsxTjhBSB3X6vJDoM=; b=AAGtKnHIFh72wPQbOIY29uXyHJKgf4BQhzDqtqRbdd5+LznKICxfH953R4lWksMKnc cWhIbGFjW9dmTGePThvhjeL5kbnsLWn/sOLXHa3TUuaU8IrzDqI7bz4DJ59mLub5zQFC YnTs1iMZEOCfVqMfE13kaPd4P1Rv29reYtJuFBZQDVvXhSN27oe5yl1QKiB3TH5zDO1d SXCuXMjaZV+vTYn99tq4PZZBNkYmp8q94eB+G5ZG6yao7XX3pu+cZz7tbZj+QvalKupu 21/VVd4Z/LAMdQZvEUTBkdQQWXQjrjzA76SdNQJ4kmVke6Sf/+k82//IPUugveLku76Y 968g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701716459; x=1702321259; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=oUFbq/Bpf84kUYD5hi1tJcGjiTvsxTjhBSB3X6vJDoM=; b=qRu7TO8+bcll8qybaRsLr0cAUYe+wN8Xea28LSrVJoXATmHUSI+4SblYoIfjZRUX+g vvmyTHPPNwvP/mlouKaBG2dk6W3ubx1ODxr9rOmaJyzdLMo5OOiJlI80+OtUQ+41+yWF 9EkAb7d6KEDVMXaR0Vw1IyU2jMh336Rg2LiNVYRxcr7ulchtqT2PA/o+XMOCOD/28qwr IQ24++Dtr/seHbgMX5nUJDqrE3s6Ar/RppnVlLsSf653DEfKVsIYnNPB4wriQQ4Kckm2 6KevgFhPvGDKAKSQIEjTw4F8g9PMdjnihn5ta3FIY8tI0VcDGPBoXlt7tBkMSW1glErt SpRA== X-Gm-Message-State: AOJu0Yy8D+90pIbgpUY1+BirNsmWyir2McQqupDw2us6H7ITVbSKjIU4 OSK3+w+SvRcnR3JT+vADZaI5Pw== X-Google-Smtp-Source: AGHT+IHYuOp6qqMq4tE1HhzSjBMzbnrKfodkZP1F+YHS+F6QHGdAXtt1lesJrgvunHJzsUHFUkmhAw== X-Received: by 2002:a2e:b348:0:b0:2c9:f727:7e65 with SMTP id q8-20020a2eb348000000b002c9f7277e65mr1332068lja.38.1701716458691; Mon, 04 Dec 2023 11:00:58 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id dx9-20020a170906a84900b009fbc655335dsm5577614ejb.27.2023.12.04.11.00.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:00:57 -0800 (PST) From: Dmitry Safonov To: David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri , Salam Noureddine , Simon Horman , netdev@vger.kernel.org Subject: [PATCH v5 3/5] net/tcp: Limit TCP_AO_REPAIR to non-listen sockets Date: Mon, 4 Dec 2023 19:00:42 +0000 Message-ID: <20231204190044.450107-4-dima@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231204190044.450107-1-dima@arista.com> References: <20231204190044.450107-1-dima@arista.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org Listen socket is not an established TCP connection, so setsockopt(TCP_AO_REPAIR) doesn't have any impact. Restrict this uAPI for listen sockets. Fixes: faadfaba5e01 ("net/tcp: Add TCP_AO_REPAIR") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet --- net/ipv4/tcp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 53bcc17c91e4..b1fe4eb01829 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3594,6 +3594,10 @@ int do_tcp_setsockopt(struct sock *sk, int level, int optname, break; case TCP_AO_REPAIR: + if (!tcp_can_repair_sock(sk)) { + err = -EPERM; + break; + } err = tcp_ao_set_repair(sk, optval, optlen); break; #ifdef CONFIG_TCP_AO @@ -4293,6 +4297,8 @@ int do_tcp_getsockopt(struct sock *sk, int level, } #endif case TCP_AO_REPAIR: + if (!tcp_can_repair_sock(sk)) + return -EPERM; return tcp_ao_get_repair(sk, optval, optlen); case TCP_AO_GET_KEYS: case TCP_AO_INFO: { From patchwork Mon Dec 4 19:00:43 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 13478983 X-Patchwork-Delegate: kuba@kernel.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=arista.com header.i=@arista.com header.b="g+XrIukv" Received: from mail-ej1-x634.google.com (mail-ej1-x634.google.com [IPv6:2a00:1450:4864:20::634]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7C4F3FA for ; Mon, 4 Dec 2023 11:01:02 -0800 (PST) Received: by mail-ej1-x634.google.com with SMTP id a640c23a62f3a-9fa45e75ed9so658099166b.1 for ; Mon, 04 Dec 2023 11:01:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1701716461; x=1702321261; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NZ0D/wyA9hkFzwdAxUoMggZbpJ8bxr4KljB1d44II90=; b=g+XrIukvP0kRCHm1wfbmqM8r0VQVu6xuEBcmVoF30BWysxs/NXepuTJ4VWFsM5KQbG whlC6LZMhvoNdi2k3CacicYWvF0WUQxWAIC0bKC1ThkjIkeq+qaoRWiawNzIXXByV8QX cXhk+nztqP6KPLMBU0az8sMelaisZxb5TSwVgc1k4UbXTjv8sSrU/rvzJMrnissiIncD nHphrmgqi1tLeymm7x5onw2Y6e6OTmcCsX9Ed/7+09cThzsWgEkjmqOnGhtG/aCo5408 vsM0MbgPm7NKUEgvS/KRWxQMosh2lJNaQ87NpG/sRFbNqzZF9bcYouMjCgBFgv4Y0K5F NXWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701716461; x=1702321261; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=NZ0D/wyA9hkFzwdAxUoMggZbpJ8bxr4KljB1d44II90=; b=JQMzzE7I8UiP8xh/RJ7Y42Zn3XJFlNNMtaeS8SHA+LmbVZ1aRPKjVVDKpsSuKbc08W 8kOWnbTzeYce9uMs9h5Bbb1xFRx3doGDh+9s4xK/zHhK3Ss3ueoBaQp8+7gnNBB/g4on MdzYBwqy8C9K/o9MxL6a1QX4nmPF6RD4Qb/jHTLqMegJwFTrlGxhP7fC5pUXaBFlT/om 0hyVBP13lDgAfFWXol5l3jwW1ryPFLqxA8/d8We5v5za1aM0VOUda7YUIculxLTyxNgq /IJ8IpZErIognuPoiDBEAhl4fbc+5eMEGcQ0MC+S+W56xL8JyvO60iNgVWWIDNfwNJ6t TNvw== X-Gm-Message-State: AOJu0YwtJeiSo77DEc9pfwPZdnfS/Ul/+Zda0f3tAZzmv5sNOKUSmPXq ZSHH+QrJgz2y9OOMOAqYf1xrsg== X-Google-Smtp-Source: AGHT+IEc7vGGV71ZVxCXlwrJR73WOT9vS/GY8jEInO10aGkvo+/egFEHgnMpiVqeaedADYMg7gZqdg== X-Received: by 2002:a17:906:220f:b0:a00:2686:6b42 with SMTP id s15-20020a170906220f00b00a0026866b42mr2988048ejs.10.1701716460982; Mon, 04 Dec 2023 11:01:00 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id dx9-20020a170906a84900b009fbc655335dsm5577614ejb.27.2023.12.04.11.00.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:00:59 -0800 (PST) From: Dmitry Safonov To: David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri , Salam Noureddine , Simon Horman , netdev@vger.kernel.org Subject: [PATCH v5 4/5] net/tcp: Don't add key with non-matching VRF on connected sockets Date: Mon, 4 Dec 2023 19:00:43 +0000 Message-ID: <20231204190044.450107-5-dima@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231204190044.450107-1-dima@arista.com> References: <20231204190044.450107-1-dima@arista.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org If the connection was established, don't allow adding TCP-AO keys that don't match the peer. Currently, there are checks for ip-address matching, but L3 index check is missing. Add it to restrict userspace shooting itself somewhere. Yet, nothing restricts the CAP_NET_RAW user from trying to shoot themselves by performing setsockopt(SO_BINDTODEVICE) or setsockopt(SO_BINDTOIFINDEX) over an established TCP-AO connection. So, this is just "minimum effort" to potentially save someone's debugging time, rather than a full restriction on doing weird things. Fixes: 248411b8cb89 ("net/tcp: Wire up l3index to TCP-AO") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet --- net/ipv4/tcp_ao.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c index c8be1d526eac..18dacfef7a07 100644 --- a/net/ipv4/tcp_ao.c +++ b/net/ipv4/tcp_ao.c @@ -1608,6 +1608,15 @@ static int tcp_ao_add_cmd(struct sock *sk, unsigned short int family, if (!dev || !l3index) return -EINVAL; + if (!bound_dev_if || bound_dev_if != cmd.ifindex) { + /* tcp_ao_established_key() doesn't expect having + * non peer-matching key on an established TCP-AO + * connection. + */ + if (!((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))) + return -EINVAL; + } + /* It's still possible to bind after adding keys or even * re-bind to a different dev (with CAP_NET_RAW). * So, no reason to return error here, rather try to be From patchwork Mon Dec 4 19:00:44 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 13478984 X-Patchwork-Delegate: kuba@kernel.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=arista.com header.i=@arista.com header.b="EmOPx5fU" Received: from mail-ej1-x62b.google.com (mail-ej1-x62b.google.com [IPv6:2a00:1450:4864:20::62b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 113D510F for ; Mon, 4 Dec 2023 11:01:04 -0800 (PST) Received: by mail-ej1-x62b.google.com with SMTP id a640c23a62f3a-a1a58fbe5e1so307790566b.2 for ; Mon, 04 Dec 2023 11:01:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1701716462; x=1702321262; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=6mT3D/Z66Vs1yufZpC/lcvNBlunBHyn7u3P08XO8P98=; b=EmOPx5fUQS4vptuJKQv8y9P5AmrPe3uprHbrugnbt5tCSmJcIZD8HNcKdlkso0hDK3 cR0tBMELizu0ZftuhBi2CwFFTIjRwMUY0WmbncBO7q6EkZRwqi7y7nsTi1yL+XGsnHoL gMrMcHcz3EoA1bdmHJlbT1IlXOQ0jqWwgMmB0uZh+E/botNKA42N7/4Xvcrq+KEK0v+T 8jP3PPU/M1UdR0WMnm64STXF6YV6YCq4hqQPnY9kHw0UgyHV7ZqGpkmETyFKx4866QAm cIDgnBSl9gyORzFd31TszUZFwkyo/KPWCNdSUjqZKOQVaUMANtJPnv9yPUc6CDS7u+CB sMTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701716462; x=1702321262; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=6mT3D/Z66Vs1yufZpC/lcvNBlunBHyn7u3P08XO8P98=; b=h+O2tq/KvmX1oJ+xuzA3USm4LFhW2Xd/wZpc+6V7EYng7D2gxZwQE4F2rYIElfQRyt HYKsHODgzXaKPL8oImJdN1QyeD12bYQ37fjbdfxSeTYItl3smrCUoHK/iCS/tCnL7R0b o48KkcozTEOk8dnhm+vRqQjqQvNfkktPkyJ1+3UnL2Vf0lNyq+iSDp+oLn07vGC2hRvj /d1upVHRvej5B4JAS/9YW2c2pZULI6V2YOU5KS42yKRfZUbRb8PwKq3vMDxEU/wcFMks E+0aRep0jLmKmAilcxjn5XOn9fW913owSDM6h57c6ep5nU9vWgn0yAqrAJ6NUFe+GutZ SESQ== X-Gm-Message-State: AOJu0Yy81kfJhhq383loNtrTiCbvTaVRiqErk3F7UlG/ZedRTl/4FI4b vJktttgP77HQBcxnwhyfVgIEK5haRvpIQxCA+7M= X-Google-Smtp-Source: AGHT+IHzDnqU6wmCDoMJN/sPJhXVQgMW2J767VgFxk/VZIoIU67UKrP6sZu8a6h2FPdtEQTZ9jClUg== X-Received: by 2002:a17:906:6c91:b0:a0f:44c6:8eb5 with SMTP id s17-20020a1709066c9100b00a0f44c68eb5mr2889368ejr.22.1701716462629; Mon, 04 Dec 2023 11:01:02 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id dx9-20020a170906a84900b009fbc655335dsm5577614ejb.27.2023.12.04.11.01.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:01:01 -0800 (PST) From: Dmitry Safonov To: David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri , Salam Noureddine , Simon Horman , netdev@vger.kernel.org Subject: [PATCH v5 5/5] net/tcp: Don't store TCP-AO maclen on reqsk Date: Mon, 4 Dec 2023 19:00:44 +0000 Message-ID: <20231204190044.450107-6-dima@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231204190044.450107-1-dima@arista.com> References: <20231204190044.450107-1-dima@arista.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org This extra check doesn't work for a handshake when SYN segment has (current_key.maclen != rnext_key.maclen). It could be amended to preserve rnext_key.maclen instead of current_key.maclen, but that requires a lookup on listen socket. Originally, this extra maclen check was introduced just because it was cheap. Drop it and convert tcp_request_sock::maclen into boolean tcp_request_sock::used_tcp_ao. Fixes: 06b22ef29591 ("net/tcp: Wire TCP-AO to request sockets") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet --- include/linux/tcp.h | 8 ++------ net/ipv4/tcp_ao.c | 4 ++-- net/ipv4/tcp_input.c | 5 +++-- net/ipv4/tcp_output.c | 9 +++------ 4 files changed, 10 insertions(+), 16 deletions(-) diff --git a/include/linux/tcp.h b/include/linux/tcp.h index 68f3d315d2e1..b646b574b060 100644 --- a/include/linux/tcp.h +++ b/include/linux/tcp.h @@ -169,7 +169,7 @@ struct tcp_request_sock { #ifdef CONFIG_TCP_AO u8 ao_keyid; u8 ao_rcv_next; - u8 maclen; + bool used_tcp_ao; #endif }; @@ -180,14 +180,10 @@ static inline struct tcp_request_sock *tcp_rsk(const struct request_sock *req) static inline bool tcp_rsk_used_ao(const struct request_sock *req) { - /* The real length of MAC is saved in the request socket, - * signing anything with zero-length makes no sense, so here is - * a little hack.. - */ #ifndef CONFIG_TCP_AO return false; #else - return tcp_rsk(req)->maclen != 0; + return tcp_rsk(req)->used_tcp_ao; #endif } diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c index 18dacfef7a07..f8308d3f565e 100644 --- a/net/ipv4/tcp_ao.c +++ b/net/ipv4/tcp_ao.c @@ -851,7 +851,7 @@ void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, const struct tcp_ao_hdr *aoh; struct tcp_ao_key *key; - treq->maclen = 0; + treq->used_tcp_ao = false; if (tcp_parse_auth_options(th, NULL, &aoh) || !aoh) return; @@ -863,7 +863,7 @@ void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, treq->ao_rcv_next = aoh->keyid; treq->ao_keyid = aoh->rnext_keyid; - treq->maclen = tcp_ao_maclen(key); + treq->used_tcp_ao = true; } static enum skb_drop_reason diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index bcb55d98004c..337c8bb07ccc 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -7182,11 +7182,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh)) goto drop_and_release; /* Invalid TCP options */ if (aoh) { - tcp_rsk(req)->maclen = aoh->length - sizeof(struct tcp_ao_hdr); + tcp_rsk(req)->used_tcp_ao = true; tcp_rsk(req)->ao_rcv_next = aoh->keyid; tcp_rsk(req)->ao_keyid = aoh->rnext_keyid; + } else { - tcp_rsk(req)->maclen = 0; + tcp_rsk(req)->used_tcp_ao = false; } #endif tcp_rsk(req)->snt_isn = isn; diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 93eef1dbbc55..f5ef15e1d9ac 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -3720,7 +3720,6 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, if (tcp_rsk_used_ao(req)) { #ifdef CONFIG_TCP_AO struct tcp_ao_key *ao_key = NULL; - u8 maclen = tcp_rsk(req)->maclen; u8 keyid = tcp_rsk(req)->ao_keyid; ao_key = tcp_sk(sk)->af_specific->ao_lookup(sk, req_to_sk(req), @@ -3730,13 +3729,11 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, * for another peer-matching key, but the peer has requested * ao_keyid (RFC5925 RNextKeyID), so let's keep it simple here. */ - if (unlikely(!ao_key || tcp_ao_maclen(ao_key) != maclen)) { - u8 key_maclen = ao_key ? tcp_ao_maclen(ao_key) : 0; - + if (unlikely(!ao_key)) { rcu_read_unlock(); kfree_skb(skb); - net_warn_ratelimited("TCP-AO: the keyid %u with maclen %u|%u from SYN packet is not present - not sending SYNACK\n", - keyid, maclen, key_maclen); + net_warn_ratelimited("TCP-AO: the keyid %u from SYN packet is not present - not sending SYNACK\n", + keyid); return NULL; } key.ao_key = ao_key;