From patchwork Tue May 9 22:16:07 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 91774 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp3212422vqo; Tue, 9 May 2023 15:33:28 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4YXymL5O76dBx8ukut5/HO3rIQ+8G9LFxmAoWZPh9CadeNNn4uOPXUT61lNdk6bEc1feFL X-Received: by 2002:a17:90a:db4d:b0:250:8258:1a5 with SMTP id u13-20020a17090adb4d00b00250825801a5mr9462071pjx.33.1683671608312; Tue, 09 May 2023 15:33:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683671608; cv=none; d=google.com; s=arc-20160816; b=NTAe5QyW/ChXnw9nq60RDF+O/VPpzA/3H3w4onpRSRMoRVomY/ri435WhmY/4klDL3 TBYQEsXGMJ7vP/nC3xAcAKSdKAI3KGthLVnSHZ+GT0ugsF9a1fASyvXUzcogPF+TPlDd 9xBUVL2rfNR78UYvKInPZRyXCpMvzfM/xwUNr1+Wl/xvkbODa6H+S30/aiRjJAQtrxgi KsiGIOidU2gkItvby0EGZM1eiZPnQL9BZzsKa/k/MJFNdnXbHdIb33DqV5hANgNmy+G1 NVK3UNiw+rk+a6TXshynnzYH9QKdCZKANYkpWN0hnkYXsTKIAsrDUShUzxCbYIQRl/nl xMRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=a/2L5rqcnCY6pJiEs4sYnqk/1S9TSMsv5FXuRy9b2gE=; b=LSFqXuR05YInjZSc6P8oFXjG3JwwN9XrIKWVMuFX660IrBG+mcwJvRrxtks0I7vqqW wUzZLPpAwrn3NgVuZ16GaFipOP2hxxS1qr2R1WrE4C5J24o8idwcN7QM2uRpi5rBZl5u jBlB138Hpg1IC+TZgeIDGI01HX0v2ypHWp8wXX6Hd4nggSr3Xh1w3C+KOeXxcDdNLbb2 ubvc3a7tFepyenwhI2pcza2halZHb66VxkKUAP086QZTN51FAF2QZlvISqhPD2cD3XJP 0av8LbyyN43MKKS1KwGvx/VohhF2Aaw2ntpG+Ri2PtFDEVme03nUKmgeBDMYQ3n3GurP tX0w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=beOko3by; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id oa4-20020a17090b1bc400b002496cedea8esi202939pjb.24.2023.05.09.15.33.15; Tue, 09 May 2023 15:33:28 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=beOko3by; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235558AbjEIWQe (ORCPT + 99 others); Tue, 9 May 2023 18:16:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53690 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235195AbjEIWQW (ORCPT ); Tue, 9 May 2023 18:16:22 -0400 Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 902DC3C0C for ; Tue, 9 May 2023 15:16:21 -0700 (PDT) Received: by mail-wm1-x32b.google.com with SMTP id 5b1f17b1804b1-3f41d087b24so26668985e9.1 for ; Tue, 09 May 2023 15:16:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1683670580; x=1686262580; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=a/2L5rqcnCY6pJiEs4sYnqk/1S9TSMsv5FXuRy9b2gE=; b=beOko3byXbdOnNTmosIZ66QrQuc7sGYZ1Hb4jRKE0TRj+CwIdJ1NsLQPcPJY2tA3yd iZtEbrPF2PiOhDJ+SGX8Q/eMIFsJW4MpBdKyifrhpNZn40mbfMUqKRdfKKYpCXPlNcGB IuEkSj9NRDVLKmrBC4j3z0xCegPt/y3Lmkr/oXFQvIdwygSyEdR4M4CR5Kjm5A93rqKy F5EDPsDFYgKUwVOa7e/CSxma6pFk3rPUXgLeMMblSqHBC6CYMzgwM9qU406EYwk6X8LC FV6Mksp9h48SK4X1mBgzZo2XFPDz3Fnb4NLdsKzN0f9c9cRHFuPHzWF9Sed2w2vrZBTC yopQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683670580; x=1686262580; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=a/2L5rqcnCY6pJiEs4sYnqk/1S9TSMsv5FXuRy9b2gE=; b=bt7MOl+8pYUUHngf8zThJq6Y03wZJzAfzgKRTZpt0hjE/P8nseIuhFTAGVi9LClcBS ao+kKnV+WDCnsUqYbJO3U5UZPSjYVJlPqOty4FICxB2s1YJOluTsidc6QoXROXj6lcRi M+7uKXxxlDRAfxW+4D85+4kNvmTtVqzgNomvLd/KGZAbEJPzngt2H6qNKwBBwOot4IsX gKT9IkWgw2hGVUbwYqHSgDLRyH4N72624Z5d0S8QhZ9xqP1D3f431od/lbBPaq66V7cO KLCXHUMjZ/BbajqwZBLSFbIamENHlDwgbfANKrNDY4RHMkJLwPlYn0V30vyVPIqe48kx HvIg== X-Gm-Message-State: AC+VfDzOarUduXVriDtO0Tq/ecVLNqnPrz0mqX9JKO+ddW4QlGjcWxpC sMLYD211gCDi3vGs9k4+l+4fglKKwUQNUhmotZM= X-Received: by 2002:a1c:f711:0:b0:3ee:775:c573 with SMTP id v17-20020a1cf711000000b003ee0775c573mr10201854wmh.20.1683670579827; Tue, 09 May 2023 15:16:19 -0700 (PDT) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id t25-20020a7bc3d9000000b003f42d3111b8sm2052888wmj.30.2023.05.09.15.16.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 May 2023 15:16:19 -0700 (PDT) From: Dmitry Safonov To: linux-kernel@vger.kernel.org, David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Hideaki YOSHIFUJI , Leonard Crestez , Salam Noureddine , netdev@vger.kernel.org Subject: [RFC 4/5] net/tcp-md5: Don't send RST if key (dis)appeared Date: Tue, 9 May 2023 23:16:07 +0100 Message-Id: <20230509221608.2569333-5-dima@arista.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230509221608.2569333-1-dima@arista.com> References: <20230509221608.2569333-1-dima@arista.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765457639943787788?= X-GMAIL-MSGID: =?utf-8?q?1765457639943787788?= Seems cheap at this place as both key and hash_location were looked up until now. Signed-off-by: Dmitry Safonov --- net/ipv4/tcp_ipv4.c | 10 ++++++++++ net/ipv6/tcp_ipv6.c | 8 ++++++++ 2 files changed, 18 insertions(+) diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index f5b870943dcb..d94cd5e70d58 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -686,6 +686,16 @@ static bool tcp_v4_md5_sign_reset(struct net *net, const struct sock *sk, l3index = tcp_v4_sdif(skb) ? inet_iif(skb) : 0; addr = (union tcp_md5_addr *)&ip_hdr(skb)->saddr; key = tcp_md5_do_lookup(sk, l3index, addr, AF_INET); + /* This segment should have been already verified by + * tcp_inbound_md5_hash(). But that might raced with userspace + * adding or deleting keys. So, follow the logic of + * tcp_inbound_md5_hash() and avoid replying with TCP-MD5 sign + * on non-signed segments and vice-versa. + */ + if (unlikely(!!key != !!hash_location)) { + rcu_read_unlock(); + return true; + } } else if (hash_location) { const union tcp_md5_addr *addr; int sdif = tcp_v4_sdif(skb); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 3756a43367a3..498dfa194b8b 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -993,6 +993,14 @@ static int tcp_v6_md5_lookup_reset_key(struct net *net, const struct sock *sk, */ l3index = tcp_v6_sdif(skb) ? tcp_v6_iif_l3_slave(skb) : 0; *key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr, l3index); + /* This segment should have been already verified by + * tcp_inbound_md5_hash(). But that might raced with userspace + * adding or deleting keys. So, follow the logic of + * tcp_inbound_md5_hash() and avoid replying with TCP-MD5 sign + * on non-signed segments and vice-versa. + */ + if (unlikely(!!*key != !!hash_location)) + return -ENOKEY; } else if (hash_location) { int dif = tcp_v6_iif_l3_slave(skb); int sdif = tcp_v6_sdif(skb);