Message ID | 20231121020111.1143180-6-dima@arista.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:2b07:b0:403:3b70:6f57 with SMTP id io7csp346567vqb; Mon, 20 Nov 2023 18:04:09 -0800 (PST) X-Google-Smtp-Source: AGHT+IHKXwgPWIDE614i51prrSx1IUOE1qEd3u03xYo+CTKJJIBPwvDnjggqNdETydobPViPq5uy X-Received: by 2002:a05:6a20:2d1e:b0:187:a119:909d with SMTP id g30-20020a056a202d1e00b00187a119909dmr7203466pzl.13.1700532249047; Mon, 20 Nov 2023 18:04:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1700532249; cv=none; d=google.com; s=arc-20160816; b=Ax956eWlsFL97F4o8FN2oWgBGTctJ/9YM+0ND/9yV2vbLfHBKbwvDRkqwsxz7VCi6d egZ6wbMxcrNUcDzIDBHoEb/WIU17aapkTi456JAgD3Mr1+CsX+GN/kv/UsldRmNcxbmp 6b88lEiIgvfLWIKMIoYrSfj9Khyk0vbTEaMT6TQ9yrjWJnLQFxKhqQ9K7G0eRweAUEX5 IM3CYu9dFS9mmajwJy4cMFKQQ+B84nzxOpw3JXRLneAnI6u9he8KqPiZp7KDH6vztW8P N/iyNtBfUgW5t0NXOYHI1Bv9uuOmfI24GXBAV189QvRDZN+hu6n8p1TgqIWeax4uSjVb 4/CA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=vRv390KZg85B3wbZ2TCp60L17ZYyL9mQWzXIk/oqbtw=; fh=Yk/Quc8tqIb7VaGeTLaGy5uds5Cbik8MTMk6yfuC1TU=; b=P0oUQfrafLf5V8qKTSgEUR46b6OBMoYFlKChiQLvs9Ftz+JXxKz1XHggfbijYRBqy5 cuYg8I9EpF13uV6DRWbi8LQUP4c0qDnwOdlDCpUEDYlsdIDXLXXCiL+jE5Qq35fo9sxB XxLjUrn7gFNEeir2oo/t8Ag/ulxMz7pDzoBTf6lejx3yC85NY1fw0DhfEhhMKkeojYeG 9B+j8rjD7wUEbpkr1GOH4xa0xC+GZ5JQmIIAvX0FEx8qkwksiJ8WXMLDZZ1A8LuWGJFD VMa5oZ6RbqtlipDtrFf5Xakc6Sq5TIRsMs11ueYdAlrRAvP+ju1IVrk+70u67b3uG7Lp cogA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=dm8J7qBS; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from snail.vger.email (snail.vger.email. [23.128.96.37]) by mx.google.com with ESMTPS id ca10-20020a17090af30a00b002839749088dsi9140274pjb.40.2023.11.20.18.04.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Nov 2023 18:04:09 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) client-ip=23.128.96.37; Authentication-Results: mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=dm8J7qBS; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id 00715801E860; Mon, 20 Nov 2023 18:01:53 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233187AbjKUCBq (ORCPT <rfc822;heyuhang3455@gmail.com> + 27 others); Mon, 20 Nov 2023 21:01:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40502 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233101AbjKUCBb (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Mon, 20 Nov 2023 21:01:31 -0500 Received: from mail-wr1-x436.google.com (mail-wr1-x436.google.com [IPv6:2a00:1450:4864:20::436]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 48F01D8 for <linux-kernel@vger.kernel.org>; Mon, 20 Nov 2023 18:01:27 -0800 (PST) Received: by mail-wr1-x436.google.com with SMTP id ffacd0b85a97d-3316bb1303bso2239622f8f.0 for <linux-kernel@vger.kernel.org>; Mon, 20 Nov 2023 18:01:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1700532085; x=1701136885; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=vRv390KZg85B3wbZ2TCp60L17ZYyL9mQWzXIk/oqbtw=; b=dm8J7qBSgjKUheRrTjDGEdwDRR/0fWw05/DnqQugslvUNkacXpJtXUS0IT8iJGb1Mw 1NSHzihLf9h6y3oKNygxigaS+wqy+P7IfFZ5kQX25qvz+AiAkYNd3IvEXpoGpoh5koW3 Q/rrR9Ewb+2LZXEW5MeTh29mNYU2aKzou37pHVDBhKXUUZMNb6djJT+7abDGihCC1fep 2637JzWf+8cf+ob/GQlJoNi+XY5C3jbXXFE6/S8hMYBWjCqMYmw1DkfWTi5lOaQWNR/Y XDYY0OozDJO4W2axIBtzrn7D/aDzbSV5U4bzk+VYWrYcijdJ3ePqxtW4oPRm/BoWBMyP uocg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700532085; x=1701136885; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=vRv390KZg85B3wbZ2TCp60L17ZYyL9mQWzXIk/oqbtw=; b=dbn1DiTPe+BUDZNxI6d/HUVVTVbH02lizeipnWcoUTDKhOB2Hxe7T3rm8T2Ctozo1m rY7f7eKthu6KwXwF9Mzt9ETiV0l+JBNsK5MMo+ctC5i6i7QrRzKJfteu/0MAo731BW7k 5l/JpliKCLvWaJ9wEFldcKNaLztGkBJ9aBcX7KtLSqf4P+5+5UYI7MqFf+MOSapGB3jM FyAAEiMTA6cebRVbigsIYSdX9jNG8GTVbcNWK3qm2Nsn3+GRv++vxV5pcayhPIcV+A7T arpWYlYSUMdR7YH0JoBaFmsnwh7axYnvviNHyTda6RlfaHu2FuLORjJxUU1n1O28TmSm G6iA== X-Gm-Message-State: AOJu0Yzwj+/47wcJaKhruPtSRYZg8z0lT7bjwagKmFSaHquW/GwV5Iy4 MbGNkwQeApNUboBnghvn63TH9Q== X-Received: by 2002:a05:6000:1147:b0:32d:a476:5285 with SMTP id d7-20020a056000114700b0032da4765285mr6146461wrx.31.1700532085689; Mon, 20 Nov 2023 18:01:25 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id c13-20020a056000184d00b00332cb846f21sm2617105wri.27.2023.11.20.18.01.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Nov 2023 18:01:25 -0800 (PST) From: Dmitry Safonov <dima@arista.com> To: David Ahern <dsahern@kernel.org>, Eric Dumazet <edumazet@google.com>, Paolo Abeni <pabeni@redhat.com>, Jakub Kicinski <kuba@kernel.org>, "David S. Miller" <davem@davemloft.net> Cc: linux-kernel@vger.kernel.org, Dmitry Safonov <dima@arista.com>, Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri <fruggeri05@gmail.com>, Salam Noureddine <noureddine@arista.com>, Simon Horman <horms@kernel.org>, netdev@vger.kernel.org Subject: [PATCH 5/7] net/tcp: Don't add key with non-matching VRF on connected sockets Date: Tue, 21 Nov 2023 02:01:09 +0000 Message-ID: <20231121020111.1143180-6-dima@arista.com> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20231121020111.1143180-1-dima@arista.com> References: <20231121020111.1143180-1-dima@arista.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Mon, 20 Nov 2023 18:01:54 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1783137303388955511 X-GMAIL-MSGID: 1783137303388955511 |
Series |
[1/7] Documentation/tcp: Fix an obvious typo
|
|
Commit Message
Dmitry Safonov
Nov. 21, 2023, 2:01 a.m. UTC
If the connection was established, don't allow adding TCP-AO keys that
don't match the peer. Currently, there are checks for ip-address
matching, but L3 index check is missing. Add it to restrict userspace
shooting itself somewhere.
Fixes: 248411b8cb89 ("net/tcp: Wire up l3index to TCP-AO")
Signed-off-by: Dmitry Safonov <dima@arista.com>
---
net/ipv4/tcp_ao.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c index 71c8c9c59642..122ff58168ee 100644 --- a/net/ipv4/tcp_ao.c +++ b/net/ipv4/tcp_ao.c @@ -1622,6 +1622,9 @@ static int tcp_ao_add_cmd(struct sock *sk, unsigned short int family, if (!dev || !l3index) return -EINVAL; + if (!((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))) + return -EINVAL; + /* It's still possible to bind after adding keys or even * re-bind to a different dev (with CAP_NET_RAW). * So, no reason to return error here, rather try to be