From patchwork Mon Dec 4 19:00:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 173532 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp2970868vqy; Mon, 4 Dec 2023 11:01:11 -0800 (PST) X-Google-Smtp-Source: AGHT+IG8NcfXlm0EgxiSI7SB6/JGLe8tnL7faFQgaxOxMW4pxIPMA/XAhbKHm0mRpr0TR8dc7SCw X-Received: by 2002:a17:90a:e387:b0:286:6cc0:cac1 with SMTP id b7-20020a17090ae38700b002866cc0cac1mr19896pjz.56.1701716471263; Mon, 04 Dec 2023 11:01:11 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1701716471; cv=none; d=google.com; s=arc-20160816; b=MTg1TmV30JmUla7YDzgSyBWATLatNsN32u/W8oZjnxIbkXkIkE26apN0PpG4/O1/St AlxyZAgwxiyn1r4Yf2sKV8OwZHE2FaB1OzIihqx5niL1+0sppbHt6lKY4FwbHNF2UI0Z 2+CrHamwE8u6agEJVzIB6qRdvrF/YhqwuKQkFCGbWPzB+O26XsbDe0x/xJedEw6VDnlK UGVeNepcq0+Rs2pGyBpEC+DurB5+r7QIQza/LzqhL3vMItA87pyZ+kYrkX2Tvkjfd3xp 7Pv46US019OUVMMNlijSnaO9xrnXCCSmrZvMrTbaZiCleD7sw738MqmBbhEj98TJwpD2 G8MQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=haVpn9fvl3FQKPXQqTZq8l5X+Z7fEQLSNTR+x6poikY=; fh=qYuvqR+Z9iMNIuN8Sqx1BijtoIlZoh73xHHeK/PvlNE=; b=DnLiPVpzYFerwHG3OuY1Fg4PsRS14sm8p36Lnu1WBwQdQ85ctp1WuJYuQRuIolILI0 lGCTTpekRxQypAl0NKN1fGBlzKnrTqDHnbZi72KdwYy8oPb70vLtDfeEeu6nMWBJBbqB ZyQ7T74bqjotwzqljtj77gDvS/by0s+HgLs4YCdIbI9tvyTz72NCOzbb20RKirrb7xfi ijyuDlx/Q87UISpBUvJUckahA7kiRSBgpZAVx/eFieJRvVJbo012tGYU3ihp1EOOnWgI w4wgke+rOXEGA9Fx3xEZYwSSYMz7dmJeI/tfOtIMKVKqSeSiFkKDw1TudDHw+Xki4Dv1 coXA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=LJ1MGQVl; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from lipwig.vger.email (lipwig.vger.email. [2620:137:e000::3:3]) by mx.google.com with ESMTPS id k1-20020a170902c40100b001cc529610e3si4564278plk.342.2023.12.04.11.01.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:01:11 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) client-ip=2620:137:e000::3:3; Authentication-Results: mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=LJ1MGQVl; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id EA3C28051A32; Mon, 4 Dec 2023 11:01:07 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231454AbjLDTAx (ORCPT + 99 others); Mon, 4 Dec 2023 14:00:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48364 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231364AbjLDTAt (ORCPT ); Mon, 4 Dec 2023 14:00:49 -0500 Received: from mail-ej1-x62f.google.com (mail-ej1-x62f.google.com [IPv6:2a00:1450:4864:20::62f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DC494D5 for ; Mon, 4 Dec 2023 11:00:55 -0800 (PST) Received: by mail-ej1-x62f.google.com with SMTP id a640c23a62f3a-a1b22a31649so215724566b.3 for ; Mon, 04 Dec 2023 11:00:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1701716454; x=1702321254; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=haVpn9fvl3FQKPXQqTZq8l5X+Z7fEQLSNTR+x6poikY=; b=LJ1MGQVlwAtkjU4Ku120jh+vw9q8rexA2ETFL/QP+d/i8tjeMk9bzZSmMhk3Cj7RXs 1NTGAEv31a2k8mGm0RSMe6CRyA5Vh4r6U5nA665TYS2yug/w4bdqShqYTq07Te4bNbi+ yX8ZCHjOeuOClFtMCBIIF622wlbmYWqLSmv4ji4DpGR61kqaa9bVPzmkE7oqe/2VWBAT S68z299WZJvA/bTCVUbRUD2d1MdvRRvQXLfu/taF17hiQNm49fIyyEWU3v+SppxJyHqN UT+yNFlKf0gWBLTs8lXbnjID7V08/E2a6ryQDCqzdVtTfcUtHu7VTfCvCNncNRdP/NWZ 8oKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701716454; x=1702321254; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=haVpn9fvl3FQKPXQqTZq8l5X+Z7fEQLSNTR+x6poikY=; b=AeNDC+iMZkofPOPV825L39bkoMRaNN2gc/xZxFxzMEpYP7Vkdd9obHjt5hEWfYJnO8 6e7a9N5UUpozrfBOtvaDoXHwumSL7obi9BPnCcSYo1Z5gnRTROUUDjQqzlKxe8Az2zP2 oy9NS/gmnz8Gj/Kx+SOEyOOhAdYQ9FjdCuwN0Ro0pc1S8eN+NwBBQS981u5UCKHu4dmB YQTQb1Me268lxqks2eGbdzyxacnOqCIXseBevrJHON35PuxLvrMrJO3jKxQHBs5sbVkD tYs4bw2fxuAiAKZgciWVBNyTUyP3s0+Qwqnm+PbQ27GfeYQRrg4NeZHIIijb10IICtGY VUpg== X-Gm-Message-State: AOJu0YzWS80A92mpVCTd2cI9PEWB5MCcDrZCwNgCPjBNuCvuoj7PQ3A+ ckXyOvLVJdkb+wCVWzqL6gR33A== X-Received: by 2002:a17:907:38f:b0:a19:a19b:55c2 with SMTP id ss15-20020a170907038f00b00a19a19b55c2mr3409428ejb.82.1701716454475; Mon, 04 Dec 2023 11:00:54 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id dx9-20020a170906a84900b009fbc655335dsm5577614ejb.27.2023.12.04.11.00.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:00:53 -0800 (PST) From: Dmitry Safonov To: David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri , Salam Noureddine , Simon Horman , netdev@vger.kernel.org, Markus Elfring , Jonathan Corbet , linux-doc@vger.kernel.org Subject: [PATCH v5 1/5] Documentation/tcp: Fix an obvious typo Date: Mon, 4 Dec 2023 19:00:40 +0000 Message-ID: <20231204190044.450107-2-dima@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231204190044.450107-1-dima@arista.com> References: <20231204190044.450107-1-dima@arista.com> MIME-Version: 1.0 X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Mon, 04 Dec 2023 11:01:08 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1784379050537370395 X-GMAIL-MSGID: 1784379050537370395 Yep, my VIM spellchecker is not good enough for typos like this one. Fixes: 7fe0e38bb669 ("Documentation/tcp: Add TCP-AO documentation") Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Reported-by: Markus Elfring Closes: https://lore.kernel.org/all/2745ab4e-acac-40d4-83bf-37f2600d0c3d@web.de/ Signed-off-by: Dmitry Safonov --- Documentation/networking/tcp_ao.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Documentation/networking/tcp_ao.rst b/Documentation/networking/tcp_ao.rst index cfa5bf1cc542..8a58321acce7 100644 --- a/Documentation/networking/tcp_ao.rst +++ b/Documentation/networking/tcp_ao.rst @@ -99,7 +99,7 @@ also [6.1]:: when it is no longer considered permitted. Linux TCP-AO will try its best to prevent you from removing a key that's -being used, considering it a key management failure. But sine keeping +being used, considering it a key management failure. But since keeping an outdated key may become a security issue and as a peer may unintentionally prevent the removal of an old key by always setting it as RNextKeyID - a forced key removal mechanism is provided, where From patchwork Mon Dec 4 19:00:41 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 173533 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp2971185vqy; Mon, 4 Dec 2023 11:01:38 -0800 (PST) X-Google-Smtp-Source: AGHT+IE62dRneaN85ny21zvh+ZwKhwkODR81rgp0VpYflY0iutWH9XmuwAhjN9GgwABGRvEimGzK X-Received: by 2002:a05:6a20:9383:b0:18c:5178:9649 with SMTP id x3-20020a056a20938300b0018c51789649mr194439pzh.14.1701716497392; Mon, 04 Dec 2023 11:01:37 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1701716497; cv=none; d=google.com; s=arc-20160816; b=ZlKllFyzNWlUyFGHuKYEM2TcjIY39JODZAzjzNlHca0ijPhQ9GAzRxAmVcvXZssfzy t8A0Bd2WY7Ct5NgysD3phLjEyF4K6yrXtM+5HNojBxlMf2mLkf+zBMAFUHb15WXGuc0n NPuRKIjMPwbcPhdWZI9PQ5VkZBXq6rwaQjulW0+XJFLwfQEf2lx3cCbV4J0Kl4Nx1IS9 Aq5jLJUQN1WSL7PCuQnyR04vnti3wcDgklQ8ARmVaKhc4t6YAdYmraCgqlyP0ZsnR9nU 6dWGnyZQhpwjx/vrMOGsfWRLctgST4Ky+Y+aeA4dc7JxJEhF+YtW1/o0Vulr+VZKVnP5 qjhQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=jdHJo0WMEGa5+mwV0AKy7FBmTBpRdeoVEnNhqPa4lAk=; fh=Yk/Quc8tqIb7VaGeTLaGy5uds5Cbik8MTMk6yfuC1TU=; b=x3OJm3d/2M+EGqt7bOTExz6cWNEEhU2wenTPCK0wGK60DrREfdeGXMuZTLZH2B4TRr pHJWwu8pByz45N0l9QITVM0Va4QeYnCi8YUJAfzLTB9lq4nX6Vcwu2zvyVLkseuPMJzd gsgtJ7tqUWWNpq9lupMth1MoEVIn/QmnSNQ4vBt6XT5sUw+Z5tg2lvfox1H4R8PzfuHe 3WLJoxAx5ityzy8ALAg5SZ7FAW4zOhVbGyhx55u9UOTmz7d1mNHdpix8egTvySBMDqQT GH6OKHCmlixV79depzc7V5TrXXPC+tMUGTRy/vgjQz+mScr48ugglgEMfFXau1sK9u6y unKA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=hmPYgw4n; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from lipwig.vger.email (lipwig.vger.email. [2620:137:e000::3:3]) by mx.google.com with ESMTPS id n126-20020a632784000000b005c671034479si3441227pgn.490.2023.12.04.11.01.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:01:37 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) client-ip=2620:137:e000::3:3; Authentication-Results: mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=hmPYgw4n; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id 71AD38050F87; Mon, 4 Dec 2023 11:01:29 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231655AbjLDTA6 (ORCPT + 99 others); Mon, 4 Dec 2023 14:00:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40872 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231379AbjLDTAw (ORCPT ); Mon, 4 Dec 2023 14:00:52 -0500 Received: from mail-wm1-x329.google.com (mail-wm1-x329.google.com [IPv6:2a00:1450:4864:20::329]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8C219D7 for ; Mon, 4 Dec 2023 11:00:58 -0800 (PST) Received: by mail-wm1-x329.google.com with SMTP id 5b1f17b1804b1-40a4848c6e1so50416585e9.1 for ; Mon, 04 Dec 2023 11:00:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1701716457; x=1702321257; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=jdHJo0WMEGa5+mwV0AKy7FBmTBpRdeoVEnNhqPa4lAk=; b=hmPYgw4neECuep8CTszJYHorbPIMNyKvwPd8QocsrH+MQ3g4OOvnYSqKfJmZDUXvaT j5+VWjKYrNaZBgTUw8PD3KtATc6EdsNPycSzj/2S9Lzm4joCNwfXZ1G4T3/vOTMY5HMg fUKae9XK7ZTMhaDR1dQqCCm5o8IKPrwmuCDiwu+uFqRnPwSLl0BYnBlc3/cuzqke55yo aSqhg0RowDUmSqHRz2eUsCfeUt++OqJ7NbikcApQz9jMnHl/2BTBB9/JGQsg+JyqaLqO 5s4FF+CrTOm4IWJnvoDGIpBll4kjmtbfX0bfwAiXyq61kbUcNRBLQ8bjFVUhLruodPU7 OdOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701716457; x=1702321257; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=jdHJo0WMEGa5+mwV0AKy7FBmTBpRdeoVEnNhqPa4lAk=; b=QxIsy2J5clUS0WinZiMZxne5LmanL+62+s9eGHE4NGdg6gOIELob6gGVDlcSdTF11G NbA7ioPZF6c14dtI1dlDqyyKrjSKXU9yqsvhZZkUHoiGW4E56mUYqM77wHERQ3wvtXZO WunLZ8taTawKZIB+g6GLdGgJ4s1MoPoYb68jF7NawRhwX6EXiG+TfhT8ceNDcwwoPopK GisTvzcRLdpt6ke18apd1ADA2ARL8nmqrLjXGGwzQwiG4yOmJaYqwaECU4Hy0e70Mdqn l56sQcYRzrwvqF9VN5nxAqn+MLnyoy0LU3cCv9RJnxv9e2x8U0W1W8/sueYYeSp1JSTU l4gQ== X-Gm-Message-State: AOJu0YxGV9VNXrGyAmXMjTSuMavQAZxWTumNLNKPbj6VoedOA0u+KxAh wf+SppuqqLwaQeOed3CkjXycAw== X-Received: by 2002:a05:600c:289:b0:40b:5e21:bde3 with SMTP id 9-20020a05600c028900b0040b5e21bde3mr2506590wmk.114.1701716456477; Mon, 04 Dec 2023 11:00:56 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id dx9-20020a170906a84900b009fbc655335dsm5577614ejb.27.2023.12.04.11.00.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:00:55 -0800 (PST) From: Dmitry Safonov To: David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri , Salam Noureddine , Simon Horman , netdev@vger.kernel.org Subject: [PATCH v5 2/5] net/tcp: Consistently align TCP-AO option in the header Date: Mon, 4 Dec 2023 19:00:41 +0000 Message-ID: <20231204190044.450107-3-dima@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231204190044.450107-1-dima@arista.com> References: <20231204190044.450107-1-dima@arista.com> MIME-Version: 1.0 X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Mon, 04 Dec 2023 11:01:29 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1784379077839298133 X-GMAIL-MSGID: 1784379077839298133 Currently functions that pre-calculate TCP header options length use unaligned TCP-AO header + MAC-length for skb reservation. And the functions that actually write TCP-AO options into skb do align the header. Nothing good can come out of this for ((maclen % 4) != 0). Provide tcp_ao_len_aligned() helper and use it everywhere for TCP header options space calculations. Fixes: 1e03d32bea8e ("net/tcp: Add TCP-AO sign to outgoing packets") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet --- include/net/tcp_ao.h | 6 ++++++ net/ipv4/tcp_ao.c | 4 ++-- net/ipv4/tcp_ipv4.c | 4 ++-- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +++--- net/ipv6/tcp_ipv6.c | 2 +- 6 files changed, 15 insertions(+), 9 deletions(-) diff --git a/include/net/tcp_ao.h b/include/net/tcp_ao.h index b56be10838f0..647781080613 100644 --- a/include/net/tcp_ao.h +++ b/include/net/tcp_ao.h @@ -62,11 +62,17 @@ static inline int tcp_ao_maclen(const struct tcp_ao_key *key) return key->maclen; } +/* Use tcp_ao_len_aligned() for TCP header calculations */ static inline int tcp_ao_len(const struct tcp_ao_key *key) { return tcp_ao_maclen(key) + sizeof(struct tcp_ao_hdr); } +static inline int tcp_ao_len_aligned(const struct tcp_ao_key *key) +{ + return round_up(tcp_ao_len(key), 4); +} + static inline unsigned int tcp_ao_digest_size(struct tcp_ao_key *key) { return key->digest_size; diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c index 7696417d0640..c8be1d526eac 100644 --- a/net/ipv4/tcp_ao.c +++ b/net/ipv4/tcp_ao.c @@ -1100,7 +1100,7 @@ void tcp_ao_connect_init(struct sock *sk) ao_info->current_key = key; if (!ao_info->rnext_key) ao_info->rnext_key = key; - tp->tcp_header_len += tcp_ao_len(key); + tp->tcp_header_len += tcp_ao_len_aligned(key); ao_info->lisn = htonl(tp->write_seq); ao_info->snd_sne = 0; @@ -1346,7 +1346,7 @@ static int tcp_ao_parse_crypto(struct tcp_ao_add *cmd, struct tcp_ao_key *key) syn_tcp_option_space -= TCPOLEN_MSS_ALIGNED; syn_tcp_option_space -= TCPOLEN_TSTAMP_ALIGNED; syn_tcp_option_space -= TCPOLEN_WSCALE_ALIGNED; - if (tcp_ao_len(key) > syn_tcp_option_space) { + if (tcp_ao_len_aligned(key) > syn_tcp_option_space) { err = -EMSGSIZE; goto err_kfree; } diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 5f693bbd578d..0c50c5a32b84 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -690,7 +690,7 @@ static bool tcp_v4_ao_sign_reset(const struct sock *sk, struct sk_buff *skb, reply_options[0] = htonl((TCPOPT_AO << 24) | (tcp_ao_len(key) << 16) | (aoh->rnext_keyid << 8) | keyid); - arg->iov[0].iov_len += round_up(tcp_ao_len(key), 4); + arg->iov[0].iov_len += tcp_ao_len_aligned(key); reply->doff = arg->iov[0].iov_len / 4; if (tcp_ao_hash_hdr(AF_INET, (char *)&reply_options[1], @@ -978,7 +978,7 @@ static void tcp_v4_send_ack(const struct sock *sk, (tcp_ao_len(key->ao_key) << 16) | (key->ao_key->sndid << 8) | key->rcv_next); - arg.iov[0].iov_len += round_up(tcp_ao_len(key->ao_key), 4); + arg.iov[0].iov_len += tcp_ao_len_aligned(key->ao_key); rep.th.doff = arg.iov[0].iov_len / 4; tcp_ao_hash_hdr(AF_INET, (char *)&rep.opt[offset], diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index a9807eeb311c..9e85f2a0bddd 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -615,7 +615,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, ao_key = treq->af_specific->ao_lookup(sk, req, tcp_rsk(req)->ao_keyid, -1); if (ao_key) - newtp->tcp_header_len += tcp_ao_len(ao_key); + newtp->tcp_header_len += tcp_ao_len_aligned(ao_key); #endif if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len) newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len; diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index eb13a55d660c..93eef1dbbc55 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -825,7 +825,7 @@ static unsigned int tcp_syn_options(struct sock *sk, struct sk_buff *skb, timestamps = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_timestamps); if (tcp_key_is_ao(key)) { opts->options |= OPTION_AO; - remaining -= tcp_ao_len(key->ao_key); + remaining -= tcp_ao_len_aligned(key->ao_key); } } @@ -915,7 +915,7 @@ static unsigned int tcp_synack_options(const struct sock *sk, ireq->tstamp_ok &= !ireq->sack_ok; } else if (tcp_key_is_ao(key)) { opts->options |= OPTION_AO; - remaining -= tcp_ao_len(key->ao_key); + remaining -= tcp_ao_len_aligned(key->ao_key); ireq->tstamp_ok &= !ireq->sack_ok; } @@ -982,7 +982,7 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb size += TCPOLEN_MD5SIG_ALIGNED; } else if (tcp_key_is_ao(key)) { opts->options |= OPTION_AO; - size += tcp_ao_len(key->ao_key); + size += tcp_ao_len_aligned(key->ao_key); } if (likely(tp->rx_opt.tstamp_ok)) { diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 937a02c2e534..8c6623496dd7 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -881,7 +881,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 if (tcp_key_is_md5(key)) tot_len += TCPOLEN_MD5SIG_ALIGNED; if (tcp_key_is_ao(key)) - tot_len += tcp_ao_len(key->ao_key); + tot_len += tcp_ao_len_aligned(key->ao_key); #ifdef CONFIG_MPTCP if (rst && !tcp_key_is_md5(key)) { From patchwork Mon Dec 4 19:00:42 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 173535 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp2971319vqy; Mon, 4 Dec 2023 11:01:47 -0800 (PST) X-Google-Smtp-Source: AGHT+IH4wQgYrqOJo/ONqljL4t+HS+H53wawSyB2j/MBaj6Mf0UgPlx0swoVsbGnbo415dn2EfCK X-Received: by 2002:a17:90b:4c87:b0:286:867c:a414 with SMTP id my7-20020a17090b4c8700b00286867ca414mr183151pjb.41.1701716506937; Mon, 04 Dec 2023 11:01:46 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1701716506; cv=none; d=google.com; s=arc-20160816; b=cTpQVZjtoWT7IlOXpdfWtHcjAadcruIXkvq2E5mw5HAReSqOXnUPjPf3M0gP4PR6e+ Am1AK8mSFgCydixSPPGyWZY0Rp3xgUHiuelOVZWnLSHWDapSZ2DKfdhC+tIEdQ61HDxO 4JHIM4gB0cvf9oq38W7sNastJDGN3ttEeON83I7cYkEDJvRcLUdu3O3JBMSwv+L4HNLi eNPZ1z9ibN3xC9PeQpF8S3AfghHHah2zbucCH9e04gD5xyENW65Z1yPa7YwtdUZnxhEk HQZ4QMY5d60czi9xX9K03ie28Pc0Zg+vX/YHh6djfIS8nhJ2Ld9f9E3X9sQTBDQDEMVW rGsQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=oUFbq/Bpf84kUYD5hi1tJcGjiTvsxTjhBSB3X6vJDoM=; fh=Yk/Quc8tqIb7VaGeTLaGy5uds5Cbik8MTMk6yfuC1TU=; b=SUz7N0l9uXWJh2aPblj9YnNECuR5yxWV44o5D+j6R6WI0qNVAAC/ix7r/o5kztc6kT ALCI2EU7YMBxsaNmdfrFe04GeTfzsS9KL61UvvwagcdALV9WRMX2nUJD+KfCkCLjBoQC dJKb6s9x6/MUV1MFaz1ku6hydIx1lc2EeteTqRbf0HA8ovzgFsdn0YlUiwjZKx9CUHhF WLLxpwuFyNjcXw5koWL+kKyp8QMV2jrBKEpN/aNOASlSNEztKTWg0YOmkB2iHmmQuEI1 hXGdWSd8A9HClJG/gf239f3kIeIlE4sKrvBDWj+8ul8ijtHOG52Ht/noO381oZ4mYlUs +D/A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=Ix+CWGjf; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from lipwig.vger.email (lipwig.vger.email. [2620:137:e000::3:3]) by mx.google.com with ESMTPS id x23-20020a17090a789700b002868183da74si3401278pjk.65.2023.12.04.11.01.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:01:46 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) client-ip=2620:137:e000::3:3; Authentication-Results: mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=Ix+CWGjf; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id 962668051A32; Mon, 4 Dec 2023 11:01:40 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233279AbjLDTBH (ORCPT + 99 others); Mon, 4 Dec 2023 14:01:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40892 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231467AbjLDTAy (ORCPT ); Mon, 4 Dec 2023 14:00:54 -0500 Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6A408D5 for ; Mon, 4 Dec 2023 11:01:00 -0800 (PST) Received: by mail-lj1-x22b.google.com with SMTP id 38308e7fff4ca-2ca00dffc23so19271501fa.2 for ; Mon, 04 Dec 2023 11:01:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1701716458; x=1702321258; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=oUFbq/Bpf84kUYD5hi1tJcGjiTvsxTjhBSB3X6vJDoM=; b=Ix+CWGjfoTnPi0Reh4LiZJRzUanU1j1VSgXwMAXwBsLOzc5Ruoq6VPwlo7IPiZ7XN7 NiZr2eJdX5AsY63Ob7RAqm+vcLFSogBYR414/9FxwRmlIjcY/L1gcqncqlcBD+Ct3B5l mv0o8CDjQVhsG8R62J8pXbnM9KHBuyEIAUYe7NcvZw9zNITb8WaJt6d+E2ytgdYVQu3X 5Y+5r5Sm8lkj9mVQshWVUdsiDiUhus/MCGEMmJk9Vi0bxzvSWTvkGvucaZmSKlOcMeA7 ClIs4X7dWVdjVc/gn91LNlJsiHPtX/2roqSLG0ATOK4Dsps+clazXrUrcLz0H6Y0JPGm 6eyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701716458; x=1702321258; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=oUFbq/Bpf84kUYD5hi1tJcGjiTvsxTjhBSB3X6vJDoM=; b=hSpYKiO9qUz0dZNxMpKR1+uSgrvV8NM/zHSGpewuRYBL+Iux9iFsgLiGZzZxkcECBv HajgGQF/iUwefB//5HxjBm9RaBxgoxrkzMVN5mVNioY3aaOkGnTguEqHwEz5A/rSOWwL m0nZ16djW42Qj2ehqIA18Y8Gu81e1bBVKAMPT5Hq2Scf1P9lLn1KmiHTEJX2DnE8Ao6x mHLhHQbgIBXsew0AzueRpLlpUebTtoHUBD7hdZBbka14m+3HeuyOK0gkahYfLs+YPR9t gImufQufLqnF8ueoVu4zH577X5iQhFmbHxsKoMlnLY+4VflflDWHwGcWTvOR0l5zUtH7 YrKA== X-Gm-Message-State: AOJu0YyAZ+93ph0TW8hcTvxA7zpm5iNA48Sg3xuZBxuxj0W14f9pS2ro 4DDRtv5l9/Rk3NPcILay0yxsLA== X-Received: by 2002:a2e:b348:0:b0:2c9:f727:7e65 with SMTP id q8-20020a2eb348000000b002c9f7277e65mr1332068lja.38.1701716458691; Mon, 04 Dec 2023 11:00:58 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id dx9-20020a170906a84900b009fbc655335dsm5577614ejb.27.2023.12.04.11.00.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:00:57 -0800 (PST) From: Dmitry Safonov To: David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri , Salam Noureddine , Simon Horman , netdev@vger.kernel.org Subject: [PATCH v5 3/5] net/tcp: Limit TCP_AO_REPAIR to non-listen sockets Date: Mon, 4 Dec 2023 19:00:42 +0000 Message-ID: <20231204190044.450107-4-dima@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231204190044.450107-1-dima@arista.com> References: <20231204190044.450107-1-dima@arista.com> MIME-Version: 1.0 X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Mon, 04 Dec 2023 11:01:40 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1784379087865386810 X-GMAIL-MSGID: 1784379087865386810 Listen socket is not an established TCP connection, so setsockopt(TCP_AO_REPAIR) doesn't have any impact. Restrict this uAPI for listen sockets. Fixes: faadfaba5e01 ("net/tcp: Add TCP_AO_REPAIR") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet --- net/ipv4/tcp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 53bcc17c91e4..b1fe4eb01829 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3594,6 +3594,10 @@ int do_tcp_setsockopt(struct sock *sk, int level, int optname, break; case TCP_AO_REPAIR: + if (!tcp_can_repair_sock(sk)) { + err = -EPERM; + break; + } err = tcp_ao_set_repair(sk, optval, optlen); break; #ifdef CONFIG_TCP_AO @@ -4293,6 +4297,8 @@ int do_tcp_getsockopt(struct sock *sk, int level, } #endif case TCP_AO_REPAIR: + if (!tcp_can_repair_sock(sk)) + return -EPERM; return tcp_ao_get_repair(sk, optval, optlen); case TCP_AO_GET_KEYS: case TCP_AO_INFO: { From patchwork Mon Dec 4 19:00:43 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 173534 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp2971282vqy; Mon, 4 Dec 2023 11:01:44 -0800 (PST) X-Google-Smtp-Source: AGHT+IEjmzV+5ZEy77hkXcXItjYgQmXLbV0Yn4tPzQJhnFn3cgdzDwsFDeCC7TQgiJaB1611zN+c X-Received: by 2002:a05:6a21:1f0a:b0:18f:97c:9274 with SMTP id ry10-20020a056a211f0a00b0018f097c9274mr1548739pzb.89.1701716503927; Mon, 04 Dec 2023 11:01:43 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1701716503; cv=none; d=google.com; s=arc-20160816; b=x9G+/Icf9GNnKMSVvI5oht8iIgOiAhzBkW0zNhmdfSu/B7SVGZnljsnix+dv+xXiLa 5scsu+Wvpe6DlwCQ/wDeI/6eUJJLhnTnRrOJINmxyq4KblhMvm5/CPUeLkkHkGt0soK2 XZtrjix6EAD+geIMWlFGocHi9C1cuvln/rZqHV3xK5zao9MR08zwFqZgLl/e+3qHm7xx y7hkkANyzrvNCGH5oDqhu+k4h0czZ/9rbSE9ohBexU8kdyyJrYKvWdF+UISEgCIf0i03 Wghh4y8vWjUOl9XcQAAkSSpbJjMgJNP9ZCSKFaJJZHN2+agQyOLjDzQIk1B5qzuJA/Nu wslA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=NZ0D/wyA9hkFzwdAxUoMggZbpJ8bxr4KljB1d44II90=; fh=Yk/Quc8tqIb7VaGeTLaGy5uds5Cbik8MTMk6yfuC1TU=; b=mIPR2Fy+thB0rY0580bUwqkBo/EkAQroA3ZMhJGF0nRj35ot3KkLWj96YD2SdYUVoe Qg8rpJjaukqOH/Viqs5DcoAmNmJlI3zNoEpe1xZYVmSycxCLxxPZyv9uYx5YENWLtSra +165yMPL+y4T61KKijPCiItbklC1X2ZtMNQYUwFrcwD/5R8b77P/VaG+3+v8R5UPGCmt J9SL0YqkixOnOBknfTYbPs9PCuQZvLqinru6B4Y8z0cWwWXbBQyiaTN12O0OQ7WRjmBn Rt+apWC/IE/OMvIJp+aD4bBYL3kOri+7J0NP6NsGGTCNUZMC3YqFBRlyPk95A5+Q70qd cW+w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=g+XrIukv; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from lipwig.vger.email (lipwig.vger.email. [23.128.96.33]) by mx.google.com with ESMTPS id e187-20020a6369c4000000b005c5e276b55esi7997709pgc.441.2023.12.04.11.01.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:01:43 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33; Authentication-Results: mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=g+XrIukv; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id 246A180A777F; Mon, 4 Dec 2023 11:01:41 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231327AbjLDTBK (ORCPT + 99 others); Mon, 4 Dec 2023 14:01:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40912 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231266AbjLDTA4 (ORCPT ); Mon, 4 Dec 2023 14:00:56 -0500 Received: from mail-ej1-x62b.google.com (mail-ej1-x62b.google.com [IPv6:2a00:1450:4864:20::62b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7D58A107 for ; Mon, 4 Dec 2023 11:01:02 -0800 (PST) Received: by mail-ej1-x62b.google.com with SMTP id a640c23a62f3a-a00cbb83c80so661355566b.0 for ; Mon, 04 Dec 2023 11:01:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1701716461; x=1702321261; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NZ0D/wyA9hkFzwdAxUoMggZbpJ8bxr4KljB1d44II90=; b=g+XrIukvP0kRCHm1wfbmqM8r0VQVu6xuEBcmVoF30BWysxs/NXepuTJ4VWFsM5KQbG whlC6LZMhvoNdi2k3CacicYWvF0WUQxWAIC0bKC1ThkjIkeq+qaoRWiawNzIXXByV8QX cXhk+nztqP6KPLMBU0az8sMelaisZxb5TSwVgc1k4UbXTjv8sSrU/rvzJMrnissiIncD nHphrmgqi1tLeymm7x5onw2Y6e6OTmcCsX9Ed/7+09cThzsWgEkjmqOnGhtG/aCo5408 vsM0MbgPm7NKUEgvS/KRWxQMosh2lJNaQ87NpG/sRFbNqzZF9bcYouMjCgBFgv4Y0K5F NXWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701716461; x=1702321261; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=NZ0D/wyA9hkFzwdAxUoMggZbpJ8bxr4KljB1d44II90=; b=a2FXLgC8GL/80Zf7+NmN4KaQ+kkC2YZH+ILn77H9IoBwH3/aLPIglNym7jjGfyoXVc iVbiujlpdkoCwzChZ5+f4h67S1Awv0P6vbIdJ/uX6gj3bc89zSNeatKj/JRcl60ov4hG dSuhWJaxKjZQjX3HZ9u1CdetE78JyzPkHotXJEBJG62xbLBTrFtUUN4lLn74F0Xq+XJW PiTX9mgU4iSyWSRMA1yleYQkWMGL+aYAN/XiRNM5LZY4J2RUnc02KiYlyJDpZUjn0a89 2IgPiJh8omYMEzZzBaU6AkYU7Q9sxzOWs8W07Ll5Ht5DemUXDIP8vsBNHp/8WvIPBqpW C8QQ== X-Gm-Message-State: AOJu0YwUi6N8YtnSvPuFEP8SZCdHX2k32u3LR3wj3iAcOfs6/TeUhXBV bLYb9y6/xSXvCTOQtXaGtq8Eew== X-Received: by 2002:a17:906:220f:b0:a00:2686:6b42 with SMTP id s15-20020a170906220f00b00a0026866b42mr2988048ejs.10.1701716460982; Mon, 04 Dec 2023 11:01:00 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id dx9-20020a170906a84900b009fbc655335dsm5577614ejb.27.2023.12.04.11.00.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:00:59 -0800 (PST) From: Dmitry Safonov To: David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri , Salam Noureddine , Simon Horman , netdev@vger.kernel.org Subject: [PATCH v5 4/5] net/tcp: Don't add key with non-matching VRF on connected sockets Date: Mon, 4 Dec 2023 19:00:43 +0000 Message-ID: <20231204190044.450107-5-dima@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231204190044.450107-1-dima@arista.com> References: <20231204190044.450107-1-dima@arista.com> MIME-Version: 1.0 X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Mon, 04 Dec 2023 11:01:41 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1784379084460628348 X-GMAIL-MSGID: 1784379084460628348 If the connection was established, don't allow adding TCP-AO keys that don't match the peer. Currently, there are checks for ip-address matching, but L3 index check is missing. Add it to restrict userspace shooting itself somewhere. Yet, nothing restricts the CAP_NET_RAW user from trying to shoot themselves by performing setsockopt(SO_BINDTODEVICE) or setsockopt(SO_BINDTOIFINDEX) over an established TCP-AO connection. So, this is just "minimum effort" to potentially save someone's debugging time, rather than a full restriction on doing weird things. Fixes: 248411b8cb89 ("net/tcp: Wire up l3index to TCP-AO") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet --- net/ipv4/tcp_ao.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c index c8be1d526eac..18dacfef7a07 100644 --- a/net/ipv4/tcp_ao.c +++ b/net/ipv4/tcp_ao.c @@ -1608,6 +1608,15 @@ static int tcp_ao_add_cmd(struct sock *sk, unsigned short int family, if (!dev || !l3index) return -EINVAL; + if (!bound_dev_if || bound_dev_if != cmd.ifindex) { + /* tcp_ao_established_key() doesn't expect having + * non peer-matching key on an established TCP-AO + * connection. + */ + if (!((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))) + return -EINVAL; + } + /* It's still possible to bind after adding keys or even * re-bind to a different dev (with CAP_NET_RAW). * So, no reason to return error here, rather try to be From patchwork Mon Dec 4 19:00:44 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 173537 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp2979986vqy; Mon, 4 Dec 2023 11:14:58 -0800 (PST) X-Google-Smtp-Source: AGHT+IFbkVfb7qybt0GdZU/0twBCqOHFetwuZcMI1bdpzy7M1rqj9r5oBJBLwqF3L3NVn1+xhakd X-Received: by 2002:a17:902:ce87:b0:1d0:14be:ceb with SMTP id f7-20020a170902ce8700b001d014be0cebmr2799349plg.57.1701717298404; Mon, 04 Dec 2023 11:14:58 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1701717298; cv=none; d=google.com; s=arc-20160816; b=nILbA1sDIowIp/Us3VLHkTRRAzvmEUT4az+kCRnG0wzFp/AESfWJT0cAKWZNzyKoMA XLlftnQr9GOwiy35StTdkODP1dMqStpIYRKEURuVgBylTojDo5zqPIc8RgQ64vB6xAtq 2VV++vlhTUTwBAGUW/BgGQR2+JbRiRUIBc1QDGnMXsycjrytcHOUdvJPdQPCgfFkvXjO 3hAI9D3WGop0wNdbmps1+KI2x0ZceV4onmOOo5M29/cIAul0FN/0GkxUCic67TlF+LA3 hWcQF0HmVCzUYM9VFscInu1U70NQyqx06ScSfedrnWCt+STVMOvi/jdSGV9asAf/RZ+/ S1pQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=6mT3D/Z66Vs1yufZpC/lcvNBlunBHyn7u3P08XO8P98=; fh=Yk/Quc8tqIb7VaGeTLaGy5uds5Cbik8MTMk6yfuC1TU=; b=Tjdy8s9zBy/rAIwEkHaRSidcX6xSLrjDZkDUx5hP26uJud3tUknbsgm/JrGRsm8Jqx IVGZldHvA8NjOyl8pNFmt9FZbK8NAFGnXF7mb5QZ2uDGUfVLhN3jbKj+dsV9LRjmEuMe 1FlCoq/dW5NXw6wzakgy6Syu2sVizPmyXhhTGEDhZ04aK1jAr0Na2U4UyOYeYFCwuejQ N1eLc9D9yeiZSm4ewQhaq1dex/3+cFUDqLQ5lpKtaKAOWW6+KX2qwtHLUs6mqEj6UIOw 5ILmj4eFOjYTv4NJlo03HXJeJ35g7txvjCqef15NNo7B7u/MZubjHGb6bS3ExXZJPIK+ WzkQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=EmOPx5fU; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.36 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from pete.vger.email (pete.vger.email. [23.128.96.36]) by mx.google.com with ESMTPS id p7-20020a1709028a8700b001c383a64ebesi7917137plo.319.2023.12.04.11.14.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:14:58 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.36 as permitted sender) client-ip=23.128.96.36; Authentication-Results: mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=EmOPx5fU; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.36 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by pete.vger.email (Postfix) with ESMTP id 4A34D80BC137; Mon, 4 Dec 2023 11:14:55 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at pete.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344402AbjLDTBP (ORCPT + 99 others); Mon, 4 Dec 2023 14:01:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59384 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232408AbjLDTBF (ORCPT ); Mon, 4 Dec 2023 14:01:05 -0500 Received: from mail-ej1-x629.google.com (mail-ej1-x629.google.com [IPv6:2a00:1450:4864:20::629]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 13633111 for ; Mon, 4 Dec 2023 11:01:04 -0800 (PST) Received: by mail-ej1-x629.google.com with SMTP id a640c23a62f3a-9e1021dbd28so663958166b.3 for ; Mon, 04 Dec 2023 11:01:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1701716462; x=1702321262; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=6mT3D/Z66Vs1yufZpC/lcvNBlunBHyn7u3P08XO8P98=; b=EmOPx5fUQS4vptuJKQv8y9P5AmrPe3uprHbrugnbt5tCSmJcIZD8HNcKdlkso0hDK3 cR0tBMELizu0ZftuhBi2CwFFTIjRwMUY0WmbncBO7q6EkZRwqi7y7nsTi1yL+XGsnHoL gMrMcHcz3EoA1bdmHJlbT1IlXOQ0jqWwgMmB0uZh+E/botNKA42N7/4Xvcrq+KEK0v+T 8jP3PPU/M1UdR0WMnm64STXF6YV6YCq4hqQPnY9kHw0UgyHV7ZqGpkmETyFKx4866QAm cIDgnBSl9gyORzFd31TszUZFwkyo/KPWCNdSUjqZKOQVaUMANtJPnv9yPUc6CDS7u+CB sMTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701716462; x=1702321262; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=6mT3D/Z66Vs1yufZpC/lcvNBlunBHyn7u3P08XO8P98=; b=BBdJBvGrdwKreHf0KfMPIgQGF9GgJowFOyHVbHmTQHRS0/Aw0rhSgJHR92c9D/2JqJ 3EJMUwfWh8yThN5IzpLnt9h+k7fzD4LDOyD/TUmh034trK7vnQYXnYRxZQ0VMTqsZ2h7 gGig2Wpnofx7rcneSm8Sm0oIQYuGCksagwbaUM4D1IPqTDOMVkC5+0dzdX/arcjxOFU5 9jTI9J+Ex6+vdUjaJahsGgNNTn2wowVO+UJ9d2AtmOfpayghf1Bbo6HXQgdXJb57PFgv ARAcCkq4b6WgxDfNT2aJvgloRc+3ZmoyeWJ8ANC6kugqJz9Dv+tuIaCSQWJCYoZW1tma r9ow== X-Gm-Message-State: AOJu0YwzpRKLTA/+qjihi3OIVQcY4oHlpGJBDWdCMZIbXT4eg/BS1a90 LMHCOeywpPksUE8fpBQlNYJn4A== X-Received: by 2002:a17:906:6c91:b0:a0f:44c6:8eb5 with SMTP id s17-20020a1709066c9100b00a0f44c68eb5mr2889368ejr.22.1701716462629; Mon, 04 Dec 2023 11:01:02 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id dx9-20020a170906a84900b009fbc655335dsm5577614ejb.27.2023.12.04.11.01.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 11:01:01 -0800 (PST) From: Dmitry Safonov To: David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri , Salam Noureddine , Simon Horman , netdev@vger.kernel.org Subject: [PATCH v5 5/5] net/tcp: Don't store TCP-AO maclen on reqsk Date: Mon, 4 Dec 2023 19:00:44 +0000 Message-ID: <20231204190044.450107-6-dima@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231204190044.450107-1-dima@arista.com> References: <20231204190044.450107-1-dima@arista.com> MIME-Version: 1.0 X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on pete.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (pete.vger.email [0.0.0.0]); Mon, 04 Dec 2023 11:14:55 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1784379918121889722 X-GMAIL-MSGID: 1784379918121889722 This extra check doesn't work for a handshake when SYN segment has (current_key.maclen != rnext_key.maclen). It could be amended to preserve rnext_key.maclen instead of current_key.maclen, but that requires a lookup on listen socket. Originally, this extra maclen check was introduced just because it was cheap. Drop it and convert tcp_request_sock::maclen into boolean tcp_request_sock::used_tcp_ao. Fixes: 06b22ef29591 ("net/tcp: Wire TCP-AO to request sockets") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet --- include/linux/tcp.h | 8 ++------ net/ipv4/tcp_ao.c | 4 ++-- net/ipv4/tcp_input.c | 5 +++-- net/ipv4/tcp_output.c | 9 +++------ 4 files changed, 10 insertions(+), 16 deletions(-) diff --git a/include/linux/tcp.h b/include/linux/tcp.h index 68f3d315d2e1..b646b574b060 100644 --- a/include/linux/tcp.h +++ b/include/linux/tcp.h @@ -169,7 +169,7 @@ struct tcp_request_sock { #ifdef CONFIG_TCP_AO u8 ao_keyid; u8 ao_rcv_next; - u8 maclen; + bool used_tcp_ao; #endif }; @@ -180,14 +180,10 @@ static inline struct tcp_request_sock *tcp_rsk(const struct request_sock *req) static inline bool tcp_rsk_used_ao(const struct request_sock *req) { - /* The real length of MAC is saved in the request socket, - * signing anything with zero-length makes no sense, so here is - * a little hack.. - */ #ifndef CONFIG_TCP_AO return false; #else - return tcp_rsk(req)->maclen != 0; + return tcp_rsk(req)->used_tcp_ao; #endif } diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c index 18dacfef7a07..f8308d3f565e 100644 --- a/net/ipv4/tcp_ao.c +++ b/net/ipv4/tcp_ao.c @@ -851,7 +851,7 @@ void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, const struct tcp_ao_hdr *aoh; struct tcp_ao_key *key; - treq->maclen = 0; + treq->used_tcp_ao = false; if (tcp_parse_auth_options(th, NULL, &aoh) || !aoh) return; @@ -863,7 +863,7 @@ void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, treq->ao_rcv_next = aoh->keyid; treq->ao_keyid = aoh->rnext_keyid; - treq->maclen = tcp_ao_maclen(key); + treq->used_tcp_ao = true; } static enum skb_drop_reason diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index bcb55d98004c..337c8bb07ccc 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -7182,11 +7182,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh)) goto drop_and_release; /* Invalid TCP options */ if (aoh) { - tcp_rsk(req)->maclen = aoh->length - sizeof(struct tcp_ao_hdr); + tcp_rsk(req)->used_tcp_ao = true; tcp_rsk(req)->ao_rcv_next = aoh->keyid; tcp_rsk(req)->ao_keyid = aoh->rnext_keyid; + } else { - tcp_rsk(req)->maclen = 0; + tcp_rsk(req)->used_tcp_ao = false; } #endif tcp_rsk(req)->snt_isn = isn; diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 93eef1dbbc55..f5ef15e1d9ac 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -3720,7 +3720,6 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, if (tcp_rsk_used_ao(req)) { #ifdef CONFIG_TCP_AO struct tcp_ao_key *ao_key = NULL; - u8 maclen = tcp_rsk(req)->maclen; u8 keyid = tcp_rsk(req)->ao_keyid; ao_key = tcp_sk(sk)->af_specific->ao_lookup(sk, req_to_sk(req), @@ -3730,13 +3729,11 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, * for another peer-matching key, but the peer has requested * ao_keyid (RFC5925 RNextKeyID), so let's keep it simple here. */ - if (unlikely(!ao_key || tcp_ao_maclen(ao_key) != maclen)) { - u8 key_maclen = ao_key ? tcp_ao_maclen(ao_key) : 0; - + if (unlikely(!ao_key)) { rcu_read_unlock(); kfree_skb(skb); - net_warn_ratelimited("TCP-AO: the keyid %u with maclen %u|%u from SYN packet is not present - not sending SYNACK\n", - keyid, maclen, key_maclen); + net_warn_ratelimited("TCP-AO: the keyid %u from SYN packet is not present - not sending SYNACK\n", + keyid); return NULL; } key.ao_key = ao_key;