Commit 33700a0c authored by Dmitry Safonov's avatar Dmitry Safonov Committed by Jakub Kicinski
Browse files

net/tcp: Don't consider TCP_CLOSE in TCP_AO_ESTABLISHED 



TCP_CLOSE may or may not have current/rnext keys and should not be
considered "established". The fast-path for TCP_CLOSE is
SKB_DROP_REASON_TCP_CLOSE. This is what tcp_rcv_state_process() does
anyways. Add an early drop path to not spend any time verifying
segment signatures for sockets in TCP_CLOSE state.

Cc: stable@vger.kernel.org # v6.7
Fixes: 0a3a8090 ("net/tcp: Verify inbound TCP-AO signed segments")
Signed-off-by: default avatarDmitry Safonov <0x7f454c46@gmail.com>
Link: https://lore.kernel.org/r/20240529-tcp_ao-sk_state-v1-1-d69b5d323c52@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent e85e271d

include/net/tcp_ao.h

+4 −3
Original line number Diff line number Diff line
@@ -86,7 +86,8 @@ static inline int tcp_ao_sizeof_key(const struct tcp_ao_key *key) 
struct tcp_ao_info {

	/* List of tcp_ao_key's */

	struct hlist_head	head;

	/* current_key and rnext_key aren't maintained on listen sockets.

	/* current_key and rnext_key are maintained on sockets

	 * in TCP_AO_ESTABLISHED states.

	 * Their purpose is to cache keys on established connections,

	 * saving needless lookups. Never dereference any of them from

	 * listen sockets.
@@ -201,9 +202,9 @@ struct tcp6_ao_context { 
};



struct tcp_sigpool;

/* Established states are fast-path and there always is current_key/rnext_key */

#define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \

			    TCPF_CLOSE | TCPF_CLOSE_WAIT | \

			    TCPF_LAST_ACK | TCPF_CLOSING)

			    TCPF_CLOSE_WAIT | TCPF_LAST_ACK | TCPF_CLOSING)



int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,

			struct tcp_ao_key *key, struct tcphdr *th,

net/ipv4/tcp_ao.c

+9 −4
Original line number Diff line number Diff line
@@ -933,6 +933,7 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb, 
	struct tcp_ao_key *key;

	__be32 sisn, disn;

	u8 *traffic_key;

	int state;

	u32 sne = 0;



	info = rcu_dereference(tcp_sk(sk)->ao_info);
@@ -948,8 +949,9 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb, 
		disn = 0;

	}



	state = READ_ONCE(sk->sk_state);

	/* Fast-path */

	if (likely((1 << sk->sk_state) & TCP_AO_ESTABLISHED)) {

	if (likely((1 << state) & TCP_AO_ESTABLISHED)) {

		enum skb_drop_reason err;

		struct tcp_ao_key *current_key;
@@ -988,6 +990,9 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb, 
		return SKB_NOT_DROPPED_YET;

	}



	if (unlikely(state == TCP_CLOSE))

		return SKB_DROP_REASON_TCP_CLOSE;



	/* Lookup key based on peer address and keyid.

	 * current_key and rnext_key must not be used on tcp listen

	 * sockets as otherwise:
@@ -1001,7 +1006,7 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb, 
	if (th->syn && !th->ack)

		goto verify_hash;



	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_NEW_SYN_RECV)) {

	if ((1 << state) & (TCPF_LISTEN | TCPF_NEW_SYN_RECV)) {

		/* Make the initial syn the likely case here */

		if (unlikely(req)) {

			sne = tcp_ao_compute_sne(0, tcp_rsk(req)->rcv_isn,
@@ -1018,14 +1023,14 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb, 
			/* no way to figure out initial sisn/disn - drop */

			return SKB_DROP_REASON_TCP_FLAGS;

		}

	} else if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {

	} else if ((1 << state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {

		disn = info->lisn;

		if (th->syn || th->rst)

			sisn = th->seq;

		else

			sisn = info->risn;

	} else {

		WARN_ONCE(1, "TCP-AO: Unexpected sk_state %d", sk->sk_state);

		WARN_ONCE(1, "TCP-AO: Unexpected sk_state %d", state);

		return SKB_DROP_REASON_TCP_AOFAILURE;

	}

verify_hash: