Commit 7753c2f0 authored by Dmitry Safonov's avatar Dmitry Safonov Committed by David S. Miller
Browse files

net/tcp: Add option for TCP-AO to (not) hash header 



Provide setsockopt() key flag that makes TCP-AO exclude hashing TCP
header for peers that match the key. This is needed for interraction
with middleboxes that may change TCP options, see RFC5925 (9.2).

Co-developed-by: default avatarFrancesco Ruggeri <fruggeri@arista.com>
Signed-off-by: default avatarFrancesco Ruggeri <fruggeri@arista.com>
Co-developed-by: default avatarSalam Noureddine <noureddine@arista.com>
Signed-off-by: default avatarSalam Noureddine <noureddine@arista.com>
Signed-off-by: default avatarDmitry Safonov <dima@arista.com>
Acked-by: default avatarDavid Ahern <dsahern@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 953af8e3

include/uapi/linux/tcp.h

+5 −0
Original line number Diff line number Diff line
@@ -367,6 +367,11 @@ struct tcp_diag_md5sig { 
#define TCP_AO_MAXKEYLEN	80



#define TCP_AO_KEYF_IFINDEX	(1 << 0)	/* L3 ifindex for VRF */

#define TCP_AO_KEYF_EXCLUDE_OPT	(1 << 1)	/* "Indicates whether TCP

						 *  options other than TCP-AO

						 *  are included in the MAC

						 *  calculation"

						 */



struct tcp_ao_add { /* setsockopt(TCP_AO_ADD_KEY) */

	struct __kernel_sockaddr_storage addr;	/* peer's address for the key */

net/ipv4/tcp_ao.c

+5 −3
Original line number Diff line number Diff line
@@ -562,7 +562,8 @@ int tcp_ao_hash_hdr(unsigned short int family, char *ao_hash, 
		WARN_ON_ONCE(1);

		goto clear_hash;

	}

	if (tcp_ao_hash_header(&hp, th, false,

	if (tcp_ao_hash_header(&hp, th,

			       !!(key->keyflags & TCP_AO_KEYF_EXCLUDE_OPT),

			       ao_hash, hash_offset, tcp_ao_maclen(key)))

		goto clear_hash;

	ahash_request_set_crypt(hp.req, NULL, hash_buf, 0);
@@ -610,7 +611,8 @@ int tcp_ao_hash_skb(unsigned short int family, 
		goto clear_hash;

	if (tcp_ao_hash_pseudoheader(family, sk, skb, &hp, skb->len))

		goto clear_hash;

	if (tcp_ao_hash_header(&hp, th, false,

	if (tcp_ao_hash_header(&hp, th,

			       !!(key->keyflags & TCP_AO_KEYF_EXCLUDE_OPT),

			       ao_hash, hash_offset, tcp_ao_maclen(key)))

		goto clear_hash;

	if (tcp_sigpool_hash_skb_data(&hp, skb, th->doff << 2))
@@ -1454,7 +1456,7 @@ static struct tcp_ao_info *setsockopt_ao_info(struct sock *sk) 
	return ERR_PTR(-ESOCKTNOSUPPORT);

}



#define TCP_AO_KEYF_ALL		(0)

#define TCP_AO_KEYF_ALL		(TCP_AO_KEYF_EXCLUDE_OPT)



static struct tcp_ao_key *tcp_ao_key_alloc(struct sock *sk,

					   struct tcp_ao_add *cmd)