Commit 9396c4ee authored by Dmitry Safonov's avatar Dmitry Safonov Committed by Paolo Abeni
Browse files

net/tcp: Don't store TCP-AO maclen on reqsk 



This extra check doesn't work for a handshake when SYN segment has
(current_key.maclen != rnext_key.maclen). It could be amended to
preserve rnext_key.maclen instead of current_key.maclen, but that
requires a lookup on listen socket.

Originally, this extra maclen check was introduced just because it was
cheap. Drop it and convert tcp_request_sock::maclen into boolean
tcp_request_sock::used_tcp_ao.

Fixes: 06b22ef2 ("net/tcp: Wire TCP-AO to request sockets")
Signed-off-by: default avatarDmitry Safonov <dima@arista.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 12083d72

include/linux/tcp.h

+2 −6
Original line number Diff line number Diff line
@@ -169,7 +169,7 @@ struct tcp_request_sock { 
#ifdef CONFIG_TCP_AO

	u8				ao_keyid;

	u8				ao_rcv_next;

	u8				maclen;

	bool				used_tcp_ao;

#endif

};
@@ -180,14 +180,10 @@ static inline struct tcp_request_sock *tcp_rsk(const struct request_sock *req) 


static inline bool tcp_rsk_used_ao(const struct request_sock *req)

{

	/* The real length of MAC is saved in the request socket,

	 * signing anything with zero-length makes no sense, so here is

	 * a little hack..

	 */

#ifndef CONFIG_TCP_AO

	return false;

#else

	return tcp_rsk(req)->maclen != 0;

	return tcp_rsk(req)->used_tcp_ao;

#endif

}

net/ipv4/tcp_ao.c

+2 −2
Original line number Diff line number Diff line
@@ -851,7 +851,7 @@ void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, 
	const struct tcp_ao_hdr *aoh;

	struct tcp_ao_key *key;



	treq->maclen = 0;

	treq->used_tcp_ao = false;



	if (tcp_parse_auth_options(th, NULL, &aoh) || !aoh)

		return;
@@ -863,7 +863,7 @@ void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, 


	treq->ao_rcv_next = aoh->keyid;

	treq->ao_keyid = aoh->rnext_keyid;

	treq->maclen = tcp_ao_maclen(key);

	treq->used_tcp_ao = true;

}



static enum skb_drop_reason

net/ipv4/tcp_input.c

+3 −2
Original line number Diff line number Diff line
@@ -7182,11 +7182,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, 
	if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh))

		goto drop_and_release; /* Invalid TCP options */

	if (aoh) {

		tcp_rsk(req)->maclen = aoh->length - sizeof(struct tcp_ao_hdr);

		tcp_rsk(req)->used_tcp_ao = true;

		tcp_rsk(req)->ao_rcv_next = aoh->keyid;

		tcp_rsk(req)->ao_keyid = aoh->rnext_keyid;



	} else {

		tcp_rsk(req)->maclen = 0;

		tcp_rsk(req)->used_tcp_ao = false;

	}

#endif

	tcp_rsk(req)->snt_isn = isn;

net/ipv4/tcp_output.c

+3 −6
Original line number Diff line number Diff line
@@ -3720,7 +3720,6 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, 
	if (tcp_rsk_used_ao(req)) {

#ifdef CONFIG_TCP_AO

		struct tcp_ao_key *ao_key = NULL;

		u8 maclen = tcp_rsk(req)->maclen;

		u8 keyid = tcp_rsk(req)->ao_keyid;



		ao_key = tcp_sk(sk)->af_specific->ao_lookup(sk, req_to_sk(req),
@@ -3730,13 +3729,11 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, 
		 * for another peer-matching key, but the peer has requested

		 * ao_keyid (RFC5925 RNextKeyID), so let's keep it simple here.

		 */

		if (unlikely(!ao_key || tcp_ao_maclen(ao_key) != maclen)) {

			u8 key_maclen = ao_key ? tcp_ao_maclen(ao_key) : 0;



		if (unlikely(!ao_key)) {

			rcu_read_unlock();

			kfree_skb(skb);

			net_warn_ratelimited("TCP-AO: the keyid %u with maclen %u|%u from SYN packet is not present - not sending SYNACK\n",

					     keyid, maclen, key_maclen);

			net_warn_ratelimited("TCP-AO: the keyid %u from SYN packet is not present - not sending SYNACK\n",

					     keyid);

			return NULL;

		}

		key.ao_key = ao_key;