linux-kernel - Re: [PATCH net-next 03/10] net/tcp: Move tcp_inbound

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240226204142.GJ13129@kernel.org>
Date: Mon, 26 Feb 2024 20:41:42 +0000
From: Simon Horman <horms@...nel.org>
To: Dmitry Safonov <dima@...sta.com>
Cc: Eric Dumazet <edumazet@...gle.com>,
	"David S. Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	David Ahern <dsahern@...nel.org>, Shuah Khan <shuah@...nel.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-kselftest@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
	Dmitry Safonov <0x7f454c46@...il.com>
Subject: Re: [PATCH net-next 03/10] net/tcp: Move tcp_inbound_hash() from
 headers

On Sat, Feb 24, 2024 at 09:04:11AM +0000, Dmitry Safonov wrote:
> Two reasons:
> 1. It's grown up enough
> 2. In order to not do header spaghetti by including
>    <trace/events/tcp.h>, which is necessary for TCP tracepoints.
> 
> Signed-off-by: Dmitry Safonov <dima@...sta.com>

..

> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index c82dc42f57c6..5fd61ae6bcc9 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -4485,6 +4485,78 @@ EXPORT_SYMBOL(tcp_inbound_md5_hash);
>  
>  #endif
>  
> +/* Called with rcu_read_lock() */
> +enum skb_drop_reason
> +tcp_inbound_hash(struct sock *sk, const struct request_sock *req,
> +		 const struct sk_buff *skb,
> +		 const void *saddr, const void *daddr,
> +		 int family, int dif, int sdif)
> +{
> +	const struct tcphdr *th = tcp_hdr(skb);
> +	const struct tcp_ao_hdr *aoh;
> +	const __u8 *md5_location;
> +	int l3index;
> +
> +	/* Invalid option or two times meet any of auth options */
> +	if (tcp_parse_auth_options(th, &md5_location, &aoh)) {
> +		tcp_hash_fail("TCP segment has incorrect auth options set",
> +			      family, skb, "");
> +		return SKB_DROP_REASON_TCP_AUTH_HDR;
> +	}
> +
> +	if (req) {
> +		if (tcp_rsk_used_ao(req) != !!aoh) {
> +			u8 keyid, rnext, maclen;
> +
> +			if (aoh) {
> +				keyid = aoh->keyid;
> +				rnext = aoh->rnext_keyid;
> +				maclen = tcp_ao_hdr_maclen(aoh);
> +			} else {
> +				keyid = rnext = maclen = 0;
> +			}

Hi Dmitry,

it looks like keyid is set but otherwise unused.

Flagged by W=1 builds with gcc-13 and clang-17.

> +
> +			NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOBAD);
> +			tcp_hash_fail("TCP connection can't start/end using TCP-AO",
> +				      family, skb, "%s",
> +				      !aoh ? "missing AO" : "AO signed");
> +			return SKB_DROP_REASON_TCP_AOFAILURE;
> +		}
> +	}
> +
> +	/* sdif set, means packet ingressed via a device
> +	 * in an L3 domain and dif is set to the l3mdev
> +	 */
> +	l3index = sdif ? dif : 0;
> +
> +	/* Fast path: unsigned segments */
> +	if (likely(!md5_location && !aoh)) {
> +		/* Drop if there's TCP-MD5 or TCP-AO key with any rcvid/sndid
> +		 * for the remote peer. On TCP-AO established connection
> +		 * the last key is impossible to remove, so there's
> +		 * always at least one current_key.
> +		 */
> +		if (tcp_ao_required(sk, saddr, family, l3index, true)) {
> +			tcp_hash_fail("AO hash is required, but not found",
> +					family, skb, "L3 index %d", l3index);
> +			return SKB_DROP_REASON_TCP_AONOTFOUND;
> +		}
> +		if (unlikely(tcp_md5_do_lookup(sk, l3index, saddr, family))) {
> +			NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
> +			tcp_hash_fail("MD5 Hash not found",
> +				      family, skb, "L3 index %d", l3index);
> +			return SKB_DROP_REASON_TCP_MD5NOTFOUND;
> +		}
> +		return SKB_NOT_DROPPED_YET;
> +	}
> +
> +	if (aoh)
> +		return tcp_inbound_ao_hash(sk, skb, family, req, l3index, aoh);
> +
> +	return tcp_inbound_md5_hash(sk, skb, saddr, daddr, family,
> +				    l3index, md5_location);
> +}
> +
>  void tcp_done(struct sock *sk)
>  {
>  	struct request_sock *req;
> 
> -- 
> 2.43.0
> 
>