| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-id: <20180105011516.GH20876@Chimay.local>
Date: Thu, 04 Jan 2018 17:15:16 -0800
From: Christoph Paasch <cpaasch@...le.com>
To: Mat Martineau <mathew.j.martineau@...ux.intel.com>
Cc: netdev@...r.kernel.org, Eric Dumazet <edumazet@...gle.com>,
Alexei Starovoitov <ast@...nel.org>
Subject: Re: [RFC 11/14] tcp_md5: Move TCP-MD5 code out of TCP itself
Hello Mat,
On 02/01/18 - 11:39:23, Mat Martineau wrote:
>
> Hi Christoph -
>
> On Mon, 18 Dec 2017, Christoph Paasch wrote:
>
> > This is all just copy-pasting the TCP_MD5-code into functions that are
> > placed in net/ipv4/tcp_md5.c.
> >
> > Signed-off-by: Christoph Paasch <cpaasch@...le.com>
> > Reviewed-by: Mat Martineau <mathew.j.martineau@...ux.intel.com>
> > ---
> > include/linux/inet_diag.h | 1 +
> > include/linux/tcp_md5.h | 138 ++++++
> > include/net/tcp.h | 77 ----
> > net/ipv4/Makefile | 1 +
> > net/ipv4/tcp.c | 133 +-----
> > net/ipv4/tcp_diag.c | 81 +---
> > net/ipv4/tcp_input.c | 38 --
> > net/ipv4/tcp_ipv4.c | 520 ++-------------------
> > net/ipv4/tcp_md5.c | 1102 +++++++++++++++++++++++++++++++++++++++++++++
> > net/ipv4/tcp_minisocks.c | 27 +-
> > net/ipv4/tcp_output.c | 4 +-
> > net/ipv6/tcp_ipv6.c | 318 +------------
> > 12 files changed, 1305 insertions(+), 1135 deletions(-)
> > create mode 100644 include/linux/tcp_md5.h
> > create mode 100644 net/ipv4/tcp_md5.c
>
> ...
>
> > diff --git a/include/linux/tcp_md5.h b/include/linux/tcp_md5.h
> > new file mode 100644
> > index 000000000000..f6a681cdded4
> > --- /dev/null
> > +++ b/include/linux/tcp_md5.h
> > @@ -0,0 +1,138 @@
>
> There's no license info in this new file. Take a look at the SPDX
> identifiers recently added as the first line of some files (like
> tcp_vegas.h) for one way to do it.
Thanks, I added the SPDX-identifier line.
>
>
> > +#ifndef _LINUX_TCP_MD5_H
> > +#define _LINUX_TCP_MD5_H
> > +
> > +#include <linux/skbuff.h>
> > +
> > +#ifdef CONFIG_TCP_MD5SIG
> > +#include <linux/types.h>
> > +
> > +#include <net/tcp.h>
> > +
> > +union tcp_md5_addr {
> > + struct in_addr a4;
> > +#if IS_ENABLED(CONFIG_IPV6)
> > + struct in6_addr a6;
> > +#endif
> > +};
> > +
> > +/* - key database */
> > +struct tcp_md5sig_key {
> > + struct hlist_node node;
> > + u8 keylen;
> > + u8 family; /* AF_INET or AF_INET6 */
> > + union tcp_md5_addr addr;
> > + u8 prefixlen;
> > + u8 key[TCP_MD5SIG_MAXKEYLEN];
> > + struct rcu_head rcu;
> > +};
> > +
> > +/* - sock block */
> > +struct tcp_md5sig_info {
> > + struct hlist_head head;
> > + struct rcu_head rcu;
> > +};
> > +
> > +union tcp_md5sum_block {
> > + struct tcp4_pseudohdr ip4;
> > +#if IS_ENABLED(CONFIG_IPV6)
> > + struct tcp6_pseudohdr ip6;
> > +#endif
> > +};
> > +
> > +/* - pool: digest algorithm, hash description and scratch buffer */
> > +struct tcp_md5sig_pool {
> > + struct ahash_request *md5_req;
> > + void *scratch;
> > +};
> > +
> > +extern const struct tcp_sock_af_ops tcp_sock_ipv4_specific;
> > +extern const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
> > +extern const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
> > +
> > +/* - functions */
> > +int tcp_v4_md5_hash_skb(char *md5_hash, const struct tcp_md5sig_key *key,
> > + const struct sock *sk, const struct sk_buff *skb);
> > +
> > +struct tcp_md5sig_key *tcp_v4_md5_lookup(const struct sock *sk,
> > + const struct sock *addr_sk);
> > +
> > +void tcp_v4_md5_destroy_sock(struct sock *sk);
> > +
> > +int tcp_v4_md5_send_response_prepare(struct sk_buff *skb, u8 flags,
> > + unsigned int remaining,
> > + struct tcp_out_options *opts,
> > + const struct sock *sk);
> > +
> > +void tcp_v4_md5_send_response_write(__be32 *topt, struct sk_buff *skb,
> > + struct tcphdr *t1,
> > + struct tcp_out_options *opts,
> > + const struct sock *sk);
> > +
> > +int tcp_v6_md5_send_response_prepare(struct sk_buff *skb, u8 flags,
> > + unsigned int remaining,
> > + struct tcp_out_options *opts,
> > + const struct sock *sk);
> > +
> > +void tcp_v6_md5_send_response_write(__be32 *topt, struct sk_buff *skb,
> > + struct tcphdr *t1,
> > + struct tcp_out_options *opts,
> > + const struct sock *sk);
> > +
> > +bool tcp_v4_inbound_md5_hash(const struct sock *sk,
> > + const struct sk_buff *skb);
> > +
> > +void tcp_v4_md5_syn_recv_sock(const struct sock *listener, struct sock *sk);
> > +
> > +void tcp_v6_md5_syn_recv_sock(const struct sock *listener, struct sock *sk);
> > +
> > +void tcp_md5_time_wait(struct sock *sk, struct inet_timewait_sock *tw);
> > +
> > +struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
> > + const struct sock *addr_sk);
> > +
> > +int tcp_v6_md5_hash_skb(char *md5_hash,
> > + const struct tcp_md5sig_key *key,
> > + const struct sock *sk,
> > + const struct sk_buff *skb);
> > +
> > +bool tcp_v6_inbound_md5_hash(const struct sock *sk,
> > + const struct sk_buff *skb);
> > +
> > +static inline void tcp_md5_twsk_destructor(struct sock *sk)
> > +{
> > + struct tcp_timewait_sock *twsk = tcp_twsk(sk);
> > +
> > + if (twsk->tw_md5_key)
> > + kfree_rcu(twsk->tw_md5_key, rcu);
> > +}
> > +
> > +static inline void tcp_md5_add_header_len(const struct sock *listener,
> > + struct sock *sk)
> > +{
> > + struct tcp_sock *tp = tcp_sk(sk);
> > +
> > + if (tp->af_specific->md5_lookup(listener, sk))
> > + tp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
> > +}
> > +
> > +int tcp_md5_diag_get_aux(struct sock *sk, bool net_admin, struct sk_buff *skb);
> > +
> > +int tcp_md5_diag_get_aux_size(struct sock *sk, bool net_admin);
> > +
> > +#else
> > +
> > +static inline bool tcp_v4_inbound_md5_hash(const struct sock *sk,
> > + const struct sk_buff *skb)
> > +{
> > + return false;
> > +}
> > +
> > +static inline bool tcp_v6_inbound_md5_hash(const struct sock *sk,
> > + const struct sk_buff *skb)
> > +{
> > + return false;
> > +}
> > +
> > +#endif
> > +
> > +#endif /* _LINUX_TCP_MD5_H */
>
> ...
>
> > diff --git a/net/ipv4/tcp_md5.c b/net/ipv4/tcp_md5.c
> > new file mode 100644
> > index 000000000000..a31b404e6dbf
> > --- /dev/null
> > +++ b/net/ipv4/tcp_md5.c
> > @@ -0,0 +1,1102 @@
>
> This new file needs license info too, maybe a SPDX identifier like
> tcp_input.c
Same here, added the SPDX-line.
Thanks for spotting this.
Christoph
Powered by blists - more mailing lists