Message-Id: <cover.1628544649.git.cdleonard@gmail.com>
Date:   Tue, 10 Aug 2021 00:35:29 +0300
From:   Leonard Crestez <cdleonard@...il.com>
To:     Eric Dumazet <edumazet@...gle.com>,
        "David S. Miller" <davem@...emloft.net>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        Kuniyuki Iwashima <kuniyu@...zon.co.jp>,
        David Ahern <dsahern@...nel.org>
Cc:     Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        Jakub Kicinski <kuba@...nel.org>,
        Yuchung Cheng <ycheng@...gle.com>,
        Francesco Ruggeri <fruggeri@...sta.com>,
        Mat Martineau <mathew.j.martineau@...ux.intel.com>,
        Christoph Paasch <cpaasch@...le.com>,
        Ivan Delalande <colona@...sta.com>,
        Priyaranjan Jha <priyarjha@...gle.com>,
        Menglong Dong <dong.menglong@....com.cn>,
        linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org,
        netdev@...r.kernel.org
Subject: [RFCv2 0/9] tcp: Initial support for RFC5925 auth option

This is similar to TCP MD5 in functionality but it's sufficiently
different that userspace interface and wire formats are incompatible.
Compared to TCP-MD5 more algorithms are supported and multiple keys can
be used on the same connection but there is still no negotiation
mechanism. Expected use-case is protecting long-duration BGP/LDP
connections between routers using pre-shared keys.

This version is mostly functional though more testing is required. Many
obvious optimizations were skipped in favor of adding functionality.
Here are several flaws:

* RST and TIMEWAIT are mostly unhandled
* A lock might be required for tcp_authopt
* Sequence Number Extension not implemented
* User is responsible for ensuring keys do not overlap (could be fine)
* Traffic key is not cached (reducing performance)

Test suite used during development is here: https://github.com/cdleonard/tcp-authopt-test
Tests are written in python using pytest and scapy and check the API in
detail and validate packet captures.

Limited kselftest support for tcp_authopt in nettest/fcnal-test.sh is
also included in this series. Those tests are slow and cover very
little.

Changes for yabgp are here:
https://github.com/cdleonard/yabgp/commits/tcp_authopt
The patched version of yabgp can establish a BGP session protected by
TCP Authentication Option with a Cisco IOS-XR router.

Changes since RFC:
* Split into per-topic commits for ease of review. The intermediate
commits compile with a few "unused function" warnings and don't do
anything useful by themselves.
* Add ABI documention including kernel-doc on uapi
* Fix lockdep warnings from crypto by creating pools with one shash for
each cpu
* Accept short options to setsockopt by padding with zeros; this
approach allows increasing the size of the structs in the future.
* Support for aes-128-cmac-96
* Support for binding addresses to keys in a way similar to old tcp_md5
* Add support for retrieving received keyid/rnextkeyid and controling
the keyid/rnextkeyid being sent.

The key control support is not based on the requirements of any
particular app (a routing daemon) but rather the recommendations of
RFC5925. Several vendors implement key chain management similar to
RFC8177 but this belongs in userspace.

Previously: https://lore.kernel.org/netdev/01383a8751e97ef826ef2adf93bfde3a08195a43.1626693859.git.cdleonard@gmail.com/

Leonard Crestez (9):
  tcp: authopt: Initial support and key management
  docs: Add user documentation for tcp_authopt
  tcp: authopt: Add crypto initialization
  tcp: authopt: Compute packet signatures
  tcp: authopt: Hook into tcp core
  tcp: authopt: Add key selection controls
  tcp: authopt: Add snmp counters
  selftests: Initial TCP-AO support for nettest
  selftests: Initial TCP-AO support for fcnal-test

 Documentation/networking/index.rst        |    1 +
 Documentation/networking/tcp_authopt.rst  |   69 ++
 include/linux/tcp.h                       |    6 +
 include/net/tcp.h                         |    1 +
 include/net/tcp_authopt.h                 |  121 +++
 include/uapi/linux/snmp.h                 |    1 +
 include/uapi/linux/tcp.h                  |  103 ++
 net/ipv4/Kconfig                          |   14 +
 net/ipv4/Makefile                         |    1 +
 net/ipv4/proc.c                           |    1 +
 net/ipv4/tcp.c                            |   27 +
 net/ipv4/tcp_authopt.c                    | 1091 +++++++++++++++++++++
 net/ipv4/tcp_input.c                      |   17 +
 net/ipv4/tcp_ipv4.c                       |    5 +
 net/ipv4/tcp_minisocks.c                  |    2 +
 net/ipv4/tcp_output.c                     |   56 +-
 net/ipv6/tcp_ipv6.c                       |    4 +
 tools/testing/selftests/net/fcnal-test.sh |   22 +
 tools/testing/selftests/net/nettest.c     |   43 +-
 19 files changed, 1583 insertions(+), 2 deletions(-)
 create mode 100644 Documentation/networking/tcp_authopt.rst
 create mode 100644 include/net/tcp_authopt.h
 create mode 100644 net/ipv4/tcp_authopt.c


base-commit: 2a2b6e3640c43a808dcb5226963e2cc0669294b1
-- 
2.25.1

Powered by blists - more mailing lists