lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20231124002720.102537-1-dima@arista.com> Date: Fri, 24 Nov 2023 00:27:13 +0000 From: Dmitry Safonov <dima@...sta.com> To: David Ahern <dsahern@...nel.org>, Eric Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>, Jakub Kicinski <kuba@...nel.org>, "David S. Miller" <davem@...emloft.net> Cc: linux-kernel@...r.kernel.org, Dmitry Safonov <dima@...sta.com>, Dmitry Safonov <0x7f454c46@...il.com>, Francesco Ruggeri <fruggeri05@...il.com>, Salam Noureddine <noureddine@...sta.com>, Simon Horman <horms@...nel.org>, netdev@...r.kernel.org Subject: [PATCH v2 0/7] TCP-AO fixes Hi, Changes from v1: - Use tcp_can_repair_sock() helper to limit TCP_AO_REPAIR (Eric) - Instead of hook to listen() syscall, allow removing current/rnext keys on TCP_LISTEN (addressing Eric's objection) - Add sne_lock to protect snd_sne/rcv_sne - Don't move used_tcp_ao in struct tcp_request_sock (Eric) I've been working on TCP-AO key-rotation selftests and as a result exercised some corner-cases that are not usually met in production. Here are a bunch of semi-related fixes: - Documentation typo (reported by Markus Elfring) - Proper alignment for TCP-AO option in TCP header that has MAC length of non 4 bytes (now a selftest with randomized maclen/algorithm/etc passes) - 3 uAPI restricting patches that disallow more things to userspace in order to prevent it shooting itself in any parts of the body - SNEs READ_ONCE()/WRITE_ONCE() that went missing by my human factor - Avoid storing MAC length from SYN header as SYN-ACK will use rnext_key.maclen (drops an extra check that fails on new selftests) Please, consider applying/pulling. The following changes since commit d3fa86b1a7b4cdc4367acacea16b72e0a200b3d7: Merge tag 'net-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2023-11-23 10:40:13 -0800) are available in the Git repository at: git@...hub.com:0x7f454c46/linux.git tcp-ao-post-merge-v2 for you to fetch changes up to c5e4cecfcdc7f996acae740812d9ab2ebcd90517: net/tcp: Don't store TCP-AO maclen on reqsk (2023-11-23 20:54:54 +0000) ---------------------------------------------------------------- Thanks, Dmitry Cc: David Ahern <dsahern@...nel.org> Cc: "David S. Miller" <davem@...emloft.net> Cc: Dmitry Safonov <0x7f454c46@...il.com> Cc: Eric Dumazet <edumazet@...gle.com> Cc: Francesco Ruggeri <fruggeri05@...il.com> Cc: Jakub Kicinski <kuba@...nel.org> Cc: Paolo Abeni <pabeni@...hat.com> Cc: Salam Noureddine <noureddine@...sta.com> Cc: Simon Horman <horms@...nel.org> Cc: netdev@...r.kernel.org Cc: linux-kernel@...r.kernel.org Dmitry Safonov (7): Documentation/tcp: Fix an obvious typo net/tcp: Consistently align TCP-AO option in the header net/tcp: Limit TCP_AO_REPAIR to non-listen sockets net/tcp: Allow removing current/rnext TCP-AO keys on TCP_LISTEN sockets net/tcp: Don't add key with non-matching VRF on connected sockets net/tcp: Add sne_lock to access SNEs net/tcp: Don't store TCP-AO maclen on reqsk Documentation/networking/tcp_ao.rst | 2 +- include/linux/tcp.h | 8 +--- include/net/tcp_ao.h | 8 +++- net/ipv4/tcp.c | 6 +++ net/ipv4/tcp_ao.c | 57 +++++++++++++++++++---------- net/ipv4/tcp_input.c | 21 +++++++++-- net/ipv4/tcp_ipv4.c | 4 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 15 +++----- net/ipv6/tcp_ipv6.c | 2 +- 10 files changed, 81 insertions(+), 44 deletions(-) base-commit: d3fa86b1a7b4cdc4367acacea16b72e0a200b3d7 -- 2.43.0
Powered by blists - more mailing lists