lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 Nov 2023 00:27:13 +0000
From: Dmitry Safonov <>
To: David Ahern <>,
	Eric Dumazet <>,
	Paolo Abeni <>,
	Jakub Kicinski <>,
	"David S. Miller" <>
	Dmitry Safonov <>,
	Dmitry Safonov <>,
	Francesco Ruggeri <>,
	Salam Noureddine <>,
	Simon Horman <>,
Subject: [PATCH v2 0/7] TCP-AO fixes


Changes from v1:
- Use tcp_can_repair_sock() helper to limit TCP_AO_REPAIR (Eric)
- Instead of hook to listen() syscall, allow removing current/rnext keys
  on TCP_LISTEN (addressing Eric's objection)
- Add sne_lock to protect snd_sne/rcv_sne
- Don't move used_tcp_ao in struct tcp_request_sock (Eric)

I've been working on TCP-AO key-rotation selftests and as a result
exercised some corner-cases that are not usually met in production.

Here are a bunch of semi-related fixes:
- Documentation typo (reported by Markus Elfring)
- Proper alignment for TCP-AO option in TCP header that has MAC length
  of non 4 bytes (now a selftest with randomized maclen/algorithm/etc
- 3 uAPI restricting patches that disallow more things to userspace in
  order to prevent it shooting itself in any parts of the body
- SNEs READ_ONCE()/WRITE_ONCE() that went missing by my human factor
- Avoid storing MAC length from SYN header as SYN-ACK will use
  rnext_key.maclen (drops an extra check that fails on new selftests)

Please, consider applying/pulling.

The following changes since commit d3fa86b1a7b4cdc4367acacea16b72e0a200b3d7:

  Merge tag 'net-6.7-rc3' of git:// (2023-11-23 10:40:13 -0800)

are available in the Git repository at: tcp-ao-post-merge-v2

for you to fetch changes up to c5e4cecfcdc7f996acae740812d9ab2ebcd90517:

  net/tcp: Don't store TCP-AO maclen on reqsk (2023-11-23 20:54:54 +0000)



Cc: David Ahern <>
Cc: "David S. Miller" <>
Cc: Dmitry Safonov <>
Cc: Eric Dumazet <>
Cc: Francesco Ruggeri <>
Cc: Jakub Kicinski <>
Cc: Paolo Abeni <>
Cc: Salam Noureddine <>
Cc: Simon Horman <>

Dmitry Safonov (7):
  Documentation/tcp: Fix an obvious typo
  net/tcp: Consistently align TCP-AO option in the header
  net/tcp: Limit TCP_AO_REPAIR to non-listen sockets
  net/tcp: Allow removing current/rnext TCP-AO keys on TCP_LISTEN sockets
  net/tcp: Don't add key with non-matching VRF on connected sockets
  net/tcp: Add sne_lock to access SNEs
  net/tcp: Don't store TCP-AO maclen on reqsk

 Documentation/networking/tcp_ao.rst |  2 +-
 include/linux/tcp.h                 |  8 +---
 include/net/tcp_ao.h                |  8 +++-
 net/ipv4/tcp.c                      |  6 +++
 net/ipv4/tcp_ao.c                   | 57 +++++++++++++++++++----------
 net/ipv4/tcp_input.c                | 21 +++++++++--
 net/ipv4/tcp_ipv4.c                 |  4 +-
 net/ipv4/tcp_minisocks.c            |  2 +-
 net/ipv4/tcp_output.c               | 15 +++-----
 net/ipv6/tcp_ipv6.c                 |  2 +-
 10 files changed, 81 insertions(+), 44 deletions(-)

base-commit: d3fa86b1a7b4cdc4367acacea16b72e0a200b3d7

Powered by blists - more mailing lists