netdev - Re: [PATCH net-next v13 07/19] net: tcp: allow tcp_timewait_sock to validate skbs before handing to device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iLkfEhGrLvCFMJi1qxrF2qJgHoceDBhPEC5hWnWffn_cw@mail.gmail.com>
Date: Wed, 17 Sep 2025 20:58:02 -0700
From: Eric Dumazet <edumazet@...gle.com>
To: Daniel Zahka <daniel.zahka@...il.com>
Cc: Donald Hunter <donald.hunter@...il.com>, Jakub Kicinski <kuba@...nel.org>, 
	"David S. Miller" <davem@...emloft.net>, Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, 
	Jonathan Corbet <corbet@....net>, Andrew Lunn <andrew+netdev@...n.ch>, 
	Saeed Mahameed <saeedm@...dia.com>, Leon Romanovsky <leon@...nel.org>, Tariq Toukan <tariqt@...dia.com>, 
	Boris Pismenny <borisp@...dia.com>, Kuniyuki Iwashima <kuniyu@...gle.com>, 
	Willem de Bruijn <willemb@...gle.com>, David Ahern <dsahern@...nel.org>, 
	Neal Cardwell <ncardwell@...gle.com>, Patrisious Haddad <phaddad@...dia.com>, Raed Salem <raeds@...dia.com>, 
	Jianbo Liu <jianbol@...dia.com>, Dragos Tatulea <dtatulea@...dia.com>, 
	Rahul Rameshbabu <rrameshbabu@...dia.com>, Stanislav Fomichev <sdf@...ichev.me>, 
	Toke Høiland-Jørgensen <toke@...hat.com>, 
	Alexander Lobakin <aleksander.lobakin@...el.com>, Kiran Kella <kiran.kella@...adcom.com>, 
	Jacob Keller <jacob.e.keller@...el.com>, netdev@...r.kernel.org
Subject: Re: [PATCH net-next v13 07/19] net: tcp: allow tcp_timewait_sock to
 validate skbs before handing to device

On Tue, Sep 16, 2025 at 5:10 PM Daniel Zahka <daniel.zahka@...il.com> wrote:
>
> Provide a callback to validate skb's originating from tcp timewait
> socks before passing to the device layer. Full socks have a
> sk_validate_xmit_skb member for checking that a device is capable of
> performing offloads required for transmitting an skb. With psp, tcp
> timewait socks will inherit the crypto state from their corresponding
> full socks. Any ACKs or RSTs that originate from a tcp timewait sock
> carrying psp state should be psp encapsulated.
>
> Reviewed-by: Willem de Bruijn <willemb@...gle.com>
> Signed-off-by: Daniel Zahka <daniel.zahka@...il.com>
> ---
>
> Notes:
>     v3:
>     - check for sk_is_inet() before casting to inet_twsk()
>     v2:
>     - patch introduced in v2
>
>  include/net/inet_timewait_sock.h |  5 +++++
>  net/core/dev.c                   | 14 ++++++++++++--
>  net/ipv4/inet_timewait_sock.c    |  3 +++
>  3 files changed, 20 insertions(+), 2 deletions(-)
>
> diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
> index c1295246216c..3a31c74c9e15 100644
> --- a/include/net/inet_timewait_sock.h
> +++ b/include/net/inet_timewait_sock.h
> @@ -84,6 +84,11 @@ struct inet_timewait_sock {
>  #if IS_ENABLED(CONFIG_INET_PSP)
>         struct psp_assoc __rcu    *psp_assoc;
>  #endif
> +#ifdef CONFIG_SOCK_VALIDATE_XMIT
> +       struct sk_buff*         (*tw_validate_xmit_skb)(struct sock *sk,
> +                                                       struct net_device *dev,
> +                                                       struct sk_buff *skb);

I guess we could use a single bit instead of a full pointer, as long
as the only user for this method is psp_validate_xmit()

This can be done later, incrementally.


> +#endif
>  };
>  #define tw_tclass tw_tos
>
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 384e59d7e715..5e22d062bac5 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -3915,10 +3915,20 @@ static struct sk_buff *sk_validate_xmit_skb(struct sk_buff *skb,
>                                             struct net_device *dev)
>  {
>  #ifdef CONFIG_SOCK_VALIDATE_XMIT
> +       struct sk_buff *(*sk_validate)(struct sock *sk, struct net_device *dev,
> +                                      struct sk_buff *skb);
>         struct sock *sk = skb->sk;
>
> -       if (sk && sk_fullsock(sk) && sk->sk_validate_xmit_skb) {
> -               skb = sk->sk_validate_xmit_skb(sk, dev, skb);
> +       sk_validate = NULL;
> +       if (sk) {
> +               if (sk_fullsock(sk))
> +                       sk_validate = sk->sk_validate_xmit_skb;
> +               else if (sk_is_inet(sk) && sk->sk_state == TCP_TIME_WAIT)

Interestingly, note that we check  TCP_TIME_WAIT in places where we do
not test sk_is_inet(),
like in sk_to_full_sk(). Time for an audit I guess.

Reviewed-by: Eric Dumazet <edumazet@...gle.com>