Commit 33cf7c90 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: add real socket cookies 



A long standing problem in netlink socket dumps is the use
of kernel socket addresses as cookies.

1) It is a security concern.

2) Sockets can be reused quite quickly, so there is
   no guarantee a cookie is used once and identify
   a flow.

3) request sock, establish sock, and timewait socks
   for a given flow have different cookies.

Part of our effort to bring better TCP statistics requires
to switch to a different allocator.

In this patch, I chose to use a per network namespace 64bit generator,
and to use it only in the case a socket needs to be dumped to netlink.
(This might be refined later if needed)

Note that I tried to carry cookies from request sock, to establish sock,
then timewait sockets.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Eric Salo <salo@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 654eff45

include/linux/sock_diag.h

+2 −2
Original line number Original line Diff line number Diff line
@@ -19,8 +19,8 @@ void sock_diag_unregister(const struct sock_diag_handler *h); 
void sock_diag_register_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh));

void sock_diag_register_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh));

void sock_diag_unregister_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh));

void sock_diag_unregister_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh));





int sock_diag_check_cookie(void *sk, const __u32 *cookie);

int sock_diag_check_cookie(struct sock *sk, const __u32 *cookie);

void sock_diag_save_cookie(void *sk, __u32 *cookie);

void sock_diag_save_cookie(struct sock *sk, __u32 *cookie);





int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);

int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);

int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk,

int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk,

include/net/inet_sock.h

+2 −0
Original line number Original line Diff line number Diff line
@@ -77,6 +77,8 @@ struct inet_request_sock { 
#define ir_v6_rmt_addr		req.__req_common.skc_v6_daddr

#define ir_v6_rmt_addr		req.__req_common.skc_v6_daddr

#define ir_v6_loc_addr		req.__req_common.skc_v6_rcv_saddr

#define ir_v6_loc_addr		req.__req_common.skc_v6_rcv_saddr

#define ir_iif			req.__req_common.skc_bound_dev_if

#define ir_iif			req.__req_common.skc_bound_dev_if

#define ir_cookie		req.__req_common.skc_cookie

#define ireq_net		req.__req_common.skc_net





	kmemcheck_bitfield_begin(flags);

	kmemcheck_bitfield_begin(flags);

	u16			snd_wscale : 4,

	u16			snd_wscale : 4,

include/net/inet_timewait_sock.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -122,6 +122,7 @@ struct inet_timewait_sock { 
#define tw_v6_rcv_saddr    	__tw_common.skc_v6_rcv_saddr

#define tw_v6_rcv_saddr    	__tw_common.skc_v6_rcv_saddr

#define tw_dport		__tw_common.skc_dport

#define tw_dport		__tw_common.skc_dport

#define tw_num			__tw_common.skc_num

#define tw_num			__tw_common.skc_num

#define tw_cookie		__tw_common.skc_cookie





	int			tw_timeout;

	int			tw_timeout;

	volatile unsigned char	tw_substate;

	volatile unsigned char	tw_substate;

include/net/net_namespace.h

+2 −0
Original line number Original line Diff line number Diff line
@@ -56,6 +56,8 @@ struct net { 
#endif

#endif

	spinlock_t		rules_mod_lock;

	spinlock_t		rules_mod_lock;





	atomic64_t		cookie_gen;



	struct list_head	list;		/* list of network namespaces */

	struct list_head	list;		/* list of network namespaces */

	struct list_head	cleanup_list;	/* namespaces on death row */

	struct list_head	cleanup_list;	/* namespaces on death row */

	struct list_head	exit_list;	/* Use only net_mutex */

	struct list_head	exit_list;	/* Use only net_mutex */

include/net/sock.h

+3 −0
Original line number Original line Diff line number Diff line
@@ -199,6 +199,8 @@ struct sock_common { 
	struct in6_addr		skc_v6_rcv_saddr;

	struct in6_addr		skc_v6_rcv_saddr;

#endif

#endif





	atomic64_t		skc_cookie;



	/*

	/*

	 * fields between dontcopy_begin/dontcopy_end

	 * fields between dontcopy_begin/dontcopy_end

	 * are not copied in sock_copy()

	 * are not copied in sock_copy()
@@ -329,6 +331,7 @@ struct sock { 
#define sk_net			__sk_common.skc_net

#define sk_net			__sk_common.skc_net

#define sk_v6_daddr		__sk_common.skc_v6_daddr

#define sk_v6_daddr		__sk_common.skc_v6_daddr

#define sk_v6_rcv_saddr	__sk_common.skc_v6_rcv_saddr

#define sk_v6_rcv_saddr	__sk_common.skc_v6_rcv_saddr

#define sk_cookie		__sk_common.skc_cookie





	socket_lock_t		sk_lock;

	socket_lock_t		sk_lock;

	struct sk_buff_head	sk_receive_queue;

	struct sk_buff_head	sk_receive_queue;

CRA Git | Maintained and supported by SUSTech CRA and CCSE