Commit 7a8d8a46 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'tcp-Add-support-for-L3-domains-to-MD5-auth' 



David Ahern says:

====================
tcp: Add support for L3 domains to MD5 auth

With VRF, the scope of network addresses is limited to the L3 domain
the device is associated. MD5 keys are based on addresses, so proper
VRF support requires an L3 domain to be considered for the lookups.

Leverage the new TCP_MD5SIG_EXT option to add support for a device index
to MD5 keys. The __tcpm_pad entry in tcp_md5sig is renamed to tcpm_ifindex
and a new flag, TCP_MD5SIG_FLAG_IFINDEX, in tcpm_flags determines if the
entry is examined. This follows what was done for MD5 and prefixes with
commits
   8917a777 ("tcp: md5: add TCP_MD5SIG_EXT socket option to set a key address prefix")
   6797318e ("tcp: md5: add an address prefix for key lookup")

Handling both a device AND L3 domain is much more complicated for the
response paths. This set focuses only on L3 support - requiring the
device index to be an l3mdev (ie, VRF). Support for slave devices can
be added later if desired, much like the progression of support for
sockets bound to a VRF and then bound to a device in a VRF. Kernel
code is setup to explicitly call out that current lookup is for an L3
index, while the uapi just references a device index allowing its
meaning to include other devices in the future.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 98c81476 5cad8bce

include/net/tcp.h

+12 −12
Original line number Diff line number Diff line
@@ -1532,8 +1532,9 @@ struct tcp_md5sig_key { 
	struct hlist_node	node;

	u8			keylen;

	u8			family; /* AF_INET or AF_INET6 */

	union tcp_md5_addr	addr;

	u8			prefixlen;

	union tcp_md5_addr	addr;

	int			l3index; /* set if key added with L3 scope */

	u8			key[TCP_MD5SIG_MAXKEYLEN];

	struct rcu_head		rcu;

};
@@ -1577,34 +1578,33 @@ struct tcp_md5sig_pool { 
int tcp_v4_md5_hash_skb(char *md5_hash, const struct tcp_md5sig_key *key,

			const struct sock *sk, const struct sk_buff *skb);

int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,

		   int family, u8 prefixlen, const u8 *newkey, u8 newkeylen,

		   gfp_t gfp);

		   int family, u8 prefixlen, int l3index,

		   const u8 *newkey, u8 newkeylen, gfp_t gfp);

int tcp_md5_do_del(struct sock *sk, const union tcp_md5_addr *addr,

		   int family, u8 prefixlen);

		   int family, u8 prefixlen, int l3index);

struct tcp_md5sig_key *tcp_v4_md5_lookup(const struct sock *sk,

					 const struct sock *addr_sk);



#ifdef CONFIG_TCP_MD5SIG

#include <linux/jump_label.h>

extern struct static_key_false tcp_md5_needed;

struct tcp_md5sig_key *__tcp_md5_do_lookup(const struct sock *sk,

struct tcp_md5sig_key *__tcp_md5_do_lookup(const struct sock *sk, int l3index,

					   const union tcp_md5_addr *addr,

					   int family);

static inline struct tcp_md5sig_key *

tcp_md5_do_lookup(const struct sock *sk,

		  const union tcp_md5_addr *addr,

		  int family)

tcp_md5_do_lookup(const struct sock *sk, int l3index,

		  const union tcp_md5_addr *addr, int family)

{

	if (!static_branch_unlikely(&tcp_md5_needed))

		return NULL;

	return __tcp_md5_do_lookup(sk, addr, family);

	return __tcp_md5_do_lookup(sk, l3index, addr, family);

}



#define tcp_twsk_md5_key(twsk)	((twsk)->tw_md5_key)

#else

static inline struct tcp_md5sig_key *tcp_md5_do_lookup(const struct sock *sk,

					 const union tcp_md5_addr *addr,

					 int family)

static inline struct tcp_md5sig_key *

tcp_md5_do_lookup(const struct sock *sk, int l3index,

		  const union tcp_md5_addr *addr, int family)

{

	return NULL;

}

include/uapi/linux/tcp.h

+3 −2
Original line number Diff line number Diff line
@@ -317,14 +317,15 @@ enum { 
#define TCP_MD5SIG_MAXKEYLEN	80



/* tcp_md5sig extension flags for TCP_MD5SIG_EXT */

#define TCP_MD5SIG_FLAG_PREFIX		1	/* address prefix length */

#define TCP_MD5SIG_FLAG_PREFIX		0x1	/* address prefix length */

#define TCP_MD5SIG_FLAG_IFINDEX		0x2	/* ifindex set */



struct tcp_md5sig {

	struct __kernel_sockaddr_storage tcpm_addr;	/* address associated */

	__u8	tcpm_flags;				/* extension flags */

	__u8	tcpm_prefixlen;				/* address prefix */

	__u16	tcpm_keylen;				/* key length */

	__u32	__tcpm_pad;				/* zero */

	int	tcpm_ifindex;				/* device index for scope */

	__u8	tcpm_key[TCP_MD5SIG_MAXKEYLEN];		/* key (binary) */

};

net/ipv4/tcp_ipv4.c

+92 −34
Original line number Diff line number Diff line
@@ -701,9 +701,21 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb) 
	rcu_read_lock();

	hash_location = tcp_parse_md5sig_option(th);

	if (sk && sk_fullsock(sk)) {

		key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)

					&ip_hdr(skb)->saddr, AF_INET);

		const union tcp_md5_addr *addr;

		int l3index;



		/* sdif set, means packet ingressed via a device

		 * in an L3 domain and inet_iif is set to it.

		 */

		l3index = tcp_v4_sdif(skb) ? inet_iif(skb) : 0;

		addr = (union tcp_md5_addr *)&ip_hdr(skb)->saddr;

		key = tcp_md5_do_lookup(sk, l3index, addr, AF_INET);

	} else if (hash_location) {

		const union tcp_md5_addr *addr;

		int sdif = tcp_v4_sdif(skb);

		int dif = inet_iif(skb);

		int l3index;



		/*

		 * active side is lost. Try to find listening socket through

		 * source port, and then find md5 key through listening socket.
@@ -714,14 +726,17 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb) 
		sk1 = __inet_lookup_listener(net, &tcp_hashinfo, NULL, 0,

					     ip_hdr(skb)->saddr,

					     th->source, ip_hdr(skb)->daddr,

					     ntohs(th->source), inet_iif(skb),

					     tcp_v4_sdif(skb));

					     ntohs(th->source), dif, sdif);

		/* don't send rst if it can't find key */

		if (!sk1)

			goto out;



		key = tcp_md5_do_lookup(sk1, (union tcp_md5_addr *)

					&ip_hdr(skb)->saddr, AF_INET);

		/* sdif set, means packet ingressed via a device

		 * in an L3 domain and dif is set to it.

		 */

		l3index = sdif ? dif : 0;

		addr = (union tcp_md5_addr *)&ip_hdr(skb)->saddr;

		key = tcp_md5_do_lookup(sk1, l3index, addr, AF_INET);

		if (!key)

			goto out;
@@ -905,6 +920,9 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb) 
static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,

				  struct request_sock *req)

{

	const union tcp_md5_addr *addr;

	int l3index;



	/* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV

	 * sk->sk_state == TCP_SYN_RECV -> for Fast Open.

	 */
@@ -916,14 +934,15 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, 
	 * exception of <SYN> segments, MUST be right-shifted by

	 * Rcv.Wind.Shift bits:

	 */

	addr = (union tcp_md5_addr *)&ip_hdr(skb)->saddr;

	l3index = tcp_v4_sdif(skb) ? inet_iif(skb) : 0;

	tcp_v4_send_ack(sk, skb, seq,

			tcp_rsk(req)->rcv_nxt,

			req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,

			tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,

			req->ts_recent,

			0,

			tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->saddr,

					  AF_INET),

			tcp_md5_do_lookup(sk, l3index, addr, AF_INET),

			inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0,

			ip_hdr(skb)->tos);

}
@@ -983,7 +1002,7 @@ DEFINE_STATIC_KEY_FALSE(tcp_md5_needed); 
EXPORT_SYMBOL(tcp_md5_needed);



/* Find the Key structure for an address.  */

struct tcp_md5sig_key *__tcp_md5_do_lookup(const struct sock *sk,

struct tcp_md5sig_key *__tcp_md5_do_lookup(const struct sock *sk, int l3index,

					   const union tcp_md5_addr *addr,

					   int family)

{
@@ -1003,7 +1022,8 @@ struct tcp_md5sig_key *__tcp_md5_do_lookup(const struct sock *sk, 
	hlist_for_each_entry_rcu(key, &md5sig->head, node) {

		if (key->family != family)

			continue;



		if (key->l3index && key->l3index != l3index)

			continue;

		if (family == AF_INET) {

			mask = inet_make_mask(key->prefixlen);

			match = (key->addr.a4.s_addr & mask) ==
@@ -1027,7 +1047,8 @@ EXPORT_SYMBOL(__tcp_md5_do_lookup); 


static struct tcp_md5sig_key *tcp_md5_do_lookup_exact(const struct sock *sk,

						      const union tcp_md5_addr *addr,

						      int family, u8 prefixlen)

						      int family, u8 prefixlen,

						      int l3index)

{

	const struct tcp_sock *tp = tcp_sk(sk);

	struct tcp_md5sig_key *key;
@@ -1046,6 +1067,8 @@ static struct tcp_md5sig_key *tcp_md5_do_lookup_exact(const struct sock *sk, 
	hlist_for_each_entry_rcu(key, &md5sig->head, node) {

		if (key->family != family)

			continue;

		if (key->l3index && key->l3index != l3index)

			continue;

		if (!memcmp(&key->addr, addr, size) &&

		    key->prefixlen == prefixlen)

			return key;
@@ -1057,23 +1080,26 @@ struct tcp_md5sig_key *tcp_v4_md5_lookup(const struct sock *sk, 
					 const struct sock *addr_sk)

{

	const union tcp_md5_addr *addr;

	int l3index;



	l3index = l3mdev_master_ifindex_by_index(sock_net(sk),

						 addr_sk->sk_bound_dev_if);

	addr = (const union tcp_md5_addr *)&addr_sk->sk_daddr;

	return tcp_md5_do_lookup(sk, addr, AF_INET);

	return tcp_md5_do_lookup(sk, l3index, addr, AF_INET);

}

EXPORT_SYMBOL(tcp_v4_md5_lookup);



/* This can be called on a newly created socket, from other files */

int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,

		   int family, u8 prefixlen, const u8 *newkey, u8 newkeylen,

		   gfp_t gfp)

		   int family, u8 prefixlen, int l3index,

		   const u8 *newkey, u8 newkeylen, gfp_t gfp)

{

	/* Add Key to the list */

	struct tcp_md5sig_key *key;

	struct tcp_sock *tp = tcp_sk(sk);

	struct tcp_md5sig_info *md5sig;



	key = tcp_md5_do_lookup_exact(sk, addr, family, prefixlen);

	key = tcp_md5_do_lookup_exact(sk, addr, family, prefixlen, l3index);

	if (key) {

		/* Pre-existing entry - just update that one. */

		memcpy(key->key, newkey, newkeylen);
@@ -1105,6 +1131,7 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr, 
	key->keylen = newkeylen;

	key->family = family;

	key->prefixlen = prefixlen;

	key->l3index = l3index;

	memcpy(&key->addr, addr,

	       (family == AF_INET6) ? sizeof(struct in6_addr) :

				      sizeof(struct in_addr));
@@ -1114,11 +1141,11 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr, 
EXPORT_SYMBOL(tcp_md5_do_add);



int tcp_md5_do_del(struct sock *sk, const union tcp_md5_addr *addr, int family,

		   u8 prefixlen)

		   u8 prefixlen, int l3index)

{

	struct tcp_md5sig_key *key;



	key = tcp_md5_do_lookup_exact(sk, addr, family, prefixlen);

	key = tcp_md5_do_lookup_exact(sk, addr, family, prefixlen, l3index);

	if (!key)

		return -ENOENT;

	hlist_del_rcu(&key->node);
@@ -1149,7 +1176,9 @@ static int tcp_v4_parse_md5_keys(struct sock *sk, int optname, 
{

	struct tcp_md5sig cmd;

	struct sockaddr_in *sin = (struct sockaddr_in *)&cmd.tcpm_addr;

	const union tcp_md5_addr *addr;

	u8 prefixlen = 32;

	int l3index = 0;



	if (optlen < sizeof(cmd))

		return -EINVAL;
@@ -1167,16 +1196,34 @@ static int tcp_v4_parse_md5_keys(struct sock *sk, int optname, 
			return -EINVAL;

	}



	if (optname == TCP_MD5SIG_EXT &&

	    cmd.tcpm_flags & TCP_MD5SIG_FLAG_IFINDEX) {

		struct net_device *dev;



		rcu_read_lock();

		dev = dev_get_by_index_rcu(sock_net(sk), cmd.tcpm_ifindex);

		if (dev && netif_is_l3_master(dev))

			l3index = dev->ifindex;



		rcu_read_unlock();



		/* ok to reference set/not set outside of rcu;

		 * right now device MUST be an L3 master

		 */

		if (!dev || !l3index)

			return -EINVAL;

	}



	addr = (union tcp_md5_addr *)&sin->sin_addr.s_addr;



	if (!cmd.tcpm_keylen)

		return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin->sin_addr.s_addr,

				      AF_INET, prefixlen);

		return tcp_md5_do_del(sk, addr, AF_INET, prefixlen, l3index);



	if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)

		return -EINVAL;



	return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin->sin_addr.s_addr,

			      AF_INET, prefixlen, cmd.tcpm_key, cmd.tcpm_keylen,

			      GFP_KERNEL);

	return tcp_md5_do_add(sk, addr, AF_INET, prefixlen, l3index,

			      cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);

}



static int tcp_v4_md5_hash_headers(struct tcp_md5sig_pool *hp,
@@ -1286,7 +1333,8 @@ EXPORT_SYMBOL(tcp_v4_md5_hash_skb); 


/* Called with rcu_read_lock() */

static bool tcp_v4_inbound_md5_hash(const struct sock *sk,

				    const struct sk_buff *skb)

				    const struct sk_buff *skb,

				    int dif, int sdif)

{

#ifdef CONFIG_TCP_MD5SIG

	/*
@@ -1301,11 +1349,17 @@ static bool tcp_v4_inbound_md5_hash(const struct sock *sk, 
	struct tcp_md5sig_key *hash_expected;

	const struct iphdr *iph = ip_hdr(skb);

	const struct tcphdr *th = tcp_hdr(skb);

	int genhash;

	const union tcp_md5_addr *addr;

	unsigned char newhash[16];

	int genhash, l3index;



	hash_expected = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&iph->saddr,

					  AF_INET);

	/* sdif set, means packet ingressed via a device

	 * in an L3 domain and dif is set to the l3mdev

	 */

	l3index = sdif ? dif : 0;



	addr = (union tcp_md5_addr *)&iph->saddr;

	hash_expected = tcp_md5_do_lookup(sk, l3index, addr, AF_INET);

	hash_location = tcp_parse_md5sig_option(th);



	/* We've parsed the options - do we have a hash? */
@@ -1331,11 +1385,11 @@ static bool tcp_v4_inbound_md5_hash(const struct sock *sk, 


	if (genhash || memcmp(hash_location, newhash, 16) != 0) {

		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);

		net_info_ratelimited("MD5 Hash failed for (%pI4, %d)->(%pI4, %d)%s\n",

		net_info_ratelimited("MD5 Hash failed for (%pI4, %d)->(%pI4, %d)%s L3 index %d\n",

				     &iph->saddr, ntohs(th->source),

				     &iph->daddr, ntohs(th->dest),

				     genhash ? " tcp_v4_calc_md5_hash failed"

				     : "");

				     : "", l3index);

		return true;

	}

	return false;
@@ -1419,7 +1473,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, 
	struct tcp_sock *newtp;

	struct sock *newsk;

#ifdef CONFIG_TCP_MD5SIG

	const union tcp_md5_addr *addr;

	struct tcp_md5sig_key *key;

	int l3index;

#endif

	struct ip_options_rcu *inet_opt;
@@ -1467,9 +1523,10 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, 
	tcp_initialize_rcv_mss(newsk);



#ifdef CONFIG_TCP_MD5SIG

	l3index = l3mdev_master_ifindex_by_index(sock_net(sk), ireq->ir_iif);

	/* Copy over the MD5 key from the original socket */

	key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&newinet->inet_daddr,

				AF_INET);

	addr = (union tcp_md5_addr *)&newinet->inet_daddr;

	key = tcp_md5_do_lookup(sk, l3index, addr, AF_INET);

	if (key) {

		/*

		 * We're using one, so create a matching key
@@ -1477,8 +1534,8 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, 
		 * memory, then we end up not copying the key

		 * across. Shucks.

		 */

		tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newinet->inet_daddr,

			       AF_INET, 32, key->key, key->keylen, GFP_ATOMIC);

		tcp_md5_do_add(newsk, addr, AF_INET, 32, l3index,

			       key->key, key->keylen, GFP_ATOMIC);

		sk_nocaps_add(newsk, NETIF_F_GSO_MASK);

	}

#endif
@@ -1808,6 +1865,7 @@ int tcp_v4_rcv(struct sk_buff *skb) 
	struct net *net = dev_net(skb->dev);

	struct sk_buff *skb_to_free;

	int sdif = inet_sdif(skb);

	int dif = inet_iif(skb);

	const struct iphdr *iph;

	const struct tcphdr *th;

	bool refcounted;
@@ -1856,7 +1914,7 @@ process: 
		struct sock *nsk;



		sk = req->rsk_listener;

		if (unlikely(tcp_v4_inbound_md5_hash(sk, skb))) {

		if (unlikely(tcp_v4_inbound_md5_hash(sk, skb, dif, sdif))) {

			sk_drops_add(sk, skb);

			reqsk_put(req);

			goto discard_it;
@@ -1914,7 +1972,7 @@ process: 
	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))

		goto discard_and_relse;



	if (tcp_v4_inbound_md5_hash(sk, skb))

	if (tcp_v4_inbound_md5_hash(sk, skb, dif, sdif))

		goto discard_and_relse;



	nf_reset_ct(skb);

net/ipv6/tcp_ipv6.c

+80 −25
Original line number Diff line number Diff line
@@ -81,7 +81,8 @@ static const struct tcp_sock_af_ops tcp_sock_ipv6_specific; 
static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;

#else

static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,

						   const struct in6_addr *addr)

						   const struct in6_addr *addr,

						   int l3index)

{

	return NULL;

}
@@ -532,15 +533,22 @@ static void tcp_v6_reqsk_destructor(struct request_sock *req) 


#ifdef CONFIG_TCP_MD5SIG

static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,

						   const struct in6_addr *addr)

						   const struct in6_addr *addr,

						   int l3index)

{

	return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);

	return tcp_md5_do_lookup(sk, l3index,

				 (union tcp_md5_addr *)addr, AF_INET6);

}



static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,

						const struct sock *addr_sk)

{

	return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);

	int l3index;



	l3index = l3mdev_master_ifindex_by_index(sock_net(sk),

						 addr_sk->sk_bound_dev_if);

	return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr,

				    l3index);

}



static int tcp_v6_parse_md5_keys(struct sock *sk, int optname,
@@ -548,6 +556,7 @@ static int tcp_v6_parse_md5_keys(struct sock *sk, int optname, 
{

	struct tcp_md5sig cmd;

	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;

	int l3index = 0;

	u8 prefixlen;



	if (optlen < sizeof(cmd))
@@ -569,12 +578,30 @@ static int tcp_v6_parse_md5_keys(struct sock *sk, int optname, 
		prefixlen = ipv6_addr_v4mapped(&sin6->sin6_addr) ? 32 : 128;

	}



	if (optname == TCP_MD5SIG_EXT &&

	    cmd.tcpm_flags & TCP_MD5SIG_FLAG_IFINDEX) {

		struct net_device *dev;



		rcu_read_lock();

		dev = dev_get_by_index_rcu(sock_net(sk), cmd.tcpm_ifindex);

		if (dev && netif_is_l3_master(dev))

			l3index = dev->ifindex;

		rcu_read_unlock();



		/* ok to reference set/not set outside of rcu;

		 * right now device MUST be an L3 master

		 */

		if (!dev || !l3index)

			return -EINVAL;

	}



	if (!cmd.tcpm_keylen) {

		if (ipv6_addr_v4mapped(&sin6->sin6_addr))

			return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],

					      AF_INET, prefixlen);

					      AF_INET, prefixlen,

					      l3index);

		return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,

				      AF_INET6, prefixlen);

				      AF_INET6, prefixlen, l3index);

	}



	if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
@@ -582,12 +609,13 @@ static int tcp_v6_parse_md5_keys(struct sock *sk, int optname, 


	if (ipv6_addr_v4mapped(&sin6->sin6_addr))

		return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],

				      AF_INET, prefixlen, cmd.tcpm_key,

				      cmd.tcpm_keylen, GFP_KERNEL);

				      AF_INET, prefixlen, l3index,

				      cmd.tcpm_key, cmd.tcpm_keylen,

				      GFP_KERNEL);



	return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,

			      AF_INET6, prefixlen, cmd.tcpm_key,

			      cmd.tcpm_keylen, GFP_KERNEL);

			      AF_INET6, prefixlen, l3index,

			      cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);

}



static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
@@ -698,17 +726,23 @@ clear_hash_noput: 
#endif



static bool tcp_v6_inbound_md5_hash(const struct sock *sk,

				    const struct sk_buff *skb)

				    const struct sk_buff *skb,

				    int dif, int sdif)

{

#ifdef CONFIG_TCP_MD5SIG

	const __u8 *hash_location = NULL;

	struct tcp_md5sig_key *hash_expected;

	const struct ipv6hdr *ip6h = ipv6_hdr(skb);

	const struct tcphdr *th = tcp_hdr(skb);

	int genhash;

	int genhash, l3index;

	u8 newhash[16];



	hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);

	/* sdif set, means packet ingressed via a device

	 * in an L3 domain and dif is set to the l3mdev

	 */

	l3index = sdif ? dif : 0;



	hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr, l3index);

	hash_location = tcp_parse_md5sig_option(th);



	/* We've parsed the options - do we have a hash? */
@@ -732,10 +766,10 @@ static bool tcp_v6_inbound_md5_hash(const struct sock *sk, 


	if (genhash || memcmp(hash_location, newhash, 16) != 0) {

		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);

		net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",

		net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u L3 index %d\n",

				     genhash ? "failed" : "mismatch",

				     &ip6h->saddr, ntohs(th->source),

				     &ip6h->daddr, ntohs(th->dest));

				     &ip6h->daddr, ntohs(th->dest), l3index);

		return true;

	}

#endif
@@ -951,8 +985,18 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb) 
	rcu_read_lock();

	hash_location = tcp_parse_md5sig_option(th);

	if (sk && sk_fullsock(sk)) {

		key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);

		int l3index;



		/* sdif set, means packet ingressed via a device

		 * in an L3 domain and inet_iif is set to it.

		 */

		l3index = tcp_v6_sdif(skb) ? tcp_v6_iif_l3_slave(skb) : 0;

		key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr, l3index);

	} else if (hash_location) {

		int dif = tcp_v6_iif_l3_slave(skb);

		int sdif = tcp_v6_sdif(skb);

		int l3index;



		/*

		 * active side is lost. Try to find listening socket through

		 * source port, and then find md5 key through listening socket.
@@ -964,13 +1008,16 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb) 
					   &tcp_hashinfo, NULL, 0,

					   &ipv6h->saddr,

					   th->source, &ipv6h->daddr,

					   ntohs(th->source),

					   tcp_v6_iif_l3_slave(skb),

					   tcp_v6_sdif(skb));

					   ntohs(th->source), dif, sdif);

		if (!sk1)

			goto out;



		key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);

		/* sdif set, means packet ingressed via a device

		 * in an L3 domain and dif is set to it.

		 */

		l3index = tcp_v6_sdif(skb) ? dif : 0;



		key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr, l3index);

		if (!key)

			goto out;
@@ -1040,6 +1087,10 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb) 
static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,

				  struct request_sock *req)

{

	int l3index;



	l3index = tcp_v6_sdif(skb) ? tcp_v6_iif_l3_slave(skb) : 0;



	/* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV

	 * sk->sk_state == TCP_SYN_RECV -> for Fast Open.

	 */
@@ -1054,7 +1105,7 @@ static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, 
			req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,

			tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,

			req->ts_recent, sk->sk_bound_dev_if,

			tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),

			tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr, l3index),

			0, 0, sk->sk_priority);

}
@@ -1126,6 +1177,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * 
	struct sock *newsk;

#ifdef CONFIG_TCP_MD5SIG

	struct tcp_md5sig_key *key;

	int l3index;

#endif

	struct flowi6 fl6;
@@ -1269,8 +1321,10 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * 
	newinet->inet_rcv_saddr = LOOPBACK4_IPV6;



#ifdef CONFIG_TCP_MD5SIG

	l3index = l3mdev_master_ifindex_by_index(sock_net(sk), ireq->ir_iif);



	/* Copy over the MD5 key from the original socket */

	key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);

	key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr, l3index);

	if (key) {

		/* We're using one, so create a matching key

		 * on the newsk structure. If we fail to get
@@ -1278,7 +1332,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * 
		 * across. Shucks.

		 */

		tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,

			       AF_INET6, 128, key->key, key->keylen,

			       AF_INET6, 128, l3index, key->key, key->keylen,

			       sk_gfp_mask(sk, GFP_ATOMIC));

	}

#endif
@@ -1480,6 +1534,7 @@ INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb) 
{

	struct sk_buff *skb_to_free;

	int sdif = inet6_sdif(skb);

	int dif = inet6_iif(skb);

	const struct tcphdr *th;

	const struct ipv6hdr *hdr;

	bool refcounted;
@@ -1528,7 +1583,7 @@ process: 
		struct sock *nsk;



		sk = req->rsk_listener;

		if (tcp_v6_inbound_md5_hash(sk, skb)) {

		if (tcp_v6_inbound_md5_hash(sk, skb, dif, sdif)) {

			sk_drops_add(sk, skb);

			reqsk_put(req);

			goto discard_it;
@@ -1583,7 +1638,7 @@ process: 
	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))

		goto discard_and_relse;



	if (tcp_v6_inbound_md5_hash(sk, skb))

	if (tcp_v6_inbound_md5_hash(sk, skb, dif, sdif))

		goto discard_and_relse;



	if (tcp_filter(sk, skb))

tools/testing/selftests/net/fcnal-test.sh

+458 −0

File changed.

Preview size limit exceeded, changes collapsed.

CRA Git | Maintained and supported by SUSTech CRA and CCSE