tcp: Use correct peer adr when copying MD5 keys (e547bc1e) · Commits · 戴 / test

When the TCP connection handshake completes on the passive side, a variety of state must be set up in the "child" sock, including the key if MD5 authentication is being used. Fix TCP for both address families to label the key with the peer's destination address, rather than the address from the listening sock, which is usually the wildcard. Reported-by:

Stephen Hemminger <shemminger@vyatta.com> Signed-off-by:

John Dykstra <john.dykstra1@gmail.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/tcp_ipv4.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1374,7 +1374,7 @@ struct sock tcp_v4_syn_recv_sock(struct sock sk, struct sk_buff *skb,
	*/		*/
	char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);		char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
	if (newkey != NULL)		if (newkey != NULL)
	tcp_v4_md5_do_add(newsk, inet_sk(sk)->daddr,		tcp_v4_md5_do_add(newsk, newinet->daddr,
	newkey, key->keylen);		newkey, key->keylen);
	newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;		newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;
	}		}

net/ipv6/tcp_ipv6.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1442,7 +1442,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock sk, struct sk_buff skb,
	*/		*/
	char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);		char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
	if (newkey != NULL)		if (newkey != NULL)
	tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,		tcp_v6_md5_do_add(newsk, &newnp->daddr,
	newkey, key->keylen);		newkey, key->keylen);
	}		}
	#endif		#endif

Admin message