mirror of
https://github.com/torvalds/linux
synced 2024-10-06 19:34:19 +00:00
net/tcp: Don't consider TCP_CLOSE in TCP_AO_ESTABLISHED
TCP_CLOSE may or may not have current/rnext keys and should not be
considered "established". The fast-path for TCP_CLOSE is
SKB_DROP_REASON_TCP_CLOSE. This is what tcp_rcv_state_process() does
anyways. Add an early drop path to not spend any time verifying
segment signatures for sockets in TCP_CLOSE state.
Cc: stable@vger.kernel.org # v6.7
Fixes: 0a3a809089
("net/tcp: Verify inbound TCP-AO signed segments")
Signed-off-by: Dmitry Safonov <0x7f454c46@gmail.com>
Link: https://lore.kernel.org/r/20240529-tcp_ao-sk_state-v1-1-d69b5d323c52@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
parent
e85e271dec
commit
33700a0c9b
|
@ -86,7 +86,8 @@ static inline int tcp_ao_sizeof_key(const struct tcp_ao_key *key)
|
||||||
struct tcp_ao_info {
|
struct tcp_ao_info {
|
||||||
/* List of tcp_ao_key's */
|
/* List of tcp_ao_key's */
|
||||||
struct hlist_head head;
|
struct hlist_head head;
|
||||||
/* current_key and rnext_key aren't maintained on listen sockets.
|
/* current_key and rnext_key are maintained on sockets
|
||||||
|
* in TCP_AO_ESTABLISHED states.
|
||||||
* Their purpose is to cache keys on established connections,
|
* Their purpose is to cache keys on established connections,
|
||||||
* saving needless lookups. Never dereference any of them from
|
* saving needless lookups. Never dereference any of them from
|
||||||
* listen sockets.
|
* listen sockets.
|
||||||
|
@ -201,9 +202,9 @@ struct tcp6_ao_context {
|
||||||
};
|
};
|
||||||
|
|
||||||
struct tcp_sigpool;
|
struct tcp_sigpool;
|
||||||
|
/* Established states are fast-path and there always is current_key/rnext_key */
|
||||||
#define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \
|
#define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \
|
||||||
TCPF_CLOSE | TCPF_CLOSE_WAIT | \
|
TCPF_CLOSE_WAIT | TCPF_LAST_ACK | TCPF_CLOSING)
|
||||||
TCPF_LAST_ACK | TCPF_CLOSING)
|
|
||||||
|
|
||||||
int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
|
int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
|
||||||
struct tcp_ao_key *key, struct tcphdr *th,
|
struct tcp_ao_key *key, struct tcphdr *th,
|
||||||
|
|
|
@ -933,6 +933,7 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb,
|
||||||
struct tcp_ao_key *key;
|
struct tcp_ao_key *key;
|
||||||
__be32 sisn, disn;
|
__be32 sisn, disn;
|
||||||
u8 *traffic_key;
|
u8 *traffic_key;
|
||||||
|
int state;
|
||||||
u32 sne = 0;
|
u32 sne = 0;
|
||||||
|
|
||||||
info = rcu_dereference(tcp_sk(sk)->ao_info);
|
info = rcu_dereference(tcp_sk(sk)->ao_info);
|
||||||
|
@ -948,8 +949,9 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb,
|
||||||
disn = 0;
|
disn = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
state = READ_ONCE(sk->sk_state);
|
||||||
/* Fast-path */
|
/* Fast-path */
|
||||||
if (likely((1 << sk->sk_state) & TCP_AO_ESTABLISHED)) {
|
if (likely((1 << state) & TCP_AO_ESTABLISHED)) {
|
||||||
enum skb_drop_reason err;
|
enum skb_drop_reason err;
|
||||||
struct tcp_ao_key *current_key;
|
struct tcp_ao_key *current_key;
|
||||||
|
|
||||||
|
@ -988,6 +990,9 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb,
|
||||||
return SKB_NOT_DROPPED_YET;
|
return SKB_NOT_DROPPED_YET;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (unlikely(state == TCP_CLOSE))
|
||||||
|
return SKB_DROP_REASON_TCP_CLOSE;
|
||||||
|
|
||||||
/* Lookup key based on peer address and keyid.
|
/* Lookup key based on peer address and keyid.
|
||||||
* current_key and rnext_key must not be used on tcp listen
|
* current_key and rnext_key must not be used on tcp listen
|
||||||
* sockets as otherwise:
|
* sockets as otherwise:
|
||||||
|
@ -1001,7 +1006,7 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb,
|
||||||
if (th->syn && !th->ack)
|
if (th->syn && !th->ack)
|
||||||
goto verify_hash;
|
goto verify_hash;
|
||||||
|
|
||||||
if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_NEW_SYN_RECV)) {
|
if ((1 << state) & (TCPF_LISTEN | TCPF_NEW_SYN_RECV)) {
|
||||||
/* Make the initial syn the likely case here */
|
/* Make the initial syn the likely case here */
|
||||||
if (unlikely(req)) {
|
if (unlikely(req)) {
|
||||||
sne = tcp_ao_compute_sne(0, tcp_rsk(req)->rcv_isn,
|
sne = tcp_ao_compute_sne(0, tcp_rsk(req)->rcv_isn,
|
||||||
|
@ -1018,14 +1023,14 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb,
|
||||||
/* no way to figure out initial sisn/disn - drop */
|
/* no way to figure out initial sisn/disn - drop */
|
||||||
return SKB_DROP_REASON_TCP_FLAGS;
|
return SKB_DROP_REASON_TCP_FLAGS;
|
||||||
}
|
}
|
||||||
} else if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
|
} else if ((1 << state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
|
||||||
disn = info->lisn;
|
disn = info->lisn;
|
||||||
if (th->syn || th->rst)
|
if (th->syn || th->rst)
|
||||||
sisn = th->seq;
|
sisn = th->seq;
|
||||||
else
|
else
|
||||||
sisn = info->risn;
|
sisn = info->risn;
|
||||||
} else {
|
} else {
|
||||||
WARN_ONCE(1, "TCP-AO: Unexpected sk_state %d", sk->sk_state);
|
WARN_ONCE(1, "TCP-AO: Unexpected sk_state %d", state);
|
||||||
return SKB_DROP_REASON_TCP_AOFAILURE;
|
return SKB_DROP_REASON_TCP_AOFAILURE;
|
||||||
}
|
}
|
||||||
verify_hash:
|
verify_hash:
|
||||||
|
|
Loading…
Reference in a new issue