tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net/tcp: Don't consider TCP_CLOSE in TCP_AO_ESTABLISHED

TCP_CLOSE may or may not have current/rnext keys and should not be
considered "established". The fast-path for TCP_CLOSE is
SKB_DROP_REASON_TCP_CLOSE. This is what tcp_rcv_state_process() does
anyways. Add an early drop path to not spend any time verifying
segment signatures for sockets in TCP_CLOSE state.

Cc: stable@vger.kernel.org # v6.7
Fixes: 0a3a809089eb ("net/tcp: Verify inbound TCP-AO signed segments")
Signed-off-by: Dmitry Safonov <0x7f454c46@gmail.com>
Link: https://lore.kernel.org/r/20240529-tcp_ao-sk_state-v1-1-d69b5d323c52@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Dmitry Safonov and committed by
Jakub Kicinski 33700a0c e85e271d

+13 -7
+4 -3
include/net/tcp_ao.h
··· 86 86 struct tcp_ao_info { 87 87 /* List of tcp_ao_key's */ 88 88 struct hlist_head head; 89 - /* current_key and rnext_key aren't maintained on listen sockets. 89 + /* current_key and rnext_key are maintained on sockets 90 + * in TCP_AO_ESTABLISHED states. 90 91 * Their purpose is to cache keys on established connections, 91 92 * saving needless lookups. Never dereference any of them from 92 93 * listen sockets. ··· 202 201 }; 203 202 204 203 struct tcp_sigpool; 204 + /* Established states are fast-path and there always is current_key/rnext_key */ 205 205 #define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \ 206 - TCPF_CLOSE | TCPF_CLOSE_WAIT | \ 207 - TCPF_LAST_ACK | TCPF_CLOSING) 206 + TCPF_CLOSE_WAIT | TCPF_LAST_ACK | TCPF_CLOSING) 208 207 209 208 int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb, 210 209 struct tcp_ao_key *key, struct tcphdr *th,
+9 -4
net/ipv4/tcp_ao.c
··· 933 933 struct tcp_ao_key *key; 934 934 __be32 sisn, disn; 935 935 u8 *traffic_key; 936 + int state; 936 937 u32 sne = 0; 937 938 938 939 info = rcu_dereference(tcp_sk(sk)->ao_info); ··· 949 948 disn = 0; 950 949 } 951 950 951 + state = READ_ONCE(sk->sk_state); 952 952 /* Fast-path */ 953 - if (likely((1 << sk->sk_state) & TCP_AO_ESTABLISHED)) { 953 + if (likely((1 << state) & TCP_AO_ESTABLISHED)) { 954 954 enum skb_drop_reason err; 955 955 struct tcp_ao_key *current_key; 956 956 ··· 990 988 return SKB_NOT_DROPPED_YET; 991 989 } 992 990 991 + if (unlikely(state == TCP_CLOSE)) 992 + return SKB_DROP_REASON_TCP_CLOSE; 993 + 993 994 /* Lookup key based on peer address and keyid. 994 995 * current_key and rnext_key must not be used on tcp listen 995 996 * sockets as otherwise: ··· 1006 1001 if (th->syn && !th->ack) 1007 1002 goto verify_hash; 1008 1003 1009 - if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_NEW_SYN_RECV)) { 1004 + if ((1 << state) & (TCPF_LISTEN | TCPF_NEW_SYN_RECV)) { 1010 1005 /* Make the initial syn the likely case here */ 1011 1006 if (unlikely(req)) { 1012 1007 sne = tcp_ao_compute_sne(0, tcp_rsk(req)->rcv_isn, ··· 1023 1018 /* no way to figure out initial sisn/disn - drop */ 1024 1019 return SKB_DROP_REASON_TCP_FLAGS; 1025 1020 } 1026 - } else if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) { 1021 + } else if ((1 << state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) { 1027 1022 disn = info->lisn; 1028 1023 if (th->syn || th->rst) 1029 1024 sisn = th->seq; 1030 1025 else 1031 1026 sisn = info->risn; 1032 1027 } else { 1033 - WARN_ONCE(1, "TCP-AO: Unexpected sk_state %d", sk->sk_state); 1028 + WARN_ONCE(1, "TCP-AO: Unexpected sk_state %d", state); 1034 1029 return SKB_DROP_REASON_TCP_AOFAILURE; 1035 1030 } 1036 1031 verify_hash: