tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net/tcp: Add option for TCP-AO to (not) hash header

Provide setsockopt() key flag that makes TCP-AO exclude hashing TCP
header for peers that match the key. This is needed for interraction
with middleboxes that may change TCP options, see RFC5925 (9.2).

Co-developed-by: Francesco Ruggeri <fruggeri@arista.com>
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Co-developed-by: Salam Noureddine <noureddine@arista.com>
Signed-off-by: Salam Noureddine <noureddine@arista.com>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Acked-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Dmitry Safonov and committed by
David S. Miller 7753c2f0 953af8e3

+10 -3
+5
include/uapi/linux/tcp.h
··· 367 367 #define TCP_AO_MAXKEYLEN 80 368 368 369 369 #define TCP_AO_KEYF_IFINDEX (1 << 0) /* L3 ifindex for VRF */ 370 + #define TCP_AO_KEYF_EXCLUDE_OPT (1 << 1) /* "Indicates whether TCP 371 + * options other than TCP-AO 372 + * are included in the MAC 373 + * calculation" 374 + */ 370 375 371 376 struct tcp_ao_add { /* setsockopt(TCP_AO_ADD_KEY) */ 372 377 struct __kernel_sockaddr_storage addr; /* peer's address for the key */
+5 -3
net/ipv4/tcp_ao.c
··· 562 562 WARN_ON_ONCE(1); 563 563 goto clear_hash; 564 564 } 565 - if (tcp_ao_hash_header(&hp, th, false, 565 + if (tcp_ao_hash_header(&hp, th, 566 + !!(key->keyflags & TCP_AO_KEYF_EXCLUDE_OPT), 566 567 ao_hash, hash_offset, tcp_ao_maclen(key))) 567 568 goto clear_hash; 568 569 ahash_request_set_crypt(hp.req, NULL, hash_buf, 0); ··· 611 610 goto clear_hash; 612 611 if (tcp_ao_hash_pseudoheader(family, sk, skb, &hp, skb->len)) 613 612 goto clear_hash; 614 - if (tcp_ao_hash_header(&hp, th, false, 613 + if (tcp_ao_hash_header(&hp, th, 614 + !!(key->keyflags & TCP_AO_KEYF_EXCLUDE_OPT), 615 615 ao_hash, hash_offset, tcp_ao_maclen(key))) 616 616 goto clear_hash; 617 617 if (tcp_sigpool_hash_skb_data(&hp, skb, th->doff << 2)) ··· 1456 1454 return ERR_PTR(-ESOCKTNOSUPPORT); 1457 1455 } 1458 1456 1459 - #define TCP_AO_KEYF_ALL (0) 1457 + #define TCP_AO_KEYF_ALL (TCP_AO_KEYF_EXCLUDE_OPT) 1460 1458 1461 1459 static struct tcp_ao_key *tcp_ao_key_alloc(struct sock *sk, 1462 1460 struct tcp_ao_add *cmd)