bianbu-repo-mirror/bianbu-linux-6.6
1
0
Fork 0
mirror of https://gitee.com/bianbu-linux/linux-6.6 synced 2025-04-24 14:07:52 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

net/tcp: Merge TCP-MD5 inbound callbacks

Browse source 
The functions do essentially the same work to verify TCP-MD5 sign.
Code can be merged into one family-independent function in order to
reduce copy'n'paste and generated code.
Later with TCP-AO option added, this will allow to create one function
that's responsible for segment verification, that will have all the
different checks for MD5/AO/non-signed packets, which in turn will help
to see checks for all corner-cases in one function, rather than spread
around different families and functions.

Cc: Eric Dumazet <edumazet@google.com>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20220223175740.452397-1-dima@arista.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Dmitry Safonov 2022-02-23 17:57:40 +00:00 • committed by Jakub Kicinski
parent 53110c67e3
commit 7bbb765b73
4 changed files with 92 additions and 131 deletions
Download patch file Download diff file Expand all files Collapse all files

13
include/net/tcp.h
View file

@ -1674,6 +1674,11 @@ tcp_md5_do_lookup(const struct sock *sk, int l3index,
return NULL; return NULL;
return __tcp_md5_do_lookup(sk, l3index, addr, family); return __tcp_md5_do_lookup(sk, l3index, addr, family);
} }
bool tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
enum skb_drop_reason *reason,
const void *saddr, const void *daddr,
int family, int dif, int sdif);
#define tcp_twsk_md5_key(twsk) ((twsk)->tw_md5_key) #define tcp_twsk_md5_key(twsk) ((twsk)->tw_md5_key)
#else #else
@ -1683,6 +1688,14 @@ tcp_md5_do_lookup(const struct sock *sk, int l3index,
{ {
return NULL; return NULL;
} }
static inline bool tcp_inbound_md5_hash(const struct sock *sk,
const struct sk_buff *skb,
enum skb_drop_reason *reason,
const void *saddr, const void *daddr,
int family, int dif, int sdif)
{
return false;
}
#define tcp_twsk_md5_key(twsk) NULL #define tcp_twsk_md5_key(twsk) NULL
#endif #endif

70
net/ipv4/tcp.c
View file

@ -4431,6 +4431,76 @@ int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *ke
} }
EXPORT_SYMBOL(tcp_md5_hash_key); EXPORT_SYMBOL(tcp_md5_hash_key);
/* Called with rcu_read_lock() */
bool tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
enum skb_drop_reason *reason,
const void *saddr, const void *daddr,
int family, int dif, int sdif)
{
/*
* This gets called for each TCP segment that arrives
* so we want to be efficient.
* We have 3 drop cases:
* o No MD5 hash and one expected.
* o MD5 hash and we're not expecting one.
* o MD5 hash and its wrong.
*/
const __u8 *hash_location = NULL;
struct tcp_md5sig_key *hash_expected;
const struct tcphdr *th = tcp_hdr(skb);
struct tcp_sock *tp = tcp_sk(sk);
int genhash, l3index;
u8 newhash[16];
/* sdif set, means packet ingressed via a device
* in an L3 domain and dif is set to the l3mdev
*/
l3index = sdif ? dif : 0;
hash_expected = tcp_md5_do_lookup(sk, l3index, saddr, family);
hash_location = tcp_parse_md5sig_option(th);
/* We've parsed the options - do we have a hash? */
if (!hash_expected && !hash_location)
return false;
if (hash_expected && !hash_location) {
*reason = SKB_DROP_REASON_TCP_MD5NOTFOUND;
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
return true;
}
if (!hash_expected && hash_location) {
*reason = SKB_DROP_REASON_TCP_MD5UNEXPECTED;
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
return true;
}
/* check the signature */
genhash = tp->af_specific->calc_md5_hash(newhash, hash_expected,
NULL, skb);
if (genhash || memcmp(hash_location, newhash, 16) != 0) {
*reason = SKB_DROP_REASON_TCP_MD5FAILURE;
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
if (family == AF_INET) {
net_info_ratelimited("MD5 Hash failed for (%pI4, %d)->(%pI4, %d)%s L3 index %d\n",
saddr, ntohs(th->source),
daddr, ntohs(th->dest),
genhash ? " tcp_v4_calc_md5_hash failed"
: "", l3index);
} else {
net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u L3 index %d\n",
genhash ? "failed" : "mismatch",
saddr, ntohs(th->source),
daddr, ntohs(th->dest), l3index);
}
return true;
}
return false;
}
EXPORT_SYMBOL(tcp_inbound_md5_hash);
#endif #endif
void tcp_done(struct sock *sk) void tcp_done(struct sock *sk)

78
net/ipv4/tcp_ipv4.c
View file

@ -1409,76 +1409,6 @@ EXPORT_SYMBOL(tcp_v4_md5_hash_skb);
#endif #endif
/* Called with rcu_read_lock() */
static bool tcp_v4_inbound_md5_hash(const struct sock *sk,
const struct sk_buff *skb,
int dif, int sdif,
enum skb_drop_reason *reason)
{
#ifdef CONFIG_TCP_MD5SIG
/*
* This gets called for each TCP segment that arrives
* so we want to be efficient.
* We have 3 drop cases:
* o No MD5 hash and one expected.
* o MD5 hash and we're not expecting one.
* o MD5 hash and its wrong.
*/
const __u8 *hash_location = NULL;
struct tcp_md5sig_key *hash_expected;
const struct iphdr *iph = ip_hdr(skb);
const struct tcphdr *th = tcp_hdr(skb);
const union tcp_md5_addr *addr;
unsigned char newhash[16];
int genhash, l3index;
/* sdif set, means packet ingressed via a device
* in an L3 domain and dif is set to the l3mdev
*/
l3index = sdif ? dif : 0;
addr = (union tcp_md5_addr *)&iph->saddr;
hash_expected = tcp_md5_do_lookup(sk, l3index, addr, AF_INET);
hash_location = tcp_parse_md5sig_option(th);
/* We've parsed the options - do we have a hash? */
if (!hash_expected && !hash_location)
return false;
if (hash_expected && !hash_location) {
*reason = SKB_DROP_REASON_TCP_MD5NOTFOUND;
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
return true;
}
if (!hash_expected && hash_location) {
*reason = SKB_DROP_REASON_TCP_MD5UNEXPECTED;
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
return true;
}
/* Okay, so this is hash_expected and hash_location -
* so we need to calculate the checksum.
*/
genhash = tcp_v4_md5_hash_skb(newhash,
hash_expected,
NULL, skb);
if (genhash || memcmp(hash_location, newhash, 16) != 0) {
*reason = SKB_DROP_REASON_TCP_MD5FAILURE;
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
net_info_ratelimited("MD5 Hash failed for (%pI4, %d)->(%pI4, %d)%s L3 index %d\n",
&iph->saddr, ntohs(th->source),
&iph->daddr, ntohs(th->dest),
genhash ? " tcp_v4_calc_md5_hash failed"
: "", l3index);
return true;
}
return false;
#endif
return false;
}
static void tcp_v4_init_req(struct request_sock *req, static void tcp_v4_init_req(struct request_sock *req,
const struct sock *sk_listener, const struct sock *sk_listener,
struct sk_buff *skb) struct sk_buff *skb)
@ -2035,8 +1965,9 @@ process:
struct sock *nsk; struct sock *nsk;
sk = req->rsk_listener; sk = req->rsk_listener;
if (unlikely(tcp_v4_inbound_md5_hash(sk, skb, dif, sdif, if (unlikely(tcp_inbound_md5_hash(sk, skb, &drop_reason,
&drop_reason))) { &iph->saddr, &iph->daddr,
AF_INET, dif, sdif))) {
sk_drops_add(sk, skb); sk_drops_add(sk, skb);
reqsk_put(req); reqsk_put(req);
goto discard_it; goto discard_it;
@ -2110,7 +2041,8 @@ process:
goto discard_and_relse; goto discard_and_relse;
} }
if (tcp_v4_inbound_md5_hash(sk, skb, dif, sdif, &drop_reason)) if (tcp_inbound_md5_hash(sk, skb, &drop_reason, &iph->saddr,
&iph->daddr, AF_INET, dif, sdif))
goto discard_and_relse; goto discard_and_relse;
nf_reset_ct(skb); nf_reset_ct(skb);

62
net/ipv6/tcp_ipv6.c
View file

@ -773,61 +773,6 @@ clear_hash_noput:
#endif #endif
static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
const struct sk_buff *skb,
int dif, int sdif,
enum skb_drop_reason *reason)
{
#ifdef CONFIG_TCP_MD5SIG
const __u8 *hash_location = NULL;
struct tcp_md5sig_key *hash_expected;
const struct ipv6hdr *ip6h = ipv6_hdr(skb);
const struct tcphdr *th = tcp_hdr(skb);
int genhash, l3index;
u8 newhash[16];
/* sdif set, means packet ingressed via a device
* in an L3 domain and dif is set to the l3mdev
*/
l3index = sdif ? dif : 0;
hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr, l3index);
hash_location = tcp_parse_md5sig_option(th);
/* We've parsed the options - do we have a hash? */
if (!hash_expected && !hash_location)
return false;
if (hash_expected && !hash_location) {
*reason = SKB_DROP_REASON_TCP_MD5NOTFOUND;
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
return true;
}
if (!hash_expected && hash_location) {
*reason = SKB_DROP_REASON_TCP_MD5UNEXPECTED;
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
return true;
}
/* check the signature */
genhash = tcp_v6_md5_hash_skb(newhash,
hash_expected,
NULL, skb);
if (genhash || memcmp(hash_location, newhash, 16) != 0) {
*reason = SKB_DROP_REASON_TCP_MD5FAILURE;
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u L3 index %d\n",
genhash ? "failed" : "mismatch",
&ip6h->saddr, ntohs(th->source),
&ip6h->daddr, ntohs(th->dest), l3index);
return true;
}
#endif
return false;
}
static void tcp_v6_init_req(struct request_sock *req, static void tcp_v6_init_req(struct request_sock *req,
const struct sock *sk_listener, const struct sock *sk_listener,
struct sk_buff *skb) struct sk_buff *skb)
@ -1687,8 +1632,8 @@ process:
struct sock *nsk; struct sock *nsk;
sk = req->rsk_listener; sk = req->rsk_listener;
if (tcp_v6_inbound_md5_hash(sk, skb, dif, sdif, if (tcp_inbound_md5_hash(sk, skb, &drop_reason, &hdr->saddr,
&drop_reason)) { &hdr->daddr, AF_INET6, dif, sdif)) {
sk_drops_add(sk, skb); sk_drops_add(sk, skb);
reqsk_put(req); reqsk_put(req);
goto discard_it; goto discard_it;
@ -1759,7 +1704,8 @@ process:
goto discard_and_relse; goto discard_and_relse;
} }
if (tcp_v6_inbound_md5_hash(sk, skb, dif, sdif, &drop_reason)) if (tcp_inbound_md5_hash(sk, skb, &drop_reason, &hdr->saddr,
&hdr->daddr, AF_INET6, dif, sdif))
goto discard_and_relse; goto discard_and_relse;
if (tcp_filter(sk, skb)) { if (tcp_filter(sk, skb)) {