linux-stable.git/include/net/tcp.h, branch v6.7

net/tcp: Only produce AO/MD5 logs if there are any keys

2024-01-04T17:07:04+00:00

User won't care about inproper hash options in the TCP header if they
don't use neither TCP-AO nor TCP-MD5. Yet, those logs can add up in
syslog, while not being a real concern to the host admin:
> kernel: TCP: TCP segment has incorrect auth options set for XX.20.239.12.54681->XX.XX.90.103.80 [S]

Keep silent and avoid logging when there aren't any keys in the system.

Side-note: I also defined static_branch_tcp_*() helpers to avoid more
ifdeffery, going to remove more ifdeffery further with their help.

Reported-by: Christian Kujau 
Closes: https://lore.kernel.org/all/f6b59324-1417-566f-a976-ff2402718a8d@nerdbynature.de/
Signed-off-by: Dmitry Safonov 
Reviewed-by: Eric Dumazet 
Fixes: 2717b5adea9e ("net/tcp: Add tcp_hash_fail() ratelimited logs")
Link: https://lore.kernel.org/r/20240104-tcp_hash_fail-logs-v1-1-ff3e1f6f9e72@arista.com
Signed-off-by: Jakub Kicinski

tcp: fix mid stream window clamp.

2023-12-06T04:07:02+00:00

After the blamed commit below, if the user-space application performs
window clamping when tp->rcv_wnd is 0, the TCP socket will never be
able to announce a non 0 receive window, even after completely emptying
the receive buffer and re-setting the window clamp to higher values.

Refactor tcp_set_window_clamp() to address the issue: when the user
decreases the current clamp value, set rcv_ssthresh according to the
same logic used at buffer initialization, but ensuring reserved mem
provisioning.

To avoid code duplication factor-out the relevant bits from
tcp_adjust_rcv_ssthresh() in a new helper and reuse it in the above
scenario.

When increasing the clamp value, give the rcv_ssthresh a chance to grow
according to previously implemented heuristic.

Fixes: 3aa7857fe1d7 ("tcp: enable mid stream window clamp")
Reported-by: David Gibson 
Reported-by: Stefano Brivio 
Signed-off-by: Paolo Abeni 
Reviewed-by: Eric Dumazet 
Link: https://lore.kernel.org/r/705dad54e6e6e9a010e571bf58e0b35a8ae70503.1701706073.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski

net/tcp: Wire up l3index to TCP-AO

2023-10-27T09:35:46+00:00

Similarly how TCP_MD5SIG_FLAG_IFINDEX works for TCP-MD5,
TCP_AO_KEYF_IFINDEX is an AO-key flag that binds that MKT to a specified
by L3 ifinndex. Similarly, without this flag the key will work in
the default VRF l3index = 0 for connections.
To prevent AO-keys from overlapping, it's restricted to add key B for a
socket that has key A, which have the same sndid/rcvid and one of
the following is true:
- !(A.keyflags & TCP_AO_KEYF_IFINDEX) or !(B.keyflags & TCP_AO_KEYF_IFINDEX)
  so that any key is non-bound to a VRF
- A.l3index == B.l3index
  both want to work for the same VRF

Additionally, it's restricted to match TCP-MD5 keys for the same peer
the following way:
|--------------|--------------------|----------------|---------------|
|              | MD5 key without    |     MD5 key    |    MD5 key    |
|              |     l3index        |    l3index=0   |   l3index=N   |
|--------------|--------------------|----------------|---------------|
|  TCP-AO key  |                    |                |               |
|  without     |       reject       |    reject      |   reject      |
|  l3index     |                    |                |               |
|--------------|--------------------|----------------|---------------|
|  TCP-AO key  |                    |                |               |
|  l3index=0   |       reject       |    reject      |   allow       |
|--------------|--------------------|----------------|---------------|
|  TCP-AO key  |                    |                |               |
|  l3index=N   |       reject       |    allow       |   reject      |
|--------------|--------------------|----------------|---------------|

This is done with the help of tcp_md5_do_lookup_any_l3index() to reject
adding AO key without TCP_AO_KEYF_IFINDEX if there's TCP-MD5 in any VRF.
This is important for case where sysctl_tcp_l3mdev_accept = 1
Similarly, for TCP-AO lookups tcp_ao_do_lookup() may be used with
l3index < 0, so that __tcp_ao_key_cmp() will match TCP-AO key in any VRF.

Signed-off-by: Dmitry Safonov 
Acked-by: David Ahern 
Signed-off-by: David S. Miller

net/tcp: Add static_key for TCP-AO

2023-10-27T09:35:45+00:00

Similarly to TCP-MD5, add a static key to TCP-AO that is patched out
when there are no keys on a machine and dynamically enabled with the
first setsockopt(TCP_AO) adds a key on any socket. The static key is as
well dynamically disabled later when the socket is destructed.

The lifetime of enabled static key here is the same as ao_info: it is
enabled on allocation, passed over from full socket to twsk and
destructed when ao_info is scheduled for destruction.

Signed-off-by: Dmitry Safonov 
Acked-by: David Ahern 
Signed-off-by: David S. Miller

net/tcp: Add tcp_hash_fail() ratelimited logs

2023-10-27T09:35:45+00:00

Add a helper for logging connection-detailed messages for failed TCP
hash verification (both MD5 and AO).

Co-developed-by: Francesco Ruggeri 
Signed-off-by: Francesco Ruggeri 
Co-developed-by: Salam Noureddine 
Signed-off-by: Salam Noureddine 
Signed-off-by: Dmitry Safonov 
Acked-by: David Ahern 
Signed-off-by: David S. Miller

net/tcp: Add TCP-AO segments counters

2023-10-27T09:35:45+00:00

Introduce segment counters that are useful for troubleshooting/debugging
as well as for writing tests.
Now there are global snmp counters as well as per-socket and per-key.

Co-developed-by: Francesco Ruggeri 
Signed-off-by: Francesco Ruggeri 
Co-developed-by: Salam Noureddine 
Signed-off-by: Salam Noureddine 
Signed-off-by: Dmitry Safonov 
Acked-by: David Ahern 
Signed-off-by: David S. Miller

net/tcp: Verify inbound TCP-AO signed segments

2023-10-27T09:35:45+00:00

Now there is a common function to verify signature on TCP segments:
tcp_inbound_hash(). It has checks for all possible cross-interactions
with MD5 signs as well as with unsigned segments.

The rules from RFC5925 are:
(1) Any TCP segment can have at max only one signature.
(2) TCP connections can't switch between using TCP-MD5 and TCP-AO.
(3) TCP-AO connections can't stop using AO, as well as unsigned
    connections can't suddenly start using AO.

Co-developed-by: Francesco Ruggeri 
Signed-off-by: Francesco Ruggeri 
Co-developed-by: Salam Noureddine 
Signed-off-by: Salam Noureddine 
Signed-off-by: Dmitry Safonov 
Acked-by: David Ahern 
Signed-off-by: David S. Miller

net/tcp: Sign SYN-ACK segments with TCP-AO

2023-10-27T09:35:45+00:00

Similarly to RST segments, wire SYN-ACKs to TCP-AO.
tcp_rsk_used_ao() is handy here to check if the request socket used AO
and needs a signature on the outgoing segments.

Co-developed-by: Francesco Ruggeri 
Signed-off-by: Francesco Ruggeri 
Co-developed-by: Salam Noureddine 
Signed-off-by: Salam Noureddine 
Signed-off-by: Dmitry Safonov 
Acked-by: David Ahern 
Signed-off-by: David S. Miller

net/tcp: Wire TCP-AO to request sockets

2023-10-27T09:35:45+00:00

Now when the new request socket is created from the listening socket,
it's recorded what MKT was used by the peer. tcp_rsk_used_ao() is
a new helper for checking if TCP-AO option was used to create the
request socket.
tcp_ao_copy_all_matching() will copy all keys that match the peer on the
request socket, as well as preparing them for the usage (creating
traffic keys).

Co-developed-by: Francesco Ruggeri 
Signed-off-by: Francesco Ruggeri 
Co-developed-by: Salam Noureddine 
Signed-off-by: Salam Noureddine 
Signed-off-by: Dmitry Safonov 
Acked-by: David Ahern 
Signed-off-by: David S. Miller

net/tcp: Add AO sign to RST packets

2023-10-27T09:35:44+00:00

Wire up sending resets to TCP-AO hashing.

Co-developed-by: Francesco Ruggeri 
Signed-off-by: Francesco Ruggeri 
Co-developed-by: Salam Noureddine 
Signed-off-by: Salam Noureddine 
Signed-off-by: Dmitry Safonov 
Acked-by: David Ahern 
Signed-off-by: David S. Miller