Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8917a777 authored by Ivan Delalande's avatar Ivan Delalande Committed by David S. Miller
Browse files

tcp: md5: add TCP_MD5SIG_EXT socket option to set a key address prefix 



Replace first padding in the tcp_md5sig structure with a new flag field
and address prefix length so it can be specified when configuring a new
key for TCP MD5 signature. The tcpm_flags field will only be used if the
socket option is TCP_MD5SIG_EXT to avoid breaking existing programs, and
tcpm_prefixlen only when the TCP_MD5SIG_FLAG_PREFIX flag is set.

Signed-off-by: default avatarBob Gilligan <gilligan@arista.com>
Signed-off-by: default avatarEric Mowat <mowat@arista.com>
Signed-off-by: default avatarIvan Delalande <colona@arista.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6797318e

include/net/tcp.h

+1 −0
Original line number Diff line number Diff line
@@ -1848,6 +1848,7 @@ struct tcp_sock_af_ops { 
					 const struct sock *sk,

					 const struct sk_buff *skb);

	int		(*md5_parse)(struct sock *sk,

				     int optname,

				     char __user *optval,

				     int optlen);

#endif

include/uapi/linux/tcp.h

+8 −3
Original line number Diff line number Diff line
@@ -118,6 +118,7 @@ enum { 
#define TCP_REPAIR_WINDOW	29	/* Get/set window parameters */

#define TCP_FASTOPEN_CONNECT	30	/* Attempt FastOpen with connect */

#define TCP_ULP			31	/* Attach a ULP to a TCP connection */

#define TCP_MD5SIG_EXT		32	/* TCP MD5 Signature with extensions */



struct tcp_repair_opt {

	__u32	opt_code;
@@ -235,11 +236,15 @@ enum { 
/* for TCP_MD5SIG socket option */

#define TCP_MD5SIG_MAXKEYLEN	80



/* tcp_md5sig extension flags for TCP_MD5SIG_EXT */

#define TCP_MD5SIG_FLAG_PREFIX		1	/* address prefix length */



struct tcp_md5sig {

	struct __kernel_sockaddr_storage tcpm_addr;	/* address associated */

	__u16	__tcpm_pad1;				/* zero */

	__u8	tcpm_flags;				/* extension flags */

	__u8	tcpm_prefixlen;				/* address prefix */

	__u16	tcpm_keylen;				/* key length */

	__u32	__tcpm_pad2;				/* zero */

	__u32	__tcpm_pad;				/* zero */

	__u8	tcpm_key[TCP_MD5SIG_MAXKEYLEN];		/* key (binary) */

};

net/ipv4/tcp.c

+2 −1
Original line number Diff line number Diff line
@@ -2714,8 +2714,9 @@ static int do_tcp_setsockopt(struct sock *sk, int level, 


#ifdef CONFIG_TCP_MD5SIG

	case TCP_MD5SIG:

	case TCP_MD5SIG_EXT:

		/* Read the IP->Key mappings from userspace */

		err = tp->af_specific->md5_parse(sk, optval, optlen);

		err = tp->af_specific->md5_parse(sk, optname, optval, optlen);

		break;

#endif

	case TCP_USER_TIMEOUT:

net/ipv4/tcp_ipv4.c

+12 −4
Original line number Diff line number Diff line
@@ -1066,11 +1066,12 @@ static void tcp_clear_md5_list(struct sock *sk) 
	}

}



static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval,

				 int optlen)

static int tcp_v4_parse_md5_keys(struct sock *sk, int optname,

				 char __user *optval, int optlen)

{

	struct tcp_md5sig cmd;

	struct sockaddr_in *sin = (struct sockaddr_in *)&cmd.tcpm_addr;

	u8 prefixlen = 32;



	if (optlen < sizeof(cmd))

		return -EINVAL;
@@ -1081,15 +1082,22 @@ static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval, 
	if (sin->sin_family != AF_INET)

		return -EINVAL;



	if (optname == TCP_MD5SIG_EXT &&

	    cmd.tcpm_flags & TCP_MD5SIG_FLAG_PREFIX) {

		prefixlen = cmd.tcpm_prefixlen;

		if (prefixlen > 32)

			return -EINVAL;

	}



	if (!cmd.tcpm_keylen)

		return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin->sin_addr.s_addr,

				      AF_INET, 32);

				      AF_INET, prefixlen);



	if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)

		return -EINVAL;



	return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin->sin_addr.s_addr,

			      AF_INET, 32, cmd.tcpm_key, cmd.tcpm_keylen,

			      AF_INET, prefixlen, cmd.tcpm_key, cmd.tcpm_keylen,

			      GFP_KERNEL);

}

net/ipv6/tcp_ipv6.c

+18 −7
Original line number Diff line number Diff line
@@ -515,11 +515,12 @@ static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk, 
	return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);

}



static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,

				 int optlen)

static int tcp_v6_parse_md5_keys(struct sock *sk, int optname,

				 char __user *optval, int optlen)

{

	struct tcp_md5sig cmd;

	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;

	u8 prefixlen;



	if (optlen < sizeof(cmd))

		return -EINVAL;
@@ -530,12 +531,22 @@ static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval, 
	if (sin6->sin6_family != AF_INET6)

		return -EINVAL;



	if (optname == TCP_MD5SIG_EXT &&

	    cmd.tcpm_flags & TCP_MD5SIG_FLAG_PREFIX) {

		prefixlen = cmd.tcpm_prefixlen;

		if (prefixlen > 128 || (ipv6_addr_v4mapped(&sin6->sin6_addr) &&

					prefixlen > 32))

			return -EINVAL;

	} else {

		prefixlen = ipv6_addr_v4mapped(&sin6->sin6_addr) ? 32 : 128;

	}



	if (!cmd.tcpm_keylen) {

		if (ipv6_addr_v4mapped(&sin6->sin6_addr))

			return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],

					      AF_INET, 32);

					      AF_INET, prefixlen);

		return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,

				      AF_INET6, 128);

				      AF_INET6, prefixlen);

	}



	if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
@@ -543,12 +554,12 @@ static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval, 


	if (ipv6_addr_v4mapped(&sin6->sin6_addr))

		return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],

				      AF_INET, 32, cmd.tcpm_key,

				      AF_INET, prefixlen, cmd.tcpm_key,

				      cmd.tcpm_keylen, GFP_KERNEL);



	return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,

			      AF_INET6, 128, cmd.tcpm_key, cmd.tcpm_keylen,

			      GFP_KERNEL);

			      AF_INET6, prefixlen, cmd.tcpm_key,

			      cmd.tcpm_keylen, GFP_KERNEL);

}



static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,