From nobody Wed May 8 02:42:01 2024 Delivered-To: wpasupplicant.patchew@gmail.com Received: by 2002:a02:7824:0:0:0:0:0 with SMTP id p36csp724896jac; Thu, 21 Oct 2021 07:51:36 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwt7EyncCoJacZ6VVpP1n4/lmK/fTYoBhw3eNAiWj09miSEmr+tMzCgx7oEpkZQu8jczlio X-Received: by 2002:a05:6a00:15c8:b0:44d:9f7e:ece2 with SMTP id o8-20020a056a0015c800b0044d9f7eece2mr6221832pfu.86.1634827896671; Thu, 21 Oct 2021 07:51:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1634827896; cv=none; d=google.com; s=arc-20160816; b=Tf0e7nXi/XiA/e54lYv88QY9I+8lv03OJqoldT+y4LdKWLU9qq1MYIDVMm7GOywRX+ uWfo+f40WXFwIUaA0SCmusKmTyhuuGSWcRQZ3yzOSHjEKRrZ0VP1RYtU6fAtbISGGsc/ 7wKp87wqJu0kOLSoPWYhqbmUPhjqVm1Vh8PgU2K4wE6XMw625Rx+mbQ96pQUSYO2izWW oN7oygBndA33uQLtK2brXEjBFsM1+iau58qSYogtH0aGC7C+P/EpXa9xDRn8BLCHJQ8T Qo3+1YOPL/aaETaUnvlch79h1gjd1A8Pbdodq1yKYojElaJsZ5O+2WZMPazD/P5NYhA0 GNkw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:message-id:date:subject:cc:to :from:dkim-signature; bh=XPNJzWMu1H6JfAZbvCA8aIWGa6w6Bxy18gm08/QGtMY=; b=Ea4SyqCvpdkthXnXq1TXDZ9JPU+5jPkKUDxp3JIT/3nUpBT67Fn0mTMBO8tPBNlM2L goEv5fQYxQfsGv0FZWGcC+xT/x9u+2Xt69hOJVIDLTl02gXB2XIrEysQ0k4OGo2yWxIu Y3DrU3OyHDh7wuH25toky/A1Is4ORF6aZk/pBUxo7OGAPWwptP0Dif5CnH0FvHanfAgh 7V+N18t0vWgjsYyOBEJVu07trarndX0uBPUj6N5N2uc3W30HJci65pHZMx9qH+bm6m/4 pElwIPx2gyFulxNBaUoN22FZ+4ay7cFFwCJxKsjXOpW9Lo8ORHaDhWflv1Q2mZWJij+B 2i7Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=RQ1AX9B3; spf=pass (google.com: domain of mptcp+bounces-2227-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 2604:1380:1000:8100::1 as permitted sender) smtp.mailfrom="mptcp+bounces-2227-wpasupplicant.patchew=gmail.com@lists.linux.dev"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from sjc.edge.kernel.org (sjc.edge.kernel.org. [2604:1380:1000:8100::1]) by mx.google.com with ESMTPS id t4si8500838pgv.356.2021.10.21.07.51.36 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 21 Oct 2021 07:51:36 -0700 (PDT) Received-SPF: pass (google.com: domain of mptcp+bounces-2227-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 2604:1380:1000:8100::1 as permitted sender) client-ip=2604:1380:1000:8100::1; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=RQ1AX9B3; spf=pass (google.com: domain of mptcp+bounces-2227-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 2604:1380:1000:8100::1 as permitted sender) smtp.mailfrom="mptcp+bounces-2227-wpasupplicant.patchew=gmail.com@lists.linux.dev"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sjc.edge.kernel.org (Postfix) with ESMTPS id 07D443E1044 for ; Thu, 21 Oct 2021 14:51:36 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id EB98972; Thu, 21 Oct 2021 14:51:34 +0000 (UTC) X-Original-To: mptcp@lists.linux.dev Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 41C0D68 for ; Thu, 21 Oct 2021 14:51:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1634827892; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XPNJzWMu1H6JfAZbvCA8aIWGa6w6Bxy18gm08/QGtMY=; b=RQ1AX9B300X9+ZgBHodtabmMQKwhEh2bQG0UeGCk6S4QGvc8sGMdzTPDyVBlptYqp5vMLt DOjhmX4n3ZwY4WIYnKAd1dhXOlU9pwSMaV6JNCKc2aIYlIhkNOt0+AzXzOAFd+xYfmQyVi Qo+4OZ5EijBns45dCfvfoToAZBArbFU= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-582-FCcU5M7mM4-zt-AjX3PwqQ-1; Thu, 21 Oct 2021 10:51:28 -0400 X-MC-Unique: FCcU5M7mM4-zt-AjX3PwqQ-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id E78411922960; Thu, 21 Oct 2021 14:51:26 +0000 (UTC) Received: from dcaratti.station (unknown [10.40.192.250]) by smtp.corp.redhat.com (Postfix) with ESMTP id 57F79101E5AE; Thu, 21 Oct 2021 14:51:25 +0000 (UTC) From: Davide Caratti To: Mat Martineau , Matthieu Baerts , Paolo Abeni Cc: mptcp@lists.linux.dev, psonparo@redhat.com Subject: [PATCH mptcp-net] mptcp: fix corrupt receiver key in MPC + data + checksum Date: Thu, 21 Oct 2021 16:51:15 +0200 Message-Id: <1207c7d44dd4d1a630afc8b7018cf4185fe4a489.1634827708.git.dcaratti@redhat.com> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dcaratti@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable using packetdrill it's possible to observe that the receiver key contains random values when clients transmit MP_CAPABLE with data and checksum (as specified in RFC8684 =C2=A73.1). Fix the layout of mptcp_out_options, to av= oid using the skb extension copy when writing the MP_CAPABLE sub-option. Fixes: d7b269083786 ("mptcp: shrink mptcp_out_options struct") Link: https://github.com/multipath-tcp/mptcp_net-next/issues/233 Reported-by: Poorva Sonparote Signed-off-by: Davide Caratti Reported-by: Tessares CI Reported-by: kernel test robot --- include/net/mptcp.h | 4 ++++ net/mptcp/options.c | 38 +++++++++++++++++++++++--------------- 2 files changed, 27 insertions(+), 15 deletions(-) diff --git a/include/net/mptcp.h b/include/net/mptcp.h index f83fa48408b3..a925349b4b89 100644 --- a/include/net/mptcp.h +++ b/include/net/mptcp.h @@ -71,6 +71,10 @@ struct mptcp_out_options { struct { u64 sndr_key; u64 rcvr_key; + u64 data_seq; + u32 subflow_seq; + u16 data_len; + __sum16 csum; }; struct { struct mptcp_addr_info addr; diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 422f4acfb3e6..ce27a4afc64a 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -489,7 +489,7 @@ static bool mptcp_established_options_mp(struct sock *s= k, struct sk_buff *skb, * discriminate between TCPOLEN_MPTCP_MPC_ACK_DATA and * TCPOLEN_MPTCP_MPC_ACK */ - opts->ext_copy.data_len =3D data_len; + opts->data_len =3D data_len; opts->suboptions =3D OPTION_MPTCP_MPC_ACK; opts->sndr_key =3D subflow->local_key; opts->rcvr_key =3D subflow->remote_key; @@ -505,9 +505,9 @@ static bool mptcp_established_options_mp(struct sock *s= k, struct sk_buff *skb, len =3D TCPOLEN_MPTCP_MPC_ACK_DATA; if (opts->csum_reqd) { /* we need to propagate more info to csum the pseudo hdr */ - opts->ext_copy.data_seq =3D mpext->data_seq; - opts->ext_copy.subflow_seq =3D mpext->subflow_seq; - opts->ext_copy.csum =3D mpext->csum; + opts->data_seq =3D mpext->data_seq; + opts->subflow_seq =3D mpext->subflow_seq; + opts->csum =3D mpext->csum; len +=3D TCPOLEN_MPTCP_DSS_CHECKSUM; } *size =3D ALIGN(len, 4); @@ -1223,25 +1223,30 @@ static void mptcp_set_rwin(const struct tcp_sock *t= p) WRITE_ONCE(msk->rcv_wnd_sent, ack_seq); } =20 -static u16 mptcp_make_csum(const struct mptcp_ext *mpext) +static u16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, = __sum16 csum) { struct csum_pseudo_header header; - __wsum csum; =20 /* cfr RFC 8684 3.3.1.: * the data sequence number used in the pseudo-header is * always the 64-bit value, irrespective of what length is used in the * DSS option itself. */ - header.data_seq =3D cpu_to_be64(mpext->data_seq); - header.subflow_seq =3D htonl(mpext->subflow_seq); - header.data_len =3D htons(mpext->data_len); + header.data_seq =3D cpu_to_be64(data_seq); + header.subflow_seq =3D htonl(subflow_seq); + header.data_len =3D htons(data_len); header.csum =3D 0; =20 - csum =3D csum_partial(&header, sizeof(header), ~csum_unfold(mpext->csum)); + csum =3D csum_partial(&header, sizeof(header), ~csum_unfold(csum)); return (__force u16)csum_fold(csum); } =20 +static u16 mptcp_make_csum(const struct mptcp_ext *mpext) +{ + return __mptcp_make_csum(mpext->data_seq, mpext->subflow_seq, mpext->data= _len, + mpext->csum); +} + void mptcp_write_options(__be32 *ptr, const struct tcp_sock *tp, struct mptcp_out_options *opts) { @@ -1332,7 +1337,7 @@ void mptcp_write_options(__be32 *ptr, const struct tc= p_sock *tp, len =3D TCPOLEN_MPTCP_MPC_SYN; } else if (OPTION_MPTCP_MPC_SYNACK & opts->suboptions) { len =3D TCPOLEN_MPTCP_MPC_SYNACK; - } else if (opts->ext_copy.data_len) { + } else if (opts->data_len) { len =3D TCPOLEN_MPTCP_MPC_ACK_DATA; if (opts->csum_reqd) len +=3D TCPOLEN_MPTCP_DSS_CHECKSUM; @@ -1361,14 +1366,17 @@ void mptcp_write_options(__be32 *ptr, const struct = tcp_sock *tp, =20 put_unaligned_be64(opts->rcvr_key, ptr); ptr +=3D 2; - if (!opts->ext_copy.data_len) + if (!opts->data_len) goto mp_capable_done; =20 if (opts->csum_reqd) { - put_unaligned_be32(opts->ext_copy.data_len << 16 | - mptcp_make_csum(&opts->ext_copy), ptr); + put_unaligned_be32(opts->data_len << 16 | + __mptcp_make_csum(opts->data_seq, + opts->subflow_seq, + opts->data_len, + opts->csum), ptr); } else { - put_unaligned_be32(opts->ext_copy.data_len << 16 | + put_unaligned_be32(opts->data_len << 16 | TCPOPT_NOP << 8 | TCPOPT_NOP, ptr); } ptr +=3D 1; --=20 2.31.1