From nobody Thu Sep 18 09:21:30 2025 Delivered-To: wpasupplicant.patchew@gmail.com Received: by 2002:a05:6638:bd2:0:0:0:0 with SMTP id g18csp413186jad; Wed, 23 Feb 2022 03:08:58 -0800 (PST) X-Google-Smtp-Source: ABdhPJyMCK93JDzA87jw1AA8BTgIguS82UEjVJx9CVJe5rKC7Hpg+9jRecMjOx/Cdycb9BOUHCAE X-Received: by 2002:a05:6402:2074:b0:410:81bf:ff3b with SMTP id bd20-20020a056402207400b0041081bfff3bmr30960972edb.326.1645614537908; Wed, 23 Feb 2022 03:08:57 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1645614537; cv=none; d=google.com; s=arc-20160816; b=cAytZ4u5Da0+edh6AzqjsGfFywEvYNP4HhN0qaXM1f3XuuiEeTwF6JkZJKLIFMdkNo 2SO4YOou4OUGOpvy6cMa7wmc58zzDDV0Sv5ZYx1wd9fkW6EX+NAhWsyMp2kbDDEgwT8h IJCWNNYT8TeD01wxJo9oQEDf/VaUmcNqGdH1B+2E+gO44ddsXkne5mBaBm7OnnbQoURe BZl3nyjhwX+djR/EApThAugGtskWUYVd5xf/PaCbxoejaDSBCoo67+CiuVulp+b/fwLw hCLLXTdD6CoyALnjsesfIWWQjPwXplVOk3JZf8citV+UbmPWMW5qJzDdWV6nvnsApjrn e4QQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from; bh=pDAzfzweoaNgFt+6tW6iMvpszVfgSRX4Bq94etrUP9E=; b=nEP+dkCw1zfQcs10/Wz3o+v3VsEotDrPiAA3gZOgDt06Rhx5rlMgmGAZqDfIVU6yFc wChmPU/alqiWcVOudlXxjNyaEhxDgJwsofItNi90sfgVu3z7x9ZYtfeHsdPh6L3bZcC1 L84Z5CBN/fW7e1mWgSUiBK558qm7Lf5tMehwMTc7rIRF2YPMPPZMySreZ3izq7B0v9zM zcnKAP4ee5VE1NJSlCRfbogfDboDbYJeqf9fCIUTJPUcMYbqbkSRkGIIWm1K3ryg+0b3 57Ic2QdSiS5yQMY1coTfSj63qgvtM79W6vTuoI+Yov8HtDLT2izCBQN1j+TEhQinHL5S ZQtg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of mptcp+bounces-3958-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 2604:1380:1:3600::1 as permitted sender) smtp.mailfrom="mptcp+bounces-3958-wpasupplicant.patchew=gmail.com@lists.linux.dev" Return-Path: Received: from ewr.edge.kernel.org (ewr.edge.kernel.org. [2604:1380:1:3600::1]) by mx.google.com with ESMTPS id nd23si13352494ejc.729.2022.02.23.03.08.57 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 23 Feb 2022 03:08:57 -0800 (PST) Received-SPF: pass (google.com: domain of mptcp+bounces-3958-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 2604:1380:1:3600::1 as permitted sender) client-ip=2604:1380:1:3600::1; Authentication-Results: mx.google.com; spf=pass (google.com: domain of mptcp+bounces-3958-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 2604:1380:1:3600::1 as permitted sender) smtp.mailfrom="mptcp+bounces-3958-wpasupplicant.patchew=gmail.com@lists.linux.dev" Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ewr.edge.kernel.org (Postfix) with ESMTPS id 637221C0A03 for ; Wed, 23 Feb 2022 11:08:56 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 1A0FD642; Wed, 23 Feb 2022 11:08:55 +0000 (UTC) X-Original-To: mptcp@lists.linux.dev Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [193.142.43.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68AE6A57 for ; Wed, 23 Feb 2022 11:08:53 +0000 (UTC) Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1nMpVr-0005iG-Kr; Wed, 23 Feb 2022 12:08:51 +0100 From: Florian Westphal To: Cc: Florian Westphal Subject: [PATCH 3/4] mptcp: handle join requests via pernet listen socket Date: Wed, 23 Feb 2022 12:08:31 +0100 Message-Id: <20220223110832.29357-4-fw@strlen.de> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220223110832.29357-1-fw@strlen.de> References: <20220223110832.29357-1-fw@strlen.de> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Currently mptcp adds kernel-based listener socket for all netlink-configured mptcp address endpoints. This has caveats because kernel may interfere with unrelated programs that use same address/port pairs. RFC 8684 says: Demultiplexing subflow SYNs MUST be done using the token; this is unlike traditional TCP, where the destination port is used for demultiplexing SYN packets. Once a subflow is set up, demultiplexing packets is done using the 5-tuple, as in traditional TCP. This patch deviates from this in that it retains the existing checks of verifying the incoming requests destination vs. the list of announced addresses. If the request is to an address that was not assigned, its treated like an invalid token, i.e. we send a tcp reset with mptcp error specific code is returned. The checks that do this are moved from subflow specific code to the new hook, this allows us to perform the check at an earlier stage. Furthermore, TCP-only listeners take precedence: An MPTCP peer MUST NOT announce addr:port pairs that are already in use by a non-mptcp listener. This could be changed, but it requires move of mptcp_handle_join() hook *before* the tcp port demux, i.e. an additional conditional in hotpath. As-is, the additional conditional (syn && !rst && ...) is placed in the 'no socket found' path. The pernet "listening" socket is hidden from userspace, its not part of any hashes and not bound to any address/port. TPROXY-like semantics apply: If tcp demux cannot find a port for a given packet, check if the packet is a syn packet with a valid join token. If so, the pernet listener is returned and tcp processing resumes. Otherwise, handling is identical. Signed-off-by: Florian Westphal Reported-by: kernel test robot --- include/net/mptcp.h | 10 ++ net/ipv6/tcp_ipv6.c | 19 ++-- net/mptcp/ctrl.c | 229 ++++++++++++++++++++++++++++++++++++++++++- net/mptcp/protocol.c | 2 +- net/mptcp/protocol.h | 2 +- net/mptcp/subflow.c | 8 +- 6 files changed, 251 insertions(+), 19 deletions(-) diff --git a/include/net/mptcp.h b/include/net/mptcp.h index 5ee422b56902..49c188b978e1 100644 --- a/include/net/mptcp.h +++ b/include/net/mptcp.h @@ -189,6 +189,7 @@ int mptcp_subflow_init_cookie_req(struct request_sock *= req, struct sk_buff *skb); =20 __be32 mptcp_get_reset_option(const struct sk_buff *skb); +struct sock *__mptcp_handle_join(int af, struct sk_buff *skb); =20 static inline __be32 mptcp_reset_option(const struct sk_buff *skb) { @@ -199,6 +200,11 @@ static inline __be32 mptcp_reset_option(const struct s= k_buff *skb) } static inline struct sock *mptcp_handle_join(int af, struct sk_buff *skb) { + const struct tcphdr *th =3D tcp_hdr(skb); + + if (th->syn && !th->ack && !th->rst && !th->fin) + return __mptcp_handle_join(af, skb); + return NULL; } #else @@ -283,9 +289,13 @@ static inline struct sock *mptcp_handle_join(int af, s= truct sk_buff *skb) { retu =20 #if IS_ENABLED(CONFIG_MPTCP_IPV6) int mptcpv6_init(void); +int mptcpv6_init_net(struct net *net); +void mptcpv6_exit_net(struct net *net); void mptcpv6_handle_mapped(struct sock *sk, bool mapped); #elif IS_ENABLED(CONFIG_IPV6) static inline int mptcpv6_init(void) { return 0; } +static inline int mptcpv6_init_net(struct net *net) { return 0; } +static inline void mptcpv6_exit_net(struct net *net) { } static inline void mptcpv6_handle_mapped(struct sock *sk, bool mapped) { } #endif =20 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 8ae0db599f56..ddc27be0e566 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -2256,13 +2256,22 @@ static struct inet_protosw tcpv6_protosw =3D { =20 static int __net_init tcpv6_net_init(struct net *net) { - return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6, - SOCK_RAW, IPPROTO_TCP, net); + int err =3D inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6, + SOCK_RAW, IPPROTO_TCP, net); + if (err) + return err; + + err =3D mptcpv6_init_net(net); + if (err) + inet_ctl_sock_destroy(net->ipv6.tcp_sk); + + return err; } =20 static void __net_exit tcpv6_net_exit(struct net *net) { inet_ctl_sock_destroy(net->ipv6.tcp_sk); + mptcpv6_exit_net(net); } =20 static struct pernet_operations tcpv6_net_ops =3D { @@ -2287,15 +2296,9 @@ int __init tcpv6_init(void) if (ret) goto out_tcpv6_protosw; =20 - ret =3D mptcpv6_init(); - if (ret) - goto out_tcpv6_pernet_subsys; - out: return ret; =20 -out_tcpv6_pernet_subsys: - unregister_pernet_subsys(&tcpv6_net_ops); out_tcpv6_protosw: inet6_unregister_protosw(&tcpv6_protosw); out_tcpv6_protocol: diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index ae20b7d92e28..c7370c5147df 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -12,6 +12,7 @@ #include =20 #include "protocol.h" +#include "mib.h" =20 #define MPTCP_SYSCTL_PATH "net/mptcp" =20 @@ -21,6 +22,12 @@ static int mptcp_pernet_id; static int mptcp_pm_type_max =3D __MPTCP_PM_TYPE_MAX; #endif =20 +struct mptcp_join_sk { + struct sock *sk; + struct inet_bind_bucket *tb; + struct inet_bind_hashbucket head; +}; + struct mptcp_pernet { #ifdef CONFIG_SYSCTL struct ctl_table_header *ctl_table_hdr; @@ -32,6 +39,18 @@ struct mptcp_pernet { u8 checksum_enabled; u8 allow_join_initial_addr_port; u8 pm_type; + + /* pernet listener to handle mptcp join requests + * based on the mptcp token. + * + * Has to be pernet because tcp uses + * sock_net(sk_listener) to obtain the net namespace for + * the syn/ack route lookup. + */ + struct mptcp_join_sk join4; +#if IS_ENABLED(CONFIG_MPTCP_IPV6) + struct mptcp_join_sk join6; +#endif }; =20 static struct mptcp_pernet *mptcp_get_pernet(const struct net *net) @@ -185,13 +204,190 @@ static void mptcp_pernet_del_table(struct mptcp_pern= et *pernet) {} =20 #endif /* CONFIG_SYSCTL */ =20 +static void add_mptcp_rst(struct sk_buff *skb) +{ + struct mptcp_ext *ext =3D skb_ext_add(skb, SKB_EXT_MPTCP); + + if (ext) { + memset(ext, 0, sizeof(*ext)); + ext->reset_reason =3D MPTCP_RST_EMPTCP; + } +} + +struct sock *__mptcp_handle_join(int af, struct sk_buff *skb) +{ + struct mptcp_options_received mp_opt; + struct mptcp_pernet *pernet; + struct mptcp_sock *msk; + struct socket *ssock; + struct sock *lsk; + struct net *net; + + /* paranoia check: don't allow 0 destination port, + * else __inet_inherit_port will insert the child socket + * into the phony hash slot of the pernet listener. + */ + if (tcp_hdr(skb)->dest =3D=3D 0) + return NULL; + + mptcp_get_options(skb, &mp_opt); + + if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ)) + return NULL; + + net =3D dev_net(skb_dst(skb)->dev); + if (!mptcp_is_enabled(net)) + return NULL; + + /* RFC8684: If the token is unknown [..], the receiver will send + * back a reset (RST) signal, analogous to an unknown port in TCP, + * containing an MP_TCPRST option (Section 3.6) [..] + */ + msk =3D mptcp_token_get_sock(net, mp_opt.token); + if (!msk) { + add_mptcp_rst(skb); + return NULL; + } + + if (!mptcp_pm_sport_in_anno_list(msk, af, skb)) { + sock_put((struct sock *)msk); + MPTCP_INC_STATS(net, MPTCP_MIB_MISMATCHPORTSYNRX); + add_mptcp_rst(skb); + return NULL; + } + + sock_put((struct sock *)msk); + pernet =3D mptcp_get_pernet(net); + + switch (af) { + case AF_INET: + lsk =3D pernet->join4.sk; + break; +#if IS_ENABLED(CONFIG_MPTCP_IPV6) + case AF_INET6: + lsk =3D pernet->join6.sk; + break; +#endif + default: + WARN_ON_ONCE(1); + return NULL; + } + + ssock =3D __mptcp_nmpc_socket(mptcp_sk(lsk)); + if (WARN_ON(!ssock)) + return NULL; + + return ssock->sk; +} + +static struct socket *mptcp_create_join_listen_socket(struct net *net, int= af) +{ + struct socket *s, *ssock; + int err; + + err =3D sock_create_kern(net, af, SOCK_STREAM, IPPROTO_MPTCP, &s); + if (err) + return ERR_PTR(err); + + ssock =3D __mptcp_nmpc_socket(mptcp_sk(s->sk)); + if (!ssock) { + err =3D -EINVAL; + goto out; + } + + ssock->sk->sk_max_ack_backlog =3D SOMAXCONN; + inet_sk_state_store(ssock->sk, TCP_LISTEN); + + s->sk->sk_max_ack_backlog =3D SOMAXCONN; + inet_sk_state_store(s->sk, TCP_LISTEN); + + s->sk->sk_net_refcnt =3D 1; + get_net_track(net, &s->sk->ns_tracker, GFP_KERNEL); + sock_inuse_add(net, 1); + + return s; +out: + sock_release(s); + return ERR_PTR(err); +} + +static int mptcp_init_join_sk(struct net *net, struct sock *sk, struct mpt= cp_join_sk *join_sk) +{ + struct socket *ssock =3D __mptcp_nmpc_socket(mptcp_sk(sk)); + struct inet_hashinfo *table =3D ssock->sk->sk_prot->h.hashinfo; + struct inet_bind_bucket *tb; + + spin_lock_init(&join_sk->head.lock); + INIT_HLIST_HEAD(&join_sk->head.chain); + + /* Our "listen socket" isn't bound to any address or port. + * Conceptually, SYN packet with mptcp join request are steered to + * this pernet socket just like TPROXY steals arbitrary connection + * requests to assign them to listening socket with different + * address or port. + * + * The bind_bucket is needed for sake of __inet_inherit_port(), + * so it can place the new child socket in the correct + * bind_bucket slot. + * + * A phony head is used to hide this socket from normal sk loookup. + */ + tb =3D inet_bind_bucket_create(table->bind_bucket_cachep, + net, &join_sk->head, 0, 0); + if (!tb) + return -ENOMEM; + + inet_csk(ssock->sk)->icsk_bind_hash =3D tb; + return 0; +} + static int __net_init mptcp_net_init(struct net *net) { struct mptcp_pernet *pernet =3D mptcp_get_pernet(net); + struct socket *sock; + int err; =20 mptcp_pernet_set_defaults(pernet); =20 - return mptcp_pernet_new_table(net, pernet); + err =3D mptcp_pernet_new_table(net, pernet); + if (err) + return err; + + sock =3D mptcp_create_join_listen_socket(net, AF_INET); + if (IS_ERR(sock)) { + err =3D PTR_ERR(sock); + goto out_table; + } + + err =3D mptcp_init_join_sk(net, sock->sk, &pernet->join4); + if (err) { + sock_release(sock); + goto out_table; + } + + /* struct sock is still reachable via sock->sk_socket backpointer */ + pernet->join4.sk =3D sock->sk; + return err; + +out_table: + if (!net_eq(net, &init_net)) + mptcp_pernet_del_table(pernet); + return err; +} + +static void __net_exit mptcp_exit_join_sk(struct mptcp_join_sk *jsk) +{ + struct socket *ssock =3D __mptcp_nmpc_socket(mptcp_sk(jsk->sk)); + struct inet_bind_bucket *tb; + struct inet_hashinfo *table; + + table =3D ssock->sk->sk_prot->h.hashinfo; + + tb =3D inet_csk(ssock->sk)->icsk_bind_hash; + inet_bind_bucket_destroy(table->bind_bucket_cachep, tb); + + ssock =3D jsk->sk->sk_socket; + sock_release(ssock); } =20 /* Note: the callback will only be called per extra netns */ @@ -200,6 +396,7 @@ static void __net_exit mptcp_net_exit(struct net *net) struct mptcp_pernet *pernet =3D mptcp_get_pernet(net); =20 mptcp_pernet_del_table(pernet); + mptcp_exit_join_sk(&pernet->join4); } =20 static struct pernet_operations mptcp_pernet_ops =3D { @@ -219,12 +416,36 @@ void __init mptcp_init(void) } =20 #if IS_ENABLED(CONFIG_MPTCP_IPV6) -int __init mptcpv6_init(void) +int __net_init mptcpv6_init_net(struct net *net) { + struct mptcp_pernet *pernet =3D mptcp_get_pernet(net); + struct socket *sock; int err; =20 - err =3D mptcp_proto_v6_init(); + if (net_eq(net, &init_net)) { + err =3D mptcp_proto_v6_init(); + if (err) + return err; + } + + sock =3D mptcp_create_join_listen_socket(net, AF_INET6); + if (IS_ERR(sock)) + return PTR_ERR(sock); =20 - return err; + err =3D mptcp_init_join_sk(net, sock->sk, &pernet->join6); + if (err) { + sock_release(sock); + return err; + } + + pernet->join6.sk =3D sock->sk; + return 0; +} + +void __net_exit mptcpv6_exit_net(struct net *net) +{ + struct mptcp_pernet *pernet =3D mptcp_get_pernet(net); + + mptcp_exit_join_sk(&pernet->join6); } #endif diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 3cb975227d12..bc7108ed453c 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3794,7 +3794,7 @@ static struct inet_protosw mptcp_v6_protosw =3D { .flags =3D INET_PROTOSW_ICSK, }; =20 -int __init mptcp_proto_v6_init(void) +int __net_init mptcp_proto_v6_init(void) { int err; =20 diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 6b2d7f60c8ad..7ec2513e1c2f 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -648,7 +648,7 @@ static inline bool mptcp_has_another_subflow(struct soc= k *ssk) =20 void __init mptcp_proto_init(void); #if IS_ENABLED(CONFIG_MPTCP_IPV6) -int __init mptcp_proto_v6_init(void); +int __net_init mptcp_proto_v6_init(void); #endif =20 struct sock *mptcp_sk_clone(const struct sock *sk, diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 1fa096086f82..99c28aea011d 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -116,6 +116,9 @@ static void subflow_init_req(struct request_sock *req, = const struct sock *sk_lis =20 static bool subflow_use_different_sport(struct mptcp_sock *msk, const stru= ct sock *sk) { + if (inet_sk(sk)->inet_sport =3D=3D 0) + return true; + return inet_sk(sk)->inet_sport !=3D inet_sk((struct sock *)msk)->inet_spo= rt; } =20 @@ -216,11 +219,6 @@ static int subflow_check_req(struct request_sock *req, pr_debug("syn inet_sport=3D%d %d", ntohs(inet_sk(sk_listener)->inet_sport), ntohs(inet_sk((struct sock *)subflow_req->msk)->inet_sport)); - if (!mptcp_pm_sport_in_anno_list(subflow_req->msk, - sk_listener->sk_family, skb)) { - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MISMATCHPORTSYNRX); - return -EPERM; - } SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINPORTSYNRX); } =20 --=20 2.34.1