[v2] tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct()

[PATCH net-next v2 0/2] tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct()

Dmitry Safonov via B4 Relay posted 2 patches 1 month ago

Diff against v1 v3 v4 v5
Download series mbox

There is a newer version of this series

include/net/tcp.h        |  4 ++++
net/ipv4/tcp.c           | 16 ++++++++++++++++
net/ipv4/tcp_ao.c        |  5 ++---
net/ipv4/tcp_ipv4.c      | 37 ++++++++++---------------------------
net/ipv4/tcp_minisocks.c | 19 +++++--------------
net/ipv6/tcp_ipv6.c      |  8 ++++++++
6 files changed, 45 insertions(+), 44 deletions(-)

Expand all Fold all

[PATCH net-next v2 0/2] tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct()

Posted by Dmitry Safonov via B4 Relay 1 month ago

On one side a minor/cosmetic issue, especially nowadays when
TCP-AO/TCP-MD5 signature verification failures aren't logged to dmesg.

Yet, I think worth addressing for two reasons:
- unsigned RST gets ignored by the peer and the connection is alive for
  longer (keep-alive interval)
- netstat counters increase and trace events report that trusted BGP peer
  is sending unsigned/incorrectly signed segments, which can ring alarm
  on monitoring.

Signed-off-by: Dmitry Safonov <dima@arista.com>
---
Changes in v2:
- Fixed TCP-MD5 ifdeffery (Reported-by: Victor Nogueira)
- Call proper destructor for inet_ipv6 (Reported-by: syzbot@syzkaller.appspotmail.com)
- Link to v1: https://lore.kernel.org/r/20250822-b4-tcp-ao-md5-rst-finwait2-v1-0-25825d085dcb@arista.com

---
Dmitry Safonov (2):
      tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct()
      tcp: Free TCP-AO/TCP-MD5 info/keys without RCU

 include/net/tcp.h        |  4 ++++
 net/ipv4/tcp.c           | 16 ++++++++++++++++
 net/ipv4/tcp_ao.c        |  5 ++---
 net/ipv4/tcp_ipv4.c      | 37 ++++++++++---------------------------
 net/ipv4/tcp_minisocks.c | 19 +++++--------------
 net/ipv6/tcp_ipv6.c      |  8 ++++++++
 6 files changed, 45 insertions(+), 44 deletions(-)
---
base-commit: d4854be4ec21dad23907c0fbc3389c3a394ebf67
change-id: 20250822-b4-tcp-ao-md5-rst-finwait2-e632b4d8f58d

Best regards,
-- 
Dmitry Safonov <dima@arista.com>