[v5] tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct()

[PATCH net-next v5 0/2] tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct()

Dmitry Safonov via B4 Relay posted 2 patches 3 weeks, 2 days ago

Diff against v1 v2 v3 v4
Download series mbox

include/net/tcp.h        |  4 ++++
include/net/tcp_ao.h     |  1 -
net/ipv4/tcp.c           | 16 ++++++++++++++++
net/ipv4/tcp_ao.c        |  5 ++---
net/ipv4/tcp_ipv4.c      | 37 ++++++++++---------------------------
net/ipv4/tcp_minisocks.c | 19 +++++--------------
net/ipv6/tcp_ipv6.c      |  8 ++++++++
7 files changed, 45 insertions(+), 45 deletions(-)

Expand all Fold all

[PATCH net-next v5 0/2] tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct()

Posted by Dmitry Safonov via B4 Relay 3 weeks, 2 days ago

On one side a minor/cosmetic issue, especially nowadays when
TCP-AO/TCP-MD5 signature verification failures aren't logged to dmesg.

Yet, I think worth addressing for two reasons:
- unsigned RST gets ignored by the peer and the connection is alive for
  longer (keep-alive interval)
- netstat counters increase and trace events report that trusted BGP peer
  is sending unsigned/incorrectly signed segments, which can ring alarm
  on monitoring.

Signed-off-by: Dmitry Safonov <dima@arista.com>
---
Changes in v5:
- Use EXPORT_IPV6_MOD_GPL() instead of EXPORT_SYMBOL_GPL()
  for tcp_md5_destruct_sock (thanks to Kuniyuki Iwashima)
- Re-worded the destructor conditions, the socket is in TCP_CLOSE
  in both cases (Kuniyuki Iwashima)
- Link to v4: https://lore.kernel.org/r/20250903-b4-tcp-ao-md5-rst-finwait2-v4-0-ef3a9eec3ef3@arista.com

Changes in v4:
- Remove struct tcp_ao_info::rcu as it's no longer used (Jakub)
- Link to v3: https://lore.kernel.org/r/20250830-b4-tcp-ao-md5-rst-finwait2-v3-0-9002fec37444@arista.com

Changes in v3:
- Assign NULL to md5sig_info before call_rcu() (catched by Eric Dumazet)
- Link to v2: https://lore.kernel.org/r/20250828-b4-tcp-ao-md5-rst-finwait2-v2-0-653099bea5c1@arista.com

Changes in v2:
- Fixed TCP-MD5 ifdeffery (Reported-by: Victor Nogueira)
- Call proper destructor for inet_ipv6 (Reported-by: syzbot@syzkaller.appspotmail.com)
- Link to v1: https://lore.kernel.org/r/20250822-b4-tcp-ao-md5-rst-finwait2-v1-0-25825d085dcb@arista.com

---
Dmitry Safonov (2):
      tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct()
      tcp: Free TCP-AO/TCP-MD5 info/keys without RCU

 include/net/tcp.h        |  4 ++++
 include/net/tcp_ao.h     |  1 -
 net/ipv4/tcp.c           | 16 ++++++++++++++++
 net/ipv4/tcp_ao.c        |  5 ++---
 net/ipv4/tcp_ipv4.c      | 37 ++++++++++---------------------------
 net/ipv4/tcp_minisocks.c | 19 +++++--------------
 net/ipv6/tcp_ipv6.c      |  8 ++++++++
 7 files changed, 45 insertions(+), 45 deletions(-)
---
base-commit: abcf9f662bc7ec72b3591d785eccd7dd8c239365
change-id: 20250822-b4-tcp-ao-md5-rst-finwait2-e632b4d8f58d

Best regards,
-- 
Dmitry Safonov <dima@arista.com>