From patchwork Mon Sep 5 07:05:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leonard Crestez X-Patchwork-Id: 605412 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C1F0C6FA89 for ; Mon, 5 Sep 2022 07:07:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237313AbiIEHHl (ORCPT ); Mon, 5 Sep 2022 03:07:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46914 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237061AbiIEHGk (ORCPT ); Mon, 5 Sep 2022 03:06:40 -0400 Received: from mail-ej1-x632.google.com (mail-ej1-x632.google.com [IPv6:2a00:1450:4864:20::632]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E3E9E3ED56; Mon, 5 Sep 2022 00:06:37 -0700 (PDT) Received: by mail-ej1-x632.google.com with SMTP id gb36so15096435ejc.10; Mon, 05 Sep 2022 00:06:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date; bh=4GldIxn/Ro3zhLYkXrozy6D5j2gf3yi4dRChcGV5aQA=; b=iZdMYJNzHECyabJulQdFHwozDHy9XPPTuikuPpSvFuA97wDLKGx4IGZHWkLTgq9FaF 3oJAnJ39Gg/GR36E+QjhQj0yA7HnlZ3rn8/yPT8zCCneaHu63e3jBkWdjz9pbpD/XjM6 +skxcu5LgEx+rRUjzyts9ljbBpXnadDOzf6EvGwIMnFjHm2racTl0dCCb82Yojbbkr0I 82DVgriHsMrZCILtGdCSoi/Qc1CqgPhj5g1Ba/Ti2Yi1NuvB4dZobIeOR3fTMmsCJnt5 Tunnt94qzAur6lQQicDu2H0zSnrWtPaGfE9OxHUVGPs+5VEPT+ALbwyGtyAc2uWsJaN6 dwkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date; bh=4GldIxn/Ro3zhLYkXrozy6D5j2gf3yi4dRChcGV5aQA=; b=QoIAKgdfVCm20UiFrCvoHiKMYrl5ln58zUNqq2+KywB6KMJlZoBju2aZ6l2lv7deGN jXlSm8/L8TfJH1kSGBZb/s5U/GtjW0wQeO1wPbgPeVHa3IRGaSCf8c2wEcdok6WZPNAW sLvt56M7LA4PGgWvGqJSjZrZYO54QqxlodZRzkktWcgAyo/aklw+uatOjYQcKSpp3CTD BD2cBtc43p5AhCPYqddcACRQHDjJHLWOvekC8z4VUjQqAfpYLAh8VUp8Lhq44ujbsMoy NNKOaWryHdlqEBnxEC37Bf/Ulb5IVUPCuEQVSOPl+gYvE0C5+qI2VohwbjTf58uPOjLs SbEA== X-Gm-Message-State: ACgBeo1XY/1RM/+LjCJSyXpJ+l0mV3sd6lDRe6qhnXu2c4jACWD8sSBh 3I9jt5lO9kbQZHGkF7aexgg= X-Google-Smtp-Source: AA6agR6Pia0V3v+BIqrst/yiAfCtiNJzjJVPs5szYgvAORIzo6BXyEifpyHxTHWSR0J2vUiWhHbeHQ== X-Received: by 2002:a17:907:9627:b0:741:8d57:f335 with SMTP id gb39-20020a170907962700b007418d57f335mr24945485ejc.7.1662361596495; Mon, 05 Sep 2022 00:06:36 -0700 (PDT) Received: from localhost.localdomain ([2a04:241e:502:a080:40ec:9f50:387:3cfb]) by smtp.gmail.com with ESMTPSA id n27-20020a056402515b00b0043cf2e0ce1csm5882775edd.48.2022.09.05.00.06.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Sep 2022 00:06:35 -0700 (PDT) From: Leonard Crestez To: David Ahern , Eric Dumazet , Dmitry Safonov <0x7f454c46@gmail.com> Cc: Francesco Ruggeri , Salam Noureddine , Philip Paeps , Shuah Khan , "David S. Miller" , Herbert Xu , Kuniyuki Iwashima , Hideaki YOSHIFUJI , Jakub Kicinski , Yuchung Cheng , Mat Martineau , Christoph Paasch , Ivan Delalande , Caowangbao , Priyaranjan Jha , netdev@vger.kernel.org, linux-crypto@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v8 13/26] tcp: authopt: Add NOSEND/NORECV flags Date: Mon, 5 Sep 2022 10:05:49 +0300 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Add flags to allow marking individual keys and invalid for send or recv. Making keys assymetric this way is not mentioned in RFC5925 but RFC8177 requires that keys inside a keychain have independent "accept" and "send" lifetimes. Flag names are negative so that the default behavior is for keys to be valid for both send and recv. Setting both NOSEND and NORECV for a certain peer address can be used on a listen socket can be used to mean "TCP-AO is required from this peer but no keys are currently valid". Signed-off-by: Leonard Crestez --- include/uapi/linux/tcp.h | 4 ++++ net/ipv4/tcp_authopt.c | 9 ++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h index 76d7be6b27f4..75107a7fd935 100644 --- a/include/uapi/linux/tcp.h +++ b/include/uapi/linux/tcp.h @@ -369,15 +369,19 @@ struct tcp_authopt { * enum tcp_authopt_key_flag - flags for `tcp_authopt.flags` * * @TCP_AUTHOPT_KEY_DEL: Delete the key and ignore non-id fields * @TCP_AUTHOPT_KEY_EXCLUDE_OPTS: Exclude TCP options from signature * @TCP_AUTHOPT_KEY_ADDR_BIND: Key only valid for `tcp_authopt.addr` + * @TCP_AUTHOPT_KEY_NOSEND: Key invalid for send (expired) + * @TCP_AUTHOPT_KEY_NORECV: Key invalid for recv (expired) */ enum tcp_authopt_key_flag { TCP_AUTHOPT_KEY_DEL = (1 << 0), TCP_AUTHOPT_KEY_EXCLUDE_OPTS = (1 << 1), TCP_AUTHOPT_KEY_ADDR_BIND = (1 << 2), + TCP_AUTHOPT_KEY_NOSEND = (1 << 4), + TCP_AUTHOPT_KEY_NORECV = (1 << 5), }; /** * enum tcp_authopt_alg - Algorithms for TCP Authentication Option */ diff --git a/net/ipv4/tcp_authopt.c b/net/ipv4/tcp_authopt.c index 0672a3bf5686..4dc2fe541498 100644 --- a/net/ipv4/tcp_authopt.c +++ b/net/ipv4/tcp_authopt.c @@ -353,10 +353,12 @@ static struct tcp_authopt_key_info *tcp_authopt_lookup_send(struct netns_tcp_aut hlist_for_each_entry_rcu(key, &net->head, node, 0) { if (key->flags & TCP_AUTHOPT_KEY_ADDR_BIND) if (!tcp_authopt_key_match_sk_addr(key, addr_sk)) continue; + if (key->flags & TCP_AUTHOPT_KEY_NOSEND) + continue; if (result && net_ratelimit()) pr_warn("ambiguous tcp authentication keys configured for send\n"); result = key; } @@ -504,11 +506,13 @@ int tcp_get_authopt_val(struct sock *sk, struct tcp_authopt *opt) } #define TCP_AUTHOPT_KEY_KNOWN_FLAGS ( \ TCP_AUTHOPT_KEY_DEL | \ TCP_AUTHOPT_KEY_EXCLUDE_OPTS | \ - TCP_AUTHOPT_KEY_ADDR_BIND) + TCP_AUTHOPT_KEY_ADDR_BIND | \ + TCP_AUTHOPT_KEY_NOSEND | \ + TCP_AUTHOPT_KEY_NORECV) int tcp_set_authopt_key(struct sock *sk, sockptr_t optval, unsigned int optlen) { struct tcp_authopt_key opt; struct tcp_authopt_info *info; @@ -1383,10 +1387,13 @@ static struct tcp_authopt_key_info *tcp_authopt_lookup_recv(struct sock *sk, hlist_for_each_entry_rcu(key, &net->head, node, 0) { if (key->flags & TCP_AUTHOPT_KEY_ADDR_BIND && !tcp_authopt_key_match_skb_addr(key, skb)) continue; *anykey = true; + // If only keys with norecv flag are present still consider that + if (key->flags & TCP_AUTHOPT_KEY_NORECV) + continue; if (recv_id >= 0 && key->recv_id != recv_id) continue; if (!result) result = key; else if (result)