From: Sewook Seo <ssewook@gmail•com>
To: Sewook Seo <sewookseo@google•com>
Cc: "Linux Network Development Mailing List" <netdev@vger•kernel.org>,
"David S . Miller " <davem@davemloft•net>,
"Hideaki YOSHIFUJI" <yoshfuji@linux-ipv6•org>,
"David Ahern" <dsahern@kernel•org>,
"Jakub Kicinski" <kuba@kernel•org>,
"Paolo Abeni" <pabeni@redhat•com>,
"Maciej Żenczykowski" <maze@google•com>,
"Eric Dumazet" <edumazet@google•com>,
"Steffen Klassert" <steffen.klassert@secunet•com>,
"Sehee Lee" <seheele@google•com>
Subject: [PATCH v3 net-next] net: Find dst with sk's xfrm policy not ctl_sk
Date: Wed, 6 Jul 2022 06:32:43 +0000 [thread overview]
Message-ID: <20220706063243.2782818-1-ssewook@gmail.com> (raw)
In-Reply-To: <20220621202240.4182683-1-ssewook@gmail.com>
From: sewookseo <sewookseo@google•com>
If we set XFRM security policy by calling setsockopt with option
IPV6_XFRM_POLICY, the policy will be stored in 'sock_policy' in 'sock'
struct. However tcp_v6_send_response doesn't look up dst_entry with the
actual socket but looks up with tcp control socket. This may cause a
problem that a RST packet is sent without ESP encryption & peer's TCP
socket can't receive it.
This patch will make the function look up dest_entry with actual socket,
if the socket has XFRM policy(sock_policy), so that the TCP response
packet via this function can be encrypted, & aligned on the encrypted
TCP socket.
Tested: We encountered this problem when a TCP socket which is encrypted
in ESP transport mode encryption, receives challenge ACK at SYN_SENT
state. After receiving challenge ACK, TCP needs to send RST to
establish the socket at next SYN try. But the RST was not encrypted &
peer TCP socket still remains on ESTABLISHED state.
So we verified this with test step as below.
[Test step]
1. Making a TCP state mismatch between client(IDLE) & server(ESTABLISHED).
2. Client tries a new connection on the same TCP ports(src & dst).
3. Server will return challenge ACK instead of SYN,ACK.
4. Client will send RST to server to clear the SOCKET.
5. Client will retransmit SYN to server on the same TCP ports.
[Expected result]
The TCP connection should be established.
Effort: net
Cc: Maciej Żenczykowski <maze@google•com>
Cc: Eric Dumazet <edumazet@google•com>
Cc: Steffen Klassert <steffen.klassert@secunet•com>
Cc: Sehee Lee <seheele@google•com>
Signed-off-by: Sewook Seo <sewookseo@google•com>
---
net/ipv4/ip_output.c | 7 ++++++-
net/ipv4/tcp_ipv4.c | 5 +++++
net/ipv6/tcp_ipv6.c | 7 ++++++-
3 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 00b4bf26fd93..1da430c8fee2 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1704,7 +1704,12 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
tcp_hdr(skb)->source, tcp_hdr(skb)->dest,
arg->uid);
security_skb_classify_flow(skb, flowi4_to_flowi_common(&fl4));
- rt = ip_route_output_key(net, &fl4);
+#ifdef CONFIG_XFRM
+ if (sk->sk_policy[XFRM_POLICY_OUT])
+ rt = ip_route_output_flow(net, &fl4, sk);
+ else
+#endif
+ rt = ip_route_output_key(net, &fl4);
if (IS_ERR(rt))
return;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index fda811a5251f..3c2ab436c692 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -819,6 +819,10 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)
ctl_sk->sk_priority = (sk->sk_state == TCP_TIME_WAIT) ?
inet_twsk(sk)->tw_priority : sk->sk_priority;
transmit_time = tcp_transmit_time(sk);
+#ifdef CONFIG_XFRM
+ if (sk->sk_policy[XFRM_POLICY_OUT] && sk_fullsock(sk))
+ xfrm_sk_clone_policy(ctl_sk, sk);
+#endif
}
ip_send_unicast_reply(ctl_sk,
skb, &TCP_SKB_CB(skb)->header.h4.opt,
@@ -827,6 +831,7 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)
transmit_time);
ctl_sk->sk_mark = 0;
+ xfrm_sk_free_policy(ctl_sk);
sock_net_set(ctl_sk, &init_net);
__TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
__TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index c72448ba6dc9..8b8819c3d2c2 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -952,7 +952,12 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
* Underlying function will use this to retrieve the network
* namespace
*/
- dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);
+#ifdef CONFIG_XFRM
+ if (sk && sk->sk_policy[XFRM_POLICY_OUT] && sk_fullsock(sk))
+ dst = ip6_dst_lookup_flow(net, sk, &fl6, NULL); /* Get dst with sk's XFRM policy */
+ else
+#endif
+ dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);
if (!IS_ERR(dst)) {
skb_dst_set(buff, dst);
ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL,
--
2.37.0.rc0.161.g10f37bed90-goog
next prev parent reply other threads:[~2022-07-06 6:35 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-21 20:22 [PATCH] net-tcp: Find dst with sk's xfrm policy not ctl_sk Sewook Seo
2022-06-22 2:01 ` Eric Dumazet
2022-07-01 15:44 ` [PATCH v2] " Sewook Seo
2022-07-05 8:25 ` Paolo Abeni
2022-07-06 3:10 ` 서세욱
2022-07-06 14:01 ` Paolo Abeni
2022-07-06 14:07 ` Eric Dumazet
2022-07-05 9:04 ` Eric Dumazet
2022-07-06 3:09 ` 서세욱
2022-07-03 13:41 ` [net] fe1d0fd632: canonical_address#:#[##] kernel test robot
2022-07-06 6:32 ` Sewook Seo [this message]
2022-07-06 7:19 ` [PATCH v3 net-next] net: Find dst with sk's xfrm policy not ctl_sk Eric Dumazet
2022-07-06 14:59 ` David Ahern
2022-07-06 21:30 ` 서세욱
2022-07-07 5:40 ` [PATCH v4 " Sewook Seo
2022-07-07 7:41 ` Eric Dumazet
2022-07-07 10:01 ` [PATCH v5 " Sewook Seo
2022-07-11 8:42 ` Steffen Klassert
2022-07-11 8:59 ` Eric Dumazet
2022-07-11 13:10 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220706063243.2782818-1-ssewook@gmail.com \
--to=ssewook@gmail$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=dsahern@kernel$(echo .)org \
--cc=edumazet@google$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=maze@google$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=seheele@google$(echo .)com \
--cc=sewookseo@google$(echo .)com \
--cc=steffen.klassert@secunet$(echo .)com \
--cc=yoshfuji@linux-ipv6$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox