lkml.org 
[lkml]   [2020]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 28/58] tcp: md5: allow changing MD5 keys in all socket states
    Date
    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit 1ca0fafd73c5268e8fc4b997094b8bb2bfe8deea ]

    This essentially reverts commit 721230326891 ("tcp: md5: reject TCP_MD5SIG
    or TCP_MD5SIG_EXT on established sockets")

    Mathieu reported that many vendors BGP implementations can
    actually switch TCP MD5 on established flows.

    Quoting Mathieu :
    Here is a list of a few network vendors along with their behavior
    with respect to TCP MD5:

    - Cisco: Allows for password to be changed, but within the hold-down
    timer (~180 seconds).
    - Juniper: When password is initially set on active connection it will
    reset, but after that any subsequent password changes no network
    resets.
    - Nokia: No notes on if they flap the tcp connection or not.
    - Ericsson/RedBack: Allows for 2 password (old/new) to co-exist until
    both sides are ok with new passwords.
    - Meta-Switch: Expects the password to be set before a connection is
    attempted, but no further info on whether they reset the TCP
    connection on a change.
    - Avaya: Disable the neighbor, then set password, then re-enable.
    - Zebos: Would normally allow the change when socket connected.

    We can revert my prior change because commit 9424e2e7ad93 ("tcp: md5: fix potential
    overestimation of TCP option space") removed the leak of 4 kernel bytes to
    the wire that was the main reason for my patch.

    While doing my investigations, I found a bug when a MD5 key is changed, leading
    to these commits that stable teams want to consider before backporting this revert :

    Commit 6a2febec338d ("tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()")
    Commit e6ced831ef11 ("tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers")

    Fixes: 721230326891 "tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets"
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv4/tcp.c | 5 +----
    1 file changed, 1 insertion(+), 4 deletions(-)

    --- a/net/ipv4/tcp.c
    +++ b/net/ipv4/tcp.c
    @@ -2596,10 +2596,7 @@ static int do_tcp_setsockopt(struct sock

    #ifdef CONFIG_TCP_MD5SIG
    case TCP_MD5SIG:
    - if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
    - err = tp->af_specific->md5_parse(sk, optval, optlen);
    - else
    - err = -EINVAL;
    + err = tp->af_specific->md5_parse(sk, optval, optlen);
    break;
    #endif
    case TCP_USER_TIMEOUT:

    \
     
     \ /
      Last update: 2020-07-20 17:38    [W:2.166 / U:0.916 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site