lkml.org 
[lkml]   [2022]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v7 17/26] tcp: authopt: Add v4mapped ipv6 address support
Date
Keys that are added with v4mapped ipv6 addresses will now be used for
ipv4 packets. This outward behavior is similar to how MD5 support
currently works.

The implementation is different - v4mapped keys are still stored with
ipv6 addresses.

Signed-off-by: Leonard Crestez <cdleonard@gmail.com>
---
net/ipv4/tcp_authopt.c | 35 +++++++++++++++++++++++++----------
1 file changed, 25 insertions(+), 10 deletions(-)

diff --git a/net/ipv4/tcp_authopt.c b/net/ipv4/tcp_authopt.c
index 0b6cbd6f5491..06f8df1d80c9 100644
--- a/net/ipv4/tcp_authopt.c
+++ b/net/ipv4/tcp_authopt.c
@@ -301,27 +301,30 @@ static bool tcp_authopt_key_match_skb_addr(struct tcp_authopt_key_info *key,
struct sockaddr_in6 *key_addr = (struct sockaddr_in6 *)&key->addr;

return ipv6_prefix_equal(&ip6h->saddr,
&key_addr->sin6_addr,
key->prefixlen);
+ } else if (keyaf == AF_INET6 && iph->version == 4) {
+ struct sockaddr_in6 *key_addr = (struct sockaddr_in6 *)&key->addr;
+
+ /* handle ipv6-mapped-ipv4-addresses */
+ if (ipv6_addr_v4mapped(&key_addr->sin6_addr)) {
+ __be32 mask = inet_make_mask(key->prefixlen);
+ __be32 ipv4 = key_addr->sin6_addr.s6_addr32[3];
+
+ return (ipv4 & mask) == ipv4;
+ }
}

- /* This actually happens with ipv6-mapped-ipv4-addresses
- * IPv6 listen sockets will be asked to validate ipv4 packets.
- */
return false;
}

static bool tcp_authopt_key_match_sk_addr(struct tcp_authopt_key_info *key,
const struct sock *addr_sk)
{
u16 keyaf = key->addr.ss_family;

- /* This probably can't happen even with ipv4-mapped-ipv6 */
- if (keyaf != addr_sk->sk_family)
- return false;
-
if (keyaf == AF_INET) {
struct sockaddr_in *key_addr = (struct sockaddr_in *)&key->addr;
__be32 mask = inet_make_mask(key->prefixlen);

return (addr_sk->sk_daddr & mask) == key_addr->sin_addr.s_addr;
@@ -330,10 +333,16 @@ static bool tcp_authopt_key_match_sk_addr(struct tcp_authopt_key_info *key,
struct sockaddr_in6 *key_addr = (struct sockaddr_in6 *)&key->addr;

return ipv6_prefix_equal(&addr_sk->sk_v6_daddr,
&key_addr->sin6_addr,
key->prefixlen);
+ } else if (keyaf == AF_INET6 && addr_sk->sk_family == AF_INET) {
+ struct sockaddr_in6 *key_addr = (struct sockaddr_in6 *)&key->addr;
+ __be32 mask = inet_make_mask(key->prefixlen);
+ __be32 ipv4 = key_addr->sin6_addr.s6_addr32[3];
+
+ return (addr_sk->sk_daddr & mask) == ipv4;
#endif
}

return false;
}
@@ -1399,14 +1408,20 @@ static int __tcp_authopt_calc_mac(struct sock *sk,
char *macbuf)
{
struct tcp_authopt_alg_pool *mac_pool;
u8 traffic_key[TCP_AUTHOPT_MAX_TRAFFIC_KEY_LEN];
int err;
- bool ipv6 = (sk->sk_family != AF_INET);
+ bool ipv6;

- if (sk->sk_family != AF_INET && sk->sk_family != AF_INET6)
- return -EINVAL;
+#if IS_ENABLED(CONFIG_IPV6)
+ if (input)
+ ipv6 = (skb->protocol == htons(ETH_P_IPV6));
+ else
+ ipv6 = (sk->sk_family == AF_INET6) && !ipv6_addr_v4mapped(&sk->sk_v6_daddr);
+#else
+ ipv6 = false;
+#endif

err = tcp_authopt_get_traffic_key(sk, skb, key, info, input, ipv6, traffic_key);
if (err)
return err;

--
2.25.1
\
 
 \ /
  Last update: 2022-08-18 22:03    [W:0.102 / U:0.408 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site