Messages in this thread | | | Date | Tue, 28 Nov 2023 18:34:51 -0700 | Subject | Re: [PATCH v3 5/7] net/tcp: Don't add key with non-matching VRF on connected sockets | From | David Ahern <> |
| |
On 11/28/23 1:57 PM, Dmitry Safonov wrote: > If the connection was established, don't allow adding TCP-AO keys that > don't match the peer. Currently, there are checks for ip-address > matching, but L3 index check is missing. Add it to restrict userspace
you say L3 index check is missing - add it. yet ...
> shooting itself somewhere. > > Fixes: 248411b8cb89 ("net/tcp: Wire up l3index to TCP-AO") > Signed-off-by: Dmitry Safonov <dima@arista.com> > --- > net/ipv4/tcp_ao.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c > index bf41be6d4721..2d000e275ce7 100644 > --- a/net/ipv4/tcp_ao.c > +++ b/net/ipv4/tcp_ao.c > @@ -1608,6 +1608,9 @@ static int tcp_ao_add_cmd(struct sock *sk, unsigned short int family, > if (!dev || !l3index) > return -EINVAL; > > + if (!((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))) > + return -EINVAL;
... this is checking socket state.
> + > /* It's still possible to bind after adding keys or even > * re-bind to a different dev (with CAP_NET_RAW). > * So, no reason to return error here, rather try to be
| |