Messages in this thread | | | Date | Wed, 16 Aug 2023 21:45:06 +0200 | From | Simon Horman <> | Subject | Re: [PATCH v10 net-next 10/23] net/tcp: Wire TCP-AO to request sockets |
| |
On Tue, Aug 15, 2023 at 08:14:39PM +0100, Dmitry Safonov wrote:
...
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c > index 8dfa0959e403..7178e8bab922 100644 > --- a/net/ipv6/tcp_ipv6.c > +++ b/net/ipv6/tcp_ipv6.c
...
> @@ -1194,9 +1198,51 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb) > static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, > struct request_sock *req) > { > + struct tcp_md5sig_key *md5_key = NULL; > + const struct in6_addr *addr; > + u8 *traffic_key = NULL; > int l3index; > > l3index = tcp_v6_sdif(skb) ? tcp_v6_iif_l3_slave(skb) : 0; > + addr = &ipv6_hdr(skb)->saddr; > + > + if (tcp_rsk_used_ao(req)) { > +#ifdef CONFIG_TCP_AO > + struct tcp_ao_key *ao_key = NULL; > + const struct tcp_ao_hdr *aoh; > + u8 keyid = 0;
Hi Dmitry,
keyid is declared and initialised here.
> + > + /* Invalid TCP option size or twice included auth */ > + if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh)) > + return; > + if (!aoh) > + return; > + ao_key = tcp_v6_ao_do_lookup(sk, addr, aoh->rnext_keyid, -1); > + if (unlikely(!ao_key)) { > + /* Send ACK with any matching MKT for the peer */ > + ao_key = tcp_v6_ao_do_lookup(sk, addr, -1, -1); > + /* Matching key disappeared (user removed the key?) > + * let the handshake timeout. > + */ > + if (!ao_key) { > + net_info_ratelimited("TCP-AO key for (%pI6, %d)->(%pI6, %d) suddenly disappeared, won't ACK new connection\n", > + addr, > + ntohs(tcp_hdr(skb)->source), > + &ipv6_hdr(skb)->daddr, > + ntohs(tcp_hdr(skb)->dest)); > + return; > + } > + } > + traffic_key = kmalloc(tcp_ao_digest_size(ao_key), GFP_ATOMIC); > + if (!traffic_key) > + return; > + > + keyid = aoh->keyid;
And reinitialised here. But is otherwise unused.
Flagged in a W=1 build with both clang-16 and gcc-13.
> + tcp_v6_ao_calc_key_rsk(ao_key, traffic_key, req); > +#endif > + } else { > + md5_key = tcp_v6_md5_do_lookup(sk, addr, l3index); > + } > > /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV > * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
...
| |