RE: [PATCH] tcp: md5: fix md5 RST when both sides have listener

Shawn Lu
2012-01-31T18:15:29Z

Thanks! Eric. Good catch. Will using RCU to pretect the md5 key.

-----Original Message-----
From: Eric Dumazet [mailto:eric.dumazet@gmail.com]
Sent: Tuesday, January 31, 2012 5:34 AM
To: Shawn Lu
Cc: davem@davemloft.net; netdev@vger.kernel.org; xiaoclu@gmail.com
Subject: RE: [PATCH] tcp: md5: fix md5 RST when both sides have listener

Le mardi 31 janvier 2012 à 10:05 +0100, Eric Dumazet a écrit :

> Hmm... The second problem is that its not safe to call
> tcp_v4_md5_do_lookup() on an unlocked socket.
>
> And locking a listener is way too expensive, since a listener socket
> is already a contention point.
>
> An attacker could send forged tcp md5 packets to slow down a server.
>
> A proper patch needs RCU conversion first.

I am working on this RCU conversion and big md5 cleanup, using a single list of keys.

You can then add your fix on top of this work.
[shawnlu] Good idea. I will resumit using rcu.

union tcp_md5_addr {
struct in_addr a4;
#if IS_ENABLED(CONFIG_IPV6)
struct in6_addr a6;
#endif
};

/* - key database */
struct tcp_md5sig_key {
struct hlist_node node;
u8 keylen;
u8 family; /* AF_INET or AF_INET6 */
union tcp_md5_addr addr;
u8 key[TCP_MD5SIG_MAXKEYLEN];
struct rcu_head rcu;
};

/* - sock block */
struct tcp_md5sig_info {
struct hlist_head head;
};