RE: [PATCH] tcp: md5: fix md5 RST when both sides have listener

Shawn Lu
2012-02-01T08:11:21Z

Why? Do you mean packet is droped by netfilter before getting to tcp and No RST is generated.

-----Original Message-----
From: Eric Dumazet [mailto:eric.dumazet@gmail.com]
Sent: Tuesday, January 31, 2012 11:54 PM
To: Shawn Lu
Cc: davem@davemloft.net; netdev@vger.kernel.org; xiaoclu@gmail.com
Subject: RE: [PATCH] tcp: md5: fix md5 RST when both sides have listener

Le mercredi 01 février 2012 à 02:48 -0500, Shawn Lu a écrit :
> Hi, Eric:
>
> How about change the title and log to following:
>
> tcp: md5: RST: getting md5 key from listener
>
> TCP RST mechanism is broken in TCP md5(RFC2385). When
> connection is gone, md5 key is lost, sending RST
> without md5 hash is deem to ignored by peer. This can
> be a problem since RST help protocal like bgp to fast
> recove from peer crash.
>
> In most case, users of tcp md5, such as bgp and ldp,
> have listener on both side to accept connection from peer.
> md5 keys for peers are saved in listening socket.
>
> There are two cases in finding md5 key when connection is
> lost:
> 1.Passive receive RST: The message is send to well known port,
> tcp will associate packet with listener. md5 key can be gotten
> from listener.
>
> 2.Active receive RST (no sock): The message is send to ative
> side, there is no socket associated with message. In this case,
> finding listener from source port, then find md5 key from
> listener.
>
> we are not loosing sercuriy here:
> packet is checked with md5 hash. No RST is generated
> if md5 hash doesn't match or no md5 key can be found.
>
> Note:
> Will send out a new version that is on top of your new patch
> -- "tcp: md5: protects md5sig_info with RCU"
>

Seems good to me !

By the way, is the patch going to work if netfilter conntrack is enabled ?