Re: [PATCH] tcp: md5: RST: getting md5 key from listener

[Eric Dumazet <eric.dumazet@gmail.com>]

Le mercredi 01 février 2012 à 00:35 -0800, Shawn Lu a écrit :
> TCP RST mechanism is broken in TCP md5(RFC2385). When
> connection is gone, md5 key is lost, sending RST
> without md5 hash is deem to ignored by peer. This can
> be a problem since RST help protocal like bgp to fast
> recove from peer crash.
> 
> In most case, users of tcp md5, such as bgp and ldp,
> have listener on both sides to accept connection from peer.
> md5 keys for peers are saved in listening socket.
> 
> There are two cases in finding md5 key when connection is
> lost:
> 1.Passive receive RST: The message is send to well known port,
> tcp will associate it with listner. md5 key is gotten from
> listener.
> 
> 2.Active receive RST (no sock): The message is send to ative
> side, there is no socket associated with the message. In this
> case, finding listener from source port, then find md5 key from
> listener.
> 
> we are not loosing sercuriy here:
> packet is checked with md5 hash. No RST is generated
> if md5 hash doesn't match or no md5 key can be found.
> 
> Signed-off-by: Shawn Lu <shawn.lu@ericsson.com>
> ---
> v4: change title and change log. 
> regerated after  "tcp: md5: protects md5sig_info with RCU"


Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>

Thanks !