[PATCH v1 net] tcp: Fix SYN option room calculation for TCP-AO.

[PATCH v1 net] tcp: Fix SYN option room calculation for TCP-AO.

[Kuniyuki Iwashima]

When building SYN packet in tcp_syn_options(), MSS, TS, WS, and
SACKPERM are used without checking the remaining bytes in the
options area.

To keep that logic as is, we limit the TCP-AO MAC length in
tcp_ao_parse_crypto().  Currently, the limit is calculated as below.

  MAX_TCP_OPTION_SPACE - TCPOLEN_TSTAMP_ALIGNED
                       - TCPOLEN_WSCALE_ALIGNED
                       - TCPOLEN_SACKPERM_ALIGNED

This looks confusing as (1) we pack SACKPERM into the leading
2-bytes of the aligned 12-bytes of TS and (2) TCPOLEN_MSS_ALIGNED
is not used.  Fortunately, the calculated limit is not wrong as
TCPOLEN_SACKPERM_ALIGNED and TCPOLEN_MSS_ALIGNED are the same value.

However, we should use the proper constant in the formula.

  MAX_TCP_OPTION_SPACE - TCPOLEN_MSS_ALIGNED
                       - TCPOLEN_TSTAMP_ALIGNED
                       - TCPOLEN_WSCALE_ALIGNED

Fixes: 4954f17ddefc ("net/tcp: Introduce TCP_AO setsockopt()s")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
---
 net/ipv4/tcp_ao.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c
index ef5472ed6158..7696417d0640 100644
--- a/net/ipv4/tcp_ao.c
+++ b/net/ipv4/tcp_ao.c
@@ -1315,7 +1315,8 @@ static int tcp_ao_parse_crypto(struct tcp_ao_add *cmd, struct tcp_ao_key *key)
 	key->maclen = cmd->maclen ?: 12; /* 12 is the default in RFC5925 */
 
 	/* Check: maclen + tcp-ao header <= (MAX_TCP_OPTION_SPACE - mss
-	 *					- tstamp - wscale - sackperm),
+	 *					- tstamp (including sackperm)
+	 *					- wscale),
 	 * see tcp_syn_options(), tcp_synack_options(), commit 33ad798c924b.
 	 *
 	 * In order to allow D-SACK with TCP-AO, the header size should be:
@@ -1342,9 +1343,9 @@ static int tcp_ao_parse_crypto(struct tcp_ao_add *cmd, struct tcp_ao_key *key)
 	 * large to leave sufficient option space.
 	 */
 	syn_tcp_option_space = MAX_TCP_OPTION_SPACE;
+	syn_tcp_option_space -= TCPOLEN_MSS_ALIGNED;
 	syn_tcp_option_space -= TCPOLEN_TSTAMP_ALIGNED;
 	syn_tcp_option_space -= TCPOLEN_WSCALE_ALIGNED;
-	syn_tcp_option_space -= TCPOLEN_SACKPERM_ALIGNED;
 	if (tcp_ao_len(key) > syn_tcp_option_space) {
 		err = -EMSGSIZE;
 		goto err_kfree;
-- 
2.30.2

Re: [PATCH v1 net] tcp: Fix SYN option room calculation for TCP-AO.

[Dmitry Safonov]

On 11/2/23 21:05, Kuniyuki Iwashima wrote:
> When building SYN packet in tcp_syn_options(), MSS, TS, WS, and
> SACKPERM are used without checking the remaining bytes in the
> options area.
> 
> To keep that logic as is, we limit the TCP-AO MAC length in
> tcp_ao_parse_crypto().  Currently, the limit is calculated as below.
> 
>   MAX_TCP_OPTION_SPACE - TCPOLEN_TSTAMP_ALIGNED
>                        - TCPOLEN_WSCALE_ALIGNED
>                        - TCPOLEN_SACKPERM_ALIGNED
> 
> This looks confusing as (1) we pack SACKPERM into the leading
> 2-bytes of the aligned 12-bytes of TS and (2) TCPOLEN_MSS_ALIGNED
> is not used.  Fortunately, the calculated limit is not wrong as
> TCPOLEN_SACKPERM_ALIGNED and TCPOLEN_MSS_ALIGNED are the same value.
> 
> However, we should use the proper constant in the formula.
> 
>   MAX_TCP_OPTION_SPACE - TCPOLEN_MSS_ALIGNED
>                        - TCPOLEN_TSTAMP_ALIGNED
>                        - TCPOLEN_WSCALE_ALIGNED
> 
> Fixes: 4954f17ddefc ("net/tcp: Introduce TCP_AO setsockopt()s")
> Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Sharp eye!
Thanks for the patch and adjusting the comment.

Reviewed-by: Dmitry Safonov <dima@arista.com>

> ---
>  net/ipv4/tcp_ao.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c
> index ef5472ed6158..7696417d0640 100644
> --- a/net/ipv4/tcp_ao.c
> +++ b/net/ipv4/tcp_ao.c
> @@ -1315,7 +1315,8 @@ static int tcp_ao_parse_crypto(struct tcp_ao_add *cmd, struct tcp_ao_key *key)
>  	key->maclen = cmd->maclen ?: 12; /* 12 is the default in RFC5925 */
>  
>  	/* Check: maclen + tcp-ao header <= (MAX_TCP_OPTION_SPACE - mss
> -	 *					- tstamp - wscale - sackperm),
> +	 *					- tstamp (including sackperm)
> +	 *					- wscale),
>  	 * see tcp_syn_options(), tcp_synack_options(), commit 33ad798c924b.
>  	 *
>  	 * In order to allow D-SACK with TCP-AO, the header size should be:
> @@ -1342,9 +1343,9 @@ static int tcp_ao_parse_crypto(struct tcp_ao_add *cmd, struct tcp_ao_key *key)
>  	 * large to leave sufficient option space.
>  	 */
>  	syn_tcp_option_space = MAX_TCP_OPTION_SPACE;
> +	syn_tcp_option_space -= TCPOLEN_MSS_ALIGNED;
>  	syn_tcp_option_space -= TCPOLEN_TSTAMP_ALIGNED;
>  	syn_tcp_option_space -= TCPOLEN_WSCALE_ALIGNED;
> -	syn_tcp_option_space -= TCPOLEN_SACKPERM_ALIGNED;
>  	if (tcp_ao_len(key) > syn_tcp_option_space) {
>  		err = -EMSGSIZE;
>  		goto err_kfree;

Thanks,
             Dmitry

Re: [PATCH v1 net] tcp: Fix SYN option room calculation for TCP-AO.

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:

On Thu, 2 Nov 2023 14:05:48 -0700 you wrote:
> When building SYN packet in tcp_syn_options(), MSS, TS, WS, and
> SACKPERM are used without checking the remaining bytes in the
> options area.
> 
> To keep that logic as is, we limit the TCP-AO MAC length in
> tcp_ao_parse_crypto().  Currently, the limit is calculated as below.
> 
> [...]

Here is the summary with links:
  - [v1,net] tcp: Fix SYN option room calculation for TCP-AO.
    https://git.kernel.org/netdev/net/c/0a8e987dcc13

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html