[PATCH 0/5] net/tcp-md5: Verify segments on TIME_WAIT sockets

[Dmitry Safonov]

Hi,

Started as a refactoring of tcp_v{4,6}_send_reset(), in order to prepare
it for TCP-AO signing for RST segments. As you can see the previous
TCP-AO-v5 [1] version of those functions, they get too big and nasty.
Patches 1 and 2 seem more-or-less straight-forward to me.

But then another thing that I wanted to fix for TCP-AO-version6 was
accepting of unsigned or incorrectly signed segments on twsk, which is
against RFC5925 (7.2) that requires checking the signature. So, I decided
to give it a shot and fix twsk for TCP-MD5 as well.
That seems more questionable, that's why I'm sending patch 3 as RFC.

And the last part, patches 4 and 5 are paranoid checks made to minimize
cases when inbound segment's signature and RST/ACK reply aren't consistent.
This is direct result of RFC2385 that lacks key rotation mechanism.
Probably, patches 4 and 5 are a bit too much, sending them for review
anyway in case such paranoia makes sense.

Thanks,
          Dmitry

Cc: David Ahern <dsahern@xxxxxxxxxx>
Cc: "David S. Miller" <davem@xxxxxxxxxxxxx>
Cc: Dmitry Safonov <0x7f454c46@xxxxxxxxx>
Cc: Eric Dumazet <edumazet@xxxxxxxxxx>
Cc: Hideaki YOSHIFUJI <yoshfuji@xxxxxxxxxxxxxx>
Cc: Jakub Kicinski <kuba@xxxxxxxxxx>
Cc: Leonard Crestez <cdleonard@xxxxxxxxx>
Cc: Paolo Abeni <pabeni@xxxxxxxxxx>
Cc: Salam Noureddine <noureddine@xxxxxxxxxx>
Cc: netdev@xxxxxxxxxxxxxxx
Cc: linux-kernel@xxxxxxxxxxxxxxx

[1]: https://lore.kernel.org/all/20230403213420.1576559-9-dima@xxxxxxxxxx/T/#u

Dmitry Safonov (5):
  net/tcp: Separate TCP-MD5 signing from tcp_v{4,6}_send_reset()
  net/tcp: Use tcp_v6_md5_hash_skb() instead of .calc_md5_hash()
  [RFC] net/tcp-md5: Verify inbound segments on twsk
  [RFC] net/tcp-md5: Don't send RST if key (dis)appeared
  [RFC] net/tcp-md5: Don't send ACK if key (dis)appears

 include/net/tcp.h   |  18 +++-
 net/ipv4/tcp.c      |   9 +-
 net/ipv4/tcp_ipv4.c | 196 +++++++++++++++++++++++++-------------------
 net/ipv6/tcp_ipv6.c | 130 +++++++++++++++++------------
 4 files changed, 207 insertions(+), 146 deletions(-)


base-commit: ba0ad6ed89fd5dada3b7b65ef2b08e95d449d4ab
-- 
2.40.0