[{"id":1759756,"web_url":"http://patchwork.ozlabs.org/comment/1759756/","msgid":"<1504047677.11498.107.camel@edumazet-glaptop3.roam.corp.google.com>","list_archive_url":null,"date":"2017-08-29T23:01:17","subject":"Re: [PATCH net-next v3 2/2] tcp_diag: report TCP MD5 signing keys\n\tand addresses","submitter":{"id":2404,"url":"http://patchwork.ozlabs.org/api/people/2404/","name":"Eric Dumazet","email":"eric.dumazet@gmail.com"},"content":"On Tue, 2017-08-29 at 15:29 -0700, Ivan Delalande wrote:\n> Report TCP MD5 (RFC2385) signing keys, addresses and address prefixes to\n> processes with CAP_NET_ADMIN requesting INET_DIAG_INFO. Currently it is\n> not possible to retrieve these from the kernel once they have been\n> configured on sockets.\n> \n> Signed-off-by: Ivan Delalande \n> ---\n> include/uapi/linux/inet_diag.h | 1 +\n> net/ipv4/tcp_diag.c | 115 ++++++++++++++++++++++++++++++++++++++---\n> 2 files changed, 110 insertions(+), 6 deletions(-)\n> \n> diff --git a/include/uapi/linux/inet_diag.h b/include/uapi/linux/inet_diag.h\n> index 678496897a68..f52ff62bfabe 100644\n> --- a/include/uapi/linux/inet_diag.h\n> +++ b/include/uapi/linux/inet_diag.h\n> @@ -143,6 +143,7 @@ enum {\n> \tINET_DIAG_MARK,\n> \tINET_DIAG_BBRINFO,\n> \tINET_DIAG_CLASS_ID,\n> +\tINET_DIAG_MD5SIG,\n> \t__INET_DIAG_MAX,\n> };\n> \n> diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c\n> index a748c74aa8b7..f972f9f7eae4 100644\n> --- a/net/ipv4/tcp_diag.c\n> +++ b/net/ipv4/tcp_diag.c\n> @@ -16,6 +16,7 @@\n> \n> #include \n> \n> +#include \n> #include \n> \n> static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,\n> @@ -36,6 +37,106 @@ static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,\n> \t\ttcp_get_info(sk, info);\n> }\n> \n> +#ifdef CONFIG_TCP_MD5SIG\n> +static void inet_diag_md5sig_fill(struct tcp_md5sig *info,\n> +\t\t\t\t const struct tcp_md5sig_key *key)\n> +{\n> +\t#if IS_ENABLED(CONFIG_IPV6)\n> +\tif (key->family == AF_INET6) {\n> +\t\tstruct sockaddr_in6 *sin6 =\n> +\t\t\t(struct sockaddr_in6 *)&info->tcpm_addr;\n> +\n> +\t\tmemcpy(&sin6->sin6_addr, &key->addr.a6,\n> +\t\t sizeof(struct in6_addr));\n> +\t} else\n> +\t#endif\n> +\t{\n> +\t\tstruct sockaddr_in *sin =\n> +\t\t\t(struct sockaddr_in *)&info->tcpm_addr;\n> +\n> +\t\tmemcpy(&sin->sin_addr, &key->addr.a4, sizeof(struct in_addr));\n\nYou probably need a memset(... 0 ...) to clear the XX bytes that are\nnot used by IPv4 address.\n\nOtherwise your patch is going to 'leak' 124 bytes of kernel memory to\nuser space and offer yet another way for attackers to build exploits.\n\nAFAIK, struct tcp_md5sig has a huge hole, since it uses\n\n\"struct __kernel_sockaddr_storage tcpm_addr \"\n\nSo a similar problem exists for IPv6.\n\nMaybe it is time to define a much smaller structure, using only 16 bytes\ninstead of 128 for the address.","headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"VC2w3qds\"; dkim-atps=neutral"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xhkdv1pB3z9sPt\n\tfor ;\n\tWed, 30 Aug 2017 09:01:23 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751781AbdH2XBV (ORCPT );\n\tTue, 29 Aug 2017 19:01:21 -0400","from mail-pf0-f196.google.com ([209.85.192.196]:38425 \"EHLO\n\tmail-pf0-f196.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1751746AbdH2XBU (ORCPT\n\t); Tue, 29 Aug 2017 19:01:20 -0400","by mail-pf0-f196.google.com with SMTP id r187so3173217pfr.5\n\tfor ; Tue, 29 Aug 2017 16:01:20 -0700 (PDT)","from ?IPv6:2620:15c:2c1:100:5c25:69da:43fc:a7c6?\n\t([2620:15c:2c1:100:5c25:69da:43fc:a7c6])\n\tby smtp.googlemail.com with ESMTPSA id\n\t128sm5978570pff.62.2017.08.29.16.01.18\n\t(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);\n\tTue, 29 Aug 2017 16:01:18 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=gmail.com; s=20161025;\n\th=message-id:subject:from:to:cc:date:in-reply-to:references\n\t:mime-version:content-transfer-encoding;\n\tbh=821eiD/ME/f2y+aNz9BD0MhohtO3sdDhWvISoZSUpW0=;\n\tb=VC2w3qds32BZXCmxQANPDfz+0iRUyL5mC/xRBALN0fpP1FwW8v8S8mgMnF129Moqth\n\tYQ+4vvizgtEMWRVsZnQv5Lk51XlZFuOOvKL1vGDrqIxoPaBlGc+lNiCJ89TYH5tPof0N\n\tYxFXDQdi3a/C9oMJ+WjcRziG/QdhbszOrfvMw+DNLLfOkF9Wt1nxboVcKamR1bg4rkNG\n\tlGTZw7fQglyEqcIQIGBf9MPFrihR+tAwftC4KHRRhHDhHLnI+5tP2IMpc36vqFEMdBUo\n\tBbEcU4wRGJD6C6h6tkf/cHwFeKqSM3ABvKZjCsJkmQqqQxARKv3RFTs+yxrkxBM1a25o\n\tcGLg==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:message-id:subject:from:to:cc:date:in-reply-to\n\t:references:mime-version:content-transfer-encoding;\n\tbh=821eiD/ME/f2y+aNz9BD0MhohtO3sdDhWvISoZSUpW0=;\n\tb=NpSSlBJ48ni4MoV/76OMneRR+4Y1ELFNy1mbBeCuFLbzXKio5mGM0bi106A8bG2Clc\n\tT+oxQFTOA9mQJHyH4PUZObumvYBZ6boCXJiSbzqhc3s667u7uv4kd33A49EAjwgwV1UK\n\tfEiP3dMVSZWzL0dQQY0iHBfEfKR6c0vU56AhBUGTNzgco5EoaG5OvZbGx91JRKA5riwb\n\tb4MYLhLWbKNsIHDNuW1N1RgleoUZjTrgLbjBGiyVK0/CjJaffbzfXvg6El4hDgrrt6U0\n\thv+VAYQitCkc1iDI1nuquP7O6UbdUIA0hnrOA7cxdk1KUzG9p+IQvIBx8ijqzU71CPM1\n\tw25g==","X-Gm-Message-State":"AHYfb5hPjj4keh3xvl97eli1oUPoDWwb+Jd8O/nF0esiWI93rXq+xucC\n\tDkLAt4/vqtn50ejc","X-Received":"by 10.98.202.76 with SMTP id n73mr1939956pfg.231.1504047679583; \n\tTue, 29 Aug 2017 16:01:19 -0700 (PDT)","Message-ID":"<1504047677.11498.107.camel@edumazet-glaptop3.roam.corp.google.com>","Subject":"Re: [PATCH net-next v3 2/2] tcp_diag: report TCP MD5 signing keys\n\tand addresses","From":"Eric Dumazet ","To":"Ivan Delalande ","Cc":"David Miller , netdev@vger.kernel.org","Date":"Tue, 29 Aug 2017 16:01:17 -0700","In-Reply-To":"<20170829222954.24863-3-colona@arista.com>","References":"<20170829222954.24863-1-colona@arista.com>\n\t<20170829222954.24863-3-colona@arista.com>","Content-Type":"text/plain; charset=\"UTF-8\"","X-Mailer":"Evolution 3.10.4-0ubuntu2 ","Mime-Version":"1.0","Content-Transfer-Encoding":"7bit","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"}}]