diff mbox

[v2,net-next,1/3] ipv6: Prevent unexpected sk->sk_prot changes

Message ID AM4PR0501MB272370367F819BEB1EBF2D7DD4850@AM4PR0501MB2723.eurprd05.prod.outlook.com
State RFC, archived
Delegated to: David Miller
Headers show

Commit Message

Ilya Lesokhin Aug. 23, 2017, 7:49 a.m. UTC 
> -----Original Message-----

> From: Eric Dumazet [mailto:eric.dumazet@gmail.com]

> Sent: Tuesday, August 15, 2017 5:46 PM

> To: Boris Pismenny <borisp@mellanox.com>

> Cc: Ilya Lesokhin <ilyal@mellanox.com>; netdev@vger.kernel.org;

> davem@davemloft.net; davejwatson@fb.com; Aviad Yehezkel

> <aviadye@mellanox.com>

> Subject: Re: [PATCH v2 net-next 1/3] ipv6: Prevent unexpected sk->sk_prot

> changes

> 

> I am just saying IPV6_ADDRFORM is becoming spaghetti code, and maybe

> this is time to make it modular. 

> 


Hi Eric,
I understand your concern, but I would like to postpone implementing this
feature until the ulp infrastructure stabilizes.
I don't even know how many users want to use IPV6_ADDRFORM on sockets with ulp.
I think that simply returning an error for ulp sockets in the meantime is a reasonable 
compromise.

what do you think about the patch below?

Subject: [PATCH 1/1] ipv6: Disable IPV6_ADDRFORM on sockets with ulp attached

The IPV6_ADDRFORM setsockopt works by overriding sk->sk_prot.
The current KTLS ulp also overrides sk->sk_prot.
Consequently, using IPV6_ADDRFORM when there is a ulp attached is
unsafe and this patch disables it.

Fixes: 3c4d7559159b ('tls: kernel TLS support')
Signed-off-by: Ilya Lesokhin <ilyal@mellanox.com>

---
 net/ipv6/ipv6_sockglue.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)



Thanks,
Ilya
diff mbox

Patch

diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 02d795f..d935948 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -185,8 +185,12 @@  static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 					retv = -EBUSY;
 					break;
 				}
-			} else if (sk->sk_protocol != IPPROTO_TCP)
+			} else if (sk->sk_protocol == IPPROTO_TCP) {
+				if (inet_csk(sk)->icsk_ulp_ops)
+					break;
+			} else {
 				break;
+			}
 
 			if (sk->sk_state != TCP_ESTABLISHED) {
 				retv = -ENOTCONN;