ipv4: Namespaceify tcp_fastopen_key knob
Different namespace application might require different tcp_fastopen_key independently of the host. David Miller pointed out there is a leak without releasing the context of tcp_fastopen_key during netns teardown. So add the release action in exit_batch path. Tested: 1. Container namespace: # cat /proc/sys/net/ipv4/tcp_fastopen_key: 2817fff2-f803cf97-eadfd1f3-78c0992b cookie key in tcp syn packets: Fast Open Cookie Kind: TCP Fast Open Cookie (34) Length: 10 Fast Open Cookie: 1e5dd82a8c492ca9 2. Host: # cat /proc/sys/net/ipv4/tcp_fastopen_key: 107d7c5f-68eb2ac7-02fb06e6-ed341702 cookie key in tcp syn packets: Fast Open Cookie Kind: TCP Fast Open Cookie (34) Length: 10 Fast Open Cookie: e213c02bf0afbc8a Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
dd000598a3
commit
4371384856
|
@ -36,6 +36,8 @@ struct inet_timewait_death_row {
|
|||
int sysctl_max_tw_buckets;
|
||||
};
|
||||
|
||||
struct tcp_fastopen_context;
|
||||
|
||||
struct netns_ipv4 {
|
||||
#ifdef CONFIG_SYSCTL
|
||||
struct ctl_table_header *forw_hdr;
|
||||
|
@ -129,6 +131,8 @@ struct netns_ipv4 {
|
|||
struct inet_timewait_death_row tcp_death_row;
|
||||
int sysctl_max_syn_backlog;
|
||||
int sysctl_tcp_fastopen;
|
||||
struct tcp_fastopen_context __rcu *tcp_fastopen_ctx;
|
||||
spinlock_t tcp_fastopen_ctx_lock;
|
||||
|
||||
#ifdef CONFIG_NET_L3_MASTER_DEV
|
||||
int sysctl_udp_l3mdev_accept;
|
||||
|
|
|
@ -1549,13 +1549,13 @@ struct tcp_fastopen_request {
|
|||
};
|
||||
void tcp_free_fastopen_req(struct tcp_sock *tp);
|
||||
|
||||
extern struct tcp_fastopen_context __rcu *tcp_fastopen_ctx;
|
||||
int tcp_fastopen_reset_cipher(void *key, unsigned int len);
|
||||
void tcp_fastopen_ctx_destroy(struct net *net);
|
||||
int tcp_fastopen_reset_cipher(struct net *net, void *key, unsigned int len);
|
||||
void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb);
|
||||
struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
|
||||
struct request_sock *req,
|
||||
struct tcp_fastopen_cookie *foc);
|
||||
void tcp_fastopen_init_key_once(void);
|
||||
void tcp_fastopen_init_key_once(struct net *net);
|
||||
bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
|
||||
struct tcp_fastopen_cookie *cookie);
|
||||
bool tcp_fastopen_defer_connect(struct sock *sk, int *err);
|
||||
|
|
|
@ -222,7 +222,7 @@ int inet_listen(struct socket *sock, int backlog)
|
|||
(tcp_fastopen & TFO_SERVER_ENABLE) &&
|
||||
!inet_csk(sk)->icsk_accept_queue.fastopenq.max_qlen) {
|
||||
fastopen_queue_tune(sk, backlog);
|
||||
tcp_fastopen_init_key_once();
|
||||
tcp_fastopen_init_key_once(sock_net(sk));
|
||||
}
|
||||
|
||||
err = inet_csk_listen_start(sk, backlog);
|
||||
|
|
|
@ -251,10 +251,12 @@ static int proc_allowed_congestion_control(struct ctl_table *ctl,
|
|||
return ret;
|
||||
}
|
||||
|
||||
static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write,
|
||||
static int proc_tcp_fastopen_key(struct ctl_table *table, int write,
|
||||
void __user *buffer, size_t *lenp,
|
||||
loff_t *ppos)
|
||||
{
|
||||
struct net *net = container_of(table->data, struct net,
|
||||
ipv4.sysctl_tcp_fastopen);
|
||||
struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
|
||||
struct tcp_fastopen_context *ctxt;
|
||||
int ret;
|
||||
|
@ -265,7 +267,7 @@ static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write,
|
|||
return -ENOMEM;
|
||||
|
||||
rcu_read_lock();
|
||||
ctxt = rcu_dereference(tcp_fastopen_ctx);
|
||||
ctxt = rcu_dereference(net->ipv4.tcp_fastopen_ctx);
|
||||
if (ctxt)
|
||||
memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
|
||||
else
|
||||
|
@ -282,7 +284,7 @@ static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write,
|
|||
ret = -EINVAL;
|
||||
goto bad_key;
|
||||
}
|
||||
tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH);
|
||||
tcp_fastopen_reset_cipher(net, user_key, TCP_FASTOPEN_KEY_LENGTH);
|
||||
}
|
||||
|
||||
bad_key:
|
||||
|
@ -395,12 +397,6 @@ static struct ctl_table ipv4_table[] = {
|
|||
.mode = 0644,
|
||||
.proc_handler = proc_dointvec
|
||||
},
|
||||
{
|
||||
.procname = "tcp_fastopen_key",
|
||||
.mode = 0600,
|
||||
.maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10),
|
||||
.proc_handler = proc_tcp_fastopen_key,
|
||||
},
|
||||
{
|
||||
.procname = "tcp_fastopen_blackhole_timeout_sec",
|
||||
.data = &sysctl_tcp_fastopen_blackhole_timeout,
|
||||
|
@ -1080,6 +1076,13 @@ static struct ctl_table ipv4_net_table[] = {
|
|||
.mode = 0644,
|
||||
.proc_handler = proc_dointvec,
|
||||
},
|
||||
{
|
||||
.procname = "tcp_fastopen_key",
|
||||
.mode = 0600,
|
||||
.data = &init_net.ipv4.sysctl_tcp_fastopen,
|
||||
.maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10),
|
||||
.proc_handler = proc_tcp_fastopen_key,
|
||||
},
|
||||
#ifdef CONFIG_IP_ROUTE_MULTIPATH
|
||||
{
|
||||
.procname = "fib_multipath_use_neigh",
|
||||
|
|
|
@ -2749,7 +2749,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
|
|||
case TCP_FASTOPEN:
|
||||
if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE |
|
||||
TCPF_LISTEN))) {
|
||||
tcp_fastopen_init_key_once();
|
||||
tcp_fastopen_init_key_once(net);
|
||||
|
||||
fastopen_queue_tune(sk, val);
|
||||
} else {
|
||||
|
|
|
@ -9,13 +9,18 @@
|
|||
#include <net/inetpeer.h>
|
||||
#include <net/tcp.h>
|
||||
|
||||
struct tcp_fastopen_context __rcu *tcp_fastopen_ctx;
|
||||
|
||||
static DEFINE_SPINLOCK(tcp_fastopen_ctx_lock);
|
||||
|
||||
void tcp_fastopen_init_key_once(void)
|
||||
void tcp_fastopen_init_key_once(struct net *net)
|
||||
{
|
||||
static u8 key[TCP_FASTOPEN_KEY_LENGTH];
|
||||
u8 key[TCP_FASTOPEN_KEY_LENGTH];
|
||||
struct tcp_fastopen_context *ctxt;
|
||||
|
||||
rcu_read_lock();
|
||||
ctxt = rcu_dereference(net->ipv4.tcp_fastopen_ctx);
|
||||
if (ctxt) {
|
||||
rcu_read_unlock();
|
||||
return;
|
||||
}
|
||||
rcu_read_unlock();
|
||||
|
||||
/* tcp_fastopen_reset_cipher publishes the new context
|
||||
* atomically, so we allow this race happening here.
|
||||
|
@ -23,8 +28,8 @@ void tcp_fastopen_init_key_once(void)
|
|||
* All call sites of tcp_fastopen_cookie_gen also check
|
||||
* for a valid cookie, so this is an acceptable risk.
|
||||
*/
|
||||
if (net_get_random_once(key, sizeof(key)))
|
||||
tcp_fastopen_reset_cipher(key, sizeof(key));
|
||||
get_random_bytes(key, sizeof(key));
|
||||
tcp_fastopen_reset_cipher(net, key, sizeof(key));
|
||||
}
|
||||
|
||||
static void tcp_fastopen_ctx_free(struct rcu_head *head)
|
||||
|
@ -35,7 +40,22 @@ static void tcp_fastopen_ctx_free(struct rcu_head *head)
|
|||
kfree(ctx);
|
||||
}
|
||||
|
||||
int tcp_fastopen_reset_cipher(void *key, unsigned int len)
|
||||
void tcp_fastopen_ctx_destroy(struct net *net)
|
||||
{
|
||||
struct tcp_fastopen_context *ctxt;
|
||||
|
||||
spin_lock(&net->ipv4.tcp_fastopen_ctx_lock);
|
||||
|
||||
ctxt = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx,
|
||||
lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock));
|
||||
rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, NULL);
|
||||
spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock);
|
||||
|
||||
if (ctxt)
|
||||
call_rcu(&ctxt->rcu, tcp_fastopen_ctx_free);
|
||||
}
|
||||
|
||||
int tcp_fastopen_reset_cipher(struct net *net, void *key, unsigned int len)
|
||||
{
|
||||
int err;
|
||||
struct tcp_fastopen_context *ctx, *octx;
|
||||
|
@ -59,26 +79,27 @@ error: kfree(ctx);
|
|||
}
|
||||
memcpy(ctx->key, key, len);
|
||||
|
||||
spin_lock(&tcp_fastopen_ctx_lock);
|
||||
spin_lock(&net->ipv4.tcp_fastopen_ctx_lock);
|
||||
|
||||
octx = rcu_dereference_protected(tcp_fastopen_ctx,
|
||||
lockdep_is_held(&tcp_fastopen_ctx_lock));
|
||||
rcu_assign_pointer(tcp_fastopen_ctx, ctx);
|
||||
spin_unlock(&tcp_fastopen_ctx_lock);
|
||||
octx = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx,
|
||||
lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock));
|
||||
rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, ctx);
|
||||
spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock);
|
||||
|
||||
if (octx)
|
||||
call_rcu(&octx->rcu, tcp_fastopen_ctx_free);
|
||||
return err;
|
||||
}
|
||||
|
||||
static bool __tcp_fastopen_cookie_gen(const void *path,
|
||||
static bool __tcp_fastopen_cookie_gen(struct net *net,
|
||||
const void *path,
|
||||
struct tcp_fastopen_cookie *foc)
|
||||
{
|
||||
struct tcp_fastopen_context *ctx;
|
||||
bool ok = false;
|
||||
|
||||
rcu_read_lock();
|
||||
ctx = rcu_dereference(tcp_fastopen_ctx);
|
||||
ctx = rcu_dereference(net->ipv4.tcp_fastopen_ctx);
|
||||
if (ctx) {
|
||||
crypto_cipher_encrypt_one(ctx->tfm, foc->val, path);
|
||||
foc->len = TCP_FASTOPEN_COOKIE_SIZE;
|
||||
|
@ -94,7 +115,8 @@ static bool __tcp_fastopen_cookie_gen(const void *path,
|
|||
*
|
||||
* XXX (TFO) - refactor when TCP_FASTOPEN_COOKIE_SIZE != AES_BLOCK_SIZE.
|
||||
*/
|
||||
static bool tcp_fastopen_cookie_gen(struct request_sock *req,
|
||||
static bool tcp_fastopen_cookie_gen(struct net *net,
|
||||
struct request_sock *req,
|
||||
struct sk_buff *syn,
|
||||
struct tcp_fastopen_cookie *foc)
|
||||
{
|
||||
|
@ -102,7 +124,7 @@ static bool tcp_fastopen_cookie_gen(struct request_sock *req,
|
|||
const struct iphdr *iph = ip_hdr(syn);
|
||||
|
||||
__be32 path[4] = { iph->saddr, iph->daddr, 0, 0 };
|
||||
return __tcp_fastopen_cookie_gen(path, foc);
|
||||
return __tcp_fastopen_cookie_gen(net, path, foc);
|
||||
}
|
||||
|
||||
#if IS_ENABLED(CONFIG_IPV6)
|
||||
|
@ -110,13 +132,13 @@ static bool tcp_fastopen_cookie_gen(struct request_sock *req,
|
|||
const struct ipv6hdr *ip6h = ipv6_hdr(syn);
|
||||
struct tcp_fastopen_cookie tmp;
|
||||
|
||||
if (__tcp_fastopen_cookie_gen(&ip6h->saddr, &tmp)) {
|
||||
if (__tcp_fastopen_cookie_gen(net, &ip6h->saddr, &tmp)) {
|
||||
struct in6_addr *buf = &tmp.addr;
|
||||
int i;
|
||||
|
||||
for (i = 0; i < 4; i++)
|
||||
buf->s6_addr32[i] ^= ip6h->daddr.s6_addr32[i];
|
||||
return __tcp_fastopen_cookie_gen(buf, foc);
|
||||
return __tcp_fastopen_cookie_gen(net, buf, foc);
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
@ -296,7 +318,7 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
|
|||
goto fastopen;
|
||||
|
||||
if (foc->len >= 0 && /* Client presents or requests a cookie */
|
||||
tcp_fastopen_cookie_gen(req, skb, &valid_foc) &&
|
||||
tcp_fastopen_cookie_gen(sock_net(sk), req, skb, &valid_foc) &&
|
||||
foc->len == TCP_FASTOPEN_COOKIE_SIZE &&
|
||||
foc->len == valid_foc.len &&
|
||||
!memcmp(foc->val, valid_foc.val, foc->len)) {
|
||||
|
|
|
@ -2473,6 +2473,7 @@ static int __net_init tcp_sk_init(struct net *net)
|
|||
net->ipv4.sysctl_tcp_timestamps = 1;
|
||||
|
||||
net->ipv4.sysctl_tcp_fastopen = TFO_CLIENT_ENABLE;
|
||||
spin_lock_init(&net->ipv4.tcp_fastopen_ctx_lock);
|
||||
|
||||
return 0;
|
||||
fail:
|
||||
|
@ -2483,7 +2484,12 @@ fail:
|
|||
|
||||
static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
|
||||
{
|
||||
struct net *net;
|
||||
|
||||
inet_twsk_purge(&tcp_hashinfo, AF_INET);
|
||||
|
||||
list_for_each_entry(net, net_exit_list, exit_list)
|
||||
tcp_fastopen_ctx_destroy(net);
|
||||
}
|
||||
|
||||
static struct pernet_operations __net_initdata tcp_sk_ops = {
|
||||
|
|
Loading…
Reference in New Issue