tcp: add server ip to encrypt cookie in fast open

Encrypt the cookie with both server and client IPv4 addresses,
such that multi-homed server will grant different cookies
based on both the source and destination IPs. No client change
is needed since cookie is opaque to the client.

Signed-off-by: Yuchung Cheng <ycheng@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 27b652f379efcfac8c81512093db8013a329e8c5..09cb5c11ceea34b54f46664feef3961d53c57392 100644 (file)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1300,7 +1300,8 @@ void tcp_free_fastopen_req(struct tcp_sock *tp);
 
 extern struct tcp_fastopen_context __rcu *tcp_fastopen_ctx;
 int tcp_fastopen_reset_cipher(void *key, unsigned int len);
-void tcp_fastopen_cookie_gen(__be32 addr, struct tcp_fastopen_cookie *foc);
+extern void tcp_fastopen_cookie_gen(__be32 src, __be32 dst,
+                                   struct tcp_fastopen_cookie *foc);
 
 #define TCP_FASTOPEN_KEY_LENGTH 16
 

diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 8f7ef0ad80e5b6b062b7b40f3049634e63b93b40..ab7bd35bb312c6e9e07aa2950d75ec4bbc982eac 100644 (file)
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -58,23 +58,22 @@ error:              kfree(ctx);
        return err;
 }
 
-/* Computes the fastopen cookie for the peer.
- * The peer address is a 128 bits long (pad with zeros for IPv4).
+/* Computes the fastopen cookie for the IP path.
+ * The path is a 128 bits long (pad with zeros for IPv4).
  *
  * The caller must check foc->len to determine if a valid cookie
  * has been generated successfully.
 */
-void tcp_fastopen_cookie_gen(__be32 addr, struct tcp_fastopen_cookie *foc)
+void tcp_fastopen_cookie_gen(__be32 src, __be32 dst,
+                            struct tcp_fastopen_cookie *foc)
 {
-       __be32 peer_addr[4] = { addr, 0, 0, 0 };
+       __be32 path[4] = { src, dst, 0, 0 };
        struct tcp_fastopen_context *ctx;
 
        rcu_read_lock();
        ctx = rcu_dereference(tcp_fastopen_ctx);
        if (ctx) {
-               crypto_cipher_encrypt_one(ctx->tfm,
-                                         foc->val,
-                                         (__u8 *)peer_addr);
+               crypto_cipher_encrypt_one(ctx->tfm, foc->val, (__u8 *)path);
                foc->len = TCP_FASTOPEN_COOKIE_SIZE;
        }
        rcu_read_unlock();

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 280efe5f19c1c86385bf8e15c146d8ac31135198..ec2702882d8d4255b38f487158abd81b0e091647 100644 (file)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1316,9 +1316,11 @@ static bool tcp_fastopen_check(struct sock *sk, struct sk_buff *skb,
                tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
                return true;
        }
+
        if (foc->len == TCP_FASTOPEN_COOKIE_SIZE) {
                if ((sysctl_tcp_fastopen & TFO_SERVER_COOKIE_NOT_CHKED) == 0) {
-                       tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc);
+                       tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr,
+                                               ip_hdr(skb)->daddr, valid_foc);
                        if ((valid_foc->len != TCP_FASTOPEN_COOKIE_SIZE) ||
                            memcmp(&foc->val[0], &valid_foc->val[0],
                            TCP_FASTOPEN_COOKIE_SIZE) != 0)
@@ -1329,14 +1331,16 @@ static bool tcp_fastopen_check(struct sock *sk, struct sk_buff *skb,
                tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
                return true;
        } else if (foc->len == 0) { /* Client requesting a cookie */
-               tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc);
+               tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr,
+                                       ip_hdr(skb)->daddr, valid_foc);
                NET_INC_STATS_BH(sock_net(sk),
                    LINUX_MIB_TCPFASTOPENCOOKIEREQD);
        } else {
                /* Client sent a cookie with wrong size. Treat it
                 * the same as invalid and return a valid one.
                 */
-               tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc);
+               tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr,
+                                       ip_hdr(skb)->daddr, valid_foc);
        }
        return false;
 }