Maxim Mikityanskiy 1816af613e bpf: Support dual-stack sockets in bpf_tcp_check_syncookie ... [ Upstream commit 2e8702cc0c ] bpf_tcp_gen_syncookie looks at the IP version in the IP header and validates the address family of the socket. It supports IPv4 packets in AF_INET6 dual-stack sockets. On the other hand, bpf_tcp_check_syncookie looks only at the address family of the socket, ignoring the real IP version in headers, and validates only the packet size. This implementation has some drawbacks: 1. Packets are not validated properly, allowing a BPF program to trick bpf_tcp_check_syncookie into handling an IPv6 packet on an IPv4 socket. 2. Dual-stack sockets fail the checks on IPv4 packets. IPv4 clients end up receiving a SYNACK with the cookie, but the following ACK gets dropped. This patch fixes these issues by changing the checks in bpf_tcp_check_syncookie to match the ones in bpf_tcp_gen_syncookie. IP version from the header is taken into account, and it is validated properly with address family. Fixes: 3990408470 ("bpf: add helper to check for a valid SYN cookie") Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Acked-by: Arthur Fabre <afabre@cloudflare.com> Link: https://lore.kernel.org/bpf/20220406124113.2795730-1-maximmi@nvidia.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-04-13 20:59:19 +02:00
..
6lowpan	…
9p	…
802	…
8021q	…
appletalk	…
atm	…
ax25	…
batman-adv	…
bluetooth	…
bpf	…
bpfilter	…
bridge	…
caif	…
can	…
ceph	…
core	bpf: Support dual-stack sockets in bpf_tcp_check_syncookie	2022-04-13 20:59:19 +02:00
dcb	…
dccp	…
decnet	…
dns_resolver	…
dsa	…
ethernet	…
ethtool	…
hsr	…
ieee802154	…
ife	…
ipv4	…
ipv6	…
iucv	…
kcm	…
key	…
l2tp	…
l3mdev	…
lapb	…
llc	…
mac80211	…
mac802154	…
mctp	…
mpls	…
mptcp	…
ncsi	…
netfilter	…
netlabel	…
netlink	…
netrom	…
nfc	…
nsh	…
openvswitch	net: openvswitch: fix leak of nested actions	2022-04-13 20:59:19 +02:00
packet	…
phonet	…
psample	…
qrtr	…
rds	…
rfkill	…
rose	…
rxrpc	rxrpc: fix a race in rxrpc_exit_net()	2022-04-13 20:59:19 +02:00
sched	…
sctp	…
smc	…
strparser	…
sunrpc	…
switchdev	…
tipc	…
tls	…
unix	…
vmw_vsock	…
wireless	…
x25	…
xdp	…
xfrm	…
Kconfig	…
Makefile	…
compat.c	…
devres.c	…
socket.c	…
sysctl_net.c	…