diff options
| author | Dmitry Safonov <[email protected]> | 2023-12-04 19:00:43 +0000 |
|---|---|---|
| committer | Paolo Abeni <[email protected]> | 2023-12-06 11:36:55 +0000 |
| commit | 12083d728213285c2d4347fa0ed3b556449703ce (patch) | |
| tree | 608cbf50cf5bfa59c7c42ed849d642bcce0938c6 /net/ipv4/tcp_output.c | |
| parent | net/tcp: Limit TCP_AO_REPAIR to non-listen sockets (diff) | |
| download | kernel-12083d728213285c2d4347fa0ed3b556449703ce.tar.gz kernel-12083d728213285c2d4347fa0ed3b556449703ce.zip | |
net/tcp: Don't add key with non-matching VRF on connected sockets
If the connection was established, don't allow adding TCP-AO keys that
don't match the peer. Currently, there are checks for ip-address
matching, but L3 index check is missing. Add it to restrict userspace
shooting itself somewhere.
Yet, nothing restricts the CAP_NET_RAW user from trying to shoot
themselves by performing setsockopt(SO_BINDTODEVICE) or
setsockopt(SO_BINDTOIFINDEX) over an established TCP-AO connection.
So, this is just "minimum effort" to potentially save someone's
debugging time, rather than a full restriction on doing weird things.
Fixes: 248411b8cb89 ("net/tcp: Wire up l3index to TCP-AO")
Signed-off-by: Dmitry Safonov <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
Diffstat (limited to 'net/ipv4/tcp_output.c')
0 files changed, 0 insertions, 0 deletions