Similarly to IPsec, RFC5925 prescribes: ">> A TCP-AO implementation MUST default to ignore incoming ICMPv4 messages of Type 3 (destination unreachable), Codes 2-4 (protocol unreachable, port unreachable, and fragmentation needed -- ’hard errors’), and ICMPv6 Type 1 (destination unreachable), Code 1 (administratively prohibited) and Code 4 (port unreachable) intended for connections in synchronized states (ESTABLISHED, FIN-WAIT-1, FIN- WAIT-2, CLOSE-WAIT, CLOSING, LAST-ACK, TIME-WAIT) that match MKTs." A selftest (later in patch series) verifies that this attack is not possible in this TCP-AO implementation.
Showing the changes to include/uapi (2 of 7 files). Show all
Unified · Split
| @@ -301,6 +301,7 @@ enum · 300 unmodified lines | ||
| 301 | 301 | LINUX_MIB_TCPAOBAD, /* TCPAOBad */ |
| 302 | 302 | LINUX_MIB_TCPAOKEYNOTFOUND, /* TCPAOKeyNotFound */ |
| 303 | 303 | LINUX_MIB_TCPAOGOOD, /* TCPAOGood */ |
| 304 | + LINUX_MIB_TCPAODROPPEDICMPS, /* TCPAODroppedIcmps */ | |
| 304 | 305 | __LINUX_MIB_MAX |
| 305 | 306 | }; |
| 306 | 307 | |
| @@ -405,7 +405,8 @@ struct tcp_ao_info_opt { /* setsockopt(TCP_AO_INFO) */ · 404 unmodified lines | ||
| 405 | 405 | set_rnext :1, /* corresponding ::rnext */ |
| 406 | 406 | ao_required :1, /* don't accept non-AO connects */ |
| 407 | 407 | set_counters :1, /* set/clear ::pkt_* counters */ |
| 408 | − reserved :28; /* must be 0 */ | |
| 408 | + accept_icmps :1, /* accept incoming ICMPs */ | |
| 409 | + reserved :27; /* must be 0 */ | |
| 409 | 410 | __u16 reserved2; /* padding, must be 0 */ |
| 410 | 411 | __u8 current_key; /* KeyID to set as Current_key */ |
| 411 | 412 | __u8 rnext; /* KeyID to set as Rnext_key */ |
| @@ -413,6 +414,7 @@ struct tcp_ao_info_opt { /* setsockopt(TCP_AO_INFO) */ · 1 unmodified line | ||
| 413 | 414 | __u64 pkt_bad; /* failed verification */ |
| 414 | 415 | __u64 pkt_key_not_found; /* could not find a key to verify */ |
| 415 | 416 | __u64 pkt_ao_required; /* segments missing TCP-AO sign */ |
| 417 | + __u64 pkt_dropped_icmp; /* ICMPs that were ignored */ | |
| 416 | 418 | } __attribute__((aligned(8))); |
| 417 | 419 | |
| 418 | 420 | /* setsockopt(fd, IPPROTO_TCP, TCP_ZEROCOPY_RECEIVE, ...) */ |