tcp_inbound_hash() parses both TCP-MD5 and TCP-AO options when at least one of the two features is enabled. With TCP_MD5SIG=y and TCP_AO=n, a packet with an AO option reaches the disabled tcp_inbound_ao_hash() stub. That stub returns success, so sockets configured to require MD5 authentication end up accepting unauthenticated data. The inverse configuration with TCP_MD5SIG=n and TCP_AO=y has the same problem for an MD5 option on AO sockets. Make the disabled stubs reject options for the unsupported authentication scheme. Fixes: 0a3a809089eb ("net/tcp: Verify inbound TCP-AO signed segments") Cc: stable@vger.kernel.org Signed-off-by: Jérémy Jean --- include/net/tcp_ao.h | 2 +- net/ipv4/tcp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/include/net/tcp_ao.h b/include/net/tcp_ao.h index 9a2333e62e994..bb249d6df8723 100644 --- a/include/net/tcp_ao.h +++ b/include/net/tcp_ao.h @@ -303,7 +303,7 @@ static inline enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk, const struct request_sock *req, int l3index, const struct tcp_ao_hdr *aoh) { - return SKB_NOT_DROPPED_YET; + return SKB_DROP_REASON_TCP_AOUNEXPECTED; } static inline struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk, diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 87ef6d5cbfeba..7d800b6283bd2 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -4962,7 +4962,7 @@ tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb, const void *saddr, const void *daddr, int family, int l3index, const __u8 *hash_location) { - return SKB_NOT_DROPPED_YET; + return SKB_DROP_REASON_TCP_MD5UNEXPECTED; } #endif -- 2.47.3