net/tcp-md5: Fix MAC comparison to be constant-time

To prevent timing attacks, MACs need to be compared in constant
time.  Use the appropriate helper function for this.

Fixes: cfb6eeb4c860 ("[TCP]: MD5 Signature Option (RFC2385) support.")
Fixes: 658ddaaf6694 ("tcp: md5: RST: getting md5 key from listener")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Link: https://patch.msgid.link/20260302203409.13388-1-ebiggers@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 3ab6247be58530104d0bd87c48d6fff9ce0144dd..df922f9f52891632c1f43e1e2f7db1328bc89e4a 100644 (file)
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -762,6 +762,7 @@ config TCP_AO
 config TCP_MD5SIG
        bool "TCP: MD5 Signature Option support (RFC2385)"
        select CRYPTO_LIB_MD5
+       select CRYPTO_LIB_UTILS
        help
          RFC2385 specifies a method of giving MD5 protection to TCP sessions.
          Its main (only?) use is to protect BGP sessions between core routers

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 8cdc26e8ad689154886a7ae66e0f375bebdfe035..202a4e57a218851ed5bfa433896913e010e03af9 100644 (file)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -244,6 +244,7 @@
 #define pr_fmt(fmt) "TCP: " fmt
 
 #include <crypto/md5.h>
+#include <crypto/utils.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/types.h>
@@ -4970,7 +4971,7 @@ tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
                tcp_v4_md5_hash_skb(newhash, key, NULL, skb);
        else
                tp->af_specific->calc_md5_hash(newhash, key, NULL, skb);
-       if (memcmp(hash_location, newhash, 16) != 0) {
+       if (crypto_memneq(hash_location, newhash, 16)) {
                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
                trace_tcp_hash_md5_mismatch(sk, skb);
                return SKB_DROP_REASON_TCP_MD5FAILURE;

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index d53d39be291a5750af3ab2a160b35f0f8a28ff9d..910c25cb24e1099c5480de276d6a3f27c33397ec 100644 (file)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -88,6 +88,7 @@
 #include <linux/skbuff_ref.h>
 
 #include <crypto/md5.h>
+#include <crypto/utils.h>
 
 #include <trace/events/tcp.h>
 
@@ -839,7 +840,7 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb,
                        goto out;
 
                tcp_v4_md5_hash_skb(newhash, key, NULL, skb);
-               if (memcmp(md5_hash_location, newhash, 16) != 0)
+               if (crypto_memneq(md5_hash_location, newhash, 16))
                        goto out;
        }
 

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index e46a0efae01235ae7430ed268b92cb47309b8d28..5195a46b951ea3b51fa7ae5a7f2a1b6c49f578c8 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -68,6 +68,7 @@
 #include <linux/seq_file.h>
 
 #include <crypto/md5.h>
+#include <crypto/utils.h>
 
 #include <trace/events/tcp.h>
 
@@ -1048,7 +1049,7 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb,
                key.type = TCP_KEY_MD5;
 
                tcp_v6_md5_hash_skb(newhash, key.md5_key, NULL, skb);
-               if (memcmp(md5_hash_location, newhash, 16) != 0)
+               if (crypto_memneq(md5_hash_location, newhash, 16))
                        goto out;
        }
 #endif