Skip to contentSkip to conversation

net/tcp-md5: Fix MAC comparison to be constant-time

PATCH Applied Eric Biggers 2 participants 2 messages Mar 2 – Mar 4

Subsystems (5)
Networking Network drivers Stable branch Crypto API +1 more subsystems
lore
Share & tools
lore

Eric Biggers

author
#0 lore raw

PATCH 1/1 net/tcp-md5: Fix MAC comparison to be constant-time

To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

Fixes cfb6eeb4c860 ("[TCP]: MD5 Signature Option (RFC2385) support.")
Fixes 658ddaaf6694 ("tcp: md5: RST: getting md5 key from listener")
Cc [email protected]
Signed-off-by Eric Biggers <[email protected]>
---
 net/ipv4/Kconfig    | 1 +
 net/ipv4/tcp.c      | 3 ++-
 net/ipv4/tcp_ipv4.c | 3 ++-
 net/ipv6/tcp_ipv6.c | 3 ++-
 4 files changed, 7 insertions(+), 3 deletions(-)
net/ipv4/Kconfig +1 -0
index b71c22475c515..45f5d401460c5 100644
@@ -759,10 +759,11 @@ config TCP_AO
 	  If unsure, say N.
 
 config TCP_MD5SIG
 	bool "TCP: MD5 Signature Option support (RFC2385)"
 	select CRYPTO_LIB_MD5
+	select CRYPTO_LIB_UTILS
 	help
 	  RFC2385 specifies a method of giving MD5 protection to TCP sessions.
 	  Its main (only?) use is to protect BGP sessions between core routers
 	  on the Internet.
net/ipv4/tcp.c +2 -1
index 8cdc26e8ad689..202a4e57a2188 100644
@@ -242,10 +242,11 @@
  */
 
 #define pr_fmt(fmt) "TCP: " fmt
 
 #include <crypto/md5.h>
+#include <crypto/utils.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/poll.h>

@@ -4968,11 +4969,11 @@ tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
 	 */
 	if (family == AF_INET)
 		tcp_v4_md5_hash_skb(newhash, key, NULL, skb);
 	else
 		tp->af_specific->calc_md5_hash(newhash, key, NULL, skb);
-	if (memcmp(hash_location, newhash, 16) != 0) {
+	if (crypto_memneq(hash_location, newhash, 16)) {
 		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
 		trace_tcp_hash_md5_mismatch(sk, skb);
 		return SKB_DROP_REASON_TCP_MD5FAILURE;
 	}
 	return SKB_NOT_DROPPED_YET;
net/ipv4/tcp_ipv4.c +2 -1
index d53d39be291a5..910c25cb24e10 100644
@@ -86,10 +86,11 @@
 #include <linux/inetdevice.h>
 #include <linux/btf_ids.h>
 #include <linux/skbuff_ref.h>
 
 #include <crypto/md5.h>
+#include <crypto/utils.h>
 
 #include <trace/events/tcp.h>
 
 #ifdef CONFIG_TCP_MD5SIG
 static void tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,

@@ -837,11 +838,11 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb,
 		key = tcp_md5_do_lookup(sk1, l3index, addr, AF_INET);
 		if (!key)
 			goto out;
 
 		tcp_v4_md5_hash_skb(newhash, key, NULL, skb);
-		if (memcmp(md5_hash_location, newhash, 16) != 0)
+		if (crypto_memneq(md5_hash_location, newhash, 16))
 			goto out;
 	}
 
 	if (key) {
 		rep.opt[0] = htonl((TCPOPT_NOP << 24) |
net/ipv6/tcp_ipv6.c +2 -1
index e46a0efae0123..5195a46b951ea 100644
@@ -66,10 +66,11 @@
 
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
 #include <crypto/md5.h>
+#include <crypto/utils.h>
 
 #include <trace/events/tcp.h>
 
 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb,
 			      enum sk_rst_reason reason);

@@ -1046,11 +1047,11 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb,
 		if (!key.md5_key)
 			goto out;
 		key.type = TCP_KEY_MD5;
 
 		tcp_v6_md5_hash_skb(newhash, key.md5_key, NULL, skb);
-		if (memcmp(md5_hash_location, newhash, 16) != 0)
+		if (crypto_memneq(md5_hash_location, newhash, 16))
 			goto out;
 	}
 #endif
 
 	if (th->ack)

base-commit: 9439a661c2e80485406ce2c90b107ca17858382d

Signature · 1 line
2.53.0
CI Applied
#1 lore raw
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 9 lines · On Mon, 2 Mar 2026 12:34:09 -0800 you wrote:

To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

Fixes cfb6eeb4c860 ("[TCP]: MD5 Signature Option (RFC2385) support.")
Fixes 658ddaaf6694 ("tcp: md5: RST: getting md5 key from listener")
Cc [email protected]
Signed-off-by Eric Biggers <[email protected]>

[...]

Here is the summary with links:
- [net] net/tcp-md5: Fix MAC comparison to be constant-time

    https://git.kernel.org/netdev/net/c/46d0d6f50dab

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html