net/tcp-ao: Fix MAC comparison to be constant-time
Subsystems (5)
PATCH 1/1 net/tcp-ao: Fix MAC comparison to be constant-time
To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
--- net/ipv4/Kconfig | 1 + net/ipv4/tcp_ao.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
net/ipv4/Kconfig +1 -0
@@ -746,10 +746,11 @@ config TCP_SIGPOOL tristate config TCP_AO bool "TCP: Authentication Option (RFC5925)" select CRYPTO + select CRYPTO_LIB_UTILS select TCP_SIGPOOL depends on 64BIT && IPV6 != m # seq-number extension needs WRITE_ONCE(u64) help TCP-AO specifies the use of stronger Message Authentication Codes (MACs), protects against replays for long-lived TCP connections, and
net/ipv4/tcp_ao.c +2 -1
@@ -8,10 +8,11 @@* Salam Noureddine <[email protected]> */ #define pr_fmt (fmt) "TCP: " fmt#include <crypto/hash.h> +#include <crypto/utils.h> #include <linux/inetdevice.h> #include <linux/tcp.h> #include <net/tcp.h> #include <net/ipv6.h>
@@ -920,11 +921,11 @@ tcp_ao_verify_hash(const struct sock *sk, const struct sk_buff *skb,return SKB_DROP_REASON_NOT_SPECIFIED ;/* XXX: make it per-AF callback? */ tcp_ao_hash_skb (family, hash_buf, key, sk, skb, traffic_key, (phash - (u8 *)th), sne); -if (memcmp (phash, hash_buf, maclen)) { +if (crypto_memneq (phash, hash_buf, maclen)) {NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPAOBAD );atomic64_inc (&info->counters.pkt_bad);atomic64_inc (&key->pkt_bad);trace_tcp_ao_mismatch (sk, skb, aoh->keyid, aoh->rnext_keyid, maclen);
base-commit: 9439a661c2e80485406ce2c90b107ca17858382d
Signature · 1 line
2.53.0
Quoted 8 lines · Eric Biggers
To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
Fixes 0a3a809089eb ("net/tcp: Verify inbound TCP-AO signed segments")Cc Dmitry Safonov <[email protected]>Signed-off-by Eric Biggers <[email protected]>
Thanks, Eric, LGTM.
Could you also send a similar patch for TCP-MD5? tcp_inbound_md5_hash(), tcp_v{4,6}_send_reset() would need the same change.
Quoted 55 lines
--- net/ipv4/Kconfig | 1 + net/ipv4/tcp_ao.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)net/ipv4/Kconfig +1
-0@@ -746,10 +746,11 @@ config TCP_SIGPOOL tristate config TCP_AO bool "TCP: Authentication Option (RFC5925)" select CRYPTO + select CRYPTO_LIB_UTILS select TCP_SIGPOOL depends on 64BIT && IPV6 != m # seq-number extension needs WRITE_ONCE(u64) help TCP-AO specifies the use of stronger Message Authentication Codes (MACs), protects against replays for long-lived TCP connections, andnet/ipv4/tcp_ao.c +2
-1@@ -8,10 +8,11 @@* Salam Noureddine <[email protected]> */ #define pr_fmt (fmt) "TCP: " fmt#include <crypto/hash.h> +#include <crypto/utils.h> #include <linux/inetdevice.h> #include <linux/tcp.h> #include <net/tcp.h> #include <net/ipv6.h> @@ -920,11 +921,11 @@ tcp_ao_verify_hash(const struct sock *sk, const struct sk_buff *skb,return SKB_DROP_REASON_NOT_SPECIFIED ;/* XXX: make it per-AF callback? */ tcp_ao_hash_skb (family, hash_buf, key, sk, skb, traffic_key, (phash - (u8 *)th), sne); -if (memcmp (phash, hash_buf, maclen)) { +if (crypto_memneq (phash, hash_buf, maclen)) {NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPAOBAD );atomic64_inc (&info->counters.pkt_bad);atomic64_inc (&key->pkt_bad);trace_tcp_ao_mismatch (sk, skb, aoh->keyid, aoh->rnext_keyid, maclen);base-commit:
9439a661c2e80485406ce2c90b107ca17858382d--
2.53.0
Quoted 10 lines · Dmitry Safonov
Quoted 8 lines · Eric Biggers
To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
Fixes 0a3a809089eb ("net/tcp: Verify inbound TCP-AO signed segments")Cc Dmitry Safonov <[email protected]>Signed-off-by Eric Biggers <[email protected]>
Quoted 6 lines
Thanks, Eric, LGTM.
Reviewed-by Dmitry Safonov <[email protected]>Could you also send a similar patch for TCP-MD5?
tcp_inbound_md5_hash(), tcp_v{4,6}_send_reset() would need the same change.
Already done, it was the first one I sent:
https://lore.kernel.org/netdev/[email protected]/
- Eric
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:
Quoted 9 lines · On Mon, 2 Mar 2026 12:36:00 -0800 you wrote:
To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
Fixes 0a3a809089eb ("net/tcp: Verify inbound TCP-AO signed segments")Cc Dmitry Safonov <[email protected]>Signed-off-by Eric Biggers <[email protected]>[...]
Here is the summary with links:
- [net] net/tcp-ao: Fix MAC comparison to be constant-time
https://git.kernel.org/netdev/net/c/67edfec516d3
You are awesome, thank you!
Signature · 2 lines
Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html