net: add real socket cookies

A long standing problem in netlink socket dumps is the use
of kernel socket addresses as cookies.

1) It is a security concern.

2) Sockets can be reused quite quickly, so there is
   no guarantee a cookie is used once and identify
   a flow.

3) request sock, establish sock, and timewait socks
   for a given flow have different cookies.

Part of our effort to bring better TCP statistics requires
to switch to a different allocator.

In this patch, I chose to use a per network namespace 64bit generator,
and to use it only in the case a socket needs to be dumped to netlink.
(This might be refined later if needed)

Note that I tried to carry cookies from request sock, to establish sock,
then timewait sockets.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Eric Salo <salo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
index b5ad7d3..083ac38 100644 (file)
--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -19,8 +19,8 @@ void sock_diag_unregister(const struct sock_diag_handler *h);
 void sock_diag_register_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh));
 void sock_diag_unregister_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh));
 
-int sock_diag_check_cookie(void *sk, const __u32 *cookie);
-void sock_diag_save_cookie(void *sk, __u32 *cookie);
+int sock_diag_check_cookie(struct sock *sk, const __u32 *cookie);
+void sock_diag_save_cookie(struct sock *sk, __u32 *cookie);
 
 int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);
 int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk,

diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index eb16c7b..e565afd 100644 (file)
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -77,6 +77,8 @@ struct inet_request_sock {
 #define ir_v6_rmt_addr         req.__req_common.skc_v6_daddr
 #define ir_v6_loc_addr         req.__req_common.skc_v6_rcv_saddr
 #define ir_iif                 req.__req_common.skc_bound_dev_if
+#define ir_cookie              req.__req_common.skc_cookie
+#define ireq_net               req.__req_common.skc_net
 
        kmemcheck_bitfield_begin(flags);
        u16                     snd_wscale : 4,

diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 6c56603..b7ce100 100644 (file)
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -122,6 +122,7 @@ struct inet_timewait_sock {
 #define tw_v6_rcv_saddr        __tw_common.skc_v6_rcv_saddr
 #define tw_dport               __tw_common.skc_dport
 #define tw_num                 __tw_common.skc_num
+#define tw_cookie              __tw_common.skc_cookie
 
        int                     tw_timeout;
        volatile unsigned char  tw_substate;

diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 2cb9acb..e086f40 100644 (file)
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -56,6 +56,8 @@ struct net {
 #endif
        spinlock_t              rules_mod_lock;
 
+       atomic64_t              cookie_gen;
+
        struct list_head        list;           /* list of network namespaces */
        struct list_head        cleanup_list;   /* namespaces on death row */
        struct list_head        exit_list;      /* Use only net_mutex */

diff --cc include/net/sock.h
Simple merge

diff --cc net/core/sock.c
Simple merge

diff --cc net/core/sock_diag.c
Simple merge

diff --cc net/dccp/ipv4.c
Simple merge

diff --cc net/ipv4/inet_connection_sock.c
Simple merge

diff --cc net/ipv4/inet_diag.c
Simple merge

diff --cc net/ipv4/inet_timewait_sock.c
Simple merge

diff --cc net/ipv4/syncookies.c
Simple merge

diff --cc net/ipv4/tcp_input.c
Simple merge