[PATCH net v2 0/3] amt: fix relay tunnel keying and unauthenticated-Request DoS

[Omar Ramadan <omar@blockcast.net>]

This series fixes related problems in the AMT relay in
drivers/net/amt.c. The relay creates and mutates per-tunnel state in
response to AMT Request messages whose source is never validated, so a
spoofed-source flood exhausts the tunnel table and reflects Membership
Queries at arbitrary addresses. The same code keys tunnels on the source
address alone, so two gateways behind one NAT collide.

Reported privately to security@kernel.org first. The security team
determined there is no memory-safety exposure and no embargo is needed,
and asked that the fix be posted here in the open with Taehee Yoo in Cc.

Patches 1 and 3 carry Fixes: cbc21dc1cfe9. Patch 3 is the core fix: the
relay now answers a Request statelessly (it computes the response MAC
and emits the Query without allocating a tunnel) and only commits tunnel
state once the gateway echoes the nonce+MAC in an Update. A spoofed
source cannot complete that exchange, so it allocates nothing.

Testing: booted net at commit 6d25ffca055a ("cipso: adjust cached
option offsets when removing CIPSO") plus this series (arm64, QEMU via
virtme-ng) with CONFIG_KASAN=y, CONFIG_PROVE_LOCKING=y,
CONFIG_PROVE_RCU=y and CONFIG_DEBUG_LIST=y on top of
tools/testing/selftests/net/config. amt.sh passes all six tests,
including both forwarding-torture cases, with no KASAN, lockdep or RCU
reports, and debug_locks stays 1. Every case completes a real gateway
handshake, so this exercises the stateless Request path and the MAC
check on Update. drivers/net/amt.c and include/net/amt.h are unchanged
between that commit and the base-commit below.

A companion change bounds the number of verified tunnels admitted per
source address. It adds a new netlink attribute and so targets net-next
as a separate posting, not part of this series. One note on its default:
a per-source cap closes the non-spoofing exhaustion path (one host, many
real handshakes) that this series does not, but a low fixed default is
wrong behind carrier-grade NAT, where many independent subscribers share
one public address and would be refused past the cap. The net-next
posting sets the default accordingly and documents the CGNAT case; this
series does not depend on that cap and closes the spoofing primitive on
its own.

Changes in v2:
- Drop v1 patch 2/4 ("amt: send the relay General Query directly
  instead of via dev_queue_xmit"). The same fix is already in net as
  commit afae89de73dd ("amt: send the relay's General Query directly
  from the receive path"). v1 was generated against v7.1 and did not
  apply to net.
- Rebase onto net. In patch 1, the port check uses the header fields
  that amt_update_handler() now snapshots before the pull. In patch 3,
  the Query senders keep that commit's tx_dropped accounting and take
  the destination by value.
- Redo the testing on net. The forwarding-torture subtests now run to
  completion.
v1: https://lore.kernel.org/netdev/20261008003606.3666617-1-omar@blockcast.net/

Omar Ramadan (3):
  amt: key relay tunnel state on the (address, port) endpoint, not the
    address
  amt: make pre-query report drops visible
  amt: do not create tunnel state for unauthenticated Requests

 drivers/net/amt.c | 266 +++++++++++++++++++++++++++++++---------------
 include/net/amt.h |  11 +-
 2 files changed, 185 insertions(+), 92 deletions(-)


base-commit: 37f12441f557468a56c1e27790413aa78c82afa2
-- 
2.47.3