Re: [PATCH net v2] tcp: fix authentication bypass via unsupported TCP auth options

[Kuniyuki Iwashima <kuniyu@google.com>]

On Sat, 07 Nov 2026 22:47:33 +0000, Jérémy Jean wrote:
> tcp_inbound_hash() parses both TCP-MD5 and TCP-AO options when at
> least one of the two features is enabled. With TCP_MD5SIG=y and
> TCP_AO=n, a packet carrying an AO option reaches the disabled
> tcp_inbound_ao_hash() stub. That stub returns success, so sockets
> configured to require MD5 authentication end up accepting
> unauthenticated data. A forged AO option skips the unsigned fast
> path, which is the only place where tcp_inbound_hash() can return
> SKB_DROP_REASON_TCP_MD5NOTFOUND.
> 
> The inverse configuration with TCP_MD5SIG=n and TCP_AO=y has the same
> problem for an MD5 option on AO sockets.
> 
> Note that TCP-AO depends on 64BIT: therefore, every 32-bit kernel with
> TCP_MD5SIG=y is in the vulnerable configuration.
> 
> Make the disabled stubs reject options for the unsupported
> authentication scheme. This matches the real helpers' behavior for
> sockets without keys. It also means that kernels with TCP_MD5SIG=n and
> TCP_AO=y now drop segments carrying an MD5 option on unkeyed sockets,
> as kernels configured with TCP_MD5SIG=y already do.
> 
> Fixes: 0a3a809089eb ("net/tcp: Verify inbound TCP-AO signed segments")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>