From nobody Thu Sep 26 06:12:11 2024
X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XDjtM3pNxz5YH75;
Thu, 26 Sep 2024 06:12:11 +0000 (UTC)
(envelope-from git@FreeBSD.org)
Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
client-signature RSA-PSS (4096 bits) client-digest SHA256)
(Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK))
by mx1.freebsd.org (Postfix) with ESMTPS id 4XDjtM1d2qz4msL;
Thu, 26 Sep 2024 06:12:11 +0000 (UTC)
(envelope-from git@FreeBSD.org)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim;
t=1727331131;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding;
bh=RzII8kzZfDPg1JdfbfPMZgFoke1pB5zPtOf4Ffww+fg=;
b=fYkzoTnz5X6UCXh8pw+aHdyfzcaJHH+D+KJbQq9BwVyofOHxLbHtMTSnKOUPKBA9nCKS/L
QwEmGU+W3SdnlFHJRmNrhwDhpaZ+jOHPeeI/tFTvJWhME3DTOdWEZgVCLaGmO1IiSLuwol
hUyJOsYFsUC9okfYW+NWl23FEQV9Gj91AvjBnYkQsX6kSgTkzHDHZ7hsIAxfQgd5fCTUPR
cvo3ESXrzvc/oQgqZqFlwuG/MGE0CkLFX2W1RJMUscu2o7lwSxtvIGaNCHg1oMk8bQsLLd
QxjUYIPoIysKx+CAUxhiMO2GS7vPjze9mK+UCBjoSukCd27PUF/Um5ydkTrGDg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org;
s=dkim; t=1727331131;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding;
bh=RzII8kzZfDPg1JdfbfPMZgFoke1pB5zPtOf4Ffww+fg=;
b=qU3M7XxBiiNsyqpzRLH0EAkkN453e9fJ48YlYSOy+4791qVRcVhKobJncHQvXnN0hTVSaO
xWgtGtTYYUT491kbpO0YZ108TudCsfuNuIXl1o3NubwH6O/jd6xM2lOG6fWCh9USKSwMK2
2zG8T945BHArBdLuWAE+sodvc4mrcI7wXUB8Z387Yi3WyDWUXoDRESty16d/Kaui9Q87ol
rhtKEiTZa5v6BuM5zDqH0fDtLm9ew+TElfIGaZjeZtxqVJHWPHFbaNXqmaXDoYhYnESDB8
0vKRqeEUWn4cOuddBlBtRXEcdr/plHouLyQaJePn9QqpzHKdyify4uQk/yRTlw==
ARC-Authentication-Results: i=1;
mx1.freebsd.org;
none
ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1727331131; a=rsa-sha256; cv=none;
b=dJIUzJUkuEY+/Oo7nKL7T4XOyxnzPK9lWz5EXgmRJBfYujA/XTDL+kjgRuEO2AL9i/bm3w
xZ1SEpVD6NxaYkUXeJdS55YPKmYu2GD2t30PL+wfjsTXYV5T+t5yK+hN6N2yZPAukabhBL
wh+etTCrtfhrqRlJBT1bPZfPmqArATkheVRKybkrbZhcKib/bm5vAfpDLmYI7dZex19/X7
O9yETb6YnY+11q3kFqB5OxF9TvbcyZVty1N3VqDj04z3/InFGeSa+mCxsmylt8DMbaq/Xk
9FT+F/K/OOmrkOSgAWamQPzsK/oGoaZhsP/3w8ghbY7hemuIakW3cQwzVQ/pYw==
Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
(Client did not present a certificate)
by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XDjtM1DnyzllG;
Thu, 26 Sep 2024 06:12:11 +0000 (UTC)
(envelope-from git@FreeBSD.org)
Received: from gitrepo.freebsd.org ([127.0.1.44])
by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 48Q6CBfR066549;
Thu, 26 Sep 2024 06:12:11 GMT
(envelope-from git@gitrepo.freebsd.org)
Received: (from git@localhost)
by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 48Q6CB3V066546;
Thu, 26 Sep 2024 06:12:11 GMT
(envelope-from git)
Date: Thu, 26 Sep 2024 06:12:11 GMT
Message-Id: <202409260612.48Q6CB3V066546@gitrepo.freebsd.org>
To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org,
dev-commits-src-main@FreeBSD.org
From: Michael Tuexen <tuexen@FreeBSD.org>
Subject: git: 78e1b031d2e8 - main - tcp: improve MAC error handling
for SYN segments
List-Id: Commit messages for the main branch of the src repository <dev-commits-src-main.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main
List-Help: <mailto:dev-commits-src-main+help@freebsd.org>
List-Post: <mailto:dev-commits-src-main@freebsd.org>
List-Subscribe: <mailto:dev-commits-src-main+subscribe@freebsd.org>
List-Unsubscribe: <mailto:dev-commits-src-main+unsubscribe@freebsd.org>
X-BeenThere: dev-commits-src-main@freebsd.org
Sender: owner-dev-commits-src-main@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Git-Committer: tuexen
X-Git-Repository: src
X-Git-Refname: refs/heads/main
X-Git-Reftype: branch
X-Git-Commit: 78e1b031d2e8ef0e1cbc8874891f5476dc7868bc
Auto-Submitted: auto-generated
The branch main has been updated by tuexen:
URL: https://cgit.FreeBSD.org/src/commit/?id=78e1b031d2e8ef0e1cbc8874891f5476dc7868bc
commit 78e1b031d2e8ef0e1cbc8874891f5476dc7868bc
Author: Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2024-09-26 06:10:01 +0000
Commit: Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2024-09-26 06:10:01 +0000
tcp: improve MAC error handling for SYN segments
Don't leak a maclabel when SYN segments are processed which results
in an error due to MD5 signature handling.
Tweak the #idef MAC to allow additional upcoming changes.
Reviewed by: markj
MFC after: 1 week
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D46766
---
sys/netinet/tcp_syncache.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c
index 80bf12474c1c..ed131421207d 100644
--- a/sys/netinet/tcp_syncache.c
+++ b/sys/netinet/tcp_syncache.c
@@ -1372,7 +1372,7 @@ syncache_add(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
int autoflowlabel = 0;
#endif
#ifdef MAC
- struct label *maclabel;
+ struct label *maclabel = NULL;
#endif
struct syncache scs;
struct ucred *cred;
@@ -1763,10 +1763,11 @@ donenoprobe:
tfo_expanded:
if (cred != NULL)
crfree(cred);
+ if (sc == NULL || sc == &scs) {
#ifdef MAC
- if (sc == &scs)
mac_syncache_destroy(&maclabel);
#endif
+ }
return (rv);
}