Messages in this thread | | | From | Eric Dumazet <> | Date | Tue, 30 Jun 2020 13:39:27 -0700 | Subject | Re: [regression] TCP_MD5SIG on established sockets |
| |
On Tue, Jun 30, 2020 at 1:34 PM Mathieu Desnoyers <mathieu.desnoyers@efficios.com> wrote: > > ----- On Jun 30, 2020, at 3:52 PM, Linus Torvalds torvalds@linux-foundation.org wrote: > > > On Tue, Jun 30, 2020 at 12:43 PM Linus Torvalds > > <torvalds@linux-foundation.org> wrote: > >> > [...] > > So I think it's still wrong (clearly others do change passwords > > outside of listening state), but considering that it apparently took > > people two years to notice, at least some of the onus on figuring out > > a better morel is on people who didn't even bother to test things in a > > timely manner. > > I'm fully willing to work with Eric on finding a way forward with a > fix which addresses the original issue Eric's patch was trying to > fix while preserving ABI compatibility. > > The main thing we need to agree on at this stage is what is our goal. We > can either choose to restore the original ABI behavior entirely, or only > focus on what appears to be the most important use-cases. > > AFAIU, restoring full ABI compatibility would require to re-enable all > the following scenarios: > > A) Transition of live socket from no key -> MD5 key. > B) Transition of live socket from MD5 key -> no key. > C) Transition of live socket from MD5 key to a different MD5 key. > > Scenario (C) appears to be the most important use-case, and probably the > easiest to restore to its original behavior. > > AFAIU restoring scenarios A and B would require us to validate how > much header space is needed by each SACK, TS and MD5 option enabled > on the socket, and reject enabling any option that adds header space > requirement exceeding the available space. > > I welcome advice on what should be the end goal here. >
The (C) & (B) case are certainly doable.
A) case is more complex, I have no idea of breakages of various TCP stacks if a flow got SACK at some point (in 3WHS) but suddenly becomes Reno.
| |