Messages in this thread | | | From | Dmitry Safonov <> | Subject | [PATCH v4 0/7] TCP-AO fixes | Date | Wed, 29 Nov 2023 16:57:14 +0000 |
| |
Hi,
Changes from v3: - Don't restrict adding any keys on TCP-AO connection in VRF, but only the ones that don't match l3index (David)
Changes from v2: - rwlocks are problematic in net code (Paolo) Changed the SNE code to avoid spin/rw locks on RX/TX fastpath by double-accounting SEQ numbers for TCP-AO enabled connections.
Changes from v1: - Use tcp_can_repair_sock() helper to limit TCP_AO_REPAIR (Eric) - Instead of hook to listen() syscall, allow removing current/rnext keys on TCP_LISTEN (addressing Eric's objection) - Add sne_lock to protect snd_sne/rcv_sne - Don't move used_tcp_ao in struct tcp_request_sock (Eric)
I've been working on TCP-AO key-rotation selftests and as a result exercised some corner-cases that are not usually met in production.
Here are a bunch of semi-related fixes: - Documentation typo (reported by Markus Elfring) - Proper alignment for TCP-AO option in TCP header that has MAC length of non 4 bytes (now a selftest with randomized maclen/algorithm/etc passes) - 3 uAPI restricting patches that disallow more things to userspace in order to prevent it shooting itself in any parts of the body - SNEs READ_ONCE()/WRITE_ONCE() that went missing by my human factor - Avoid storing MAC length from SYN header as SYN-ACK will use rnext_key.maclen (drops an extra check that fails on new selftests)
Please, consider applying/pulling.
The following changes since commit 3b47bc037bd44f142ac09848e8d3ecccc726be99:
Merge tag 'pinctrl-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl (2023-11-29 06:45:22 -0800)
are available in the Git repository at:
git@github.com:0x7f454c46/linux.git tcp-ao-post-merge-v4
for you to fetch changes up to adb1a6e8d2034c1e17b6a84a512c71aa4c41c1d2:
net/tcp: Don't store TCP-AO maclen on reqsk (2023-11-29 16:14:14 +0000)
----------------------------------------------------------------
Thanks, Dmitry
Cc: David Ahern <dsahern@kernel.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Eric Dumazet <edumazet@google.com> Cc: Francesco Ruggeri <fruggeri05@gmail.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Salam Noureddine <noureddine@arista.com> Cc: Simon Horman <horms@kernel.org> Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org
Dmitry Safonov (7): Documentation/tcp: Fix an obvious typo net/tcp: Consistently align TCP-AO option in the header net/tcp: Limit TCP_AO_REPAIR to non-listen sockets net/tcp: Allow removing current/rnext TCP-AO keys on TCP_LISTEN sockets net/tcp: Don't add key with non-matching VRF on connected sockets net/tcp: Store SNEs + SEQs on ao_info net/tcp: Don't store TCP-AO maclen on reqsk
Documentation/networking/tcp_ao.rst | 2 +- include/linux/tcp.h | 8 +-- include/net/tcp_ao.h | 31 +++++++++-- net/ipv4/tcp.c | 13 ++++- net/ipv4/tcp_ao.c | 80 ++++++++++++++++++----------- net/ipv4/tcp_fastopen.c | 2 + net/ipv4/tcp_input.c | 26 ++++++---- net/ipv4/tcp_ipv4.c | 4 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 16 +++--- net/ipv6/tcp_ipv6.c | 2 +- 11 files changed, 122 insertions(+), 64 deletions(-)
base-commit: 3b47bc037bd44f142ac09848e8d3ecccc726be99 -- 2.43.0
| |