From: Simon Horman <horms@kernel.org>
To: Dmitry Safonov <dima@arista.com>
Cc: Eric Dumazet <edumazet@google.com>,
"David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
David Ahern <dsahern@kernel.org>, Shuah Khan <shuah@kernel.org>,
Steven Rostedt <rostedt@goodmis.org>,
Masami Hiramatsu <mhiramat@kernel.org>,
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest@vger.kernel.org,
linux-trace-kernel@vger.kernel.org,
Dmitry Safonov <0x7f454c46@gmail.com>
Subject: Re: [PATCH net-next 03/10] net/tcp: Move tcp_inbound_hash() from headers
Date: Mon, 26 Feb 2024 20:41:42 +0000 [thread overview]
Message-ID: <20240226204142.GJ13129@kernel.org> (raw)
In-Reply-To: <20240224-tcp-ao-tracepoints-v1-3-15f31b7f30a7@arista.com>
On Sat, Feb 24, 2024 at 09:04:11AM +0000, Dmitry Safonov wrote:
> Two reasons:
> 1. It's grown up enough
> 2. In order to not do header spaghetti by including
> <trace/events/tcp.h>, which is necessary for TCP tracepoints.
>
> Signed-off-by: Dmitry Safonov <dima@arista.com>
...
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index c82dc42f57c6..5fd61ae6bcc9 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -4485,6 +4485,78 @@ EXPORT_SYMBOL(tcp_inbound_md5_hash);
>
> #endif
>
> +/* Called with rcu_read_lock() */
> +enum skb_drop_reason
> +tcp_inbound_hash(struct sock *sk, const struct request_sock *req,
> + const struct sk_buff *skb,
> + const void *saddr, const void *daddr,
> + int family, int dif, int sdif)
> +{
> + const struct tcphdr *th = tcp_hdr(skb);
> + const struct tcp_ao_hdr *aoh;
> + const __u8 *md5_location;
> + int l3index;
> +
> + /* Invalid option or two times meet any of auth options */
> + if (tcp_parse_auth_options(th, &md5_location, &aoh)) {
> + tcp_hash_fail("TCP segment has incorrect auth options set",
> + family, skb, "");
> + return SKB_DROP_REASON_TCP_AUTH_HDR;
> + }
> +
> + if (req) {
> + if (tcp_rsk_used_ao(req) != !!aoh) {
> + u8 keyid, rnext, maclen;
> +
> + if (aoh) {
> + keyid = aoh->keyid;
> + rnext = aoh->rnext_keyid;
> + maclen = tcp_ao_hdr_maclen(aoh);
> + } else {
> + keyid = rnext = maclen = 0;
> + }
Hi Dmitry,
it looks like keyid is set but otherwise unused.
Flagged by W=1 builds with gcc-13 and clang-17.
> +
> + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOBAD);
> + tcp_hash_fail("TCP connection can't start/end using TCP-AO",
> + family, skb, "%s",
> + !aoh ? "missing AO" : "AO signed");
> + return SKB_DROP_REASON_TCP_AOFAILURE;
> + }
> + }
> +
> + /* sdif set, means packet ingressed via a device
> + * in an L3 domain and dif is set to the l3mdev
> + */
> + l3index = sdif ? dif : 0;
> +
> + /* Fast path: unsigned segments */
> + if (likely(!md5_location && !aoh)) {
> + /* Drop if there's TCP-MD5 or TCP-AO key with any rcvid/sndid
> + * for the remote peer. On TCP-AO established connection
> + * the last key is impossible to remove, so there's
> + * always at least one current_key.
> + */
> + if (tcp_ao_required(sk, saddr, family, l3index, true)) {
> + tcp_hash_fail("AO hash is required, but not found",
> + family, skb, "L3 index %d", l3index);
> + return SKB_DROP_REASON_TCP_AONOTFOUND;
> + }
> + if (unlikely(tcp_md5_do_lookup(sk, l3index, saddr, family))) {
> + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
> + tcp_hash_fail("MD5 Hash not found",
> + family, skb, "L3 index %d", l3index);
> + return SKB_DROP_REASON_TCP_MD5NOTFOUND;
> + }
> + return SKB_NOT_DROPPED_YET;
> + }
> +
> + if (aoh)
> + return tcp_inbound_ao_hash(sk, skb, family, req, l3index, aoh);
> +
> + return tcp_inbound_md5_hash(sk, skb, saddr, daddr, family,
> + l3index, md5_location);
> +}
> +
> void tcp_done(struct sock *sk)
> {
> struct request_sock *req;
>
> --
> 2.43.0
>
>
next prev parent reply other threads:[~2024-02-26 20:43 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-24 9:04 [PATCH net-next 00/10] net/tcp: TCP-AO and TCP-MD5 tracepoints Dmitry Safonov
2024-02-24 9:04 ` [PATCH net-next 01/10] net/tcp: Use static_branch_tcp_{md5,ao} to drop ifdefs Dmitry Safonov
2024-02-24 9:04 ` [PATCH net-next 02/10] net/tcp: Add a helper tcp_ao_hdr_maclen() Dmitry Safonov
2024-02-24 9:04 ` [PATCH net-next 03/10] net/tcp: Move tcp_inbound_hash() from headers Dmitry Safonov
2024-02-24 9:30 ` Eric Dumazet
2024-02-24 9:40 ` Dmitry Safonov
2024-02-26 20:41 ` Simon Horman [this message]
2024-02-26 23:51 ` Dmitry Safonov
2024-02-24 9:04 ` [PATCH net-next 04/10] net/tcp: Add tcp-md5 and tcp-ao tracepoints Dmitry Safonov
2024-02-24 9:04 ` [PATCH net-next 05/10] net/tcp: Remove tcp_hash_fail() Dmitry Safonov
2024-02-24 9:04 ` [PATCH net-next 06/10] selftests/net: Clean-up double assignment Dmitry Safonov
2024-02-24 9:04 ` [PATCH net-next 07/10] selftests/net: Provide test_snprintf() helper Dmitry Safonov
2024-02-24 9:04 ` [PATCH net-next 08/10] selftests/net: Be consistnat in kconfig checks Dmitry Safonov
2024-02-24 9:04 ` [PATCH net-next 09/10] selftests/net: Don't forget to close nsfd after switch_save_ns() Dmitry Safonov
2024-02-24 9:04 ` [PATCH net-next 10/10] selftest/net: Add trace events matching to tcp_ao Dmitry Safonov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240226204142.GJ13129@kernel.org \
--to=horms@kernel.org \
--cc=0x7f454c46@gmail.com \
--cc=davem@davemloft.net \
--cc=dima@arista.com \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=mhiramat@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=rostedt@goodmis.org \
--cc=shuah@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).