linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Eric Dumazet <edumazet@google.com>
To: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
	"David S. Miller" <davem@davemloft.net>,
	linux-kernel <linux-kernel@vger.kernel.org>,
	netdev <netdev@vger.kernel.org>,
	Yuchung Cheng <ycheng@google.com>,
	Jonathan Rajotte-Julien <joraj@efficios.com>
Subject: Re: [regression] TCP_MD5SIG on established sockets
Date: Tue, 30 Jun 2020 13:39:27 -0700	[thread overview]
Message-ID: <CANn89iJ+rkMrLrHrKXO-57frXNb32epB93LYLRuHX00uWc-0Uw@mail.gmail.com> (raw)
In-Reply-To: <312079189.17903.1593549293094.JavaMail.zimbra@efficios.com>

On Tue, Jun 30, 2020 at 1:34 PM Mathieu Desnoyers
<mathieu.desnoyers@efficios.com> wrote:
>
> ----- On Jun 30, 2020, at 3:52 PM, Linus Torvalds torvalds@linux-foundation.org wrote:
>
> > On Tue, Jun 30, 2020 at 12:43 PM Linus Torvalds
> > <torvalds@linux-foundation.org> wrote:
> >>
> [...]
> > So I think it's still wrong (clearly others do change passwords
> > outside of listening state), but considering that it apparently took
> > people two years to notice, at least some of the onus on figuring out
> > a better morel is on people who didn't even bother to test things in a
> > timely manner.
>
> I'm fully willing to work with Eric on finding a way forward with a
> fix which addresses the original issue Eric's patch was trying to
> fix while preserving ABI compatibility.
>
> The main thing we need to agree on at this stage is what is our goal. We
> can either choose to restore the original ABI behavior entirely, or only
> focus on what appears to be the most important use-cases.
>
> AFAIU, restoring full ABI compatibility would require to re-enable all
> the following scenarios:
>
> A) Transition of live socket from no key -> MD5 key.
> B) Transition of live socket from MD5 key -> no key.
> C) Transition of live socket from MD5 key to a different MD5 key.
>
> Scenario (C) appears to be the most important use-case, and probably the
> easiest to restore to its original behavior.
>
> AFAIU restoring scenarios A and B would require us to validate how
> much header space is needed by each SACK, TS and MD5 option enabled
> on the socket, and reject enabling any option that adds header space
> requirement exceeding the available space.
>
> I welcome advice on what should be the end goal here.
>

The (C) & (B) case are certainly doable.

A) case is more complex, I have no idea of breakages of various TCP
stacks if a flow got SACK
at some point (in 3WHS) but suddenly becomes Reno.

  reply	other threads:[~2020-06-30 20:39 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-13 19:38 [regression] TC_MD5SIG on established sockets Mathieu Desnoyers
2020-05-13 19:49 ` Eric Dumazet
2020-05-13 19:56   ` Eric Dumazet
2020-06-29 19:43     ` [regression] TCP_MD5SIG " Mathieu Desnoyers
2020-06-29 20:47       ` Eric Dumazet
2020-06-30 19:43         ` Linus Torvalds
2020-06-30 19:52           ` Linus Torvalds
2020-06-30 20:34             ` Mathieu Desnoyers
2020-06-30 20:39               ` Eric Dumazet [this message]
2020-06-30 20:44                 ` David Miller
2020-06-30 20:56                   ` Eric Dumazet
2020-06-30 21:17                     ` Mathieu Desnoyers
2020-06-30 21:23                       ` Eric Dumazet
2020-06-30 21:54                         ` Eric Dumazet
2020-06-30 22:07                           ` Eric Dumazet
2020-06-30 22:38                             ` Eric Dumazet
2020-06-30 23:44                               ` Mathieu Desnoyers
2020-07-01  0:01                                 ` Eric Dumazet
2020-07-01  2:02                               ` Herbert Xu
2020-07-01  2:17                                 ` Eric Dumazet
2020-07-01  2:22                                   ` Herbert Xu
2020-07-01  2:30                                     ` Eric Dumazet
2020-07-01  2:39                                       ` Joe Perches
2020-07-01  2:58                                       ` Herbert Xu
2020-07-01  3:36                                         ` Eric Dumazet
2020-07-01  3:50                                           ` Herbert Xu
2020-07-01 12:19                                           ` Mathieu Desnoyers
2020-07-01 15:15                                             ` Eric Dumazet
2020-07-01 17:24                             ` Eric Dumazet
2020-06-30 20:21           ` David Miller
2020-06-30 20:30             ` Eric Dumazet
2020-06-30 20:39               ` Mathieu Desnoyers

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CANn89iJ+rkMrLrHrKXO-57frXNb32epB93LYLRuHX00uWc-0Uw@mail.gmail.com \
    --to=edumazet@google.com \
    --cc=davem@davemloft.net \
    --cc=joraj@efficios.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mathieu.desnoyers@efficios.com \
    --cc=netdev@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    --cc=ycheng@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).