Re: [PATCH v6 21/26] selftests: net/fcnal: Initial tcp_authopt support

From: Leonard Crestez <cdleonard@gmail.com>
To: Eric Dumazet <edumazet@google.com>, David Ahern <dsahern@kernel.org>
Cc: Philip Paeps <philip@trouble.is>,
	Dmitry Safonov <0x7f454c46@gmail.com>,
	Shuah Khan <shuah@kernel.org>,
	"David S. Miller" <davem@davemloft.net>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	Kuniyuki Iwashima <kuniyu@amazon.co.jp>,
	Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
	Jakub Kicinski <kuba@kernel.org>,
	Yuchung Cheng <ycheng@google.com>,
	Francesco Ruggeri <fruggeri@arista.com>,
	Mat Martineau <mathew.j.martineau@linux.intel.com>,
	Christoph Paasch <cpaasch@apple.com>,
	Ivan Delalande <colona@arista.com>,
	Caowangbao <caowangbao@huawei.com>,
	Priyaranjan Jha <priyarjha@google.com>,
	netdev <netdev@vger.kernel.org>,
	"open list:HARDWARE RANDOM NUMBER GENERATOR CORE" 
	<linux-crypto@vger.kernel.org>,
	"open list:KERNEL SELFTEST FRAMEWORK" 
	<linux-kselftest@vger.kernel.org>,
	LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v6 21/26] selftests: net/fcnal: Initial tcp_authopt support
Date: Wed, 27 Jul 2022 11:29:50 +0300	[thread overview]
Message-ID: <dd2ca85e-ab29-2973-f129-9afafb405851@gmail.com> (raw)
In-Reply-To: <CANn89i+=LVDFx_zjDy6uK+QorR+fosdkb8jqNMO6syqOsS7ZqQ@mail.gmail.com>

On 7/26/22 10:27, Eric Dumazet wrote:
> On Tue, Jul 26, 2022 at 9:06 AM Eric Dumazet <edumazet@google.com> wrote:
>>
>> On Tue, Jul 26, 2022 at 8:16 AM Leonard Crestez <cdleonard@gmail.com> wrote:
>>>
>>> Tests are mostly copied from tcp_md5 with minor changes.
>>>
>>> It covers VRF support but only based on binding multiple servers: not
>>> multiple keys bound to different interfaces.
>>>
>>> Also add a specific -t tcp_authopt to run only these tests specifically.
>>>
>>
>> Thanks for the test.
>>
>> Could you amend the existing TCP MD5 test to make sure dual sockets
>> mode is working ?
>>
>> Apparently, if we have a dual stack listener socket (AF_INET6),
>> correct incoming IPV4 SYNs are dropped.

>>   If this is the case, fixing MD5 should happen first ;

I remember looking into this and my conclusion was that ipv4-mapped-ipv6 
is not worth supporting for AO, at least not in the initial version.

Instead I just wrote a test to check that ipv4-mapped-ipv6 fails for AO:
https://github.com/cdleonard/tcp-authopt-test/blob/main/tcp_authopt_test/test_verify_capture.py#L191

On a closer look it does appear that support existed for 
ipv4-mapped-ipv6 in TCP-MD5 but my test didn't actually exercise it 
correctly so the test had to be fixed.

Do you think it makes sense to add support for ipv4-mapped-ipv6 for AO? 
It's not particularly difficult to test, it was skipped due to a lack of 
application use case and to keep the initial series smaller.

Adding support for this later as a separate commit should be fine. Since 
ivp4-mapped-ipv6 addresses shouldn't appear on the wire giving them 
special treatment "later" should raise no compatibility concerns.

>> I think that we are very late in the cycle (linux-5.19 should be
>> released in 5 days), and your patch set should not be merged so late.

This was posted in order to get code reviews, I'm not actually expecting 
inclusion.

--
Regards,
Leonard