Re: [PATCH net-next 03/10] net/tcp: Move tcp_inbound_hash() from headers

On Sat, Feb 24, 2024 at 09:04:11AM +0000, Dmitry Safonov wrote:

Two reasons:

1. It's grown up enough
2. In order to not do header spaghetti by including <trace/events/tcp.h>, which is necessary for TCP tracepoints.

Signed-off-by: Dmitry Safonov dima@arista.com

...

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index c82dc42f57c6..5fd61ae6bcc9 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -4485,6 +4485,78 @@ EXPORT_SYMBOL(tcp_inbound_md5_hash); #endif +/* Called with rcu_read_lock() */ +enum skb_drop_reason +tcp_inbound_hash(struct sock *sk, const struct request_sock *req,

•  const struct sk_buff *skb,
  

•  const void *saddr, const void *daddr,
  

•  int family, int dif, int sdif)
  

+{

• const struct tcphdr *th = tcp_hdr(skb);
• const struct tcp_ao_hdr *aoh;
• const __u8 *md5_location;
• int l3index;
• /* Invalid option or two times meet any of auth options */
• if (tcp_parse_auth_options(th, &md5_location, &aoh)) {

• tcp_hash_fail("TCP segment has incorrect auth options set",
  

• 	      family, skb, "");
  

• return SKB_DROP_REASON_TCP_AUTH_HDR;
  

• }
• if (req) {

• if (tcp_rsk_used_ao(req) != !!aoh) {
  

• 	u8 keyid, rnext, maclen;
  

• 	if (aoh) {
  

• 		keyid = aoh->keyid;
  

• 		rnext = aoh->rnext_keyid;
  

• 		maclen = tcp_ao_hdr_maclen(aoh);
  

• 	} else {
  

• 		keyid = rnext = maclen = 0;
  

• 	}
  

Hi Dmitry,

it looks like keyid is set but otherwise unused.

Flagged by W=1 builds with gcc-13 and clang-17.

• 	NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOBAD);
  

• 	tcp_hash_fail("TCP connection can't start/end using TCP-AO",
  

• 		      family, skb, "%s",
  

• 		      !aoh ? "missing AO" : "AO signed");
  

• 	return SKB_DROP_REASON_TCP_AOFAILURE;
  

• }
  

• }
• /* sdif set, means packet ingressed via a device

• * in an L3 domain and dif is set to the l3mdev
  

• */
  

• l3index = sdif ? dif : 0;
• /* Fast path: unsigned segments */
• if (likely(!md5_location && !aoh)) {

• /* Drop if there's TCP-MD5 or TCP-AO key with any rcvid/sndid
  

•  * for the remote peer. On TCP-AO established connection
  

•  * the last key is impossible to remove, so there's
  

•  * always at least one current_key.
  

•  */
  

• if (tcp_ao_required(sk, saddr, family, l3index, true)) {
  

• 	tcp_hash_fail("AO hash is required, but not found",
  

• 			family, skb, "L3 index %d", l3index);
  

• 	return SKB_DROP_REASON_TCP_AONOTFOUND;
  

• }
  

• if (unlikely(tcp_md5_do_lookup(sk, l3index, saddr, family))) {
  

• 	NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
  

• 	tcp_hash_fail("MD5 Hash not found",
  

• 		      family, skb, "L3 index %d", l3index);
  

• 	return SKB_DROP_REASON_TCP_MD5NOTFOUND;
  

• }
  

• return SKB_NOT_DROPPED_YET;
  

• }
• if (aoh)

• return tcp_inbound_ao_hash(sk, skb, family, req, l3index, aoh);
  

• return tcp_inbound_md5_hash(sk, skb, saddr, daddr, family,

• 		    l3index, md5_location);
  

+}

void tcp_done(struct sock *sk) { struct request_sock *req;

-- 2.43.0