Hi,
I've been working on TCP-AO key-rotation selftests and as a result
exercised some corner-cases that are not usually met in production.
Here are a bunch of semi-related fixes:
- Documentation typo (reported by Markus Elfring)
- Proper alignment for TCP-AO option in TCP header that has MAC length
of non 4 bytes (now a selftest with randomized maclen/algorithm/etc
passes)
- 3 uAPI restricting patches that disallow more things to userspace in
order to prevent it shooting itself in any parts of the body
- SNEs READ_ONCE()/WRITE_ONCE() that went missing by my human factor
- Avoid storing MAC length from SYN header as SYN-ACK will use
rnext_key.maclen (drops an extra check that fails on new selftests)
Please, consider applying/pulling.
The following changes since commit 98b1cc82c4affc16f5598d4fa14b1858671b2263:
Linux 6.7-rc2 (2023-11-19 15:02:14 -0800)
are available in the Git repository at:
git@xxxxxxxxxx:0x7f454c46/linux.git tcp-ao-post-merge
for you to fetch changes up to 4555b5b8d11f4d19ef32a761e2d87dd378e9a435:
net/tcp: Don't store TCP-AO maclen on reqsk (2023-11-21 01:48:23 +0000)
----------------------------------------------------------------
Dmitry Safonov (7):
Documentation/tcp: Fix an obvious typo
net/tcp: Consistently align TCP-AO option in the header
net/tcp: Limit TCP_AO_REPAIR to non-listen sockets
net/tcp: Reset TCP-AO cached keys on listen() syscall
net/tcp: Don't add key with non-matching VRF on connected sockets
net/tcp: ACCESS_ONCE() on snd/rcv SNEs
net/tcp: Don't store TCP-AO maclen on reqsk
Thanks,
Dmitry
Cc: David Ahern <dsahern@xxxxxxxxxx>
Cc: "David S. Miller" <davem@xxxxxxxxxxxxx>
Cc: Dmitry Safonov <0x7f454c46@xxxxxxxxx>
Cc: Eric Dumazet <edumazet@xxxxxxxxxx>
Cc: Francesco Ruggeri <fruggeri05@xxxxxxxxx>
Cc: Jakub Kicinski <kuba@xxxxxxxxxx>
Cc: Paolo Abeni <pabeni@xxxxxxxxxx>
Cc: Salam Noureddine <noureddine@xxxxxxxxxx>
Cc: Simon Horman <horms@xxxxxxxxxx>
Cc: netdev@xxxxxxxxxxxxxxx
Cc: linux-kernel@xxxxxxxxxxxxxxx
Dmitry Safonov (7):
Documentation/tcp: Fix an obvious typo
net/tcp: Consistently align TCP-AO option in the header
net/tcp: Limit TCP_AO_REPAIR to non-listen sockets
net/tcp: Reset TCP-AO cached keys on listen() syscall
net/tcp: Don't add key with non-matching VRF on connected sockets
net/tcp: ACCESS_ONCE() on snd/rcv SNEs
net/tcp: Don't store TCP-AO maclen on reqsk
Documentation/networking/tcp_ao.rst | 2 +-
include/linux/tcp.h | 10 ++++------
include/net/tcp_ao.h | 11 +++++++++++
net/ipv4/af_inet.c | 1 +
net/ipv4/tcp.c | 6 ++++++
net/ipv4/tcp_ao.c | 29 +++++++++++++++++++++++------
net/ipv4/tcp_input.c | 9 +++++----
net/ipv4/tcp_ipv4.c | 4 ++--
net/ipv4/tcp_minisocks.c | 2 +-
net/ipv4/tcp_output.c | 15 ++++++---------
net/ipv6/tcp_ipv6.c | 2 +-
11 files changed, 61 insertions(+), 30 deletions(-)
base-commit: 98b1cc82c4affc16f5598d4fa14b1858671b2263
--
2.42.0
