On Sat, Feb 24, 2024 at 09:04:11AM +0000, Dmitry Safonov wrote:
> Two reasons:
> 1. It's grown up enough
> 2. In order to not do header spaghetti by including
> <trace/events/tcp.h>, which is necessary for TCP tracepoints.
>
> Signed-off-by: Dmitry Safonov <[email protected]>
...
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index c82dc42f57c6..5fd61ae6bcc9 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -4485,6 +4485,78 @@ EXPORT_SYMBOL(tcp_inbound_md5_hash);
>
> #endif
>
> +/* Called with rcu_read_lock() */
> +enum skb_drop_reason
> +tcp_inbound_hash(struct sock *sk, const struct request_sock *req,
> + const struct sk_buff *skb,
> + const void *saddr, const void *daddr,
> + int family, int dif, int sdif)
> +{
> + const struct tcphdr *th = tcp_hdr(skb);
> + const struct tcp_ao_hdr *aoh;
> + const __u8 *md5_location;
> + int l3index;
> +
> + /* Invalid option or two times meet any of auth options */
> + if (tcp_parse_auth_options(th, &md5_location, &aoh)) {
> + tcp_hash_fail("TCP segment has incorrect auth options set",
> + family, skb, "");
> + return SKB_DROP_REASON_TCP_AUTH_HDR;
> + }
> +
> + if (req) {
> + if (tcp_rsk_used_ao(req) != !!aoh) {
> + u8 keyid, rnext, maclen;
> +
> + if (aoh) {
> + keyid = aoh->keyid;
> + rnext = aoh->rnext_keyid;
> + maclen = tcp_ao_hdr_maclen(aoh);
> + } else {
> + keyid = rnext = maclen = 0;
> + }
Hi Dmitry,
it looks like keyid is set but otherwise unused.
Flagged by W=1 builds with gcc-13 and clang-17.
> +
> + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOBAD);
> + tcp_hash_fail("TCP connection can't start/end using
> TCP-AO",
> + family, skb, "%s",
> + !aoh ? "missing AO" : "AO signed");
> + return SKB_DROP_REASON_TCP_AOFAILURE;
> + }
> + }
> +
> + /* sdif set, means packet ingressed via a device
> + * in an L3 domain and dif is set to the l3mdev
> + */
> + l3index = sdif ? dif : 0;
> +
> + /* Fast path: unsigned segments */
> + if (likely(!md5_location && !aoh)) {
> + /* Drop if there's TCP-MD5 or TCP-AO key with any rcvid/sndid
> + * for the remote peer. On TCP-AO established connection
> + * the last key is impossible to remove, so there's
> + * always at least one current_key.
> + */
> + if (tcp_ao_required(sk, saddr, family, l3index, true)) {
> + tcp_hash_fail("AO hash is required, but not found",
> + family, skb, "L3 index %d", l3index);
> + return SKB_DROP_REASON_TCP_AONOTFOUND;
> + }
> + if (unlikely(tcp_md5_do_lookup(sk, l3index, saddr, family))) {
> + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
> + tcp_hash_fail("MD5 Hash not found",
> + family, skb, "L3 index %d", l3index);
> + return SKB_DROP_REASON_TCP_MD5NOTFOUND;
> + }
> + return SKB_NOT_DROPPED_YET;
> + }
> +
> + if (aoh)
> + return tcp_inbound_ao_hash(sk, skb, family, req, l3index, aoh);
> +
> + return tcp_inbound_md5_hash(sk, skb, saddr, daddr, family,
> + l3index, md5_location);
> +}
> +
> void tcp_done(struct sock *sk)
> {
> struct request_sock *req;
>
> --
> 2.43.0
>
>
