From: David Ahern <dsahern@kernel.org>
To: Dmitry Safonov <dima@arista.com>,
Eric Dumazet <edumazet@google.com>,
Paolo Abeni <pabeni@redhat.com>, Jakub Kicinski <kuba@kernel.org>,
"David S. Miller" <davem@davemloft.net>
Cc: linux-kernel@vger.kernel.org,
Andy Lutomirski <luto@amacapital.net>,
Ard Biesheuvel <ardb@kernel.org>,
Bob Gilligan <gilligan@arista.com>,
Dan Carpenter <error27@gmail.com>,
David Laight <David.Laight@aculab.com>,
Dmitry Safonov <0x7f454c46@gmail.com>,
Donald Cassidy <dcassidy@redhat.com>,
Eric Biggers <ebiggers@kernel.org>,
"Eric W. Biederman" <ebiederm@xmission.com>,
Francesco Ruggeri <fruggeri05@gmail.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
Ivan Delalande <colona@arista.com>,
Leonard Crestez <cdleonard@gmail.com>,
Salam Noureddine <noureddine@arista.com>,
netdev@vger.kernel.org
Subject: Re: [PATCH v7 04/22] net/tcp: Prevent TCP-MD5 with TCP-AO being set
Date: Sun, 18 Jun 2023 10:50:38 -0700 [thread overview]
Message-ID: <85077827-d11d-d3e6-0d23-9e60974cad0f@kernel.org> (raw)
In-Reply-To: <20230614230947.3954084-5-dima@arista.com>
On 6/14/23 4:09 PM, Dmitry Safonov wrote:
> Be as conservative as possible: if there is TCP-MD5 key for a given peer
> regardless of L3 interface - don't allow setting TCP-AO key for the same
> peer. According to RFC5925, TCP-AO is supposed to replace TCP-MD5 and
> there can't be any switch between both on any connected tuple.
> Later it can be relaxed, if there's a use, but in the beginning restrict
> any intersection.
>
> Note: it's still should be possible to set both TCP-MD5 and TCP-AO keys
> on a listening socket for *different* peers.
Does the testsuite cover use of both MD5 and AO for a single listening
socket with different peers and then other tests covering attempts to
use both for a same peer?
next prev parent reply other threads:[~2023-06-18 17:50 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-14 23:09 [PATCH v7 00/22] net/tcp: Add TCP-AO support Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 01/22] net/tcp: Prepare tcp_md5sig_pool for TCP-AO Dmitry Safonov
2023-06-15 10:45 ` Steen Hegelund
2023-06-15 16:44 ` Dmitry Safonov
2023-06-16 7:00 ` Steen Hegelund
2023-06-14 23:09 ` [PATCH v7 02/22] net/tcp: Add TCP-AO config and structures Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 03/22] net/tcp: Introduce TCP_AO setsockopt()s Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 04/22] net/tcp: Prevent TCP-MD5 with TCP-AO being set Dmitry Safonov
2023-06-18 17:50 ` David Ahern [this message]
2023-06-19 16:31 ` Dmitry Safonov
2023-06-19 16:41 ` Dmitry Safonov
2023-06-19 16:59 ` Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 05/22] net/tcp: Calculate TCP-AO traffic keys Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 06/22] net/tcp: Add TCP-AO sign to outgoing packets Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 07/22] net/tcp: Add tcp_parse_auth_options() Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 08/22] net/tcp: Add AO sign to RST packets Dmitry Safonov
2023-06-15 1:22 ` kernel test robot
2023-06-15 1:23 ` kernel test robot
2023-06-15 11:47 ` kernel test robot
2023-06-14 23:09 ` [PATCH v7 09/22] net/tcp: Add TCP-AO sign to twsk Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 10/22] net/tcp: Wire TCP-AO to request sockets Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 11/22] net/tcp: Sign SYN-ACK segments with TCP-AO Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 12/22] net/tcp: Verify inbound TCP-AO signed segments Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 13/22] net/tcp: Add TCP-AO segments counters Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 14/22] net/tcp: Add TCP-AO SNE support Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 15/22] net/tcp: Add tcp_hash_fail() ratelimited logs Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 16/22] net/tcp: Ignore specific ICMPs for TCP-AO connections Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 17/22] net/tcp: Add option for TCP-AO to (not) hash header Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 18/22] net/tcp: Add TCP-AO getsockopt()s Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 19/22] net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs) Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 20/22] net/tcp: Add static_key for TCP-AO Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 21/22] net/tcp: Wire up l3index to TCP-AO Dmitry Safonov
2023-06-14 23:09 ` [PATCH v7 22/22] net/tcp: Add TCP_AO_REPAIR Dmitry Safonov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=85077827-d11d-d3e6-0d23-9e60974cad0f@kernel.org \
--to=dsahern@kernel.org \
--cc=0x7f454c46@gmail.com \
--cc=David.Laight@aculab.com \
--cc=ardb@kernel.org \
--cc=cdleonard@gmail.com \
--cc=colona@arista.com \
--cc=davem@davemloft.net \
--cc=dcassidy@redhat.com \
--cc=dima@arista.com \
--cc=ebiederm@xmission.com \
--cc=ebiggers@kernel.org \
--cc=edumazet@google.com \
--cc=error27@gmail.com \
--cc=fruggeri05@gmail.com \
--cc=gilligan@arista.com \
--cc=herbert@gondor.apana.org.au \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=netdev@vger.kernel.org \
--cc=noureddine@arista.com \
--cc=pabeni@redhat.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.