Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:4 as permitted sender) client-ip=2620:137:e000::3:4;
Message-ID: <24f4b6aa-3be3-8fd1-7f98-503c1d7fea56@arista.com>
Date:   Thu, 21 Sep 2023 17:03:07 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.0
Subject: Re: [PATCH v12 net-next 06/23] net/tcp: Add TCP-AO sign to outgoing
 packets
Content-Language: en-US
To:     Paolo Abeni <pabeni@redhat.com>
Cc:     David Ahern <dsahern@kernel.org>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        "David S. Miller" <davem@davemloft.net>,
        linux-kernel@vger.kernel.org,
        Andy Lutomirski <luto@amacapital.net>,
        Ard Biesheuvel <ardb@kernel.org>,
        Bob Gilligan <gilligan@arista.com>,
        Dan Carpenter <error27@gmail.com>,
        David Laight <David.Laight@aculab.com>,
        Dmitry Safonov <0x7f454c46@gmail.com>,
        Donald Cassidy <dcassidy@redhat.com>,
        Eric Biggers <ebiggers@kernel.org>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        Francesco Ruggeri <fruggeri05@gmail.com>,
        "Gaillardetz, Dominik" <dgaillar@ciena.com>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
        Ivan Delalande <colona@arista.com>,
        Leonard Crestez <cdleonard@gmail.com>,
        "Nassiri, Mohammad" <mnassiri@ciena.com>,
        Salam Noureddine <noureddine@arista.com>,
        Simon Horman <simon.horman@corigine.com>,
        "Tetreault, Francois" <ftetreau@ciena.com>, netdev@vger.kernel.org
References: <20230918190027.613430-1-dima@arista.com>
 <20230918190027.613430-7-dima@arista.com>
 <c2c0b0684b9c2a930ae6001bcc0044dd7a0862d5.camel@redhat.com>
From:   Dmitry Safonov <dima@arista.com>
In-Reply-To: <c2c0b0684b9c2a930ae6001bcc0044dd7a0862d5.camel@redhat.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 9/21/23 12:23, Paolo Abeni wrote:
> On Mon, 2023-09-18 at 20:00 +0100, Dmitry Safonov wrote:
>> @@ -1361,16 +1385,48 @@ static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb,
>>  		th->window	= htons(min(tp->rcv_wnd, 65535U));
>>  	}
>>  
>> -	tcp_options_write(th, tp, &opts);
>> +	tcp_options_write(th, tp, &opts, &key);
>>  
>> +	if (tcp_key_is_md5(&key)) {
>>  #ifdef CONFIG_TCP_MD5SIG
>> -	/* Calculate the MD5 hash, as we have all we need now */
>> -	if (md5) {
>> +		/* Calculate the MD5 hash, as we have all we need now */
>>  		sk_gso_disable(sk);
>>  		tp->af_specific->calc_md5_hash(opts.hash_location,
>> -					       md5, sk, skb);
>> -	}
>> +					       key.md5_key, sk, skb);
>>  #endif
>> +	} else if (tcp_key_is_ao(&key)) {
>> +#ifdef CONFIG_TCP_AO
>> +		struct tcp_ao_info *ao;
>> +		void *tkey_buf = NULL;
>> +		u8 *traffic_key;
>> +		__be32 disn;
>> +
>> +		ao = rcu_dereference_protected(tcp_sk(sk)->ao_info,
>> +					       lockdep_sock_is_held(sk));
>> +		if (unlikely(tcb->tcp_flags & TCPHDR_SYN)) {
>> +			if (tcb->tcp_flags & TCPHDR_ACK)
>> +				disn = ao->risn;
>> +			else
>> +				disn = 0;
>> +
>> +			tkey_buf = kmalloc(tcp_ao_digest_size(key.ao_key),
>> +					   GFP_ATOMIC);
>> +			if (!tkey_buf) {
>> +				kfree_skb_reason(skb, SKB_DROP_REASON_NOMEM);
>> +				return -ENOMEM;
>> +			}
>> +			traffic_key = tkey_buf;
>> +			tp->af_specific->ao_calc_key_sk(key.ao_key, traffic_key,
>> +							sk, ao->lisn, disn, true);
>> +		} else {
>> +			traffic_key = snd_other_key(key.ao_key);
>> +		}
>> +		tp->af_specific->calc_ao_hash(opts.hash_location, key.ao_key,
>> +					      sk, skb, traffic_key,
>> +					      opts.hash_location - (u8 *)th, 0);
>> +		kfree(tkey_buf);
>> +#endif
> 
> I'm sorry for the incremental feedback.
> 
> The above could possibly deserve being moved to a specific helper, for
> both readability and code locality when TCP_AO is enabled at compile
> time but not used.

Sure, will do for the v13.

Thanks,
           Dmitry