Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <dd2ca85e-ab29-2973-f129-9afafb405851@gmail.com>
Date:   Wed, 27 Jul 2022 11:29:50 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.11.0
From:   Leonard Crestez <cdleonard@gmail.com>
Subject: Re: [PATCH v6 21/26] selftests: net/fcnal: Initial tcp_authopt
 support
To:     Eric Dumazet <edumazet@google.com>,
        David Ahern <dsahern@kernel.org>
Cc:     Philip Paeps <philip@trouble.is>,
        Dmitry Safonov <0x7f454c46@gmail.com>,
        Shuah Khan <shuah@kernel.org>,
        "David S. Miller" <davem@davemloft.net>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        Kuniyuki Iwashima <kuniyu@amazon.co.jp>,
        Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
        Jakub Kicinski <kuba@kernel.org>,
        Yuchung Cheng <ycheng@google.com>,
        Francesco Ruggeri <fruggeri@arista.com>,
        Mat Martineau <mathew.j.martineau@linux.intel.com>,
        Christoph Paasch <cpaasch@apple.com>,
        Ivan Delalande <colona@arista.com>,
        Caowangbao <caowangbao@huawei.com>,
        Priyaranjan Jha <priyarjha@google.com>,
        netdev <netdev@vger.kernel.org>,
        "open list:HARDWARE RANDOM NUMBER GENERATOR CORE" 
        <linux-crypto@vger.kernel.org>,
        "open list:KERNEL SELFTEST FRAMEWORK" 
        <linux-kselftest@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
References: <cover.1658815925.git.cdleonard@gmail.com>
 <ad19d5c8a24054d48e1c35bb0ec92075b9f0dc6a.1658815925.git.cdleonard@gmail.com>
 <CANn89i+ByJsdKLXi982jq0H3irYg_ANSEdmL2zwZ_7G-E_g2eg@mail.gmail.com>
 <CANn89i+=LVDFx_zjDy6uK+QorR+fosdkb8jqNMO6syqOsS7ZqQ@mail.gmail.com>
Content-Language: en-US
In-Reply-To: <CANn89i+=LVDFx_zjDy6uK+QorR+fosdkb8jqNMO6syqOsS7ZqQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 7/26/22 10:27, Eric Dumazet wrote:
> On Tue, Jul 26, 2022 at 9:06 AM Eric Dumazet <edumazet@google.com> wrote:
>>
>> On Tue, Jul 26, 2022 at 8:16 AM Leonard Crestez <cdleonard@gmail.com> wrote:
>>>
>>> Tests are mostly copied from tcp_md5 with minor changes.
>>>
>>> It covers VRF support but only based on binding multiple servers: not
>>> multiple keys bound to different interfaces.
>>>
>>> Also add a specific -t tcp_authopt to run only these tests specifically.
>>>
>>
>> Thanks for the test.
>>
>> Could you amend the existing TCP MD5 test to make sure dual sockets
>> mode is working ?
>>
>> Apparently, if we have a dual stack listener socket (AF_INET6),
>> correct incoming IPV4 SYNs are dropped.

>>   If this is the case, fixing MD5 should happen first ;

I remember looking into this and my conclusion was that ipv4-mapped-ipv6 
is not worth supporting for AO, at least not in the initial version.

Instead I just wrote a test to check that ipv4-mapped-ipv6 fails for AO:
https://github.com/cdleonard/tcp-authopt-test/blob/main/tcp_authopt_test/test_verify_capture.py#L191

On a closer look it does appear that support existed for 
ipv4-mapped-ipv6 in TCP-MD5 but my test didn't actually exercise it 
correctly so the test had to be fixed.


Do you think it makes sense to add support for ipv4-mapped-ipv6 for AO? 
It's not particularly difficult to test, it was skipped due to a lack of 
application use case and to keep the initial series smaller.

Adding support for this later as a separate commit should be fine. Since 
ivp4-mapped-ipv6 addresses shouldn't appear on the wire giving them 
special treatment "later" should raise no compatibility concerns.


>> I think that we are very late in the cycle (linux-5.19 should be
>> released in 5 days), and your patch set should not be merged so late.

This was posted in order to get code reviews, I'm not actually expecting 
inclusion.

--
Regards,
Leonard