diff mbox series

[net-next,03/10] net/tcp: Move tcp_inbound_hash() from headers

Message ID 20240224-tcp-ao-tracepoints-v1-3-15f31b7f30a7@arista.com
State New
Headers
Series net/tcp: TCP-AO and TCP-MD5 tracepoints |

Commit Message

Dmitry Safonov Feb. 24, 2024, 9:04 a.m. UTC 
  Two reasons:
1. It's grown up enough
2. In order to not do header spaghetti by including
   <trace/events/tcp.h>, which is necessary for TCP tracepoints.

Signed-off-by: Dmitry Safonov <dima@arista.com>
---
 include/net/tcp.h | 65 ++++---------------------------------------------
 net/ipv4/tcp.c    | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 76 insertions(+), 61 deletions(-)

Comments

Eric Dumazet Feb. 24, 2024, 9:30 a.m. UTC | #1 
On Sat, Feb 24, 2024 at 10:04 AM Dmitry Safonov <dima@arista.com> wrote:
>
> Two reasons:
> 1. It's grown up enough
> 2. In order to not do header spaghetti by including
>    <trace/events/tcp.h>, which is necessary for TCP tracepoints.
>
> Signed-off-by: Dmitry Safonov <dima@arista.com>

Okay, but what about CONFIG_IPV6=m ?

I do not see any EXPORT_SYMBOL() in this patch.
Dmitry Safonov Feb. 24, 2024, 9:40 a.m. UTC | #2 
On 2/24/24 09:30, Eric Dumazet wrote:
> On Sat, Feb 24, 2024 at 10:04 AM Dmitry Safonov <dima@arista.com> wrote:
>>
>> Two reasons:
>> 1. It's grown up enough
>> 2. In order to not do header spaghetti by including
>>    <trace/events/tcp.h>, which is necessary for TCP tracepoints.
>>
>> Signed-off-by: Dmitry Safonov <dima@arista.com>
> 
> Okay, but what about CONFIG_IPV6=m ?
> 
> I do not see any EXPORT_SYMBOL() in this patch.

Ouch. I keep forgetting about that case, will fix in v2.

Thanks,
             Dmitry
Simon Horman Feb. 26, 2024, 8:41 p.m. UTC | #3 
On Sat, Feb 24, 2024 at 09:04:11AM +0000, Dmitry Safonov wrote:
> Two reasons:
> 1. It's grown up enough
> 2. In order to not do header spaghetti by including
>    <trace/events/tcp.h>, which is necessary for TCP tracepoints.
> 
> Signed-off-by: Dmitry Safonov <dima@arista.com>

..

> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index c82dc42f57c6..5fd61ae6bcc9 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -4485,6 +4485,78 @@ EXPORT_SYMBOL(tcp_inbound_md5_hash);
>  
>  #endif
>  
> +/* Called with rcu_read_lock() */
> +enum skb_drop_reason
> +tcp_inbound_hash(struct sock *sk, const struct request_sock *req,
> +		 const struct sk_buff *skb,
> +		 const void *saddr, const void *daddr,
> +		 int family, int dif, int sdif)
> +{
> +	const struct tcphdr *th = tcp_hdr(skb);
> +	const struct tcp_ao_hdr *aoh;
> +	const __u8 *md5_location;
> +	int l3index;
> +
> +	/* Invalid option or two times meet any of auth options */
> +	if (tcp_parse_auth_options(th, &md5_location, &aoh)) {
> +		tcp_hash_fail("TCP segment has incorrect auth options set",
> +			      family, skb, "");
> +		return SKB_DROP_REASON_TCP_AUTH_HDR;
> +	}
> +
> +	if (req) {
> +		if (tcp_rsk_used_ao(req) != !!aoh) {
> +			u8 keyid, rnext, maclen;
> +
> +			if (aoh) {
> +				keyid = aoh->keyid;
> +				rnext = aoh->rnext_keyid;
> +				maclen = tcp_ao_hdr_maclen(aoh);
> +			} else {
> +				keyid = rnext = maclen = 0;
> +			}

Hi Dmitry,

it looks like keyid is set but otherwise unused.

Flagged by W=1 builds with gcc-13 and clang-17.

> +
> +			NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOBAD);
> +			tcp_hash_fail("TCP connection can't start/end using TCP-AO",
> +				      family, skb, "%s",
> +				      !aoh ? "missing AO" : "AO signed");
> +			return SKB_DROP_REASON_TCP_AOFAILURE;
> +		}
> +	}
> +
> +	/* sdif set, means packet ingressed via a device
> +	 * in an L3 domain and dif is set to the l3mdev
> +	 */
> +	l3index = sdif ? dif : 0;
> +
> +	/* Fast path: unsigned segments */
> +	if (likely(!md5_location && !aoh)) {
> +		/* Drop if there's TCP-MD5 or TCP-AO key with any rcvid/sndid
> +		 * for the remote peer. On TCP-AO established connection
> +		 * the last key is impossible to remove, so there's
> +		 * always at least one current_key.
> +		 */
> +		if (tcp_ao_required(sk, saddr, family, l3index, true)) {
> +			tcp_hash_fail("AO hash is required, but not found",
> +					family, skb, "L3 index %d", l3index);
> +			return SKB_DROP_REASON_TCP_AONOTFOUND;
> +		}
> +		if (unlikely(tcp_md5_do_lookup(sk, l3index, saddr, family))) {
> +			NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
> +			tcp_hash_fail("MD5 Hash not found",
> +				      family, skb, "L3 index %d", l3index);
> +			return SKB_DROP_REASON_TCP_MD5NOTFOUND;
> +		}
> +		return SKB_NOT_DROPPED_YET;
> +	}
> +
> +	if (aoh)
> +		return tcp_inbound_ao_hash(sk, skb, family, req, l3index, aoh);
> +
> +	return tcp_inbound_md5_hash(sk, skb, saddr, daddr, family,
> +				    l3index, md5_location);
> +}
> +
>  void tcp_done(struct sock *sk)
>  {
>  	struct request_sock *req;
> 
> -- 
> 2.43.0
> 
>
Dmitry Safonov Feb. 26, 2024, 11:51 p.m. UTC | #4 
On Mon, Feb 26, 2024 at 8:43 PM Simon Horman <horms@kernel.org> wrote:
>
> On Sat, Feb 24, 2024 at 09:04:11AM +0000, Dmitry Safonov wrote:
[..]
> > +     if (req) {
> > +             if (tcp_rsk_used_ao(req) != !!aoh) {
> > +                     u8 keyid, rnext, maclen;
> > +
> > +                     if (aoh) {
> > +                             keyid = aoh->keyid;
> > +                             rnext = aoh->rnext_keyid;
> > +                             maclen = tcp_ao_hdr_maclen(aoh);
> > +                     } else {
> > +                             keyid = rnext = maclen = 0;
> > +                     }
>
> Hi Dmitry,
>
> it looks like keyid is set but otherwise unused.
>
> Flagged by W=1 builds with gcc-13 and clang-17.

Hi Simon,

Yeah, I think I didn't notice it when I was splitting the WIP patch.
It should be in the very next patch that uses them:
+                       trace_tcp_ao_handshake_failure(sk, skb, keyid,
rnext, maclen);

Thanks for the report, going to fix in v2,
             Dmitry
diff mbox series

Patch

diff --git a/include/net/tcp.h b/include/net/tcp.h
index c1fff9207e2d..c80bdfb5efe5 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -2789,66 +2789,9 @@  static inline bool tcp_ao_required(struct sock *sk, const void *saddr,
 	return false;
 }
 
-/* Called with rcu_read_lock() */
-static inline enum skb_drop_reason
-tcp_inbound_hash(struct sock *sk, const struct request_sock *req,
-		 const struct sk_buff *skb,
-		 const void *saddr, const void *daddr,
-		 int family, int dif, int sdif)
-{
-	const struct tcphdr *th = tcp_hdr(skb);
-	const struct tcp_ao_hdr *aoh;
-	const __u8 *md5_location;
-	int l3index;
-
-	/* Invalid option or two times meet any of auth options */
-	if (tcp_parse_auth_options(th, &md5_location, &aoh)) {
-		tcp_hash_fail("TCP segment has incorrect auth options set",
-			      family, skb, "");
-		return SKB_DROP_REASON_TCP_AUTH_HDR;
-	}
-
-	if (req) {
-		if (tcp_rsk_used_ao(req) != !!aoh) {
-			NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOBAD);
-			tcp_hash_fail("TCP connection can't start/end using TCP-AO",
-				      family, skb, "%s",
-				      !aoh ? "missing AO" : "AO signed");
-			return SKB_DROP_REASON_TCP_AOFAILURE;
-		}
-	}
-
-	/* sdif set, means packet ingressed via a device
-	 * in an L3 domain and dif is set to the l3mdev
-	 */
-	l3index = sdif ? dif : 0;
-
-	/* Fast path: unsigned segments */
-	if (likely(!md5_location && !aoh)) {
-		/* Drop if there's TCP-MD5 or TCP-AO key with any rcvid/sndid
-		 * for the remote peer. On TCP-AO established connection
-		 * the last key is impossible to remove, so there's
-		 * always at least one current_key.
-		 */
-		if (tcp_ao_required(sk, saddr, family, l3index, true)) {
-			tcp_hash_fail("AO hash is required, but not found",
-					family, skb, "L3 index %d", l3index);
-			return SKB_DROP_REASON_TCP_AONOTFOUND;
-		}
-		if (unlikely(tcp_md5_do_lookup(sk, l3index, saddr, family))) {
-			NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
-			tcp_hash_fail("MD5 Hash not found",
-				      family, skb, "L3 index %d", l3index);
-			return SKB_DROP_REASON_TCP_MD5NOTFOUND;
-		}
-		return SKB_NOT_DROPPED_YET;
-	}
-
-	if (aoh)
-		return tcp_inbound_ao_hash(sk, skb, family, req, l3index, aoh);
-
-	return tcp_inbound_md5_hash(sk, skb, saddr, daddr, family,
-				    l3index, md5_location);
-}
+enum skb_drop_reason tcp_inbound_hash(struct sock *sk,
+		const struct request_sock *req, const struct sk_buff *skb,
+		const void *saddr, const void *daddr,
+		int family, int dif, int sdif);
 
 #endif	/* _TCP_H */
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index c82dc42f57c6..5fd61ae6bcc9 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -4485,6 +4485,78 @@  EXPORT_SYMBOL(tcp_inbound_md5_hash);
 
 #endif
 
+/* Called with rcu_read_lock() */
+enum skb_drop_reason
+tcp_inbound_hash(struct sock *sk, const struct request_sock *req,
+		 const struct sk_buff *skb,
+		 const void *saddr, const void *daddr,
+		 int family, int dif, int sdif)
+{
+	const struct tcphdr *th = tcp_hdr(skb);
+	const struct tcp_ao_hdr *aoh;
+	const __u8 *md5_location;
+	int l3index;
+
+	/* Invalid option or two times meet any of auth options */
+	if (tcp_parse_auth_options(th, &md5_location, &aoh)) {
+		tcp_hash_fail("TCP segment has incorrect auth options set",
+			      family, skb, "");
+		return SKB_DROP_REASON_TCP_AUTH_HDR;
+	}
+
+	if (req) {
+		if (tcp_rsk_used_ao(req) != !!aoh) {
+			u8 keyid, rnext, maclen;
+
+			if (aoh) {
+				keyid = aoh->keyid;
+				rnext = aoh->rnext_keyid;
+				maclen = tcp_ao_hdr_maclen(aoh);
+			} else {
+				keyid = rnext = maclen = 0;
+			}
+
+			NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOBAD);
+			tcp_hash_fail("TCP connection can't start/end using TCP-AO",
+				      family, skb, "%s",
+				      !aoh ? "missing AO" : "AO signed");
+			return SKB_DROP_REASON_TCP_AOFAILURE;
+		}
+	}
+
+	/* sdif set, means packet ingressed via a device
+	 * in an L3 domain and dif is set to the l3mdev
+	 */
+	l3index = sdif ? dif : 0;
+
+	/* Fast path: unsigned segments */
+	if (likely(!md5_location && !aoh)) {
+		/* Drop if there's TCP-MD5 or TCP-AO key with any rcvid/sndid
+		 * for the remote peer. On TCP-AO established connection
+		 * the last key is impossible to remove, so there's
+		 * always at least one current_key.
+		 */
+		if (tcp_ao_required(sk, saddr, family, l3index, true)) {
+			tcp_hash_fail("AO hash is required, but not found",
+					family, skb, "L3 index %d", l3index);
+			return SKB_DROP_REASON_TCP_AONOTFOUND;
+		}
+		if (unlikely(tcp_md5_do_lookup(sk, l3index, saddr, family))) {
+			NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
+			tcp_hash_fail("MD5 Hash not found",
+				      family, skb, "L3 index %d", l3index);
+			return SKB_DROP_REASON_TCP_MD5NOTFOUND;
+		}
+		return SKB_NOT_DROPPED_YET;
+	}
+
+	if (aoh)
+		return tcp_inbound_ao_hash(sk, skb, family, req, l3index, aoh);
+
+	return tcp_inbound_md5_hash(sk, skb, saddr, daddr, family,
+				    l3index, md5_location);
+}
+
 void tcp_done(struct sock *sk)
 {
 	struct request_sock *req;