From patchwork Sat Feb 24 09:04:13 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Safonov X-Patchwork-Id: 205795 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:a81b:b0:108:e6aa:91d0 with SMTP id bq27csp1056913dyb; Sat, 24 Feb 2024 01:07:30 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCXnfJ8C8eKUOKaFZGGNJWYRMFTSgk157Pqx86ESHhyTqOTcG63o2cwPd/cq5XRpj1fNXnVxCk/vIMaAe4ZS3BIwxRaWXQ== X-Google-Smtp-Source: AGHT+IFqlfIDAVBzsNVtMLMqNa6amw9uO8aoRZI0ZLFk/MMBSQuLLwuyQLxI0gb/4gCc1iz+v9f4 X-Received: by 2002:aa7:cf19:0:b0:565:552a:6f8f with SMTP id a25-20020aa7cf19000000b00565552a6f8fmr1400416edy.7.1708765650361; Sat, 24 Feb 2024 01:07:30 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1708765650; cv=pass; d=google.com; s=arc-20160816; b=WfRSoP/WS3TBBf6WG0axamw6KWrFOFgOX7RHk0hX98jx9md0gVENxNN52jf4KVnk2L LTGo7tqRbwJMTjKmGaxOznD4aq63oH8gy5qH8jLkBCcsakBbiG9ByFGFEiOKRudLwbkg rtM63UiEnbihlHpnTKTrh8tu3O4wKqD7HkqyvRt1Qt3WTdX5Cxa3DPBcpORmkKLYcTe8 KWtpzRZZuiUYrlvQvxR2H3RfKzZGGkGjx+KLsF6Vn7ZPIttzYEN8ld6szD5Kq1IV5a3E Pg61z5Robsl/CPW2iziyeR3qsJhSaicnF6bCLPhTa0xq4uJvHQ0xztux6x7Eo2nqE9Ff DnrA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from:dkim-signature; bh=/WCWN7oYoEuG7HunFuhQOorajxoQi/eLk6qQ00vzKmA=; fh=VzQB8AP2Im7XqfdCVgHcJ7pUBbEjzTj104mGqSE6rSQ=; b=ZoDKvkMgqzbj4h0SNdftnHA3LiPrjmVI/j+OzgaH0QaC17o8k5Gt3UAzWdgaohlyX2 m0G4w532P+L2Rz8K69bNN7jBhh5+NiHBjLufyaAMl9zCaQW3gFagD9JEWsMtJO9l2jur L3ML04adwRYPex8OtGhFbU5FcjjiV7ZEJfBnAkGueNV3ZQQlNtFxL3uDGWlYRML0kLU3 7HfxGska2RtaaTzzYMkJQWrc8ywVmrb9BlsLb9m0yfTxVCriQ8L3q72mSvSHxauJyDFO uIsGWYTWw3eQwMzC1DwxjJoovIodzLTBwR/pLDesKaR1IrmJ8BFIcJQOhSN5GxccvufC AJ7A==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=kecxXJsk; arc=pass (i=1 spf=pass spfdomain=arista.com dkim=pass dkdomain=arista.com dmarc=pass fromdomain=arista.com); spf=pass (google.com: domain of linux-kernel+bounces-79525-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) smtp.mailfrom="linux-kernel+bounces-79525-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from am.mirrors.kernel.org (am.mirrors.kernel.org. [2604:1380:4601:e00::3]) by mx.google.com with ESMTPS id o13-20020aa7d3cd000000b005614804183fsi321776edr.173.2024.02.24.01.07.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 24 Feb 2024 01:07:30 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-79525-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3; Authentication-Results: mx.google.com; dkim=pass header.i=@arista.com header.s=google header.b=kecxXJsk; arc=pass (i=1 spf=pass spfdomain=arista.com dkim=pass dkdomain=arista.com dmarc=pass fromdomain=arista.com); spf=pass (google.com: domain of linux-kernel+bounces-79525-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) smtp.mailfrom="linux-kernel+bounces-79525-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=arista.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by am.mirrors.kernel.org (Postfix) with ESMTPS id 950861F21662 for ; Sat, 24 Feb 2024 09:07:29 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 82DB841235; Sat, 24 Feb 2024 09:04:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=arista.com header.i=@arista.com header.b="kecxXJsk" Received: from mail-lj1-f174.google.com (mail-lj1-f174.google.com [209.85.208.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6FE2D25755 for ; Sat, 24 Feb 2024 09:04:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708765495; cv=none; b=ce0bVIOdQl+REE5ll9iEc8LPt/gvOD3NSg0sUsIjyLxwX5g8QV4iZ5sVGQeM5nBBLildZe5fyQ5YCdeHnGxiETBjaZ2+BnHfuyA0oor/mkJJSHSxjb/GiNPoKnVeXNYU4O9rZxX3XIzy1BYS+cNp26Kf+nQkPHjBcIbw9aiAUmA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708765495; c=relaxed/simple; bh=102HRfrUAQjjWH58WHrrD12WSyo7oflbFvQouUtSetI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ek7i9ByiHeS/b61uKaR1Vtv9+uX0RJbwx0Hd8fGoCBMuuhSk7NWKWcdqlsAJJeVGM1GxQ4FzjJSWTjcWvOwxViweBkyqrQSE7AIA4SouyO3djXWrbfGH0kz7fVeb8tnYYBVjwy1KPIZSZb0UWwVxS5UpvlD46M34btH65Sk/oXs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=arista.com; spf=pass smtp.mailfrom=arista.com; dkim=pass (2048-bit key) header.d=arista.com header.i=@arista.com header.b=kecxXJsk; arc=none smtp.client-ip=209.85.208.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=arista.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arista.com Received: by mail-lj1-f174.google.com with SMTP id 38308e7fff4ca-2d228a132acso15816591fa.0 for ; Sat, 24 Feb 2024 01:04:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1708765491; x=1709370291; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/WCWN7oYoEuG7HunFuhQOorajxoQi/eLk6qQ00vzKmA=; b=kecxXJskS/VPkcy2d6pLkwy1enjie9s6ZsZCz/Eho52RjQ0R2jXMzFF9veb/QJ1fEW PDByytLsa+TSxFiV6r6+j/Fy8Xy8qkKKAixiElXU3mVFPQ+XC2S9iYm7FZVXEoMacGnq a0u8tcnK7E26RYEjV04CIp+wkIwugPbptA++fRRVy1Ay2iftrJoQlWwRGndWL7AUe38t juGI0B0dxLHOP1sE6Kqmic64r//4C+ZjjW4fvxPsVnOJQndHj7UvyKML+rnCixb4fgvX 2TPv3pLGGO+lJEcRgXVhI7BliN0I0zQ7qpkBWyDJa1XkzLGjEdrWdWbGryw26xcqDwn4 e6Xw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1708765491; x=1709370291; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/WCWN7oYoEuG7HunFuhQOorajxoQi/eLk6qQ00vzKmA=; b=PQA0dslijM8jQvLQKzkrtzqT/uv9S73fpl3D/QzZxZtXTZUr8ZX9MRmz+ppTAB90Y4 PB+4AnG/YkIwkZLuhBDglAn+vZfVpVssCIjlOvATr1o9qqmCdqVBdUma1O98yBTCq+6e ZllxShvSxnVjByaAjYXrnFcStcP4GOgu0+bPloVAtcCYkliomIHUhJfNh5RbtWH/D4NG EmSKFsXn/z+2kJ3hXMPMe9RwH6CGQHx1+qI5mGyV6tRCAxOQWK0NBShzmfO2m8n8O3Lc FCXUz9DyKewAZ0Dz4hqqmUqAT9nIjN23tXDKl4vuX9FFIucX9KsQXIB0G55Qtzz7OBDr CNdg== X-Forwarded-Encrypted: i=1; AJvYcCXobz8oWs83l+i4knLmW5C/elzppERLtZ4OB43//Z6352ViMMVl0+5MlNqj1NKXnWY/ylVqgj4DtkjtdsQNF2BR1i56Ub+uskXGec0W X-Gm-Message-State: AOJu0YzeN4wshuMKmZzX9J/xhLloZHSjMTHQeJTL6gsWbooebWK3fOI/ NKGF1N0tK8US0H/KRNBFxfwA84qngBitzAVQmacoorIE7/Vy3GWH4ATq3paP6A== X-Received: by 2002:a2e:8410:0:b0:2d1:1de5:3c42 with SMTP id z16-20020a2e8410000000b002d11de53c42mr751193ljg.24.1708765490647; Sat, 24 Feb 2024 01:04:50 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id m6-20020a7bce06000000b00410bca333b7sm5320593wmc.27.2024.02.24.01.04.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 24 Feb 2024 01:04:49 -0800 (PST) From: Dmitry Safonov To: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Paolo Abeni , David Ahern , Shuah Khan , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers Cc: Dmitry Safonov , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-trace-kernel@vger.kernel.org, Dmitry Safonov <0x7f454c46@gmail.com> Subject: [PATCH net-next 05/10] net/tcp: Remove tcp_hash_fail() Date: Sat, 24 Feb 2024 09:04:13 +0000 Message-ID: <20240224-tcp-ao-tracepoints-v1-5-15f31b7f30a7@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240224-tcp-ao-tracepoints-v1-0-15f31b7f30a7@arista.com> References: <20240224-tcp-ao-tracepoints-v1-0-15f31b7f30a7@arista.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Mailer: b4 0.13-dev-b6b4b X-Developer-Signature: v=1; a=ed25519-sha256; t=1708765347; l=6825; i=dima@arista.com; s=20231212; h=from:subject:message-id; bh=102HRfrUAQjjWH58WHrrD12WSyo7oflbFvQouUtSetI=; b=KuzFXrwGm/QiXWsQtc0Vn6P92cAYtnXKfXYserYzReUDAUFuXH+EUeP0KbUmC6fAtLJAdtW0c jt0POjVpiFoDOqY9QA2u49RZDcJ/hc0Ifew/MAFXfSaqbi/CS7HiMtj X-Developer-Key: i=dima@arista.com; a=ed25519; pk=hXINUhX25b0D/zWBKvd6zkvH7W2rcwh/CH6cjEa3OTk= X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1791770650474067262 X-GMAIL-MSGID: 1791770650474067262 Now there are tracepoints, that cover all functionality of tcp_hash_fail(), but also wire up missing places They are also faster, can be disabled and provide filtering. This potentially may create a regression if a userspace depends on dmesg logs. Fingers crossed, let's see if anyone complains in reality. Signed-off-by: Dmitry Safonov --- include/net/tcp_ao.h | 37 ------------------------------------- net/ipv4/tcp.c | 25 ------------------------- net/ipv4/tcp_ao.c | 9 --------- 3 files changed, 71 deletions(-) diff --git a/include/net/tcp_ao.h b/include/net/tcp_ao.h index 6501ed1dfa1e..ebc6d4e3c073 100644 --- a/include/net/tcp_ao.h +++ b/include/net/tcp_ao.h @@ -148,43 +148,6 @@ extern struct static_key_false_deferred tcp_ao_needed; #define static_branch_tcp_ao() false #endif -static inline bool tcp_hash_should_produce_warnings(void) -{ - return static_branch_tcp_md5() || static_branch_tcp_ao(); -} - -#define tcp_hash_fail(msg, family, skb, fmt, ...) \ -do { \ - const struct tcphdr *th = tcp_hdr(skb); \ - char hdr_flags[6]; \ - char *f = hdr_flags; \ - \ - if (!tcp_hash_should_produce_warnings()) \ - break; \ - if (th->fin) \ - *f++ = 'F'; \ - if (th->syn) \ - *f++ = 'S'; \ - if (th->rst) \ - *f++ = 'R'; \ - if (th->psh) \ - *f++ = 'P'; \ - if (th->ack) \ - *f++ = '.'; \ - *f = 0; \ - if ((family) == AF_INET) { \ - net_info_ratelimited("%s for %pI4.%d->%pI4.%d [%s] " fmt "\n", \ - msg, &ip_hdr(skb)->saddr, ntohs(th->source), \ - &ip_hdr(skb)->daddr, ntohs(th->dest), \ - hdr_flags, ##__VA_ARGS__); \ - } else { \ - net_info_ratelimited("%s for [%pI6c].%d->[%pI6c].%d [%s]" fmt "\n", \ - msg, &ipv6_hdr(skb)->saddr, ntohs(th->source), \ - &ipv6_hdr(skb)->daddr, ntohs(th->dest), \ - hdr_flags, ##__VA_ARGS__); \ - } \ -} while (0) - #ifdef CONFIG_TCP_AO /* TCP-AO structures and functions */ struct tcp4_ao_context { diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 81f22d6afe4a..e83fdce91554 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -4448,7 +4448,6 @@ tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb, if (!key && hash_location) { NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED); - tcp_hash_fail("Unexpected MD5 Hash found", family, skb, ""); trace_tcp_hash_md5_unexpected(sk, skb); return SKB_DROP_REASON_TCP_MD5UNEXPECTED; } @@ -4464,21 +4463,6 @@ tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb, NULL, skb); if (genhash || memcmp(hash_location, newhash, 16) != 0) { NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE); - if (family == AF_INET) { - tcp_hash_fail("MD5 Hash failed", AF_INET, skb, "%s L3 index %d", - genhash ? "tcp_v4_calc_md5_hash failed" - : "", l3index); - } else { - if (genhash) { - tcp_hash_fail("MD5 Hash failed", - AF_INET6, skb, "L3 index %d", - l3index); - } else { - tcp_hash_fail("MD5 Hash mismatch", - AF_INET6, skb, "L3 index %d", - l3index); - } - } trace_tcp_hash_md5_mismatch(sk, skb); return SKB_DROP_REASON_TCP_MD5FAILURE; } @@ -4502,8 +4486,6 @@ tcp_inbound_hash(struct sock *sk, const struct request_sock *req, /* Invalid option or two times meet any of auth options */ if (tcp_parse_auth_options(th, &md5_location, &aoh)) { - tcp_hash_fail("TCP segment has incorrect auth options set", - family, skb, ""); trace_tcp_hash_bad_header(sk, skb); return SKB_DROP_REASON_TCP_AUTH_HDR; } @@ -4521,9 +4503,6 @@ tcp_inbound_hash(struct sock *sk, const struct request_sock *req, } NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOBAD); - tcp_hash_fail("TCP connection can't start/end using TCP-AO", - family, skb, "%s", - !aoh ? "missing AO" : "AO signed"); trace_tcp_ao_handshake_failure(sk, skb, keyid, rnext, maclen); return SKB_DROP_REASON_TCP_AOFAILURE; } @@ -4542,15 +4521,11 @@ tcp_inbound_hash(struct sock *sk, const struct request_sock *req, * always at least one current_key. */ if (tcp_ao_required(sk, saddr, family, l3index, true)) { - tcp_hash_fail("AO hash is required, but not found", - family, skb, "L3 index %d", l3index); trace_tcp_hash_ao_required(sk, skb); return SKB_DROP_REASON_TCP_AONOTFOUND; } if (unlikely(tcp_md5_do_lookup(sk, l3index, saddr, family))) { NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND); - tcp_hash_fail("MD5 Hash not found", - family, skb, "L3 index %d", l3index); trace_tcp_hash_md5_required(sk, skb); return SKB_DROP_REASON_TCP_MD5NOTFOUND; } diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c index 416cdeaccd07..e99bf734d070 100644 --- a/net/ipv4/tcp_ao.c +++ b/net/ipv4/tcp_ao.c @@ -893,9 +893,6 @@ tcp_ao_verify_hash(const struct sock *sk, const struct sk_buff *skb, NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOBAD); atomic64_inc(&info->counters.pkt_bad); atomic64_inc(&key->pkt_bad); - tcp_hash_fail("AO hash wrong length", family, skb, - "%u != %d L3index: %d", maclen, - tcp_ao_maclen(key), l3index); trace_tcp_ao_wrong_maclen(sk, skb, aoh->keyid, aoh->rnext_keyid, maclen); return SKB_DROP_REASON_TCP_AOFAILURE; @@ -912,8 +909,6 @@ tcp_ao_verify_hash(const struct sock *sk, const struct sk_buff *skb, NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOBAD); atomic64_inc(&info->counters.pkt_bad); atomic64_inc(&key->pkt_bad); - tcp_hash_fail("AO hash mismatch", family, skb, - "L3index: %d", l3index); trace_tcp_ao_mismatch(sk, skb, aoh->keyid, aoh->rnext_keyid, maclen); kfree(hash_buf); @@ -944,8 +939,6 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb, info = rcu_dereference(tcp_sk(sk)->ao_info); if (!info) { NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOKEYNOTFOUND); - tcp_hash_fail("AO key not found", family, skb, - "keyid: %u L3index: %d", aoh->keyid, l3index); trace_tcp_ao_key_not_found(sk, skb, aoh->keyid, aoh->rnext_keyid, maclen); return SKB_DROP_REASON_TCP_AOUNEXPECTED; @@ -1052,8 +1045,6 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb, key_not_found: NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAOKEYNOTFOUND); atomic64_inc(&info->counters.key_not_found); - tcp_hash_fail("Requested by the peer AO key id not found", - family, skb, "L3index: %d", l3index); trace_tcp_ao_key_not_found(sk, skb, aoh->keyid, aoh->rnext_keyid, maclen); return SKB_DROP_REASON_TCP_AOKEYNOTFOUND;