netdev - Re: [PATCH v2 04/17] tcp: add datapath logic for PSP with inline key exchange

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250626070759.08d41566@kernel.org>
Date: Thu, 26 Jun 2025 07:07:59 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>
Cc: Daniel Zahka <daniel.zahka@...il.com>, Donald Hunter
 <donald.hunter@...il.com>, "David S. Miller" <davem@...emloft.net>, Eric
 Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>, Simon
 Horman <horms@...nel.org>, Jonathan Corbet <corbet@....net>, Andrew Lunn
 <andrew+netdev@...n.ch>, Saeed Mahameed <saeedm@...dia.com>, Leon
 Romanovsky <leon@...nel.org>, Tariq Toukan <tariqt@...dia.com>, Boris
 Pismenny <borisp@...dia.com>, Kuniyuki Iwashima <kuniyu@...gle.com>, Willem
 de Bruijn <willemb@...gle.com>, David Ahern <dsahern@...nel.org>, Neal
 Cardwell <ncardwell@...gle.com>, Patrisious Haddad <phaddad@...dia.com>,
 Raed Salem <raeds@...dia.com>, Jianbo Liu <jianbol@...dia.com>, Dragos
 Tatulea <dtatulea@...dia.com>, Rahul Rameshbabu <rrameshbabu@...dia.com>,
 Stanislav Fomichev <sdf@...ichev.me>, Toke Høiland-Jørgensen <toke@...hat.com>, Alexander Lobakin
 <aleksander.lobakin@...el.com>, Jacob Keller <jacob.e.keller@...el.com>,
 netdev@...r.kernel.org
Subject: Re: [PATCH v2 04/17] tcp: add datapath logic for PSP with inline
 key exchange

On Wed, 25 Jun 2025 20:06:15 -0400 Willem de Bruijn wrote:
> > @@ -2068,7 +2074,8 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb,
> >  	     (TCPHDR_ECE | TCPHDR_CWR | TCPHDR_AE)) ||
> >  	    !tcp_skb_can_collapse_rx(tail, skb) ||
> >  	    thtail->doff != th->doff ||
> > -	    memcmp(thtail + 1, th + 1, hdrlen - sizeof(*th)))
> > +	    memcmp(thtail + 1, th + 1, hdrlen - sizeof(*th)) ||
> > +	    psp_skb_coalesce_diff(tail, skb))
> >  		goto no_coalesce;  
> 
> Since this is a "can these skbs be coalesced" condition check, move it
> inside tcp_skb_can_collapse_rx?

I think the idea was that once the packet is added to the socket rcv
queue we don't really care what exact PSP state it had. I must had
matched what the socket wanted if it got in. The decrypted bit is all
we care about. But packets in the backlog are not fully validated, yet,
so we need an exact comparison.