netdev - Re: [PATCH v3 04/19] tcp: add datapath logic for PSP with inline key exchange

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <686c704c732fe_266852947c@willemb.c.googlers.com.notmuch>
Date: Mon, 07 Jul 2025 21:11:40 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Daniel Zahka <daniel.zahka@...il.com>, 
 Willem de Bruijn <willemdebruijn.kernel@...il.com>, 
 Donald Hunter <donald.hunter@...il.com>, 
 Jakub Kicinski <kuba@...nel.org>, 
 "David S. Miller" <davem@...emloft.net>, 
 Eric Dumazet <edumazet@...gle.com>, 
 Paolo Abeni <pabeni@...hat.com>, 
 Simon Horman <horms@...nel.org>, 
 Jonathan Corbet <corbet@....net>, 
 Andrew Lunn <andrew+netdev@...n.ch>
Cc: Saeed Mahameed <saeedm@...dia.com>, 
 Leon Romanovsky <leon@...nel.org>, 
 Tariq Toukan <tariqt@...dia.com>, 
 Boris Pismenny <borisp@...dia.com>, 
 Kuniyuki Iwashima <kuniyu@...gle.com>, 
 Willem de Bruijn <willemb@...gle.com>, 
 David Ahern <dsahern@...nel.org>, 
 Neal Cardwell <ncardwell@...gle.com>, 
 Patrisious Haddad <phaddad@...dia.com>, 
 Raed Salem <raeds@...dia.com>, 
 Jianbo Liu <jianbol@...dia.com>, 
 Dragos Tatulea <dtatulea@...dia.com>, 
 Rahul Rameshbabu <rrameshbabu@...dia.com>, 
 Stanislav Fomichev <sdf@...ichev.me>, 
 Toke Høiland-Jørgensen <toke@...hat.com>, 
 Alexander Lobakin <aleksander.lobakin@...el.com>, 
 Jacob Keller <jacob.e.keller@...el.com>, 
 netdev@...r.kernel.org
Subject: Re: [PATCH v3 04/19] tcp: add datapath logic for PSP with inline key
 exchange

Daniel Zahka wrote:
> 
> 
> On 7/6/25 12:16 PM, Willem de Bruijn wrote:
> >> diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
> >> index d0f49e6e3e35..79337028f3a5 100644
> >> --- a/net/ipv4/tcp_minisocks.c
> >> +++ b/net/ipv4/tcp_minisocks.c
> >> @@ -104,9 +104,12 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
> >>   	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
> >>   	u32 rcv_nxt = READ_ONCE(tcptw->tw_rcv_nxt);
> >>   	struct tcp_options_received tmp_opt;
> >> +	enum skb_drop_reason psp_drop;
> >>   	bool paws_reject = false;
> >>   	int ts_recent_stamp;
> >>   
> >> +	psp_drop = psp_twsk_rx_policy_check(tw, skb);
> >> +
> > Why not return immediately here if the policy check fails, similar to
> > the non-timewait path?
> 
> The placement is so that we can accept a non psp encapsulated syn in the 
> case where TCP_TW_SYN is returned from tcp_timewait_state_process().

Ah I see. Maybe worth a brief comment.