diff options
| author |  Dmitry Safonov <dima@arista.com>
| 2023-10-23 20:21:59 +0100 |
|---|---|---|
| committer |  David S. Miller <davem@davemloft.net>
| 2023-10-27 10:35:44 +0100 |
| commit | f7dca36fc54afa2eb76bff8d0589a2ef18caea91 (patch) | |
| tree | 318f2f477d23c115b66a9a1ea136f562ed588430 /include/net/dropreason-core.h | |
| parent | net/tcp: Add TCP-AO sign to outgoing packets (diff) | |
| download | linux-f7dca36fc54afa2eb76bff8d0589a2ef18caea91.tar.gz linux-f7dca36fc54afa2eb76bff8d0589a2ef18caea91.tar.bz2 linux-f7dca36fc54afa2eb76bff8d0589a2ef18caea91.zip | |
net/tcp: Add tcp_parse_auth_options()
Introduce a helper that:
(1) shares the common code with TCP-MD5 header options parsing
(2) looks for hash signature only once for both TCP-MD5 and TCP-AO
(3) fails with -EEXIST if any TCP sign option is present twice, see
RFC5925 (2.2):
">> A single TCP segment MUST NOT have more than one TCP-AO in its
options sequence. When multiple TCP-AOs appear, TCP MUST discard
the segment."
Co-developed-by: Francesco Ruggeri <fruggeri@arista.com>
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Co-developed-by: Salam Noureddine <noureddine@arista.com>
Signed-off-by: Salam Noureddine <noureddine@arista.com>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Acked-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net/dropreason-core.h')
| -rw-r--r-- | include/net/dropreason-core.h | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/include/net/dropreason-core.h b/include/net/dropreason-core.h index 845dce805de7..3af4464a9c5b 100644 --- a/include/net/dropreason-core.h +++ b/include/net/dropreason-core.h @@ -20,6 +20,7 @@ FN(IP_NOPROTO) \ FN(SOCKET_RCVBUFF) \ FN(PROTO_MEM) \ + FN(TCP_AUTH_HDR) \ FN(TCP_MD5NOTFOUND) \ FN(TCP_MD5UNEXPECTED) \ FN(TCP_MD5FAILURE) \ @@ -143,6 +144,11 @@ enum skb_drop_reason { */ SKB_DROP_REASON_PROTO_MEM, /** + * @SKB_DROP_REASON_TCP_AUTH_HDR: TCP-MD5 or TCP-AO hashes are met + * twice or set incorrectly. + */ + SKB_DROP_REASON_TCP_AUTH_HDR, + /** * @SKB_DROP_REASON_TCP_MD5NOTFOUND: no MD5 hash and one expected, * corresponding to LINUX_MIB_TCPMD5NOTFOUND */ |