Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1664283

Re: [PATCH v2 2/2] tcp: md5: extend the tcp_md5sig struct to specify a key address prefix

Show all headers | View raw

On Sat, Jun 10, 2017 at 06:58:11PM -0400, David Miller wrote:
> From: Ivan Delalande <colona@arista.com>
> Date: Fri,  9 Jun 2017 19:14:49 -0700
> 
> > Add a flag field and address prefix length at the end of the tcp_md5sig
> > structure so users can configure an address prefix length along with a
> > key. Make sure shorter option values are still accepted in
> > tcp_v4_parse_md5_keys and tcp_v6_parse_md5_keys to maintain backward
> > compatibility.
> > 
> > Signed-off-by: Bob Gilligan <gilligan@arista.com>
> > Signed-off-by: Eric Mowat <mowat@arista.com>
> > Signed-off-by: Ivan Delalande <colona@arista.com>
> 
> As I believe was previously stated, the problem with this approach is
> that if a new tool requests the prefix length and is run on an older
> kernel, the kernel will return success even though the prefix length
> was not taken into account.
> 
> We do not want to get a success back when the operation requested was
> not performed.

Ah yeah that's right, sorry, definitely not great.

So I guess our only other option is to add a new socket option, like
TCP_MD5SIG_EXT which would use the extended version of struct tcp_md5sig
from this patch. Is it justified for this feature, or do you see any
other way to achieve this?

Thanks,
-- 
Ivan Delalande
Arista Networks

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2 1/2] tcp: md5: add an address prefix for key lookup Ivan Delalande <colona@arista.com> - 2017-06-10 04:20 +0200
  [PATCH v2 2/2] tcp: md5: extend the tcp_md5sig struct to specify a key address prefix Ivan Delalande <colona@arista.com> - 2017-06-10 04:20 +0200
    Re: [PATCH v2 2/2] tcp: md5: extend the tcp_md5sig struct to  specify a key address prefix David Miller <davem@davemloft.net> - 2017-06-11 01:00 +0200
      Re: [PATCH v2 2/2] tcp: md5: extend the tcp_md5sig struct to specify  a key address prefix Ivan Delalande <colona@arista.com> - 2017-06-13 00:50 +0200
  [PATCH v3 1/2] tcp: md5: add an address prefix for key lookup Ivan Delalande <colona@arista.com> - 2017-06-16 03:10 +0200
    [PATCH v3 2/2] tcp: md5: add TCP_MD5SIG_EXT socket option to set a key address prefix Ivan Delalande <colona@arista.com> - 2017-06-16 03:10 +0200
      Re: [PATCH v3 2/2] tcp: md5: add TCP_MD5SIG_EXT socket option to  set a key address prefix David Miller <davem@davemloft.net> - 2017-06-19 20:00 +0200
    Re: [PATCH v3 1/2] tcp: md5: add an address prefix for key lookup David Miller <davem@davemloft.net> - 2017-06-19 20:00 +0200

csiph-web