Re: [PATCH v3] tcp: verify the checksum of the first data segment in a new connection

2018-06-15 Thread van der Linden, Frank
On 6/14/18 5:05 PM, David Miller wrote: > From: Frank van der Linden > Date: Tue, 12 Jun 2018 23:09:37 + > >> commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash >> table") introduced an optimization for the handling of child sockets >> created for a new TCP connection. >> >>

Re: [PATCH v2] tcp: verify the checksum of the first data segment in a new connection

2018-06-12 Thread van der Linden, Frank
Ok, patch v3 sent. It was rightly pointed out to me that I shouldn't commit the mortal sin of top posting - but bear with me guys, I'll dig up my 25-year old .muttrc :-) Frank On 6/12/18, 3:03 PM, "Eric Dumazet" wrote: On 06/12/2018 02:53 PM, van der

Re: [PATCH v2] tcp: verify the checksum of the first data segment in a new connection

2018-06-12 Thread van der Linden, Frank
. Though if you have the simpler change already lined up, I'll happily refrain from sending it myself. Frank On 6/12/18, 3:03 PM, "Eric Dumazet" wrote: On 06/12/2018 02:53 PM, van der Linden, Frank wrote: > The convention seems to be to call tcp_checksum

Re: [PATCH v2] tcp: verify the checksum of the first data segment in a new connection

2018-06-12 Thread van der Linden, Frank
The convention seems to be to call tcp_checksum_complete after tcp_filter has a chance to deal with the packet. I wanted to preserve that. If that is not a concern, then I agree that this is a far better way to go. Frank On 6/12/18, 2:50 PM, "Eric Dumazet" wrote: On 06/12/2018

Re: [PATCH] tcp: verify the checksum of the first data segment in a new connection

2018-06-12 Thread van der Linden, Frank
Resubmitted. The various release/deref requirements in that path make a straight "goto csum_error" impossible without duplicating some lines, but this is 2nd best. Frank On 6/11/18, 4:43 PM, "van der Linden, Frank" wrote: Yeah, true, it's missing INERRS in th

Re: [PATCH] tcp: verify the checksum of the first data segment in a new connection

2018-06-11 Thread van der Linden, Frank
Yeah, true, it's missing INERRS in this case. I'll fix it up a bit. Frank On 6/11/18, 4:38 PM, "Eric Dumazet" wrote: On 06/11/2018 04:25 PM, van der Linden, Frank wrote: > A few comments on this one: > > - obviously this is fairly ser

Re: [PATCH] tcp: verify the checksum of the first data segment in a new connection

2018-06-11 Thread van der Linden, Frank
A few comments on this one: - obviously this is fairly serious, as it can let corrupted data all the way up to the application - I am not nuts about the patch itself, the code feels a bit cluttered, but it's the least invasive way I could think of. Probably some refactoring is needed at some p