From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B08BE936ED for ; Wed, 4 Oct 2023 22:56:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240411AbjJDW4O (ORCPT ); Wed, 4 Oct 2023 18:56:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41566 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236558AbjJDW4N (ORCPT ); Wed, 4 Oct 2023 18:56:13 -0400 Received: from ms.lwn.net (ms.lwn.net [IPv6:2600:3c01:e000:3a1::42]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3693895; Wed, 4 Oct 2023 15:56:07 -0700 (PDT) Received: from localhost (unknown [IPv6:2601:281:8300:73::646]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ms.lwn.net (Postfix) with ESMTPSA id C0D9577D; Wed, 4 Oct 2023 22:56:05 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 ms.lwn.net C0D9577D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lwn.net; s=20201203; t=1696460165; bh=VGEewOivVVXxRe4yeWdnj6hs2luNc7hkwYEag1NXZWw=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=tHHuP8QvrNgyqfwD29DAEB9Fyz/9m9K3y2sKAXSae3a3KPAXs4o196eUbjmVhXmc+ DFmYoUWRH1ppihNXVcglkKTJuit12m9ESk/aU1Om5Lp0AQk8cJ3q+rViPWi3AYQY+j 3CIp4qdj1gFMP/4l1vD8w/kRkCY4dZ/EGBNAgF5WsyUVACADAy6C6gLwEH4AlucGgM xRF578ij0imQW2Lmj/PbcEPj+4ozg47EDmULcRtc9XY73lXNfPaVNAeFvadkpSoxNv ts9OrI59d5JMZUAT2Kpm/2CHT8wjZZo8BlbD1AEiOdcejef62leajHNZhaiOK4Kvcg Mjq/XOV+Pay6w== From: Jonathan Corbet To: Dmitry Safonov , David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Andy Lutomirski , Ard Biesheuvel , Bob Gilligan , Dan Carpenter , David Laight , Dmitry Safonov <0x7f454c46@gmail.com>, Donald Cassidy , Eric Biggers , "Eric W. Biederman" , Francesco Ruggeri , "Gaillardetz, Dominik" , Herbert Xu , Hideaki YOSHIFUJI , Ivan Delalande , Leonard Crestez , "Nassiri, Mohammad" , Salam Noureddine , Simon Horman , "Tetreault, Francois" , netdev@vger.kernel.org, linux-doc@vger.kernel.org Subject: Re: [PATCH v13 net-next 23/23] Documentation/tcp: Add TCP-AO documentation In-Reply-To: <20231004223629.166300-24-dima@arista.com> References: <20231004223629.166300-1-dima@arista.com> <20231004223629.166300-24-dima@arista.com> Date: Wed, 04 Oct 2023 16:56:05 -0600 Message-ID: <87jzs2yp2y.fsf@meer.lwn.net> MIME-Version: 1.0 Content-Type: text/plain Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Dmitry Safonov writes: > It has Frequently Asked Questions (FAQ) on RFC 5925 - I found it very > useful answering those before writing the actual code. It provides answers > to common questions that arise on a quick read of the RFC, as well as how > they were answered. There's also comparison to TCP-MD5 option, > evaluation of per-socket vs in-kernel-DB approaches and description of > uAPI provided. > > Hopefully, it will be as useful for reviewing the code as it was for writing. It looks like useful information; I just have one request... > Cc: Jonathan Corbet > Cc: linux-doc@vger.kernel.org > Signed-off-by: Dmitry Safonov > Acked-by: David Ahern > --- > Documentation/networking/index.rst | 1 + > Documentation/networking/tcp_ao.rst | 434 ++++++++++++++++++++++++++++ > 2 files changed, 435 insertions(+) > create mode 100644 Documentation/networking/tcp_ao.rst > > diff --git a/Documentation/networking/index.rst b/Documentation/networking/index.rst > index 5b75c3f7a137..69c1e53ef88b 100644 > --- a/Documentation/networking/index.rst > +++ b/Documentation/networking/index.rst > @@ -107,6 +107,7 @@ Contents: > sysfs-tagging > tc-actions-env-rules > tc-queue-filters > + tcp_ao > tcp-thin > team > timestamping > diff --git a/Documentation/networking/tcp_ao.rst b/Documentation/networking/tcp_ao.rst > new file mode 100644 > index 000000000000..cfa13a0748a2 > --- /dev/null > +++ b/Documentation/networking/tcp_ao.rst > @@ -0,0 +1,434 @@ > +.. SPDX-License-Identifier: GPL-2.0 > + > +======================================================== > +TCP Authentication Option Linux implementation (RFC5925) > +======================================================== > + > +TCP Authentication Option (TCP-AO) provides a TCP extension aimed at verifying > +segments between trusted peers. It adds a new TCP header option with > +a Message Authentication Code (MAC). MACs are produced from the content > +of a TCP segment using a hashing function with a password known to both peers. > +The intent of TCP-AO is to deprecate TCP-MD5 providing better security, > +key rotation and support for variety of hashing algorithms. > + > +1. Introduction > +=============== > + > +.. list-table:: Short and Limited Comparison of TCP-AO and TCP-MD5 > + > + * - > + - TCP-MD5 > + - TCP-AO > + * - Supported hashing algorithms > + - MD5 (cryptographically weak). > + - Must support HMAC-SHA1 (chosen-prefix attacks) and CMAC-AES-128 > + (only side-channel attacks). May support any hashing algorithm. ...can you please avoid using list-table if possible? It makes the plain-text version nearly impossible to read. Thanks, jon