> -----Original Message-----
> From: Eric Dumazet [mailto:[email protected]]
> Sent: Tuesday, August 15, 2017 5:46 PM
> To: Boris Pismenny <[email protected]>
> Cc: Ilya Lesokhin <[email protected]>; [email protected];
> [email protected]; [email protected]; Aviad Yehezkel
> <[email protected]>
> Subject: Re: [PATCH v2 net-next 1/3] ipv6: Prevent unexpected sk->sk_prot
> changes
>
> I am just saying IPV6_ADDRFORM is becoming spaghetti code, and maybe
> this is time to make it modular.
>
Hi Eric,
I understand your concern, but I would like to postpone implementing this
feature until the ulp infrastructure stabilizes.
I don't even know how many users want to use IPV6_ADDRFORM on sockets with ulp.
I think that simply returning an error for ulp sockets in the meantime is a
reasonable
compromise.
what do you think about the patch below?
Subject: [PATCH 1/1] ipv6: Disable IPV6_ADDRFORM on sockets with ulp attached
The IPV6_ADDRFORM setsockopt works by overriding sk->sk_prot.
The current KTLS ulp also overrides sk->sk_prot.
Consequently, using IPV6_ADDRFORM when there is a ulp attached is
unsafe and this patch disables it.
Fixes: 3c4d7559159b ('tls: kernel TLS support')
Signed-off-by: Ilya Lesokhin <[email protected]>
---
net/ipv6/ipv6_sockglue.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 02d795f..d935948 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -185,8 +185,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level,
int optname,
retv = -EBUSY;
break;
}
- } else if (sk->sk_protocol != IPPROTO_TCP)
+ } else if (sk->sk_protocol == IPPROTO_TCP) {
+ if (inet_csk(sk)->icsk_ulp_ops)
+ break;
+ } else {
break;
+ }
if (sk->sk_state != TCP_ESTABLISHED) {
retv = -ENOTCONN;
Thanks,
Ilya
