Re: [PATCH] net/tls: Fix return values for setsockopt

[Jakub Kicinski]

On Wed, 04 Dec 2019 12:51:35 -0800 (PST), David Miller wrote:
> From: Willem de Bruijn <willemdebruijn.kernel@xxxxxxxxx>
> Date: Wed, 4 Dec 2019 15:43:00 -0500
> > On Wed, Dec 4, 2019 at 2:36 PM Jakub Kicinski wrote:  
> >> On Wed, 4 Dec 2019 14:22:55 -0500, Willem de Bruijn wrote:  
> >> > On Tue, Dec 3, 2019 at 6:08 PM Jakub Kicinski wrote:  
> >> > > On Tue,  3 Dec 2019 23:44:58 +0100, Valentin Vidic wrote:  
> >> > > > ENOTSUPP is not available in userspace:
> >> > > >
> >> > > >   setsockopt failed, 524, Unknown error 524
> >> > > >
> >> > > > Signed-off-by: Valentin Vidic <vvidic@xxxxxxxxxxxxxxxxxxxxxx>  
> >> > >
> >> > > I'm not 100% clear on whether we can change the return codes after they
> >> > > had been exposed to user space for numerous releases..  
> >> >
> >> > This has also come up in the context of SO_ZEROCOPY in the past. In my
> >> > opinion the answer is no. A quick grep | wc -l in net/ shows 99
> >> > matches for this error code. Only a fraction of those probably make it
> >> > to userspace, but definitely more than this single case.
> >> >
> >> > If anything, it may be time to define it in uapi?  
> >>
> >> No opinion but FWIW I'm toying with some CI for netdev, I've added a
> >> check for use of ENOTSUPP, apparently checkpatch already sniffs out
> >> uses of ENOSYS, so seems appropriate to add this one.  
> > 
> > Good idea if not exposing this in UAPI.  
> 
> I'm trying to understand this part of the discussion.
> 
> If we have been returning a non-valid error code, this 524 internal
> kernel thing, it is _NOT_ an exposed UAPI.
> 
> It is a kernel bug and we should fix it.

I agree. We should just fix this.

As Willem points out the use of this error code has spread, but in
theory I'm a co-maintainer of the TLS code now, and my maintainer 
gut says "just fix it" :)

> If userspace anywhere is checking for 524, that is what needs to be fixed.

FWIW I did a quick grep through openssl and gnutls and fbthrift and I
see no references to ENOTSUPP or 524.

Valentin, what's the strategy you're using for this fix? There's a
bunch of ENOTSUPP in net/tls/tls_sw.c as well, could you convert those,
too?