Good find! While there is probably zero difference as the compiler optimizes this, keeping "old_len" instead would only require the clearing of TH_FIN, and not another assignment though, which seems more alike to similar other checks... @tuexen @cc and @rrs may want to have a look too...

• rebase to main

Looks good, the intended change is clear to follow and in line with the spirit of RFC9438.

lgtm;

• remove unused variable

• rebase to main

• filter out any segments smaller than the current maxseg size minus maximum tcp header options

Root cause was found, no need to keep this around

• bracket setting inp_cred to NULL with #ifdef invariants

Base stack change looks good.

if idle is used as a boolean, why not be consequent about it and declare it as such also? To prevent future misuses with numeric calculations...

In D44092#1013944, @dim wrote:

KMSAN is @markj I believe? Though it looks like you're getting a clang assertion there. So what is the clang version being used?

• some compiler trickery to the correct struct member size

In D44362#1011765, @kib wrote:

I do not understand the change. You re-wrote the code as if the TCP_RFC7413 option is always set. This is not true, at least from the fast grepping of the sources.

thx

only minor whitespace nits. i'm ok with removing this macro mechanistically.

i've read through the TCP related changes, which look good to me. But that's only a minute part of this change. Others should comment on the remaining aspects of this major diff.

addressed all comments.

• sort prototype definitions alphabetically

• clean key material in the error path too.

Discussed transport

Can I ping @kib like this?

As at least two, maybe three different NIC vendors have similar capabilities, wouldn't it make sense to have global, driver independent sysctls?

• clean before free all crypto material

whitespace fix 2

whitespace fix

In D44092#1005867, @emaste wrote:

Makes sense to me. Have you tested make tinderbox?

MAIN e0dfecadf5946b6a8ad423be4eb1c14017b3a8a7 errors on make tinderbox with the same error:

In D44092#1005867, @emaste wrote:

Makes sense to me. Have you tested make tinderbox?