Re: [PATCH net 0/2] tcp: make TCP-AO lookups more predictable

On Tue, 23 Jun 2026 at 06:25, Eric Dumazet [off-list ref] wrote:

On Mon, Jun 22, 2026 at 6:13 PM Dmitry Safonov [off-list ref] wrote:

[..]

quoted

What do you think?

If intersecting keys are not yet allowed, I think we must return an
error code at the insertion stage,
instead of hoping the user will do "the right thing".

That is happenning already: in the new selftest you used different
keyids, so that adds distinct keys and they both may be used/rotated
on the connection (and have to be copied to the established socket).
If you try adding two keys with different prefixes, but matching the
same peer ip (same keyids; available in the same VRFs) –  second
setsockopt() will fail. There are tests for this in
setsockopt-closed.c under duplicate_tests().

Thanks,
             Dmitry