netdev - Re: [Crypto v4 03/12] support for inline tls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 12 Feb 2018 14:48:35 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     atul.gupta@...lsio.com
Cc:     davejwatson@...com, herbert@...dor.apana.org.au,
        sd@...asysnail.net, linux-crypto@...r.kernel.org,
        netdev@...r.kernel.org, ganeshgr@...lsio.com
Subject: Re: [Crypto v4 03/12] support for inline tls

From: Atul Gupta <atul.gupta@...lsio.com>
Date: Mon, 12 Feb 2018 17:34:28 +0530

> +static int get_tls_prot(struct sock *sk)
> +{
> +	struct tls_context *ctx = tls_get_ctx(sk);
> +	struct net_device *netdev;
> +	struct tls_device *dev;
> +
> +	/* Device bound to specific IP */
> +	if (inet_sk(sk)->inet_rcv_saddr) {
> +		netdev = find_netdev(sk);
> +		if (!netdev)
> +			goto out;
> +
> +		/* Device supports Inline record processing */
> +		if (!(netdev->features & NETIF_F_HW_TLS_INLINE))
> +			goto out;
> +
> +		mutex_lock(&device_mutex);
> +		list_for_each_entry(dev, &device_list, dev_list) {
> +			if (dev->netdev && dev->netdev(dev, netdev))
> +				break;
> +		}
> +		mutex_unlock(&device_mutex);
> +
> +		ctx->tx_conf = TLS_FULL_HW;
> +		if (dev->prot)
> +			dev->prot(dev, sk);

What if the same IP address is configured on multiple interfaces?

> +	} else { /* src address not known or INADDR_ANY */
> +		mutex_lock(&device_mutex);
> +		list_for_each_entry(dev, &device_list, dev_list) {
> +			if (dev->feature && dev->feature(dev)) {
> +				ctx->tx_conf = TLS_FULL_HW;
> +				break;
> +			}
> +		}
> +		mutex_unlock(&device_mutex);
> +		update_sk_prot(sk, ctx);

And I think this is even more of a stretch.  Just because you find
an inline TLS device on the global list doesn't mean traffic will
necessarily flow through it once the connection is fully established
and therefore be able to provide inline TLS offloading.