linux-kernel - Re: [net] Octeontx2-af: Skip overlap check for SPI field

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250726174428.GL1367887@horms.kernel.org>
Date: Sat, 26 Jul 2025 18:44:28 +0100
From: Simon Horman <horms@...nel.org>
To: Hariprasad Kelam <hkelam@...vell.com>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	Sunil Goutham <sgoutham@...vell.com>,
	Linu Cherian <lcherian@...vell.com>,
	Geetha sowjanya <gakula@...vell.com>,
	Jerin Jacob <jerinj@...vell.com>,
	Subbaraya Sundeep <sbhatta@...vell.com>,
	Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Ratheesh Kannoth <rkannoth@...vell.com>
Subject: Re: [net] Octeontx2-af: Skip overlap check for SPI field

On Fri, Jul 25, 2025 at 12:18:02PM +0530, Hariprasad Kelam wrote:
> Octeontx2/CN10K silicon supports generating a 256-bit key per packet.
> The specific fields to be extracted from a packet for key generation
> are configurable via a Key Extraction (MKEX) Profile.
> 
> The AF driver scans the configured extraction profile to ensure that
> fields from upper layers do not overwrite fields from lower layers in
> the key.
> 
> Example Packet Field Layout:
> LA: DMAC + SMAC
> LB: VLAN
> LC: IPv4/IPv6
> LD: TCP/UDP
> 
> Valid MKEX Profile Configuration:
> 
> LA   -> DMAC   -> key_offset[0-5]
> LC   -> SIP    -> key_offset[20-23]
> LD   -> SPORT  -> key_offset[30-31]
> 
> Invalid MKEX profile configuration:
> 
> LA   -> DMAC   -> key_offset[0-5]
> LC   -> SIP    -> key_offset[20-23]
> LD   -> SPORT  -> key_offset[2-3]  // Overlaps with DMAC field
> 
> In another scenario, if the MKEX profile is configured to extract
> the SPI field from both AH and ESP headers at the same key offset,
> the driver rejecting this configuration. In a regular traffic,
> ipsec packet will be having either AF(LD) or ESP (LE). This patch

Should "AF" be "AH ?

> relaxes the check for the same.
> 
> Fixes: 12aa0a3b93f3 ("octeontx2-af: Harden rule validation.")
> Signed-off-by: Hariprasad Kelam <hkelam@...vell.com>
> ---
>  drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
> index 1b765045aa63..d8d491a01e5b 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
> @@ -607,7 +607,7 @@ static void npc_set_features(struct rvu *rvu, int blkaddr, u8 intf)
>  			*features &= ~BIT_ULL(NPC_OUTER_VID);
>  
>  	/* Set SPI flag only if AH/ESP and IPSEC_SPI are in the key */
> -	if (npc_check_field(rvu, blkaddr, NPC_IPSEC_SPI, intf) &&
> +	if (npc_is_field_present(rvu, NPC_IPSEC_SPI, intf) &&

As this checks now differs in form from that of other's in this function,
perhaps expanding the comment above is warranted.

>  	    (*features & (BIT_ULL(NPC_IPPROTO_ESP) | BIT_ULL(NPC_IPPROTO_AH))))
>  		*features |= BIT_ULL(NPC_IPSEC_SPI);
>  
> -- 
> 2.34.1
>