netdev - [PATCH RFC ipsec-next 0/14] IPsec hardware offloding API

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 12 Apr 2017 08:26:39 +0200
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     <netdev@...r.kernel.org>
CC:     Steffen Klassert <steffen.klassert@...unet.com>,
        Ilan Tayari <ilant@...lanox.com>
Subject: [PATCH RFC ipsec-next 0/14] IPsec hardware offloding API

This patchset adds the basic infrastructure for IPsec hardware
offloading, it creates a configuration API and adjusts the
packet path.

Patch 1 adds the needed netdev features to configure IPsec offloads.

Patch 2 - 4 prepares for IPsec hardware offloading.

Patch 5 implements the IPsec hardware offloading API.

Patch 5 - 8 reorganize esp_output so that we can use it
on layer 2 to implement the software fallback for the
case that a packet is rerouted to a device that does
not support IPsec offloading.

Patch 9 adds gso handlers for esp4 and esp6, this implements
the software fallback for GSO packets.

Patch 10 adds xfrm_replay_overflow functions for offloading.

Patch 11 changes ESP to use a synchronous crypto algorithm
on offloading, we don't have the option for asynchronous
returns when we handle IPsec at layer2.

Patch 12 adds a xfrm validate function to validate_xmit_skb.
This implements the software fallback for non GSO packets.

Patch 13 sets the inner_network and inner_transport members of
the SKB, as well as encapsulation, to reflect the actual positions
of these headers, and removes them only once encryption is done
on the payload.

Patch 14 prepares the ESP GRO codepath for hardware offloading.