netdev - Re: kTLS broken somewhere between 4.18 and 5.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5cd19a06c0ec1_7e362b112aa185b8da@john-XPS-13-9360.notmuch>
Date:   Tue, 07 May 2019 07:45:26 -0700
From:   John Fastabend <john.fastabend@...il.com>
To:     Andre Tomt <andre@...t.net>,
        John Fastabend <john.fastabend@...il.com>,
        "Steinar H. Gunderson" <steinar+kernel@...derson.no>,
        netdev@...r.kernel.org, Daniel Borkmann <daniel@...earbox.net>
Subject: Re: kTLS broken somewhere between 4.18 and 5.0

Andre Tomt wrote:
> On 14.04.2019 22:40, John Fastabend wrote:
> > On 4/13/19 6:56 PM, Andre Tomt wrote:
> >> On 13.04.2019 17:34, Steinar H. Gunderson wrote:
> >>> Hi,
> >>>
> >>> I've been using kTLS for a while, with my video reflector Cubemap
> >>> (https://git.sesse.net/?p=cubemap). After I upgraded my server from
> >>> 4.18.11 to 5.0.6, seemingly I've started seeing corruption. The data sent
> >>> with send() (HTTP headers, HLS playlists) appears to be fine, but sendfile()
> >>> (actual video data, from a file on tmpfs) is not; after ~20 kB of data
> >>> (19626 in one test here), the data appears to be randomly corrupted. Diffing
> >>> non-TLS (good) and TLS (bad) video data:

[...]

> Hi John
> 
> Have you had any luck tracking this down?
> 
> Just gave net.git a spin and it is still serving up corrupted data when 
> ktls is active and using sendfile.  FWIW I only tested without ktls 
> offload capable hardware (ie in software mode) and no bpf. Same sendfile 
> usage on a non-ktls socket works fine.

Hi Andre, I should have a series to address this in the next few days. I
still need to resolve a couple corner cases. Hopefully, by next week we
can get bpf tree working for this case.

Thanks,
John