netdev - Re: [PATCH net-next V2 5/8] net/bonding: Implement TLS TX device offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 17 Jan 2021 13:04:41 +0200
From:   Tariq Toukan <ttoukan.linux@...il.com>
To:     Jakub Kicinski <kuba@...nel.org>, Tariq Toukan <tariqt@...dia.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Boris Pismenny <borisp@...dia.com>, netdev@...r.kernel.org,
        Moshe Shemesh <moshe@...dia.com>,
        Jay Vosburgh <j.vosburgh@...il.com>,
        Veaceslav Falico <vfalico@...il.com>,
        Andy Gospodarek <andy@...yhouse.net>,
        John Fastabend <john.fastabend@...il.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Jarod Wilson <jarod@...hat.com>,
        Ivan Vecera <ivecera@...hat.com>
Subject: Re: [PATCH net-next V2 5/8] net/bonding: Implement TLS TX device
 offload



On 1/17/2021 4:54 AM, Jakub Kicinski wrote:
> On Thu, 14 Jan 2021 20:01:32 +0200 Tariq Toukan wrote:
>> As the bond interface is being bypassed by the TLS module, interacting
>> directly against the slaves, there is no way for the bond interface to
>> disable its device offload capabilities, as long as the mode/policy
>> config allows it.
>> Hence, the feature flag is not directly controllable, but just reflects
>> the current offload status based on the logic under bond_sk_check().
> 
> In that case why set it in ->hw_features ?
> IIRC features set only in ->features but not ->hw_features show up to
> userspace as "fixed" which I gather is what we want here, no?
> 

On one hand, by showing "off [Fixed]" we might hide the fact that bond 
driver now does support the TLS offload feature, you simply need to 
choose the proper mode/xmit_policy.

On the other hand, as the feature flag toggling has totally no impact, I 
don't see a point in opening it for toggling.

So yeah, I'll fix.


>> +#if IS_ENABLED(CONFIG_TLS_DEVICE)
>> +	bond_dev->hw_features |= BOND_TLS_FEATURES;
>> +	if (bond_sk_check(bond))
>> +		bond_dev->features |= BOND_TLS_FEATURES;
>> +#endif