netdev - Re: [RFC PATCH 0/6] BOND TLS flags fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 27 May 2021 10:56:30 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Tariq Toukan <ttoukan.linux@...il.com>
Cc:     Tariq Toukan <tariqt@...dia.com>,
        "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
        Moshe Shemesh <moshe@...dia.com>,
        Boris Pismenny <borisp@...dia.com>,
        Saeed Mahameed <saeedm@...dia.com>,
        Maxim Mikityanskiy <maximmi@...dia.com>
Subject: Re: [RFC PATCH 0/6] BOND TLS flags fixes

On Thu, 27 May 2021 17:07:06 +0300 Tariq Toukan wrote:
> On 5/27/2021 3:47 AM, Jakub Kicinski wrote:
> > On Wed, 26 May 2021 12:57:41 +0300 Tariq Toukan wrote:  
> >> This RFC series suggests a solution for the following problem:
> >>
> >> Bond interface and lower interface are both up with TLS RX/TX offloads on.
> >> TX/RX csum offload is turned off for the upper, hence RX/TX TLS is turned off
> >> for it as well.
> >> Yet, although it indicates that feature is disabled, new connections are still
> >> offloaded by the lower, as Bond has no way to impact that:
> >> Return value of bond_sk_get_lower_dev() is agnostic to this change.
> >>
> >> One way to solve this issue, is to bring back the Bond TLS operations callbacks,
> >> i.e. provide implementation for struct tlsdev_ops in Bond.
> >> This gives full control for the Bond over its features, making it aware of every
> >> new TLS connection offload request.
> >> This direction was proposed in the original Bond TLS implementation, but dropped
> >> during ML review. Probably it's right to re-consider now.
> >>
> >> Here I suggest another solution, which requires generic changes out of the bond
> >> driver.
> >>
> >> Fixes in patches 1 and 4 are needed anyway, independently to which solution
> >> we choose. I'll probably submit them separately soon.  
> > 
> > No opinions here, semantics of bond features were always clear
> > as mud to me. What does it mean that bond survived 20 years without
> > rx-csum? And it so why would TLS offload be different from what one
> > may presume the semantics of rx-csum are today?
> 
> Advanced device offloads have basic logical dependencies, that are 
> applied for all kind of netdevs, agnostic to internal details of each 
> netdev.
> 
> Nothing special with TLS really.
> TLS device offload behaves similarly to TSO (needs HW_CSUM), and GRO_HW 
> (needs RXCSUM).
> [...]

Right, the inter-dependency between features is obvious enough. 
What makes a feature be part of UPPER_DISABLES though?