netdev - Re: [RFC PATCH 0/6] BOND TLS flags fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210526174714.1328af13@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Wed, 26 May 2021 17:47:14 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Tariq Toukan <tariqt@...dia.com>
Cc:     "David S. Miller" <davem@...emloft.net>, <netdev@...r.kernel.org>,
        Moshe Shemesh <moshe@...dia.com>,
        Boris Pismenny <borisp@...dia.com>,
        Saeed Mahameed <saeedm@...dia.com>,
        Maxim Mikityanskiy <maximmi@...dia.com>
Subject: Re: [RFC PATCH 0/6] BOND TLS flags fixes

On Wed, 26 May 2021 12:57:41 +0300 Tariq Toukan wrote:
> This RFC series suggests a solution for the following problem:
> 
> Bond interface and lower interface are both up with TLS RX/TX offloads on.
> TX/RX csum offload is turned off for the upper, hence RX/TX TLS is turned off
> for it as well.
> Yet, although it indicates that feature is disabled, new connections are still
> offloaded by the lower, as Bond has no way to impact that:
> Return value of bond_sk_get_lower_dev() is agnostic to this change.
> 
> One way to solve this issue, is to bring back the Bond TLS operations callbacks,
> i.e. provide implementation for struct tlsdev_ops in Bond.
> This gives full control for the Bond over its features, making it aware of every
> new TLS connection offload request.
> This direction was proposed in the original Bond TLS implementation, but dropped
> during ML review. Probably it's right to re-consider now.
> 
> Here I suggest another solution, which requires generic changes out of the bond
> driver.
> 
> Fixes in patches 1 and 4 are needed anyway, independently to which solution
> we choose. I'll probably submit them separately soon.

No opinions here, semantics of bond features were always clear 
as mud to me. What does it mean that bond survived 20 years without
rx-csum? And it so why would TLS offload be different from what one
may presume the semantics of rx-csum are today? 🤷🏻‍♂️