netdev - Re: pull-request: mlx5-next 2023-01-24 V2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y+RFj3QfGIsmvTab@nvidia.com>
Date:   Wed, 8 Feb 2023 20:59:59 -0400
From:   Jason Gunthorpe <jgg@...dia.com>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     Saeed Mahameed <saeed@...nel.org>,
        Leon Romanovsky <leon@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Paolo Abeni <pabeni@...hat.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Saeed Mahameed <saeedm@...dia.com>, linux-rdma@...r.kernel.org,
        netdev@...r.kernel.org
Subject: Re: pull-request: mlx5-next 2023-01-24 V2

On Wed, Feb 08, 2023 at 04:48:07PM -0800, Jakub Kicinski wrote:
> On Wed, 8 Feb 2023 20:27:17 -0400 Jason Gunthorpe wrote:
> > On Wed, Feb 08, 2023 at 03:19:22PM -0800, Jakub Kicinski wrote:
> > > On Wed, 8 Feb 2023 12:13:00 -0400 Jason Gunthorpe wrote:  
> > > > I can't accept yours because it means RDMA stops existing. So we must
> > > > continue with what has been done for the last 15 years - RDMA
> > > > (selectively) mirrors the IP and everything running at or below the IP
> > > > header level.  
> > > 
> > > Re-implement bits you need for configuration, not stop existing.  
> > 
> > This is completely technically infeasible. They share IP addresess, we
> > cannot have two stacks running IPSEC on top of othe same IP address
> > without co-ordinating. Almost every part is like that to some degree.
> > 
> > And even if we somehow did keep things 100% seperated, with seperated
> > IPs - Linus isn't going to let me copy and paste the huge swaths of
> > core netdev code required to do IP stuff (arp, nd, routing, icmp,
> > bonding, etc) into RDMA for a reason like this.
> > 
> > So, it really is a complete death blow to demand to keep these things
> > separated.
> > 
> > Let alone what would happen if we applied the same logic to all the
> > places sharing the IP with HW - remember iscsi? FCoE?
> 
> Who said IP configuration.

Please explain to me your vision how we could do IPSEC in rdma and
continue to use an IP address owned by netdev while netdev is also
running IPSEC on the same IP address for netdev traffic.

I can't see how it is even technically possible.

Tell me how the NIC knows, on a packet by packet basis, if the IPSEC
or IKE packet should be delivered to netdev or to RDMA.

Jason