netdev - Re: [PATCH net-next v1 04/10] net/mlx5e: Prepare IPsec packet reformat code for tunnel mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 15 Apr 2023 11:49:15 +0300
From:   Leon Romanovsky <leon@...nel.org>
To:     "Samudrala, Sridhar" <sridhar.samudrala@...el.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Steffen Klassert <steffen.klassert@...unet.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        netdev@...r.kernel.org, Saeed Mahameed <saeedm@...dia.com>,
        Raed Salem <raeds@...dia.com>, Emeel Hakim <ehakim@...dia.com>,
        Simon Horman <simon.horman@...igine.com>
Subject: Re: [PATCH net-next v1 04/10] net/mlx5e: Prepare IPsec packet
 reformat code for tunnel mode

On Fri, Apr 14, 2023 at 05:40:40PM -0500, Samudrala, Sridhar wrote:
> 
> 
> On 4/13/2023 7:29 AM, Leon Romanovsky wrote:
> > From: Leon Romanovsky <leonro@...dia.com>
> > 
> > Refactor setup_pkt_reformat() function to accommodate future extension
> > to support tunnel mode.
> > 
> > Signed-off-by: Leon Romanovsky <leonro@...dia.com>
> > ---
> >   .../mellanox/mlx5/core/en_accel/ipsec.c       |  1 +
> >   .../mellanox/mlx5/core/en_accel/ipsec.h       |  2 +-
> >   .../mellanox/mlx5/core/en_accel/ipsec_fs.c    | 81 ++++++++++++++-----
> >   3 files changed, 63 insertions(+), 21 deletions(-)
> > 
> > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> > index def01bfde610..359da277c03a 100644
> > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> > @@ -297,6 +297,7 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,
> >   	attrs->upspec.sport = ntohs(x->sel.sport);
> >   	attrs->upspec.sport_mask = ntohs(x->sel.sport_mask);
> >   	attrs->upspec.proto = x->sel.proto;
> > +	attrs->mode = x->props.mode;
> >   	mlx5e_ipsec_init_limits(sa_entry, attrs);
> >   }
> > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
> > index bb89e18b17b4..ae525420a492 100644
> > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
> > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
> > @@ -77,7 +77,7 @@ struct mlx5_replay_esn {
> >   struct mlx5_accel_esp_xfrm_attrs {
> >   	u32   spi;
> > -	u32   flags;
> > +	u32   mode;
> >   	struct aes_gcm_keymat aes_gcm;
> >   	union {
> > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> > index 060be020ca64..6a1ed4114054 100644
> > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> > @@ -10,6 +10,7 @@
> >   #include "lib/fs_chains.h"
> >   #define NUM_IPSEC_FTE BIT(15)
> > +#define MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_SIZE 16
> >   struct mlx5e_ipsec_fc {
> >   	struct mlx5_fc *cnt;
> > @@ -836,40 +837,80 @@ static int setup_modify_header(struct mlx5_core_dev *mdev, u32 val, u8 dir,
> >   	return 0;
> >   }
> > +static int
> > +setup_pkt_transport_reformat(struct mlx5_accel_esp_xfrm_attrs *attrs,
> > +			     struct mlx5_pkt_reformat_params *reformat_params)
> > +{
> > +	u8 *reformatbf;
> > +	__be32 spi;
> > +
> > +	switch (attrs->dir) {
> > +	case XFRM_DEV_OFFLOAD_IN:
> > +		reformat_params->type = MLX5_REFORMAT_TYPE_DEL_ESP_TRANSPORT;
> > +		break;
> > +	case XFRM_DEV_OFFLOAD_OUT:
> > +		if (attrs->family == AF_INET)
> > +			reformat_params->type =
> > +				MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV4;
> > +		else
> > +			reformat_params->type =
> > +				MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV6;
> 
> Is it guaranteed that attrs->family will be either AF_INET or AF_INET6?
> Later patches seem to indicate that this may not be true as they use
> switch statement and includes default case

Yes, we have relevant check in mlx5e_xfrm_validate_state():

   380         if (x->props.family != AF_INET &&
   381             x->props.family != AF_INET6) {
   382                 NL_SET_ERR_MSG_MOD(extack, "Only IPv4/6 xfrm states may be offloaded");
   383                 return -EINVAL;
   384         }

> 

<...>

> > -	if (attrs->family == AF_INET)
> > -		reformat_params.type =
> > -			MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV4;
> > -	else
> > -		reformat_params.type =
> > -			MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV6;
> 
> same here

See my answer above.

Thanks