netdev - Setting security path with IPsec packet offload mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 22 Jun 2023 06:58:06 +0000
From: Bharat Bhushan <bbhushan2@...vell.com>
To: Steffen Klassert <steffen.klassert@...unet.com>,
        "herbert@...dor.apana.org.au" <herbert@...dor.apana.org.au>,
        "David S.
 Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>, Jakub
 Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Setting security path with IPsec packet offload mode

Hi All,

Have a query related to security patch (secpath_set()) with packet offload mode on egress side. Working to enable ipsec packet offload while Crypto offload is working.
For packet offload xfrm_offload(*skb) returns false in driver. While looking in xfrm framework, cannot find where security patch (secpath_set()) is set with packet offload mode on egress side.

For sure I might be missing something here and looking for help to understand same. Meantime just tried below hack:

diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index ff114d68cc43..8499c0e74a5a 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -718,12 +718,24 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
        }
 
        if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) {
+               struct sec_path *sp;
                if (!xfrm_dev_offload_ok(skb, x)) {
                        XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
                        kfree_skb(skb);
                        return -EHOSTUNREACH;
                }
 
+               sp = secpath_set(skb);
+               if (!sp) {
+                       XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
+                       kfree_skb(skb);
+                       return -ENOMEM;
+               }
+
+               sp->olen++;
+               sp->xvec[sp->len++] = x;
+               xfrm_state_hold(x);
+
                return xfrm_output_resume(sk, skb, 0);
        }
 

Thanks in advance,
-Bharat