netdev - RE: [EXT] Re: Setting security path with IPsec packet offload mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: 
 <DM5PR1801MB1883AE64318EE97C7549471BE323A@DM5PR1801MB1883.namprd18.prod.outlook.com>
Date: Fri, 23 Jun 2023 07:01:06 +0000
From: Bharat Bhushan <bbhushan2@...vell.com>
To: Bharat Bhushan <bbhushan2@...vell.com>, Leon Romanovsky <leon@...nel.org>
CC: Steffen Klassert <steffen.klassert@...unet.com>,
        "herbert@...dor.apana.org.au" <herbert@...dor.apana.org.au>,
        "David S.
 Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>, Jakub
 Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [EXT] Re: Setting security path with IPsec packet offload mode



> -----Original Message-----
> From: Bharat Bhushan <bbhushan2@...vell.com>
> Sent: Friday, June 23, 2023 12:18 PM
> To: Leon Romanovsky <leon@...nel.org>
> Cc: Steffen Klassert <steffen.klassert@...unet.com>;
> herbert@...dor.apana.org.au; David S. Miller <davem@...emloft.net>; Eric
> Dumazet <edumazet@...gle.com>; Jakub Kicinski <kuba@...nel.org>; Paolo
> Abeni <pabeni@...hat.com>; netdev@...r.kernel.org
> Subject: RE: [EXT] Re: Setting security path with IPsec packet offload mode
> 
> Hi Leon,
> 
> > -----Original Message-----
> > From: Leon Romanovsky <leon@...nel.org>
> > Sent: Thursday, June 22, 2023 2:05 PM
> > To: Bharat Bhushan <bbhushan2@...vell.com>
> > Cc: Steffen Klassert <steffen.klassert@...unet.com>;
> > herbert@...dor.apana.org.au; David S. Miller <davem@...emloft.net>;
> > Eric Dumazet <edumazet@...gle.com>; Jakub Kicinski <kuba@...nel.org>;
> > Paolo Abeni <pabeni@...hat.com>; netdev@...r.kernel.org
> > Subject: [EXT] Re: Setting security path with IPsec packet offload
> > mode
> >
> > External Email
> >
> > ----------------------------------------------------------------------
> > On Thu, Jun 22, 2023 at 06:58:06AM +0000, Bharat Bhushan wrote:
> > > Hi All,
> > >
> > > Have a query related to security patch (secpath_set()) with packet
> > > offload
> > mode on egress side. Working to enable ipsec packet offload while
> > Crypto offload is working.
> > > For packet offload xfrm_offload(*skb) returns false in driver. While
> > > looking in
> > xfrm framework, cannot find where security patch (secpath_set()) is
> > set with packet offload mode on egress side.
> >
> > The idea of packet offload is to take plain text packets and perform
> > all needed magic in HW without need from driver and stack to make anything.
> 
> So driver does not know whether it normal packet and will be transmitted
> normally or this will undergo inline ipsec in hardware.
> 
> In our case packet transmit requires a different code flow in driver, to pass some
> extra details in transmit descriptor like state and policy pointers. So is there some
> way driver can find same and extra state and policy details from skb?

s/extra/extract
I mean extract xfrm state and policy details from skb?

Thanks
-Bharat

> 
> Thanks
> -Bharat
> 
> >
> > We don't set secpath in TX path as such packets exit from XFRM as
> > "plain" ones toward HW.
> > It is different in RX, we set there, as XFRM core still needs to
> > perform some code on the arrived packets, before forwarding them to stack.
> >
> > Thanks
> >
> > >
> > > For sure I might be missing something here and looking for help to
> > > understand
> > same. Meantime just tried below hack:
> > >
> > > diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index
> > > ff114d68cc43..8499c0e74a5a 100644
> > > --- a/net/xfrm/xfrm_output.c
> > > +++ b/net/xfrm/xfrm_output.c
> > > @@ -718,12 +718,24 @@ int xfrm_output(struct sock *sk, struct sk_buff
> *skb)
> > >         }
> > >
> > >         if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) {
> > > +               struct sec_path *sp;
> > >                 if (!xfrm_dev_offload_ok(skb, x)) {
> > >                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
> > >                         kfree_skb(skb);
> > >                         return -EHOSTUNREACH;
> > >                 }
> > >
> > > +               sp = secpath_set(skb);
> > > +               if (!sp) {
> > > +                       XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
> > > +                       kfree_skb(skb);
> > > +                       return -ENOMEM;
> > > +               }
> > > +
> > > +               sp->olen++;
> > > +               sp->xvec[sp->len++] = x;
> > > +               xfrm_state_hold(x);
> > > +
> > >                 return xfrm_output_resume(sk, skb, 0);
> > >         }
> > >
> > >
> > > Thanks in advance,
> > > -Bharat
> > >