netdev - [PATCH xfrm-next 0/9] mlx5 IPsec replay window enhancement and XFRM core statistics

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 16 Oct 2023 12:15:08 +0300
From: Leon Romanovsky <leon@...nel.org>
To: Steffen Klassert <steffen.klassert@...unet.com>
Cc: Leon Romanovsky <leonro@...dia.com>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	netdev@...r.kernel.org,
	Patrisious Haddad <phaddad@...dia.com>,
	Raed Salem <raeds@...dia.com>,
	Saeed Mahameed <saeedm@...dia.com>
Subject: [PATCH xfrm-next 0/9] mlx5 IPsec replay window enhancement and XFRM core statistics

From: Leon Romanovsky <leonro@...dia.com>

Hi,

This series does two things at the same time, but they are connected together:
 * Rewrite and fix mlx5 IPsec replay window implementation.
 * Connect XFRM statistics with offloaded counters to report replay window
   reason statistics.

First two patches are XFRM core changes to allow reuse of already existing
callback to fill all statistics.

Next two patches are fixes to replay window and sequence packet number
misconfiguration. They are not urgent and can go to -next.

Rest of the patches are rewrite of mlx5 replay window implementation.

As an example, the end result, after simulating replay window attack with 5 packets:
[leonro@c ~]$ grep XfrmInStateSeqError /proc/net/xfrm_stat
XfrmInStateSeqError     	5
[leonro@c ~]$ sudo ip -s x s
<...>
	stats:
	  replay-window 0 replay 5 failed 0

Thanks

Leon Romanovsky (7):
  xfrm: generalize xdo_dev_state_update_curlft to allow statistics
    update
  xfrm: get global statistics from the offloaded device
  net/mlx5e: Honor user choice of IPsec replay window size
  net/mlx5e: Ensure that IPsec sequence packet number starts from 1
  net/mlx5e: Remove exposure of IPsec RX flow steering struct
  net/mlx5e: Connect mlx5 IPsec statistics with XFRM core
  net/mlx5e: Delete obsolete IPsec code

Patrisious Haddad (2):
  net/mlx5e: Unify esw and normal IPsec status table
    creation/destruction
  net/mlx5e: Add IPsec and ASO syndromes check in HW

 Documentation/networking/xfrm_device.rst      |   4 +-
 .../mellanox/mlx5/core/en_accel/ipsec.c       |  57 ++-
 .../mellanox/mlx5/core/en_accel/ipsec.h       |  23 +-
 .../mellanox/mlx5/core/en_accel/ipsec_fs.c    | 410 +++++++++++++++---
 .../mlx5/core/en_accel/ipsec_offload.c        |   2 +-
 .../mellanox/mlx5/core/en_accel/ipsec_rxtx.c  |  25 +-
 .../mellanox/mlx5/core/en_accel/ipsec_rxtx.h  |   1 -
 .../mellanox/mlx5/core/en_accel/ipsec_stats.c |   1 -
 .../mellanox/mlx5/core/esw/ipsec_fs.c         | 160 +------
 .../mellanox/mlx5/core/esw/ipsec_fs.h         |  15 -
 include/linux/mlx5/mlx5_ifc.h                 |   7 +
 include/linux/netdevice.h                     |   2 +-
 include/net/xfrm.h                            |  14 +-
 net/xfrm/xfrm_proc.c                          |   1 +
 net/xfrm/xfrm_state.c                         |  17 +-
 net/xfrm/xfrm_user.c                          |   2 +-
 16 files changed, 459 insertions(+), 282 deletions(-)

-- 
2.41.0