netdev - Re: [PATCH bpf-next 1/2] bpf: add skcipher API support to TC/XDP programs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231026144759.5ce20f4c@kernel.org>
Date: Thu, 26 Oct 2023 14:47:59 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Vadim Fedorenko <vadfed@...a.com>
Cc: Martin KaFai Lau <martin.lau@...ux.dev>, Andrii Nakryiko
 <andrii@...nel.org>, Alexei Starovoitov <ast@...nel.org>, Mykola Lysenko
 <mykolal@...com>, Vadim Fedorenko <vadim.fedorenko@...ux.dev>,
 <bpf@...r.kernel.org>, <netdev@...r.kernel.org>
Subject: Re: [PATCH bpf-next 1/2] bpf: add skcipher API support to TC/XDP
 programs

On Wed, 25 Oct 2023 18:59:37 -0700 Vadim Fedorenko wrote:
> Add crypto API support to BPF to be able to decrypt or encrypt packets
> in TC/XDP BPF programs. Only symmetric key ciphers are supported for
> now. Special care should be taken for initialization part of crypto algo
> because crypto_alloc_sync_skcipher() doesn't work with preemtion
> disabled, it can be run only in sleepable BPF program. Also async crypto
> is not supported because of the very same issue - TC/XDP BPF programs
> are not sleepable.

Do CC crypto@ for the next version, please.

> +/**
> + * struct bpf_crypto_skcipher_ctx - refcounted BPF sync skcipher context structure
> + * @tfm:	The pointer to crypto_sync_skcipher struct.
> + * @rcu:	The RCU head used to free the crypto context with RCU safety.
> + * @usage:	Object reference counter. When the refcount goes to 0, the
> + *		memory is released back to the BPF allocator, which provides
> + *		RCU safety.
> + */
> +

spurious newline?

> +struct bpf_crypto_skcipher_ctx {

> +/**
> + * bpf_crypto_skcipher_ctx_acquire() - Acquire a reference to a BPF crypto context.

The contexts are refcounted and can be placed in maps?
Does anything prevent them from being used simultaneously 
by difference CPUs?

> +	case BPF_DYNPTR_TYPE_SKB:
> +		return skb_pointer_if_linear(ptr->data, ptr->offset, __bpf_dynptr_size(ptr));

dynptr takes care of checking if skb can be written to?