netdev - Re: [PATCH] [PATCH ipsec] xfrm: Store ipsec interface index

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <ZfpnCIv+8eYd7CpO@gauss3.secunet.de>
Date: Wed, 20 Mar 2024 05:33:12 +0100
From: Steffen Klassert <steffen.klassert@...unet.com>
To: Feng Wang <wangfe@...gle.com>
CC: Leon Romanovsky <leon@...nel.org>, <netdev@...r.kernel.org>,
	<herbert@...dor.apana.org.au>, <davem@...emloft.net>
Subject: Re: [PATCH] [PATCH ipsec] xfrm: Store ipsec interface index

On Tue, Mar 19, 2024 at 10:15:13AM -0700, Feng Wang wrote:
> Hi Leon,
> 
> There is no "packet offload driver" in the current kernel tree.  The packet
> offload driver mostly is vendor specific, it implements hardware packet
> offload.

There are 'packet offload drivers' in the kernel, that's why we
support this kind of offload. We don't add code for proprietary
drivers.

> On Tue, Mar 19, 2024 at 1:42 AM Leon Romanovsky <leon@...nel.org> wrote:
> 
> > On Mon, Mar 18, 2024 at 04:13:28PM -0700, Feng Wang wrote:
> > > From: wangfe <wangfe@...gle.com>
> > >
> > > When there are multiple ipsec sessions, packet offload driver
> > > can use the index to distinguish the packets from the different
> > > sessions even though xfrm_selector are same.
> >
> > Do we have such "packet offload driver" in the kernel tree?
> >
> > Thanks
> >
> > > Thus each packet is handled corresponding to its session parameter.
> > >
> > > Signed-off-by: wangfe <wangfe@...gle.com>
> > > ---
> > >  net/xfrm/xfrm_interface_core.c | 4 +++-
> > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/net/xfrm/xfrm_interface_core.c
> > b/net/xfrm/xfrm_interface_core.c
> > > index 21d50d75c260..996571af53e5 100644
> > > --- a/net/xfrm/xfrm_interface_core.c
> > > +++ b/net/xfrm/xfrm_interface_core.c
> > > @@ -506,7 +506,9 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device
> > *dev, struct flowi *fl)
> > >       xfrmi_scrub_packet(skb, !net_eq(xi->net, dev_net(dev)));
> > >       skb_dst_set(skb, dst);
> > >       skb->dev = tdev;
> > > -
> > > +#ifdef CONFIG_XFRM_OFFLOAD
> > > +     skb->skb_iif = if_id;
> > > +#endif

This looks wrong. The network interface ID is not the same as the xfrm
interface ID.