netdev - Re: [PATCH ipsec v3 0/4] Support IPsec crypto offload for IPv6 ESP and IPv4 UDP-encapsulated ESP data paths

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240711095208.GN6668@unreal>
Date: Thu, 11 Jul 2024 12:52:08 +0300
From: Leon Romanovsky <leon@...nel.org>
To: steffen.klassert@...unet.com
Cc: Mike Yu <yumike@...gle.com>, netdev@...r.kernel.org,
	stanleyjhu@...gle.com, martinwu@...gle.com,
	chiachangwang@...gle.com
Subject: Re: [PATCH ipsec v3 0/4] Support IPsec crypto offload for IPv6 ESP
 and IPv4 UDP-encapsulated ESP data paths

On Wed, Jul 10, 2024 at 07:16:50PM +0800, Mike Yu wrote:
> Currently, IPsec crypto offload is enabled for GRO code path. However, there
> are other code paths where the XFRM stack is involved; for example, IPv6 ESP
> packets handled by xfrm6_esp_rcv() in ESP layer, and IPv4 UDP-encapsulated
> ESP packets handled by udp_rcv() in UDP layer.
> 
> This patchset extends the crypto offload support to cover these two cases.
> This is useful for devices with traffic accounting (e.g., Android), where GRO
> can lead to inaccurate accounting on the underlying network. For example, VPN
> traffic might not be counted on the wifi network interface wlan0 if the packets
> are handled in GRO code path before entering the network stack for accounting.
> 
> Below is the RX data path scenario the crypto offload can be applied to.
> 
>   +-----------+   +-------+
>   | HW Driver |-->| wlan0 |--------+
>   +-----------+   +-------+        |
>                                    v
>                              +---------------+   +------+
>                      +------>| Network Stack |-->| Apps |
>                      |       +---------------+   +------+
>                      |             |
>                      |             v
>                  +--------+   +------------+
>                  | ipsec1 |<--| XFRM Stack |
>                  +--------+   +------------+
> 
> v2 -> v3:
> - Correct ESP seq in esp_xmit().
> v1 -> v2:
> - Fix comment style.
> 
> Mike Yu (4):
>   xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO
>     path
>   xfrm: Allow UDP encapsulation in crypto offload control path
>   xfrm: Support crypto offload for inbound IPv4 UDP-encapsulated ESP
>     packet
>   xfrm: Support crypto offload for outbound IPv4 UDP-encapsulated ESP
>     packet
> 
>  net/ipv4/esp4.c         |  8 +++++++-
>  net/ipv4/esp4_offload.c | 17 ++++++++++++++++-
>  net/xfrm/xfrm_device.c  |  6 +++---
>  net/xfrm/xfrm_input.c   |  3 ++-
>  net/xfrm/xfrm_policy.c  |  5 ++++-
>  5 files changed, 32 insertions(+), 7 deletions(-)

Steffen,

If it helps, we tested v2 version and it didn't break anything for us :).
But we didn't test this specific functionality.

Thanks

> 
> -- 
> 2.45.2.803.g4e1b14247a-goog
> 
>