netdev - Re: [PATCH net 7/8] net/mlx5e: Rely on reqid in IPsec tunnel mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <729dfd39-cb1f-4067-bf61-a3d1ca0b70e3@intel.com>
Date: Mon, 13 Jan 2025 11:08:22 -0800
From: Jacob Keller <jacob.e.keller@...el.com>
To: Tariq Toukan <tariqt@...dia.com>, "David S. Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "Eric
 Dumazet" <edumazet@...gle.com>, Andrew Lunn <andrew+netdev@...n.ch>
CC: <netdev@...r.kernel.org>, Saeed Mahameed <saeedm@...dia.com>, Gal Pressman
	<gal@...dia.com>, Leon Romanovsky <leonro@...dia.com>, Mark Bloch
	<mbloch@...dia.com>, Moshe Shemesh <moshe@...dia.com>
Subject: Re: [PATCH net 7/8] net/mlx5e: Rely on reqid in IPsec tunnel mode



On 1/13/2025 7:40 AM, Tariq Toukan wrote:
> From: Leon Romanovsky <leonro@...dia.com>
> 
> All packet offloads SAs have reqid in it to make sure they have
> corresponding policy. While it is not strictly needed for transparent
> mode, it is extremely important in tunnel mode. In that mode, policy and
> SAs have different match criteria.
> 
> Policy catches the whole subnet addresses, and SA catches the tunnel gateways
> addresses. The source address of such tunnel is not known during egress packet
> traversal in flow steering as it is added only after successful encryption.
> 
> As reqid is required for packet offload and it is unique for every SA,
> we can safely rely on it only.
> 
> The output below shows the configured egress policy and SA by strongswan:
> 
> [leonro@vm ~]$ sudo ip x s
> src 192.169.101.2 dst 192.169.101.1
>         proto esp spi 0xc88b7652 reqid 1 mode tunnel
>         replay-window 0 flag af-unspec esn
>         aead rfc4106(gcm(aes)) 0xe406a01083986e14d116488549094710e9c57bc6 128
>         anti-replay esn context:
>          seq-hi 0x0, seq 0x0, oseq-hi 0x0, oseq 0x0
>          replay_window 1, bitmap-length 1
>          00000000
>         crypto offload parameters: dev eth2 dir out mode packet
> 
> [leonro@064 ~]$ sudo ip x p
> src 192.170.0.0/16 dst 192.170.0.0/16
>         dir out priority 383615 ptype main
>         tmpl src 192.169.101.2 dst 192.169.101.1
>                 proto esp spi 0xc88b7652 reqid 1 mode tunnel
>         crypto offload parameters: dev eth2 mode packet
> 
> Fixes: b3beba1fb404 ("net/mlx5e: Allow policies with reqid 0, to support IKE policy holes")
> Signed-off-by: Leon Romanovsky <leonro@...dia.com>
> Signed-off-by: Tariq Toukan <tariqt@...dia.com>
> ---

Reviewed-by: Jacob Keller <jacob.e.keller@...el.com>