netdev - Re: [PATCH ipsec-rc] xfrm: fix tunnel mode TX datapath in packet offload mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z72pd+rQw7BbiQEX@gauss3.secunet.de>
Date: Tue, 25 Feb 2025 12:28:55 +0100
From: Steffen Klassert <steffen.klassert@...unet.com>
To: Leon Romanovsky <leon@...nel.org>
CC: Alexandre Cassen <acassen@...p.free.fr>, <netdev@...r.kernel.org>, "David
 S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
	"Herbert Xu" <herbert@...dor.apana.org.au>, Jakub Kicinski <kuba@...nel.org>,
	"Paolo Abeni" <pabeni@...hat.com>
Subject: Re: [PATCH ipsec-rc] xfrm: fix tunnel mode TX datapath in packet
 offload mode

On Wed, Feb 19, 2025 at 12:20:37PM +0200, Leon Romanovsky wrote:
> From: Alexandre Cassen <acassen@...p.free.fr>
> 
> Packets that match the output xfrm policy are delivered to the netstack.
> In IPsec packet mode for tunnel mode, the HW is responsible for building
> the hard header and outer IP header. In such a situation, the inner
> header may refer to a network that is not directly reachable by the host,
> resulting in a failed neighbor resolution. The packet is then dropped.
> xfrm policy defines the netdevice to use for xmit so we can send packets
> directly to it.
> 
> Makes direct xmit exclusive to tunnel mode, since some rules may apply
> in transport mode.
> 
> Fixes: f8a70afafc17 ("xfrm: add TX datapath support for IPsec packet offload mode")
> Signed-off-by: Alexandre Cassen <acassen@...p.free.fr>
> Signed-off-by: Leon Romanovsky <leonro@...dia.com>

Applied, thanks a lot!