Re: [PATCH ipsec-next v9] xfrm: Add Direction to the SA in or out

[Sabrina Dubroca <sd@queasysnail.net>]

2024-04-10, 09:35:08 +0200, Nicolas Dichtel wrote:
> Le 10/04/2024 à 09:26, Sabrina Dubroca a écrit :
> > 2024-04-10, 08:32:20 +0200, Nicolas Dichtel wrote:
> >> Le 09/04/2024 à 19:56, Antony Antony a écrit :
> >>> v6->v7:
> >>>  - add replay-window check non-esn 0 and ESN 1.
> >>>  - remove :XFRMA_SA_DIR only allowed with HW OFFLOAD
> >> Why? I still think that having an 'input' SA used in the output path is wrong
> >> and confusing.
> >> Please, don't drop this check.
> > 
> > Limiting XFRMA_SA_DIR to only HW offload makes no sense. It's
> > completely redundant with an existing property. We should also try to
> > limit the divergence between offload and non-offload configuration. If
> Sure.
> 
> > something is clearly only for offloaded configs, then fine, but
> > otherwise the APIs should be identical.
> But right now, the property is enforced for offload and but not for non-offload.
> In that sense, the api is not identical. I'm only asking to make this explicit.

We can't get rid of the offload-specific way of setting the direction,
because it's a flag (off = out, on = in), but if we add another way of
setting the direction, it should be for all cases (we already have one
for offload, we don't need a 2nd offload-specific flag), and it should
correctly lock down uses (incompatible options, and use of the SA in
the datapath as you said).

> > And based on what Antony says, this is intended in large part for
> > IPTFS, which is not going to be offloaded any time soon (or probably
> > ever), so that restriction would have to be lifted immediately. I'm
> > not sure why Antony accepted your request.
> I don't see the problem with that. The attribute can be relaxed later for IPTFS
> if needed.

Then we would have landed back on v4 (unless we add the checks we're
discussing now)...

> But there are use cases without offload and without IPTFS.

Sure. That's probably the vast majority of IPsec users.

> Why isn't it possible to restrict the use of an input SA to the input path and
> output SA to xmit path?

Because nobody has written a patch for it yet :)

-- 
Sabrina