From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-44.mimecast.com (us-smtp-delivery-44.mimecast.com [205.139.111.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 03F271591F0 for ; Wed, 24 Apr 2024 10:18:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.139.111.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713953902; cv=none; b=fZSSJCWY2roJf2va9Z60ioJ1q7munVaLQoeWb0eZD5ijVwKZe2/qA4ASqnfHhcqKoLcqjX07q7unGmBvuhY/8qXSI2b0fZVdy3TaZq0TxerIwvXPpyegoSmMyJSBHkKq32yx/4xK/CUTTn60Nh2zNjkJB004/78G4otgHYYDsvo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713953902; c=relaxed/simple; bh=Ms/kL5uYZ8RGAy+Ewand3vQOkDQURuccLAcO7HmSPd4=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: In-Reply-To:Content-Type:Content-Disposition; b=s8s+VPKa0d3gr6gIPiP3IWX5F587NJAS401321qJecw7dhUjqWQNF25nl22koNQOEXJ72thfpHMXjo4nbPl1YsrMhpzQirKU80LpGtV5g4l4P42VNsKuwJb6CQImPl2Kbvv2kFBfmjuESrOr7h8ZBJwM9CV8WHt5Mo33e0hTQec= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=queasysnail.net; spf=none smtp.mailfrom=queasysnail.net; arc=none smtp.client-ip=205.139.111.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=queasysnail.net Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=queasysnail.net Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-160-an_liTfIMIWa-05WnuWjYg-1; Wed, 24 Apr 2024 06:18:14 -0400 X-MC-Unique: an_liTfIMIWa-05WnuWjYg-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.rdu2.redhat.com [10.11.54.7]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 187CF38049FC; Wed, 24 Apr 2024 10:18:14 +0000 (UTC) Received: from hog (unknown [10.39.193.137]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 63AFF1C060D0; Wed, 24 Apr 2024 10:18:12 +0000 (UTC) Date: Wed, 24 Apr 2024 12:18:11 +0200 From: Sabrina Dubroca To: Rahul Rameshbabu Cc: netdev@vger.kernel.org, stable@vger.kernel.org, Jakub Kicinski , Eric Dumazet , "David S. Miller" , Paolo Abeni , Gal Pressman , Tariq Toukan , Yossi Kuperman , Benjamin Poirier , Cosmin Ratiu Subject: Re: [PATCH net-next 2/3] macsec: Detect if Rx skb is macsec-related for offloading devices that update md_dst Message-ID: References: <20240419011740.333714-1-rrameshbabu@nvidia.com> <20240419011740.333714-3-rrameshbabu@nvidia.com> <87mspp6xh7.fsf@nvidia.com> <87plugpqrk.fsf@nvidia.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 In-Reply-To: <87plugpqrk.fsf@nvidia.com> X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.7 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: queasysnail.net Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable 2024-04-22, 22:55:02 -0700, Rahul Rameshbabu wrote: > On Mon, 22 Apr, 2024 11:23:05 +0200 Sabrina Dubroca = wrote: > > 2024-04-19, 11:01:20 -0700, Rahul Rameshbabu wrote: > >> On Fri, 19 Apr, 2024 17:05:52 +0200 Sabrina Dubroca wrote: > >> > 2024-04-18, 18:17:16 -0700, Rahul Rameshbabu wrote: > >> > >> >> +=09=09=09/* This datapath is insecure because it is unable to > >> >> +=09=09=09 * enforce isolation of broadcast/multicast traffic and > >> >> +=09=09=09 * unicast traffic with promiscuous mode on the macsec > >> >> +=09=09=09 * netdev. Since the core stack has no mechanism to > >> >> +=09=09=09 * check that the hardware did indeed receive MACsec > >> >> +=09=09=09 * traffic, it is possible that the response handling > >> >> +=09=09=09 * done by the MACsec port was to a plaintext packet. > >> >> +=09=09=09 * This violates the MACsec protocol standard. > >> >> +=09=09=09 */ > >> >> +=09=09=09DEBUG_NET_WARN_ON_ONCE(true); > >> > > >> > If you insist on this warning (and I'm not convinced it's useful, > >> > since if the HW is already built and cannot inform the driver, there= 's > >> > nothing the driver implementer can do), I would move it somewhere in= to > >> > the config path. macsec_update_offload would be a better location fo= r > >> > this kind of warning (maybe with a pr_warn (not limited to debug > >> > configs) saying something like "MACsec offload on devices that don't > >> > support md_dst are insecure: they do not provide proper isolation of > >> > traffic"). The comment can stay here. > >> > > >>=20 > >> I do not like the warning either. I left it mainly if it needed furthe= r > >> discussion on the mailing list. Will remove it in my next revision. Th= at > >> said, it may make sense to advertise rx_uses_md_dst over netlink to > >> annotate what macsec offload path a device uses? Just throwing out an > >> idea here. > > > > Maybe. I was also thinking about adding a way to restrict offloading > > only to devices with rx_uses_md_dst. >=20 > That's an option. Basically, devices that do not support rx_uses_md_dst > really only just do SW MACsec but do not return an error if the offload > parameter is passed over netlink so user scripts do not break? Forcing a fallback to SW could be considered a breakage because of the performance regression, so I don't think we can turn this on by default. Then I would simply reject offload on those devices. We could have a compat mode that does the SW fallback you suggest. I don't know if it would be used. > > (Slightly related) I also find it annoying that users have to tell the > > kernel whether to use PHY or MAC offload, but have no way to know > > which one their HW supports. That should probably have been an > > implementation detail that didn't need to be part of uapi :/ >=20 > We could leave the phy / mac netlink keywords and introduce an "on" > option. We deduce whether the device is a phydev or not when on is > passed and set the macsec->offload flag based on that. The phy and mac > options for offload in ip-macsec can then be deprecated. I thought about doing exactly that, and then dropped the idea because it would only help with newer kernels. --=20 Sabrina