linux-toradex.git/drivers/net/netdevsim/ipsec.c, branch v6.11-rc5

netdevsim: Fill IPsec state validation failure reason

2023-01-27T00:28:48+00:00

Rely on extack to return failure reason.

Signed-off-by: Leon Romanovsky 
Signed-off-by: Jakub Kicinski

xfrm: extend add state callback to set failure reason

2023-01-27T00:28:48+00:00

Almost all validation logic is in the drivers, but they are
missing reliable way to convey failure reason to userspace
applications.

Let's use extack to return this information to users.

Signed-off-by: Leon Romanovsky 
Signed-off-by: Jakub Kicinski

xfrm: allow state packet offload mode

2022-12-05T09:32:44+00:00

Allow users to configure xfrm states with packet offload mode.
The packet mode must be requested both for policy and state, and
such requires us to do not implement fallback.

We explicitly return an error if requested packet mode can't
be configured.

Reviewed-by: Raed Salem 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Steffen Klassert

netdevsim: rely on XFRM state direction instead of flags

2022-05-06T06:34:33+00:00

Make sure that netdevsim relies on direction and not on flags.

Reviewed-by: Raed Salem 
Signed-off-by: Leon Romanovsky 
Acked-by: Jakub Kicinski 
Signed-off-by: Steffen Klassert

net: netdevsim: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops

2021-07-06T17:36:59+00:00

There are two pointers in struct xfrm_state_offload, *dev, *real_dev.
These are used in callback functions of struct xfrmdev_ops.
The *dev points whether bonding interface or real interface.
If bonding ipsec offload is used, it points bonding interface If not,
it points real interface.
And real_dev always points real interface.
So, netdevsim should always use real_dev instead of dev.
Of course, real_dev always not be null.

Test commands:
    ip netns add A
    ip netns exec A bash
    modprobe netdevsim
    echo "1 1" > /sys/bus/netdevsim/new_device
    ip link add bond0 type bond mode active-backup
    ip link set eth0 master bond0
    ip link set eth0 up
    ip link set bond0 up
    ip x s add proto esp dst 14.1.1.1 src 15.1.1.1 spi 0x07 mode \
transport reqid 0x07 replay-window 32 aead 'rfc4106(gcm(aes))' \
0x44434241343332312423222114131211f4f3f2f1 128 sel src 14.0.0.52/24 \
dst 14.0.0.70/24 proto tcp offload dev bond0 dir in

Splat looks like:
BUG: spinlock bad magic on CPU#5, kworker/5:1/53
 lock: 0xffff8881068c2cc8, .magic: 11121314, .owner: /-1,
.owner_cpu: -235736076
CPU: 5 PID: 53 Comm: kworker/5:1 Not tainted 5.13.0-rc3+ #1168
Workqueue: events linkwatch_event
Call Trace:
 dump_stack+0xa4/0xe5
 do_raw_spin_lock+0x20b/0x270
 ? rwlock_bug.part.1+0x90/0x90
 _raw_spin_lock_nested+0x5f/0x70
 bond_get_stats+0xe4/0x4c0 [bonding]
 ? rcu_read_lock_sched_held+0xc0/0xc0
 ? bond_neigh_init+0x2c0/0x2c0 [bonding]
 ? dev_get_alias+0xe2/0x190
 ? dev_get_port_parent_id+0x14a/0x360
 ? rtnl_unregister+0x190/0x190
 ? dev_get_phys_port_name+0xa0/0xa0
 ? memset+0x1f/0x40
 ? memcpy+0x38/0x60
 ? rtnl_phys_switch_id_fill+0x91/0x100
 dev_get_stats+0x8c/0x270
 rtnl_fill_stats+0x44/0xbe0
 ? nla_put+0xbe/0x140
 rtnl_fill_ifinfo+0x1054/0x3ad0
[ ... ]

Fixes: 272c2330adc9 ("xfrm: bail early on slave pass over skb")
Signed-off-by: Taehee Yoo 
Signed-off-by: David S. Miller

net: netdevsim: Use scnprintf() for avoiding potential buffer overflow

2020-03-16T00:06:22+00:00

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Cc: "David S . Miller" 
Cc: Jakub Kicinski 
Cc: netdev@vger.kernel.org
Signed-off-by: Takashi Iwai 
Signed-off-by: David S. Miller

netdevsim: move netdev creation/destruction to dev probe

2019-04-26T05:52:03+00:00

Remove the existing way to create netdevsim over rtnetlink and move the
netdev creation/destruction to dev probe, so for every probed port,
a netdevsim-netdev instance is created.

Adjust selftests to work with new interface.

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller

drivers: net: netdevsim: use skb_sec_path helper

2018-12-19T19:21:37+00:00

... so this won't have to be changed when skb->sp goes away.

v2: no changes, preserve ack.

Acked-by: Shannon Nelson 
Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller

netdevsim: fix sa_idx out of bounds check

2018-07-02T11:35:33+00:00

Currently if sa_idx is equal to NSIM_IPSEC_MAX_SA_COUNT then
an out-of-bounds read on ipsec->sa will occur. Fix the
incorrect bounds check by using >= rather than >.

Detected by CoverityScan, CID#1470226 ("Out-of-bounds-read")

Fixes: 7699353da875 ("netdevsim: add ipsec offload testing")
Signed-off-by: Colin Ian King 
Acked-by: Shannon Nelson 
Signed-off-by: David S. Miller

netdevsim: add ipsec offload testing

2018-06-28T07:10:08+00:00

Implement the IPsec/XFRM offload API for testing.

Signed-off-by: Shannon Nelson 
Reviewed-by: Jakub Kicinski 
Signed-off-by: David S. Miller