From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: linux-mips@linux-mips.org, Netdev <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>
Cc: "Måns Rullgård" <mans@mansr.com>, "Jiri Benc" <jbenc@redhat.com>,
"David Miller" <davem@davemloft.net>,
"Hannes Frederic Sowa" <hannes@stressinduktion.org>,
"Willy Tarreau" <w@1wt.eu>,
"WireGuard mailing list" <wireguard@lists.zx2c4.com>,
"Felix Fietkau" <nbd@nbd.name>
Subject: Re: Misalignment, MIPS, and ip_hdr(skb)->version
Date: Sun, 11 Dec 2016 15:50:31 +0100 [thread overview]
Message-ID: <CAHmME9q5ifwwishXjXYE3J=sVeR4jYY9fLUgs_FHCP594EZr6g@mail.gmail.com> (raw)
In-Reply-To: <20161211071501.GA32621@kroah.com>
Hey guys,
Thanks for the extremely detailed answers. The main take-away from
this is that passing unaligned packets to the networking stack kills
kittens. So now it's a question of mitigation. I have three options:
1. Copy the plaintext to three bytes before the start of the cipher
text, overwriting parts of the header that aren't actually required.
Pros: no changes required, MTU stays small.
Cons: scatterwalk's fast paths aren't hit, which means two page table
mappings are taken instead of one. I have no idea if this actually
matters or will slow down anything relavent.
2. Add 3 bytes to the plaintext header, set to zero, marked for future use.
Pros: satisfies IETF mantras and makes unaligned in-place decryption
straightforward.
Cons: lowers MTU, additional unauthenticated cleartext bits in the
header are of limited utility in protocol.
3. Add 3 bytes of padding, set to zero, to the encrypted section just
before the IP header, marked for future use.
Pros: satisfies IETF mantras, can use those extra bits in the future
for interesting protocol extensions for authenticated peers.
Cons: lowers MTU, marginally more difficult to implement but still
probably just one or two lines of code.
Of these, I'm leaning toward (3).
Anyway, thanks a lot for the input. "Doing nothing" is no longer under
serious consideration, thanks to your messages.
Thanks,
Jason
next prev parent reply other threads:[~2016-12-11 14:44 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-07 18:35 Jason A. Donenfeld
2016-12-07 18:47 ` Dave Taht
2016-12-07 18:51 ` David Miller
2016-12-07 18:54 ` Jason A. Donenfeld
2016-12-07 19:52 ` David Miller
2016-12-08 0:29 ` Jason A. Donenfeld
2016-12-08 0:37 ` David Miller
2016-12-08 22:20 ` Jason A. Donenfeld
2016-12-08 23:14 ` David Miller
2016-12-11 8:07 ` Willy Tarreau
2016-12-11 10:47 ` Måns Rullgård
2016-12-10 12:25 ` Felix Fietkau
2016-12-10 13:25 ` Måns Rullgård
2016-12-10 20:09 ` Felix Fietkau
2016-12-10 20:32 ` Måns Rullgård
2016-12-10 20:36 ` Felix Fietkau
2016-12-12 16:19 ` David Laight
2016-12-12 16:31 ` Måns Rullgård
2016-12-08 0:30 ` Hannes Frederic Sowa
2016-12-08 4:34 ` Daniel Kahn Gillmor
2016-12-09 11:26 ` Jiri Benc
2016-12-10 22:18 ` Dan Lüdtke
2016-12-11 7:15 ` Greg KH
2016-12-11 14:50 ` Jason A. Donenfeld [this message]
2016-12-11 15:30 ` Andrew Lunn
2016-12-11 15:37 ` Jason A. Donenfeld
2016-12-11 16:44 ` Willy Tarreau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHmME9q5ifwwishXjXYE3J=sVeR4jYY9fLUgs_FHCP594EZr6g@mail.gmail.com' \
--to=jason@zx2c4.com \
--cc=davem@davemloft.net \
--cc=hannes@stressinduktion.org \
--cc=jbenc@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@linux-mips.org \
--cc=mans@mansr.com \
--cc=nbd@nbd.name \
--cc=netdev@vger.kernel.org \
--cc=w@1wt.eu \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).