On Fri, 19 Apr, 2024 17:05:52 +0200 Sabrina Dubroca sd@queasysnail.net wrote:
2024-04-18, 18:17:16 -0700, Rahul Rameshbabu wrote:
<snip>
/* This datapath is insecure because it is unable to* enforce isolation of broadcast/multicast traffic and* unicast traffic with promiscuous mode on the macsec* netdev. Since the core stack has no mechanism to* check that the hardware did indeed receive MACsec* traffic, it is possible that the response handling* done by the MACsec port was to a plaintext packet.* This violates the MACsec protocol standard.*/DEBUG_NET_WARN_ON_ONCE(true);If you insist on this warning (and I'm not convinced it's useful, since if the HW is already built and cannot inform the driver, there's nothing the driver implementer can do), I would move it somewhere into the config path. macsec_update_offload would be a better location for this kind of warning (maybe with a pr_warn (not limited to debug configs) saying something like "MACsec offload on devices that don't support md_dst are insecure: they do not provide proper isolation of traffic"). The comment can stay here.
I do not like the warning either. I left it mainly if it needed further discussion on the mailing list. Will remove it in my next revision. That said, it may make sense to advertise rx_uses_md_dst over netlink to annotate what macsec offload path a device uses? Just throwing out an idea here.
if (ether_addr_equal_64bits(hdr->h_dest, ndev->dev_addr)) { /* exact match, divert skb to this port */
-- Thanks,
Rahul Rameshbabu