pluto: check various incompatible settings with nic-offload=packet|auto

[paulwouters]

• Limit the replay-window size to what is supported in known HW. (but what to do with replay-window=0 and it disabling ESN?)
• Only allow ESP, not AH or IPTFS
• Do not allow compression
• TODO: what about tfcpad= , encap-dscp, nopmtudisc, ikepad, encapsulation,

[bleve]

Looks good.

about replay-window=0 we can't do anything - what happens in that case is defined by rfc, only thing we might do is give warning, but warning like "Warning: reply-window=0 (disable) also disables ESN, not suitable for fast transfer speeds"

[cagney]

Why not probe the hardware.

[letoams]

On Jan 7, 2024, at 12:35, cagney ***@***.***> wrote: Why not probe the hardware.

Combinatory explosion? Not guaranteed the hardware throws an error? It’s worth doing this, once we see more hardware implementations. This is indeed a bit of a bandaid. Perhaps there will be proper features discovery call in Linux in the future ? Note also technically, you might not know over which nic a future IPsec tunnel would go over, so you might not know which interface probe answers to use. Paul

[cagney]

Why not probe the hardware.

Or at least the kernel.[hc]. Adding:

dbg("packet offload replay-window compatible with all known hardware and Linux kernels");

to generic code should, minimally, raise an eyebrow.

Combinatory explosion?
Not guaranteed the hardware throws an error?

It’s worth doing this, once we see more hardware implementations. This is indeed a bit of a bandaid. Perhaps there will be proper features discovery call in Linux in the future ?

Note also technically, you might not know over which nic a future IPsec tunnel would go over, so you might not know which interface probe answers to use.

A valid point. Pluto already handles this though with per-interface hw detection vis:

ifd->nic_offload = kernel_ops_detect_offload(ifp, logger);

However, a grep of where that field is referenced only turns up kernel*.c - shouldn't there be a check in orient() so that a connection with hw-offload=yes only picks those interfaces. Ditto for the above?

[cagney]

BTW

Ditto for the above?

isn't copy the code; rather orient ask the kernel if the interface can support offload with a given set of parameters