nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

net/xfrm: Add inner_ipproto into sec_path

Browse source 
The inner_ipproto saves the inner IP protocol of the plain
text packet. This allows vendor's IPsec feature making offload
decision at skb's features_check and configuring hardware at
ndo_start_xmit.

For example, ConnectX6-DX IPsec device needs the plaintext's
IP protocol to support partial checksum offload on
VXLAN/GENEVE packet over IPsec transport mode tunnel.

Signed-off-by: Raed Salem <raeds@nvidia.com>
Signed-off-by: Huy Nguyen <huyn@nvidia.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
This commit is contained in:
Huy Nguyen 2021-06-14 17:33:48 +03:00 committed by Saeed Mahameed
parent dd7cf00f87
commit fa4535238f
2 changed files with 41 additions and 1 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

1
include/net/xfrm.h
View file

@ -1024,6 +1024,7 @@ struct xfrm_offload {
#define CRYPTO_INVALID_PROTOCOL 128 #define CRYPTO_INVALID_PROTOCOL 128
__u8 proto; __u8 proto;
__u8 inner_ipproto;
}; };
struct sec_path { struct sec_path {

41
net/xfrm/xfrm_output.c
View file

@ -565,6 +565,42 @@ static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb
return 0; return 0;
} }
/* For partial checksum offload, the outer header checksum is calculated
* by software and the inner header checksum is calculated by hardware.
* This requires hardware to know the inner packet type to calculate
* the inner header checksum. Save inner ip protocol here to avoid
* traversing the packet in the vendor's xmit code.
* If the encap type is IPIP, just save skb->inner_ipproto. Otherwise,
* get the ip protocol from the IP header.
*/
static void xfrm_get_inner_ipproto(struct sk_buff *skb)
{
struct xfrm_offload *xo = xfrm_offload(skb);
const struct ethhdr *eth;
if (!xo)
return;
if (skb->inner_protocol_type == ENCAP_TYPE_IPPROTO) {
xo->inner_ipproto = skb->inner_ipproto;
return;
}
if (skb->inner_protocol_type != ENCAP_TYPE_ETHER)
return;
eth = (struct ethhdr *)skb_inner_mac_header(skb);
switch (ntohs(eth->h_proto)) {
case ETH_P_IPV6:
xo->inner_ipproto = inner_ipv6_hdr(skb)->nexthdr;
break;
case ETH_P_IP:
xo->inner_ipproto = inner_ip_hdr(skb)->protocol;
break;
}
}
int xfrm_output(struct sock *sk, struct sk_buff *skb) int xfrm_output(struct sock *sk, struct sk_buff *skb)
{ {
struct net *net = dev_net(skb_dst(skb)->dev); struct net *net = dev_net(skb_dst(skb)->dev);
@ -594,12 +630,15 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
kfree_skb(skb); kfree_skb(skb);
return -ENOMEM; return -ENOMEM;
} }
skb->encapsulation = 1;
sp->olen++; sp->olen++;
sp->xvec[sp->len++] = x; sp->xvec[sp->len++] = x;
xfrm_state_hold(x); xfrm_state_hold(x);
if (skb->encapsulation)
xfrm_get_inner_ipproto(skb);
skb->encapsulation = 1;
if (skb_is_gso(skb)) { if (skb_is_gso(skb)) {
if (skb->inner_protocol) if (skb->inner_protocol)
return xfrm_output_gso(net, sk, skb); return xfrm_output_gso(net, sk, skb);