| Message ID | 20210414232540.138232-3-saeed@kernel.org |
|---|---|
| State | New |
| Headers | show |
| Series | Fix ipsec offlaods with vxlan tunnel | expand |
On Wed, Apr 14, 2021 at 04:25:39PM -0700, Saeed Mahameed wrote: > From: Huy Nguyen <huyn@nvidia.com> > > The inner_ipproto saves the inner IP protocol of the plain > text packet. This allows vendor's IPsec feature making offload > decision at skb's features_check and configuring hardware at > ndo_start_xmit. > > For example, ConnectX6-DX IPsec device needs the plaintext's > IP protocol to support partial checksum offload on > VXLAN/GENEVE packet over IPsec transport mode tunnel. > > Signed-off-by: Raed Salem <raeds@nvidia.com> > Signed-off-by: Huy Nguyen <huyn@nvidia.com> > Cc: Steffen Klassert <steffen.klassert@secunet.com> > --- > include/net/xfrm.h | 1 + > net/xfrm/xfrm_output.c | 36 +++++++++++++++++++++++++++++++++++- > 2 files changed, 36 insertions(+), 1 deletion(-) > > diff --git a/include/net/xfrm.h b/include/net/xfrm.h > index c58a6d4eb610..e535700431fb 100644 > --- a/include/net/xfrm.h > +++ b/include/net/xfrm.h > @@ -1032,6 +1032,7 @@ struct sec_path { > > struct xfrm_state *xvec[XFRM_MAX_DEPTH]; > struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH]; > + u8 inner_ipproto; This is for offload, so it should go to struct xfrm_offload. We have already 'proto' there, so it is just easy add 'inner_proto'.
On Wed, 14 Apr 2021 16:25:39 -0700 Saeed Mahameed wrote: > +static void get_inner_ipproto(struct sk_buff *skb, struct sec_path *sp) > +{ > + const struct ethhdr *eth; > + > + if (!skb->inner_protocol) > + return; > + > + if (skb->inner_protocol_type == ENCAP_TYPE_IPPROTO) { > + sp->inner_ipproto = skb->inner_protocol; > + return; > + } > + > + if (skb->inner_protocol_type != ENCAP_TYPE_ETHER) > + return; > + > + eth = (struct ethhdr *)skb_inner_mac_header(skb); > + > + switch (eth->h_proto) { > + case ntohs(ETH_P_IPV6): > + sp->inner_ipproto = inner_ipv6_hdr(skb)->nexthdr; > + break; > + case ntohs(ETH_P_IP): > + sp->inner_ipproto = inner_ip_hdr(skb)->protocol; > + break; > + default: > + return; > + } > +} Bunch of sparse warnings here, please check.
I fixed. Thank you. Saeed will resubmit. On 4/15/2021 12:00 PM, Jakub Kicinski wrote: > On Wed, 14 Apr 2021 16:25:39 -0700 Saeed Mahameed wrote: >> +static void get_inner_ipproto(struct sk_buff *skb, struct sec_path *sp) >> +{ >> + const struct ethhdr *eth; >> + >> + if (!skb->inner_protocol) >> + return; >> + >> + if (skb->inner_protocol_type == ENCAP_TYPE_IPPROTO) { >> + sp->inner_ipproto = skb->inner_protocol; >> + return; >> + } >> + >> + if (skb->inner_protocol_type != ENCAP_TYPE_ETHER) >> + return; >> + >> + eth = (struct ethhdr *)skb_inner_mac_header(skb); >> + >> + switch (eth->h_proto) { >> + case ntohs(ETH_P_IPV6): >> + sp->inner_ipproto = inner_ipv6_hdr(skb)->nexthdr; >> + break; >> + case ntohs(ETH_P_IP): >> + sp->inner_ipproto = inner_ip_hdr(skb)->protocol; >> + break; >> + default: >> + return; >> + } >> +} > Bunch of sparse warnings here, please check.
diff --git a/include/net/xfrm.h b/include/net/xfrm.h index c58a6d4eb610..e535700431fb 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -1032,6 +1032,7 @@ struct sec_path { struct xfrm_state *xvec[XFRM_MAX_DEPTH]; struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH]; + u8 inner_ipproto; }; struct sec_path *secpath_set(struct sk_buff *skb); diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index e4cb0ff4dcf4..da412928093b 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -565,6 +565,36 @@ static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb return 0; } +/* Save inner ip protocol for vendor offload usage */ +static void get_inner_ipproto(struct sk_buff *skb, struct sec_path *sp) +{ + const struct ethhdr *eth; + + if (!skb->inner_protocol) + return; + + if (skb->inner_protocol_type == ENCAP_TYPE_IPPROTO) { + sp->inner_ipproto = skb->inner_protocol; + return; + } + + if (skb->inner_protocol_type != ENCAP_TYPE_ETHER) + return; + + eth = (struct ethhdr *)skb_inner_mac_header(skb); + + switch (eth->h_proto) { + case ntohs(ETH_P_IPV6): + sp->inner_ipproto = inner_ipv6_hdr(skb)->nexthdr; + break; + case ntohs(ETH_P_IP): + sp->inner_ipproto = inner_ip_hdr(skb)->protocol; + break; + default: + return; + } +} + int xfrm_output(struct sock *sk, struct sk_buff *skb) { struct net *net = dev_net(skb_dst(skb)->dev); @@ -594,8 +624,12 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) kfree_skb(skb); return -ENOMEM; } - skb->encapsulation = 1; + sp->inner_ipproto = 0; + if (skb->encapsulation) + get_inner_ipproto(skb, sp); + + skb->encapsulation = 1; sp->olen++; sp->xvec[sp->len++] = x; xfrm_state_hold(x);