Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-01 10:43:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

xfrm: Support crypto offload for outbound IPv4 UDP-encapsulated ESP packet

Browse Source 
esp_xmit() is already able to handle UDP encapsulation through the call to
esp_output_head(). However, the ESP header and the outer IP header
are not correct and need to be corrected.

Test: Enabled both dir=in/out IPsec crypto offload, and verified IPv4
      UDP-encapsulated ESP packets on both wifi/cellular network
Signed-off-by: Mike Yu <yumike@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Mike Yu 2024-07-12 10:51:25 +08:00 committed by Steffen Klassert
parent 4ecbac84b5
commit 447bc4b190
2 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
net/ipv4/esp4.c
View File

@ -349,6 +349,7 @@ static struct ip_esp_hdr *esp_output_udp_encap(struct sk_buff *skb,
{
struct udphdr *uh;
unsigned int len;
struct xfrm_offload *xo = xfrm_offload(skb);
len = skb->len + esp->tailen - skb_transport_offset(skb);
if (len + sizeof(struct iphdr) > IP_MAX_MTU)
@ -360,7 +361,12 @@ static struct ip_esp_hdr *esp_output_udp_encap(struct sk_buff *skb,
uh->len = htons(len);
uh->check = 0;
*skb_mac_header(skb) = IPPROTO_UDP;
/* For IPv4 ESP with UDP encapsulation, if xo is not null, the skb is in the crypto offload
* data path, which means that esp_output_udp_encap is called outside of the XFRM stack.
* In this case, the mac header doesn't point to the IPv4 protocol field, so don't set it.
*/
if (!xo || encap_type != UDP_ENCAP_ESPINUDP)
*skb_mac_header(skb) = IPPROTO_UDP;
return (struct ip_esp_hdr *)(uh + 1);
}

17
net/ipv4/esp4_offload.c
View File

@ -264,6 +264,7 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_
struct esp_info esp;
bool hw_offload = true;
__u32 seq;
int encap_type = 0;
esp.inplace = true;
@ -296,8 +297,10 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_
esp.esph = ip_esp_hdr(skb);
if (x->encap)
encap_type = x->encap->encap_type;
if (!hw_offload || !skb_is_gso(skb)) {
if (!hw_offload || !skb_is_gso(skb) || (hw_offload && encap_type == UDP_ENCAP_ESPINUDP)) {
esp.nfrags = esp_output_head(x, skb, &esp);
if (esp.nfrags < 0)
return esp.nfrags;
@ -324,6 +327,18 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_
esp.seqno = cpu_to_be64(seq + ((u64)xo->seq.hi << 32));
if (hw_offload && encap_type == UDP_ENCAP_ESPINUDP) {
/* In the XFRM stack, the encapsulation protocol is set to iphdr->protocol by
* setting *skb_mac_header(skb) (see esp_output_udp_encap()) where skb->mac_header
* points to iphdr->protocol (see xfrm4_tunnel_encap_add()).
* However, in esp_xmit(), skb->mac_header doesn't point to iphdr->protocol.
* Therefore, the protocol field needs to be corrected.
*/
ip_hdr(skb)->protocol = IPPROTO_UDP;
esph->seq_no = htonl(seq);
}
ip_hdr(skb)->tot_len = htons(skb->len);
ip_send_check(ip_hdr(skb));