| Message ID | 20250113154055.1927008-8-tariqt@nvidia.com (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | mlx5 misc fixes 2025-01-13 | expand |
On 1/13/2025 7:40 AM, Tariq Toukan wrote: > From: Leon Romanovsky <leonro@nvidia.com> > > All packet offloads SAs have reqid in it to make sure they have > corresponding policy. While it is not strictly needed for transparent > mode, it is extremely important in tunnel mode. In that mode, policy and > SAs have different match criteria. > > Policy catches the whole subnet addresses, and SA catches the tunnel gateways > addresses. The source address of such tunnel is not known during egress packet > traversal in flow steering as it is added only after successful encryption. > > As reqid is required for packet offload and it is unique for every SA, > we can safely rely on it only. > > The output below shows the configured egress policy and SA by strongswan: > > [leonro@vm ~]$ sudo ip x s > src 192.169.101.2 dst 192.169.101.1 > proto esp spi 0xc88b7652 reqid 1 mode tunnel > replay-window 0 flag af-unspec esn > aead rfc4106(gcm(aes)) 0xe406a01083986e14d116488549094710e9c57bc6 128 > anti-replay esn context: > seq-hi 0x0, seq 0x0, oseq-hi 0x0, oseq 0x0 > replay_window 1, bitmap-length 1 > 00000000 > crypto offload parameters: dev eth2 dir out mode packet > > [leonro@064 ~]$ sudo ip x p > src 192.170.0.0/16 dst 192.170.0.0/16 > dir out priority 383615 ptype main > tmpl src 192.169.101.2 dst 192.169.101.1 > proto esp spi 0xc88b7652 reqid 1 mode tunnel > crypto offload parameters: dev eth2 mode packet > > Fixes: b3beba1fb404 ("net/mlx5e: Allow policies with reqid 0, to support IKE policy holes") > Signed-off-by: Leon Romanovsky <leonro@nvidia.com> > Signed-off-by: Tariq Toukan <tariqt@nvidia.com> > --- Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index 47df02ef5d69..772b329aecc5 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -1743,23 +1743,21 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) goto err_alloc; } - if (attrs->family == AF_INET) - setup_fte_addr4(spec, &attrs->saddr.a4, &attrs->daddr.a4); - else - setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6); - setup_fte_no_frags(spec); setup_fte_upper_proto_match(spec, &attrs->upspec); switch (attrs->type) { case XFRM_DEV_OFFLOAD_CRYPTO: + if (attrs->family == AF_INET) + setup_fte_addr4(spec, &attrs->saddr.a4, &attrs->daddr.a4); + else + setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6); setup_fte_spi(spec, attrs->spi, false); setup_fte_esp(spec); setup_fte_reg_a(spec); break; case XFRM_DEV_OFFLOAD_PACKET: - if (attrs->reqid) - setup_fte_reg_c4(spec, attrs->reqid); + setup_fte_reg_c4(spec, attrs->reqid); err = setup_pkt_reformat(ipsec, attrs, &flow_act); if (err) goto err_pkt_reformat;