From patchwork Fri Nov 18 06:35:24 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leon Romanovsky X-Patchwork-Id: 13047749 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5FA4AC4332F for ; Fri, 18 Nov 2022 06:36:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241120AbiKRGf7 (ORCPT ); Fri, 18 Nov 2022 01:35:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47764 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241009AbiKRGfw (ORCPT ); Fri, 18 Nov 2022 01:35:52 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 532B174CD5 for ; Thu, 17 Nov 2022 22:35:50 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F0A42B8229C for ; Fri, 18 Nov 2022 06:35:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 35E74C433C1; Fri, 18 Nov 2022 06:35:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1668753347; bh=9tCTtXs76v/GZvuTuuScTFdMZC4fvPZTd/sX7KDjTyw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dy1RfkUInkh189EiCHATD229BB7tQRkYX5EdUg4P7lZsjNfZExpQp1ZRPnf8zXXEk Gp/XVnNRpcHHrMRkG4d7bsBqJe52K97ecFYmju1T8y4eeN/sV6cHLJEWRgJ4T/NAPW gVd0LFpzkhpkKmkDEdOS1pPHye3Syx1O8aoVnJBEdrjo2tWboQ4xpibJEJzlQKO793 1/UV9HbOasf4yErGjQs58BCe6ZeKUsAgzSrNtpw5sBa7GwSOd/TW428fgAZiulMPMT XUW++UuTVfAl6YjchprhWMjXxGuWDpHVGmroTq1tA+V5go2jCJx6pXlbBU2x/JtR09 3UmvhCudh8XJw== From: Leon Romanovsky To: Steffen Klassert Cc: Leon Romanovsky , "David S. Miller" , Eric Dumazet , Herbert Xu , Jakub Kicinski , netdev@vger.kernel.org, Bharat Bhushan Subject: [PATCH xfrm-next v8 4/8] xfrm: add TX datapath support for IPsec packet offload mode Date: Fri, 18 Nov 2022 08:35:24 +0200 Message-Id: X-Mailer: git-send-email 2.38.1 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Leon Romanovsky In IPsec packet mode, the device is going to encrypt and encapsulate packets that are associated with offloaded policy. After successful policy lookup to indicate if packets should be offloaded or not, the stack forwards packets to the device to do the magic. Signed-off-by: Raed Salem Signed-off-by: Huy Nguyen Signed-off-by: Leon Romanovsky --- net/xfrm/xfrm_device.c | 15 +++++++++++++-- net/xfrm/xfrm_output.c | 12 +++++++++++- net/xfrm/xfrm_policy.c | 21 ++++++++++++++++++++- 3 files changed, 44 insertions(+), 4 deletions(-) diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c index 8e18abc5016f..6affb3d1e204 100644 --- a/net/xfrm/xfrm_device.c +++ b/net/xfrm/xfrm_device.c @@ -120,6 +120,16 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur if (xo->flags & XFRM_GRO || x->xso.dir == XFRM_DEV_OFFLOAD_IN) return skb; + /* The packet was sent to HW IPsec packet offload engine, + * but to wrong device. Drop the packet, so it won't skip + * XFRM stack. + */ + if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET && x->xso.dev != dev) { + kfree_skb(skb); + dev_core_stats_tx_dropped_inc(dev); + return NULL; + } + /* This skb was already validated on the upper/virtual dev */ if ((x->xso.dev != dev) && (x->xso.real_dev == dev)) return skb; @@ -385,8 +395,9 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) if (!x->type_offload || x->encap) return false; - if ((!dev || (dev == xfrm_dst_path(dst)->dev)) && - (!xdst->child->xfrm)) { + if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET || + ((!dev || (dev == xfrm_dst_path(dst)->dev)) && + !xdst->child->xfrm)) { mtu = xfrm_state_mtu(x, xdst->child_mtu_cached); if (skb->len <= mtu) goto ok; diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index 9a5e79a38c67..ce9e360a96e2 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -494,7 +494,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err) struct xfrm_state *x = dst->xfrm; struct net *net = xs_net(x); - if (err <= 0) + if (err <= 0 || x->xso.type == XFRM_DEV_OFFLOAD_PACKET) goto resume; do { @@ -718,6 +718,16 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) break; } + if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) { + if (!xfrm_dev_offload_ok(skb, x)) { + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); + kfree_skb(skb); + return -EHOSTUNREACH; + } + + return xfrm_output_resume(sk, skb, 0); + } + secpath_reset(skb); if (xfrm_dev_offload_ok(skb, x)) { diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 07f43729ac4e..06226942a152 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -2619,6 +2619,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, int tos; int family = policy->selector.family; xfrm_address_t saddr, daddr; + struct dst_entry *dst1; xfrm_flowi_addr_get(fl, &saddr, &daddr, family); @@ -2628,7 +2629,8 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, for (; i < nx; i++) { struct xfrm_dst *xdst = xfrm_alloc_dst(net, family); - struct dst_entry *dst1 = &xdst->u.dst; + + dst1 = &xdst->u.dst; err = PTR_ERR(xdst); if (IS_ERR(xdst)) { @@ -2708,6 +2710,23 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, if (!dev) goto free_dst; + dst1 = &xdst0->u.dst; + /* Packet offload: both policy and SA should be offloaded */ + if ((policy->xdo.type == XFRM_DEV_OFFLOAD_PACKET && + dst1->xfrm->xso.type != XFRM_DEV_OFFLOAD_PACKET) || + (policy->xdo.type != XFRM_DEV_OFFLOAD_PACKET && + dst1->xfrm->xso.type == XFRM_DEV_OFFLOAD_PACKET)) { + err = -EINVAL; + goto free_dst; + } + + /* Packet offload: both policy and SA should have same device */ + if (policy->xdo.type == XFRM_DEV_OFFLOAD_PACKET && + policy->xdo.dev != dst1->xfrm->xso.dev) { + err = -EINVAL; + goto free_dst; + } + xfrm_init_path(xdst0, dst, nfheader_len); xfrm_init_pmtu(bundle, nx);