Commit fa453523 authored by Huy Nguyen's avatar Huy Nguyen Committed by Saeed Mahameed

net/xfrm: Add inner_ipproto into sec_path

The inner_ipproto saves the inner IP protocol of the plain
text packet. This allows vendor's IPsec feature making offload
decision at skb's features_check and configuring hardware at
ndo_start_xmit.

For example, ConnectX6-DX IPsec device needs the plaintext's
IP protocol to support partial checksum offload on
VXLAN/GENEVE packet over IPsec transport mode tunnel.
Signed-off-by: default avatarRaed Salem <raeds@nvidia.com>
Signed-off-by: default avatarHuy Nguyen <huyn@nvidia.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
parent dd7cf00f
...@@ -1024,6 +1024,7 @@ struct xfrm_offload { ...@@ -1024,6 +1024,7 @@ struct xfrm_offload {
#define CRYPTO_INVALID_PROTOCOL 128 #define CRYPTO_INVALID_PROTOCOL 128
__u8 proto; __u8 proto;
__u8 inner_ipproto;
}; };
struct sec_path { struct sec_path {
......
...@@ -565,6 +565,42 @@ static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb ...@@ -565,6 +565,42 @@ static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb
return 0; return 0;
} }
/* For partial checksum offload, the outer header checksum is calculated
* by software and the inner header checksum is calculated by hardware.
* This requires hardware to know the inner packet type to calculate
* the inner header checksum. Save inner ip protocol here to avoid
* traversing the packet in the vendor's xmit code.
* If the encap type is IPIP, just save skb->inner_ipproto. Otherwise,
* get the ip protocol from the IP header.
*/
static void xfrm_get_inner_ipproto(struct sk_buff *skb)
{
struct xfrm_offload *xo = xfrm_offload(skb);
const struct ethhdr *eth;
if (!xo)
return;
if (skb->inner_protocol_type == ENCAP_TYPE_IPPROTO) {
xo->inner_ipproto = skb->inner_ipproto;
return;
}
if (skb->inner_protocol_type != ENCAP_TYPE_ETHER)
return;
eth = (struct ethhdr *)skb_inner_mac_header(skb);
switch (ntohs(eth->h_proto)) {
case ETH_P_IPV6:
xo->inner_ipproto = inner_ipv6_hdr(skb)->nexthdr;
break;
case ETH_P_IP:
xo->inner_ipproto = inner_ip_hdr(skb)->protocol;
break;
}
}
int xfrm_output(struct sock *sk, struct sk_buff *skb) int xfrm_output(struct sock *sk, struct sk_buff *skb)
{ {
struct net *net = dev_net(skb_dst(skb)->dev); struct net *net = dev_net(skb_dst(skb)->dev);
...@@ -594,12 +630,15 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) ...@@ -594,12 +630,15 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
kfree_skb(skb); kfree_skb(skb);
return -ENOMEM; return -ENOMEM;
} }
skb->encapsulation = 1;
sp->olen++; sp->olen++;
sp->xvec[sp->len++] = x; sp->xvec[sp->len++] = x;
xfrm_state_hold(x); xfrm_state_hold(x);
if (skb->encapsulation)
xfrm_get_inner_ipproto(skb);
skb->encapsulation = 1;
if (skb_is_gso(skb)) { if (skb_is_gso(skb)) {
if (skb->inner_protocol) if (skb->inner_protocol)
return xfrm_output_gso(net, sk, skb); return xfrm_output_gso(net, sk, skb);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment