Commit 447bc4b1 authored by Mike Yu's avatar Mike Yu Committed by Steffen Klassert
Browse files

xfrm: Support crypto offload for outbound IPv4 UDP-encapsulated ESP packet 



esp_xmit() is already able to handle UDP encapsulation through the call to
esp_output_head(). However, the ESP header and the outer IP header
are not correct and need to be corrected.

Test: Enabled both dir=in/out IPsec crypto offload, and verified IPv4
      UDP-encapsulated ESP packets on both wifi/cellular network
Signed-off-by: default avatarMike Yu <yumike@google.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 4ecbac84

net/ipv4/esp4.c

+7 −1
Original line number Diff line number Diff line
@@ -349,6 +349,7 @@ static struct ip_esp_hdr *esp_output_udp_encap(struct sk_buff *skb, 
{

	struct udphdr *uh;

	unsigned int len;

	struct xfrm_offload *xo = xfrm_offload(skb);



	len = skb->len + esp->tailen - skb_transport_offset(skb);

	if (len + sizeof(struct iphdr) > IP_MAX_MTU)
@@ -360,6 +361,11 @@ static struct ip_esp_hdr *esp_output_udp_encap(struct sk_buff *skb, 
	uh->len = htons(len);

	uh->check = 0;



	/* For IPv4 ESP with UDP encapsulation, if xo is not null, the skb is in the crypto offload

	 * data path, which means that esp_output_udp_encap is called outside of the XFRM stack.

	 * In this case, the mac header doesn't point to the IPv4 protocol field, so don't set it.

	 */

	if (!xo || encap_type != UDP_ENCAP_ESPINUDP)

		*skb_mac_header(skb) = IPPROTO_UDP;



	return (struct ip_esp_hdr *)(uh + 1);

net/ipv4/esp4_offload.c

+16 −1
Original line number Diff line number Diff line
@@ -264,6 +264,7 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_ 
	struct esp_info esp;

	bool hw_offload = true;

	__u32 seq;

	int encap_type = 0;



	esp.inplace = true;
@@ -296,8 +297,10 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_ 


	esp.esph = ip_esp_hdr(skb);



	if (x->encap)

		encap_type = x->encap->encap_type;



	if (!hw_offload || !skb_is_gso(skb)) {

	if (!hw_offload || !skb_is_gso(skb) || (hw_offload && encap_type == UDP_ENCAP_ESPINUDP)) {

		esp.nfrags = esp_output_head(x, skb, &esp);

		if (esp.nfrags < 0)

			return esp.nfrags;
@@ -324,6 +327,18 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_ 


	esp.seqno = cpu_to_be64(seq + ((u64)xo->seq.hi << 32));



	if (hw_offload && encap_type == UDP_ENCAP_ESPINUDP) {

		/* In the XFRM stack, the encapsulation protocol is set to iphdr->protocol by

		 * setting *skb_mac_header(skb) (see esp_output_udp_encap()) where skb->mac_header

		 * points to iphdr->protocol (see xfrm4_tunnel_encap_add()).

		 * However, in esp_xmit(), skb->mac_header doesn't point to iphdr->protocol.

		 * Therefore, the protocol field needs to be corrected.

		 */

		ip_hdr(skb)->protocol = IPPROTO_UDP;



		esph->seq_no = htonl(seq);

	}



	ip_hdr(skb)->tot_len = htons(skb->len);

	ip_send_check(ip_hdr(skb));