Commit 71670f76 authored by Alexandre Cassen's avatar Alexandre Cassen Committed by Jakub Kicinski
Browse files

net/mlx5e: Support routed networks during IPsec MACs initialization 



Remote IPsec tunnel endpoint may refer to a network segment that is
not directly connected to the host. In such a case, IPsec tunnel
endpoints are connected to a router and reachable via a routing path.
In IPsec packet offload mode, HW is initialized with the MAC address
of both IPsec tunnel endpoints.

Extend the current IPsec init MACs procedure to resolve nexthop for
routed networks. Direct neighbour lookup and probe is still used
for directly connected networks and as a fallback mechanism if fib
lookup fails.

Signed-off-by: default avatarAlexandre Cassen <acassen@corp.free.fr>
Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Reviewed-by: default avatarCosmin Ratiu <cratiu@nvidia.com>
Signed-off-by: default avatarTariq Toukan <tariqt@nvidia.com>
Reviewed-by: default avatarMichal Swiatkowski <michal.swiatkowski@linux.intel.com>
Link: https://patch.msgid.link/1753194228-333722-2-git-send-email-tariqt@nvidia.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent cf51016b

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c

+80 −2
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ 
#include <linux/inetdevice.h>

#include <linux/netdevice.h>

#include <net/netevent.h>

#include <net/ipv6_stubs.h>



#include "en.h"

#include "eswitch.h"
@@ -259,9 +260,15 @@ static void mlx5e_ipsec_init_macs(struct mlx5e_ipsec_sa_entry *sa_entry, 
				  struct mlx5_accel_esp_xfrm_attrs *attrs)

{

	struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry);

	struct mlx5e_ipsec_addr *addrs = &attrs->addrs;

	struct net_device *netdev = sa_entry->dev;

	struct xfrm_state *x = sa_entry->x;

	struct dst_entry *rt_dst_entry;

	struct flowi4 fl4 = {};

	struct flowi6 fl6 = {};

	struct neighbour *n;

	u8 addr[ETH_ALEN];

	struct rtable *rt;

	const void *pkey;

	u8 *dst, *src;
@@ -274,18 +281,89 @@ static void mlx5e_ipsec_init_macs(struct mlx5e_ipsec_sa_entry *sa_entry, 
	case XFRM_DEV_OFFLOAD_IN:

		src = attrs->dmac;

		dst = attrs->smac;

		pkey = &attrs->addrs.saddr.a4;



		switch (addrs->family) {

		case AF_INET:

			fl4.flowi4_proto = x->sel.proto;

			fl4.daddr = addrs->saddr.a4;

			fl4.saddr = addrs->daddr.a4;

			pkey = &addrs->saddr.a4;

			break;

		case AF_INET6:

			fl6.flowi6_proto = x->sel.proto;

			memcpy(fl6.daddr.s6_addr32, addrs->saddr.a6, 16);

			memcpy(fl6.saddr.s6_addr32, addrs->daddr.a6, 16);

			pkey = &addrs->saddr.a6;

			break;

		default:

			return;

		}

		break;

	case XFRM_DEV_OFFLOAD_OUT:

		src = attrs->smac;

		dst = attrs->dmac;

		pkey = &attrs->addrs.daddr.a4;

		switch (addrs->family) {

		case AF_INET:

			fl4.flowi4_proto = x->sel.proto;

			fl4.daddr = addrs->daddr.a4;

			fl4.saddr = addrs->saddr.a4;

			pkey = &addrs->daddr.a4;

			break;

		case AF_INET6:

			fl6.flowi6_proto = x->sel.proto;

			memcpy(fl6.daddr.s6_addr32, addrs->daddr.a6, 16);

			memcpy(fl6.saddr.s6_addr32, addrs->saddr.a6, 16);

			pkey = &addrs->daddr.a6;

			break;

		default:

			return;

		}

		break;

	default:

		return;

	}



	ether_addr_copy(src, addr);



	/* Destination can refer to a routed network, so perform FIB lookup

	 * to resolve nexthop and get its MAC. Neighbour resolution is used as

	 * fallback.

	 */

	switch (addrs->family) {

	case AF_INET:

		rt = ip_route_output_key(dev_net(netdev), &fl4);

		if (IS_ERR(rt))

			goto neigh;



		if (rt->rt_type != RTN_UNICAST) {

			ip_rt_put(rt);

			goto neigh;

		}

		rt_dst_entry = &rt->dst;

		break;

	case AF_INET6:

		rt_dst_entry = ipv6_stub->ipv6_dst_lookup_flow(

			dev_net(netdev), NULL, &fl6, NULL);

		if (IS_ERR(rt_dst_entry))

			goto neigh;

		break;

	default:

		return;

	}



	n = dst_neigh_lookup(rt_dst_entry, pkey);

	if (!n) {

		dst_release(rt_dst_entry);

		goto neigh;

	}



	neigh_ha_snapshot(addr, n, netdev);

	ether_addr_copy(dst, addr);

	dst_release(rt_dst_entry);

	neigh_release(n);

	return;



neigh:

	n = neigh_lookup(&arp_tbl, pkey, netdev);

	if (!n) {

		n = neigh_create(&arp_tbl, pkey, netdev);