Commit c82b48b6 authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Steffen Klassert
Browse files

xfrm: prevent configuration of interface index when offload is used 



Both packet and crypto offloads perform decryption while packet is
arriving to the HW from the wire. It means that there is no possible
way to perform lookup on XFRM if_id as it can't be set to be "before' HW.

So instead of silently ignore this configuration, let's warn users about
misconfiguration.

Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent e86212b6

net/xfrm/xfrm_device.c

+5 −0
Original line number Diff line number Diff line
@@ -251,6 +251,11 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 
		return -EINVAL;

	}



	if (xuo->flags & XFRM_OFFLOAD_INBOUND && x->if_id) {

		NL_SET_ERR_MSG(extack, "XFRM if_id is not supported in RX path");

		return -EINVAL;

	}



	is_packet_offload = xuo->flags & XFRM_OFFLOAD_PACKET;



	/* We don't yet support TFC padding. */