| Message ID | 14366463-cf15-ceec-c3ee-17b5796ac59c@secunet.com |
|---|---|
| State | New |
| Headers | show |
| Series | [net] drivers: net: Fix *_ipsec_offload_ok(): Use ip_hdr family | expand |
Hello David, I saw the status of my patched has been changed to "Changes requested". Can you tell me what can I do to get the patch accepted? Thank you in advance! BR, Christian Am 17.09.20 um 14:27 schrieb Christian Langrock: > Xfrm_dev_offload_ok() is called with the unencrypted SKB. So in case of > interfamily ipsec traffic (IPv4-in-IPv6 and IPv6 in IPv4) the check > assumes the wrong family of the skb (IP family of the state). > With this patch the ip header of the SKB is used to determine the > family. > > Signed-off-by: Christian Langrock <christian.langrock@secunet.com> > --- > drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 2 +- > drivers/net/ethernet/intel/ixgbevf/ipsec.c | 2 +- > drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 2 +- > 3 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c > b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c > index eca73526ac86..3601dd293463 100644 > --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c > +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c > @@ -813,7 +813,7 @@ static void ixgbe_ipsec_del_sa(struct xfrm_state *xs) > **/ > static bool ixgbe_ipsec_offload_ok(struct sk_buff *skb, struct > xfrm_state *xs) > { > - if (xs->props.family == AF_INET) { > + if (ip_hdr(skb)->version == 4) { > /* Offload with IPv4 options is not supported yet */ > if (ip_hdr(skb)->ihl != 5) > return false; > diff --git a/drivers/net/ethernet/intel/ixgbevf/ipsec.c > b/drivers/net/ethernet/intel/ixgbevf/ipsec.c > index 5170dd9d8705..b1d72d5d1744 100644 > --- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c > +++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c > @@ -418,7 +418,7 @@ static void ixgbevf_ipsec_del_sa(struct xfrm_state *xs) > **/ > static bool ixgbevf_ipsec_offload_ok(struct sk_buff *skb, struct > xfrm_state *xs) > { > - if (xs->props.family == AF_INET) { > + if (ip_hdr(skb)->version == 4) { > /* Offload with IPv4 options is not supported yet */ > if (ip_hdr(skb)->ihl != 5) > return false; > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c > b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c > index d39989cddd90..e3a9b313b01f 100644 > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c > @@ -460,7 +460,7 @@ void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv) > > static bool mlx5e_ipsec_offload_ok(struct sk_buff *skb, struct > xfrm_state *x) > { > - if (x->props.family == AF_INET) { > + if (ip_hdr(skb)->version == 4) { > /* Offload with IPv4 options is not supported yet */ > if (ip_hdr(skb)->ihl > 5) > return false;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c index eca73526ac86..3601dd293463 100644 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c @@ -813,7 +813,7 @@ static void ixgbe_ipsec_del_sa(struct xfrm_state *xs) **/ static bool ixgbe_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) { - if (xs->props.family == AF_INET) { + if (ip_hdr(skb)->version == 4) { /* Offload with IPv4 options is not supported yet */ if (ip_hdr(skb)->ihl != 5) return false; diff --git a/drivers/net/ethernet/intel/ixgbevf/ipsec.c b/drivers/net/ethernet/intel/ixgbevf/ipsec.c index 5170dd9d8705..b1d72d5d1744 100644 --- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c +++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c @@ -418,7 +418,7 @@ static void ixgbevf_ipsec_del_sa(struct xfrm_state *xs) **/ static bool ixgbevf_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) { - if (xs->props.family == AF_INET) { + if (ip_hdr(skb)->version == 4) { /* Offload with IPv4 options is not supported yet */ if (ip_hdr(skb)->ihl != 5) return false; diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c index d39989cddd90..e3a9b313b01f 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c @@ -460,7 +460,7 @@ void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv) static bool mlx5e_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x) { - if (x->props.family == AF_INET) { + if (ip_hdr(skb)->version == 4) { /* Offload with IPv4 options is not supported yet */ if (ip_hdr(skb)->ihl > 5)
Xfrm_dev_offload_ok() is called with the unencrypted SKB. So in case of interfamily ipsec traffic (IPv4-in-IPv6 and IPv6 in IPv4) the check assumes the wrong family of the skb (IP family of the state). With this patch the ip header of the SKB is used to determine the family. Signed-off-by: Christian Langrock <christian.langrock@secunet.com> --- drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 2 +- drivers/net/ethernet/intel/ixgbevf/ipsec.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) return false;