iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net/mlx5e: Tidy up IPsec NAT-T SA discovery

Browse Source 
IPsec NAT-T packets are UDP encapsulated packets over ESP normal ones.
In case they arrive to RX, the SPI and ESP are located in inner header,
while the check was performed on outer header instead.

That wrong check caused to the situation where received rekeying request
was missed and caused to rekey timeout, which "compensated" this failure
by completing rekeying.

Fixes: d659549349 ("net/mlx5e: Support IPsec NAT-T functionality")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
This commit is contained in:
Leon Romanovsky 2023-11-12 13:50:00 +02:00 committed by Saeed Mahameed
parent dddb49b63d
commit c2bf84f1d1
2 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
View File

@ -1212,13 +1212,22 @@ static void setup_fte_esp(struct mlx5_flow_spec *spec)
MLX5_SET(fte_match_param, spec->match_value, outer_headers.ip_protocol, IPPROTO_ESP); MLX5_SET(fte_match_param, spec->match_value, outer_headers.ip_protocol, IPPROTO_ESP);
} }
static void setup_fte_spi(struct mlx5_flow_spec *spec, u32 spi) static void setup_fte_spi(struct mlx5_flow_spec *spec, u32 spi, bool encap)
{ {
/* SPI number */ /* SPI number */
spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS; spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS;
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, misc_parameters.outer_esp_spi); if (encap) {
MLX5_SET(fte_match_param, spec->match_value, misc_parameters.outer_esp_spi, spi); MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
misc_parameters.inner_esp_spi);
MLX5_SET(fte_match_param, spec->match_value,
misc_parameters.inner_esp_spi, spi);
} else {
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
misc_parameters.outer_esp_spi);
MLX5_SET(fte_match_param, spec->match_value,
misc_parameters.outer_esp_spi, spi);
}
} }
static void setup_fte_no_frags(struct mlx5_flow_spec *spec) static void setup_fte_no_frags(struct mlx5_flow_spec *spec)
@ -1596,8 +1605,9 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
else else
setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6); setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6);
setup_fte_spi(spec, attrs->spi); setup_fte_spi(spec, attrs->spi, attrs->encap);
setup_fte_esp(spec); if (!attrs->encap)
setup_fte_esp(spec);
setup_fte_no_frags(spec); setup_fte_no_frags(spec);
setup_fte_upper_proto_match(spec, &attrs->upspec); setup_fte_upper_proto_match(spec, &attrs->upspec);
@ -1719,7 +1729,7 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
switch (attrs->type) { switch (attrs->type) {
case XFRM_DEV_OFFLOAD_CRYPTO: case XFRM_DEV_OFFLOAD_CRYPTO:
setup_fte_spi(spec, attrs->spi); setup_fte_spi(spec, attrs->spi, false);
setup_fte_esp(spec); setup_fte_esp(spec);
setup_fte_reg_a(spec); setup_fte_reg_a(spec);
break; break;

2
include/linux/mlx5/mlx5_ifc.h
View File

@ -621,7 +621,7 @@ struct mlx5_ifc_fte_match_set_misc_bits {
u8 reserved_at_140[0x8]; u8 reserved_at_140[0x8];
u8 bth_dst_qp[0x18]; u8 bth_dst_qp[0x18];
u8 reserved_at_160[0x20]; u8 inner_esp_spi[0x20];
u8 outer_esp_spi[0x20]; u8 outer_esp_spi[0x20];
u8 reserved_at_1a0[0x60]; u8 reserved_at_1a0[0x60];
}; };