Commit b1216933 authored by Taehee Yoo's avatar Taehee Yoo Committed by David S. Miller
Browse files

bonding: disallow setting nested bonding + ipsec offload 



bonding interface can be nested and it supports ipsec offload.
So, it allows setting the nested bonding + ipsec scenario.
But code does not support this scenario.
So, it should be disallowed.

interface graph:
bond2
   |
bond1
   |
eth0

The nested bonding + ipsec offload may not a real usecase.
So, disallowing this scenario is fine.

Fixes: 18cb261a ("bonding: support hardware encryption offload to slaves")
Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a22c39b8

drivers/net/bonding/bond_main.c

+9 −6
Original line number Diff line number Diff line
@@ -419,8 +419,9 @@ static int bond_ipsec_add_sa(struct xfrm_state *xs) 
	xs->xso.real_dev = slave->dev;

	bond->xs = xs;



	if (!(slave->dev->xfrmdev_ops

	      && slave->dev->xfrmdev_ops->xdo_dev_state_add)) {

	if (!slave->dev->xfrmdev_ops ||

	    !slave->dev->xfrmdev_ops->xdo_dev_state_add ||

	    netif_is_bond_master(slave->dev)) {

		slave_warn(bond_dev, slave->dev, "Slave does not support ipsec offload\n");

		rcu_read_unlock();

		return -EINVAL;
@@ -453,8 +454,9 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs) 


	xs->xso.real_dev = slave->dev;



	if (!(slave->dev->xfrmdev_ops

	      && slave->dev->xfrmdev_ops->xdo_dev_state_delete)) {

	if (!slave->dev->xfrmdev_ops ||

	    !slave->dev->xfrmdev_ops->xdo_dev_state_delete ||

	    netif_is_bond_master(slave->dev)) {

		slave_warn(bond_dev, slave->dev, "%s: no slave xdo_dev_state_delete\n", __func__);

		goto out;

	}
@@ -479,8 +481,9 @@ static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) 
	if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP)

		return true;



	if (!(slave_dev->xfrmdev_ops

	      && slave_dev->xfrmdev_ops->xdo_dev_offload_ok)) {

	if (!slave_dev->xfrmdev_ops ||

	    !slave_dev->xfrmdev_ops->xdo_dev_offload_ok ||

	    netif_is_bond_master(slave_dev)) {

		slave_warn(bond_dev, slave_dev, "%s: no slave xdo_dev_offload_ok\n", __func__);

		return false;

	}