Commit c7dbf4c0 authored by Steffen Klassert's avatar Steffen Klassert
Browse files

xfrm: Provide private skb extensions for segmented and hw offloaded ESP packets 



Commit 94579ac3 ("xfrm: Fix double ESP trailer insertion in IPsec
crypto offload.") added a XFRM_XMIT flag to avoid duplicate ESP trailer
insertion on HW offload. This flag is set on the secpath that is shared
amongst segments. This lead to a situation where some segments are
not transformed correctly when segmentation happens at layer 3.

Fix this by using private skb extensions for segmented and hw offloaded
ESP packets.

Fixes: 94579ac3 ("xfrm: Fix double ESP trailer insertion in IPsec crypto offload.")
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent b1e3a560

net/ipv4/esp4_offload.c

+10 −1
Original line number Diff line number Diff line
@@ -314,8 +314,17 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_ 
	ip_hdr(skb)->tot_len = htons(skb->len);

	ip_send_check(ip_hdr(skb));



	if (hw_offload)

	if (hw_offload) {

		if (!skb_ext_add(skb, SKB_EXT_SEC_PATH))

			return -ENOMEM;



		xo = xfrm_offload(skb);

		if (!xo)

			return -EINVAL;



		xo->flags |= XFRM_XMIT;

		return 0;

	}



	err = esp_output_tail(x, skb, &esp);

	if (err)

net/ipv6/esp6_offload.c

+10 −1
Original line number Diff line number Diff line
@@ -348,8 +348,17 @@ static int esp6_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features 


	ipv6_hdr(skb)->payload_len = htons(len);



	if (hw_offload)

	if (hw_offload) {

		if (!skb_ext_add(skb, SKB_EXT_SEC_PATH))

			return -ENOMEM;



		xo = xfrm_offload(skb);

		if (!xo)

			return -EINVAL;



		xo->flags |= XFRM_XMIT;

		return 0;

	}



	err = esp6_output_tail(x, skb, &esp);

	if (err)

net/xfrm/xfrm_device.c

+0 −2
Original line number Diff line number Diff line
@@ -134,8 +134,6 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur 
		return skb;

	}



	xo->flags |= XFRM_XMIT;



	if (skb_is_gso(skb) && unlikely(x->xso.dev != dev)) {

		struct sk_buff *segs;