Commit a43dce93 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 



Steffen Klassert says:

====================
pull request (net-next): ipsec-next 2017-08-21

1) Support RX checksum with IPsec crypto offload for esp4/esp6.
   From Ilan Tayari.

2) Fixup IPv6 checksums when doing IPsec crypto offload.
   From Yossi Kuperman.

3) Auto load the xfrom offload modules if a user installs
   a SA that requests IPsec offload. From Ilan Tayari.

4) Clear RX offload informations in xfrm_input to not
   confuse the TX path with stale offload informations.
   From Ilan Tayari.

5) Allow IPsec GSO for local sockets if the crypto operation
   will be offloaded.

6) Support setting of an output mark to the xfrm_state.
   This mark can be used to to do the tunnel route lookup.
   From Lorenzo Colitti.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 0c45d7fe 077fbac4

include/net/xfrm.h

+28 −4
Original line number Diff line number Diff line
@@ -43,6 +43,8 @@ 
	MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))

#define MODULE_ALIAS_XFRM_TYPE(family, proto) \

	MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))

#define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \

	MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto))



#ifdef CONFIG_XFRM_STATISTICS

#define XFRM_INC_STATS(net, field)	SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
@@ -163,6 +165,7 @@ struct xfrm_state { 
		int		header_len;

		int		trailer_len;

		u32		extra_flags;

		u32		output_mark;

	} props;



	struct xfrm_lifetime_cfg lft;
@@ -296,10 +299,12 @@ struct xfrm_policy_afinfo { 
	struct dst_entry	*(*dst_lookup)(struct net *net,

					       int tos, int oif,

					       const xfrm_address_t *saddr,

					       const xfrm_address_t *daddr);

					       const xfrm_address_t *daddr,

					       u32 mark);

	int			(*get_saddr)(struct net *net, int oif,

					     xfrm_address_t *saddr,

					     xfrm_address_t *daddr);

					     xfrm_address_t *daddr,

					     u32 mark);

	void			(*decode_session)(struct sk_buff *skb,

						  struct flowi *fl,

						  int reverse);
@@ -1558,7 +1563,7 @@ void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); 
u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);

int xfrm_init_replay(struct xfrm_state *x);

int xfrm_state_mtu(struct xfrm_state *x, int mtu);

int __xfrm_init_state(struct xfrm_state *x, bool init_replay);

int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload);

int xfrm_init_state(struct xfrm_state *x);

int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);

int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
@@ -1638,7 +1643,7 @@ static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 
struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif,

				    const xfrm_address_t *saddr,

				    const xfrm_address_t *daddr,

				    int family);

				    int family, u32 mark);



struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
@@ -1856,6 +1861,20 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 
		       struct xfrm_user_offload *xuo);

bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);



static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)

{

	struct xfrm_state *x = dst->xfrm;



	if (!x || !x->type_offload)

		return false;



	if (x->xso.offload_handle && (x->xso.dev == dst->path->dev) &&

	    !dst->child->xfrm)

		return true;



	return false;

}



static inline void xfrm_dev_state_delete(struct xfrm_state *x)

{

	struct xfrm_state_offload *xso = &x->xso;
@@ -1898,6 +1917,11 @@ static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x 
{

	return false;

}



static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)

{

	return false;

}

#endif



static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)

include/uapi/linux/xfrm.h

+1 −0
Original line number Diff line number Diff line
@@ -304,6 +304,7 @@ enum xfrm_attr_type_t { 
	XFRMA_ADDRESS_FILTER,	/* struct xfrm_address_filter */

	XFRMA_PAD,

	XFRMA_OFFLOAD_DEV,	/* struct xfrm_state_offload */

	XFRMA_OUTPUT_MARK,	/* __u32 */

	__XFRMA_MAX



#define XFRMA_MAX (__XFRMA_MAX - 1)

net/core/sock.c

+1 −1
Original line number Diff line number Diff line
@@ -1776,7 +1776,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst) 
		sk->sk_route_caps |= NETIF_F_GSO_SOFTWARE;

	sk->sk_route_caps &= ~sk->sk_route_nocaps;

	if (sk_can_gso(sk)) {

		if (dst->header_len) {

		if (dst->header_len && !xfrm_dst_offload_ok(dst)) {

			sk->sk_route_caps &= ~NETIF_F_GSO_MASK;

		} else {

			sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;

net/ipv4/esp4.c

+11 −3
Original line number Diff line number Diff line
@@ -510,7 +510,8 @@ int esp_input_done2(struct sk_buff *skb, int err) 
	int elen = skb->len - hlen;

	int ihl;

	u8 nexthdr[2];

	int padlen;

	int padlen, trimlen;

	__wsum csumdiff;



	if (!xo || (xo && !(xo->flags & CRYPTO_DONE)))

		kfree(ESP_SKB_CB(skb)->tmp);
@@ -568,8 +569,15 @@ int esp_input_done2(struct sk_buff *skb, int err) 
			skb->ip_summed = CHECKSUM_UNNECESSARY;

	}



	pskb_trim(skb, skb->len - alen - padlen - 2);

	__skb_pull(skb, hlen);

	trimlen = alen + padlen + 2;

	if (skb->ip_summed == CHECKSUM_COMPLETE) {

		csumdiff = skb_checksum(skb, skb->len - trimlen, trimlen, 0);

		skb->csum = csum_block_sub(skb->csum, csumdiff,

					   skb->len - trimlen);

	}

	pskb_trim(skb, skb->len - trimlen);



	skb_pull_rcsum(skb, hlen);

	if (x->props.mode == XFRM_MODE_TUNNEL)

		skb_reset_transport_header(skb);

	else

net/ipv4/esp4_offload.c

+4 −1
Original line number Diff line number Diff line
@@ -182,10 +182,12 @@ out: 
static int esp_input_tail(struct xfrm_state *x, struct sk_buff *skb)

{

	struct crypto_aead *aead = x->data;

	struct xfrm_offload *xo = xfrm_offload(skb);



	if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr) + crypto_aead_ivsize(aead)))

		return -EINVAL;



	if (!(xo->flags & CRYPTO_DONE))

		skb->ip_summed = CHECKSUM_NONE;



	return esp_input_done2(skb, 0);
@@ -303,3 +305,4 @@ module_init(esp4_offload_init); 
module_exit(esp4_offload_exit);

MODULE_LICENSE("GPL");

MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");

MODULE_ALIAS_XFRM_OFFLOAD_TYPE(AF_INET, XFRM_PROTO_ESP);

CRA Git | Maintained and supported by SUSTech CRA and CCSE