Skip to content

Commit b3beba1

Browse files
raed-salemrleon
raed-salem
authored and
rleon
committed
net/mlx5e: Allow policies with reqid 0, to support IKE policy holes
IKE policies hole, is special policy that exists to allow for IKE traffic to bypass IPsec encryption even though there is already a policies and SA(s) configured on same endpoints, these policies does not nessecarly have the reqid configured, so need to add an exception for such policies. These kind of policies are allowed under the condition that at least upper protocol and/or ips are not 0. Signed-off-by: Raed Salem <[email protected]> Link: https://lore.kernel.org/r/cbcadde312c24de74c47d9b0616f86a5818cc9bf.1678714336.git.leon@kernel.org Signed-off-by: Leon Romanovsky <[email protected]>
1 parent c9fa320 commit b3beba1

File tree

3 files changed

+59
-27
lines changed

3 files changed

+59
-27
lines changed

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -503,6 +503,8 @@ static int mlx5e_xfrm_validate_policy(struct mlx5_core_dev *mdev,
503503
struct xfrm_policy *x,
504504
struct netlink_ext_ack *extack)
505505
{
506+
struct xfrm_selector *sel = &x->selector;
507+
506508
if (x->type != XFRM_POLICY_TYPE_MAIN) {
507509
NL_SET_ERR_MSG_MOD(extack, "Cannot offload non-main policy types");
508510
return -EINVAL;
@@ -520,8 +522,9 @@ static int mlx5e_xfrm_validate_policy(struct mlx5_core_dev *mdev,
520522
return -EINVAL;
521523
}
522524

523-
if (!x->xfrm_vec[0].reqid) {
524-
NL_SET_ERR_MSG_MOD(extack, "Cannot offload policy without reqid");
525+
if (!x->xfrm_vec[0].reqid && sel->proto == IPPROTO_IP &&
526+
addr6_all_zero(sel->saddr.a6) && addr6_all_zero(sel->daddr.a6)) {
527+
NL_SET_ERR_MSG_MOD(extack, "Unsupported policy with reqid 0 without at least one of upper protocol or ip addr(s) different than 0");
525528
return -EINVAL;
526529
}
527530

@@ -530,8 +533,8 @@ static int mlx5e_xfrm_validate_policy(struct mlx5_core_dev *mdev,
530533
return -EINVAL;
531534
}
532535

533-
if (x->selector.proto != IPPROTO_IP &&
534-
(x->selector.proto != IPPROTO_UDP || x->xdo.dir != XFRM_DEV_OFFLOAD_OUT)) {
536+
if (sel->proto != IPPROTO_IP &&
537+
(sel->proto != IPPROTO_UDP || x->xdo.dir != XFRM_DEV_OFFLOAD_OUT)) {
535538
NL_SET_ERR_MSG_MOD(extack, "Device does not support upper protocol other than UDP, and only Tx direction");
536539
return -EINVAL;
537540
}

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,13 @@ mlx5e_ipsec_pol2dev(struct mlx5e_ipsec_pol_entry *pol_entry)
254254
{
255255
return pol_entry->ipsec->mdev;
256256
}
257+
258+
static inline bool addr6_all_zero(__be32 *addr6)
259+
{
260+
static const __be32 zaddr6[4] = {};
261+
262+
return !memcmp(addr6, zaddr6, sizeof(*zaddr6));
263+
}
257264
#else
258265
static inline void mlx5e_ipsec_init(struct mlx5e_priv *priv)
259266
{

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c

Lines changed: 45 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -621,37 +621,53 @@ static void tx_ft_put_policy(struct mlx5e_ipsec *ipsec, u32 prio)
621621
static void setup_fte_addr4(struct mlx5_flow_spec *spec, __be32 *saddr,
622622
__be32 *daddr)
623623
{
624+
if (!*saddr && !*daddr)
625+
return;
626+
624627
spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
625628

626629
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, outer_headers.ip_version);
627630
MLX5_SET(fte_match_param, spec->match_value, outer_headers.ip_version, 4);
628631

629-
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
630-
outer_headers.src_ipv4_src_ipv6.ipv4_layout.ipv4), saddr, 4);
631-
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
632-
outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4), daddr, 4);
633-
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
634-
outer_headers.src_ipv4_src_ipv6.ipv4_layout.ipv4);
635-
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
636-
outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4);
632+
if (*saddr) {
633+
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
634+
outer_headers.src_ipv4_src_ipv6.ipv4_layout.ipv4), saddr, 4);
635+
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
636+
outer_headers.src_ipv4_src_ipv6.ipv4_layout.ipv4);
637+
}
638+
639+
if (*daddr) {
640+
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
641+
outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4), daddr, 4);
642+
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
643+
outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4);
644+
}
637645
}
638646

639647
static void setup_fte_addr6(struct mlx5_flow_spec *spec, __be32 *saddr,
640648
__be32 *daddr)
641649
{
650+
if (addr6_all_zero(saddr) && addr6_all_zero(daddr))
651+
return;
652+
642653
spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
643654

644655
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, outer_headers.ip_version);
645656
MLX5_SET(fte_match_param, spec->match_value, outer_headers.ip_version, 6);
646657

647-
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
648-
outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), saddr, 16);
649-
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
650-
outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), daddr, 16);
651-
memset(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
652-
outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), 0xff, 16);
653-
memset(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
654-
outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), 0xff, 16);
658+
if (!addr6_all_zero(saddr)) {
659+
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
660+
outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), saddr, 16);
661+
memset(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
662+
outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), 0xff, 16);
663+
}
664+
665+
if (!addr6_all_zero(daddr)) {
666+
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
667+
outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), daddr, 16);
668+
memset(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
669+
outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), 0xff, 16);
670+
}
655671
}
656672

657673
static void setup_fte_esp(struct mlx5_flow_spec *spec)
@@ -920,7 +936,8 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
920936
setup_fte_reg_a(spec);
921937
break;
922938
case XFRM_DEV_OFFLOAD_PACKET:
923-
setup_fte_reg_c0(spec, attrs->reqid);
939+
if (attrs->reqid)
940+
setup_fte_reg_c0(spec, attrs->reqid);
924941
err = setup_pkt_reformat(mdev, attrs, &flow_act);
925942
if (err)
926943
goto err_pkt_reformat;
@@ -989,10 +1006,12 @@ static int tx_add_policy(struct mlx5e_ipsec_pol_entry *pol_entry)
9891006
setup_fte_no_frags(spec);
9901007
setup_fte_upper_proto_match(spec, &attrs->upspec);
9911008

992-
err = setup_modify_header(mdev, attrs->reqid, XFRM_DEV_OFFLOAD_OUT,
993-
&flow_act);
994-
if (err)
995-
goto err_mod_header;
1009+
if (attrs->reqid) {
1010+
err = setup_modify_header(mdev, attrs->reqid,
1011+
XFRM_DEV_OFFLOAD_OUT, &flow_act);
1012+
if (err)
1013+
goto err_mod_header;
1014+
}
9961015

9971016
switch (attrs->action) {
9981017
case XFRM_POLICY_ALLOW:
@@ -1028,7 +1047,8 @@ static int tx_add_policy(struct mlx5e_ipsec_pol_entry *pol_entry)
10281047
return 0;
10291048

10301049
err_action:
1031-
mlx5_modify_header_dealloc(mdev, flow_act.modify_hdr);
1050+
if (attrs->reqid)
1051+
mlx5_modify_header_dealloc(mdev, flow_act.modify_hdr);
10321052
err_mod_header:
10331053
kvfree(spec);
10341054
err_alloc:
@@ -1263,7 +1283,9 @@ void mlx5e_accel_ipsec_fs_del_pol(struct mlx5e_ipsec_pol_entry *pol_entry)
12631283
return;
12641284
}
12651285

1266-
mlx5_modify_header_dealloc(mdev, ipsec_rule->modify_hdr);
1286+
if (ipsec_rule->modify_hdr)
1287+
mlx5_modify_header_dealloc(mdev, ipsec_rule->modify_hdr);
1288+
12671289
tx_ft_put_policy(pol_entry->ipsec, pol_entry->attrs.prio);
12681290
}
12691291

0 commit comments

Comments
 (0)