xfrm: Support crypto offload for outbound IPv4 UDP-encapsulated ESP packet

esp_xmit() is already able to handle UDP encapsulation through the call to
esp_output_head(). However, the ESP header and the outer IP header
are not correct and need to be corrected.

Test: Enabled both dir=in/out IPsec crypto offload, and verified IPv4
      UDP-encapsulated ESP packets on both wifi/cellular network
Signed-off-by: Mike Yu <yumike@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 3968d3f98e08302570f722ef8acb76353dd6ef16..73981595f06285f1974f0d1b835bbd9971411911 100644 (file)
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -349,6 +349,7 @@ static struct ip_esp_hdr *esp_output_udp_encap(struct sk_buff *skb,
 {
        struct udphdr *uh;
        unsigned int len;
+       struct xfrm_offload *xo = xfrm_offload(skb);
 
        len = skb->len + esp->tailen - skb_transport_offset(skb);
        if (len + sizeof(struct iphdr) > IP_MAX_MTU)
@@ -360,7 +361,12 @@ static struct ip_esp_hdr *esp_output_udp_encap(struct sk_buff *skb,
        uh->len = htons(len);
        uh->check = 0;
 
-       *skb_mac_header(skb) = IPPROTO_UDP;
+       /* For IPv4 ESP with UDP encapsulation, if xo is not null, the skb is in the crypto offload
+        * data path, which means that esp_output_udp_encap is called outside of the XFRM stack.
+        * In this case, the mac header doesn't point to the IPv4 protocol field, so don't set it.
+        */
+       if (!xo || encap_type != UDP_ENCAP_ESPINUDP)
+               *skb_mac_header(skb) = IPPROTO_UDP;
 
        return (struct ip_esp_hdr *)(uh + 1);
 }

diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
index b3271957ad9a0c3230496786cf0e864da83ec8da..a37d18858c72ce6d6a48b85132cace3abfddffb2 100644 (file)
--- a/net/ipv4/esp4_offload.c
+++ b/net/ipv4/esp4_offload.c
@@ -264,6 +264,7 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb,  netdev_features_
        struct esp_info esp;
        bool hw_offload = true;
        __u32 seq;
+       int encap_type = 0;
 
        esp.inplace = true;
 
@@ -296,8 +297,10 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb,  netdev_features_
 
        esp.esph = ip_esp_hdr(skb);
 
+       if (x->encap)
+               encap_type = x->encap->encap_type;
 
-       if (!hw_offload || !skb_is_gso(skb)) {
+       if (!hw_offload || !skb_is_gso(skb) || (hw_offload && encap_type == UDP_ENCAP_ESPINUDP)) {
                esp.nfrags = esp_output_head(x, skb, &esp);
                if (esp.nfrags < 0)
                        return esp.nfrags;
@@ -324,6 +327,18 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb,  netdev_features_
 
        esp.seqno = cpu_to_be64(seq + ((u64)xo->seq.hi << 32));
 
+       if (hw_offload && encap_type == UDP_ENCAP_ESPINUDP) {
+               /* In the XFRM stack, the encapsulation protocol is set to iphdr->protocol by
+                * setting *skb_mac_header(skb) (see esp_output_udp_encap()) where skb->mac_header
+                * points to iphdr->protocol (see xfrm4_tunnel_encap_add()).
+                * However, in esp_xmit(), skb->mac_header doesn't point to iphdr->protocol.
+                * Therefore, the protocol field needs to be corrected.
+                */
+               ip_hdr(skb)->protocol = IPPROTO_UDP;
+
+               esph->seq_no = htonl(seq);
+       }
+
        ip_hdr(skb)->tot_len = htons(skb->len);
        ip_send_check(ip_hdr(skb));