xfrm: prevent configuration of interface index when offload is used

Both packet and crypto offloads perform decryption while packet is
arriving to the HW from the wire. It means that there is no possible
way to perform lookup on XFRM if_id as it can't be set to be "before' HW.

So instead of silently ignore this configuration, let's warn users about
misconfiguration.

Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 3be0139373f75b947e39207331ba2a91d26156d4..81fd486b5e5664b4e58b3ea80c966c0a379030ee 100644 (file)
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -251,6 +251,11 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
                return -EINVAL;
        }
 
+       if (xuo->flags & XFRM_OFFLOAD_INBOUND && x->if_id) {
+               NL_SET_ERR_MSG(extack, "XFRM if_id is not supported in RX path");
+               return -EINVAL;
+       }
+
        is_packet_offload = xuo->flags & XFRM_OFFLOAD_PACKET;
 
        /* We don't yet support TFC padding. */