Hello David, I saw the status of my patched has been changed to "Changes requested".
Can you tell me what can I do to get the patch accepted?
Thank you in advance!
BR,
Christian
Am 17.09.20 um 14:27 schrieb Christian Langrock:
> Xfrm_dev_offload_ok() is called with the unencrypted SKB. So in case of
> interfamily ipsec traffic (IPv4-in-IPv6 and IPv6 in IPv4) the check
> assumes the wrong family of the skb (IP family of the state).
> With this patch the ip header of the SKB is used to determine the
> family.
>
> Signed-off-by: Christian Langrock <christian.langr...@secunet.com>
> ---
> drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 2 +-
> drivers/net/ethernet/intel/ixgbevf/ipsec.c | 2 +-
> drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 2 +-
> 3 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
> b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
> index eca73526ac86..3601dd293463 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
> @@ -813,7 +813,7 @@ static void ixgbe_ipsec_del_sa(struct xfrm_state *xs)
> **/
> static bool ixgbe_ipsec_offload_ok(struct sk_buff *skb, struct
> xfrm_state *xs)
> {
> - if (xs->props.family == AF_INET) {
> + if (ip_hdr(skb)->version == 4) {
> /* Offload with IPv4 options is not supported yet */
> if (ip_hdr(skb)->ihl != 5)
> return false;
> diff --git a/drivers/net/ethernet/intel/ixgbevf/ipsec.c
> b/drivers/net/ethernet/intel/ixgbevf/ipsec.c
> index 5170dd9d8705..b1d72d5d1744 100644
> --- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c
> +++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c
> @@ -418,7 +418,7 @@ static void ixgbevf_ipsec_del_sa(struct xfrm_state *xs)
> **/
> static bool ixgbevf_ipsec_offload_ok(struct sk_buff *skb, struct
> xfrm_state *xs)
> {
> - if (xs->props.family == AF_INET) {
> + if (ip_hdr(skb)->version == 4) {
> /* Offload with IPv4 options is not supported yet */
> if (ip_hdr(skb)->ihl != 5)
> return false;
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> index d39989cddd90..e3a9b313b01f 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> @@ -460,7 +460,7 @@ void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv)
>
> static bool mlx5e_ipsec_offload_ok(struct sk_buff *skb, struct
> xfrm_state *x)
> {
> - if (x->props.family == AF_INET) {
> + if (ip_hdr(skb)->version == 4) {
> /* Offload with IPv4 options is not supported yet */
> if (ip_hdr(skb)->ihl > 5)
> return false;
--
Dipl.-Inf.(FH) Christian Langrock
Senior Consultant
Network & Client Security
Division Public Authorities
secunet Security Networks AG
Phone: +49 201 5454-3833
E-Mail: christian.langr...@secunet.com
Ammonstraße 74
01067 Dresden, Germany
www.secunet.com
______________________________________________________________________
Registered at: Kurfuerstenstrasse 58, 45138 Essen, Germany
Amtsgericht Essen HRB 13615
Management Board: Dr Rainer Baumgart (CEO), Thomas Pleines
Chairman of Supervisory Board: Ralf Wintergerst
______________________________________________________________________
signature.asc
Description: OpenPGP digital signature
