Skip to content

Commit ca7992f

Browse files
rleonkuba-moo
rleon
authored and
kuba-moo
committed
net/mlx5e: Properly match IPsec subnet addresses
Existing match criteria didn't allow to match whole subnet and only by specific addresses only. This caused to tunnel mode do not forward such traffic through relevant SA. In tunnel mode, policies look like this: src 192.169.0.0/16 dst 192.169.0.0/16 dir out priority 383615 ptype main tmpl src 192.169.101.2 dst 192.169.101.1 proto esp spi 0xc5141c18 reqid 1 mode tunnel crypto offload parameters: dev eth2 mode packet In this case, the XFRM core code handled all subnet calculations and forwarded network address to the drivers e.g. 192.169.0.0. For mlx5 devices, there is a need to set relevant prefix e.g. 0xFFFF00 to perform flow steering match operation. Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Tariq Toukan <[email protected]> Reviewed-by: Michal Swiatkowski <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
1 parent 348ed4b commit ca7992f

File tree

3 files changed

+69
-9
lines changed

3 files changed

+69
-9
lines changed

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,16 @@ static void mlx5e_ipsec_init_macs(struct mlx5e_ipsec_sa_entry *sa_entry,
303303
neigh_release(n);
304304
}
305305

306+
static void mlx5e_ipsec_state_mask(struct mlx5e_ipsec_addr *addrs)
307+
{
308+
/*
309+
* State doesn't have subnet prefixes in outer headers.
310+
* The match is performed for exaxt source/destination addresses.
311+
*/
312+
memset(addrs->smask.m6, 0xFF, sizeof(__be32) * 4);
313+
memset(addrs->dmask.m6, 0xFF, sizeof(__be32) * 4);
314+
}
315+
306316
void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,
307317
struct mlx5_accel_esp_xfrm_attrs *attrs)
308318
{
@@ -378,6 +388,7 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,
378388
sizeof(attrs->addrs.saddr));
379389
memcpy(&attrs->addrs.daddr, x->id.daddr.a6, sizeof(attrs->addrs.daddr));
380390
attrs->addrs.family = x->props.family;
391+
mlx5e_ipsec_state_mask(&attrs->addrs);
381392
attrs->type = x->xso.type;
382393
attrs->reqid = x->props.reqid;
383394
attrs->upspec.dport = ntohs(x->sel.dport);
@@ -1046,6 +1057,43 @@ static void mlx5e_xfrm_update_stats(struct xfrm_state *x)
10461057
x->curlft.bytes += success_bytes - headers * success_packets;
10471058
}
10481059

1060+
static __be32 word_to_mask(int prefix)
1061+
{
1062+
if (prefix < 0)
1063+
return 0;
1064+
1065+
if (!prefix || prefix > 31)
1066+
return cpu_to_be32(0xFFFFFFFF);
1067+
1068+
return cpu_to_be32(((1U << prefix) - 1) << (32 - prefix));
1069+
}
1070+
1071+
static void mlx5e_ipsec_policy_mask(struct mlx5e_ipsec_addr *addrs,
1072+
struct xfrm_selector *sel)
1073+
{
1074+
int i;
1075+
1076+
if (addrs->family == AF_INET) {
1077+
addrs->smask.m4 = word_to_mask(sel->prefixlen_s);
1078+
addrs->saddr.a4 &= addrs->smask.m4;
1079+
addrs->dmask.m4 = word_to_mask(sel->prefixlen_d);
1080+
addrs->daddr.a4 &= addrs->dmask.m4;
1081+
return;
1082+
}
1083+
1084+
for (i = 0; i < 4; i++) {
1085+
if (sel->prefixlen_s != 32 * i)
1086+
addrs->smask.m6[i] =
1087+
word_to_mask(sel->prefixlen_s - 32 * i);
1088+
addrs->saddr.a6[i] &= addrs->smask.m6[i];
1089+
1090+
if (sel->prefixlen_d != 32 * i)
1091+
addrs->dmask.m6[i] =
1092+
word_to_mask(sel->prefixlen_d - 32 * i);
1093+
addrs->daddr.a6[i] &= addrs->dmask.m6[i];
1094+
}
1095+
}
1096+
10491097
static int mlx5e_xfrm_validate_policy(struct mlx5_core_dev *mdev,
10501098
struct xfrm_policy *x,
10511099
struct netlink_ext_ack *extack)
@@ -1121,6 +1169,7 @@ mlx5e_ipsec_build_accel_pol_attrs(struct mlx5e_ipsec_pol_entry *pol_entry,
11211169
memcpy(&attrs->addrs.saddr, sel->saddr.a6, sizeof(attrs->addrs.saddr));
11221170
memcpy(&attrs->addrs.daddr, sel->daddr.a6, sizeof(attrs->addrs.daddr));
11231171
attrs->addrs.family = sel->family;
1172+
mlx5e_ipsec_policy_mask(&attrs->addrs, sel);
11241173
attrs->dir = x->xdo.dir;
11251174
attrs->action = x->action;
11261175
attrs->type = XFRM_DEV_OFFLOAD_PACKET;

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,11 +81,18 @@ struct mlx5e_ipsec_addr {
8181
__be32 a4;
8282
__be32 a6[4];
8383
} saddr;
84-
84+
union {
85+
__be32 m4;
86+
__be32 m6[4];
87+
} smask;
8588
union {
8689
__be32 a4;
8790
__be32 a6[4];
8891
} daddr;
92+
union {
93+
__be32 m4;
94+
__be32 m6[4];
95+
} dmask;
8996
u8 family;
9097
};
9198

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1488,7 +1488,9 @@ static void setup_fte_addr4(struct mlx5_flow_spec *spec,
14881488
struct mlx5e_ipsec_addr *addrs)
14891489
{
14901490
__be32 *saddr = &addrs->saddr.a4;
1491+
__be32 *smask = &addrs->smask.m4;
14911492
__be32 *daddr = &addrs->daddr.a4;
1493+
__be32 *dmask = &addrs->dmask.m4;
14921494

14931495
if (!*saddr && !*daddr)
14941496
return;
@@ -1501,23 +1503,25 @@ static void setup_fte_addr4(struct mlx5_flow_spec *spec,
15011503
if (*saddr) {
15021504
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
15031505
outer_headers.src_ipv4_src_ipv6.ipv4_layout.ipv4), saddr, 4);
1504-
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
1505-
outer_headers.src_ipv4_src_ipv6.ipv4_layout.ipv4);
1506+
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
1507+
outer_headers.src_ipv4_src_ipv6.ipv4_layout.ipv4), smask, 4);
15061508
}
15071509

15081510
if (*daddr) {
15091511
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
15101512
outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4), daddr, 4);
1511-
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
1512-
outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4);
1513+
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
1514+
outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4), dmask, 4);
15131515
}
15141516
}
15151517

15161518
static void setup_fte_addr6(struct mlx5_flow_spec *spec,
15171519
struct mlx5e_ipsec_addr *addrs)
15181520
{
15191521
__be32 *saddr = addrs->saddr.a6;
1522+
__be32 *smask = addrs->smask.m6;
15201523
__be32 *daddr = addrs->daddr.a6;
1524+
__be32 *dmask = addrs->dmask.m6;
15211525

15221526
if (addr6_all_zero(saddr) && addr6_all_zero(daddr))
15231527
return;
@@ -1530,15 +1534,15 @@ static void setup_fte_addr6(struct mlx5_flow_spec *spec,
15301534
if (!addr6_all_zero(saddr)) {
15311535
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
15321536
outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), saddr, 16);
1533-
memset(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
1534-
outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), 0xff, 16);
1537+
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
1538+
outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), dmask, 16);
15351539
}
15361540

15371541
if (!addr6_all_zero(daddr)) {
15381542
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
15391543
outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), daddr, 16);
1540-
memset(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
1541-
outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), 0xff, 16);
1544+
memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
1545+
outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), smask, 16);
15421546
}
15431547
}
15441548

0 commit comments

Comments
 (0)