Skip to contentSkip to conversation

Support UDP encapsulation in packet offload mode

PATCH Applied Leon Romanovsky 5 participants 10 messages Jul 19, 2023 – Jul 25, 2023

Subsystems (6)
Networking Network drivers Mellanox mlx5 core Networking IPsec +2 more subsystems
lore
Share & tools
lore

Leon Romanovsky

author
#0 lore raw

cover Support UDP encapsulation in packet offload mode

From: Leon Romanovsky <[email protected]>

Hi,

As was raised by Ilia in this thread [1], the ESP over UDP feature is supported in packet offload mode. So comes this series, which adds relevant bits to the mlx5 driver and opens XFRM core code to accept such configuration.

NAT-T is part of IKEv2 and strongswan uses it automatically [2].

[1] https://lore.kernel.org/all/[email protected]
[2] https://wiki.strongswan.org/projects/1/wiki/NatTraversal

Leon Romanovsky (4):
net/mlx5: Add relevant capabilities bits to support NAT-T net/mlx5e: Check for IPsec NAT-T support net/mlx5e: Support IPsec NAT-T functionality
xfrm: Support UDP encapsulation in packet offload mode

 .../mellanox/mlx5/core/en_accel/ipsec.c       | 27 +++++++-
 .../mellanox/mlx5/core/en_accel/ipsec.h       | 12 +++-
 .../mellanox/mlx5/core/en_accel/ipsec_fs.c    | 61 ++++++++++++++-----
 .../mlx5/core/en_accel/ipsec_offload.c        |  6 ++
 include/linux/mlx5/mlx5_ifc.h                 |  7 ++-
 net/xfrm/xfrm_device.c                        | 13 ++--
 6 files changed, 100 insertions(+), 26 deletions(-)
Signature · 1 line
2.41.0
author
#1 lore raw

PATCH 1/4 net/mlx5: Add relevant capabilities bits to support NAT-T

From: Leon Romanovsky <[email protected]>

Provide an ability to check if flow steering supports UDP encapsulation and decapsulation of IPsec ESP packets.

Signed-off-by Leon Romanovsky <[email protected]>
---
 include/linux/mlx5/mlx5_ifc.h | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
include/linux/mlx5/mlx5_ifc.h +5 -2
index 33344a71c3e3..b3ad6b9852ec 100644
@@ -464,10 +464,10 @@ struct mlx5_ifc_flow_table_prop_layout_bits {
 
 	u8         reformat_add_esp_trasport[0x1];
 	u8         reformat_l2_to_l3_esp_tunnel[0x1];
-	u8         reserved_at_42[0x1];
+	u8         reformat_add_esp_transport_over_udp[0x1];
 	u8         reformat_del_esp_trasport[0x1];
 	u8         reformat_l3_esp_tunnel_to_l2[0x1];
-	u8         reserved_at_45[0x1];
+	u8         reformat_del_esp_transport_over_udp[0x1];
 	u8         execute_aso[0x1];
 	u8         reserved_at_47[0x19];
 

@@ -6665,9 +6665,12 @@ enum mlx5_reformat_ctx_type {
 	MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL = 0x4,
 	MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV4 = 0x5,
 	MLX5_REFORMAT_TYPE_L2_TO_L3_ESP_TUNNEL = 0x6,
+	MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_UDPV4 = 0x7,
 	MLX5_REFORMAT_TYPE_DEL_ESP_TRANSPORT = 0x8,
 	MLX5_REFORMAT_TYPE_L3_ESP_TUNNEL_TO_L2 = 0x9,
+	MLX5_REFORMAT_TYPE_DEL_ESP_TRANSPORT_OVER_UDP = 0xa,
 	MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV6 = 0xb,
+	MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_UDPV6 = 0xc,
 	MLX5_REFORMAT_TYPE_INSERT_HDR = 0xf,
 	MLX5_REFORMAT_TYPE_REMOVE_HDR = 0x10,
 	MLX5_REFORMAT_TYPE_ADD_MACSEC = 0x11,
Signature · 1 line
2.41.0
author
#2 lore raw

PATCH 2/4 net/mlx5e: Check for IPsec NAT-T support

In reply to Leon Romanovsky

From: Leon Romanovsky <[email protected]>

Set relevant IPsec capability to indicate if flow steering supports UDP encapsulation and decapsulation of IPsec ESP packets.

Signed-off-by Leon Romanovsky <[email protected]>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h    | 1 +
 .../ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c    | 6 ++++++
 2 files changed, 7 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +1 -0
index 4e9887171508..b382b0cad7f6 100644
@@ -110,6 +110,7 @@ enum mlx5_ipsec_cap {
 	MLX5_IPSEC_CAP_ROCE             = 1 << 3,
 	MLX5_IPSEC_CAP_PRIO             = 1 << 4,
 	MLX5_IPSEC_CAP_TUNNEL           = 1 << 5,
+	MLX5_IPSEC_CAP_ESPINUDP         = 1 << 6,
 };
 
 struct mlx5e_priv;
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c +6 -0
index a3554bde3e07..5ff06263c5bd 100644
@@ -54,6 +54,12 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev)
 		    MLX5_CAP_FLOWTABLE_NIC_RX(mdev,
 					      reformat_l3_esp_tunnel_to_l2))
 			caps |= MLX5_IPSEC_CAP_TUNNEL;
+
+		if (MLX5_CAP_FLOWTABLE_NIC_TX(mdev,
+					      reformat_add_esp_transport_over_udp) &&
+		    MLX5_CAP_FLOWTABLE_NIC_RX(mdev,
+					      reformat_del_esp_transport_over_udp))
+			caps |= MLX5_IPSEC_CAP_ESPINUDP;
 	}
 
 	if (mlx5_get_roce_state(mdev) &&
Signature · 1 line
2.41.0
author
#3 lore raw

PATCH 3/4 net/mlx5e: Support IPsec NAT-T functionality

In reply to Leon Romanovsky

From: Leon Romanovsky <[email protected]>

Extend mlx5 IPsec packet offload to support UDP encapsulation of IPsec ESP packets.

Signed-off-by Leon Romanovsky <[email protected]>
---
 .../mellanox/mlx5/core/en_accel/ipsec.c       | 27 +++++++-
 .../mellanox/mlx5/core/en_accel/ipsec.h       | 11 +++-
 .../mellanox/mlx5/core/en_accel/ipsec_fs.c    | 61 ++++++++++++++-----
 3 files changed, 81 insertions(+), 18 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +25 -2
index 891d39b4bfd4..658b7d8d50c7 100644
@@ -354,6 +354,12 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,
 
 	mlx5e_ipsec_init_limits(sa_entry, attrs);
 	mlx5e_ipsec_init_macs(sa_entry, attrs);
+
+	if (x->encap) {
+		attrs->encap = true;
+		attrs->sport = x->encap->encap_sport;
+		attrs->dport = x->encap->encap_dport;
+	}
 }
 
 static int mlx5e_xfrm_validate_state(struct mlx5_core_dev *mdev,

@@ -387,8 +393,25 @@ static int mlx5e_xfrm_validate_state(struct mlx5_core_dev *mdev,
 		return -EINVAL;
 	}
 	if (x->encap) {
-		NL_SET_ERR_MSG_MOD(extack, "Encapsulated xfrm state may not be offloaded");
-		return -EINVAL;
+		if (!(mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_ESPINUDP)) {
+			NL_SET_ERR_MSG_MOD(extack, "Encapsulation is not supported");
+			return -EINVAL;
+		}
+
+		if (x->encap->encap_type != UDP_ENCAP_ESPINUDP) {
+			NL_SET_ERR_MSG_MOD(extack, "Encapsulation other than UDP is not supported");
+			return -EINVAL;
+		}
+
+		if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) {
+			NL_SET_ERR_MSG_MOD(extack, "Encapsulation is supported in packet offload mode only");
+			return -EINVAL;
+		}
+
+		if (x->props.mode != XFRM_MODE_TRANSPORT) {
+			NL_SET_ERR_MSG_MOD(extack, "Encapsulation is supported in transport mode only");
+			return -EINVAL;
+		}
 	}
 	if (!x->aead) {
 		NL_SET_ERR_MSG_MOD(extack, "Cannot offload xfrm states without aead");
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +9 -2
index b382b0cad7f6..7a7047263618 100644
@@ -94,13 +94,20 @@ struct mlx5_accel_esp_xfrm_attrs {
 	u8 dir : 2;
 	u8 type : 2;
 	u8 drop : 1;
+	u8 encap : 1;
 	u8 family;
 	struct mlx5_replay_esn replay_esn;
 	u32 authsize;
 	u32 reqid;
 	struct mlx5_ipsec_lft lft;
-	u8 smac[ETH_ALEN];
-	u8 dmac[ETH_ALEN];
+	union {
+		u8 smac[ETH_ALEN];
+		__be16 sport;
+	};
+	union {
+		u8 dmac[ETH_ALEN];
+		__be16 dport;
+	};
 };
 
 enum mlx5_ipsec_cap {
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +47 -14

84 lines not on this page · raw message

Signature · 1 line
2.41.0
author
#4 lore raw

PATCH 4/4 xfrm: Support UDP encapsulation in packet offload mode

In reply to Leon Romanovsky

From: Leon Romanovsky <[email protected]>

Since mlx5 supports UDP encapsulation in packet offload, change the XFRM core to allow users to configure it.

Signed-off-by Leon Romanovsky <[email protected]>
---
 net/xfrm/xfrm_device.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)
net/xfrm/xfrm_device.c +7 -6
index 533697e2488f..3784534c9185 100644
@@ -247,12 +247,6 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
 		return -EINVAL;
 	}
 
-	/* We don't yet support UDP encapsulation and TFC padding. */
-	if (x->encap || x->tfcpad) {
-		NL_SET_ERR_MSG(extack, "Encapsulation and TFC padding can't be offloaded");
-		return -EINVAL;
-	}
-
 	if (xuo->flags &
 	    ~(XFRM_OFFLOAD_IPV6 | XFRM_OFFLOAD_INBOUND | XFRM_OFFLOAD_PACKET)) {
 		NL_SET_ERR_MSG(extack, "Unrecognized flags in offload request");

@@ -260,6 +254,13 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
 	}
 
 	is_packet_offload = xuo->flags & XFRM_OFFLOAD_PACKET;
+
+	/* We don't yet support UDP encapsulation and TFC padding. */
+	if ((!is_packet_offload && x->encap) || x->tfcpad) {
+		NL_SET_ERR_MSG(extack, "Encapsulation and TFC padding can't be offloaded");
+		return -EINVAL;
+	}
+
 	dev = dev_get_by_index(net, xuo->ifindex);
 	if (!dev) {
 		if (!(xuo->flags & XFRM_OFFLOAD_INBOUND)) {
Signature · 1 line
2.41.0
maintainer
#5 lore raw

Re: [PATCH net-next 4/4] xfrm: Support UDP encapsulation in packet offload mode

Quoted 6 lines · On Wed, 19 Jul 2023 12:26:56 +0300 Leon Romanovsky wrote:

From: Leon Romanovsky <[email protected]>

Since mlx5 supports UDP encapsulation in packet offload, change the XFRM core to allow users to configure it.

Signed-off-by Leon Romanovsky <[email protected]>

Steffen, any opinion on this one? Would you like to take the whole series?

maintainer Acked-by
#6 lore raw

Re: [PATCH net-next 4/4] xfrm: Support UDP encapsulation in packet offload mode

Quoted 9 lines · Jakub Kicinski
Quoted 6 lines · On Wed, 19 Jul 2023 12:26:56 +0300 Leon Romanovsky wrote:

From: Leon Romanovsky <[email protected]>

Since mlx5 supports UDP encapsulation in packet offload, change the XFRM core to allow users to configure it.

Signed-off-by Leon Romanovsky <[email protected]>

Steffen, any opinion on this one? Would you like to take the whole series?

The xfrm changes are quite trivial compared to the driver changes. So it will likely create less conflicts if you take it directly.

In case you want to do that:

Acked-by Steffen Klassert <[email protected]>

Otherwise I can take it of course.

maintainer
#7 lore raw

Re: [PATCH net-next 4/4] xfrm: Support UDP encapsulation in packet offload mode

Quoted 9 lines · Steffen Klassert
Quoted 8 lines · Jakub Kicinski
Quoted 6 lines · On Wed, 19 Jul 2023 12:26:56 +0300 Leon Romanovsky wrote:

From: Leon Romanovsky <[email protected]>

Since mlx5 supports UDP encapsulation in packet offload, change the XFRM core to allow users to configure it.

Signed-off-by Leon Romanovsky <[email protected]>
Quoted 8 lines
Quoted 1 line

Steffen, any opinion on this one? Would you like to take the whole series?

The xfrm changes are quite trivial compared to the driver changes. So it will likely create less conflicts if you take it directly.

In case you want to do that:

Acked-by Steffen Klassert <[email protected]>

Sounds good to me! I'm reviving the series in PW and applying it.

Thanks,

Paolo

author
#8 lore raw

Re: [PATCH net-next 4/4] xfrm: Support UDP encapsulation in packet offload mode

Quoted 12 lines · Paolo Abeni
Quoted 11 lines · Steffen Klassert
Quoted 9 lines · Jakub Kicinski
Quoted 6 lines · On Wed, 19 Jul 2023 12:26:56 +0300 Leon Romanovsky wrote:

From: Leon Romanovsky <[email protected]>

Since mlx5 supports UDP encapsulation in packet offload, change the XFRM core to allow users to configure it.

Signed-off-by Leon Romanovsky <[email protected]>

Steffen, any opinion on this one? Would you like to take the whole series?

Quoted 8 lines
Quoted 6 lines

The xfrm changes are quite trivial compared to the driver changes. So it will likely create less conflicts if you take it directly.

In case you want to do that:

Acked-by Steffen Klassert <[email protected]>

Sounds good to me! I'm reviving the series in PW and applying it.

Thanks a lot.

Quoted 5 lines

Thanks,

Paolo

CI Applied
#9 lore raw
In reply to Leon Romanovsky
This series was applied to netdev/net-next.git (main) by Paolo Abeni <[email protected]>:

Hello:

This series was applied to netdev/net-next.git (main) by Paolo Abeni <[email protected]>:

Quoted 10 lines · On Wed, 19 Jul 2023 12:26:52 +0300 you wrote:

From: Leon Romanovsky <[email protected]>

Hi,

As was raised by Ilia in this thread [1], the ESP over UDP feature is supported in packet offload mode. So comes this series, which adds relevant bits to the mlx5 driver and opens XFRM core code to accept such configuration.

[...]

Here is the summary with links:
- [net-next,1/4] net/mlx5: Add relevant capabilities bits to support NAT-T

    https://git.kernel.org/netdev/net-next/c/57266281271a
  - [net-next,2/4] net/mlx5e: Check for IPsec NAT-T support
    https://git.kernel.org/netdev/net-next/c/4acea83a849a
  - [net-next,3/4] net/mlx5e: Support IPsec NAT-T functionality
    https://git.kernel.org/netdev/net-next/c/d65954934937
  - [net-next,4/4] xfrm: Support UDP encapsulation in packet offload mode
    https://git.kernel.org/netdev/net-next/c/89edf40220be

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html