github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-07 05:55:44 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bonding: disallow setting nested bonding + ipsec offload

Browse Source 
[ Upstream commit b121693381 ]

bonding interface can be nested and it supports ipsec offload.
So, it allows setting the nested bonding + ipsec scenario.
But code does not support this scenario.
So, it should be disallowed.

interface graph:
bond2
   |
bond1
   |
eth0

The nested bonding + ipsec offload may not a real usecase.
So, disallowing this scenario is fine.

Fixes: 18cb261afd ("bonding: support hardware encryption offload to slaves")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Taehee Yoo 2021-07-05 15:38:11 +00:00 committed by Greg Kroah-Hartman
parent 43511a6a16
commit b3bd1f5e50
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/net/bonding/bond_main.c
View File

@ -403,8 +403,9 @@ static int bond_ipsec_add_sa(struct xfrm_state *xs)
xs->xso.real_dev = slave->dev; xs->xso.real_dev = slave->dev;
bond->xs = xs; bond->xs = xs;
if (!(slave->dev->xfrmdev_ops if (!slave->dev->xfrmdev_ops ||
&& slave->dev->xfrmdev_ops->xdo_dev_state_add)) { !slave->dev->xfrmdev_ops->xdo_dev_state_add ||
netif_is_bond_master(slave->dev)) {
slave_warn(bond_dev, slave->dev, "Slave does not support ipsec offload\n"); slave_warn(bond_dev, slave->dev, "Slave does not support ipsec offload\n");
rcu_read_unlock(); rcu_read_unlock();
return -EINVAL; return -EINVAL;
@ -437,8 +438,9 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs)
xs->xso.real_dev = slave->dev; xs->xso.real_dev = slave->dev;
if (!(slave->dev->xfrmdev_ops if (!slave->dev->xfrmdev_ops ||
&& slave->dev->xfrmdev_ops->xdo_dev_state_delete)) { !slave->dev->xfrmdev_ops->xdo_dev_state_delete ||
netif_is_bond_master(slave->dev)) {
slave_warn(bond_dev, slave->dev, "%s: no slave xdo_dev_state_delete\n", __func__); slave_warn(bond_dev, slave->dev, "%s: no slave xdo_dev_state_delete\n", __func__);
goto out; goto out;
} }
@ -463,8 +465,9 @@ static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs)
if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP)
return true; return true;
if (!(slave_dev->xfrmdev_ops if (!slave_dev->xfrmdev_ops ||
&& slave_dev->xfrmdev_ops->xdo_dev_offload_ok)) { !slave_dev->xfrmdev_ops->xdo_dev_offload_ok ||
netif_is_bond_master(slave_dev)) {
slave_warn(bond_dev, slave_dev, "%s: no slave xdo_dev_offload_ok\n", __func__); slave_warn(bond_dev, slave_dev, "%s: no slave xdo_dev_offload_ok\n", __func__);
return false; return false;
} }