Re: [PATCH net 7/8] net/mlx5e: Rely on reqid in IPsec tunnel mode

[Jacob Keller <jacob.e.keller@intel.com>]

On 1/13/2025 7:40 AM, Tariq Toukan wrote:
> From: Leon Romanovsky <leonro@nvidia.com>
> 
> All packet offloads SAs have reqid in it to make sure they have
> corresponding policy. While it is not strictly needed for transparent
> mode, it is extremely important in tunnel mode. In that mode, policy and
> SAs have different match criteria.
> 
> Policy catches the whole subnet addresses, and SA catches the tunnel gateways
> addresses. The source address of such tunnel is not known during egress packet
> traversal in flow steering as it is added only after successful encryption.
> 
> As reqid is required for packet offload and it is unique for every SA,
> we can safely rely on it only.
> 
> The output below shows the configured egress policy and SA by strongswan:
> 
> [leonro@vm ~]$ sudo ip x s
> src 192.169.101.2 dst 192.169.101.1
>         proto esp spi 0xc88b7652 reqid 1 mode tunnel
>         replay-window 0 flag af-unspec esn
>         aead rfc4106(gcm(aes)) 0xe406a01083986e14d116488549094710e9c57bc6 128
>         anti-replay esn context:
>          seq-hi 0x0, seq 0x0, oseq-hi 0x0, oseq 0x0
>          replay_window 1, bitmap-length 1
>          00000000
>         crypto offload parameters: dev eth2 dir out mode packet
> 
> [leonro@064 ~]$ sudo ip x p
> src 192.170.0.0/16 dst 192.170.0.0/16
>         dir out priority 383615 ptype main
>         tmpl src 192.169.101.2 dst 192.169.101.1
>                 proto esp spi 0xc88b7652 reqid 1 mode tunnel
>         crypto offload parameters: dev eth2 mode packet
> 
> Fixes: b3beba1fb404 ("net/mlx5e: Allow policies with reqid 0, to support IKE policy holes")
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
> ---

Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>