Re: [PATCH 1/1] bonding: crypto offload enabled, non-offload slave failover, rekey failed

[Hangbin Liu <hangbin.liu@linux.dev>]

On Thu, Sep 03, 2026 at 05:01:23PM -0500, David Dai wrote:
> Create a bonding device (i.e. bond0) in active-backup mode, 2 slaves.
> Active slave: offload capable interface (i.e. eth1), primary interface.
> Backup slave: non-offload capable interface(i.e. eth2).
> Configure strongswan service swantl.conf child SA "hw_offload = crypto"
> Start strongswan service
> IPSec Crytpo Offload is enabled on top of bond0. i.e. 
> ip xfrm state |grep offload
>         crypto offload parameters: dev bond0 dir out mode crypto
> 	crypto offload parameters: dev bond0 dir in mode crypto
> 
> Active slave eth1 takes adavantage of IPSec Crypto Offload capability. 
> 
> If active slave eth1 is down for any reason (i.e. eth1 link down):
> ip link set down dev eth1
> non-offload capable interface eth2 failover to becomes active slave. 
> The existing SAs can continue use software IPsec after failover.
> Traffic still keeps going properly.
> 
> However if eth1 link had not recovered yet, strongswan service does
> new child SA rekey, or uses swanctl command to do new child SA rekey, 
> it will fail because active slave eth2 doesn't support crypto offload.
> In bond_ipsec_add_sa routine, it returns -EINVAL now, which is 
> treated as fatal error by xfrm_dev_state_add routine in kernel xfrm.
> 
> To make the non-offload active slave survive the child SA rekey, need 
> to make bond_ipsec_add_sa routine returns -EOPNOTSUPP instead when 
> active slave doesn't support IPsec Crypto offload, the xfrm will 
> gracefully fallback to create new SA using Software IPsec. 
> Network traffic can keep going.
> 
> After offload capable interface eth1 link is up, becomes active slave,
> next time strongswan child SA rekey will create a new SA which enables
> crypto offload again.
> 
> This way, network traffic is never interrupted, always keeps going.
> 
> Signed-off-by: David Dai <zdai@linux.ibm.com>
> Tested-by: David Dai <zdai@linux.ibm.com>
> ---
>  drivers/net/bonding/bond_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index ef9eb0c53c66..79fc892dab07 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -490,7 +490,7 @@ static int bond_ipsec_add_sa(struct net_device *bond_dev,
>  	    !real_dev->xfrmdev_ops->xdo_dev_state_add ||
>  	    netif_is_bond_master(real_dev)) {
>  		NL_SET_ERR_MSG_MOD(extack, "Slave does not support ipsec offload");
> -		err = -EINVAL;
> +		err = -EOPNOTSUPP;
>  		goto out;
>  	}
>  
> -- 
> 2.55.0
> 

The patch looks good to me. I am just not sure whether we should shorten
the description. Let's wait for others' opinions.

Thanks
Hangbin