| Message ID | 20220525135912.181765-2-radu.nicolau@intel.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | akhil goyal |
| Headers | show |
| Series | [1/3] ipsec: fix NAT-T ports and length | expand |
| Context | Check | Description |
|---|---|---|
| ci/checkpatch | success | coding style OK |
> -----Original Message----- > From: Radu Nicolau <radu.nicolau@intel.com> > Sent: Wednesday, May 25, 2022 2:59 PM > To: Nicolau, Radu <radu.nicolau@intel.com>; Akhil Goyal <gakhil@marvell.com> > Cc: dev@dpdk.org; Buckley, Daniel M <daniel.m.buckley@intel.com>; Zhang, Qi > Z <qi.z.zhang@intel.com>; stable@dpdk.org > Subject: [PATCH 2/3] examples/ipsec-secgw: fix NAT-T header fields > > Use the proper IP protocol (UDP instead of ESP) and set the ports when > UDP encapsulation is enabled. > > Fixes: 9ae86b4cfc77 ("examples/ipsec-secgw: support UDP encap for inline > crypto") > Cc: stable@dpdk.org > > Signed-off-by: Radu Nicolau <radu.nicolau@intel.com> > --- Acked-by: Fan Zhang <roy.fan.zhang@intel.com>
diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c index 1839ac71af..45509c5c68 100644 --- a/examples/ipsec-secgw/sa.c +++ b/examples/ipsec-secgw/sa.c @@ -1458,6 +1458,8 @@ fill_ipsec_sa_prm(struct rte_ipsec_sa_prm *prm, const struct ipsec_sa *ss, RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT : RTE_SECURITY_IPSEC_SA_MODE_TUNNEL; prm->ipsec_xform.options.udp_encap = ss->udp_encap; + prm->ipsec_xform.udp.dport = ss->udp.dport; + prm->ipsec_xform.udp.sport = ss->udp.sport; prm->ipsec_xform.options.ecn = 1; prm->ipsec_xform.options.copy_dscp = 1; @@ -1513,13 +1515,13 @@ ipsec_sa_init(struct ipsec_sa *lsa, struct rte_ipsec_sa *sa, uint32_t sa_size) .version_ihl = IPVERSION << 4 | sizeof(v4) / RTE_IPV4_IHL_MULTIPLIER, .time_to_live = IPDEFTTL, - .next_proto_id = IPPROTO_ESP, + .next_proto_id = lsa->udp_encap ? IPPROTO_UDP : IPPROTO_ESP, .src_addr = lsa->src.ip.ip4, .dst_addr = lsa->dst.ip.ip4, }; struct rte_ipv6_hdr v6 = { .vtc_flow = htonl(IP6_VERSION << 28), - .proto = IPPROTO_ESP, + .proto = lsa->udp_encap ? IPPROTO_UDP : IPPROTO_ESP, }; if (IS_IP6_TUNNEL(lsa->flags)) {
Use the proper IP protocol (UDP instead of ESP) and set the ports when UDP encapsulation is enabled. Fixes: 9ae86b4cfc77 ("examples/ipsec-secgw: support UDP encap for inline crypto") Cc: stable@dpdk.org Signed-off-by: Radu Nicolau <radu.nicolau@intel.com> --- examples/ipsec-secgw/sa.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)