Re: ipsec doesn't route TCP with 4.11 kernel

From	Steffen Klassert <steffen.klassert@secunet.com>
Newsgroups	linux.kernel
Subject	Re: ipsec doesn't route TCP with 4.11 kernel
Date	2017-05-03 10:30 +0200
Message-ID	<tCXPz-2wj-3@gated-at.bofh.it> (permalink)
References	(1 earlier) <tAJQJ-4gp-3@gated-at.bofh.it> <tANrk-6wQ-13@gated-at.bofh.it> <tB9rP-4OU-13@gated-at.bofh.it> <tB9rP-4OU-11@gated-at.bofh.it> <tBhfI-1AI-27@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, Apr 28, 2017 at 09:46:42AM -0700, Eric Dumazet wrote:
> On Fri, 2017-04-28 at 09:13 +0200, Steffen Klassert wrote:
> >          encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
> > 
> > Ok, this is espinudp. This information was important.
> 
> > This is not a GRO issue as I thought, the TX side is already broken.
> > 
> > Could you please try the patch below?
> > 
> > Subject: [PATCH] esp4: Fix udpencap for local TCP packets.
> > 
> > Locally generated TCP packets are usually cloned, so we
> > do skb_cow_data() on this packets. After that we need to
> > reload the pointer to the esp header. On udpencap this
> > header has an offset to skb_transport_header, so take this
> > offset into account.
> 
> 
> It looks like locally generated TCP packets could avoid the
> skb_cow_data(), if you were using skb_header_cloned() instead of
> skb_cloned()  ?

Yes, should be possible in the codepath where we do crypto
with separate src and dst buffers. Would require some
rearrangements to make sure we don't do inplace crypto
in this case.

Thanks for the hint!

Thread

ipsec doesn't route TCP with 4.11 kernel Don Bowman <db@donbowman.ca> - 2017-04-26 03:10 +0200
  Re: ipsec doesn't route TCP with 4.11 kernel Joseph Salisbury <joseph.salisbury@canonical.com> - 2017-04-26 21:10 +0200
    Re: ipsec doesn't route TCP with 4.11 kernel Don Bowman <db@donbowman.ca> - 2017-04-28 00:40 +0200
      Re: ipsec doesn't route TCP with 4.11 kernel Joseph Salisbury <joseph.salisbury@canonical.com> - 2017-05-01 16:00 +0200
  Re: ipsec doesn't route TCP with 4.11 kernel Cong Wang <xiyou.wangcong@gmail.com> - 2017-04-27 07:10 +0200
    Re: ipsec doesn't route TCP with 4.11 kernel Steffen Klassert <steffen.klassert@secunet.com> - 2017-04-27 11:00 +0200
      Re: ipsec doesn't route TCP with 4.11 kernel Don Bowman <db@donbowman.ca> - 2017-04-28 00:20 +0200
      Re: ipsec doesn't route TCP with 4.11 kernel Steffen Klassert <steffen.klassert@secunet.com> - 2017-04-28 10:30 +0200
        Re: ipsec doesn't route TCP with 4.11 kernel Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-28 18:50 +0200
          Re: ipsec doesn't route TCP with 4.11 kernel Steffen Klassert <steffen.klassert@secunet.com> - 2017-05-03 10:30 +0200
        Re: ipsec doesn't route TCP with 4.11 kernel Don Bowman <db@donbowman.ca> - 2017-04-30 02:50 +0200
          Re: ipsec doesn't route TCP with 4.11 kernel Steffen Klassert <steffen.klassert@secunet.com> - 2017-05-03 10:20 +0200

csiph-web