[][openwrt][mt7988][crypto][prevent hnat bind UDP flow]
[Description]
Change HNAT binding flow.
HNAT will not bind UDP encrypted flow since EIP197 HW does not support
fragmentation. If we bind UDP flow to encryption, it will possibly cause
network fail due to fragmentation.
[Release-log]
N/A
Change-Id: I421b20e39ccbc91b805ce2977fa662a121a0db4b
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/7962051
diff --git a/package-21.02/kernel/crypto-eip/src/xfrm-offload.c b/package-21.02/kernel/crypto-eip/src/xfrm-offload.c
index 9e101e8..1f29dd0 100644
--- a/package-21.02/kernel/crypto-eip/src/xfrm-offload.c
+++ b/package-21.02/kernel/crypto-eip/src/xfrm-offload.c
@@ -282,6 +282,16 @@
{
struct mtk_xfrm_params *xfrm_params;
+ /*
+ * EIP197 does not support fragmentation. As a result, we can not bind UDP
+ * flow since it may cause network fail due to fragmentation
+ */
+ if (ntohs(skb->protocol) != ETH_P_IP
+ || ip_hdr(skb)->protocol != IPPROTO_TCP) {
+ skb_hnat_alg(skb) = 1;
+ return false;
+ }
+
xfrm_params = (struct mtk_xfrm_params *)xs->xso.offload_handle;
skb_hnat_cdrt(skb) = xfrm_params->cdrt->idx;