tree d7236cbec04bf6b623442c2d7d2a8cab37595712
parent 95b8e2936e1a03f8c7a434385ce3464e8e026de0
author developer <developer@mediatek.com> 1719821503 +0800
committer developer <developer@mediatek.com> 1720580112 +0800

[][openwrt][mt7988][crypto][Add support for route-based IPSec]

[Description]
Add support for route-based IPSec.

1. Refactor dst mac dicover for IPSec
In the past, we use tunnel dst IP to find a nexthop, then use nexthop
to find dst mac. However, for the route-based vti, we can't find the
real nexthop. We should use tunnel dst IP to find dst mac directly.

2. Add check for VTI
If the packet has passed through VTI (ex. route-based IPSec), the
'dev_queue_xmit' function called at network layer will cause both
skb->mac_header and skb->network_header to point to the IP header. In
this situation, 'skb_to_hnat_info' cannot correctly fill in the inner
layer information, and it needs to be filled in by
'hnat_bind_crypto_entry'.

[Release-log]
N/A


Change-Id: Ie63a7d18f0cee5b9caca63251fc5fba5f52f1ee3
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/9298628