[EXT] [PATCH] ipsec: fix NAT-T length calculation

[Xiao Liang]

The context

    hlen = sa->hdr_len + sa->iv_len + sizeof(*esph);
    ...
    ph = rte_pktmbuf_prepend(mb, hlen - l2len);
    ...
    update_tun_outb_l3hdr(sa, ph + sa->hdr_l3_off, ph + hlen,
        mb->pkt_len - sqh_len, sa->hdr_l3_off, sqn_low16(sqc));

assumes L2 header length included in sa->hdr_len.

Even if hdr_len doesn't include L2, then mb->pkt_len won't either, so
UDP datagram length should still be
    mb->pkt_len - sqh_len - sa->hdr_len + sizeof(struct rte_udp_hdr);

On Fri, Jul 7, 2023 at 8:51 PM Xiao Liang <shaw.leon at gmail.com> wrote:
>
> > sa->hdr_len and prm->tun.hdr_len don't include L2 length so both should
> > start in the diagram at the end of the ETH header.
> >
> > So the right way to compute datagram length is
> >
> > dgram_len = mb->pkt_len - sqh_len - sa->hdr_l3_off - sa->hdr_len +
> > sizeof(struct rte_udp_hdr)
> >
>
> |<-           mb->pkt_len - sqh_len                   ->|
> |<- sa->hdr_l3_off ->|<- sa->hdr_len ->|
>                                   |<- udph->dgram_len ->|
>
> +--------------------+------------+-----+-----+---------+-----+
> |         ETH        |     IP     | UDP | ESP | payload | sqh |
> +--------------------+------------+-----+-----+---------+-----+
>
> |<- sa->hdr_l3_off ->|<- l3_len ->|
>                      |<- sa->hdr_len  ->|
>
> If hdr_len doesn't include L2 length, I would agree that
>
>     dgram_len = mb->pkt_len - sqh_len - sa->hdr_l3_off - sa->hdr_len +
> sizeof(struct rte_udp_hdr)
>
> But then what's the point of
>     sa->hdr_len - sa->hdr_l3_off
> in lib/ipsec/sa.c?