Linux/include/net/tls.h

Version: ~ [ linux-6.12-rc7 ] ~ [ linux-6.11.7 ] ~ [ linux-6.10.14 ] ~ [ linux-6.9.12 ] ~ [ linux-6.8.12 ] ~ [ linux-6.7.12 ] ~ [ linux-6.6.60 ] ~ [ linux-6.5.13 ] ~ [ linux-6.4.16 ] ~ [ linux-6.3.13 ] ~ [ linux-6.2.16 ] ~ [ linux-6.1.116 ] ~ [ linux-6.0.19 ] ~ [ linux-5.19.17 ] ~ [ linux-5.18.19 ] ~ [ linux-5.17.15 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.171 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.229 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.285 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.323 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.336 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.337 ] ~ [ linux-4.4.302 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.12 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

Diff markup

1 /* 1 /* 2 * Copyright (c) 2016-2017, Mellanox Technolog 2 * Copyright (c) 2016-2017, Mellanox Technologies. All rights reserved. 3 * Copyright (c) 2016-2017, Dave Watson <davej 3 * Copyright (c) 2016-2017, Dave Watson <davejwatson@fb.com>. All rights reserved. 4 * 4 * 5 * This software is available to you under a c 5 * This software is available to you under a choice of one of two 6 * licenses. You may choose to be licensed un 6 * licenses. You may choose to be licensed under the terms of the GNU 7 * General Public License (GPL) Version 2, ava 7 * General Public License (GPL) Version 2, available from the file 8 * COPYING in the main directory of this sourc 8 * COPYING in the main directory of this source tree, or the 9 * OpenIB.org BSD license below: 9 * OpenIB.org BSD license below: 10 * 10 * 11 * Redistribution and use in source and bi 11 * Redistribution and use in source and binary forms, with or 12 * without modification, are permitted pro 12 * without modification, are permitted provided that the following 13 * conditions are met: 13 * conditions are met: 14 * 14 * 15 * - Redistributions of source code must 15 * - Redistributions of source code must retain the above 16 * copyright notice, this list of condi 16 * copyright notice, this list of conditions and the following 17 * disclaimer. 17 * disclaimer. 18 * 18 * 19 * - Redistributions in binary form must 19 * - Redistributions in binary form must reproduce the above 20 * copyright notice, this list of condi 20 * copyright notice, this list of conditions and the following 21 * disclaimer in the documentation and/ 21 * disclaimer in the documentation and/or other materials 22 * provided with the distribution. 22 * provided with the distribution. 23 * 23 * 24 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT W 24 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 25 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMIT 25 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 26 * MERCHANTABILITY, FITNESS FOR A PARTICULAR P 26 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 27 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTH 27 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 28 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER L 28 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 29 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARIS 29 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 30 * CONNECTION WITH THE SOFTWARE OR THE USE OR 30 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 31 * SOFTWARE. 31 * SOFTWARE. 32 */ 32 */ 33 33 34 #ifndef _TLS_OFFLOAD_H 34 #ifndef _TLS_OFFLOAD_H 35 #define _TLS_OFFLOAD_H 35 #define _TLS_OFFLOAD_H 36 36 37 #include <linux/types.h> 37 #include <linux/types.h> 38 #include <asm/byteorder.h> 38 #include <asm/byteorder.h> 39 #include <linux/crypto.h> 39 #include <linux/crypto.h> 40 #include <linux/socket.h> 40 #include <linux/socket.h> 41 #include <linux/tcp.h> 41 #include <linux/tcp.h> 42 #include <linux/mutex.h> << 43 #include <linux/netdevice.h> << 44 #include <linux/rcupdate.h> << 45 << 46 #include <net/net_namespace.h> << 47 #include <net/tcp.h> 42 #include <net/tcp.h> 48 #include <net/strparser.h> !! 43 49 #include <crypto/aead.h> << 50 #include <uapi/linux/tls.h> 44 #include <uapi/linux/tls.h> 51 45 52 struct tls_rec; << 53 46 54 /* Maximum data size carried in a TLS record * 47 /* Maximum data size carried in a TLS record */ 55 #define TLS_MAX_PAYLOAD_SIZE ((size 48 #define TLS_MAX_PAYLOAD_SIZE ((size_t)1 << 14) 56 49 57 #define TLS_HEADER_SIZE 5 50 #define TLS_HEADER_SIZE 5 58 #define TLS_NONCE_OFFSET TLS_HE 51 #define TLS_NONCE_OFFSET TLS_HEADER_SIZE 59 52 60 #define TLS_CRYPTO_INFO_READY(info) ((info 53 #define TLS_CRYPTO_INFO_READY(info) ((info)->cipher_type) 61 54 62 #define TLS_AAD_SPACE_SIZE 13 !! 55 #define TLS_RECORD_TYPE_DATA 0x17 63 << 64 #define TLS_MAX_IV_SIZE 16 << 65 #define TLS_MAX_SALT_SIZE 4 << 66 #define TLS_TAG_SIZE 16 << 67 #define TLS_MAX_REC_SEQ_SIZE 8 << 68 #define TLS_MAX_AAD_SIZE TLS_AA << 69 << 70 /* For CCM mode, the full 16-bytes of IV is ma << 71 * << 72 * IV[16] = b0[1] || implicit nonce[4] || expl << 73 * << 74 * The field 'length' is encoded in field 'b0' << 75 * Hence b0 contains (3 - 1) = 2. << 76 */ << 77 #define TLS_AES_CCM_IV_B0_BYTE 2 << 78 #define TLS_SM4_CCM_IV_B0_BYTE 2 << 79 56 80 enum { !! 57 #define TLS_AAD_SPACE_SIZE 13 81 TLS_BASE, << 82 TLS_SW, << 83 TLS_HW, << 84 TLS_HW_RECORD, << 85 TLS_NUM_CONFIG, << 86 }; << 87 << 88 struct tx_work { << 89 struct delayed_work work; << 90 struct sock *sk; << 91 }; << 92 58 93 struct tls_sw_context_tx { !! 59 struct tls_sw_context { 94 struct crypto_aead *aead_send; 60 struct crypto_aead *aead_send; 95 struct crypto_wait async_wait; 61 struct crypto_wait async_wait; 96 struct tx_work tx_work; << 97 struct tls_rec *open_rec; << 98 struct list_head tx_list; << 99 atomic_t encrypt_pending; << 100 u8 async_capable:1; << 101 << 102 #define BIT_TX_SCHEDULED 0 << 103 #define BIT_TX_CLOSING 1 << 104 unsigned long tx_bitmask; << 105 }; << 106 << 107 struct tls_strparser { << 108 struct sock *sk; << 109 62 110 u32 mark : 8; !! 63 /* Sending context */ 111 u32 stopped : 1; !! 64 char aad_space[TLS_AAD_SPACE_SIZE]; 112 u32 copy_mode : 1; << 113 u32 mixed_decrypted : 1; << 114 65 115 bool msg_ready; !! 66 unsigned int sg_plaintext_size; 116 !! 67 int sg_plaintext_num_elem; 117 struct strp_msg stm; !! 68 struct scatterlist sg_plaintext_data[MAX_SKB_FRAGS]; 118 !! 69 119 struct sk_buff *anchor; !! 70 unsigned int sg_encrypted_size; 120 struct work_struct work; !! 71 int sg_encrypted_num_elem; 121 }; !! 72 struct scatterlist sg_encrypted_data[MAX_SKB_FRAGS]; 122 !! 73 123 struct tls_sw_context_rx { !! 74 /* AAD | sg_plaintext_data | sg_tag */ 124 struct crypto_aead *aead_recv; !! 75 struct scatterlist sg_aead_in[2]; 125 struct crypto_wait async_wait; !! 76 /* AAD | sg_encrypted_data (data contain overhead for hdr&iv&tag) */ 126 struct sk_buff_head rx_list; /* lis !! 77 struct scatterlist sg_aead_out[2]; 127 void (*saved_data_ready)(struct sock * << 128 << 129 u8 reader_present; << 130 u8 async_capable:1; << 131 u8 zc_capable:1; << 132 u8 reader_contended:1; << 133 << 134 struct tls_strparser strp; << 135 << 136 atomic_t decrypt_pending; << 137 struct sk_buff_head async_hold; << 138 struct wait_queue_head wq; << 139 }; << 140 << 141 struct tls_record_info { << 142 struct list_head list; << 143 u32 end_seq; << 144 int len; << 145 int num_frags; << 146 skb_frag_t frags[MAX_SKB_FRAGS]; << 147 }; 78 }; 148 79 149 #define TLS_DRIVER_STATE_SIZE_TX 16 !! 80 enum { 150 struct tls_offload_context_tx { !! 81 TLS_PENDING_CLOSED_RECORD 151 struct crypto_aead *aead_send; << 152 spinlock_t lock; /* protects re << 153 struct list_head records_list; << 154 struct tls_record_info *open_record; << 155 struct tls_record_info *retransmit_hin << 156 u64 hint_record_sn; << 157 u64 unacked_record_sn; << 158 << 159 struct scatterlist sg_tx_data[MAX_SKB_ << 160 void (*sk_destruct)(struct sock *sk); << 161 struct work_struct destruct_work; << 162 struct tls_context *ctx; << 163 /* The TLS layer reserves room for dri << 164 * Currently the belief is that there << 165 * driver specific state to justify an << 166 */ << 167 u8 driver_state[TLS_DRIVER_STATE_SIZE_ << 168 }; << 169 << 170 enum tls_context_flags { << 171 /* tls_device_down was called after th << 172 * was released, and kTLS works in sof << 173 * still TLS_HW (needed for transition << 174 */ << 175 TLS_RX_DEV_DEGRADED = 0, << 176 /* Unlike RX where resync is driven en << 177 * the driver knows when things went o << 178 * to be atomic. << 179 */ << 180 TLS_TX_SYNC_SCHED = 1, << 181 /* tls_dev_del was called for the RX s << 182 * but tls_ctx->netdev might still be << 183 * resources might not be released yet << 184 * tls_dev_del call in tls_device_down << 185 */ << 186 TLS_RX_DEV_CLOSED = 2, << 187 }; << 188 << 189 struct cipher_context { << 190 char iv[TLS_MAX_IV_SIZE + TLS_MAX_SALT << 191 char rec_seq[TLS_MAX_REC_SEQ_SIZE]; << 192 }; 82 }; 193 83 194 union tls_crypto_context { !! 84 struct tls_context { 195 struct tls_crypto_info info; << 196 union { 85 union { 197 struct tls12_crypto_info_aes_g !! 86 struct tls_crypto_info crypto_send; 198 struct tls12_crypto_info_aes_g !! 87 struct tls12_crypto_info_aes_gcm_128 crypto_send_aes_gcm_128; 199 struct tls12_crypto_info_chach << 200 struct tls12_crypto_info_sm4_g << 201 struct tls12_crypto_info_sm4_c << 202 }; 88 }; 203 }; << 204 89 205 struct tls_prot_info { !! 90 void *priv_ctx; 206 u16 version; !! 91 207 u16 cipher_type; !! 92 u8 tx_conf:2; >> 93 208 u16 prepend_size; 94 u16 prepend_size; 209 u16 tag_size; 95 u16 tag_size; 210 u16 overhead_size; 96 u16 overhead_size; 211 u16 iv_size; 97 u16 iv_size; 212 u16 salt_size; !! 98 char *iv; 213 u16 rec_seq_size; 99 u16 rec_seq_size; 214 u16 aad_size; !! 100 char *rec_seq; 215 u16 tail_size; << 216 }; << 217 << 218 struct tls_context { << 219 /* read-only cache line */ << 220 struct tls_prot_info prot_info; << 221 << 222 u8 tx_conf:3; << 223 u8 rx_conf:3; << 224 u8 zerocopy_sendfile:1; << 225 u8 rx_no_pad:1; << 226 << 227 int (*push_pending_record)(struct sock << 228 void (*sk_write_space)(struct sock *sk << 229 << 230 void *priv_ctx_tx; << 231 void *priv_ctx_rx; << 232 << 233 struct net_device __rcu *netdev; << 234 << 235 /* rw cache line */ << 236 struct cipher_context tx; << 237 struct cipher_context rx; << 238 101 239 struct scatterlist *partially_sent_rec 102 struct scatterlist *partially_sent_record; 240 u16 partially_sent_offset; 103 u16 partially_sent_offset; 241 << 242 bool splicing_pages; << 243 bool pending_open_record_frags; << 244 << 245 struct mutex tx_lock; /* protects part << 246 * per-type TX f << 247 */ << 248 unsigned long flags; 104 unsigned long flags; >> 105 bool in_tcp_sendpages; 249 106 250 /* cache cold stuff */ !! 107 u16 pending_open_record_frags; 251 struct proto *sk_proto; !! 108 int (*push_pending_record)(struct sock *sk, int flags); 252 struct sock *sk; << 253 << 254 void (*sk_destruct)(struct sock *sk); << 255 << 256 union tls_crypto_context crypto_send; << 257 union tls_crypto_context crypto_recv; << 258 << 259 struct list_head list; << 260 refcount_t refcount; << 261 struct rcu_head rcu; << 262 }; << 263 109 264 enum tls_offload_ctx_dir { !! 110 void (*sk_write_space)(struct sock *sk); 265 TLS_OFFLOAD_CTX_DIR_RX, !! 111 void (*sk_proto_close)(struct sock *sk, long timeout); 266 TLS_OFFLOAD_CTX_DIR_TX, << 267 }; << 268 112 269 struct tlsdev_ops { !! 113 int (*setsockopt)(struct sock *sk, int level, 270 int (*tls_dev_add)(struct net_device * !! 114 int optname, char __user *optval, 271 enum tls_offload_ct !! 115 unsigned int optlen); 272 struct tls_crypto_i !! 116 int (*getsockopt)(struct sock *sk, int level, 273 u32 start_offload_t !! 117 int optname, char __user *optval, 274 void (*tls_dev_del)(struct net_device !! 118 int __user *optlen); 275 struct tls_context << 276 enum tls_offload_c << 277 int (*tls_dev_resync)(struct net_devic << 278 struct sock *sk, << 279 enum tls_offload << 280 }; 119 }; 281 120 282 enum tls_offload_sync_type { !! 121 int wait_on_pending_writer(struct sock *sk, long *timeo); 283 TLS_OFFLOAD_SYNC_TYPE_DRIVER_REQ = 0, !! 122 int tls_sk_query(struct sock *sk, int optname, char __user *optval, 284 TLS_OFFLOAD_SYNC_TYPE_CORE_NEXT_HINT = !! 123 int __user *optlen); 285 TLS_OFFLOAD_SYNC_TYPE_DRIVER_REQ_ASYNC !! 124 int tls_sk_attach(struct sock *sk, int optname, char __user *optval, 286 }; !! 125 unsigned int optlen); 287 126 288 #define TLS_DEVICE_RESYNC_NH_START_IVAL << 289 #define TLS_DEVICE_RESYNC_NH_MAX_IVAL << 290 127 291 #define TLS_DEVICE_RESYNC_ASYNC_LOGMAX !! 128 int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx); 292 struct tls_offload_resync_async { !! 129 int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size); 293 atomic64_t req; !! 130 int tls_sw_sendpage(struct sock *sk, struct page *page, 294 u16 loglen; !! 131 int offset, size_t size, int flags); 295 u16 rcd_delta; !! 132 void tls_sw_close(struct sock *sk, long timeout); 296 u32 log[TLS_DEVICE_RESYNC_ASYNC_LOGMAX !! 133 void tls_sw_free_tx_resources(struct sock *sk); 297 }; << 298 134 299 #define TLS_DRIVER_STATE_SIZE_RX 8 !! 135 void tls_sk_destruct(struct sock *sk, struct tls_context *ctx); 300 struct tls_offload_context_rx { !! 136 void tls_icsk_clean_acked(struct sock *sk); 301 /* sw must be the first member of tls_ << 302 struct tls_sw_context_rx sw; << 303 enum tls_offload_sync_type resync_type << 304 /* this member is set regardless of re << 305 u8 resync_nh_reset:1; << 306 /* CORE_NEXT_HINT-only member, but use << 307 u8 resync_nh_do_now:1; << 308 union { << 309 /* TLS_OFFLOAD_SYNC_TYPE_DRIVE << 310 struct { << 311 atomic64_t resync_req; << 312 }; << 313 /* TLS_OFFLOAD_SYNC_TYPE_CORE_ << 314 struct { << 315 u32 decrypted_failed; << 316 u32 decrypted_tgt; << 317 } resync_nh; << 318 /* TLS_OFFLOAD_SYNC_TYPE_DRIVE << 319 struct { << 320 struct tls_offload_res << 321 }; << 322 }; << 323 /* The TLS layer reserves room for dri << 324 * Currently the belief is that there << 325 * driver specific state to justify an << 326 */ << 327 u8 driver_state[TLS_DRIVER_STATE_SIZE_ << 328 }; << 329 137 330 struct tls_record_info *tls_get_record(struct !! 138 int tls_push_sg(struct sock *sk, struct tls_context *ctx, 331 u32 seq !! 139 struct scatterlist *sg, u16 first_offset, >> 140 int flags); >> 141 int tls_push_pending_closed_record(struct sock *sk, struct tls_context *ctx, >> 142 int flags, long *timeo); 332 143 333 static inline bool tls_record_is_start_marker( !! 144 static inline bool tls_is_pending_closed_record(struct tls_context *ctx) 334 { 145 { 335 return rec->len == 0; !! 146 return test_bit(TLS_PENDING_CLOSED_RECORD, &ctx->flags); 336 } 147 } 337 148 338 static inline u32 tls_record_start_seq(struct !! 149 static inline int tls_complete_pending_work(struct sock *sk, >> 150 struct tls_context *ctx, >> 151 int flags, long *timeo) 339 { 152 { 340 return rec->end_seq - rec->len; !! 153 int rc = 0; 341 } << 342 154 343 struct sk_buff * !! 155 if (unlikely(sk->sk_write_pending)) 344 tls_validate_xmit_skb(struct sock *sk, struct !! 156 rc = wait_on_pending_writer(sk, timeo); 345 struct sk_buff *skb); << 346 struct sk_buff * << 347 tls_validate_xmit_skb_sw(struct sock *sk, stru << 348 struct sk_buff *skb); << 349 157 350 static inline bool tls_is_skb_tx_device_offloa !! 158 if (!rc && tls_is_pending_closed_record(ctx)) 351 { !! 159 rc = tls_push_pending_closed_record(sk, ctx, flags, timeo); 352 #ifdef CONFIG_TLS_DEVICE << 353 struct sock *sk = skb->sk; << 354 160 355 return sk && sk_fullsock(sk) && !! 161 return rc; 356 (smp_load_acquire(&sk->sk_valid << 357 &tls_validate_xmit_skb); << 358 #else << 359 return false; << 360 #endif << 361 } 162 } 362 163 363 static inline struct tls_context *tls_get_ctx( !! 164 static inline bool tls_is_partially_sent_record(struct tls_context *ctx) 364 { 165 { 365 const struct inet_connection_sock *ics !! 166 return !!ctx->partially_sent_record; 366 << 367 /* Use RCU on icsk_ulp_data only for s << 368 * TLS data path doesn't need rcu_dere << 369 */ << 370 return (__force void *)icsk->icsk_ulp_ << 371 } 167 } 372 168 373 static inline struct tls_sw_context_rx *tls_sw !! 169 static inline bool tls_is_pending_open_record(struct tls_context *tls_ctx) 374 const struct tls_context *tls_ << 375 { 170 { 376 return (struct tls_sw_context_rx *)tls !! 171 return tls_ctx->pending_open_record_frags; 377 } 172 } 378 173 379 static inline struct tls_sw_context_tx *tls_sw !! 174 static inline void tls_err_abort(struct sock *sk) 380 const struct tls_context *tls_ << 381 { 175 { 382 return (struct tls_sw_context_tx *)tls !! 176 sk->sk_err = EBADMSG; >> 177 sk->sk_error_report(sk); 383 } 178 } 384 179 385 static inline struct tls_offload_context_tx * !! 180 static inline bool tls_bigint_increment(unsigned char *seq, int len) 386 tls_offload_ctx_tx(const struct tls_context *t << 387 { 181 { 388 return (struct tls_offload_context_tx !! 182 int i; 389 } << 390 << 391 static inline bool tls_sw_has_ctx_tx(const str << 392 { << 393 struct tls_context *ctx = tls_get_ctx( << 394 << 395 if (!ctx) << 396 return false; << 397 return !!tls_sw_ctx_tx(ctx); << 398 } << 399 183 400 static inline bool tls_sw_has_ctx_rx(const str !! 184 for (i = len - 1; i >= 0; i--) { 401 { !! 185 ++seq[i]; 402 struct tls_context *ctx = tls_get_ctx( !! 186 if (seq[i] != 0) >> 187 break; >> 188 } 403 189 404 if (!ctx) !! 190 return (i == -1); 405 return false; << 406 return !!tls_sw_ctx_rx(ctx); << 407 } 191 } 408 192 409 static inline struct tls_offload_context_rx * !! 193 static inline void tls_advance_record_sn(struct sock *sk, 410 tls_offload_ctx_rx(const struct tls_context *t !! 194 struct tls_context *ctx) 411 { 195 { 412 return (struct tls_offload_context_rx !! 196 if (tls_bigint_increment(ctx->rec_seq, ctx->rec_seq_size)) >> 197 tls_err_abort(sk); >> 198 tls_bigint_increment(ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, >> 199 ctx->iv_size); 413 } 200 } 414 201 415 static inline void *__tls_driver_ctx(struct tl !! 202 static inline void tls_fill_prepend(struct tls_context *ctx, 416 enum tls_ !! 203 char *buf, >> 204 size_t plaintext_len, >> 205 unsigned char record_type) 417 { 206 { 418 if (direction == TLS_OFFLOAD_CTX_DIR_T !! 207 size_t pkt_len, iv_size = ctx->iv_size; 419 return tls_offload_ctx_tx(tls_ << 420 else << 421 return tls_offload_ctx_rx(tls_ << 422 } << 423 << 424 static inline void * << 425 tls_driver_ctx(const struct sock *sk, enum tls << 426 { << 427 return __tls_driver_ctx(tls_get_ctx(sk << 428 } << 429 208 430 #define RESYNC_REQ BIT(0) !! 209 pkt_len = plaintext_len + iv_size + ctx->tag_size; 431 #define RESYNC_REQ_ASYNC BIT(1) << 432 /* The TLS context is valid until sk_destruct << 433 static inline void tls_offload_rx_resync_reque << 434 { << 435 struct tls_context *tls_ctx = tls_get_ << 436 struct tls_offload_context_rx *rx_ctx << 437 210 438 atomic64_set(&rx_ctx->resync_req, ((u6 !! 211 /* we cover nonce explicit here as well, so buf should be of >> 212 * size KTLS_DTLS_HEADER_SIZE + KTLS_DTLS_NONCE_EXPLICIT_SIZE >> 213 */ >> 214 buf[0] = record_type; >> 215 buf[1] = TLS_VERSION_MINOR(ctx->crypto_send.version); >> 216 buf[2] = TLS_VERSION_MAJOR(ctx->crypto_send.version); >> 217 /* we can use IV for nonce explicit according to spec */ >> 218 buf[3] = pkt_len >> 8; >> 219 buf[4] = pkt_len & 0xFF; >> 220 memcpy(buf + TLS_NONCE_OFFSET, >> 221 ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, iv_size); 439 } 222 } 440 223 441 /* Log all TLS record header TCP sequences in !! 224 static inline void tls_make_aad(char *buf, 442 static inline void !! 225 size_t size, 443 tls_offload_rx_resync_async_request_start(stru !! 226 char *record_sequence, >> 227 int record_sequence_size, >> 228 unsigned char record_type) 444 { 229 { 445 struct tls_context *tls_ctx = tls_get_ !! 230 memcpy(buf, record_sequence, record_sequence_size); 446 struct tls_offload_context_rx *rx_ctx << 447 231 448 atomic64_set(&rx_ctx->resync_async->re !! 232 buf[8] = record_type; 449 ((u64)len << 16) | RESYNC !! 233 buf[9] = TLS_1_2_VERSION_MAJOR; 450 rx_ctx->resync_async->loglen = 0; !! 234 buf[10] = TLS_1_2_VERSION_MINOR; 451 rx_ctx->resync_async->rcd_delta = 0; !! 235 buf[11] = size >> 8; >> 236 buf[12] = size & 0xFF; 452 } 237 } 453 238 454 static inline void !! 239 static inline struct tls_context *tls_get_ctx(const struct sock *sk) 455 tls_offload_rx_resync_async_request_end(struct << 456 { 240 { 457 struct tls_context *tls_ctx = tls_get_ !! 241 struct inet_connection_sock *icsk = inet_csk(sk); 458 struct tls_offload_context_rx *rx_ctx << 459 242 460 atomic64_set(&rx_ctx->resync_async->re !! 243 return icsk->icsk_ulp_data; 461 ((u64)ntohl(seq) << 32) | << 462 } 244 } 463 245 464 static inline void !! 246 static inline struct tls_sw_context *tls_sw_ctx( 465 tls_offload_rx_resync_set_type(struct sock *sk !! 247 const struct tls_context *tls_ctx) 466 { 248 { 467 struct tls_context *tls_ctx = tls_get_ !! 249 return (struct tls_sw_context *)tls_ctx->priv_ctx; 468 << 469 tls_offload_ctx_rx(tls_ctx)->resync_ty << 470 } 250 } 471 251 472 /* Driver's seq tracking has to be disabled un !! 252 static inline struct tls_offload_context *tls_offload_ctx( 473 static inline bool tls_offload_tx_resync_pendi !! 253 const struct tls_context *tls_ctx) 474 { 254 { 475 struct tls_context *tls_ctx = tls_get_ !! 255 return (struct tls_offload_context *)tls_ctx->priv_ctx; 476 bool ret; << 477 << 478 ret = test_bit(TLS_TX_SYNC_SCHED, &tls << 479 smp_mb__after_atomic(); << 480 return ret; << 481 } 256 } 482 257 483 struct sk_buff *tls_encrypt_skb(struct sk_buff !! 258 int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg, 484 !! 259 unsigned char *record_type); 485 #ifdef CONFIG_TLS_DEVICE << 486 void tls_device_sk_destruct(struct sock *sk); << 487 void tls_offload_tx_resync_request(struct sock << 488 260 489 static inline bool tls_is_sk_rx_device_offload << 490 { << 491 if (!sk_fullsock(sk) || << 492 smp_load_acquire(&sk->sk_destruct) << 493 return false; << 494 return tls_get_ctx(sk)->rx_conf == TLS << 495 } << 496 #endif << 497 #endif /* _TLS_OFFLOAD_H */ 261 #endif /* _TLS_OFFLOAD_H */ 498 262

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

TOMOYO Linux Cross Reference
Linux/include/net/tls.h

Diff markup

Differences between /include/net/tls.h (Version linux-6.12-rc7) and /include/net/tls.h (Version linux-4.16.18)

TOMOYO Linux Cross Reference Linux/include/net/tls.h

Diff markup

Differences between /include/net/tls.h (Version linux-6.12-rc7) and /include/net/tls.h (Version linux-4.16.18)

TOMOYO Linux Cross Reference
Linux/include/net/tls.h