forked from Qortal/Brooklyn
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
299 lines
7.0 KiB
299 lines
7.0 KiB
// SPDX-License-Identifier: GPL-2.0 |
|
/* Copyright(c) 2018 Oracle and/or its affiliates. All rights reserved. */ |
|
|
|
#include <crypto/aead.h> |
|
#include <linux/debugfs.h> |
|
#include <net/xfrm.h> |
|
|
|
#include "netdevsim.h" |
|
|
|
#define NSIM_IPSEC_AUTH_BITS 128 |
|
|
|
static ssize_t nsim_dbg_netdev_ops_read(struct file *filp, |
|
char __user *buffer, |
|
size_t count, loff_t *ppos) |
|
{ |
|
struct netdevsim *ns = filp->private_data; |
|
struct nsim_ipsec *ipsec = &ns->ipsec; |
|
size_t bufsize; |
|
char *buf, *p; |
|
int len; |
|
int i; |
|
|
|
/* the buffer needed is |
|
* (num SAs * 3 lines each * ~60 bytes per line) + one more line |
|
*/ |
|
bufsize = (ipsec->count * 4 * 60) + 60; |
|
buf = kzalloc(bufsize, GFP_KERNEL); |
|
if (!buf) |
|
return -ENOMEM; |
|
|
|
p = buf; |
|
p += scnprintf(p, bufsize - (p - buf), |
|
"SA count=%u tx=%u\n", |
|
ipsec->count, ipsec->tx); |
|
|
|
for (i = 0; i < NSIM_IPSEC_MAX_SA_COUNT; i++) { |
|
struct nsim_sa *sap = &ipsec->sa[i]; |
|
|
|
if (!sap->used) |
|
continue; |
|
|
|
p += scnprintf(p, bufsize - (p - buf), |
|
"sa[%i] %cx ipaddr=0x%08x %08x %08x %08x\n", |
|
i, (sap->rx ? 'r' : 't'), sap->ipaddr[0], |
|
sap->ipaddr[1], sap->ipaddr[2], sap->ipaddr[3]); |
|
p += scnprintf(p, bufsize - (p - buf), |
|
"sa[%i] spi=0x%08x proto=0x%x salt=0x%08x crypt=%d\n", |
|
i, be32_to_cpu(sap->xs->id.spi), |
|
sap->xs->id.proto, sap->salt, sap->crypt); |
|
p += scnprintf(p, bufsize - (p - buf), |
|
"sa[%i] key=0x%08x %08x %08x %08x\n", |
|
i, sap->key[0], sap->key[1], |
|
sap->key[2], sap->key[3]); |
|
} |
|
|
|
len = simple_read_from_buffer(buffer, count, ppos, buf, p - buf); |
|
|
|
kfree(buf); |
|
return len; |
|
} |
|
|
|
static const struct file_operations ipsec_dbg_fops = { |
|
.owner = THIS_MODULE, |
|
.open = simple_open, |
|
.read = nsim_dbg_netdev_ops_read, |
|
}; |
|
|
|
static int nsim_ipsec_find_empty_idx(struct nsim_ipsec *ipsec) |
|
{ |
|
u32 i; |
|
|
|
if (ipsec->count == NSIM_IPSEC_MAX_SA_COUNT) |
|
return -ENOSPC; |
|
|
|
/* search sa table */ |
|
for (i = 0; i < NSIM_IPSEC_MAX_SA_COUNT; i++) { |
|
if (!ipsec->sa[i].used) |
|
return i; |
|
} |
|
|
|
return -ENOSPC; |
|
} |
|
|
|
static int nsim_ipsec_parse_proto_keys(struct xfrm_state *xs, |
|
u32 *mykey, u32 *mysalt) |
|
{ |
|
const char aes_gcm_name[] = "rfc4106(gcm(aes))"; |
|
struct net_device *dev = xs->xso.dev; |
|
unsigned char *key_data; |
|
char *alg_name = NULL; |
|
int key_len; |
|
|
|
if (!xs->aead) { |
|
netdev_err(dev, "Unsupported IPsec algorithm\n"); |
|
return -EINVAL; |
|
} |
|
|
|
if (xs->aead->alg_icv_len != NSIM_IPSEC_AUTH_BITS) { |
|
netdev_err(dev, "IPsec offload requires %d bit authentication\n", |
|
NSIM_IPSEC_AUTH_BITS); |
|
return -EINVAL; |
|
} |
|
|
|
key_data = &xs->aead->alg_key[0]; |
|
key_len = xs->aead->alg_key_len; |
|
alg_name = xs->aead->alg_name; |
|
|
|
if (strcmp(alg_name, aes_gcm_name)) { |
|
netdev_err(dev, "Unsupported IPsec algorithm - please use %s\n", |
|
aes_gcm_name); |
|
return -EINVAL; |
|
} |
|
|
|
/* 160 accounts for 16 byte key and 4 byte salt */ |
|
if (key_len > NSIM_IPSEC_AUTH_BITS) { |
|
*mysalt = ((u32 *)key_data)[4]; |
|
} else if (key_len == NSIM_IPSEC_AUTH_BITS) { |
|
*mysalt = 0; |
|
} else { |
|
netdev_err(dev, "IPsec hw offload only supports 128 bit keys with optional 32 bit salt\n"); |
|
return -EINVAL; |
|
} |
|
memcpy(mykey, key_data, 16); |
|
|
|
return 0; |
|
} |
|
|
|
static int nsim_ipsec_add_sa(struct xfrm_state *xs) |
|
{ |
|
struct nsim_ipsec *ipsec; |
|
struct net_device *dev; |
|
struct netdevsim *ns; |
|
struct nsim_sa sa; |
|
u16 sa_idx; |
|
int ret; |
|
|
|
dev = xs->xso.dev; |
|
ns = netdev_priv(dev); |
|
ipsec = &ns->ipsec; |
|
|
|
if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) { |
|
netdev_err(dev, "Unsupported protocol 0x%04x for ipsec offload\n", |
|
xs->id.proto); |
|
return -EINVAL; |
|
} |
|
|
|
if (xs->calg) { |
|
netdev_err(dev, "Compression offload not supported\n"); |
|
return -EINVAL; |
|
} |
|
|
|
/* find the first unused index */ |
|
ret = nsim_ipsec_find_empty_idx(ipsec); |
|
if (ret < 0) { |
|
netdev_err(dev, "No space for SA in Rx table!\n"); |
|
return ret; |
|
} |
|
sa_idx = (u16)ret; |
|
|
|
memset(&sa, 0, sizeof(sa)); |
|
sa.used = true; |
|
sa.xs = xs; |
|
|
|
if (sa.xs->id.proto & IPPROTO_ESP) |
|
sa.crypt = xs->ealg || xs->aead; |
|
|
|
/* get the key and salt */ |
|
ret = nsim_ipsec_parse_proto_keys(xs, sa.key, &sa.salt); |
|
if (ret) { |
|
netdev_err(dev, "Failed to get key data for SA table\n"); |
|
return ret; |
|
} |
|
|
|
if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) { |
|
sa.rx = true; |
|
|
|
if (xs->props.family == AF_INET6) |
|
memcpy(sa.ipaddr, &xs->id.daddr.a6, 16); |
|
else |
|
memcpy(&sa.ipaddr[3], &xs->id.daddr.a4, 4); |
|
} |
|
|
|
/* the preparations worked, so save the info */ |
|
memcpy(&ipsec->sa[sa_idx], &sa, sizeof(sa)); |
|
|
|
/* the XFRM stack doesn't like offload_handle == 0, |
|
* so add a bitflag in case our array index is 0 |
|
*/ |
|
xs->xso.offload_handle = sa_idx | NSIM_IPSEC_VALID; |
|
ipsec->count++; |
|
|
|
return 0; |
|
} |
|
|
|
static void nsim_ipsec_del_sa(struct xfrm_state *xs) |
|
{ |
|
struct netdevsim *ns = netdev_priv(xs->xso.dev); |
|
struct nsim_ipsec *ipsec = &ns->ipsec; |
|
u16 sa_idx; |
|
|
|
sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID; |
|
if (!ipsec->sa[sa_idx].used) { |
|
netdev_err(ns->netdev, "Invalid SA for delete sa_idx=%d\n", |
|
sa_idx); |
|
return; |
|
} |
|
|
|
memset(&ipsec->sa[sa_idx], 0, sizeof(struct nsim_sa)); |
|
ipsec->count--; |
|
} |
|
|
|
static bool nsim_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) |
|
{ |
|
struct netdevsim *ns = netdev_priv(xs->xso.dev); |
|
struct nsim_ipsec *ipsec = &ns->ipsec; |
|
|
|
ipsec->ok++; |
|
|
|
return true; |
|
} |
|
|
|
static const struct xfrmdev_ops nsim_xfrmdev_ops = { |
|
.xdo_dev_state_add = nsim_ipsec_add_sa, |
|
.xdo_dev_state_delete = nsim_ipsec_del_sa, |
|
.xdo_dev_offload_ok = nsim_ipsec_offload_ok, |
|
}; |
|
|
|
bool nsim_ipsec_tx(struct netdevsim *ns, struct sk_buff *skb) |
|
{ |
|
struct sec_path *sp = skb_sec_path(skb); |
|
struct nsim_ipsec *ipsec = &ns->ipsec; |
|
struct xfrm_state *xs; |
|
struct nsim_sa *tsa; |
|
u32 sa_idx; |
|
|
|
/* do we even need to check this packet? */ |
|
if (!sp) |
|
return true; |
|
|
|
if (unlikely(!sp->len)) { |
|
netdev_err(ns->netdev, "no xfrm state len = %d\n", |
|
sp->len); |
|
return false; |
|
} |
|
|
|
xs = xfrm_input_state(skb); |
|
if (unlikely(!xs)) { |
|
netdev_err(ns->netdev, "no xfrm_input_state() xs = %p\n", xs); |
|
return false; |
|
} |
|
|
|
sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID; |
|
if (unlikely(sa_idx >= NSIM_IPSEC_MAX_SA_COUNT)) { |
|
netdev_err(ns->netdev, "bad sa_idx=%d max=%d\n", |
|
sa_idx, NSIM_IPSEC_MAX_SA_COUNT); |
|
return false; |
|
} |
|
|
|
tsa = &ipsec->sa[sa_idx]; |
|
if (unlikely(!tsa->used)) { |
|
netdev_err(ns->netdev, "unused sa_idx=%d\n", sa_idx); |
|
return false; |
|
} |
|
|
|
if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) { |
|
netdev_err(ns->netdev, "unexpected proto=%d\n", xs->id.proto); |
|
return false; |
|
} |
|
|
|
ipsec->tx++; |
|
|
|
return true; |
|
} |
|
|
|
void nsim_ipsec_init(struct netdevsim *ns) |
|
{ |
|
ns->netdev->xfrmdev_ops = &nsim_xfrmdev_ops; |
|
|
|
#define NSIM_ESP_FEATURES (NETIF_F_HW_ESP | \ |
|
NETIF_F_HW_ESP_TX_CSUM | \ |
|
NETIF_F_GSO_ESP) |
|
|
|
ns->netdev->features |= NSIM_ESP_FEATURES; |
|
ns->netdev->hw_enc_features |= NSIM_ESP_FEATURES; |
|
|
|
ns->ipsec.pfile = debugfs_create_file("ipsec", 0400, |
|
ns->nsim_dev_port->ddir, ns, |
|
&ipsec_dbg_fops); |
|
} |
|
|
|
void nsim_ipsec_teardown(struct netdevsim *ns) |
|
{ |
|
struct nsim_ipsec *ipsec = &ns->ipsec; |
|
|
|
if (ipsec->count) |
|
netdev_err(ns->netdev, "tearing down IPsec offload with %d SAs left\n", |
|
ipsec->count); |
|
debugfs_remove_recursive(ipsec->pfile); |
|
}
|
|
|