projects/linux·blob master · refs

296 lines · 7.1 KiB

1// SPDX-License-Identifier: GPL-2.0
2/* Copyright(c) 2018 Oracle and/or its affiliates. All rights reserved. */
3
4#include <crypto/aead.h>
5#include <linux/debugfs.h>
6#include <net/xfrm.h>
7
8#include "netdevsim.h"
9
10#define NSIM_IPSEC_AUTH_BITS 128
11
12static ssize_t nsim_dbg_netdev_ops_read(struct file *filp,
13 char __user *buffer,
14 size_t count, loff_t *ppos)
15{
16 struct netdevsim *ns = filp->private_data;
17 struct nsim_ipsec *ipsec = &ns->ipsec;
18 size_t bufsize;
19 char *buf, *p;
20 int len;
21 int i;
22
23 /* the buffer needed is
24 * (num SAs * 3 lines each * ~60 bytes per line) + one more line
25 */
26 bufsize = (ipsec->count * 4 * 60) + 60;
27 buf = kzalloc(bufsize, GFP_KERNEL);
28 if (!buf)
29 return -ENOMEM;
30
31 p = buf;
32 p += scnprintf(p, bufsize - (p - buf),
33 "SA count=%u tx=%u\n",
34 ipsec->count, ipsec->tx);
35
36 for (i = 0; i < NSIM_IPSEC_MAX_SA_COUNT; i++) {
37 struct nsim_sa *sap = &ipsec->sa[i];
38
39 if (!sap->used)
40 continue;
41
42 if (sap->xs->props.family == AF_INET6)
43 p += scnprintf(p, bufsize - (p - buf),
44 "sa[%i] %cx ipaddr=%pI6c\n",
45 i, (sap->rx ? 'r' : 't'), &sap->ipaddr);
46 else
47 p += scnprintf(p, bufsize - (p - buf),
48 "sa[%i] %cx ipaddr=%pI4\n",
49 i, (sap->rx ? 'r' : 't'), &sap->ipaddr[3]);
50 p += scnprintf(p, bufsize - (p - buf),
51 "sa[%i] spi=0x%08x proto=0x%x salt=0x%08x crypt=%d\n",
52 i, be32_to_cpu(sap->xs->id.spi),
53 sap->xs->id.proto, sap->salt, sap->crypt);
54 p += scnprintf(p, bufsize - (p - buf),
55 "sa[%i] key=0x%08x %08x %08x %08x\n",
56 i, sap->key[0], sap->key[1],
57 sap->key[2], sap->key[3]);
58 }
59
60 len = simple_read_from_buffer(buffer, count, ppos, buf, p - buf);
61
62 kfree(buf);
63 return len;
64}
65
66static const struct file_operations ipsec_dbg_fops = {
67 .owner = THIS_MODULE,
68 .open = simple_open,
69 .read = nsim_dbg_netdev_ops_read,
70};
71
72static int nsim_ipsec_find_empty_idx(struct nsim_ipsec *ipsec)
73{
74 u32 i;
75
76 if (ipsec->count == NSIM_IPSEC_MAX_SA_COUNT)
77 return -ENOSPC;
78
79 /* search sa table */
80 for (i = 0; i < NSIM_IPSEC_MAX_SA_COUNT; i++) {
81 if (!ipsec->sa[i].used)
82 return i;
83 }
84
85 return -ENOSPC;
86}
87
88static int nsim_ipsec_parse_proto_keys(struct net_device *dev,
89 struct xfrm_state *xs,
90 u32 *mykey, u32 *mysalt)
91{
92 const char aes_gcm_name[] = "rfc4106(gcm(aes))";
93 unsigned char *key_data;
94 char *alg_name = NULL;
95 int key_len;
96
97 if (!xs->aead) {
98 netdev_err(dev, "Unsupported IPsec algorithm\n");
99 return -EINVAL;
100 }
101
102 if (xs->aead->alg_icv_len != NSIM_IPSEC_AUTH_BITS) {
103 netdev_err(dev, "IPsec offload requires %d bit authentication\n",
104 NSIM_IPSEC_AUTH_BITS);
105 return -EINVAL;
106 }
107
108 key_data = &xs->aead->alg_key[0];
109 key_len = xs->aead->alg_key_len;
110 alg_name = xs->aead->alg_name;
111
112 if (strcmp(alg_name, aes_gcm_name)) {
113 netdev_err(dev, "Unsupported IPsec algorithm - please use %s\n",
114 aes_gcm_name);
115 return -EINVAL;
116 }
117
118 /* 160 accounts for 16 byte key and 4 byte salt */
119 if (key_len > NSIM_IPSEC_AUTH_BITS) {
120 *mysalt = ((u32 *)key_data)[4];
121 } else if (key_len == NSIM_IPSEC_AUTH_BITS) {
122 *mysalt = 0;
123 } else {
124 netdev_err(dev, "IPsec hw offload only supports 128 bit keys with optional 32 bit salt\n");
125 return -EINVAL;
126 }
127 memcpy(mykey, key_data, 16);
128
129 return 0;
130}
131
132static int nsim_ipsec_add_sa(struct net_device *dev,
133 struct xfrm_state *xs,
134 struct netlink_ext_ack *extack)
135{
136 struct nsim_ipsec *ipsec;
137 struct netdevsim *ns;
138 struct nsim_sa sa;
139 u16 sa_idx;
140 int ret;
141
142 ns = netdev_priv(dev);
143 ipsec = &ns->ipsec;
144
145 if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) {
146 NL_SET_ERR_MSG_MOD(extack, "Unsupported protocol for ipsec offload");
147 return -EINVAL;
148 }
149
150 if (xs->calg) {
151 NL_SET_ERR_MSG_MOD(extack, "Compression offload not supported");
152 return -EINVAL;
153 }
154
155 if (xs->xso.type != XFRM_DEV_OFFLOAD_CRYPTO) {
156 NL_SET_ERR_MSG_MOD(extack, "Unsupported ipsec offload type");
157 return -EINVAL;
158 }
159
160 /* find the first unused index */
161 ret = nsim_ipsec_find_empty_idx(ipsec);
162 if (ret < 0) {
163 NL_SET_ERR_MSG_MOD(extack, "No space for SA in Rx table!");
164 return ret;
165 }
166 sa_idx = (u16)ret;
167
168 memset(&sa, 0, sizeof(sa));
169 sa.used = true;
170 sa.xs = xs;
171
172 if (sa.xs->id.proto & IPPROTO_ESP)
173 sa.crypt = xs->ealg || xs->aead;
174
175 /* get the key and salt */
176 ret = nsim_ipsec_parse_proto_keys(dev, xs, sa.key, &sa.salt);
177 if (ret) {
178 NL_SET_ERR_MSG_MOD(extack, "Failed to get key data for SA table");
179 return ret;
180 }
181
182 if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN)
183 sa.rx = true;
184
185 if (xs->props.family == AF_INET6)
186 memcpy(sa.ipaddr, &xs->id.daddr.a6, 16);
187 else
188 memcpy(&sa.ipaddr[3], &xs->id.daddr.a4, 4);
189
190 /* the preparations worked, so save the info */
191 memcpy(&ipsec->sa[sa_idx], &sa, sizeof(sa));
192
193 /* the XFRM stack doesn't like offload_handle == 0,
194 * so add a bitflag in case our array index is 0
195 */
196 xs->xso.offload_handle = sa_idx | NSIM_IPSEC_VALID;
197 ipsec->count++;
198
199 return 0;
200}
201
202static void nsim_ipsec_del_sa(struct net_device *dev, struct xfrm_state *xs)
203{
204 struct netdevsim *ns = netdev_priv(dev);
205 struct nsim_ipsec *ipsec = &ns->ipsec;
206 u16 sa_idx;
207
208 sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID;
209 if (!ipsec->sa[sa_idx].used) {
210 netdev_err(ns->netdev, "Invalid SA for delete sa_idx=%d\n",
211 sa_idx);
212 return;
213 }
214
215 memset(&ipsec->sa[sa_idx], 0, sizeof(struct nsim_sa));
216 ipsec->count--;
217}
218
219static const struct xfrmdev_ops nsim_xfrmdev_ops = {
220 .xdo_dev_state_add = nsim_ipsec_add_sa,
221 .xdo_dev_state_delete = nsim_ipsec_del_sa,
222};
223
224bool nsim_ipsec_tx(struct netdevsim *ns, struct sk_buff *skb)
225{
226 struct sec_path *sp = skb_sec_path(skb);
227 struct nsim_ipsec *ipsec = &ns->ipsec;
228 struct xfrm_state *xs;
229 struct nsim_sa *tsa;
230 u32 sa_idx;
231
232 /* do we even need to check this packet? */
233 if (!sp)
234 return true;
235
236 if (unlikely(!sp->len)) {
237 netdev_err(ns->netdev, "no xfrm state len = %d\n",
238 sp->len);
239 return false;
240 }
241
242 xs = xfrm_input_state(skb);
243 if (unlikely(!xs)) {
244 netdev_err(ns->netdev, "no xfrm_input_state() xs = %p\n", xs);
245 return false;
246 }
247
248 sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID;
249 if (unlikely(sa_idx >= NSIM_IPSEC_MAX_SA_COUNT)) {
250 netdev_err(ns->netdev, "bad sa_idx=%d max=%d\n",
251 sa_idx, NSIM_IPSEC_MAX_SA_COUNT);
252 return false;
253 }
254
255 tsa = &ipsec->sa[sa_idx];
256 if (unlikely(!tsa->used)) {
257 netdev_err(ns->netdev, "unused sa_idx=%d\n", sa_idx);
258 return false;
259 }
260
261 if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) {
262 netdev_err(ns->netdev, "unexpected proto=%d\n", xs->id.proto);
263 return false;
264 }
265
266 ipsec->tx++;
267
268 return true;
269}
270
271void nsim_ipsec_init(struct netdevsim *ns)
272{
273 ns->netdev->xfrmdev_ops = &nsim_xfrmdev_ops;
274
275#define NSIM_ESP_FEATURES (NETIF_F_HW_ESP | \
276 NETIF_F_HW_ESP_TX_CSUM | \
277 NETIF_F_GSO_ESP)
278
279 ns->netdev->features |= NSIM_ESP_FEATURES;
280 ns->netdev->hw_features |= NSIM_ESP_FEATURES;
281 ns->netdev->hw_enc_features |= NSIM_ESP_FEATURES;
282
283 ns->ipsec.pfile = debugfs_create_file("ipsec", 0400,
284 ns->nsim_dev_port->ddir, ns,
285 &ipsec_dbg_fops);
286}
287
288void nsim_ipsec_teardown(struct netdevsim *ns)
289{
290 struct nsim_ipsec *ipsec = &ns->ipsec;
291
292 if (ipsec->count)
293 netdev_err(ns->netdev, "tearing down IPsec offload with %d SAs left\n",
294 ipsec->count);
295 debugfs_remove_recursive(ipsec->pfile);
296}