d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cxgbe tom: Remove support for non-KTLS TLS offload.

Browse Source 
TOE TLS offload was first supported via a customized OpenSSL developed
by Chelsio with proprietary socket options prior to KTLS being present
either in FreeBSD or upstream OpenSSL.  With the addition of KTLS in
both places, cxgbe's TOE driver was extended to support TLS offload
via KTLS as well.  This change removes the older interface leaving
only the KTLS bindings for TOE TLS.

Since KTLS was added to TOE TLS second, it was somehat shoe-horned
into the existing code.  In addition to removing the non-KTLS TLS
offload, refactor and simplify the code to assume KTLS, e.g. not
copying keys into a helper structure that mimic'ed the non-KTLS mode,
but using the KTLS session object directly when constructing key
contexts.

This also removes some unused code to send TX keys inline in work
requests for TOE TLS.  This code was never enabled, and was arguably
sending the wrong thing (it was not sending the raw key context as we
do for NIC TLS when using inline keys).

Sponsored by:	Chelsio Communications
This commit is contained in:
John Baldwin 2021-05-28 16:49:56 -07:00
parent faf0224ff2
commit 789f2d4b3f
5 changed files with 300 additions and 1384 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
sys/dev/cxgbe/tom/t4_cpl_io.c
View File

@ -1170,12 +1170,8 @@ t4_push_data(struct adapter *sc, struct toepcb *toep, int drop)
if (ulp_mode(toep) == ULP_MODE_ISCSI)
t4_push_pdus(sc, toep, drop);
else if (tls_tx_key(toep) && toep->tls.mode == TLS_MODE_TLSOM)
t4_push_tls_records(sc, toep, drop);
#ifdef KERN_TLS
else if (toep->flags & TPF_KTLS)
t4_push_ktls(sc, toep, drop);
#endif
else
t4_push_frames(sc, toep, drop);
}
@ -1809,10 +1805,6 @@ do_fw4_ack(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
credits -= txsd->tx_credits;
toep->tx_credits += txsd->tx_credits;
plen += txsd->plen;
if (txsd->iv_buffer) {
free(txsd->iv_buffer, M_CXGBE);
txsd->iv_buffer = NULL;
}
txsd++;
toep->txsd_avail++;
KASSERT(toep->txsd_avail <= toep->txsd_total,
@ -1863,13 +1855,6 @@ do_fw4_ack(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
tid, plen);
#endif
sbdrop_locked(sb, plen);
if (tls_tx_key(toep) &&
toep->tls.mode == TLS_MODE_TLSOM) {
struct tls_ofld_info *tls_ofld = &toep->tls;
MPASS(tls_ofld->sb_off >= plen);
tls_ofld->sb_off -= plen;
}
if (!TAILQ_EMPTY(&toep->aiotx_jobq))
t4_aiotx_queue_toep(so, toep);
sowwakeup_locked(so); /* unlocks so_snd */

1467
sys/dev/cxgbe/tom/t4_tls.c
View File

File diff suppressed because it is too large Load Diff

178
sys/dev/cxgbe/tom/t4_tls.h
View File

@ -33,50 +33,8 @@
#ifndef __T4_TLS_H__
#define __T4_TLS_H__
#define TLS1_VERSION 0x0301
#define TLS1_1_VERSION 0x0302
#define TLS1_2_VERSION 0x0303
#define TLS_MAX_VERSION TLS1_2_VERSION
#define DTLS1_VERSION 0xFEFF
#define DTLS1_2_VERSION 0xFEFD
#define DTLS_MAX_VERSION DTLS1_2_VERSION
#define DTLS1_VERSION_MAJOR 0xFE
/* Custom socket options for TLS+TOE. */
#define MAX_MAC_KSZ 64 /*512 bits */
#define MAX_CIPHER_KSZ 32 /* 256 bits */
#define CIPHER_BLOCK_SZ 16
#define SALT_SIZE 4
/* Can accomodate 16, 11-15 are reserved */
enum {
CHSSL_SHA_NOP,
CHSSL_SHA1,
CHSSL_SHA224,
CHSSL_SHA256,
CHSSL_GHASH,
CHSSL_SHA512_224,
CHSSL_SHA512_256,
CHSSL_SHA512_384,
CHSSL_SHA512_512,
CHSSL_CBCMAC,
CHSSL_CMAC,
};
/* Can accomodate 16, 8-15 are reserved */
enum {
CHSSL_CIPH_NOP,
CHSSL_AES_CBC,
CHSSL_AES_GCM,
CHSSL_AES_CTR,
CHSSL_AES_GEN,
CHSSL_IPSEC_ESP,
CHSSL_AES_XTS,
CHSSL_AES_CCM,
};
/* Key Context Programming Operation type */
#define KEY_WRITE_RX 0x1
#define KEY_WRITE_TX 0x2
@ -94,73 +52,6 @@ enum {
#define V_KEY_GET_LOC(x) ((x) << S_KEY_GET_LOC)
#define G_KEY_GET_LOC(x) (((x) >> S_KEY_GET_LOC) & M_KEY_GET_LOC)
struct tls_ofld_state {
unsigned char enc_mode;
unsigned char mac_mode;
unsigned char key_loc;
unsigned char ofld_mode;
unsigned char auth_mode;
unsigned char resv[3];
};
struct tls_tx_ctxt {
unsigned char salt[SALT_SIZE];
unsigned char key[MAX_CIPHER_KSZ];
unsigned char ipad[MAX_MAC_KSZ];
unsigned char opad[MAX_MAC_KSZ];
};
struct tls_rx_ctxt {
unsigned char salt[SALT_SIZE];
unsigned char key[MAX_CIPHER_KSZ];
unsigned char ipad[MAX_MAC_KSZ];
unsigned char opad[MAX_MAC_KSZ];
};
struct tls_key_context {
struct tls_tx_ctxt tx;
struct tls_rx_ctxt rx;
unsigned char l_p_key;
unsigned char hmac_ctrl;
unsigned char mac_first;
unsigned char iv_size;
unsigned char iv_ctrl;
unsigned char iv_algo;
unsigned char tx_seq_no;
unsigned char rx_seq_no;
struct tls_ofld_state state;
unsigned int tx_key_info_size;
unsigned int rx_key_info_size;
unsigned int frag_size;
unsigned int mac_secret_size;
unsigned int cipher_secret_size;
int proto_ver;
unsigned int sock_fd;
unsigned short dtls_epoch;
unsigned short rsv;
};
/* Set with 'struct tls_key_context'. */
#define TCP_TLSOM_SET_TLS_CONTEXT (TCP_VENDOR)
/* Get returns int of enabled (1) / disabled (0). */
#define TCP_TLSOM_GET_TLS_TOM (TCP_VENDOR + 1)
enum {
TLS_TOM_NONE = 0,
TLS_TOM_TXONLY,
TLS_TOM_BOTH
};
/* Set with no value. */
#define TCP_TLSOM_CLR_TLS_TOM (TCP_VENDOR + 2)
/* Set with no value. */
#define TCP_TLSOM_CLR_QUIES (TCP_VENDOR + 3)
#ifdef _KERNEL
/* Timeouts for handshake timer in seconds. */
#define TLS_SRV_HELLO_DONE 9
@ -175,49 +66,11 @@ enum {
#define CONTENT_TYPE_KEY_CONTEXT 32
#define CONTENT_TYPE_ERROR 127
#define GCM_TAG_SIZE 16
#define AEAD_EXPLICIT_DATA_SIZE 8
#define TLS_HEADER_LENGTH 5
#define TP_TX_PG_SZ 65536
#define FC_TP_PLEN_MAX 17408
#define IPAD_SIZE 64
#define OPAD_SIZE 64
#define KEY_SIZE 32
#define CIPHER_BLOCK_SIZE 16
#define HDR_KCTX_SIZE (IPAD_SIZE + OPAD_SIZE + KEY_SIZE)
#define KEY_IN_DDR_SIZE 16
#define TLS_KEY_CONTEXT_SZ roundup2(sizeof(struct tls_tx_ctxt), 32)
/* MAC KEY SIZE */
#define SHA_NOP 0
#define SHA_GHASH 16
#define SHA_224 28
#define SHA_256 32
#define SHA_384 48
#define SHA_512 64
#define SHA1 20
/* CIPHER KEY SIZE */
#define AES_NOP 0
#define AES_128 16
#define AES_192 24
#define AES_256 32
enum {
TLS_1_2_VERSION,
TLS_1_1_VERSION,
DTLS_1_2_VERSION,
TLS_VERSION_MAX,
};
enum {
CH_EVP_CIPH_STREAM_CIPHER,
CH_EVP_CIPH_CBC_MODE,
CH_EVP_CIPH_GCM_MODE,
CH_EVP_CIPH_CTR_MODE,
};
#define TLS_KEY_CONTEXT_SZ roundup2(sizeof(struct tls_keyctx), 32)
enum {
TLS_SFO_WR_CONTEXTLOC_DSGL,
@ -233,49 +86,26 @@ enum {
CPL_TX_TLS_SFO_TYPE_HEARTBEAT, /* XXX: Shouldn't this be "CUSTOM"? */
};
enum {
CH_CK_SIZE_128,
CH_CK_SIZE_192,
CH_CK_SIZE_256,
CH_CK_SIZE_NOP,
};
enum {
CH_MK_SIZE_128,
CH_MK_SIZE_160,
CH_MK_SIZE_192,
CH_MK_SIZE_256,
CH_MK_SIZE_512,
CH_MK_SIZE_NOP,
};
struct tls_scmd {
__be32 seqno_numivs;
__be32 ivgen_hdrlen;
};
enum tls_mode {
TLS_MODE_OFF,
TLS_MODE_TLSOM,
TLS_MODE_KTLS,
};
struct tls_ofld_info {
struct tls_key_context k_ctx;
unsigned int frag_size;
int key_location;
int mac_length;
int rx_key_addr;
int tx_key_addr;
uint64_t tx_seq_no;
uint16_t rx_version;
unsigned short fcplenmax;
unsigned short adjusted_plen;
unsigned short expn_per_ulp;
unsigned short pdus_per_ulp;
struct tls_scmd scmd0;
u_int iv_len;
enum tls_mode mode;
unsigned int tx_key_info_size;
struct callout handshake_timer;
u_int sb_off;
};
struct tls_key_req {

20
sys/dev/cxgbe/tom/t4_tom.c
View File

@ -1990,24 +1990,6 @@ t4_aio_queue_tom(struct socket *so, struct kaiocb *job)
return (t4_aio_queue_aiotx(so, job));
}
static int
t4_ctloutput_tom(struct socket *so, struct sockopt *sopt)
{
if (sopt->sopt_level != IPPROTO_TCP)
return (tcp_ctloutput(so, sopt));
switch (sopt->sopt_name) {
case TCP_TLSOM_SET_TLS_CONTEXT:
case TCP_TLSOM_GET_TLS_TOM:
case TCP_TLSOM_CLR_TLS_TOM:
case TCP_TLSOM_CLR_QUIES:
return (t4_ctloutput_tls(so, sopt));
default:
return (tcp_ctloutput(so, sopt));
}
}
static int
t4_tom_mod_load(void)
{
@ -2028,7 +2010,6 @@ t4_tom_mod_load(void)
bcopy(tcp_protosw, &toe_protosw, sizeof(toe_protosw));
bcopy(tcp_protosw->pr_usrreqs, &toe_usrreqs, sizeof(toe_usrreqs));
toe_usrreqs.pru_aio_queue = t4_aio_queue_tom;
toe_protosw.pr_ctloutput = t4_ctloutput_tom;
toe_protosw.pr_usrreqs = &toe_usrreqs;
tcp6_protosw = pffindproto(PF_INET6, IPPROTO_TCP, SOCK_STREAM);
@ -2037,7 +2018,6 @@ t4_tom_mod_load(void)
bcopy(tcp6_protosw, &toe6_protosw, sizeof(toe6_protosw));
bcopy(tcp6_protosw->pr_usrreqs, &toe6_usrreqs, sizeof(toe6_usrreqs));
toe6_usrreqs.pru_aio_queue = t4_aio_queue_tom;
toe6_protosw.pr_ctloutput = t4_ctloutput_tom;
toe6_protosw.pr_usrreqs = &toe6_usrreqs;
return (t4_register_uld(&tom_uld_info));

4
sys/dev/cxgbe/tom/t4_tom.h
View File

@ -120,7 +120,6 @@ struct conn_params {
struct ofld_tx_sdesc {
uint32_t plen; /* payload length */
uint8_t tx_credits; /* firmware tx credits (unit is 16B) */
void *iv_buffer; /* optional buffer holding IVs for TLS */
};
struct ppod_region {
@ -466,15 +465,12 @@ const struct offload_settings *lookup_offload_policy(struct adapter *, int,
/* t4_tls.c */
bool can_tls_offload(struct adapter *);
void do_rx_data_tls(const struct cpl_rx_data *, struct toepcb *, struct mbuf *);
int t4_ctloutput_tls(struct socket *, struct sockopt *);
void t4_push_tls_records(struct adapter *, struct toepcb *, int);
void t4_push_ktls(struct adapter *, struct toepcb *, int);
void t4_tls_mod_load(void);
void t4_tls_mod_unload(void);
void tls_detach(struct toepcb *);
void tls_establish(struct toepcb *);
void tls_init_toep(struct toepcb *);
int tls_rx_key(struct toepcb *);
void tls_stop_handshake_timer(struct toepcb *);
int tls_tx_key(struct toepcb *);
void tls_uninit_toep(struct toepcb *);