d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ktls: Try to enable TOE TLS after marking existing data not ready.

Browse Source 
At the moment this is mostly a no-op but in the future there will be
in-flight encrypted data which requires software decryption.  This
same setup is also needed for NIC TLS RX.

Note that this does break TOE TLS RX for AES-CBC ciphers since there
is no software fallback for AES-CBC receive.  This will be resolved
one way or another before 14.0 is released.

Reviewed by:	hselasky
Sponsored by:	Chelsio Communications
Differential Revision:	https://reviews.freebsd.org/D34082
This commit is contained in:
John Baldwin 2022-01-31 16:39:21 -08:00
parent 9ad859dab2
commit d958bc7963
1 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
sys/kern/uipc_ktls.c
View File

@ -1195,12 +1195,6 @@ ktls_enable_rx(struct socket *so, struct tls_enable *en)
return (error);
}
#ifdef TCP_OFFLOAD
error = ktls_try_toe(so, tls, KTLS_RX);
if (error)
#endif
ktls_use_sw(tls);
/* Mark the socket as using TLS offload. */
SOCKBUF_LOCK(&so->so_rcv);
so->so_rcv.sb_tls_seqno = be64dec(en->rec_seq);
@ -1208,12 +1202,16 @@ ktls_enable_rx(struct socket *so, struct tls_enable *en)
so->so_rcv.sb_flags |= SB_TLS_RX;
/* Mark existing data as not ready until it can be decrypted. */
if (tls->mode != TCP_TLS_MODE_TOE) {
sb_mark_notready(&so->so_rcv);
ktls_check_rx(&so->so_rcv);
}
sb_mark_notready(&so->so_rcv);
ktls_check_rx(&so->so_rcv);
SOCKBUF_UNLOCK(&so->so_rcv);
#ifdef TCP_OFFLOAD
error = ktls_try_toe(so, tls, KTLS_RX);
if (error)
#endif
ktls_use_sw(tls);
counter_u64_add(ktls_offload_total, 1);
return (0);