netdev - [PATCH net-next 0/6] net/tls: separate the TLS TOE code out

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20191003181859.24958-1-jakub.kicinski@netronome.com>
Date:   Thu,  3 Oct 2019 11:18:53 -0700
From:   Jakub Kicinski <jakub.kicinski@...ronome.com>
To:     davem@...emloft.net
Cc:     netdev@...r.kernel.org, oss-drivers@...ronome.com,
        davejwatson@...com, borisp@...lanox.com, aviadye@...lanox.com,
        john.fastabend@...il.com, daniel@...earbox.net,
        atul.gupta@...lsio.com,
        Jakub Kicinski <jakub.kicinski@...ronome.com>
Subject: [PATCH net-next 0/6] net/tls: separate the TLS TOE code out

Hi!

We have 3 modes of operation of TLS - software, crypto offload
(Mellanox, Netronome) and TCP Offload Engine-based (Chelsio).
The last one takes over the socket, like any TOE would, and
is not really compatible with how we want to do things in the
networking stack.

Confusingly the name of the crypto-only offload mode is TLS_HW,
while TOE-offload related functions use tls_hw_ as their prefix.

Engineers looking to implement offload are also be faced with
TOE artefacts like struct tls_device (while, again,
CONFIG_TLS_DEVICE actually gates the non-TOE offload).

To improve the clarity of the offload code move the TOE code
into new files, and rename the functions and structures
appropriately.

Because TOE-offload takes over the socket, and makes no use of
the TLS infrastructure in the kernel, the rest of the code
(anything beyond the ULP setup handlers) do not have to worry
about the mode == TLS_HW_RECORD case.

The increase in code size is due to duplication of the full
license boilerplate. Unfortunately original author (Dave Watson)
seems unreachable :(

Jakub Kicinski (6):
  net/tls: move TOE-related structures to a separate header
  net/tls: rename tls_device to tls_toe_device
  net/tls: move tls_build_proto() on init path
  net/tls: move TOE-related code to a separate file
  net/tls: rename tls_hw_* functions tls_toe_*
  net/tls: allow compiling TLS TOE out

 drivers/crypto/chelsio/Kconfig            |   2 +-
 drivers/crypto/chelsio/chtls/chtls.h      |   5 +-
 drivers/crypto/chelsio/chtls/chtls_main.c |  20 ++--
 include/net/tls.h                         |  37 +-----
 include/net/tls_toe.h                     |  77 ++++++++++++
 net/tls/Kconfig                           |  10 ++
 net/tls/Makefile                          |   1 +
 net/tls/tls_main.c                        | 124 ++-----------------
 net/tls/tls_toe.c                         | 139 ++++++++++++++++++++++
 9 files changed, 257 insertions(+), 158 deletions(-)
 create mode 100644 include/net/tls_toe.h
 create mode 100644 net/tls/tls_toe.c

-- 
2.21.0