drivers/net/netdevsim/ipsec.c - third_party/kernel - Git at Google

 // SPDX-License-Identifier: GPL-2.0
 /* Copyright(c) 2018 Oracle and/or its affiliates. All rights reserved. */

 #include <crypto/aead.h>
 #include <linux/debugfs.h>
 #include <net/xfrm.h>

 #include "netdevsim.h"

 #define NSIM_IPSEC_AUTH_BITS	128

 static ssize_t nsim_dbg_netdev_ops_read(struct file *filp,
 					char __user *buffer,
 					size_t count, loff_t *ppos)
 {
 	struct netdevsim *ns = filp->private_data;
 	struct nsim_ipsec *ipsec = &ns->ipsec;
 	size_t bufsize;
 	char *buf, *p;
 	int len;
 	int i;

 	/* the buffer needed is
 	 * (num SAs * 3 lines each * ~60 bytes per line) + one more line
 	 */
 	bufsize = (ipsec->count * 4 * 60) + 60;
 	buf = kzalloc(bufsize, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;

 	p = buf;
 	p += snprintf(p, bufsize - (p - buf),
 		      "SA count=%u tx=%u\n",
 		      ipsec->count, ipsec->tx);

 	for (i = 0; i < NSIM_IPSEC_MAX_SA_COUNT; i++) {
 		struct nsim_sa *sap = &ipsec->sa[i];

 		if (!sap->used)
 			continue;

 		p += snprintf(p, bufsize - (p - buf),
 			      "sa[%i] %cx ipaddr=0x%08x %08x %08x %08x\n",
 			      i, (sap->rx ? 'r' : 't'), sap->ipaddr[0],
 			      sap->ipaddr[1], sap->ipaddr[2], sap->ipaddr[3]);
 		p += snprintf(p, bufsize - (p - buf),
 			      "sa[%i]    spi=0x%08x proto=0x%x salt=0x%08x crypt=%d\n",
 			      i, be32_to_cpu(sap->xs->id.spi),
 			      sap->xs->id.proto, sap->salt, sap->crypt);
 		p += snprintf(p, bufsize - (p - buf),
 			      "sa[%i]    key=0x%08x %08x %08x %08x\n",
 			      i, sap->key[0], sap->key[1],
 			      sap->key[2], sap->key[3]);
 	}

 	len = simple_read_from_buffer(buffer, count, ppos, buf, p - buf);

 	kfree(buf);
 	return len;
 }

 static const struct file_operations ipsec_dbg_fops = {
 	.owner = THIS_MODULE,
 	.open = simple_open,
 	.read = nsim_dbg_netdev_ops_read,
 };

 static int nsim_ipsec_find_empty_idx(struct nsim_ipsec *ipsec)
 {
 	u32 i;

 	if (ipsec->count == NSIM_IPSEC_MAX_SA_COUNT)
 		return -ENOSPC;

 	/* search sa table */
 	for (i = 0; i < NSIM_IPSEC_MAX_SA_COUNT; i++) {
 		if (!ipsec->sa[i].used)
 			return i;
 	}

 	return -ENOSPC;
 }

 static int nsim_ipsec_parse_proto_keys(struct xfrm_state *xs,
 				       u32 *mykey, u32 *mysalt)
 {
 	const char aes_gcm_name[] = "rfc4106(gcm(aes))";
 	struct net_device *dev = xs->xso.dev;
 	unsigned char *key_data;
 	char *alg_name = NULL;
 	int key_len;

 	if (!xs->aead) {
 		netdev_err(dev, "Unsupported IPsec algorithm\n");
 		return -EINVAL;
 	}

 	if (xs->aead->alg_icv_len != NSIM_IPSEC_AUTH_BITS) {
 		netdev_err(dev, "IPsec offload requires %d bit authentication\n",
 			   NSIM_IPSEC_AUTH_BITS);
 		return -EINVAL;
 	}

 	key_data = &xs->aead->alg_key[0];
 	key_len = xs->aead->alg_key_len;
 	alg_name = xs->aead->alg_name;

 	if (strcmp(alg_name, aes_gcm_name)) {
 		netdev_err(dev, "Unsupported IPsec algorithm - please use %s\n",
 			   aes_gcm_name);
 		return -EINVAL;
 	}

 	/* 160 accounts for 16 byte key and 4 byte salt */
 	if (key_len > NSIM_IPSEC_AUTH_BITS) {
 		*mysalt = ((u32 *)key_data)[4];
 	} else if (key_len == NSIM_IPSEC_AUTH_BITS) {
 		*mysalt = 0;
 	} else {
 		netdev_err(dev, "IPsec hw offload only supports 128 bit keys with optional 32 bit salt\n");
 		return -EINVAL;
 	}
 	memcpy(mykey, key_data, 16);

 	return 0;
 }

 static int nsim_ipsec_add_sa(struct xfrm_state *xs)
 {
 	struct nsim_ipsec *ipsec;
 	struct net_device *dev;
 	struct netdevsim *ns;
 	struct nsim_sa sa;
 	u16 sa_idx;
 	int ret;

 	dev = xs->xso.dev;
 	ns = netdev_priv(dev);
 	ipsec = &ns->ipsec;

 	if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) {
 		netdev_err(dev, "Unsupported protocol 0x%04x for ipsec offload\n",
 			   xs->id.proto);
 		return -EINVAL;
 	}

 	if (xs->calg) {
 		netdev_err(dev, "Compression offload not supported\n");
 		return -EINVAL;
 	}

 	/* find the first unused index */
 	ret = nsim_ipsec_find_empty_idx(ipsec);
 	if (ret < 0) {
 		netdev_err(dev, "No space for SA in Rx table!\n");
 		return ret;
 	}
 	sa_idx = (u16)ret;

 	memset(&sa, 0, sizeof(sa));
 	sa.used = true;
 	sa.xs = xs;

 	if (sa.xs->id.proto & IPPROTO_ESP)
 		sa.crypt = xs->ealg || xs->aead;

 	/* get the key and salt */
 	ret = nsim_ipsec_parse_proto_keys(xs, sa.key, &sa.salt);
 	if (ret) {
 		netdev_err(dev, "Failed to get key data for SA table\n");
 		return ret;
 	}

 	if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
 		sa.rx = true;

 		if (xs->props.family == AF_INET6)
 			memcpy(sa.ipaddr, &xs->id.daddr.a6, 16);
 		else
 			memcpy(&sa.ipaddr[3], &xs->id.daddr.a4, 4);
 	}

 	/* the preparations worked, so save the info */
 	memcpy(&ipsec->sa[sa_idx], &sa, sizeof(sa));

 	/* the XFRM stack doesn't like offload_handle == 0,
 	 * so add a bitflag in case our array index is 0
 	 */
 	xs->xso.offload_handle = sa_idx | NSIM_IPSEC_VALID;
 	ipsec->count++;

 	return 0;
 }

 static void nsim_ipsec_del_sa(struct xfrm_state *xs)
 {
 	struct netdevsim *ns = netdev_priv(xs->xso.dev);
 	struct nsim_ipsec *ipsec = &ns->ipsec;
 	u16 sa_idx;

 	sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID;
 	if (!ipsec->sa[sa_idx].used) {
 		netdev_err(ns->netdev, "Invalid SA for delete sa_idx=%d\n",
 			   sa_idx);
 		return;
 	}

 	memset(&ipsec->sa[sa_idx], 0, sizeof(struct nsim_sa));
 	ipsec->count--;
 }

 static bool nsim_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs)
 {
 	struct netdevsim *ns = netdev_priv(xs->xso.dev);
 	struct nsim_ipsec *ipsec = &ns->ipsec;

 	ipsec->ok++;

 	return true;
 }

 static const struct xfrmdev_ops nsim_xfrmdev_ops = {
 	.xdo_dev_state_add	= nsim_ipsec_add_sa,
 	.xdo_dev_state_delete	= nsim_ipsec_del_sa,
 	.xdo_dev_offload_ok	= nsim_ipsec_offload_ok,
 };

 bool nsim_ipsec_tx(struct netdevsim *ns, struct sk_buff *skb)
 {
 	struct sec_path *sp = skb_sec_path(skb);
 	struct nsim_ipsec *ipsec = &ns->ipsec;
 	struct xfrm_state *xs;
 	struct nsim_sa *tsa;
 	u32 sa_idx;

 	/* do we even need to check this packet? */
 	if (!sp)
 		return true;

 	if (unlikely(!sp->len)) {
 		netdev_err(ns->netdev, "no xfrm state len = %d\n",
 			   sp->len);
 		return false;
 	}

 	xs = xfrm_input_state(skb);
 	if (unlikely(!xs)) {
 		netdev_err(ns->netdev, "no xfrm_input_state() xs = %p\n", xs);
 		return false;
 	}

 	sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID;
 	if (unlikely(sa_idx >= NSIM_IPSEC_MAX_SA_COUNT)) {
 		netdev_err(ns->netdev, "bad sa_idx=%d max=%d\n",
 			   sa_idx, NSIM_IPSEC_MAX_SA_COUNT);
 		return false;
 	}

 	tsa = &ipsec->sa[sa_idx];
 	if (unlikely(!tsa->used)) {
 		netdev_err(ns->netdev, "unused sa_idx=%d\n", sa_idx);
 		return false;
 	}

 	if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) {
 		netdev_err(ns->netdev, "unexpected proto=%d\n", xs->id.proto);
 		return false;
 	}

 	ipsec->tx++;

 	return true;
 }

 void nsim_ipsec_init(struct netdevsim *ns)
 {
 	ns->netdev->xfrmdev_ops = &nsim_xfrmdev_ops;

 #define NSIM_ESP_FEATURES	(NETIF_F_HW_ESP | \
 				 NETIF_F_HW_ESP_TX_CSUM | \
 				 NETIF_F_GSO_ESP)

 	ns->netdev->features |= NSIM_ESP_FEATURES;
 	ns->netdev->hw_enc_features |= NSIM_ESP_FEATURES;

 	ns->ipsec.pfile = debugfs_create_file("ipsec", 0400,
 					      ns->nsim_dev_port->ddir, ns,
 					      &ipsec_dbg_fops);
 }

 void nsim_ipsec_teardown(struct netdevsim *ns)
 {
 	struct nsim_ipsec *ipsec = &ns->ipsec;

 	if (ipsec->count)
 		netdev_err(ns->netdev, "tearing down IPsec offload with %d SAs left\n",
 			   ipsec->count);
 	debugfs_remove_recursive(ipsec->pfile);
 }
	// SPDX-License-Identifier: GPL-2.0
	/* Copyright(c) 2018 Oracle and/or its affiliates. All rights reserved. */

	#include <crypto/aead.h>
	#include <linux/debugfs.h>
	#include <net/xfrm.h>

	#include "netdevsim.h"

	#define NSIM_IPSEC_AUTH_BITS 128

	static ssize_t nsim_dbg_netdev_ops_read(struct file *filp,
	char __user *buffer,
	size_t count, loff_t *ppos)
	{
	struct netdevsim *ns = filp->private_data;
	struct nsim_ipsec *ipsec = &ns->ipsec;
	size_t bufsize;
	char buf, p;
	int len;
	int i;

	/* the buffer needed is
	* (num SAs * 3 lines each * ~60 bytes per line) + one more line
	*/
	bufsize = (ipsec->count * 4 * 60) + 60;
	buf = kzalloc(bufsize, GFP_KERNEL);
	if (!buf)
	return -ENOMEM;

	p = buf;
	p += snprintf(p, bufsize - (p - buf),
	"SA count=%u tx=%u\n",
	ipsec->count, ipsec->tx);

	for (i = 0; i < NSIM_IPSEC_MAX_SA_COUNT; i++) {
	struct nsim_sa *sap = &ipsec->sa[i];

	if (!sap->used)
	continue;

	p += snprintf(p, bufsize - (p - buf),
	"sa[%i] %cx ipaddr=0x%08x %08x %08x %08x\n",
	i, (sap->rx ? 'r' : 't'), sap->ipaddr[0],
	sap->ipaddr[1], sap->ipaddr[2], sap->ipaddr[3]);
	p += snprintf(p, bufsize - (p - buf),
	"sa[%i] spi=0x%08x proto=0x%x salt=0x%08x crypt=%d\n",
	i, be32_to_cpu(sap->xs->id.spi),
	sap->xs->id.proto, sap->salt, sap->crypt);
	p += snprintf(p, bufsize - (p - buf),
	"sa[%i] key=0x%08x %08x %08x %08x\n",
	i, sap->key[0], sap->key[1],
	sap->key[2], sap->key[3]);
	}

	len = simple_read_from_buffer(buffer, count, ppos, buf, p - buf);

	kfree(buf);
	return len;
	}

	static const struct file_operations ipsec_dbg_fops = {
	.owner = THIS_MODULE,
	.open = simple_open,
	.read = nsim_dbg_netdev_ops_read,
	};

	static int nsim_ipsec_find_empty_idx(struct nsim_ipsec *ipsec)
	{
	u32 i;

	if (ipsec->count == NSIM_IPSEC_MAX_SA_COUNT)
	return -ENOSPC;

	/* search sa table */
	for (i = 0; i < NSIM_IPSEC_MAX_SA_COUNT; i++) {
	if (!ipsec->sa[i].used)
	return i;
	}

	return -ENOSPC;
	}

	static int nsim_ipsec_parse_proto_keys(struct xfrm_state *xs,
	u32 mykey, u32 mysalt)
	{
	const char aes_gcm_name[] = "rfc4106(gcm(aes))";
	struct net_device *dev = xs->xso.dev;
	unsigned char *key_data;
	char *alg_name = NULL;
	int key_len;

	if (!xs->aead) {
	netdev_err(dev, "Unsupported IPsec algorithm\n");
	return -EINVAL;
	}

	if (xs->aead->alg_icv_len != NSIM_IPSEC_AUTH_BITS) {
	netdev_err(dev, "IPsec offload requires %d bit authentication\n",
	NSIM_IPSEC_AUTH_BITS);
	return -EINVAL;
	}

	key_data = &xs->aead->alg_key[0];
	key_len = xs->aead->alg_key_len;
	alg_name = xs->aead->alg_name;

	if (strcmp(alg_name, aes_gcm_name)) {
	netdev_err(dev, "Unsupported IPsec algorithm - please use %s\n",
	aes_gcm_name);
	return -EINVAL;
	}

	/* 160 accounts for 16 byte key and 4 byte salt */
	if (key_len > NSIM_IPSEC_AUTH_BITS) {
	mysalt = ((u32 )key_data)[4];
	} else if (key_len == NSIM_IPSEC_AUTH_BITS) {
	*mysalt = 0;
	} else {
	netdev_err(dev, "IPsec hw offload only supports 128 bit keys with optional 32 bit salt\n");
	return -EINVAL;
	}
	memcpy(mykey, key_data, 16);

	return 0;
	}

	static int nsim_ipsec_add_sa(struct xfrm_state *xs)
	{
	struct nsim_ipsec *ipsec;
	struct net_device *dev;
	struct netdevsim *ns;
	struct nsim_sa sa;
	u16 sa_idx;
	int ret;

	dev = xs->xso.dev;
	ns = netdev_priv(dev);
	ipsec = &ns->ipsec;

	if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) {
	netdev_err(dev, "Unsupported protocol 0x%04x for ipsec offload\n",
	xs->id.proto);
	return -EINVAL;
	}

	if (xs->calg) {
	netdev_err(dev, "Compression offload not supported\n");
	return -EINVAL;
	}

	/* find the first unused index */
	ret = nsim_ipsec_find_empty_idx(ipsec);
	if (ret < 0) {
	netdev_err(dev, "No space for SA in Rx table!\n");
	return ret;
	}
	sa_idx = (u16)ret;

	memset(&sa, 0, sizeof(sa));
	sa.used = true;
	sa.xs = xs;

	if (sa.xs->id.proto & IPPROTO_ESP)
	sa.crypt = xs->ealg \|\| xs->aead;

	/* get the key and salt */
	ret = nsim_ipsec_parse_proto_keys(xs, sa.key, &sa.salt);
	if (ret) {
	netdev_err(dev, "Failed to get key data for SA table\n");
	return ret;
	}

	if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
	sa.rx = true;

	if (xs->props.family == AF_INET6)
	memcpy(sa.ipaddr, &xs->id.daddr.a6, 16);
	else
	memcpy(&sa.ipaddr[3], &xs->id.daddr.a4, 4);
	}

	/* the preparations worked, so save the info */
	memcpy(&ipsec->sa[sa_idx], &sa, sizeof(sa));

	/* the XFRM stack doesn't like offload_handle == 0,
	* so add a bitflag in case our array index is 0
	*/
	xs->xso.offload_handle = sa_idx \| NSIM_IPSEC_VALID;
	ipsec->count++;

	return 0;
	}

	static void nsim_ipsec_del_sa(struct xfrm_state *xs)
	{
	struct netdevsim *ns = netdev_priv(xs->xso.dev);
	struct nsim_ipsec *ipsec = &ns->ipsec;
	u16 sa_idx;

	sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID;
	if (!ipsec->sa[sa_idx].used) {
	netdev_err(ns->netdev, "Invalid SA for delete sa_idx=%d\n",
	sa_idx);
	return;
	}

	memset(&ipsec->sa[sa_idx], 0, sizeof(struct nsim_sa));
	ipsec->count--;
	}

	static bool nsim_ipsec_offload_ok(struct sk_buff skb, struct xfrm_state xs)
	{
	struct netdevsim *ns = netdev_priv(xs->xso.dev);
	struct nsim_ipsec *ipsec = &ns->ipsec;

	ipsec->ok++;

	return true;
	}

	static const struct xfrmdev_ops nsim_xfrmdev_ops = {
	.xdo_dev_state_add = nsim_ipsec_add_sa,
	.xdo_dev_state_delete = nsim_ipsec_del_sa,
	.xdo_dev_offload_ok = nsim_ipsec_offload_ok,
	};

	bool nsim_ipsec_tx(struct netdevsim ns, struct sk_buff skb)
	{
	struct sec_path *sp = skb_sec_path(skb);
	struct nsim_ipsec *ipsec = &ns->ipsec;
	struct xfrm_state *xs;
	struct nsim_sa *tsa;
	u32 sa_idx;

	/* do we even need to check this packet? */
	if (!sp)
	return true;

	if (unlikely(!sp->len)) {
	netdev_err(ns->netdev, "no xfrm state len = %d\n",
	sp->len);
	return false;
	}

	xs = xfrm_input_state(skb);
	if (unlikely(!xs)) {
	netdev_err(ns->netdev, "no xfrm_input_state() xs = %p\n", xs);
	return false;
	}

	sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID;
	if (unlikely(sa_idx >= NSIM_IPSEC_MAX_SA_COUNT)) {
	netdev_err(ns->netdev, "bad sa_idx=%d max=%d\n",
	sa_idx, NSIM_IPSEC_MAX_SA_COUNT);
	return false;
	}

	tsa = &ipsec->sa[sa_idx];
	if (unlikely(!tsa->used)) {
	netdev_err(ns->netdev, "unused sa_idx=%d\n", sa_idx);
	return false;
	}

	if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) {
	netdev_err(ns->netdev, "unexpected proto=%d\n", xs->id.proto);
	return false;
	}

	ipsec->tx++;

	return true;
	}

	void nsim_ipsec_init(struct netdevsim *ns)
	{
	ns->netdev->xfrmdev_ops = &nsim_xfrmdev_ops;

	#define NSIM_ESP_FEATURES (NETIF_F_HW_ESP \| \
	NETIF_F_HW_ESP_TX_CSUM \| \
	NETIF_F_GSO_ESP)

	ns->netdev->features \|= NSIM_ESP_FEATURES;
	ns->netdev->hw_enc_features \|= NSIM_ESP_FEATURES;

	ns->ipsec.pfile = debugfs_create_file("ipsec", 0400,
	ns->nsim_dev_port->ddir, ns,
	&ipsec_dbg_fops);
	}

	void nsim_ipsec_teardown(struct netdevsim *ns)
	{
	struct nsim_ipsec *ipsec = &ns->ipsec;

	if (ipsec->count)
	netdev_err(ns->netdev, "tearing down IPsec offload with %d SAs left\n",
	ipsec->count);
	debugfs_remove_recursive(ipsec->pfile);
	}