d829e9c411
Convert kTLS over to make use of sk_msg interface for plaintext and encrypted scattergather data, so it reuses all the sk_msg helpers and data structure which later on in a second step enables to glue this to BPF. This also allows to remove quite a bit of open coded helpers which are covered by the sk_msg API. Recent changes in kTLs80ece6a03a("tls: Remove redundant vars from tls record structure") and4e6d47206c("tls: Add support for inplace records encryption") changed the data path handling a bit; while we've kept the latter optimization intact, we had to undo the former change to better fit the sk_msg model, hence the sg_aead_in and sg_aead_out have been brought back and are linked into the sk_msg sgs. Now the kTLS record contains a msg_plaintext and msg_encrypted sk_msg each. In the original code, the zerocopy_from_iter() has been used out of TX but also RX path. For the strparser skb-based RX path, we've left the zerocopy_from_iter() in decrypt_internal() mostly untouched, meaning it has been moved into tls_setup_from_iter() with charging logic removed (as not used from RX). Given RX path is not based on sk_msg objects, we haven't pursued setting up a dummy sk_msg to call into sk_msg_zerocopy_from_iter(), but it could be an option to prusue in a later step. Joint work with John. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
28 lines
564 B
Plaintext
28 lines
564 B
Plaintext
#
|
|
# TLS configuration
|
|
#
|
|
config TLS
|
|
tristate "Transport Layer Security support"
|
|
depends on INET
|
|
select CRYPTO
|
|
select CRYPTO_AES
|
|
select CRYPTO_GCM
|
|
select STREAM_PARSER
|
|
select NET_SOCK_MSG
|
|
default n
|
|
---help---
|
|
Enable kernel support for TLS protocol. This allows symmetric
|
|
encryption handling of the TLS protocol to be done in-kernel.
|
|
|
|
If unsure, say N.
|
|
|
|
config TLS_DEVICE
|
|
bool "Transport Layer Security HW offload"
|
|
depends on TLS
|
|
select SOCK_VALIDATE_XMIT
|
|
default n
|
|
help
|
|
Enable kernel support for HW offload of the TLS protocol.
|
|
|
|
If unsure, say N.
|