Software implementation of transport layer security, implemented using ULP infrastructure. tcp proto_ops are replaced with tls equivalents of sendmsg and sendpage. Only symmetric crypto is done in the kernel, keys are passed by setsockopt after the handshake is complete. All control messages are supported via CMSG data - the actual symmetric encryption is the same, just the message type needs to be passed separately. For user API, please see Documentation patch. Pieces that can be shared between hw and sw implementation are in tls_main.c
Showing the changes to include/uapi/linux (1 of 10 files). Show all
Unified · Split
| @@ -0,0 +1,79 @@ | ||
| 1 | +/* | |
| 2 | + * Copyright (c) 2016-2017, Mellanox Technologies. All rights reserved. | |
| 3 | + * | |
| 4 | + * This software is available to you under a choice of one of two | |
| 5 | + * licenses. You may choose to be licensed under the terms of the GNU | |
| 6 | + * General Public License (GPL) Version 2, available from the file | |
| 7 | + * COPYING in the main directory of this source tree, or the | |
| 8 | + * OpenIB.org BSD license below: | |
| 9 | + * | |
| 10 | + * Redistribution and use in source and binary forms, with or | |
| 11 | + * without modification, are permitted provided that the following | |
| 12 | + * conditions are met: | |
| 13 | + * | |
| 14 | + * - Redistributions of source code must retain the above | |
| 15 | + * copyright notice, this list of conditions and the following | |
| 16 | + * disclaimer. | |
| 17 | + * | |
| 18 | + * - Redistributions in binary form must reproduce the above | |
| 19 | + * copyright notice, this list of conditions and the following | |
| 20 | + * disclaimer in the documentation and/or other materials | |
| 21 | + * provided with the distribution. | |
| 22 | + * | |
| 23 | + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, | |
| 24 | + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF | |
| 25 | + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND | |
| 26 | + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS | |
| 27 | + * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN | |
| 28 | + * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN | |
| 29 | + * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | |
| 30 | + * SOFTWARE. | |
| 31 | + */ | |
| 32 | + | |
| 33 | +#ifndef _UAPI_LINUX_TLS_H | |
| 34 | +#define _UAPI_LINUX_TLS_H | |
| 35 | + | |
| 36 | +#include <linux/types.h> | |
| 37 | +#include <asm/byteorder.h> | |
| 38 | +#include <linux/socket.h> | |
| 39 | +#include <linux/tcp.h> | |
| 40 | +#include <net/tcp.h> | |
| 41 | + | |
| 42 | +/* TLS socket options */ | |
| 43 | +#define TLS_TX 1 /* Set transmit parameters */ | |
| 44 | + | |
| 45 | +/* Supported versions */ | |
| 46 | +#define TLS_VERSION_MINOR(ver) ((ver) & 0xFF) | |
| 47 | +#define TLS_VERSION_MAJOR(ver) (((ver) >> 8) & 0xFF) | |
| 48 | + | |
| 49 | +#define TLS_VERSION_NUMBER(id) ((((id##_VERSION_MAJOR) & 0xFF) << 8) | \ | |
| 50 | + ((id##_VERSION_MINOR) & 0xFF)) | |
| 51 | + | |
| 52 | +#define TLS_1_2_VERSION_MAJOR 0x3 | |
| 53 | +#define TLS_1_2_VERSION_MINOR 0x3 | |
| 54 | +#define TLS_1_2_VERSION TLS_VERSION_NUMBER(TLS_1_2) | |
| 55 | + | |
| 56 | +/* Supported ciphers */ | |
| 57 | +#define TLS_CIPHER_AES_GCM_128 51 | |
| 58 | +#define TLS_CIPHER_AES_GCM_128_IV_SIZE 8 | |
| 59 | +#define TLS_CIPHER_AES_GCM_128_KEY_SIZE 16 | |
| 60 | +#define TLS_CIPHER_AES_GCM_128_SALT_SIZE 4 | |
| 61 | +#define TLS_CIPHER_AES_GCM_128_TAG_SIZE 16 | |
| 62 | +#define TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE 8 | |
| 63 | + | |
| 64 | +#define TLS_SET_RECORD_TYPE 1 | |
| 65 | + | |
| 66 | +struct tls_crypto_info { | |
| 67 | + __u16 version; | |
| 68 | + __u16 cipher_type; | |
| 69 | +}; | |
| 70 | + | |
| 71 | +struct tls12_crypto_info_aes_gcm_128 { | |
| 72 | + struct tls_crypto_info info; | |
| 73 | + unsigned char iv[TLS_CIPHER_AES_GCM_128_IV_SIZE]; | |
| 74 | + unsigned char key[TLS_CIPHER_AES_GCM_128_KEY_SIZE]; | |
| 75 | + unsigned char salt[TLS_CIPHER_AES_GCM_128_SALT_SIZE]; | |
| 76 | + unsigned char rec_seq[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE]; | |
| 77 | +}; | |
| 78 | + | |
| 79 | +#endif /* _UAPI_LINUX_TLS_H */ | |