| 1009 | } |
| 1010 | |
| 1011 | int |
| 1012 | ktls_enable_rx(struct socket *so, struct tls_enable *en) |
| 1013 | { |
| 1014 | struct ktls_session *tls; |
| 1015 | int error; |
| 1016 | |
| 1017 | if (!ktls_offload_enable) |
| 1018 | return (ENOTSUP); |
| 1019 | if (SOLISTENING(so)) |
| 1020 | return (EINVAL); |
| 1021 | |
| 1022 | counter_u64_add(ktls_offload_enable_calls, 1); |
| 1023 | |
| 1024 | /* |
| 1025 | * This should always be true since only the TCP socket option |
| 1026 | * invokes this function. |
| 1027 | */ |
| 1028 | if (so->so_proto->pr_protocol != IPPROTO_TCP) |
| 1029 | return (EINVAL); |
| 1030 | |
| 1031 | /* |
| 1032 | * XXX: Don't overwrite existing sessions. We should permit |
| 1033 | * this to support rekeying in the future. |
| 1034 | */ |
| 1035 | if (so->so_rcv.sb_tls_info != NULL) |
| 1036 | return (EALREADY); |
| 1037 | |
| 1038 | if (en->cipher_algorithm == CRYPTO_AES_CBC && !ktls_cbc_enable) |
| 1039 | return (ENOTSUP); |
| 1040 | |
| 1041 | /* TLS 1.3 is not yet supported. */ |
| 1042 | if (en->tls_vmajor == TLS_MAJOR_VER_ONE && |
| 1043 | en->tls_vminor == TLS_MINOR_VER_THREE) |
| 1044 | return (ENOTSUP); |
| 1045 | |
| 1046 | error = ktls_create_session(so, en, &tls); |
| 1047 | if (error) |
| 1048 | return (error); |
| 1049 | |
| 1050 | #ifdef TCP_OFFLOAD |
| 1051 | error = ktls_try_toe(so, tls, KTLS_RX); |
| 1052 | if (error) |
| 1053 | #endif |
| 1054 | error = ktls_try_sw(so, tls, KTLS_RX); |
| 1055 | |
| 1056 | if (error) { |
| 1057 | ktls_cleanup(tls); |
| 1058 | return (error); |
| 1059 | } |
| 1060 | |
| 1061 | /* Mark the socket as using TLS offload. */ |
| 1062 | SOCKBUF_LOCK(&so->so_rcv); |
| 1063 | so->so_rcv.sb_tls_seqno = be64dec(en->rec_seq); |
| 1064 | so->so_rcv.sb_tls_info = tls; |
| 1065 | so->so_rcv.sb_flags |= SB_TLS_RX; |
| 1066 | |
| 1067 | /* Mark existing data as not ready until it can be decrypted. */ |
| 1068 | sb_mark_notready(&so->so_rcv); |
no test coverage detected