| 1075 | } |
| 1076 | |
| 1077 | int |
| 1078 | ktls_enable_tx(struct socket *so, struct tls_enable *en) |
| 1079 | { |
| 1080 | struct ktls_session *tls; |
| 1081 | struct inpcb *inp; |
| 1082 | int error; |
| 1083 | |
| 1084 | if (!ktls_offload_enable) |
| 1085 | return (ENOTSUP); |
| 1086 | if (SOLISTENING(so)) |
| 1087 | return (EINVAL); |
| 1088 | |
| 1089 | counter_u64_add(ktls_offload_enable_calls, 1); |
| 1090 | |
| 1091 | /* |
| 1092 | * This should always be true since only the TCP socket option |
| 1093 | * invokes this function. |
| 1094 | */ |
| 1095 | if (so->so_proto->pr_protocol != IPPROTO_TCP) |
| 1096 | return (EINVAL); |
| 1097 | |
| 1098 | /* |
| 1099 | * XXX: Don't overwrite existing sessions. We should permit |
| 1100 | * this to support rekeying in the future. |
| 1101 | */ |
| 1102 | if (so->so_snd.sb_tls_info != NULL) |
| 1103 | return (EALREADY); |
| 1104 | |
| 1105 | if (en->cipher_algorithm == CRYPTO_AES_CBC && !ktls_cbc_enable) |
| 1106 | return (ENOTSUP); |
| 1107 | |
| 1108 | /* TLS requires ext pgs */ |
| 1109 | if (mb_use_ext_pgs == 0) |
| 1110 | return (ENXIO); |
| 1111 | |
| 1112 | error = ktls_create_session(so, en, &tls); |
| 1113 | if (error) |
| 1114 | return (error); |
| 1115 | |
| 1116 | /* Prefer TOE -> ifnet TLS -> software TLS. */ |
| 1117 | #ifdef TCP_OFFLOAD |
| 1118 | error = ktls_try_toe(so, tls, KTLS_TX); |
| 1119 | if (error) |
| 1120 | #endif |
| 1121 | error = ktls_try_ifnet(so, tls, false); |
| 1122 | if (error) |
| 1123 | error = ktls_try_sw(so, tls, KTLS_TX); |
| 1124 | |
| 1125 | if (error) { |
| 1126 | ktls_cleanup(tls); |
| 1127 | return (error); |
| 1128 | } |
| 1129 | |
| 1130 | error = sblock(&so->so_snd, SBL_WAIT); |
| 1131 | if (error) { |
| 1132 | ktls_cleanup(tls); |
| 1133 | return (error); |
| 1134 | } |
no test coverage detected