Commit 53b4414a authored by Jakub Kicinski's avatar Jakub Kicinski Committed by David S. Miller
Browse files

net/tls: allow compiling TLS TOE out 



TLS "record layer offload" requires TOE, and bypasses most of
the normal networking stack. It is also significantly less
maintained. Allow users to compile it out to avoid issues.

Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: default avatarJohn Hurley <john.hurley@netronome.com>
Reviewed-by: default avatarSimon Horman <simon.horman@netronome.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0eb8745e

drivers/crypto/chelsio/Kconfig

+1 −1
Original line number Diff line number Diff line
@@ -35,7 +35,7 @@ config CHELSIO_IPSEC_INLINE 
config CRYPTO_DEV_CHELSIO_TLS

        tristate "Chelsio Crypto Inline TLS Driver"

        depends on CHELSIO_T4

        depends on TLS

        depends on TLS_TOE

        select CRYPTO_DEV_CHELSIO

        ---help---

          Support Chelsio Inline TLS with Chelsio crypto accelerator.

net/tls/Kconfig

+10 −0
Original line number Diff line number Diff line
@@ -26,3 +26,13 @@ config TLS_DEVICE 
	Enable kernel support for HW offload of the TLS protocol.



	If unsure, say N.



config TLS_TOE

	bool "Transport Layer Security TCP stack bypass"

	depends on TLS

	default n

	help

	Enable kernel support for legacy HW offload of the TLS protocol,

	which is incompatible with the Linux networking stack semantics.



	If unsure, say N.

net/tls/Makefile

+2 −1
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ 


obj-$(CONFIG_TLS) += tls.o



tls-y := tls_main.o tls_sw.o tls_toe.o

tls-y := tls_main.o tls_sw.o



tls-$(CONFIG_TLS_TOE) += tls_toe.o

tls-$(CONFIG_TLS_DEVICE) += tls_device.o tls_device_fallback.o

net/tls/tls_main.c

+4 −1
Original line number Diff line number Diff line
@@ -679,10 +679,11 @@ static void build_protos(struct proto prot[TLS_NUM_CONFIG][TLS_NUM_CONFIG], 


	prot[TLS_HW][TLS_HW] = prot[TLS_HW][TLS_SW];

#endif



#ifdef CONFIG_TLS_TOE

	prot[TLS_HW_RECORD][TLS_HW_RECORD] = *base;

	prot[TLS_HW_RECORD][TLS_HW_RECORD].hash		= tls_toe_hash;

	prot[TLS_HW_RECORD][TLS_HW_RECORD].unhash	= tls_toe_unhash;

#endif

}



static int tls_init(struct sock *sk)
@@ -692,8 +693,10 @@ static int tls_init(struct sock *sk) 


	tls_build_proto(sk);



#ifdef CONFIG_TLS_TOE

	if (tls_toe_bypass(sk))

		return 0;

#endif



	/* The TLS ulp is currently supported only for TCP sockets

	 * in ESTABLISHED state.

CRA Git | Maintained and supported by SUSTech CRA and CCSE