Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 68c1fb2d authored by Shannon Nelson's avatar Shannon Nelson Committed by Jeff Kirsher
Browse files

ixgbe: check for 128-bit authentication 



Make sure the Security Association is using
a 128-bit authentication, since that's the only
size that the hardware offload supports.

Signed-off-by: default avatarShannon Nelson <shannon.nelson@oracle.com>
Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
parent 8b4c6ed2

drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c

+11 −5
Original line number Diff line number Diff line
@@ -423,15 +423,21 @@ static int ixgbe_ipsec_parse_proto_keys(struct xfrm_state *xs, 
	const char aes_gcm_name[] = "rfc4106(gcm(aes))";

	int key_len;



	if (xs->aead) {

		key_data = &xs->aead->alg_key[0];

		key_len = xs->aead->alg_key_len;

		alg_name = xs->aead->alg_name;

	} else {

	if (!xs->aead) {

		netdev_err(dev, "Unsupported IPsec algorithm\n");

		return -EINVAL;

	}



	if (xs->aead->alg_icv_len != IXGBE_IPSEC_AUTH_BITS) {

		netdev_err(dev, "IPsec offload requires %d bit authentication\n",

			   IXGBE_IPSEC_AUTH_BITS);

		return -EINVAL;

	}



	key_data = &xs->aead->alg_key[0];

	key_len = xs->aead->alg_key_len;

	alg_name = xs->aead->alg_name;



	if (strcmp(alg_name, aes_gcm_name)) {

		netdev_err(dev, "Unsupported IPsec algorithm - please use %s\n",

			   aes_gcm_name);

drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h

+1 −0
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ 
#define IXGBE_IPSEC_MAX_RX_IP_COUNT	128

#define IXGBE_IPSEC_BASE_RX_INDEX	0

#define IXGBE_IPSEC_BASE_TX_INDEX	IXGBE_IPSEC_MAX_SA_COUNT

#define IXGBE_IPSEC_AUTH_BITS		128



#define IXGBE_RXTXIDX_IPS_EN		0x00000001

#define IXGBE_RXIDX_TBL_SHIFT		1