net: skbuff: generalize the skb->decrypted bit

The ->decrypted bit can be reused for other crypto protocols.
Remove the direct dependency on TLS, add helpers to clean up
the ifdefs leaking out everywhere.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 03ea36a82cdd754b2462667449a5f2534452340c..7dfb906d92f718319cac736421705b21bd09debe 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -992,7 +992,7 @@ struct sk_buff {
 #ifdef CONFIG_NETFILTER_SKIP_EGRESS
        __u8                    nf_skip_egress:1;
 #endif
-#ifdef CONFIG_TLS_DEVICE
+#ifdef CONFIG_SKB_DECRYPTED
        __u8                    decrypted:1;
 #endif
        __u8                    slow_gro:1;
@@ -1615,17 +1615,26 @@ static inline void skb_copy_hash(struct sk_buff *to, const struct sk_buff *from)
 static inline int skb_cmp_decrypted(const struct sk_buff *skb1,
                                    const struct sk_buff *skb2)
 {
-#ifdef CONFIG_TLS_DEVICE
+#ifdef CONFIG_SKB_DECRYPTED
        return skb2->decrypted - skb1->decrypted;
 #else
        return 0;
 #endif
 }
 
+static inline bool skb_is_decrypted(const struct sk_buff *skb)
+{
+#ifdef CONFIG_SKB_DECRYPTED
+       return skb->decrypted;
+#else
+       return false;
+#endif
+}
+
 static inline void skb_copy_decrypted(struct sk_buff *to,
                                      const struct sk_buff *from)
 {
-#ifdef CONFIG_TLS_DEVICE
+#ifdef CONFIG_SKB_DECRYPTED
        to->decrypted = from->decrypted;
 #endif
 }

diff --git a/include/net/sock.h b/include/net/sock.h
index 2253eefe284880489eb9b4c60d9d77a3c7bd9ef1..a495330c5c499bf792c7c3e6a5cf56165b9ec901 100644 (file)
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2835,12 +2835,10 @@ static inline struct sk_buff *sk_validate_xmit_skb(struct sk_buff *skb,
 
        if (sk && sk_fullsock(sk) && sk->sk_validate_xmit_skb) {
                skb = sk->sk_validate_xmit_skb(sk, dev, skb);
-#ifdef CONFIG_TLS_DEVICE
-       } else if (unlikely(skb->decrypted)) {
+       } else if (unlikely(skb_is_decrypted(skb))) {
                pr_warn_ratelimited("unencrypted skb with no associated socket - dropping\n");
                kfree_skb(skb);
                skb = NULL;
-#endif
        }
 #endif
 

diff --git a/net/Kconfig b/net/Kconfig
index 3e57ccf0da279ceff6fffe911c21cba75a33bf75..d5ab791f7afa2716a8420ffcdf36408dcfb30ac7 100644 (file)
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -60,6 +60,9 @@ config NET_XGRESS
 config NET_REDIRECT
        bool
 
+config SKB_DECRYPTED
+       bool
+
 config SKB_EXTENSIONS
        bool
 

diff --git a/net/core/sock.c b/net/core/sock.c
index 5ed411231fc7bebefcd1fc268607392a73f1f106..fe9195186c13f51b113f8e8bc69ea25ea4a13aad 100644 (file)
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2526,13 +2526,12 @@ EXPORT_SYMBOL(skb_set_owner_w);
 
 static bool can_skb_orphan_partial(const struct sk_buff *skb)
 {
-#ifdef CONFIG_TLS_DEVICE
        /* Drivers depend on in-order delivery for crypto offload,
         * partial orphan breaks out-of-order-OK logic.
         */
-       if (skb->decrypted)
+       if (skb_is_decrypted(skb))
                return false;
-#endif
+
        return (skb->destructor == sock_wfree ||
                (IS_ENABLED(CONFIG_INET) && skb->destructor == tcp_wfree));
 }

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 8d44ab5671eacd4bc06647c7cca387a79e346618..1f28a2561795cf48ee7dbf638c15c773c8b8c84c 100644 (file)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4805,10 +4805,8 @@ static bool tcp_try_coalesce(struct sock *sk,
        if (!mptcp_skb_can_collapse(to, from))
                return false;
 
-#ifdef CONFIG_TLS_DEVICE
-       if (from->decrypted != to->decrypted)
+       if (skb_cmp_decrypted(from, to))
                return false;
-#endif
 
        if (!skb_try_coalesce(to, from, fragstolen, &delta))
                return false;
@@ -5377,9 +5375,7 @@ restart:
                        break;
 
                memcpy(nskb->cb, skb->cb, sizeof(skb->cb));
-#ifdef CONFIG_TLS_DEVICE
-               nskb->decrypted = skb->decrypted;
-#endif
+               skb_copy_decrypted(nskb, skb);
                TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(nskb)->end_seq = start;
                if (list)
                        __skb_queue_before(list, skb, nskb);
@@ -5409,10 +5405,8 @@ restart:
                                    !mptcp_skb_can_collapse(nskb, skb) ||
                                    (TCP_SKB_CB(skb)->tcp_flags & (TCPHDR_SYN | TCPHDR_FIN)))
                                        goto end;
-#ifdef CONFIG_TLS_DEVICE
-                               if (skb->decrypted != nskb->decrypted)
+                               if (skb_cmp_decrypted(skb, nskb))
                                        goto end;
-#endif
                        }
                }
        }

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 56b75efcfd12bfff5b49ad5141b1c0a2344f0f04..52963c3bb8ca7380692f7be6e15d687c45e8673a 100644 (file)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2044,10 +2044,8 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb,
              TCP_SKB_CB(skb)->tcp_flags) & TCPHDR_ACK) ||
            ((TCP_SKB_CB(tail)->tcp_flags ^
              TCP_SKB_CB(skb)->tcp_flags) & (TCPHDR_ECE | TCPHDR_CWR)) ||
-#ifdef CONFIG_TLS_DEVICE
-           tail->decrypted != skb->decrypted ||
-#endif
            !mptcp_skb_can_collapse(tail, skb) ||
+           skb_cmp_decrypted(tail, skb) ||
            thtail->doff != th->doff ||
            memcmp(thtail + 1, th + 1, hdrlen - sizeof(*th)))
                goto no_coalesce;

diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index ebe4722bb0204433936e69724879779141288789..fab0973f995bf6edf2c3821ee34b6ece8a17ab78 100644 (file)
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -265,9 +265,7 @@ found:
                flush |= (len - 1) >= mss;
 
        flush |= (ntohl(th2->seq) + skb_gro_len(p)) ^ ntohl(th->seq);
-#ifdef CONFIG_TLS_DEVICE
-       flush |= p->decrypted ^ skb->decrypted;
-#endif
+       flush |= skb_cmp_decrypted(p, skb);
 
        if (flush || skb_gro_receive(p, skb)) {
                mss = 1;

diff --git a/net/tls/Kconfig b/net/tls/Kconfig
index 0cdc1f7b6b084e975a6d32cfbc0af172fe40222e..ce8d56a1918734228d900fb466333d416a976270 100644 (file)
--- a/net/tls/Kconfig
+++ b/net/tls/Kconfig
@@ -20,6 +20,7 @@ config TLS
 config TLS_DEVICE
        bool "Transport Layer Security HW offload"
        depends on TLS
+       select SKB_DECRYPTED
        select SOCK_VALIDATE_XMIT
        select SOCK_RX_QUEUE_MAPPING
        default n