ixgbe: check for 128-bit authentication

Make sure the Security Association is using
a 128-bit authentication, since that's the only
size that the hardware offload supports.

Signed-off-by: Shannon Nelson <shannon.nelson@oracle.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index 93eacddb6704d4ebc7ed8b55dc2121adda7b5e31..8b7dbc8057eb3545b427757eb4a0b548d8689dc9 100644 (file)
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -423,15 +423,21 @@ static int ixgbe_ipsec_parse_proto_keys(struct xfrm_state *xs,
        const char aes_gcm_name[] = "rfc4106(gcm(aes))";
        int key_len;
 
-       if (xs->aead) {
-               key_data = &xs->aead->alg_key[0];
-               key_len = xs->aead->alg_key_len;
-               alg_name = xs->aead->alg_name;
-       } else {
+       if (!xs->aead) {
                netdev_err(dev, "Unsupported IPsec algorithm\n");
                return -EINVAL;
        }
 
+       if (xs->aead->alg_icv_len != IXGBE_IPSEC_AUTH_BITS) {
+               netdev_err(dev, "IPsec offload requires %d bit authentication\n",
+                          IXGBE_IPSEC_AUTH_BITS);
+               return -EINVAL;
+       }
+
+       key_data = &xs->aead->alg_key[0];
+       key_len = xs->aead->alg_key_len;
+       alg_name = xs->aead->alg_name;
+
        if (strcmp(alg_name, aes_gcm_name)) {
                netdev_err(dev, "Unsupported IPsec algorithm - please use %s\n",
                           aes_gcm_name);

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h
index da3ce7849e851e0237d12c62f7c6083c3d8aca2d..87d2800b94ab830a4298b241f6faaa20ce589cb0 100644 (file)
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h
@@ -32,6 +32,7 @@
 #define IXGBE_IPSEC_MAX_RX_IP_COUNT    128
 #define IXGBE_IPSEC_BASE_RX_INDEX      0
 #define IXGBE_IPSEC_BASE_TX_INDEX      IXGBE_IPSEC_MAX_SA_COUNT
+#define IXGBE_IPSEC_AUTH_BITS          128
 
 #define IXGBE_RXTXIDX_IPS_EN           0x00000001
 #define IXGBE_RXIDX_TBL_SHIFT          1