Skip to content

Commit dd23eca

Browse files
werwurmwerwurm
authored
Add nat20sw kernel module to linux examples. (#102)
The nat20sw module is an implementation of a nat20device character device class. It uses the functionality implemented in nat20lib and nat20crypto to implement a fully fledged DICE service with embedded CA (ECA). The root secret is hard coded and thus not useful for production applications. But it serves as inspirational reference implementation and as a suitable environment to develop user space tools against.
1 parent 766ab38 commit dd23eca

10 files changed

Lines changed: 627 additions & 1 deletion

File tree

‎.github/workflows/linux-kmod-build.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,3 +121,20 @@ jobs:
121121
find ${{ runner.temp }}/buildroot.build -name 'nat20crypto.ko' | grep -q nat20crypto.ko
122122
echo "nat20crypto.ko built successfully:"
123123
find ${{ runner.temp }}/buildroot.build -name 'nat20crypto.ko' -exec ls -la {} \;
124+
125+
- name: Build nat20sw kernel module
126+
env:
127+
NAT20DEVICE_OVERRIDE_SRCDIR: ${{ github.workspace }}
128+
NAT20LIB_OVERRIDE_SRCDIR: ${{ github.workspace }}
129+
NAT20CRYPTO_OVERRIDE_SRCDIR: ${{ github.workspace }}
130+
NAT20SW_OVERRIDE_SRCDIR: ${{ github.workspace }}
131+
run: |
132+
cd ${{ runner.temp }}/buildroot.build/buildroot
133+
make nat20sw-dirclean
134+
make nat20sw -j $(( $(nproc) + 1 ))
135+
136+
- name: Verify nat20sw.ko was produced
137+
run: |
138+
find ${{ runner.temp }}/buildroot.build -name 'nat20sw.ko' | grep -q nat20sw.ko
139+
echo "nat20sw.ko built successfully:"
140+
find ${{ runner.temp }}/buildroot.build -name 'nat20sw.ko' -exec ls -la {} \;

‎examples/linux/br_external/Config.in‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,4 +35,5 @@
3535

3636
source "$BR2_EXTERNAL_NAT20_PATH/package/nat20crypto/Config.in"
3737
source "$BR2_EXTERNAL_NAT20_PATH/package/nat20device/Config.in"
38+
source "$BR2_EXTERNAL_NAT20_PATH/package/nat20sw/Config.in"
3839
source "$BR2_EXTERNAL_NAT20_PATH/package/nat20lib/Config.in"

‎examples/linux/br_external/configs/qemu_br_defconfig‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3978,4 +3978,5 @@ BR2_TARGET_UBOOT_CUSTOM_PATCH_DIR=""
39783978
#
39793979
BR2_PACKAGE_NAT20CRYPTO=y
39803980
BR2_PACKAGE_NAT20DEVICE=y
3981+
BR2_PACKAGE_NAT20SW=y
39813982
BR2_PACKAGE_NAT20LIB=y

‎examples/linux/br_external/package/nat20sw/Config.in‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Copyright 2026 Aurora Operations, Inc.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
4+
#
5+
# This work is dual licensed.
6+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
# OR
21+
#
22+
# This program is free software; you can redistribute it and/or
23+
# modify it under the terms of the GNU General Public License
24+
# as published by the Free Software Foundation; either version 2
25+
# of the License, or (at your option) any later version.
26+
#
27+
# This program is distributed in the hope that it will be useful,
28+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
29+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30+
# GNU General Public License for more details.
31+
#
32+
# You should have received a copy of the GNU General Public License
33+
# along with this program; if not, see
34+
# <https://www.gnu.org/licenses/>.
35+
36+
config BR2_PACKAGE_NAT20SW
37+
bool "nat20sw"
38+
depends on BR2_PACKAGE_NAT20LIB
39+
depends on BR2_PACKAGE_NAT20CRYPTO
40+
depends on BR2_PACKAGE_NAT20DEVICE
41+
help
42+
Add the software implementation of a nat20 service
43+
as a module. This is a driver for the nat20-device
44+
class.

‎examples/linux/br_external/package/nat20sw/nat20sw.mk‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Copyright 2026 Aurora Operations, Inc.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
4+
#
5+
# This work is dual licensed.
6+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
# OR
21+
#
22+
# This program is free software; you can redistribute it and/or
23+
# modify it under the terms of the GNU General Public License
24+
# as published by the Free Software Foundation; either version 2
25+
# of the License, or (at your option) any later version.
26+
#
27+
# This program is distributed in the hope that it will be useful,
28+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
29+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30+
# GNU General Public License for more details.
31+
#
32+
# You should have received a copy of the GNU General Public License
33+
# along with this program; if not, see
34+
# <https://www.gnu.org/licenses/>.
35+
36+
# In CI NAT20SW_OVERRIDE_SRCDIR is set to the root of the repository,
37+
# so that the source under test is always the current branch.
38+
# Integrators who use this configuration should pin the version
39+
# to a specific commit or branch to avoid breakages when the main branch changes.
40+
NAT20SW_VERSION = origin/main
41+
NAT20SW_SITE = https://github.com/aurora-opensource/libnat20.git
42+
NAT20SW_SITE_METHOD = git
43+
NAT20SW_LICENSE = Apache-2.0 OR GPL-2.0
44+
NAT20SW_LICENSE_FILES = LICENSE-Apache-2.0.txt LICENSE-GPL-2.0.txt
45+
46+
NAT20SW_DEPENDENCIES += nat20lib
47+
NAT20SW_DEPENDENCIES += nat20device
48+
NAT20SW_DEPENDENCIES += nat20crypto
49+
NAT20SW_MODULE_MAKE_OPTS += NAT20SW_NAT20LIB_DIR=$(NAT20LIB_DIR)/examples/linux/nat20lib
50+
NAT20SW_MODULE_MAKE_OPTS += NAT20SW_NAT20DEVICE_DIR=$(NAT20DEVICE_DIR)/examples/linux/nat20device
51+
NAT20SW_MODULE_MAKE_OPTS += NAT20SW_NAT20CRYPTO_DIR=$(NAT20CRYPTO_DIR)/examples/linux/nat20crypto
52+
53+
NAT20SW_MODULE_SUBDIRS = examples/linux/nat20sw
54+
55+
$(eval $(kernel-module))
56+
$(eval $(generic-package))

‎examples/linux/br_external/utils/envsetup.sh‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ fi
4747
source .env
4848

4949
export NAT20CRYPTO_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
50+
export NAT20SW_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
5051
export NAT20DEVICE_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
5152
export NAT20LIB_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
5253

@@ -72,14 +73,15 @@ function brrebuild() {
7273
echo " linux - Rebuild the linux kernel"
7374
echo " nat20crypto - Rebuild the nat20crypto module"
7475
echo " nat20device - Rebuild the nat20device module"
76+
echo " nat20sw - Rebuild the nat20sw module"
7577
echo " nat20lib - Rebuild the nat20lib library"
7678
popd
7779
return 1
7880
fi
7981

8082
case "$1" in
8183
all)
82-
ensure_popd make linux-rebuild nat20crypto-rebuild nat20device-rebuild nat20lib-rebuild all
84+
ensure_popd make linux-rebuild nat20lib-rebuild nat20crypto-rebuild nat20device-rebuild nat20sw-rebuild all
8385
;;
8486
*)
8587
ensure_popd make $1-rebuild all

‎examples/linux/nat20lib/mod.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ EXPORT_SYMBOL(n20_cbor_write_byte_string);
6060
EXPORT_SYMBOL(n20_cbor_write_int);
6161
EXPORT_SYMBOL(n20_cbor_write_map_header);
6262
EXPORT_SYMBOL(n20_cbor_write_null);
63+
EXPORT_SYMBOL(n20_cbor_write_tag);
6364
EXPORT_SYMBOL(n20_cbor_write_text_string);
6465
EXPORT_SYMBOL(n20_cbor_write_header);
6566
EXPORT_SYMBOL(n20_compress_input);
@@ -83,9 +84,11 @@ EXPORT_SYMBOL(n20_open_dice_cwt_write);
8384
EXPORT_SYMBOL(n20_rfc6979_k_generation);
8485
EXPORT_SYMBOL(n20_service_message_dispatch);
8586
EXPORT_SYMBOL(n20_stream_byte_count);
87+
EXPORT_SYMBOL(n20_stream_has_buffer_overflow);
8688
EXPORT_SYMBOL(n20_stream_has_write_position_overflow);
8789
EXPORT_SYMBOL(n20_stream_init);
8890
EXPORT_SYMBOL(n20_stream_prepend);
91+
EXPORT_SYMBOL(n20_stream_put);
8992
EXPORT_SYMBOL(n20_stream_skip);
9093

9194
module_init(nat20lib_init);

‎examples/linux/nat20sw/Kbuild‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Copyright 2026 Aurora Operations, Inc.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
4+
#
5+
# This work is dual licensed.
6+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
# OR
21+
#
22+
# This program is free software; you can redistribute it and/or
23+
# modify it under the terms of the GNU General Public License
24+
# as published by the Free Software Foundation; either version 2
25+
# of the License, or (at your option) any later version.
26+
#
27+
# This program is distributed in the hope that it will be useful,
28+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
29+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30+
# GNU General Public License for more details.
31+
#
32+
# You should have received a copy of the GNU General Public License
33+
# along with this program; if not, see
34+
# <https://www.gnu.org/licenses/>.
35+
36+
KBUILD_EXTRA_SYMBOLS := $(NAT20SW_NAT20LIB_DIR)/Module.symvers
37+
KBUILD_EXTRA_SYMBOLS += $(NAT20SW_NAT20DEVICE_DIR)/Module.symvers
38+
KBUILD_EXTRA_SYMBOLS += $(NAT20SW_NAT20CRYPTO_DIR)/Module.symvers
39+
40+
obj-m := nat20sw.o
41+
42+
ccflags-y := -I $(NAT20SW_NAT20LIB_DIR)/include
43+
ccflags-y += -I $(NAT20SW_NAT20DEVICE_DIR)/include
44+
ccflags-y += -I $(NAT20SW_NAT20CRYPTO_DIR)/include

‎examples/linux/nat20sw/Makefile‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Copyright 2026 Aurora Operations, Inc.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
4+
#
5+
# This work is dual licensed.
6+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
# OR
21+
#
22+
# This program is free software; you can redistribute it and/or
23+
# modify it under the terms of the GNU General Public License
24+
# as published by the Free Software Foundation; either version 2
25+
# of the License, or (at your option) any later version.
26+
#
27+
# This program is distributed in the hope that it will be useful,
28+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
29+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30+
# GNU General Public License for more details.
31+
#
32+
# You should have received a copy of the GNU General Public License
33+
# along with this program; if not, see
34+
# <https://www.gnu.org/licenses/>.
35+
36+
KDIR ?= /lib/modules/`uname -r`/build
37+
INSTALL_MOD_DIR ?= extra
38+
39+
NAT20SW_NAT20LIB_DIR ?= $(PWD)/../nat20lib
40+
NAT20SW_NAT20DEVICE_DIR ?= $(PWD)/../nat20device
41+
NAT20SW_NAT20CRYPTO_DIR ?= $(PWD)/../nat20crypto
42+
43+
all: modules
44+
45+
modules:
46+
$(MAKE) -C $(KDIR) NAT20SW_NAT20LIB_DIR=$(NAT20SW_NAT20LIB_DIR) NAT20SW_NAT20DEVICE_DIR=$(NAT20SW_NAT20DEVICE_DIR) NAT20SW_NAT20CRYPTO_DIR=$(NAT20SW_NAT20CRYPTO_DIR) M=$$PWD modules
47+
48+
modules_install:
49+
$(MAKE) -C $(KDIR) INSTALL_MOD_DIR=$(INSTALL_MOD_DIR) M=$$PWD modules_install
50+
51+
clean:
52+
$(MAKE) -C $(KDIR) M=$$PWD clean
53+
54+
.PHONY: all modules modules_install clean

0 commit comments

Comments
 (0)