| Message ID | 20240530232607.82686-1-kuba@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | a535d59432370343058755100ee75ab03c0e3f91 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: tls: fix marking packets as decrypted | expand |
On Thu, 30 May 2024 16:26:07 -0700 Jakub Kicinski wrote: > For TLS offload we mark packets with skb->decrypted to make sure > they don't escape the host without getting encrypted first. > The crypto state lives in the socket, so it may get detached > by a call to skb_orphan(). As a safety check - the egress path > drops all packets with skb->decrypted and no "crypto-safe" socket. > > The skb marking was added to sendpage only (and not sendmsg), > because tls_device injected data into the TCP stack using sendpage. > This special case was missed when sendpage got folded into sendmsg. > > Fixes: c5c37af6ecad ("tcp: Convert do_tcp_sendpages() to use MSG_SPLICE_PAGES") > Signed-off-by: Jakub Kicinski <kuba@kernel.org> Forgot to mention - compile tested only, ENODEV :(
On Fri, May 31, 2024 at 1:29 AM Jakub Kicinski <kuba@kernel.org> wrote: > > On Thu, 30 May 2024 16:26:07 -0700 Jakub Kicinski wrote: > > For TLS offload we mark packets with skb->decrypted to make sure > > they don't escape the host without getting encrypted first. > > The crypto state lives in the socket, so it may get detached > > by a call to skb_orphan(). As a safety check - the egress path > > drops all packets with skb->decrypted and no "crypto-safe" socket. > > > > The skb marking was added to sendpage only (and not sendmsg), > > because tls_device injected data into the TCP stack using sendpage. > > This special case was missed when sendpage got folded into sendmsg. > > > > Fixes: c5c37af6ecad ("tcp: Convert do_tcp_sendpages() to use MSG_SPLICE_PAGES") > > Signed-off-by: Jakub Kicinski <kuba@kernel.org> > > Forgot to mention - compile tested only, ENODEV :( Reviewed-by: Eric Dumazet <edumazet@google.com> In net-next, we could probably move skb_cmp_decrypted(), skb_is_decrypted(), skb_copy_decrypted() to a new include file, and define skb_set_decrypted() helper there.
Hello: This patch was applied to netdev/net.git (main) by Paolo Abeni <pabeni@redhat.com>: On Thu, 30 May 2024 16:26:07 -0700 you wrote: > For TLS offload we mark packets with skb->decrypted to make sure > they don't escape the host without getting encrypted first. > The crypto state lives in the socket, so it may get detached > by a call to skb_orphan(). As a safety check - the egress path > drops all packets with skb->decrypted and no "crypto-safe" socket. > > The skb marking was added to sendpage only (and not sendmsg), > because tls_device injected data into the TCP stack using sendpage. > This special case was missed when sendpage got folded into sendmsg. > > [...] Here is the summary with links: - [net] net: tls: fix marking packets as decrypted https://git.kernel.org/netdev/net/c/a535d5943237 You are awesome, thank you!
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 681b54e1f3a6..4d8cc2ebb64c 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1165,6 +1165,9 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) process_backlog++; +#ifdef CONFIG_SKB_DECRYPTED + skb->decrypted = !!(flags & MSG_SENDPAGE_DECRYPTED); +#endif tcp_skb_entail(sk, skb); copy = size_goal;
For TLS offload we mark packets with skb->decrypted to make sure they don't escape the host without getting encrypted first. The crypto state lives in the socket, so it may get detached by a call to skb_orphan(). As a safety check - the egress path drops all packets with skb->decrypted and no "crypto-safe" socket. The skb marking was added to sendpage only (and not sendmsg), because tls_device injected data into the TCP stack using sendpage. This special case was missed when sendpage got folded into sendmsg. Fixes: c5c37af6ecad ("tcp: Convert do_tcp_sendpages() to use MSG_SPLICE_PAGES") Signed-off-by: Jakub Kicinski <kuba@kernel.org> --- CC: dhowells@redhat.com CC: borisp@nvidia.com CC: john.fastabend@gmail.com --- net/ipv4/tcp.c | 3 +++ 1 file changed, 3 insertions(+)