system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-07-21 10:41:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

net/handshake: Add API for sending TLS Closure alerts

Browse source 
This helper sends an alert only if a TLS session was established.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Link: https://lore.kernel.org/r/169047936730.5241.618595693821012638.stgit@oracle-102.nfsv4bat.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Chuck Lever 2023-07-27 13:36:17 -04:00 committed by Jakub Kicinski
parent 0257427146
commit 35b1b538d4
5 changed files with 92 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
include/net/handshake.h
View file

@ -40,5 +40,6 @@ int tls_server_hello_x509(const struct tls_handshake_args *args, gfp_t flags);
int tls_server_hello_psk(const struct tls_handshake_args *args, gfp_t flags);
bool tls_handshake_cancel(struct sock *sk);
void tls_handshake_close(struct socket *sock);
#endif /* _NET_HANDSHAKE_H */

2
net/handshake/Makefile
View file

@ -8,6 +8,6 @@
#
obj-y += handshake.o
handshake-y := genl.o netlink.o request.o tlshd.o trace.o
handshake-y := alert.o genl.o netlink.o request.o tlshd.o trace.o
obj-$(CONFIG_NET_HANDSHAKE_KUNIT_TEST) += handshake-test.o

61
net/handshake/alert.c Normal file
View file

@ -0,0 +1,61 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Handle the TLS Alert protocol
*
* Author: Chuck Lever <chuck.lever@oracle.com>
*
* Copyright (c) 2023, Oracle and/or its affiliates.
*/
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/inet.h>
#include <net/sock.h>
#include <net/handshake.h>
#include <net/tls.h>
#include <net/tls_prot.h>
#include "handshake.h"
/**
* tls_alert_send - send a TLS Alert on a kTLS socket
* @sock: open kTLS socket to send on
* @level: TLS Alert level
* @description: TLS Alert description
*
* Returns zero on success or a negative errno.
*/
int tls_alert_send(struct socket *sock, u8 level, u8 description)
{
u8 record_type = TLS_RECORD_TYPE_ALERT;
u8 buf[CMSG_SPACE(sizeof(record_type))];
struct msghdr msg = { 0 };
struct cmsghdr *cmsg;
struct kvec iov;
u8 alert[2];
int ret;
alert[0] = level;
alert[1] = description;
iov.iov_base = alert;
iov.iov_len = sizeof(alert);
memset(buf, 0, sizeof(buf));
msg.msg_control = buf;
msg.msg_controllen = sizeof(buf);
msg.msg_flags = MSG_DONTWAIT;
cmsg = CMSG_FIRSTHDR(&msg);
cmsg->cmsg_level = SOL_TLS;
cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
cmsg->cmsg_len = CMSG_LEN(sizeof(record_type));
memcpy(CMSG_DATA(cmsg), &record_type, sizeof(record_type));
iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iov, 1, iov.iov_len);
ret = sock_sendmsg(sock, &msg);
return ret < 0 ? ret : 0;
}

6
net/handshake/handshake.h
View file

@ -41,8 +41,11 @@ struct handshake_req {
enum hr_flags_bits {
HANDSHAKE_F_REQ_COMPLETED,
HANDSHAKE_F_REQ_SESSION,
};
struct genl_info;
/* Invariants for all handshake requests for one transport layer
* security protocol
*/
@ -63,6 +66,9 @@ enum hp_flags_bits {
HANDSHAKE_F_PROTO_NOTIFY,
};
/* alert.c */
int tls_alert_send(struct socket *sock, u8 level, u8 description);
/* netlink.c */
int handshake_genl_notify(struct net *net, const struct handshake_proto *proto,
gfp_t flags);

23
net/handshake/tlshd.c
View file

@ -18,6 +18,7 @@
#include <net/sock.h>
#include <net/handshake.h>
#include <net/genetlink.h>
#include <net/tls_prot.h>
#include <uapi/linux/keyctl.h>
#include <uapi/linux/handshake.h>
@ -100,6 +101,9 @@ static void tls_handshake_done(struct handshake_req *req,
if (info)
tls_handshake_remote_peerids(treq, info);
if (!status)
set_bit(HANDSHAKE_F_REQ_SESSION, &req->hr_flags);
treq->th_consumer_done(treq->th_consumer_data, -status,
treq->th_peerid[0]);
}
@ -424,3 +428,22 @@ bool tls_handshake_cancel(struct sock *sk)
return handshake_req_cancel(sk);
}
EXPORT_SYMBOL(tls_handshake_cancel);
/**
* tls_handshake_close - send a Closure alert
* @sock: an open socket
*
*/
void tls_handshake_close(struct socket *sock)
{
struct handshake_req *req;
req = handshake_req_hash_lookup(sock->sk);
if (!req)
return;
if (!test_and_clear_bit(HANDSHAKE_F_REQ_SESSION, &req->hr_flags))
return;
tls_alert_send(sock, TLS_ALERT_LEVEL_WARNING,
TLS_ALERT_DESC_CLOSE_NOTIFY);
}
EXPORT_SYMBOL(tls_handshake_close);