Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH RFC net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX
@ 2020-08-18 14:12 Yutaro Hayakawa
  2020-08-28 11:14 ` Yutaro Hayakawa
  2020-08-28 16:52 ` Jakub Kicinski
  0 siblings, 2 replies; 9+ messages in thread
From: Yutaro Hayakawa @ 2020-08-18 14:12 UTC (permalink / raw)
  To: netdev; +Cc: michio.honda, Yutaro Hayakawa

Implement the getsockopt SOL_TLS TLS_RX which is currently missing. The
primary usecase is to use it in conjunction with TCP_REPAIR to
checkpoint/restore the TLS record layer state.

TLS connection state usually exists on the user space library. So
basically we can easily extract it from there, but when the TLS
connections are delegated to the kTLS, it is not the case. We need to
have a way to extract the TLS state from the kernel for both of TX and
RX side.

The new TLS_RX getsockopt copies the crypto_info to user in the same
way as TLS_TX does.

We have described use cases in our research work in Netdev 0x14
Transport Workshop [1].

Also, there is an TLS implementation called tlse [2] which supports
TLS connection migration. They have support of kTLS and their code
shows that they are expecting the future support of this option.

[1] https://speakerdeck.com/yutarohayakawa/prism-proxies-without-the-pain
[2] https://github.com/eduardsui/tlse

Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
---
 net/tls/tls_main.c | 50 +++++++++++++++++++++++++++++++++-------------
 1 file changed, 36 insertions(+), 14 deletions(-)

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index bbc52b088d29..ea66cac2cd84 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -330,8 +330,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
 		tls_ctx_free(sk, ctx);
 }
 
-static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
-				int __user *optlen)
+static int do_tls_getsockopt_conf(struct sock *sk, char __user *optval,
+				  int __user *optlen, int tx)
 {
 	int rc = 0;
 	struct tls_context *ctx = tls_get_ctx(sk);
@@ -352,7 +352,11 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
 	}
 
 	/* get user crypto info */
-	crypto_info = &ctx->crypto_send.info;
+	if (tx) {
+		crypto_info = &ctx->crypto_send.info;
+	} else {
+		crypto_info = &ctx->crypto_recv.info;
+	}
 
 	if (!TLS_CRYPTO_INFO_READY(crypto_info)) {
 		rc = -EBUSY;
@@ -378,11 +382,19 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
 			goto out;
 		}
 		lock_sock(sk);
-		memcpy(crypto_info_aes_gcm_128->iv,
-		       ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
-		       TLS_CIPHER_AES_GCM_128_IV_SIZE);
-		memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
-		       TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
+		if (tx) {
+			memcpy(crypto_info_aes_gcm_128->iv,
+			       ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
+			       TLS_CIPHER_AES_GCM_128_IV_SIZE);
+			memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
+			       TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
+		} else {
+			memcpy(crypto_info_aes_gcm_128->iv,
+			       ctx->rx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
+			       TLS_CIPHER_AES_GCM_128_IV_SIZE);
+			memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->rx.rec_seq,
+			       TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
+		}
 		release_sock(sk);
 		if (copy_to_user(optval,
 				 crypto_info_aes_gcm_128,
@@ -402,11 +414,19 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
 			goto out;
 		}
 		lock_sock(sk);
-		memcpy(crypto_info_aes_gcm_256->iv,
-		       ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
-		       TLS_CIPHER_AES_GCM_256_IV_SIZE);
-		memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
-		       TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
+		if (tx) {
+			memcpy(crypto_info_aes_gcm_256->iv,
+			       ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
+			       TLS_CIPHER_AES_GCM_256_IV_SIZE);
+			memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
+			       TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
+		} else {
+			memcpy(crypto_info_aes_gcm_256->iv,
+			       ctx->rx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
+			       TLS_CIPHER_AES_GCM_256_IV_SIZE);
+			memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->rx.rec_seq,
+			       TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
+		}
 		release_sock(sk);
 		if (copy_to_user(optval,
 				 crypto_info_aes_gcm_256,
@@ -429,7 +449,9 @@ static int do_tls_getsockopt(struct sock *sk, int optname,
 
 	switch (optname) {
 	case TLS_TX:
-		rc = do_tls_getsockopt_tx(sk, optval, optlen);
+	case TLS_RX:
+		rc = do_tls_getsockopt_conf(sk, optval, optlen,
+					    optname == TLS_TX);
 		break;
 	default:
 		rc = -ENOPROTOOPT;
-- 
2.26.2


^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2020-09-01 18:47 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-18 14:12 [PATCH RFC net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX Yutaro Hayakawa
2020-08-28 11:14 ` Yutaro Hayakawa
2020-08-28 16:52 ` Jakub Kicinski
2020-08-30 14:01   ` [PATCH RFC v2 " Yutaro Hayakawa
2020-08-30 17:48     ` Yutaro Hayakawa
2020-08-30 19:07       ` [PATCH RFC v3 " Yutaro Hayakawa
2020-08-31 18:30         ` Jakub Kicinski
2020-09-01 13:59           ` [PATCH " Yutaro Hayakawa
2020-09-01 18:47             ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).