Re: [PATCH net-next 1/5] tls: reject the combination of TLS and sockmap

[Sabrina Dubroca <sd@queasysnail.net>]

2026-06-15, 20:45:21 +0200, Jakub Sitnicki wrote:
> On Sat, Jun 13, 2026 at 06:40 PM -07, Jakub Kicinski wrote:
> > TLS and sockmap (BPF psock) integration hides a lot of latent bugs.
> > Bugs which may be more or less relevant for real users but they
> > are definitely exploitable.
> >
> > We could not find anyone actively using this integration so let's
> > reject this config. Adding a TLS socket to a sockmap was already
> > rejected by sk_psock_init() through the inet_csk_has_ulp() check.
> > We need to reject the attempts to configure the TLS keys (rather
> > than adding the ULP itself) because checking prior to the ULP
> > installation is tricky without risking a race with sockmap getting
> > added in parallel (sockmap does not hold the socket lock).
> >
> > This patch is a minimal rejection of the feature. Subsequent patch
> > in the series will do a light dead code removal. Full cleanup would
> > require a major rewrite of the Tx path, we don't need skmsg any more.
> >
> > Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> > ---
> 
> SGTM until we can come up with a generic way to exclude sockmapped
> sockets from ktls and espintcp.

And possibly ovpn too.

Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>

-- 
Sabrina