Re: [PATCH RFC 4/5] net/tls: Add support for PF_TLSH (a TLS handshake listener)

Hannes Reinecke
2022-04-21T07:36:51Z

On 4/18/22 18:49, Chuck Lever wrote:
> In-kernel TLS consumers need a way to perform a TLS handshake. In
> the absence of a handshake implementation in the kernel itself, a
> mechanism to perform the handshake in user space, using an existing
> TLS handshake library, is necessary.
>
> I've designed a way to pass a connected kernel socket endpoint to
> user space using the traditional listen/accept mechanism. accept(2)
> gives us a well-understood way to materialize a socket endpoint as a
> normal file descriptor in a specific user space process. Like any
> open socket descriptor, the accepted FD can then be passed to a
> library such as openSSL to perform a TLS handshake.
>
> This prototype currently handles only initiating client-side TLS
> handshakes. Server-side handshakes and key renegotiation are left
> to do.
>
> Security Considerations
> ~~~~~~~~ ~~~~~~~~~~~~~~
>
> This prototype is net-namespace aware.
>
> The kernel has no mechanism to attest that the listening user space
> agent is trustworthy.
>
> Currently the prototype does not handle multiple listeners that
> overlap -- multiple listeners in the same net namespace that have
> overlapping bind addresses.
>
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> ---
> .../networking/tls-in-kernel-handshake.rst | 103 ++
> include/linux/socket.h | 1
> include/net/sock.h | 3
> include/net/tls.h | 15
> include/net/tlsh.h | 22
> include/uapi/linux/tls.h | 16
> net/core/sock.c | 2
> net/tls/Makefile | 2
> net/tls/af_tlsh.c | 1040 ++++++++++++++++++++
> net/tls/tls_main.c | 10
> 10 files changed, 1213 insertions(+), 1 deletion(-)
> create mode 100644 Documentation/networking/tls-in-kernel-handshake.rst
> create mode 100644 include/net/tlsh.h
> create mode 100644 net/tls/af_tlsh.c
>
Reviewed-by: Hannes Reinecke <hare@suse.de>

Cheers,

Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
hare@suse.de +49 911 74053 688
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nürnberg
HRB 36809 (AG Nürnberg), GF: Felix Imendörffer