[PATCH 0/3] tls: Use correct sk->sk_prot for IPV6

[PATCH 0/3] tls: Use correct sk->sk_prot for IPV6

[Ilya Lesokhin]

Fix tls code to use the correct sk->sk_prot for IPV6.
Previously it was tcp_prot of IPV4 was used.

Boris Pismenny (1):
  net: Export tcpv6_prot

Ilya Lesokhin (2):
  ipv6: Prevent unexpected sk->sk_prot changes
  tls: Use correct sk->sk_prot for IPV6

 net/ipv6/ipv6_sockglue.c | 12 ++++++++++
 net/ipv6/tcp_ipv6.c      |  1 +
 net/tls/tls_main.c       | 61 ++++++++++++++++++++++++++++++++++++++----------
 3 files changed, 62 insertions(+), 12 deletions(-)

-- 
1.8.3.1

[PATCH 1/3] ipv6: Prevent unexpected sk->sk_prot changes

[Ilya Lesokhin]

With this patch IPV6 code ensure that only sockets with the
expected sk->sk_prot are converted to IPV4.

Signed-off-by: Boris Pismenny <borisp@mellanox.com>
---
 net/ipv6/ipv6_sockglue.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 02d795f..318cd344 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -174,6 +174,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 		if (val == PF_INET) {
 			struct ipv6_txoptions *opt;
 			struct sk_buff *pktopt;
+			struct proto *expected_prot;
 
 			if (sk->sk_type == SOCK_RAW)
 				break;
@@ -199,6 +200,17 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 				break;
 			}
 
+			if (sk->sk_protocol == IPPROTO_TCP &&
+			    sk->sk_prot != &tcpv6_prot)
+				break;
+
+			expected_prot = &udpv6_prot;
+			if (sk->sk_protocol == IPPROTO_UDPLITE)
+				expected_prot = &udplitev6_prot;
+
+			if (sk->sk_prot != expected_prot)
+				break;
+
 			fl6_free_socklist(sk);
 			__ipv6_sock_mc_close(sk);
 
-- 
1.8.3.1

[PATCH 2/3] net: Export tcpv6_prot

[Ilya Lesokhin]

From: Boris Pismenny <borisp@mellanox.com>

Want to be able to use these in TLS.

Signed-off-by: Boris Pismenny <borisp@mellanox.com>
---
 net/ipv6/tcp_ipv6.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2521690..e3a44a5 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1944,6 +1944,7 @@ struct proto tcpv6_prot = {
 #endif
 	.diag_destroy		= tcp_abort,
 };
+EXPORT_SYMBOL(tcpv6_prot);
 
 static struct inet6_protocol tcpv6_protocol = {
 	.early_demux	=	tcp_v6_early_demux,
-- 
1.8.3.1

Re: [PATCH 2/3] net: Export tcpv6_prot

[David Miller]

From: Ilya Lesokhin <ilyal@mellanox.com>
Date: Thu, 10 Aug 2017 13:33:15 +0300

> From: Boris Pismenny <borisp@mellanox.com>
> 
> Want to be able to use these in TLS.
> 
> Signed-off-by: Boris Pismenny <borisp@mellanox.com>
> ---
>  net/ipv6/tcp_ipv6.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index 2521690..e3a44a5 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -1944,6 +1944,7 @@ struct proto tcpv6_prot = {
>  #endif
>  	.diag_destroy		= tcp_abort,
>  };
> +EXPORT_SYMBOL(tcpv6_prot);

EXPORT_SYMBOL_GPL() please.

[PATCH 3/3] tls: Use correct sk->sk_prot for IPV6

[Ilya Lesokhin]

The code assumed that only IP version 4 TCP sk->sk_prot was
being used. Now it checks for IPV6 and sets sk->sk_prot
accordingly.

Signed-off-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: Ilya Lesokhin <ilyal@mellanox.com>
---
 net/tls/tls_main.c | 61 +++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 49 insertions(+), 12 deletions(-)

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 60aff60..a5a499f 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -41,12 +41,29 @@
 
 #include <net/tls.h>
 
+#if IS_ENABLED(CONFIG_IPV6)
+#include <net/transp_v6.h>
+#endif
+
 MODULE_AUTHOR("Mellanox Technologies");
 MODULE_DESCRIPTION("Transport Layer Security Support");
 MODULE_LICENSE("Dual BSD/GPL");
 
-static struct proto tls_base_prot;
-static struct proto tls_sw_prot;
+enum {
+	TLSV4,
+#if IS_ENABLED(CONFIG_IPV6)
+	TLSV6,
+#endif
+	TLS_NUM_PROTS,
+};
+
+enum {
+	TLS_BASE_TX,
+	TLS_SW_TX,
+	TLS_NUM_CONFIG,
+};
+
+static struct proto tls_prots[TLS_NUM_PROTS][TLS_NUM_CONFIG];
 
 int wait_on_pending_writer(struct sock *sk, long *timeo)
 {
@@ -342,6 +359,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
 	struct tls_context *ctx = tls_get_ctx(sk);
 	struct proto *prot = NULL;
 	int rc = 0;
+	int ip_ver = sk->sk_family == AF_INET6 ? TLSV6 : TLSV4;
 
 	if (!optval || (optlen < sizeof(*crypto_info))) {
 		rc = -EINVAL;
@@ -396,7 +414,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
 
 	/* currently SW is default, we will have ethtool in future */
 	rc = tls_set_sw_offload(sk, ctx);
-	prot = &tls_sw_prot;
+	prot = &tls_prots[ip_ver][TLS_SW_TX];
 	if (rc)
 		goto err_crypto_info;
 
@@ -443,6 +461,15 @@ static int tls_init(struct sock *sk)
 	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tls_context *ctx;
 	int rc = 0;
+	int ip_ver = TLSV4;
+
+#if IS_ENABLED(CONFIG_IPV6)
+	if (sk->sk_family == AF_INET6)
+		ip_ver = TLSV6;
+	else
+#endif
+	if (sk->sk_family != AF_INET)
+		return -EINVAL;
 
 	/* allocate tls context */
 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
@@ -453,7 +480,8 @@ static int tls_init(struct sock *sk)
 	icsk->icsk_ulp_data = ctx;
 	ctx->setsockopt = sk->sk_prot->setsockopt;
 	ctx->getsockopt = sk->sk_prot->getsockopt;
-	sk->sk_prot = &tls_base_prot;
+
+	sk->sk_prot = &tls_prots[ip_ver][TLS_BASE_TX];
 out:
 	return rc;
 }
@@ -464,16 +492,25 @@ static int tls_init(struct sock *sk)
 	.init			= tls_init,
 };
 
+static void build_protos(struct proto *prot, struct proto *base)
+{
+	prot[TLS_BASE_TX] = *base;
+	prot[TLS_BASE_TX].setsockopt = tls_setsockopt;
+	prot[TLS_BASE_TX].getsockopt = tls_getsockopt;
+
+	prot[TLS_SW_TX]		= prot[TLS_BASE_TX];
+	prot[TLS_SW_TX].close	= tls_sk_proto_close;
+	prot[TLS_SW_TX].sendmsg		= tls_sw_sendmsg;
+	prot[TLS_SW_TX].sendpage	= tls_sw_sendpage;
+}
+
 static int __init tls_register(void)
 {
-	tls_base_prot			= tcp_prot;
-	tls_base_prot.setsockopt	= tls_setsockopt;
-	tls_base_prot.getsockopt	= tls_getsockopt;
-
-	tls_sw_prot			= tls_base_prot;
-	tls_sw_prot.sendmsg		= tls_sw_sendmsg;
-	tls_sw_prot.sendpage            = tls_sw_sendpage;
-	tls_sw_prot.close               = tls_sk_proto_close;
+	build_protos(tls_prots[TLSV4], &tcp_prot);
+
+#if IS_ENABLED(CONFIG_IPV6)
+	build_protos(tls_prots[TLSV6], &tcpv6_prot);
+#endif
 
 	tcp_register_ulp(&tcp_tls_ulp_ops);
 
-- 
1.8.3.1

Re: [PATCH 3/3] tls: Use correct sk->sk_prot for IPV6

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 3248 bytes --]

Hi Ilya,

[auto build test ERROR on net/master]
[also build test ERROR on v4.13-rc4 next-20170811]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Ilya-Lesokhin/ipv6-Prevent-unexpected-sk-sk_prot-changes/20170811-223050
config: i386-randconfig-x018-201732 (attached as .config)
compiler: gcc-6 (Debian 6.2.0-3) 6.2.0 20160901
reproduce:
        # save the attached .config to linux build tree
        make ARCH=i386 

All errors (new ones prefixed by >>):

   net/tls/tls_main.c: In function 'do_tls_setsockopt_tx':
>> net/tls/tls_main.c:362:43: error: 'TLSV6' undeclared (first use in this function)
     int ip_ver = sk->sk_family == AF_INET6 ? TLSV6 : TLSV4;
                                              ^~~~~
   net/tls/tls_main.c:362:43: note: each undeclared identifier is reported only once for each function it appears in

vim +/TLSV6 +362 net/tls/tls_main.c

   354	
   355	static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
   356					unsigned int optlen)
   357	{
   358		struct tls_crypto_info *crypto_info, tmp_crypto_info;
   359		struct tls_context *ctx = tls_get_ctx(sk);
   360		struct proto *prot = NULL;
   361		int rc = 0;
 > 362		int ip_ver = sk->sk_family == AF_INET6 ? TLSV6 : TLSV4;
   363	
   364		if (!optval || (optlen < sizeof(*crypto_info))) {
   365			rc = -EINVAL;
   366			goto out;
   367		}
   368	
   369		rc = copy_from_user(&tmp_crypto_info, optval, sizeof(*crypto_info));
   370		if (rc) {
   371			rc = -EFAULT;
   372			goto out;
   373		}
   374	
   375		/* check version */
   376		if (tmp_crypto_info.version != TLS_1_2_VERSION) {
   377			rc = -ENOTSUPP;
   378			goto out;
   379		}
   380	
   381		/* get user crypto info */
   382		crypto_info = &ctx->crypto_send;
   383	
   384		/* Currently we don't support set crypto info more than one time */
   385		if (TLS_CRYPTO_INFO_READY(crypto_info))
   386			goto out;
   387	
   388		switch (tmp_crypto_info.cipher_type) {
   389		case TLS_CIPHER_AES_GCM_128: {
   390			if (optlen != sizeof(struct tls12_crypto_info_aes_gcm_128)) {
   391				rc = -EINVAL;
   392				goto out;
   393			}
   394			rc = copy_from_user(
   395			  crypto_info,
   396			  optval,
   397			  sizeof(struct tls12_crypto_info_aes_gcm_128));
   398	
   399			if (rc) {
   400				rc = -EFAULT;
   401				goto err_crypto_info;
   402			}
   403			break;
   404		}
   405		default:
   406			rc = -EINVAL;
   407			goto out;
   408		}
   409	
   410		ctx->sk_write_space = sk->sk_write_space;
   411		sk->sk_write_space = tls_write_space;
   412	
   413		ctx->sk_proto_close = sk->sk_prot->close;
   414	
   415		/* currently SW is default, we will have ethtool in future */
   416		rc = tls_set_sw_offload(sk, ctx);
   417		prot = &tls_prots[ip_ver][TLS_SW_TX];
   418		if (rc)
   419			goto err_crypto_info;
   420	
   421		sk->sk_prot = prot;
   422		goto out;
   423	
   424	err_crypto_info:
   425		memset(crypto_info, 0, sizeof(*crypto_info));
   426	out:
   427		return rc;
   428	}
   429	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 33510 bytes --]

Re: [PATCH 3/3] tls: Use correct sk->sk_prot for IPV6

[David Miller]

From: Ilya Lesokhin <ilyal@mellanox.com>
Date: Thu, 10 Aug 2017 13:33:16 +0300

> +#if IS_ENABLED(CONFIG_IPV6)
> +	build_protos(tls_prots[TLSV6], &tcpv6_prot);
> +#endif
>  

Have you tested this with CONFIG_TLS=m and CONFIG_IPV6=m?

I bet it doesn't link.

How about CONFIG_IPV6=m and CONFIG_TLS=y?  That won't
work either.

In fact TLS has no Kconfig dependency whatsoever on IPV6.