netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Boris Pismenny <borisp@mellanox.com>
To: netdev@vger.kernel.org, davem@davemloft.net
Cc: ilyal@mellanox.com, borisp@mellanox.com, tracywwnj@gmail.com,
	xiyou.wangcong@gmail.com, weiwan@google.com, linux@roeck-us.net,
	davejwatson@fb.com
Subject: [PATCH v4 net] Use correct sk->sk_prot for IPv6 in TLS
Date: Tue, 27 Feb 2018 14:18:38 +0200	[thread overview]
Message-ID: <1519733919-16909-1-git-send-email-borisp@mellanox.com> (raw)

The tls ulp overrides sk->prot with a new tls specific proto structs.            
The tls specific structs were previously based on the ipv4 specific              
tcp_prot sturct.                                                                 
As a result, attaching the tls ulp to an ipv6 tcp socket replaced                
some ipv6 callback with the ipv4 equivalents.                                    
                                                                                 
This patch adds ipv6 tls proto structs and uses them when                        
attached to ipv6 sockets. 

Changed since v3:
- Removed the use of tcpv6_prot and the dependency on the IPv6 module.
- Should fix the issue triggered by CVE-2018-5703

Changed since v2: 
- Dropped patch to fix IPv6_ADDRFORM setsockopt
There was some disagreement about the correct way of fixinig it,
and this series does not depend on it.

Changes since v1:                                                                
- TLS now dependes on IPv6                                                       
This fixes complication issues when TLS is built-in and IPv6 is a module.        
The downside should be small as it is unlikely that there are kernel TLS         
users who can't afford to include IPv6 in thier kernel.                          
- tls_init now checks sk->sk_prot directly                                       
This is somewhat safer then checking indirectly through sk->sk_family       

Boris Pismenny (1):
  tls: Use correct sk->sk_prot for IPv6

 net/tls/tls_main.c | 52 +++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 37 insertions(+), 15 deletions(-)

-- 
1.8.3.1

             reply	other threads:[~2018-02-27 12:18 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-02-27 12:18 Boris Pismenny [this message]
2018-02-27 12:18 ` [PATCH v4 net] tls: Use correct sk->sk_prot for IPV6 Boris Pismenny
2018-02-27 19:44   ` David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1519733919-16909-1-git-send-email-borisp@mellanox.com \
    --to=borisp@mellanox.com \
    --cc=davejwatson@fb.com \
    --cc=davem@davemloft.net \
    --cc=ilyal@mellanox.com \
    --cc=linux@roeck-us.net \
    --cc=netdev@vger.kernel.org \
    --cc=tracywwnj@gmail.com \
    --cc=weiwan@google.com \
    --cc=xiyou.wangcong@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).