From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7212C282C4 for ; Sat, 9 Feb 2019 07:53:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 90D8920857 for ; Sat, 9 Feb 2019 07:53:35 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=nxp.com header.i=@nxp.com header.b="q8lvMceg" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726703AbfBIHxd (ORCPT ); Sat, 9 Feb 2019 02:53:33 -0500 Received: from mail-eopbgr70078.outbound.protection.outlook.com ([40.107.7.78]:12016 "EHLO EUR04-HE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725946AbfBIHxd (ORCPT ); Sat, 9 Feb 2019 02:53:33 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nxp.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zzGUtudyt+ge1lswRmlOpjYWLQjxjh5ARuxRW5I5UTE=; b=q8lvMcegbk54hBt/5+bsXYM9cb8Pe9EGpG/DUZMy6OXSq53yBHoruCBjTKO8lrmXznT0hVo50dexMF5yh3Sz/t32F5Fg8ginWFNVJMEBBapXVN14qC6G3MKAmu4fUD8EZMlNX98qsoUGO1+W70GhMOzhIpPgkEoRv+7Z88nxA4I= Received: from DB7PR04MB4252.eurprd04.prod.outlook.com (52.135.131.26) by DB7PR04MB5515.eurprd04.prod.outlook.com (20.178.106.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1601.21; Sat, 9 Feb 2019 07:53:28 +0000 Received: from DB7PR04MB4252.eurprd04.prod.outlook.com ([fe80::579:53a:ce74:16d7]) by DB7PR04MB4252.eurprd04.prod.outlook.com ([fe80::579:53a:ce74:16d7%3]) with mapi id 15.20.1601.016; Sat, 9 Feb 2019 07:53:28 +0000 From: Vakul Garg To: "netdev@vger.kernel.org" CC: "borisp@mellanox.com" , "aviadye@mellanox.com" , "davejwatson@fb.com" , "davem@davemloft.net" , "doronrk@fb.com" , Vakul Garg Subject: [PATCH net-next] net/tls: Disable async decrytion for tls1.3 Thread-Topic: [PATCH net-next] net/tls: Disable async decrytion for tls1.3 Thread-Index: AQHUwEyLKzBObPqrhEW3vl3d5z0HgA== Date: Sat, 9 Feb 2019 07:53:28 +0000 Message-ID: <20190209075110.19881-1-vakul.garg@nxp.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: PN1PR01CA0106.INDPRD01.PROD.OUTLOOK.COM (2603:1096:c00::22) To DB7PR04MB4252.eurprd04.prod.outlook.com (2603:10a6:5:27::26) authentication-results: spf=none (sender IP is ) smtp.mailfrom=vakul.garg@nxp.com; x-ms-exchange-messagesentrepresentingtype: 1 x-mailer: git-send-email 2.13.6 x-originating-ip: [92.120.1.70] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;DB7PR04MB5515;6:iRqmgBCV9WemVp8fwWDhSI7iXS1YGpJCBxD3Q1Pq9+mAmU9OnJbwLoq0b6T9NYN3Kt/F8+XOP8PZfOkHXrc9r6m0QE3QgprAw6LkMlyabpd/7VMh5TQUrS6NXOzDQ2BxZ+0fat1x2lIba7WixduZKTZO+d5jQVYu4RR6JsGjNeeOxm5d8UFPt2vPLw7HGrWHANf3grAQHEOzKnJ9PN70FP0K+QJkvQNdU9BKRJs8EnWhSVOd21D212l/ftmoEHOzui1z5xxHB+7HClowWjmhRwVL6M2XxH92lYG1jAvOWrdDyg0H+i/wwK/SGx0br/sSVIpEqKgtWazVnkjoQSOgo3noBk9DdwVvln/tf4b1pKFh6WkzzMEYUsf6mQGo9iN6QfvasC3QDWbf8Y9GKqFcKl6SGMt6S6mX+YTh2F79wWfGxuqMZGxK5v4Or2q2WaBpmU+AcyJ38mFFpFPk7PknPw==;5:OljROtX1Bs+Cyb9WTJr8mEMS5wSSwNttfEHgYdpmJEZw/YUWsSlBTS/qsUUq2qS3tqWlrwmMIwPbdpxjaL0LC3vU5Dpy5VSHwYVS2Bo9DHnpFJJ2a7C1LvN8DJxAUuJv6mSh1I1EwjCuUZNDw0SN73Y7jAp65y9vUNlibJMYoib7YIyidCewQDJpJFELGF8Z6au2GP7ig2+v0WYFKs3K3Q==;7:u48Y0iNSP+V4MfwGi7nApyebYPwmgMWjn8ciaYPqQf8k3c/zGdOH7dOMj4QrlzTCgfeK4O86LmyLwFFqrAa+aUxqK/6X3oWjdpe4VtCKL9wAzhjWV7lxC4p4UeqNg5xufML/NeopJYh+up3X6iwy9Q== x-ms-office365-filtering-correlation-id: fa2d5d19-3e2b-4bb5-bfa4-08d68e63ad90 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(4618075)(2017052603328)(7153060)(7193020);SRVR:DB7PR04MB5515; x-ms-traffictypediagnostic: DB7PR04MB5515: x-microsoft-antispam-prvs: x-forefront-prvs: 09435FCA72 x-forefront-antispam-report: SFV:NSPM;SFS:(10009020)(136003)(39860400002)(346002)(366004)(376002)(396003)(189003)(199004)(6506007)(386003)(26005)(6486002)(99286004)(186003)(2906002)(66066001)(53936002)(102836004)(68736007)(14444005)(6436002)(1076003)(5640700003)(2501003)(256004)(52116002)(71200400001)(71190400001)(36756003)(316002)(54906003)(6916009)(8676002)(6116002)(44832011)(25786009)(476003)(305945005)(8936002)(3846002)(86362001)(106356001)(4326008)(486006)(81156014)(105586002)(2351001)(1730700003)(14454004)(50226002)(81166006)(478600001)(97736004)(7736002)(6512007)(2616005);DIR:OUT;SFP:1101;SCL:1;SRVR:DB7PR04MB5515;H:DB7PR04MB4252.eurprd04.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1; received-spf: None (protection.outlook.com: nxp.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: yMxwHbLV4ZzPDx+CRCRZtXpfJ7o8l/U4hhCtRwbX03ejM00rVYYE+Uh2LZKgUqtN2Gge3IqeYOTJibq6KrwKZvoWbtlOyDW4umfn8poT/LyweXpFqDOLAA7+oPBH9j9mWnDjYGRU3FWoNZpQkcSqRahZqsjYjAm7in/gvkqADmJR4zSqB/UtcN/XVszGqoClifjs1k0xaztnNFdQSDCT61HDMJ2m+e1b0Sr7Lukb5eYhpnbBGmK2GLtpsCqjtZqK0g6HGhr2Q/SyXVK6/sAgrNRPKQ/i0uN3Zw+lv7mheFjoR+df6ZoQBfLFGqvuWesOF3MJIS4mYWg2PKHWHDSGLal+sWmeCXrDTFonq6F82Llx0zKxmUqCmAmvHVU3UZ7BBEO3Qu2IZrYneHEO8S9yfKyuBMpMGV1+WT2BOrrzgQo= Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nxp.com X-MS-Exchange-CrossTenant-Network-Message-Id: fa2d5d19-3e2b-4bb5-bfa4-08d68e63ad90 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Feb 2019 07:53:27.0195 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR04MB5515 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Function tls_sw_recvmsg() dequeues multiple records from stream parser and decrypts them. In case the decryption is done by async accelerator, the records may get submitted for decryption while the previous ones may not have been decryted yet. For tls1.3, the record type is known only after decryption. Therefore, for tls1.3, tls_sw_recvmsg() may submit records for decryption even if it gets 'handshake' records after 'data' records. These intermediate 'handshake' records may do a key updation. By the time new keys are given to ktls by userspace, it is possible that ktls has already submitted some records i(which are encrypted with new keys) for decryption using old keys. This would lead to decrypt failure. Therefore, async decryption of records should be disabled for tls1.3. Fixes: 130b392c6cd6b ("net: tls: Add tls 1.3 support") Signed-off-by: Vakul Garg --- net/tls/tls_sw.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 8051a9164139..fe8c287cbaa1 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -2215,8 +2215,12 @@ int tls_set_sw_offload(struct sock *sk, struct tls_c= ontext *ctx, int tx) =20 if (sw_ctx_rx) { tfm =3D crypto_aead_tfm(sw_ctx_rx->aead_recv); - sw_ctx_rx->async_capable =3D - tfm->__crt_alg->cra_flags & CRYPTO_ALG_ASYNC; + + if (crypto_info->version =3D=3D TLS_1_3_VERSION) + sw_ctx_rx->async_capable =3D false; + else + sw_ctx_rx->async_capable =3D + tfm->__crt_alg->cra_flags & CRYPTO_ALG_ASYNC; =20 /* Set up strparser */ memset(&cb, 0, sizeof(cb)); --=20 2.13.6