[PATCH net] net: tls: fix marking packets as decrypted

[PATCH net] net: tls: fix marking packets as decrypted

[Jakub Kicinski]

For TLS offload we mark packets with skb->decrypted to make sure
they don't escape the host without getting encrypted first.
The crypto state lives in the socket, so it may get detached
by a call to skb_orphan(). As a safety check - the egress path
drops all packets with skb->decrypted and no "crypto-safe" socket.

The skb marking was added to sendpage only (and not sendmsg),
because tls_device injected data into the TCP stack using sendpage.
This special case was missed when sendpage got folded into sendmsg.

Fixes: c5c37af6ecad ("tcp: Convert do_tcp_sendpages() to use MSG_SPLICE_PAGES")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: dhowells@redhat.com
CC: borisp@nvidia.com
CC: john.fastabend@gmail.com
---
 net/ipv4/tcp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 681b54e1f3a6..4d8cc2ebb64c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1165,6 +1165,9 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
 
 			process_backlog++;
 
+#ifdef CONFIG_SKB_DECRYPTED
+			skb->decrypted = !!(flags & MSG_SENDPAGE_DECRYPTED);
+#endif
 			tcp_skb_entail(sk, skb);
 			copy = size_goal;
 
-- 
2.45.1

Re: [PATCH net] net: tls: fix marking packets as decrypted

[Jakub Kicinski]

On Thu, 30 May 2024 16:26:07 -0700 Jakub Kicinski wrote:
> For TLS offload we mark packets with skb->decrypted to make sure
> they don't escape the host without getting encrypted first.
> The crypto state lives in the socket, so it may get detached
> by a call to skb_orphan(). As a safety check - the egress path
> drops all packets with skb->decrypted and no "crypto-safe" socket.
> 
> The skb marking was added to sendpage only (and not sendmsg),
> because tls_device injected data into the TCP stack using sendpage.
> This special case was missed when sendpage got folded into sendmsg.
> 
> Fixes: c5c37af6ecad ("tcp: Convert do_tcp_sendpages() to use MSG_SPLICE_PAGES")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Forgot to mention - compile tested only, ENODEV :(

Re: [PATCH net] net: tls: fix marking packets as decrypted

[Eric Dumazet]

On Fri, May 31, 2024 at 1:29 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Thu, 30 May 2024 16:26:07 -0700 Jakub Kicinski wrote:
> > For TLS offload we mark packets with skb->decrypted to make sure
> > they don't escape the host without getting encrypted first.
> > The crypto state lives in the socket, so it may get detached
> > by a call to skb_orphan(). As a safety check - the egress path
> > drops all packets with skb->decrypted and no "crypto-safe" socket.
> >
> > The skb marking was added to sendpage only (and not sendmsg),
> > because tls_device injected data into the TCP stack using sendpage.
> > This special case was missed when sendpage got folded into sendmsg.
> >
> > Fixes: c5c37af6ecad ("tcp: Convert do_tcp_sendpages() to use MSG_SPLICE_PAGES")
> > Signed-off-by: Jakub Kicinski <kuba@kernel.org>
>
> Forgot to mention - compile tested only, ENODEV :(

Reviewed-by: Eric Dumazet <edumazet@google.com>

In net-next, we could probably move skb_cmp_decrypted(), skb_is_decrypted(),
skb_copy_decrypted() to a new include file, and define
skb_set_decrypted() helper there.

Re: [PATCH net] net: tls: fix marking packets as decrypted

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Thu, 30 May 2024 16:26:07 -0700 you wrote:
> For TLS offload we mark packets with skb->decrypted to make sure
> they don't escape the host without getting encrypted first.
> The crypto state lives in the socket, so it may get detached
> by a call to skb_orphan(). As a safety check - the egress path
> drops all packets with skb->decrypted and no "crypto-safe" socket.
> 
> The skb marking was added to sendpage only (and not sendmsg),
> because tls_device injected data into the TCP stack using sendpage.
> This special case was missed when sendpage got folded into sendmsg.
> 
> [...]

Here is the summary with links:
  - [net] net: tls: fix marking packets as decrypted
    https://git.kernel.org/netdev/net/c/a535d5943237

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html