* [PATCH RFC net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX
@ 2020-08-18 14:12 Yutaro Hayakawa
2020-08-28 11:14 ` Yutaro Hayakawa
2020-08-28 16:52 ` Jakub Kicinski
0 siblings, 2 replies; 9+ messages in thread
From: Yutaro Hayakawa @ 2020-08-18 14:12 UTC (permalink / raw)
To: netdev; +Cc: michio.honda, Yutaro Hayakawa
Implement the getsockopt SOL_TLS TLS_RX which is currently missing. The
primary usecase is to use it in conjunction with TCP_REPAIR to
checkpoint/restore the TLS record layer state.
TLS connection state usually exists on the user space library. So
basically we can easily extract it from there, but when the TLS
connections are delegated to the kTLS, it is not the case. We need to
have a way to extract the TLS state from the kernel for both of TX and
RX side.
The new TLS_RX getsockopt copies the crypto_info to user in the same
way as TLS_TX does.
We have described use cases in our research work in Netdev 0x14
Transport Workshop [1].
Also, there is an TLS implementation called tlse [2] which supports
TLS connection migration. They have support of kTLS and their code
shows that they are expecting the future support of this option.
[1] https://speakerdeck.com/yutarohayakawa/prism-proxies-without-the-pain
[2] https://github.com/eduardsui/tlse
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
---
net/tls/tls_main.c | 50 +++++++++++++++++++++++++++++++++-------------
1 file changed, 36 insertions(+), 14 deletions(-)
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index bbc52b088d29..ea66cac2cd84 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -330,8 +330,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
tls_ctx_free(sk, ctx);
}
-static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
- int __user *optlen)
+static int do_tls_getsockopt_conf(struct sock *sk, char __user *optval,
+ int __user *optlen, int tx)
{
int rc = 0;
struct tls_context *ctx = tls_get_ctx(sk);
@@ -352,7 +352,11 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
}
/* get user crypto info */
- crypto_info = &ctx->crypto_send.info;
+ if (tx) {
+ crypto_info = &ctx->crypto_send.info;
+ } else {
+ crypto_info = &ctx->crypto_recv.info;
+ }
if (!TLS_CRYPTO_INFO_READY(crypto_info)) {
rc = -EBUSY;
@@ -378,11 +382,19 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
goto out;
}
lock_sock(sk);
- memcpy(crypto_info_aes_gcm_128->iv,
- ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
- TLS_CIPHER_AES_GCM_128_IV_SIZE);
- memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
- TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
+ if (tx) {
+ memcpy(crypto_info_aes_gcm_128->iv,
+ ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
+ TLS_CIPHER_AES_GCM_128_IV_SIZE);
+ memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
+ TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
+ } else {
+ memcpy(crypto_info_aes_gcm_128->iv,
+ ctx->rx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
+ TLS_CIPHER_AES_GCM_128_IV_SIZE);
+ memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->rx.rec_seq,
+ TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
+ }
release_sock(sk);
if (copy_to_user(optval,
crypto_info_aes_gcm_128,
@@ -402,11 +414,19 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
goto out;
}
lock_sock(sk);
- memcpy(crypto_info_aes_gcm_256->iv,
- ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
- TLS_CIPHER_AES_GCM_256_IV_SIZE);
- memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
- TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
+ if (tx) {
+ memcpy(crypto_info_aes_gcm_256->iv,
+ ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
+ TLS_CIPHER_AES_GCM_256_IV_SIZE);
+ memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
+ TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
+ } else {
+ memcpy(crypto_info_aes_gcm_256->iv,
+ ctx->rx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
+ TLS_CIPHER_AES_GCM_256_IV_SIZE);
+ memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->rx.rec_seq,
+ TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
+ }
release_sock(sk);
if (copy_to_user(optval,
crypto_info_aes_gcm_256,
@@ -429,7 +449,9 @@ static int do_tls_getsockopt(struct sock *sk, int optname,
switch (optname) {
case TLS_TX:
- rc = do_tls_getsockopt_tx(sk, optval, optlen);
+ case TLS_RX:
+ rc = do_tls_getsockopt_conf(sk, optval, optlen,
+ optname == TLS_TX);
break;
default:
rc = -ENOPROTOOPT;
--
2.26.2
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH RFC net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX
2020-08-18 14:12 [PATCH RFC net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX Yutaro Hayakawa
@ 2020-08-28 11:14 ` Yutaro Hayakawa
2020-08-28 16:52 ` Jakub Kicinski
1 sibling, 0 replies; 9+ messages in thread
From: Yutaro Hayakawa @ 2020-08-28 11:14 UTC (permalink / raw)
To: netdev; +Cc: Michio Honda
Hello, is there any chance that this patch gets reviewed?
Thanks,
Yutaro
2020年8月18日(火) 23:12 Yutaro Hayakawa <yhayakawa3720@gmail.com>:
>
> Implement the getsockopt SOL_TLS TLS_RX which is currently missing. The
> primary usecase is to use it in conjunction with TCP_REPAIR to
> checkpoint/restore the TLS record layer state.
>
> TLS connection state usually exists on the user space library. So
> basically we can easily extract it from there, but when the TLS
> connections are delegated to the kTLS, it is not the case. We need to
> have a way to extract the TLS state from the kernel for both of TX and
> RX side.
>
> The new TLS_RX getsockopt copies the crypto_info to user in the same
> way as TLS_TX does.
>
> We have described use cases in our research work in Netdev 0x14
> Transport Workshop [1].
>
> Also, there is an TLS implementation called tlse [2] which supports
> TLS connection migration. They have support of kTLS and their code
> shows that they are expecting the future support of this option.
>
> [1] https://speakerdeck.com/yutarohayakawa/prism-proxies-without-the-pain
> [2] https://github.com/eduardsui/tlse
>
> Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
> ---
> net/tls/tls_main.c | 50 +++++++++++++++++++++++++++++++++-------------
> 1 file changed, 36 insertions(+), 14 deletions(-)
>
> diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
> index bbc52b088d29..ea66cac2cd84 100644
> --- a/net/tls/tls_main.c
> +++ b/net/tls/tls_main.c
> @@ -330,8 +330,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
> tls_ctx_free(sk, ctx);
> }
>
> -static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
> - int __user *optlen)
> +static int do_tls_getsockopt_conf(struct sock *sk, char __user *optval,
> + int __user *optlen, int tx)
> {
> int rc = 0;
> struct tls_context *ctx = tls_get_ctx(sk);
> @@ -352,7 +352,11 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
> }
>
> /* get user crypto info */
> - crypto_info = &ctx->crypto_send.info;
> + if (tx) {
> + crypto_info = &ctx->crypto_send.info;
> + } else {
> + crypto_info = &ctx->crypto_recv.info;
> + }
>
> if (!TLS_CRYPTO_INFO_READY(crypto_info)) {
> rc = -EBUSY;
> @@ -378,11 +382,19 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
> goto out;
> }
> lock_sock(sk);
> - memcpy(crypto_info_aes_gcm_128->iv,
> - ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
> - TLS_CIPHER_AES_GCM_128_IV_SIZE);
> - memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
> - TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
> + if (tx) {
> + memcpy(crypto_info_aes_gcm_128->iv,
> + ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
> + TLS_CIPHER_AES_GCM_128_IV_SIZE);
> + memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
> + TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
> + } else {
> + memcpy(crypto_info_aes_gcm_128->iv,
> + ctx->rx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
> + TLS_CIPHER_AES_GCM_128_IV_SIZE);
> + memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->rx.rec_seq,
> + TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
> + }
> release_sock(sk);
> if (copy_to_user(optval,
> crypto_info_aes_gcm_128,
> @@ -402,11 +414,19 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
> goto out;
> }
> lock_sock(sk);
> - memcpy(crypto_info_aes_gcm_256->iv,
> - ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
> - TLS_CIPHER_AES_GCM_256_IV_SIZE);
> - memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
> - TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
> + if (tx) {
> + memcpy(crypto_info_aes_gcm_256->iv,
> + ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
> + TLS_CIPHER_AES_GCM_256_IV_SIZE);
> + memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
> + TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
> + } else {
> + memcpy(crypto_info_aes_gcm_256->iv,
> + ctx->rx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
> + TLS_CIPHER_AES_GCM_256_IV_SIZE);
> + memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->rx.rec_seq,
> + TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
> + }
> release_sock(sk);
> if (copy_to_user(optval,
> crypto_info_aes_gcm_256,
> @@ -429,7 +449,9 @@ static int do_tls_getsockopt(struct sock *sk, int optname,
>
> switch (optname) {
> case TLS_TX:
> - rc = do_tls_getsockopt_tx(sk, optval, optlen);
> + case TLS_RX:
> + rc = do_tls_getsockopt_conf(sk, optval, optlen,
> + optname == TLS_TX);
> break;
> default:
> rc = -ENOPROTOOPT;
> --
> 2.26.2
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH RFC net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX
2020-08-18 14:12 [PATCH RFC net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX Yutaro Hayakawa
2020-08-28 11:14 ` Yutaro Hayakawa
@ 2020-08-28 16:52 ` Jakub Kicinski
2020-08-30 14:01 ` [PATCH RFC v2 " Yutaro Hayakawa
1 sibling, 1 reply; 9+ messages in thread
From: Jakub Kicinski @ 2020-08-28 16:52 UTC (permalink / raw)
To: Yutaro Hayakawa; +Cc: netdev, michio.honda
On Tue, 18 Aug 2020 14:12:24 +0000 Yutaro Hayakawa wrote:
> @@ -352,7 +352,11 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
> }
>
> /* get user crypto info */
> - crypto_info = &ctx->crypto_send.info;
> + if (tx) {
> + crypto_info = &ctx->crypto_send.info;
> + } else {
> + crypto_info = &ctx->crypto_recv.info;
> + }
No need for parenthesis, if both branches have one line.
>
> if (!TLS_CRYPTO_INFO_READY(crypto_info)) {
> rc = -EBUSY;
> @@ -378,11 +382,19 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
> goto out;
> }
> lock_sock(sk);
> - memcpy(crypto_info_aes_gcm_128->iv,
> - ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
> - TLS_CIPHER_AES_GCM_128_IV_SIZE);
> - memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
> - TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
> + if (tx) {
> + memcpy(crypto_info_aes_gcm_128->iv,
> + ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
> + TLS_CIPHER_AES_GCM_128_IV_SIZE);
> + memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
> + TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
> + } else {
> + memcpy(crypto_info_aes_gcm_128->iv,
> + ctx->rx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
> + TLS_CIPHER_AES_GCM_128_IV_SIZE);
> + memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->rx.rec_seq,
> + TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
> + }
Instead of all the duplication choose the right struct cipher_context
above, like we do for crypto_info.
> release_sock(sk);
> if (copy_to_user(optval,
> crypto_info_aes_gcm_128,
> @@ -402,11 +414,19 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
> goto out;
> }
> lock_sock(sk);
> - memcpy(crypto_info_aes_gcm_256->iv,
> - ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
> - TLS_CIPHER_AES_GCM_256_IV_SIZE);
> - memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
> - TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
> + if (tx) {
> + memcpy(crypto_info_aes_gcm_256->iv,
> + ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
> + TLS_CIPHER_AES_GCM_256_IV_SIZE);
> + memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
> + TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
> + } else {
> + memcpy(crypto_info_aes_gcm_256->iv,
> + ctx->rx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
> + TLS_CIPHER_AES_GCM_256_IV_SIZE);
> + memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->rx.rec_seq,
> + TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
> + }
ditto.
> release_sock(sk);
> if (copy_to_user(optval,
> crypto_info_aes_gcm_256,
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH RFC v2 net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX
2020-08-28 16:52 ` Jakub Kicinski
@ 2020-08-30 14:01 ` Yutaro Hayakawa
2020-08-30 17:48 ` Yutaro Hayakawa
0 siblings, 1 reply; 9+ messages in thread
From: Yutaro Hayakawa @ 2020-08-30 14:01 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: netdev, michio.honda, Yutaro Hayakawa
From: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Implement the getsockopt SOL_TLS TLS_RX which is currently missing. The
primary usecase is to use it in conjunction with TCP_REPAIR to
checkpoint/restore the TLS record layer state.
TLS connection state usually exists on the user space library. So
basically we can easily extract it from there, but when the TLS
connections are delegated to the kTLS, it is not the case. We need to
have a way to extract the TLS state from the kernel for both of TX and
RX side.
The new TLS_RX getsockopt copies the crypto_info to user in the same
way as TLS_TX does.
We have described use cases in our research work in Netdev 0x14
Transport Workshop [1].
Also, there is an TLS implementation called tlse [2] which supports
TLS connection migration. They have support of kTLS and their code
shows that they are expecting the future support of this option.
[1] https://speakerdeck.com/yutarohayakawa/prism-proxies-without-the-pain
[2] https://github.com/eduardsui/tlse
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
---
Changes in v2:
- Remove duplicated memcpy for each cipher suites
Thanks for your reply. Reflected the comments.
net/tls/tls_main.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index bbc52b0..0271441 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -330,12 +330,13 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
tls_ctx_free(sk, ctx);
}
-static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
- int __user *optlen)
+static int do_tls_getsockopt_conf(struct sock *sk, char __user *optval,
+ int __user *optlen, int tx)
{
int rc = 0;
struct tls_context *ctx = tls_get_ctx(sk);
struct tls_crypto_info *crypto_info;
+ struct tls_cipher_context *cctx;
int len;
if (get_user(len, optlen))
@@ -352,7 +353,13 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
}
/* get user crypto info */
- crypto_info = &ctx->crypto_send.info;
+ if (tx) {
+ crypto_info = &ctx->crypto_send.info;
+ cctx = &ctx->tx;
+ } else {
+ crypto_info = &ctx->crypto_recv.info;
+ cctx = &ctx->rx;
+ }
if (!TLS_CRYPTO_INFO_READY(crypto_info)) {
rc = -EBUSY;
@@ -379,9 +386,9 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
}
lock_sock(sk);
memcpy(crypto_info_aes_gcm_128->iv,
- ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
+ cctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
TLS_CIPHER_AES_GCM_128_IV_SIZE);
- memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
+ memcpy(crypto_info_aes_gcm_128->rec_seq, cctx->rec_seq,
TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
release_sock(sk);
if (copy_to_user(optval,
@@ -403,9 +410,9 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
}
lock_sock(sk);
memcpy(crypto_info_aes_gcm_256->iv,
- ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
+ cctx->iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
TLS_CIPHER_AES_GCM_256_IV_SIZE);
- memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
+ memcpy(crypto_info_aes_gcm_256->rec_seq, cctx->rec_seq,
TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
release_sock(sk);
if (copy_to_user(optval,
@@ -429,7 +436,9 @@ static int do_tls_getsockopt(struct sock *sk, int optname,
switch (optname) {
case TLS_TX:
- rc = do_tls_getsockopt_tx(sk, optval, optlen);
+ case TLS_RX:
+ rc = do_tls_getsockopt_conf(sk, optval, optlen,
+ optname == TLS_TX);
break;
default:
rc = -ENOPROTOOPT;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH RFC v2 net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX
2020-08-30 14:01 ` [PATCH RFC v2 " Yutaro Hayakawa
@ 2020-08-30 17:48 ` Yutaro Hayakawa
2020-08-30 19:07 ` [PATCH RFC v3 " Yutaro Hayakawa
0 siblings, 1 reply; 9+ messages in thread
From: Yutaro Hayakawa @ 2020-08-30 17:48 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: netdev, Michio Honda
Apology. Kernel Test Robot just pointed out that the v2 patch has a
compilation error. My local compilation tests have passed because I
didn't enable the kTLS kernel option. Let me resubmit the fixed
version soon.
Yutaro
2020年8月30日(日) 23:02 Yutaro Hayakawa <yhayakawa3720@gmail.com>:
>
> From: Yutaro Hayakawa <yhayakawa3720@gmail.com>
>
> Implement the getsockopt SOL_TLS TLS_RX which is currently missing. The
> primary usecase is to use it in conjunction with TCP_REPAIR to
> checkpoint/restore the TLS record layer state.
>
> TLS connection state usually exists on the user space library. So
> basically we can easily extract it from there, but when the TLS
> connections are delegated to the kTLS, it is not the case. We need to
> have a way to extract the TLS state from the kernel for both of TX and
> RX side.
>
> The new TLS_RX getsockopt copies the crypto_info to user in the same
> way as TLS_TX does.
>
> We have described use cases in our research work in Netdev 0x14
> Transport Workshop [1].
>
> Also, there is an TLS implementation called tlse [2] which supports
> TLS connection migration. They have support of kTLS and their code
> shows that they are expecting the future support of this option.
>
> [1] https://speakerdeck.com/yutarohayakawa/prism-proxies-without-the-pain
> [2] https://github.com/eduardsui/tlse
>
> Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
> ---
> Changes in v2:
> - Remove duplicated memcpy for each cipher suites
>
> Thanks for your reply. Reflected the comments.
>
> net/tls/tls_main.c | 25 +++++++++++++++++--------
> 1 file changed, 17 insertions(+), 8 deletions(-)
>
> diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
> index bbc52b0..0271441 100644
> --- a/net/tls/tls_main.c
> +++ b/net/tls/tls_main.c
> @@ -330,12 +330,13 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
> tls_ctx_free(sk, ctx);
> }
>
> -static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
> - int __user *optlen)
> +static int do_tls_getsockopt_conf(struct sock *sk, char __user *optval,
> + int __user *optlen, int tx)
> {
> int rc = 0;
> struct tls_context *ctx = tls_get_ctx(sk);
> struct tls_crypto_info *crypto_info;
> + struct tls_cipher_context *cctx;
> int len;
>
> if (get_user(len, optlen))
> @@ -352,7 +353,13 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
> }
>
> /* get user crypto info */
> - crypto_info = &ctx->crypto_send.info;
> + if (tx) {
> + crypto_info = &ctx->crypto_send.info;
> + cctx = &ctx->tx;
> + } else {
> + crypto_info = &ctx->crypto_recv.info;
> + cctx = &ctx->rx;
> + }
>
> if (!TLS_CRYPTO_INFO_READY(crypto_info)) {
> rc = -EBUSY;
> @@ -379,9 +386,9 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
> }
> lock_sock(sk);
> memcpy(crypto_info_aes_gcm_128->iv,
> - ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
> + cctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
> TLS_CIPHER_AES_GCM_128_IV_SIZE);
> - memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
> + memcpy(crypto_info_aes_gcm_128->rec_seq, cctx->rec_seq,
> TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
> release_sock(sk);
> if (copy_to_user(optval,
> @@ -403,9 +410,9 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
> }
> lock_sock(sk);
> memcpy(crypto_info_aes_gcm_256->iv,
> - ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
> + cctx->iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
> TLS_CIPHER_AES_GCM_256_IV_SIZE);
> - memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
> + memcpy(crypto_info_aes_gcm_256->rec_seq, cctx->rec_seq,
> TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
> release_sock(sk);
> if (copy_to_user(optval,
> @@ -429,7 +436,9 @@ static int do_tls_getsockopt(struct sock *sk, int optname,
>
> switch (optname) {
> case TLS_TX:
> - rc = do_tls_getsockopt_tx(sk, optval, optlen);
> + case TLS_RX:
> + rc = do_tls_getsockopt_conf(sk, optval, optlen,
> + optname == TLS_TX);
> break;
> default:
> rc = -ENOPROTOOPT;
> --
> 1.8.3.1
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH RFC v3 net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX
2020-08-30 17:48 ` Yutaro Hayakawa
@ 2020-08-30 19:07 ` Yutaro Hayakawa
2020-08-31 18:30 ` Jakub Kicinski
0 siblings, 1 reply; 9+ messages in thread
From: Yutaro Hayakawa @ 2020-08-30 19:07 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: netdev, michio.honda, Yutaro Hayakawa
From: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Implement the getsockopt SOL_TLS TLS_RX which is currently missing. The
primary usecase is to use it in conjunction with TCP_REPAIR to
checkpoint/restore the TLS record layer state.
TLS connection state usually exists on the user space library. So
basically we can easily extract it from there, but when the TLS
connections are delegated to the kTLS, it is not the case. We need to
have a way to extract the TLS state from the kernel for both of TX and
RX side.
The new TLS_RX getsockopt copies the crypto_info to user in the same
way as TLS_TX does.
We have described use cases in our research work in Netdev 0x14
Transport Workshop [1].
Also, there is an TLS implementation called tlse [2] which supports
TLS connection migration. They have support of kTLS and their code
shows that they are expecting the future support of this option.
[1] https://speakerdeck.com/yutarohayakawa/prism-proxies-without-the-pain
[2] https://github.com/eduardsui/tlse
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
---
Changes in v3:
- Fix compilation error
net/tls/tls_main.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index bbc52b0..002b085 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -330,12 +330,13 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
tls_ctx_free(sk, ctx);
}
-static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
- int __user *optlen)
+static int do_tls_getsockopt_conf(struct sock *sk, char __user *optval,
+ int __user *optlen, int tx)
{
int rc = 0;
struct tls_context *ctx = tls_get_ctx(sk);
struct tls_crypto_info *crypto_info;
+ struct cipher_context *cctx;
int len;
if (get_user(len, optlen))
@@ -352,7 +353,13 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
}
/* get user crypto info */
- crypto_info = &ctx->crypto_send.info;
+ if (tx) {
+ crypto_info = &ctx->crypto_send.info;
+ cctx = &ctx->tx;
+ } else {
+ crypto_info = &ctx->crypto_recv.info;
+ cctx = &ctx->rx;
+ }
if (!TLS_CRYPTO_INFO_READY(crypto_info)) {
rc = -EBUSY;
@@ -379,9 +386,9 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
}
lock_sock(sk);
memcpy(crypto_info_aes_gcm_128->iv,
- ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
+ cctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
TLS_CIPHER_AES_GCM_128_IV_SIZE);
- memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
+ memcpy(crypto_info_aes_gcm_128->rec_seq, cctx->rec_seq,
TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
release_sock(sk);
if (copy_to_user(optval,
@@ -403,9 +410,9 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
}
lock_sock(sk);
memcpy(crypto_info_aes_gcm_256->iv,
- ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
+ cctx->iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
TLS_CIPHER_AES_GCM_256_IV_SIZE);
- memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
+ memcpy(crypto_info_aes_gcm_256->rec_seq, cctx->rec_seq,
TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
release_sock(sk);
if (copy_to_user(optval,
@@ -429,7 +436,9 @@ static int do_tls_getsockopt(struct sock *sk, int optname,
switch (optname) {
case TLS_TX:
- rc = do_tls_getsockopt_tx(sk, optval, optlen);
+ case TLS_RX:
+ rc = do_tls_getsockopt_conf(sk, optval, optlen,
+ optname == TLS_TX);
break;
default:
rc = -ENOPROTOOPT;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH RFC v3 net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX
2020-08-30 19:07 ` [PATCH RFC v3 " Yutaro Hayakawa
@ 2020-08-31 18:30 ` Jakub Kicinski
2020-09-01 13:59 ` [PATCH " Yutaro Hayakawa
0 siblings, 1 reply; 9+ messages in thread
From: Jakub Kicinski @ 2020-08-31 18:30 UTC (permalink / raw)
To: Yutaro Hayakawa; +Cc: netdev, michio.honda
On Mon, 31 Aug 2020 04:07:13 +0900 Yutaro Hayakawa wrote:
> From: Yutaro Hayakawa <yhayakawa3720@gmail.com>
>
> Implement the getsockopt SOL_TLS TLS_RX which is currently missing. The
> primary usecase is to use it in conjunction with TCP_REPAIR to
> checkpoint/restore the TLS record layer state.
>
> TLS connection state usually exists on the user space library. So
> basically we can easily extract it from there, but when the TLS
> connections are delegated to the kTLS, it is not the case. We need to
> have a way to extract the TLS state from the kernel for both of TX and
> RX side.
>
> The new TLS_RX getsockopt copies the crypto_info to user in the same
> way as TLS_TX does.
>
> We have described use cases in our research work in Netdev 0x14
> Transport Workshop [1].
>
> Also, there is an TLS implementation called tlse [2] which supports
> TLS connection migration. They have support of kTLS and their code
> shows that they are expecting the future support of this option.
>
> [1] https://speakerdeck.com/yutarohayakawa/prism-proxies-without-the-pain
> [2] https://github.com/eduardsui/tlse
>
> Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX
2020-08-31 18:30 ` Jakub Kicinski
@ 2020-09-01 13:59 ` Yutaro Hayakawa
2020-09-01 18:47 ` David Miller
0 siblings, 1 reply; 9+ messages in thread
From: Yutaro Hayakawa @ 2020-09-01 13:59 UTC (permalink / raw)
Cc: Boris Pismenny, Aviad Yehezkel, John Fastabend, Daniel Borkmann,
Jakub Kicinski, michio.honda, netdev, Yutaro Hayakawa
From: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Implement the getsockopt SOL_TLS TLS_RX which is currently missing. The
primary usecase is to use it in conjunction with TCP_REPAIR to
checkpoint/restore the TLS record layer state.
TLS connection state usually exists on the user space library. So
basically we can easily extract it from there, but when the TLS
connections are delegated to the kTLS, it is not the case. We need to
have a way to extract the TLS state from the kernel for both of TX and
RX side.
The new TLS_RX getsockopt copies the crypto_info to user in the same
way as TLS_TX does.
We have described use cases in our research work in Netdev 0x14
Transport Workshop [1].
Also, there is an TLS implementation called tlse [2] which supports
TLS connection migration. They have support of kTLS and their code
shows that they are expecting the future support of this option.
[1] https://speakerdeck.com/yutarohayakawa/prism-proxies-without-the-pain
[2] https://github.com/eduardsui/tlse
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
---
net/tls/tls_main.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index bbc52b0..002b085 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -330,12 +330,13 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
tls_ctx_free(sk, ctx);
}
-static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
- int __user *optlen)
+static int do_tls_getsockopt_conf(struct sock *sk, char __user *optval,
+ int __user *optlen, int tx)
{
int rc = 0;
struct tls_context *ctx = tls_get_ctx(sk);
struct tls_crypto_info *crypto_info;
+ struct cipher_context *cctx;
int len;
if (get_user(len, optlen))
@@ -352,7 +353,13 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
}
/* get user crypto info */
- crypto_info = &ctx->crypto_send.info;
+ if (tx) {
+ crypto_info = &ctx->crypto_send.info;
+ cctx = &ctx->tx;
+ } else {
+ crypto_info = &ctx->crypto_recv.info;
+ cctx = &ctx->rx;
+ }
if (!TLS_CRYPTO_INFO_READY(crypto_info)) {
rc = -EBUSY;
@@ -379,9 +386,9 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
}
lock_sock(sk);
memcpy(crypto_info_aes_gcm_128->iv,
- ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
+ cctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
TLS_CIPHER_AES_GCM_128_IV_SIZE);
- memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq,
+ memcpy(crypto_info_aes_gcm_128->rec_seq, cctx->rec_seq,
TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
release_sock(sk);
if (copy_to_user(optval,
@@ -403,9 +410,9 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
}
lock_sock(sk);
memcpy(crypto_info_aes_gcm_256->iv,
- ctx->tx.iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
+ cctx->iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
TLS_CIPHER_AES_GCM_256_IV_SIZE);
- memcpy(crypto_info_aes_gcm_256->rec_seq, ctx->tx.rec_seq,
+ memcpy(crypto_info_aes_gcm_256->rec_seq, cctx->rec_seq,
TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
release_sock(sk);
if (copy_to_user(optval,
@@ -429,7 +436,9 @@ static int do_tls_getsockopt(struct sock *sk, int optname,
switch (optname) {
case TLS_TX:
- rc = do_tls_getsockopt_tx(sk, optval, optlen);
+ case TLS_RX:
+ rc = do_tls_getsockopt_conf(sk, optval, optlen,
+ optname == TLS_TX);
break;
default:
rc = -ENOPROTOOPT;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX
2020-09-01 13:59 ` [PATCH " Yutaro Hayakawa
@ 2020-09-01 18:47 ` David Miller
0 siblings, 0 replies; 9+ messages in thread
From: David Miller @ 2020-09-01 18:47 UTC (permalink / raw)
To: yhayakawa3720
Cc: borisp, aviadye, john.fastabend, daniel, kuba, michio.honda, netdev
From: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Date: Tue, 1 Sep 2020 22:59:45 +0900
> From: Yutaro Hayakawa <yhayakawa3720@gmail.com>
>
> Implement the getsockopt SOL_TLS TLS_RX which is currently missing. The
> primary usecase is to use it in conjunction with TCP_REPAIR to
> checkpoint/restore the TLS record layer state.
>
> TLS connection state usually exists on the user space library. So
> basically we can easily extract it from there, but when the TLS
> connections are delegated to the kTLS, it is not the case. We need to
> have a way to extract the TLS state from the kernel for both of TX and
> RX side.
>
> The new TLS_RX getsockopt copies the crypto_info to user in the same
> way as TLS_TX does.
>
> We have described use cases in our research work in Netdev 0x14
> Transport Workshop [1].
>
> Also, there is an TLS implementation called tlse [2] which supports
> TLS connection migration. They have support of kTLS and their code
> shows that they are expecting the future support of this option.
>
> [1] https://speakerdeck.com/yutarohayakawa/prism-proxies-without-the-pain
> [2] https://github.com/eduardsui/tlse
>
> Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
> Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Applied, thank you.
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2020-09-01 18:47 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-18 14:12 [PATCH RFC net-next] net/tls: Implement getsockopt SOL_TLS TLS_RX Yutaro Hayakawa
2020-08-28 11:14 ` Yutaro Hayakawa
2020-08-28 16:52 ` Jakub Kicinski
2020-08-30 14:01 ` [PATCH RFC v2 " Yutaro Hayakawa
2020-08-30 17:48 ` Yutaro Hayakawa
2020-08-30 19:07 ` [PATCH RFC v3 " Yutaro Hayakawa
2020-08-31 18:30 ` Jakub Kicinski
2020-09-01 13:59 ` [PATCH " Yutaro Hayakawa
2020-09-01 18:47 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.