Commit 05191d88 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'in-kernel-support-for-the-tls-alert-protocol' 

Chuck Lever says:

====================
In-kernel support for the TLS Alert protocol

IMO the kernel doesn't need user space (ie, tlshd) to handle the TLS
Alert protocol. Instead, a set of small helper functions can be used
to handle sending and receiving TLS Alerts for in-kernel TLS
consumers.
====================

Merged on top of a tag in case it's needed in the NFS tree.

Link: https://lore.kernel.org/r/169047923706.5241.1181144206068116926.stgit@oracle-102.nfsv4bat.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 222a6c42 b470985c

drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls.h

+1 −0
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include <crypto/internal/hash.h>

#include <linux/tls.h>

#include <net/tls.h>

#include <net/tls_prot.h>

#include <net/tls_toe.h>



#include "t4fw_api.h"

include/net/handshake.h

+5 −0
Original line number Diff line number Diff line
@@ -40,5 +40,10 @@ int tls_server_hello_x509(const struct tls_handshake_args *args, gfp_t flags); 
int tls_server_hello_psk(const struct tls_handshake_args *args, gfp_t flags);



bool tls_handshake_cancel(struct sock *sk);

void tls_handshake_close(struct socket *sock);



u8 tls_get_record_type(const struct sock *sk, const struct cmsghdr *msg);

void tls_alert_recv(const struct sock *sk, const struct msghdr *msg,

		    u8 *level, u8 *description);



#endif /* _NET_HANDSHAKE_H */

include/net/tls.h

+0 −4
Original line number Diff line number Diff line
@@ -69,10 +69,6 @@ extern const struct tls_cipher_size_desc tls_cipher_size_desc[]; 


#define TLS_CRYPTO_INFO_READY(info)	((info)->cipher_type)



#define TLS_RECORD_TYPE_ALERT		0x15

#define TLS_RECORD_TYPE_HANDSHAKE	0x16

#define TLS_RECORD_TYPE_DATA		0x17



#define TLS_AAD_SPACE_SIZE		13



#define MAX_IV_SIZE			16

include/net/tls_prot.h

0 → 100644
+68 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */

/*

 * Copyright (c) 2023, Oracle and/or its affiliates.

 *

 * TLS Protocol definitions

 *

 * From https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml

 */



#ifndef _TLS_PROT_H

#define _TLS_PROT_H



/*

 * TLS Record protocol: ContentType

 */

enum {

	TLS_RECORD_TYPE_CHANGE_CIPHER_SPEC = 20,

	TLS_RECORD_TYPE_ALERT = 21,

	TLS_RECORD_TYPE_HANDSHAKE = 22,

	TLS_RECORD_TYPE_DATA = 23,

	TLS_RECORD_TYPE_HEARTBEAT = 24,

	TLS_RECORD_TYPE_TLS12_CID = 25,

	TLS_RECORD_TYPE_ACK = 26,

};



/*

 * TLS Alert protocol: AlertLevel

 */

enum {

	TLS_ALERT_LEVEL_WARNING = 1,

	TLS_ALERT_LEVEL_FATAL = 2,

};



/*

 * TLS Alert protocol: AlertDescription

 */

enum {

	TLS_ALERT_DESC_CLOSE_NOTIFY = 0,

	TLS_ALERT_DESC_UNEXPECTED_MESSAGE = 10,

	TLS_ALERT_DESC_BAD_RECORD_MAC = 20,

	TLS_ALERT_DESC_RECORD_OVERFLOW = 22,

	TLS_ALERT_DESC_HANDSHAKE_FAILURE = 40,

	TLS_ALERT_DESC_BAD_CERTIFICATE = 42,

	TLS_ALERT_DESC_UNSUPPORTED_CERTIFICATE = 43,

	TLS_ALERT_DESC_CERTIFICATE_REVOKED = 44,

	TLS_ALERT_DESC_CERTIFICATE_EXPIRED = 45,

	TLS_ALERT_DESC_CERTIFICATE_UNKNOWN = 46,

	TLS_ALERT_DESC_ILLEGAL_PARAMETER = 47,

	TLS_ALERT_DESC_UNKNOWN_CA = 48,

	TLS_ALERT_DESC_ACCESS_DENIED = 49,

	TLS_ALERT_DESC_DECODE_ERROR = 50,

	TLS_ALERT_DESC_DECRYPT_ERROR = 51,

	TLS_ALERT_DESC_TOO_MANY_CIDS_REQUESTED	= 52,

	TLS_ALERT_DESC_PROTOCOL_VERSION = 70,

	TLS_ALERT_DESC_INSUFFICIENT_SECURITY = 71,

	TLS_ALERT_DESC_INTERNAL_ERROR = 80,

	TLS_ALERT_DESC_INAPPROPRIATE_FALLBACK = 86,

	TLS_ALERT_DESC_USER_CANCELED = 90,

	TLS_ALERT_DESC_MISSING_EXTENSION = 109,

	TLS_ALERT_DESC_UNSUPPORTED_EXTENSION = 110,

	TLS_ALERT_DESC_UNRECOGNIZED_NAME = 112,

	TLS_ALERT_DESC_BAD_CERTIFICATE_STATUS_RESPONSE = 113,

	TLS_ALERT_DESC_UNKNOWN_PSK_IDENTITY = 115,

	TLS_ALERT_DESC_CERTIFICATE_REQUIRED = 116,

	TLS_ALERT_DESC_NO_APPLICATION_PROTOCOL = 120,

};



#endif /* _TLS_PROT_H */

include/trace/events/handshake.h

+160 −0
Original line number Diff line number Diff line
@@ -6,7 +6,86 @@ 
#define _TRACE_HANDSHAKE_H



#include <linux/net.h>

#include <net/tls_prot.h>

#include <linux/tracepoint.h>

#include <trace/events/net_probe_common.h>



#define TLS_RECORD_TYPE_LIST \

	record_type(CHANGE_CIPHER_SPEC) \

	record_type(ALERT) \

	record_type(HANDSHAKE) \

	record_type(DATA) \

	record_type(HEARTBEAT) \

	record_type(TLS12_CID) \

	record_type_end(ACK)



#undef record_type

#undef record_type_end

#define record_type(x)		TRACE_DEFINE_ENUM(TLS_RECORD_TYPE_##x);

#define record_type_end(x)	TRACE_DEFINE_ENUM(TLS_RECORD_TYPE_##x);



TLS_RECORD_TYPE_LIST



#undef record_type

#undef record_type_end

#define record_type(x)		{ TLS_RECORD_TYPE_##x, #x },

#define record_type_end(x)	{ TLS_RECORD_TYPE_##x, #x }



#define show_tls_content_type(type) \

	__print_symbolic(type, TLS_RECORD_TYPE_LIST)



TRACE_DEFINE_ENUM(TLS_ALERT_LEVEL_WARNING);

TRACE_DEFINE_ENUM(TLS_ALERT_LEVEL_FATAL);



#define show_tls_alert_level(level) \

	__print_symbolic(level, \

		{ TLS_ALERT_LEVEL_WARNING,	"Warning" }, \

		{ TLS_ALERT_LEVEL_FATAL,	"Fatal" })



#define TLS_ALERT_DESCRIPTION_LIST \

	alert_description(CLOSE_NOTIFY) \

	alert_description(UNEXPECTED_MESSAGE) \

	alert_description(BAD_RECORD_MAC) \

	alert_description(RECORD_OVERFLOW) \

	alert_description(HANDSHAKE_FAILURE) \

	alert_description(BAD_CERTIFICATE) \

	alert_description(UNSUPPORTED_CERTIFICATE) \

	alert_description(CERTIFICATE_REVOKED) \

	alert_description(CERTIFICATE_EXPIRED) \

	alert_description(CERTIFICATE_UNKNOWN) \

	alert_description(ILLEGAL_PARAMETER) \

	alert_description(UNKNOWN_CA) \

	alert_description(ACCESS_DENIED) \

	alert_description(DECODE_ERROR) \

	alert_description(DECRYPT_ERROR) \

	alert_description(TOO_MANY_CIDS_REQUESTED) \

	alert_description(PROTOCOL_VERSION) \

	alert_description(INSUFFICIENT_SECURITY) \

	alert_description(INTERNAL_ERROR) \

	alert_description(INAPPROPRIATE_FALLBACK) \

	alert_description(USER_CANCELED) \

	alert_description(MISSING_EXTENSION) \

	alert_description(UNSUPPORTED_EXTENSION) \

	alert_description(UNRECOGNIZED_NAME) \

	alert_description(BAD_CERTIFICATE_STATUS_RESPONSE) \

	alert_description(UNKNOWN_PSK_IDENTITY) \

	alert_description(CERTIFICATE_REQUIRED) \

	alert_description_end(NO_APPLICATION_PROTOCOL)



#undef alert_description

#undef alert_description_end

#define alert_description(x)		TRACE_DEFINE_ENUM(TLS_ALERT_DESC_##x);

#define alert_description_end(x)	TRACE_DEFINE_ENUM(TLS_ALERT_DESC_##x);



TLS_ALERT_DESCRIPTION_LIST



#undef alert_description

#undef alert_description_end

#define alert_description(x)		{ TLS_ALERT_DESC_##x, #x },

#define alert_description_end(x)	{ TLS_ALERT_DESC_##x, #x }



#define show_tls_alert_description(desc) \

	__print_symbolic(desc, TLS_ALERT_DESCRIPTION_LIST)



DECLARE_EVENT_CLASS(handshake_event_class,

	TP_PROTO(
@@ -106,6 +185,47 @@ DECLARE_EVENT_CLASS(handshake_error_class, 
		),						\

		TP_ARGS(net, req, sk, err))



DECLARE_EVENT_CLASS(handshake_alert_class,

	TP_PROTO(

		const struct sock *sk,

		unsigned char level,

		unsigned char description

	),

	TP_ARGS(sk, level, description),

	TP_STRUCT__entry(

		/* sockaddr_in6 is always bigger than sockaddr_in */

		__array(__u8, saddr, sizeof(struct sockaddr_in6))

		__array(__u8, daddr, sizeof(struct sockaddr_in6))

		__field(unsigned int, netns_ino)

		__field(unsigned long, level)

		__field(unsigned long, description)

	),

	TP_fast_assign(

		const struct inet_sock *inet = inet_sk(sk);



		memset(__entry->saddr, 0, sizeof(struct sockaddr_in6));

		memset(__entry->daddr, 0, sizeof(struct sockaddr_in6));

		TP_STORE_ADDR_PORTS(__entry, inet, sk);



		__entry->netns_ino = sock_net(sk)->ns.inum;

		__entry->level = level;

		__entry->description = description;

	),

	TP_printk("src=%pISpc dest=%pISpc %s: %s",

		__entry->saddr, __entry->daddr,

		show_tls_alert_level(__entry->level),

		show_tls_alert_description(__entry->description)

	)

);

#define DEFINE_HANDSHAKE_ALERT(name)				\

	DEFINE_EVENT(handshake_alert_class, name,		\

		TP_PROTO(					\

			const struct sock *sk,			\

			unsigned char level,			\

			unsigned char description		\

		),						\

		TP_ARGS(sk, level, description))





/*

 * Request lifetime events
@@ -154,6 +274,46 @@ DEFINE_HANDSHAKE_ERROR(handshake_cmd_accept_err); 
DEFINE_HANDSHAKE_FD_EVENT(handshake_cmd_done);

DEFINE_HANDSHAKE_ERROR(handshake_cmd_done_err);



/*

 * TLS Record events

 */



TRACE_EVENT(tls_contenttype,

	TP_PROTO(

		const struct sock *sk,

		unsigned char type

	),

	TP_ARGS(sk, type),

	TP_STRUCT__entry(

		/* sockaddr_in6 is always bigger than sockaddr_in */

		__array(__u8, saddr, sizeof(struct sockaddr_in6))

		__array(__u8, daddr, sizeof(struct sockaddr_in6))

		__field(unsigned int, netns_ino)

		__field(unsigned long, type)

	),

	TP_fast_assign(

		const struct inet_sock *inet = inet_sk(sk);



		memset(__entry->saddr, 0, sizeof(struct sockaddr_in6));

		memset(__entry->daddr, 0, sizeof(struct sockaddr_in6));

		TP_STORE_ADDR_PORTS(__entry, inet, sk);



		__entry->netns_ino = sock_net(sk)->ns.inum;

		__entry->type = type;

	),

	TP_printk("src=%pISpc dest=%pISpc %s",

		__entry->saddr, __entry->daddr,

		show_tls_content_type(__entry->type)

	)

);



/*

 * TLS Alert events

 */



DEFINE_HANDSHAKE_ALERT(tls_alert_send);

DEFINE_HANDSHAKE_ALERT(tls_alert_recv);



#endif /* _TRACE_HANDSHAKE_H */



#include <trace/define_trace.h>