Commit 35b1b538 authored by Chuck Lever's avatar Chuck Lever Committed by Jakub Kicinski
Browse files

net/handshake: Add API for sending TLS Closure alerts 



This helper sends an alert only if a TLS session was established.

Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Link: https://lore.kernel.org/r/169047936730.5241.618595693821012638.stgit@oracle-102.nfsv4bat.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 02574271

include/net/handshake.h

+1 −0
Original line number Diff line number Diff line
@@ -40,5 +40,6 @@ int tls_server_hello_x509(const struct tls_handshake_args *args, gfp_t flags); 
int tls_server_hello_psk(const struct tls_handshake_args *args, gfp_t flags);



bool tls_handshake_cancel(struct sock *sk);

void tls_handshake_close(struct socket *sock);



#endif /* _NET_HANDSHAKE_H */

net/handshake/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -8,6 +8,6 @@ 
#



obj-y += handshake.o

handshake-y := genl.o netlink.o request.o tlshd.o trace.o

handshake-y := alert.o genl.o netlink.o request.o tlshd.o trace.o



obj-$(CONFIG_NET_HANDSHAKE_KUNIT_TEST) += handshake-test.o

net/handshake/alert.c

0 → 100644
+61 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Handle the TLS Alert protocol

 *

 * Author: Chuck Lever <chuck.lever@oracle.com>

 *

 * Copyright (c) 2023, Oracle and/or its affiliates.

 */



#include <linux/types.h>

#include <linux/socket.h>

#include <linux/kernel.h>

#include <linux/module.h>

#include <linux/skbuff.h>

#include <linux/inet.h>



#include <net/sock.h>

#include <net/handshake.h>

#include <net/tls.h>

#include <net/tls_prot.h>



#include "handshake.h"



/**

 * tls_alert_send - send a TLS Alert on a kTLS socket

 * @sock: open kTLS socket to send on

 * @level: TLS Alert level

 * @description: TLS Alert description

 *

 * Returns zero on success or a negative errno.

 */

int tls_alert_send(struct socket *sock, u8 level, u8 description)

{

	u8 record_type = TLS_RECORD_TYPE_ALERT;

	u8 buf[CMSG_SPACE(sizeof(record_type))];

	struct msghdr msg = { 0 };

	struct cmsghdr *cmsg;

	struct kvec iov;

	u8 alert[2];

	int ret;



	alert[0] = level;

	alert[1] = description;

	iov.iov_base = alert;

	iov.iov_len = sizeof(alert);



	memset(buf, 0, sizeof(buf));

	msg.msg_control = buf;

	msg.msg_controllen = sizeof(buf);

	msg.msg_flags = MSG_DONTWAIT;



	cmsg = CMSG_FIRSTHDR(&msg);

	cmsg->cmsg_level = SOL_TLS;

	cmsg->cmsg_type = TLS_SET_RECORD_TYPE;

	cmsg->cmsg_len = CMSG_LEN(sizeof(record_type));

	memcpy(CMSG_DATA(cmsg), &record_type, sizeof(record_type));



	iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iov, 1, iov.iov_len);

	ret = sock_sendmsg(sock, &msg);

	return ret < 0 ? ret : 0;

}

net/handshake/handshake.h

+6 −0
Original line number Diff line number Diff line
@@ -41,8 +41,11 @@ struct handshake_req { 


enum hr_flags_bits {

	HANDSHAKE_F_REQ_COMPLETED,

	HANDSHAKE_F_REQ_SESSION,

};



struct genl_info;



/* Invariants for all handshake requests for one transport layer

 * security protocol

 */
@@ -63,6 +66,9 @@ enum hp_flags_bits { 
	HANDSHAKE_F_PROTO_NOTIFY,

};



/* alert.c */

int tls_alert_send(struct socket *sock, u8 level, u8 description);



/* netlink.c */

int handshake_genl_notify(struct net *net, const struct handshake_proto *proto,

			  gfp_t flags);

net/handshake/tlshd.c

+23 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ 
#include <net/sock.h>

#include <net/handshake.h>

#include <net/genetlink.h>

#include <net/tls_prot.h>



#include <uapi/linux/keyctl.h>

#include <uapi/linux/handshake.h>
@@ -100,6 +101,9 @@ static void tls_handshake_done(struct handshake_req *req, 
	if (info)

		tls_handshake_remote_peerids(treq, info);



	if (!status)

		set_bit(HANDSHAKE_F_REQ_SESSION, &req->hr_flags);



	treq->th_consumer_done(treq->th_consumer_data, -status,

			       treq->th_peerid[0]);

}
@@ -424,3 +428,22 @@ bool tls_handshake_cancel(struct sock *sk) 
	return handshake_req_cancel(sk);

}

EXPORT_SYMBOL(tls_handshake_cancel);



/**

 * tls_handshake_close - send a Closure alert

 * @sock: an open socket

 *

 */

void tls_handshake_close(struct socket *sock)

{

	struct handshake_req *req;



	req = handshake_req_hash_lookup(sock->sk);

	if (!req)

		return;

	if (!test_and_clear_bit(HANDSHAKE_F_REQ_SESSION, &req->hr_flags))

		return;

	tls_alert_send(sock, TLS_ALERT_LEVEL_WARNING,

		       TLS_ALERT_DESC_CLOSE_NOTIFY);

}

EXPORT_SYMBOL(tls_handshake_close);