Files
linux/include/linux
Jakub Kicinski 414776621d net/tls: prevent skb_orphan() from leaking TLS plain text with offload
sk_validate_xmit_skb() and drivers depend on the sk member of
struct sk_buff to identify segments requiring encryption.
Any operation which removes or does not preserve the original TLS
socket such as skb_orphan() or skb_clone() will cause clear text
leaks.

Make the TCP socket underlying an offloaded TLS connection
mark all skbs as decrypted, if TLS TX is in offload mode.
Then in sk_validate_xmit_skb() catch skbs which have no socket
(or a socket with no validation) and decrypted flag set.

Note that CONFIG_SOCK_VALIDATE_XMIT, CONFIG_TLS_DEVICE and
sk->sk_validate_xmit_skb are slightly interchangeable right now,
they all imply TLS offload. The new checks are guarded by
CONFIG_TLS_DEVICE because that's the option guarding the
sk_buff->decrypted member.

Second, smaller issue with orphaning is that it breaks
the guarantee that packets will be delivered to device
queues in-order. All TLS offload drivers depend on that
scheduling property. This means skb_orphan_partial()'s
trick of preserving partial socket references will cause
issues in the drivers. We need a full orphan, and as a
result netem delay/throttling will cause all TLS offload
skbs to be dropped.

Reusing the sk_buff->decrypted flag also protects from
leaking clear text when incoming, decrypted skb is redirected
(e.g. by TC).

See commit 0608c69c9a ("bpf: sk_msg, sock{map|hash} redirect
through ULP") for justification why the internal flag is safe.
The only location which could leak the flag in is tcp_bpf_sendmsg(),
which is taken care of by clearing the previously unused bit.

v2:
 - remove superfluous decrypted mark copy (Willem);
 - remove the stale doc entry (Boris);
 - rely entirely on EOR marking to prevent coalescing (Boris);
 - use an internal sendpages flag instead of marking the socket
   (Boris).
v3 (Willem):
 - reorganize the can_skb_orphan_partial() condition;
 - fix the flag leak-in through tcp_bpf_sendmsg.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-08-08 22:39:35 -07:00
..
2019-06-20 09:23:22 +02:00
2019-05-31 11:13:10 +02:00
2019-07-10 09:00:57 -06:00
2019-05-14 19:52:50 -07:00
2019-07-01 08:18:54 -06:00
2018-11-07 13:44:59 -07:00
2018-11-07 13:44:59 -07:00
2019-04-09 17:05:46 -07:00
2019-05-07 08:39:02 -06:00
2019-06-12 20:27:13 +02:00
2019-07-18 09:49:30 +02:00
2018-11-13 21:55:24 +01:00
2019-02-28 03:28:53 -05:00
2019-06-12 20:30:39 +02:00
2019-02-28 08:24:23 -07:00
2019-07-23 13:59:33 -07:00
2018-12-19 10:42:08 +01:00
2019-04-22 09:48:12 -06:00
2019-02-15 16:54:38 +01:00
2019-07-05 21:34:50 +02:00
2019-06-26 13:19:46 -07:00
2018-11-19 19:03:46 -07:00
2019-06-10 13:00:24 +02:00
2019-04-08 22:56:14 +02:00
2019-07-05 15:19:10 -07:00
2018-11-30 13:29:04 +00:00
2019-03-07 18:32:03 -08:00
2019-01-30 20:51:47 -05:00
2018-10-17 13:56:58 -07:00
2019-07-08 19:25:19 -07:00
2019-06-13 09:02:33 -04:00
2019-02-20 07:22:17 -07:00
2019-02-20 07:22:10 -07:00
2019-07-09 14:15:37 -07:00
2018-12-06 15:45:46 +01:00
2019-02-08 15:02:49 -08:00
2019-07-26 17:01:29 -06:00
2018-10-21 10:46:39 -04:00
2019-07-16 19:23:25 -07:00
2018-10-08 22:53:10 +11:00
2019-05-14 19:52:51 -07:00
2019-06-12 11:42:13 +02:00
2019-06-15 12:25:49 +02:00
2019-05-14 19:52:48 -07:00
2019-04-02 17:57:35 +02:00
2019-05-08 22:14:36 +02:00
2019-05-31 12:37:46 -07:00
2019-05-16 15:51:55 -07:00
2019-02-07 16:38:35 +01:00
2019-07-08 10:51:25 +02:00
2019-07-12 11:05:43 -07:00
2018-10-11 09:16:44 -07:00
2019-06-27 21:22:15 +08:00
2019-02-07 00:13:27 +01:00
2019-07-07 11:50:03 +02:00
2018-12-10 10:17:45 +01:00
2019-01-11 18:05:40 -08:00
2019-06-05 11:54:38 +02:00
2019-05-15 17:35:54 +01:00
2019-07-18 10:20:13 -06:00
2018-12-22 12:15:29 +01:00
2019-07-10 09:00:57 -06:00