Jakub Kicinski
414776621d
net/tls: prevent skb_orphan() from leaking TLS plain text with offload
...
sk_validate_xmit_skb() and drivers depend on the sk member of
struct sk_buff to identify segments requiring encryption.
Any operation which removes or does not preserve the original TLS
socket such as skb_orphan() or skb_clone() will cause clear text
leaks.
Make the TCP socket underlying an offloaded TLS connection
mark all skbs as decrypted, if TLS TX is in offload mode.
Then in sk_validate_xmit_skb() catch skbs which have no socket
(or a socket with no validation) and decrypted flag set.
Note that CONFIG_SOCK_VALIDATE_XMIT, CONFIG_TLS_DEVICE and
sk->sk_validate_xmit_skb are slightly interchangeable right now,
they all imply TLS offload. The new checks are guarded by
CONFIG_TLS_DEVICE because that's the option guarding the
sk_buff->decrypted member.
Second, smaller issue with orphaning is that it breaks
the guarantee that packets will be delivered to device
queues in-order. All TLS offload drivers depend on that
scheduling property. This means skb_orphan_partial()'s
trick of preserving partial socket references will cause
issues in the drivers. We need a full orphan, and as a
result netem delay/throttling will cause all TLS offload
skbs to be dropped.
Reusing the sk_buff->decrypted flag also protects from
leaking clear text when incoming, decrypted skb is redirected
(e.g. by TC).
See commit 0608c69c9a ("bpf: sk_msg, sock{map|hash} redirect
through ULP") for justification why the internal flag is safe.
The only location which could leak the flag in is tcp_bpf_sendmsg(),
which is taken care of by clearing the previously unused bit.
v2:
- remove superfluous decrypted mark copy (Willem);
- remove the stale doc entry (Boris);
- rely entirely on EOR marking to prevent coalescing (Boris);
- use an internal sendpages flag instead of marking the socket
(Boris).
v3 (Willem):
- reorganize the can_skb_orphan_partial() condition;
- fix the flag leak-in through tcp_bpf_sendmsg.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com >
Acked-by: Willem de Bruijn <willemb@google.com >
Reviewed-by: Boris Pismenny <borisp@mellanox.com >
Signed-off-by: David S. Miller <davem@davemloft.net >
2019-08-08 22:39:35 -07:00
..
2019-06-19 17:09:55 +02:00
2019-06-26 09:18:54 -07:00
2019-06-19 17:09:55 +02:00
2019-07-18 11:05:25 -07:00
2019-06-19 17:09:55 +02:00
2019-07-17 09:55:43 -07:00
2019-06-19 17:09:55 +02:00
2019-06-21 16:01:06 +02:00
2019-06-19 17:09:55 +02:00
2019-07-28 12:44:14 +02:00
2019-06-20 09:23:22 +02:00
2019-06-19 17:09:55 +02:00
2019-07-13 14:40:42 -07:00
2019-07-08 11:01:13 -07:00
2019-07-03 17:52:08 -04:00
2019-06-19 17:09:55 +02:00
2019-07-15 20:18:40 -07:00
2019-07-25 13:31:00 -07:00
2019-07-11 18:11:21 -07:00
2019-07-13 15:42:44 -07:00
2019-07-16 13:17:00 +02:00
2019-07-08 09:54:55 -07:00
2019-07-13 15:02:27 -07:00
2019-07-19 17:13:56 -07:00
2019-06-19 17:09:55 +02:00
2019-06-17 20:20:36 -07:00
2019-07-04 17:34:34 +01:00
2019-06-19 17:09:55 +02:00
2019-07-25 15:37:04 +02:00
2019-07-19 17:13:56 -07:00
2019-07-01 11:52:43 +05:30
2019-07-04 17:35:11 +01:00
2019-07-18 14:32:33 -07:00
2019-07-12 15:13:55 -07:00
2019-06-19 17:09:07 +02:00
2019-06-19 17:09:55 +02:00
2019-07-18 09:12:34 -07:00
2019-06-19 17:09:07 +02:00
2019-06-24 19:23:39 +02:00
2019-07-08 18:55:42 -07:00
2019-07-10 09:00:57 -06:00
2019-07-01 08:18:54 -06:00
2019-07-16 19:23:22 -07:00
2019-07-21 21:46:23 -06:00
2019-07-16 10:06:39 -06:00
2019-06-20 10:29:22 -06:00
2019-07-11 20:04:40 -06:00
2019-06-27 15:25:16 -07:00
2019-06-20 00:06:27 -04:00
2019-06-27 15:25:16 -07:00
2019-06-27 15:25:16 -07:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:08 +02:00
2019-07-15 11:03:02 -03:00
2019-07-15 21:20:52 -07:00
2019-07-12 11:11:30 -07:00
2019-07-22 14:32:20 -07:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-07-16 19:23:23 -07:00
2019-07-16 19:23:24 -07:00
2019-07-18 21:01:06 +02:00
2019-07-18 21:01:06 +02:00
2019-07-09 13:55:46 +02:00
2019-07-21 13:31:14 -07:00
2019-06-12 20:27:13 +02:00
2019-06-19 17:09:55 +02:00
2019-06-20 07:56:13 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-07-18 09:49:30 +02:00
2019-07-12 12:24:03 -07:00
2019-06-19 17:09:06 +02:00
2019-06-19 17:09:06 +02:00
2019-07-24 10:12:09 -07:00
2019-07-08 20:57:08 -07:00
2019-07-05 15:19:10 -07:00
2019-07-19 10:42:02 -07:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-07-18 14:49:33 -07:00
2019-07-27 08:25:51 -07:00
2019-07-25 11:34:39 -07:00
2019-06-19 17:09:55 +02:00
2019-07-15 19:04:27 -07:00
2019-07-16 22:15:46 +02:00
2019-06-24 10:23:16 +02:00
2019-07-23 17:43:58 +02:00
2019-07-08 14:19:33 -07:00
2019-07-17 09:55:43 -07:00
2019-07-12 11:05:41 -07:00
2019-06-27 23:02:12 +01:00
2019-06-19 17:09:55 +02:00
2019-06-24 23:57:50 +03:00
2019-07-23 07:25:09 -06:00
2019-06-24 19:23:39 +02:00
2019-06-14 14:21:07 -06:00
2019-06-12 20:30:39 +02:00
2019-06-12 20:30:39 +02:00
2019-06-19 17:09:55 +02:00
2019-07-23 13:59:33 -07:00
2019-06-24 09:16:47 +10:00
2019-07-19 10:42:02 -07:00
2019-07-16 22:52:37 -04:00
2019-07-30 13:16:57 -06:00
2019-06-19 17:09:11 +02:00
2019-07-03 18:52:20 +02:00
2019-07-10 20:09:17 -07:00
2019-06-20 14:47:54 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-07-12 15:13:55 -07:00
2019-06-13 02:38:28 +02:00
2019-07-25 16:14:39 -03:00
2019-06-25 12:59:43 +10:00
2019-06-22 21:21:04 +02:00
2019-06-22 21:21:04 +02:00
2019-07-18 17:08:06 -07:00
2019-07-12 11:05:45 -07:00
2019-07-15 11:03:02 -03:00
2019-06-29 21:08:14 -07:00
2019-06-26 15:10:35 +02:00
2019-06-19 17:09:55 +02:00
2019-07-09 14:52:14 -07:00
2019-07-01 19:15:46 -07:00
2019-06-22 08:59:24 -04:00
2019-07-05 21:34:50 +02:00
2019-07-30 14:42:13 -07:00
2019-07-26 14:20:06 -07:00
2019-07-08 19:25:19 -07:00
2019-07-08 20:28:59 -07:00
2019-06-26 13:19:46 -07:00
2019-07-04 22:01:59 -04:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-07-15 11:42:31 +02:00
2019-07-04 17:26:48 +02:00
2019-06-26 14:08:11 +02:00
2019-07-04 17:26:48 +02:00
2019-06-14 16:08:36 -05:00
2019-06-19 17:09:56 +02:00
2019-06-25 12:51:25 +01:00
2019-07-16 19:23:22 -07:00
2019-07-17 07:21:02 -07:00
2019-07-04 17:26:48 +02:00
2019-06-14 14:31:48 -06:00
2019-07-14 19:42:11 -07:00
2019-07-23 09:51:00 +02:00
2019-06-19 17:09:55 +02:00
2019-07-08 14:01:43 +02:00
2019-06-20 17:32:21 -04:00
2019-06-10 13:00:24 +02:00
2019-06-14 19:31:47 -07:00
2019-06-17 12:09:22 +02:00
2019-07-12 11:05:42 -07:00
2019-07-12 11:05:42 -07:00
2019-07-16 19:23:21 -07:00
2019-07-08 19:36:47 -07:00
2019-07-10 18:43:43 -07:00
2019-06-19 17:09:08 +02:00
2019-07-16 19:23:22 -07:00
2019-07-20 09:00:45 +02:00
2019-06-19 17:09:07 +02:00
2019-06-19 17:09:56 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-07-05 15:19:10 -07:00
2019-06-19 17:09:55 +02:00
2019-06-29 01:31:08 +02:00
2019-07-11 15:30:05 -07:00
2019-07-15 08:53:27 -03:00
2019-06-24 19:23:44 +02:00
2019-07-16 19:23:24 -07:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-07-12 11:05:47 -07:00
2019-07-18 17:08:07 -07:00
2019-07-18 17:08:07 -07:00
2019-07-02 14:32:44 -03:00
2019-06-19 17:09:55 +02:00
2019-07-18 17:08:07 -07:00
2019-07-14 19:42:11 -07:00
2019-06-19 17:09:55 +02:00
2019-07-18 17:08:07 -07:00
2019-07-18 17:08:07 -07:00
2019-07-25 20:12:38 +03:00
2019-06-24 14:00:32 +02:00
2019-06-13 08:59:34 -04:00
2019-07-15 08:53:27 -03:00
2019-07-03 19:28:40 +02:00
2019-07-08 19:25:19 -07:00
2019-07-01 19:34:46 -07:00
2019-06-21 17:21:11 +02:00
2019-07-01 19:12:10 -07:00
2019-07-18 15:50:28 -04:00
2019-07-06 14:54:50 -04:00
2019-07-06 14:54:49 -04:00
2019-07-18 17:08:06 -07:00
2019-06-13 09:02:33 -04:00
2019-06-21 11:08:37 +02:00
2019-07-09 14:15:37 -07:00
2019-07-26 17:01:29 -06:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-07-10 23:08:44 -05:00
2019-07-12 11:05:47 -07:00
2019-07-12 11:05:43 -07:00
2019-08-03 07:02:01 -07:00
2019-08-01 06:39:33 +02:00
2019-07-12 11:05:43 -07:00
2019-07-12 11:05:43 -07:00
2019-07-17 09:55:43 -07:00
2019-06-21 18:11:53 -05:00
2019-06-21 22:05:42 -04:00
2019-07-21 09:46:59 -07:00
2019-06-19 17:09:55 +02:00
2019-07-08 16:12:03 -07:00
2019-07-13 11:21:28 +02:00
2019-06-24 19:19:23 +02:00
2019-07-16 19:23:25 -07:00
2019-07-12 15:26:29 -07:00
2019-07-08 19:48:57 -07:00
2019-07-16 19:23:24 -07:00
2019-07-15 11:03:02 -03:00
2019-06-26 10:53:57 +02:00
2019-07-04 10:40:54 +02:00
2019-06-22 11:28:37 +02:00
2019-07-15 20:44:49 -07:00
2019-07-16 19:23:22 -07:00
2019-07-15 21:06:15 -07:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-12 11:42:13 +02:00
2019-06-15 12:25:49 +02:00
2019-07-09 10:28:47 -07:00
2019-06-19 17:09:55 +02:00
2019-06-13 22:34:55 -07:00
2019-06-26 11:39:11 +02:00
2019-06-19 17:09:55 +02:00
2019-07-04 22:01:59 -04:00
2019-07-16 19:23:22 -07:00
2019-07-16 19:23:22 -07:00
2019-06-28 19:46:47 +02:00
2019-07-09 12:34:26 -07:00
2019-06-29 12:02:17 -07:00
2019-06-12 15:27:44 +01:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:07 +02:00
2019-07-15 08:53:27 -03:00
2019-06-20 15:21:33 -04:00
2019-06-19 17:09:55 +02:00
2019-07-25 15:37:05 +02:00
2019-06-12 12:29:20 +01:00
2019-06-14 09:02:42 -04:00
2019-06-29 10:33:57 -06:00
2019-07-03 17:52:50 -04:00
2019-06-21 10:18:43 +02:00
2019-07-15 11:03:03 -03:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:55 +02:00
2019-06-19 17:09:06 +02:00
2019-07-16 19:23:24 -07:00
2019-07-09 09:07:00 -07:00
2019-07-09 11:35:38 -07:00
2019-08-08 22:39:35 -07:00
2019-07-22 16:04:17 +02:00
2019-07-12 11:05:44 -07:00
2019-06-19 17:09:55 +02:00
2019-07-08 16:12:03 -07:00
2019-08-08 22:39:35 -07:00
2019-06-17 20:20:36 -07:00
2019-06-15 12:25:55 +02:00
2019-07-03 17:52:50 -04:00
2019-07-08 10:51:25 +02:00
2019-07-12 11:05:43 -07:00
2019-07-16 19:23:21 -07:00
2019-06-19 17:09:55 +02:00
2019-07-19 10:42:02 -07:00
2019-07-18 17:08:07 -07:00
2019-06-19 17:09:55 +02:00
2019-06-22 16:30:37 -07:00
2019-06-27 21:22:15 +08:00
2019-06-19 17:09:55 +02:00
2019-06-25 08:54:51 +02:00
2019-07-07 11:50:03 +02:00
2019-06-19 17:09:55 +02:00
2019-06-24 23:57:49 +03:00
2019-07-16 15:14:48 -04:00
2019-06-19 17:09:55 +02:00
2019-07-16 19:23:24 -07:00
2019-06-19 17:09:55 +02:00
2019-07-13 10:36:53 -07:00
2019-06-19 23:45:09 -04:00
2019-06-26 21:02:32 +01:00
2019-06-19 17:09:55 +02:00
2019-07-12 11:05:47 -07:00
2019-07-12 11:05:43 -07:00
2019-06-21 16:04:05 +02:00
2019-06-19 17:09:55 +02:00
2019-07-18 10:20:13 -06:00
2019-07-14 16:51:47 -07:00
2019-06-27 14:12:15 -07:00
2019-07-10 09:00:57 -06:00