John Fastabend
e7b1564a24
bpf: Fix running sk_skb program types with ktls ...
[ Upstream commit e91de6afa81c10e9f855c5695eb9a53168d96b73 ]
KTLS uses a stream parser to collect TLS messages and send them to
the upper layer tls receive handler. This ensures the tls receiver
has a full TLS header to parse when it is run. However, when a
socket has BPF_SK_SKB_STREAM_VERDICT program attached before KTLS
is enabled we end up with two stream parsers running on the same
socket.
The result is both try to run on the same socket. First the KTLS
stream parser runs and calls read_sock() which will tcp_read_sock
which in turn calls tcp_rcv_skb(). This dequeues the skb from the
sk_receive_queue. When this is done KTLS code then data_ready()
callback which because we stacked KTLS on top of the bpf stream
verdict program has been replaced with sk_psock_start_strp(). This
will in turn kick the stream parser again and eventually do the
same thing KTLS did above calling into tcp_rcv_skb() and dequeuing
a skb from the sk_receive_queue.
At this point the data stream is broke. Part of the stream was
handled by the KTLS side some other bytes may have been handled
by the BPF side. Generally this results in either missing data
or more likely a "Bad Message" complaint from the kTLS receive
handler as the BPF program steals some bytes meant to be in a
TLS header and/or the TLS header length is no longer correct.
We've already broke the idealized model where we can stack ULPs
in any order with generic callbacks on the TX side to handle this.
So in this patch we do the same thing but for RX side. We add
a sk_psock_strp_enabled() helper so TLS can learn a BPF verdict
program is running and add a tls_sw_has_ctx_rx() helper so BPF
side can learn there is a TLS ULP on the socket.
Then on BPF side we omit calling our stream parser to avoid
breaking the data stream for the KTLS receiver. Then on the
KTLS side we call BPF_SK_SKB_STREAM_VERDICT once the KTLS
receiver is done with the packet but before it posts the
msg to userspace. This gives us symmetry between the TX and
RX halfs and IMO makes it usable again. On the TX side we
process packets in this order BPF -> TLS -> TCP and on
the receive side in the reverse order TCP -> TLS -> BPF.
Discovered while testing OpenSSL 3.0 Alpha2.0 release.
Fixes: d829e9c411https://lore.kernel.org/bpf/159079361946.5745.605854335665044485.stgit@john-Precision-5820-Tower
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-06-22 09:31:12 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 188
2019-05-30 11:29:21 -07:00
Bluetooth: Add support for utilizing Fast Advertising Interval
2019-09-05 17:27:21 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 194
2019-05-30 11:29:22 -07:00
netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
2020-05-20 08:20:23 +02:00
netfilter: nf_tables: autoload modules from the abort path
2020-01-29 16:45:33 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234
2019-06-19 17:09:07 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336
2019-06-05 17:37:07 +02:00
sctp: cache netns in sctp_ep_common
2019-12-04 22:30:57 +01:00
net: sched: take reference to psample group in flow_action infra
2019-09-16 09:18:03 +02:00
net sched: fix reporting the first-time use timestamp
2020-06-03 08:21:01 +02:00
ipv6: Fix return value of ipv6_mc_may_pull() for malformed packets
2019-08-19 17:19:46 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
rxrpc: Fix the excessive initial retransmission timeout
2020-05-27 17:46:48 +02:00
net: split out functions related to registering inflight socket files
2019-02-28 08:24:23 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321
2019-06-05 17:37:05 +02:00
net: avoid potential false sharing in neighbor related code
2019-12-31 16:45:03 +01:00
ax25: fix possible use-after-free
2019-01-23 11:18:00 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 90
2019-05-24 17:37:53 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 5
2019-05-21 11:28:40 +02:00
bonding: add an option to specify a delay between peer notifications
2019-07-04 12:30:48 -07:00
bonding: fix state transition issue in link monitoring
2019-11-05 17:40:16 -08:00
bpf: support cloning sk storage on accept()
2019-08-17 23:18:54 +02:00
net: annotate lockless accesses to sk->sk_napi_id
2019-10-30 17:34:35 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
cfg80211: Fix radar event during another phy CAC
2020-02-05 21:22:46 +00:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: rework SIOCGSTAMP ioctl handling
2019-04-19 14:07:40 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
devlink: disallow reload operation during device cleanup
2019-11-09 19:38:36 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report()
2020-05-27 17:46:24 +02:00
net: dsa: Pass ndo_setup_tc slave callback to drivers
2019-09-16 21:32:57 +02:00
net/dst: do not confirm neighbor for vxlan and geneve pmtu update
2020-01-04 19:19:05 +01:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:18:58 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
net: fib: drop include of module.h from fib_notifier.h
2019-04-22 21:50:53 -07:00
fib: add missing attribute validation for tun_id
2020-03-18 07:17:44 +01:00
route: Add multipath_hash in flowi_common to make user-define hash
2019-02-27 12:50:17 -08:00
net: sched: correct flower port blocking
2020-03-05 16:43:32 +01:00
net: core: rename indirect block ingress cb function
2019-12-18 16:08:47 +01:00
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
net/fq_impl: Switch to kvmalloc() for memory allocation
2019-11-08 09:11:49 +01:00
genetlink: optionally validate strictly/dumps
2019-04-27 17:07:22 -04:00
net: Move the definition of the default Geneve udp port to public header file
2019-03-22 12:09:31 -07:00
net:gue.h:Fix shifting signed 32-bit value by 31 bits problem
2019-07-01 10:58:23 -07:00
net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static
2019-10-25 16:24:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
wireless-drivers-next patches for 5.1
2019-02-22 12:56:24 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
ipv6: shrink struct ipv6_mc_socklist
2019-08-28 14:43:03 -07:00
net: ife: drop include of module.h from net/ife.h
2019-04-22 21:50:53 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
inet: factor out inet_send_prepare()
2019-07-03 13:51:54 -07:00
net/tls: use RCU protection on icsk->icsk_ulp_data
2019-08-31 23:44:28 -07:00
tunnel: Propagate ECT(1) when decapsulating as recommended by RFC6040
2020-05-14 07:58:22 +02:00
inet: frags: re-introduce skb coalescing for local delivery
2019-08-08 15:55:10 -07:00
dccp: Fix possible memleak in dccp_init and dccp_fini
2020-06-17 16:40:32 +02:00
ip: support SO_MARK cmsg
2019-09-13 21:44:19 +02:00
tcp: honor SO_PRIORITY in TIME_WAIT state
2019-09-27 12:05:02 +02:00
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-08 21:50:15 -08:00
inet: protect against too small mtu values.
2019-12-18 16:08:17 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
ipv6: Use global sernum for dst validation with nexthop objects
2020-05-14 07:58:20 +02:00
net: ipv6: do not consider routes via gateways for anycast address check
2020-04-21 09:04:45 +02:00
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
2019-06-18 20:48:45 -04:00
ipv4: nexthop version of fib_info_nh_uses_dev
2020-06-03 08:21:37 +02:00
route: Add multipath_hash in flowi_common to make user-define hash
2019-02-27 12:50:17 -08:00
ipvs: move old_secure_tcp into struct netns_ipvs
2019-10-24 11:56:02 +02:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2019-12-18 16:08:40 +01:00
inet: fix various use-after-free in defrags units
2019-06-19 11:37:47 -04:00
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2019-12-18 16:08:42 +01:00
bonding/alb: properly access headers in bond_alb_xmit()
2020-02-11 04:35:48 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
llc: fix sk_buff leak in llc_conn_service()
2019-10-08 13:23:05 -07:00
lwtunnel: Pass encap and encap type attributes to lwtunnel_fill_encap
2019-04-23 19:42:29 -07:00
mac80211: populate debugfs only after cfg80211 init
2020-04-29 16:33:18 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2019-06-05 17:36:38 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2019-06-05 17:36:38 +02:00
net: avoid potential false sharing in neighbor related code
2019-12-31 16:45:03 +01:00
net: add annotations on hh->hh_len lockless accesses
2020-01-09 10:20:06 +01:00
ipv6: Use global sernum for dst validation with nexthop objects
2020-05-14 07:58:20 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
netlink: Fix nlmsg_parse as a wrapper for strict message parsing
2019-08-13 20:37:16 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: netrom: Fix error cleanup path of nr_proto_init
2019-04-11 13:59:49 -07:00
ipv4: nexthop version of fib_info_nh_uses_dev
2020-06-03 08:21:37 +02:00
page_pool: do not release pool until inflight == 0.
2019-12-18 16:09:07 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net_sched: fix ops->bind_class() implementations
2020-02-01 09:34:38 +00:00
Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net
2019-09-17 23:51:10 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: sched: take reference to psample group in flow_action infra
2019-09-16 09:18:03 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
2019-10-09 21:34:31 -07:00
ipv4: Revert removal of rt_uses_gateway
2019-09-20 18:23:33 -07:00
net: Rename net/nexthop.h net/rtnh.h
2019-04-22 21:47:25 -07:00
net_sched: fix tcm_parent in tc filter dump
2020-05-20 08:20:07 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net/smc: add smcd support to the pnet table
2019-02-21 10:34:37 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: annotate lockless accesses to sk->sk_pacing_shift
2020-01-09 10:20:07 +01:00
udp: correct reuseport selection with connected sockets
2019-09-16 09:02:18 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp: fix SO_RCVLOWAT hangs with fat skbs
2020-05-20 08:20:10 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
bpf: Fix running sk_skb program types with ktls
2020-06-22 09:31:12 +02:00
udp: document udp_rcv_segment special case for looped packets
2020-05-10 10:31:33 +02:00
ipv6: Move ipv6 stubs to a separate header file
2019-03-29 10:53:45 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321
2019-06-05 17:37:05 +02:00
vxlan: add adjacent link to limit depth level
2019-10-24 14:53:49 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 268
2019-06-05 17:30:29 +02:00
xdp: page_pool related fix to cpumap
2019-06-19 11:23:13 -04:00
page_pool: do not release pool until inflight == 0.
2019-12-18 16:09:07 +01:00
xsk: add support to allow unaligned chunk placement
2019-08-31 01:08:26 +02:00
xfrm interface: fix management of phydev
2019-07-17 10:03:54 +02:00
e7b1564a24