linux-kernel - Re: [PATCH] net/tls: allow limiting maximum record size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7d71d5d3c708451372d2cd0580951997ccc4b883.camel@gmail.com>
Date: Tue, 02 Sep 2025 07:46:55 +1000
From: Wilfred Mallawa <wilfred.opensource@...il.com>
To: Simon Horman <horms@...nel.org>
Cc: chuck.lever@...cle.com, kernel-tls-handshake@...ts.linux.dev, "David S .
 Miller" <davem@...emloft.net>, donald.hunter@...il.com,
 edumazet@...gle.com, hare@...nel.org,  Jakub Kicinski	 <kuba@...nel.org>,
 john.fastabend@...il.com, linux-kernel@...r.kernel.org, 
	netdev@...r.kernel.org, pabeni@...hat.com, Hannes Reinecke <hare@...e.de>
Subject: Re: [PATCH] net/tls: allow limiting maximum record size

On Mon, 2025-09-01 at 17:44 +0100, Simon Horman wrote:
> 
[snip]
> 
> > diff --git a/Documentation/netlink/specs/handshake.yaml
> > b/Documentation/netlink/specs/handshake.yaml
> > index 95c3fade7a8d..0dbe5d0c8507 100644
> > --- a/Documentation/netlink/specs/handshake.yaml
> > +++ b/Documentation/netlink/specs/handshake.yaml
> > @@ -87,6 +87,9 @@ attribute-sets:
> >          name: remote-auth
> >          type: u32
> >          multi-attr: true
> > +      -
> > +          name: record-size-limit
> > +          type: u32
> 
> nit: This indentation is not consistent with the existing spec.
> 
> >  
> >  operations:
> >    list:
> 
> And I believe you are missing the following hunk:
> 
> @@ -126,6 +126,7 @@ operations:
>              - status
>              - sockfd
>              - remote-auth
> +            - record-size-limit
> 
>  mcast-groups:
>    list:
> 
> ...
Ah good catch thanks!
> 
> > diff --git a/net/handshake/genl.c b/net/handshake/genl.c
> > index f55d14d7b726..fb8962ae7131 100644
> > --- a/net/handshake/genl.c
> > +++ b/net/handshake/genl.c
> > @@ -16,10 +16,11 @@ static const struct nla_policy
> > handshake_accept_nl_policy[HANDSHAKE_A_ACCEPT_HAN
> >  };
> >  
> >  /* HANDSHAKE_CMD_DONE - do */
> > -static const struct nla_policy
> > handshake_done_nl_policy[HANDSHAKE_A_DONE_REMOTE_AUTH + 1] = {
> > +static const struct nla_policy
> > handshake_done_nl_policy[__HANDSHAKE_A_DONE_MAX] = {
> 
> Although it's necessary to update this file in patches,
> it is automatically generated using: make -C tools/net/ynl/
> 
> Accordingly, although the meaning is the same, the line above should
> be:
> 
> static const struct nla_policy
> handshake_done_nl_policy[HANDSHAKE_A_DONE_RECORD_SIZE_LIMIT + 1] = {
> 
> >  	[HANDSHAKE_A_DONE_STATUS] = { .type = NLA_U32, },
> >  	[HANDSHAKE_A_DONE_SOCKFD] = { .type = NLA_S32, },
> >  	[HANDSHAKE_A_DONE_REMOTE_AUTH] = { .type = NLA_U32, },
> > +	[HANDSHAKE_A_DONE_RECORD_SIZE_LIMIT] = { .type = NLA_U32,
> > },
> >  };
> >  
> >  /* Ops table for handshake */
> > @@ -35,7 +36,7 @@ static const struct genl_split_ops
> > handshake_nl_ops[] = {
> >  		.cmd		= HANDSHAKE_CMD_DONE,
> >  		.doit		= handshake_nl_done_doit,
> >  		.policy		=
> > handshake_done_nl_policy,
> > -		.maxattr	= HANDSHAKE_A_DONE_REMOTE_AUTH,
> > +		.maxattr	= HANDSHAKE_A_DONE_MAX,
> 
> And this one should be:
> 
> 		.maxattr        =
> HANDSHAKE_A_DONE_RECORD_SIZE_LIMIT,
> 
> >  		.flags		= GENL_CMD_CAP_DO,
> >  	},
> >  };
Okay did not know I could "make -C tools/net/ynl/" to generate this.
Will use that going forward. Thanks for the feedback!

Regards,
Wilfred