netdev - Re: [PATCH] net/handshake: Add new parameter 'HANDSHAKE_A_ACCEPT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <63db3af9-3cae-4a2e-829d-1896b4d94b14@oracle.com>
Date: Tue, 1 Jul 2025 11:16:11 -0400
From: Chuck Lever <chuck.lever@...cle.com>
To: Hannes Reinecke <hare@...nel.org>
Cc: kernel-tls-handshake@...ts.linux.dev, Jakub Kicinski <kuba@...nel.org>,
        netdev@...r.kernel.org
Subject: Re: [PATCH] net/handshake: Add new parameter
 'HANDSHAKE_A_ACCEPT_KEYRING'

On 7/1/25 10:46 AM, Hannes Reinecke wrote:
> Add a new netlink parameter 'HANDSHAKE_A_ACCEPT_KEYRING' to provide
> the serial number of the keyring to use.
> 
> Signed-off-by: Hannes Reinecke <hare@...nel.org>
> ---
>  Documentation/netlink/specs/handshake.yaml | 4 ++++
>  include/uapi/linux/handshake.h             | 1 +
>  net/handshake/tlshd.c                      | 6 ++++++
>  3 files changed, 11 insertions(+)
> 
> diff --git a/Documentation/netlink/specs/handshake.yaml b/Documentation/netlink/specs/handshake.yaml
> index b934cc513e3d..a8be0b54755b 100644
> --- a/Documentation/netlink/specs/handshake.yaml
> +++ b/Documentation/netlink/specs/handshake.yaml
> @@ -71,6 +71,9 @@ attribute-sets:
>        -
>          name: peername
>          type: string
> +      -
> +        name: keyring
> +        type: u32
>    -
>      name: done
>      attributes:
> @@ -109,6 +112,7 @@ operations:
>              - peer-identity
>              - certificate
>              - peername
> +            - keyring
>      -
>        name: done
>        doc: Handler reports handshake completion
> diff --git a/include/uapi/linux/handshake.h b/include/uapi/linux/handshake.h
> index 3d7ea58778c9..662e7de46c54 100644
> --- a/include/uapi/linux/handshake.h
> +++ b/include/uapi/linux/handshake.h
> @@ -45,6 +45,7 @@ enum {
>  	HANDSHAKE_A_ACCEPT_PEER_IDENTITY,
>  	HANDSHAKE_A_ACCEPT_CERTIFICATE,
>  	HANDSHAKE_A_ACCEPT_PEERNAME,
> +	HANDSHAKE_A_ACCEPT_KEYRING,
>  
>  	__HANDSHAKE_A_ACCEPT_MAX,
>  	HANDSHAKE_A_ACCEPT_MAX = (__HANDSHAKE_A_ACCEPT_MAX - 1)
> diff --git a/net/handshake/tlshd.c b/net/handshake/tlshd.c
> index d6f52839827e..081093dfd553 100644
> --- a/net/handshake/tlshd.c
> +++ b/net/handshake/tlshd.c
> @@ -230,6 +230,12 @@ static int tls_handshake_accept(struct handshake_req *req,
>  		if (ret < 0)
>  			goto out_cancel;
>  	}
> +	if (treq->th_keyring) {
> +		ret = nla_put_u32(msg, HANDSHAKE_A_ACCEPT_KEYRING,
> +				  treq->th_keyring);
> +		if (ret < 0)
> +			goto out_cancel;
> +	}
>  
>  	ret = nla_put_u32(msg, HANDSHAKE_A_ACCEPT_AUTH_MODE,
>  			  treq->th_auth_mode);

Reviewed-by: Chuck Lever <chuck.lever@...cle.com>

-- 
Chuck Lever