mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Chuck LeverandJakub Kicinski
81246a6530
ACCEPT and DONE are the two downcalls of the handshake genl
family, both intended for use by the trusted handshake agent
(tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has
no privilege check at all.
The fd-lookup in handshake_nl_done_doit() only confirms that
some pending handshake request exists for the supplied sockfd;
it does not authenticate the sender. An unprivileged process
that guesses or observes a valid sockfd can therefore submit
a DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel
consumer to proceed as if the handshake succeeded. A non-zero
status on a forged DONE tears down a legitimate in-flight
handshake before tlshd can report its real result.
Fixes: 3b3009ea8a ("net/handshake: Create a NETLINK service for handling handshake requests")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Link: https://patch.msgid.link/20260609141831.90694-1-cel@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
142 lines
2.6 KiB
YAML
142 lines
2.6 KiB
YAML
# SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause)
|
|
#
|
|
# Author: Chuck Lever <chuck.lever@oracle.com>
|
|
#
|
|
# Copyright (c) 2023, Oracle and/or its affiliates.
|
|
#
|
|
---
|
|
name: handshake
|
|
|
|
protocol: genetlink
|
|
|
|
doc: Netlink protocol to request a transport layer security handshake.
|
|
|
|
definitions:
|
|
-
|
|
type: const
|
|
name: max-errno
|
|
value: 4095
|
|
header: linux/err.h
|
|
scope: kernel
|
|
-
|
|
type: enum
|
|
name: handler-class
|
|
value-start: 0
|
|
entries: [none, tlshd, max]
|
|
-
|
|
type: enum
|
|
name: msg-type
|
|
value-start: 0
|
|
entries: [unspec, clienthello, serverhello]
|
|
-
|
|
type: enum
|
|
name: auth
|
|
value-start: 0
|
|
entries: [unspec, unauth, psk, x509]
|
|
|
|
attribute-sets:
|
|
-
|
|
name: x509
|
|
attributes:
|
|
-
|
|
name: cert
|
|
type: s32
|
|
-
|
|
name: privkey
|
|
type: s32
|
|
-
|
|
name: accept
|
|
attributes:
|
|
-
|
|
name: sockfd
|
|
type: s32
|
|
-
|
|
name: handler-class
|
|
type: u32
|
|
enum: handler-class
|
|
-
|
|
name: message-type
|
|
type: u32
|
|
enum: msg-type
|
|
-
|
|
name: timeout
|
|
type: u32
|
|
-
|
|
name: auth-mode
|
|
type: u32
|
|
enum: auth
|
|
-
|
|
name: peer-identity
|
|
type: u32
|
|
multi-attr: true
|
|
-
|
|
name: certificate
|
|
type: nest
|
|
nested-attributes: x509
|
|
multi-attr: true
|
|
-
|
|
name: peername
|
|
type: string
|
|
-
|
|
name: keyring
|
|
type: u32
|
|
-
|
|
name: done
|
|
attributes:
|
|
-
|
|
name: status
|
|
type: u32
|
|
checks:
|
|
max: max-errno
|
|
-
|
|
name: sockfd
|
|
type: s32
|
|
-
|
|
name: remote-auth
|
|
type: u32
|
|
multi-attr: true
|
|
|
|
operations:
|
|
list:
|
|
-
|
|
name: ready
|
|
doc: Notify handlers that a new handshake request is waiting
|
|
notify: accept
|
|
-
|
|
name: accept
|
|
doc: Handler retrieves next queued handshake request
|
|
attribute-set: accept
|
|
flags: [admin-perm]
|
|
do:
|
|
request:
|
|
attributes:
|
|
- handler-class
|
|
reply:
|
|
attributes:
|
|
- sockfd
|
|
- message-type
|
|
- timeout
|
|
- auth-mode
|
|
- peer-identity
|
|
- certificate
|
|
- peername
|
|
- keyring
|
|
-
|
|
name: done
|
|
doc: Handler reports handshake completion
|
|
attribute-set: done
|
|
flags: [admin-perm]
|
|
do:
|
|
request:
|
|
attributes:
|
|
- status
|
|
- sockfd
|
|
- remote-auth
|
|
|
|
mcast-groups:
|
|
list:
|
|
-
|
|
name: none
|
|
-
|
|
name: tlshd
|