net: tls: fix marking packets as decrypted

BugLink: https://bugs.launchpad.net/bugs/2074091

[ Upstream commit a535d59432370343058755100ee75ab03c0e3f91 ]

For TLS offload we mark packets with skb->decrypted to make sure
they don't escape the host without getting encrypted first.
The crypto state lives in the socket, so it may get detached
by a call to skb_orphan(). As a safety check - the egress path
drops all packets with skb->decrypted and no "crypto-safe" socket.

The skb marking was added to sendpage only (and not sendmsg),
because tls_device injected data into the TCP stack using sendpage.
This special case was missed when sendpage got folded into sendmsg.

Fixes: c5c37af6ec ("tcp: Convert do_tcp_sendpages() to use MSG_SPLICE_PAGES")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20240530232607.82686-1-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Portia Stephens <portia.stephens@canonical.com>
Signed-off-by: Roxana Nicolescu <roxana.nicolescu@canonical.com>

This commit is contained in:

Jakub Kicinski

2024-05-30 16:26:07 -07:00

committed by

Roxana Nicolescu

parent 6578e8f7ca

commit ea08e8fa45

1 changed files with 3 additions and 0 deletions

									
										net/ipv4/tcp.c
									
		+3
		
												View File
												
				@@ -1158,6 +1158,9 @@ new_segment:

							process_backlog++;

				#ifdef CONFIG_SKB_DECRYPTED

							skb->decrypted = !!(flags & MSG_SENDPAGE_DECRYPTED);

				#endif

							tcp_skb_entail(sk, skb);

							copy = size_goal;