diff options
| author | Dave Watson <davejwatson@fb.com> | 2018-03-22 18:10:35 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-03-23 17:25:54 +0100 |
| commit | c46234ebb4d1eee5e09819f49169e51cfc6eb909 (patch) | |
| tree | 6f1fbbe3cd74ec939633db5a9e2d6b80ffffaf16 /net/tls/Kconfig | |
| parent | tls: Refactor variable names (diff) | |
| download | linux-c46234ebb4d1eee5e09819f49169e51cfc6eb909.tar.xz linux-c46234ebb4d1eee5e09819f49169e51cfc6eb909.zip | |
tls: RX path for ktls
Add rx path for tls software implementation.
recvmsg, splice_read, and poll implemented.
An additional sockopt TLS_RX is added, with the same interface as
TLS_TX. Either TLX_RX or TLX_TX may be provided separately, or
together (with two different setsockopt calls with appropriate keys).
Control messages are passed via CMSG in a similar way to transmit.
If no cmsg buffer is passed, then only application data records
will be passed to userspace, and EIO is returned for other types of
alerts.
EBADMSG is passed for decryption errors, and EMSGSIZE is passed for
framing too big, and EBADMSG for framing too small (matching openssl
semantics). EINVAL is returned for TLS versions that do not match the
original setsockopt call. All are unrecoverable.
strparser is used to parse TLS framing. Decryption is done directly
in to userspace buffers if they are large enough to support it, otherwise
sk_cow_data is called (similar to ipsec), and buffers are decrypted in
place and copied. splice_read always decrypts in place, since no
buffers are provided to decrypt in to.
sk_poll is overridden, and only returns POLLIN if a full TLS message is
received. Otherwise we wait for strparser to finish reading a full frame.
Actual decryption is only done during recvmsg or splice_read calls.
Signed-off-by: Dave Watson <davejwatson@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tls/Kconfig')
| -rw-r--r-- | net/tls/Kconfig | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/tls/Kconfig b/net/tls/Kconfig index eb583038c67e..89b8745a986f 100644 --- a/net/tls/Kconfig +++ b/net/tls/Kconfig @@ -7,6 +7,7 @@ config TLS select CRYPTO select CRYPTO_AES select CRYPTO_GCM + select STREAM_PARSER default n ---help--- Enable kernel support for TLS protocol. This allows symmetric |