Re: [PATCH v3 5/8] net/handshake: Support KeyUpdate message types

[Hannes Reinecke]

On 10/3/25 06:31, alistair23@xxxxxxxxx wrote:
> From: Alistair Francis <alistair.francis@xxxxxxx>
>
> When reporting the msg-type to userspace let's also support reporting
> KeyUpdate events. This supports reporting a client/server event and if
> the other side requested a KeyUpdateRequest.
>
> Link: https://datatracker.ietf.org/doc/html/rfc8446#section-4.6.3
> Signed-off-by: Alistair Francis <alistair.francis@xxxxxxx>
> ---
> v3:
>   - Fixup yamllint and kernel-doc failures
>
>   Documentation/netlink/specs/handshake.yaml | 16 +++++++++-
>   Documentation/networking/tls-handshake.rst |  4 +--
>   drivers/nvme/host/tcp.c                    | 12 ++++++--
>   drivers/nvme/target/tcp.c                  | 11 +++++--
>   include/net/handshake.h                    | 10 +++++--
>   include/uapi/linux/handshake.h             | 13 +++++++++
>   net/handshake/tlshd.c                      | 34 ++++++++++++++++++----
>   7 files changed, 84 insertions(+), 16 deletions(-)
>
> diff --git a/Documentation/netlink/specs/handshake.yaml b/Documentation/netlink/specs/handshake.yaml
> index a273bc74d26f..c72ec8fa7d7a 100644
> --- a/Documentation/netlink/specs/handshake.yaml
> +++ b/Documentation/netlink/specs/handshake.yaml
> @@ -21,12 +21,18 @@ definitions:
>       type: enum
>       name: msg-type
>       value-start: 0
> -    entries: [unspec, clienthello, serverhello]
> +    entries: [unspec, clienthello, serverhello, clientkeyupdate,
> +              clientkeyupdaterequest, serverkeyupdate, serverkeyupdaterequest]
>     -
>       type: enum
>       name: auth
>       value-start: 0
>       entries: [unspec, unauth, psk, x509]
> +  -
> +    type: enum
> +    name: key-update-type
> +    value-start: 0
> +    entries: [unspec, send, received, received_request_update]
>   
>   attribute-sets:
>     -
> @@ -74,6 +80,13 @@ attribute-sets:
>         -
>           name: keyring
>           type: u32
> +      -
> +        name: key-update-request
> +        type: u32
> +        enum: key-update-type
> +      -
> +        name: key-serial
> +        type: u32
>     -
>       name: done
>       attributes:
> @@ -116,6 +129,7 @@ operations:
>               - certificate
>               - peername
>               - keyring
> +            - key-serial
>       -
>         name: done
>         doc: Handler reports handshake completion
> diff --git a/Documentation/networking/tls-handshake.rst b/Documentation/networking/tls-handshake.rst
> index d7287890056a..f858011e5bfb 100644
> --- a/Documentation/networking/tls-handshake.rst
> +++ b/Documentation/networking/tls-handshake.rst
> @@ -110,7 +110,7 @@ To initiate a client-side TLS handshake with a pre-shared key, use:
>   
>   .. code-block:: c
>   
> -  ret = tls_client_hello_psk(args, gfp_flags);
> +  ret = tls_client_hello_psk(args, gfp_flags, handshake_key_update_type);
>   
>   However, in this case, the consumer fills in the @ta_my_peerids array
>   with serial numbers of keys containing the peer identities it wishes
> @@ -140,7 +140,7 @@ or
>   
>   .. code-block:: c
>   
> -  ret = tls_server_hello_psk(args, gfp_flags);
> +  ret = tls_server_hello_psk(args, gfp_flags, handshake_key_update_type);
>   
>   The argument structure is filled in as above.
>   
I would very much prefer to have our own function here; currently the
'tls_server_hello_psk' is issuing a 'ServerHello' command, the
'tls_client_hello_psk' is issuing a 'ClientHello' command.
Consequently I'd rather have 'tls_client_keyupdate_psk()' /
'tls_server_keyupdate_psk()' functions to indicate that we're sending
a KeyUpdate command instead of overloading the existing
commands.

Cheers,

Hannes
--
Dr. Hannes Reinecke                  Kernel Storage Architect
hare@xxxxxxx                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich