Re: [PATCH net-next v5 5/6] tls: send a KeyUpdate at the record limit and on request

[Martin Belanger]

On 11/4/26 16:43, sashiko-bot@xxxxxxxxxx wrote:
> > +   ret = tls_encrypt_async_wait(ctx);
> > +   if (!ret)
> > +           ret = tls_keyupdate_rekey(sk, 1);
>
> [Severity: Medium]
> As reported by Sashiko on v4 [1], can tls_tx_key_update() ignore fatal
> transmission errors and rotate the TX key anyway when 
tls_tx_records() fails
> with -EPIPE or -ECONNRESET?

Yes, but this is not specific to KeyUpdate. After shutdown(SHUT_WR),
send() on a kTLS socket with no KeyUpdate also returns the full
length. I tested this with TLS 1.3 AES-GCM. As I read the code, the
KeyUpdate record then stays queued and TCP does not send it, so the
peer never sees a record with the next key.

This corrects my note in the v2 changes, "The next call reports the
error". In the same test, the next send() also returned success.

> [Severity: High]
> As reported by Sashiko on v4 [2], how is the KeyUpdate state in struct
> tls_context synchronized when sk_stream_wait_memory() drops lock_sock(sk)
> during a send or TLS_TX_KEY_UPDATE?

No change, for the reasons in the v4 changes. I checked these points
by reading the code.

Points 1 and 2 need a TLS_TX or TLS_RX setsockopt() during a blocked
sendmsg(), which is an application error.

Point 3: tx_key_update_reply stays set after the update_requested
KeyUpdate, so the reply still goes out before the next Application
Data record.

Point 4: a record that was already being written can go out before
the reply. RFC 9846 section 4.7.3 allows this for records in flight.

Martin