diff options
| author | Ondrej Mosnacek <omosnace@redhat.com> | 2019-07-09 13:11:24 +0200 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2019-07-26 22:08:02 +1000 |
| commit | 91b05a7e7d8033a90a64f5fc0e3808db423e420a (patch) | |
| tree | b883a067a751829e504a48127b80546e8e22efc6 /include/net | |
| parent | 31fb084c4eb556fac30115d99bc518c7944887d2 (diff) | |
| download | linux-91b05a7e7d8033a90a64f5fc0e3808db423e420a.tar.bz2 | |
crypto: user - make NETLINK_CRYPTO work inside netns
Currently, NETLINK_CRYPTO works only in the init network namespace. It
doesn't make much sense to cut it out of the other network namespaces,
so do the minor plumbing work necessary to make it work in any network
namespace. Code inspired by net/core/sock_diag.c.
Tested using kcapi-dgst from libkcapi [1]:
Before:
# unshare -n kcapi-dgst -c sha256 </dev/null | wc -c
libkcapi - Error: Netlink error: sendmsg failed
libkcapi - Error: Netlink error: sendmsg failed
libkcapi - Error: NETLINK_CRYPTO: cannot obtain cipher information for hmac(sha512) (is required crypto_user.c patch missing? see documentation)
0
After:
# unshare -n kcapi-dgst -c sha256 </dev/null | wc -c
32
[1] https://github.com/smuellerDD/libkcapi
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'include/net')
| -rw-r--r-- | include/net/net_namespace.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h index 4a9da951a794..85bc1de5dece 100644 --- a/include/net/net_namespace.h +++ b/include/net/net_namespace.h @@ -171,6 +171,9 @@ struct net { #ifdef CONFIG_XDP_SOCKETS struct netns_xdp xdp; #endif +#if IS_ENABLED(CONFIG_CRYPTO_USER) + struct sock *crypto_nlsk; +#endif struct sock *diag_nlsk; atomic_t fnhe_genid; } __randomize_layout; |