netlink: specs: handshake: type the remaining key serials s32

include/linux/key.h has "typedef int32_t key_serial_t" and commit
160f404495 ("handshake: Fix sign of key_serial_t fields") converted
x509.cert and x509.privkey to s32, but accept.peer-identity,
accept.keyring and done.remote-auth were left as u32 - the same
quantity typed both ways inside one family, and a generated user space
struct with __s32 cert next to __u32 keyring. All three come from
key_serial_t storage in net/handshake/tlshd.c (treq->th_peerid[],
treq->th_keyring), and special keyrings are legitimately negative
(KEY_SPEC_PROCESS_KEYRING is -2).

NLA_U32 and NLA_S32 have the same length and no range check here, so
the only wire effect is how the value is printed.

Acked-by: Chuck Lever <cel@kernel.org>
Reviewed-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
Link: https://patch.msgid.link/20260904190410.3864660-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Documentation/netlink/specs/handshake.yaml

@@ -67,7 +67,7 @@ attribute-sets:
         enum: auth
       -
         name: peer-identity
-        type: u32
+        type: s32
         multi-attr: true
       -
         name: certificate
@@ -79,7 +79,7 @@ attribute-sets:
         type: string
       -
         name: keyring
-        type: u32
+        type: s32
   -
     name: done
     attributes:
@@ -93,7 +93,7 @@ attribute-sets:
         type: s32
       -
         name: remote-auth
-        type: u32
+        type: s32
         multi-attr: true
 
 operations:

net/handshake/genl.c

@@ -21,7 +21,7 @@ static const struct nla_policy handshake_accept_nl_policy[HANDSHAKE_A_ACCEPT_HAN
 static const struct nla_policy handshake_done_nl_policy[HANDSHAKE_A_DONE_REMOTE_AUTH + 1] = {
 	[HANDSHAKE_A_DONE_STATUS] = NLA_POLICY_MAX(NLA_U32, MAX_ERRNO),
 	[HANDSHAKE_A_DONE_SOCKFD] = { .type = NLA_S32, },
-	[HANDSHAKE_A_DONE_REMOTE_AUTH] = { .type = NLA_U32, },
+	[HANDSHAKE_A_DONE_REMOTE_AUTH] = { .type = NLA_S32, },
 };
 
 /* Ops table for handshake */