1 /* SPDX-License-Identifier: GPL-2.0-or-later */
5 #define TCP_AO_KEY_ALIGN 1
6 #define __tcp_ao_key_align __aligned(TCP_AO_KEY_ALIGN)
10 #if IS_ENABLED(CONFIG_IPV6)
22 struct tcp_ao_counters
{
25 atomic64_t key_not_found
;
26 atomic64_t ao_required
;
27 atomic64_t dropped_icmp
;
31 struct hlist_node node
;
32 union tcp_ao_addr addr
;
33 u8 key
[TCP_AO_MAXKEYLEN
] __tcp_ao_key_align
;
34 unsigned int tcp_sigpool_id
;
35 unsigned int digest_size
;
50 static inline u8
*rcv_other_key(struct tcp_ao_key
*key
)
52 return key
->traffic_keys
;
55 static inline u8
*snd_other_key(struct tcp_ao_key
*key
)
57 return key
->traffic_keys
+ key
->digest_size
;
60 static inline int tcp_ao_maclen(const struct tcp_ao_key
*key
)
65 /* Use tcp_ao_len_aligned() for TCP header calculations */
66 static inline int tcp_ao_len(const struct tcp_ao_key
*key
)
68 return tcp_ao_maclen(key
) + sizeof(struct tcp_ao_hdr
);
71 static inline int tcp_ao_len_aligned(const struct tcp_ao_key
*key
)
73 return round_up(tcp_ao_len(key
), 4);
76 static inline unsigned int tcp_ao_digest_size(struct tcp_ao_key
*key
)
78 return key
->digest_size
;
81 static inline int tcp_ao_sizeof_key(const struct tcp_ao_key
*key
)
83 return sizeof(struct tcp_ao_key
) + (key
->digest_size
<< 1);
87 /* List of tcp_ao_key's */
88 struct hlist_head head
;
89 /* current_key and rnext_key aren't maintained on listen sockets.
90 * Their purpose is to cache keys on established connections,
91 * saving needless lookups. Never dereference any of them from
93 * ::current_key may change in RX to the key that was requested by
94 * the peer, please use READ_ONCE()/WRITE_ONCE() in order to avoid
96 * Do the same for ::rnext_key, if you don't hold socket lock
97 * (it's changed only by userspace request in setsockopt()).
99 struct tcp_ao_key
*current_key
;
100 struct tcp_ao_key
*rnext_key
;
101 struct tcp_ao_counters counters
;
107 /* Sequence Number Extension (SNE) are upper 4 bytes for SEQ,
108 * that protect TCP-AO connection from replayed old TCP segments.
110 * In order to get correct SNE, there's a helper tcp_ao_compute_sne().
111 * It needs SEQ basis to understand whereabouts are lower SEQ numbers.
112 * According to that basis vector, it can provide incremented SNE
113 * when SEQ rolls over or provide decremented SNE when there's
114 * a retransmitted segment from before-rolling over.
115 * - for request sockets such basis is rcv_isn/snt_isn, which seems
116 * good enough as it's unexpected to receive 4 Gbytes on reqsk.
117 * - for full sockets the basis is rcv_nxt/snd_una. snd_una is
118 * taken instead of snd_nxt as currently it's easier to track
119 * in tcp_snd_una_update(), rather than updating SNE in all
120 * WRITE_ONCE(tp->snd_nxt, ...)
121 * - for time-wait sockets the basis is tw_rcv_nxt/tw_snd_nxt.
122 * tw_snd_nxt is not expected to change, while tw_rcv_nxt may.
126 refcount_t refcnt
; /* Protects twsk destruction */
130 #ifdef CONFIG_TCP_MD5SIG
131 #include <linux/jump_label.h>
132 extern struct static_key_false_deferred tcp_md5_needed
;
133 #define static_branch_tcp_md5() static_branch_unlikely(&tcp_md5_needed.key)
135 #define static_branch_tcp_md5() false
138 /* TCP-AO structures and functions */
139 #include <linux/jump_label.h>
140 extern struct static_key_false_deferred tcp_ao_needed
;
141 #define static_branch_tcp_ao() static_branch_unlikely(&tcp_ao_needed.key)
143 #define static_branch_tcp_ao() false
146 static inline bool tcp_hash_should_produce_warnings(void)
148 return static_branch_tcp_md5() || static_branch_tcp_ao();
151 #define tcp_hash_fail(msg, family, skb, fmt, ...) \
153 const struct tcphdr *th = tcp_hdr(skb); \
155 char *f = hdr_flags; \
157 if (!tcp_hash_should_produce_warnings()) \
170 if ((family) == AF_INET) { \
171 net_info_ratelimited("%s for %pI4.%d->%pI4.%d [%s] " fmt "\n", \
172 msg, &ip_hdr(skb)->saddr, ntohs(th->source), \
173 &ip_hdr(skb)->daddr, ntohs(th->dest), \
174 hdr_flags, ##__VA_ARGS__); \
176 net_info_ratelimited("%s for [%pI6c].%d->[%pI6c].%d [%s]" fmt "\n", \
177 msg, &ipv6_hdr(skb)->saddr, ntohs(th->source), \
178 &ipv6_hdr(skb)->daddr, ntohs(th->dest), \
179 hdr_flags, ##__VA_ARGS__); \
184 /* TCP-AO structures and functions */
185 struct tcp4_ao_context
{
194 struct tcp6_ao_context
{
195 struct in6_addr saddr
;
196 struct in6_addr daddr
;
204 #define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \
205 TCPF_CLOSE | TCPF_CLOSE_WAIT | \
206 TCPF_LAST_ACK | TCPF_CLOSING)
208 int tcp_ao_transmit_skb(struct sock
*sk
, struct sk_buff
*skb
,
209 struct tcp_ao_key
*key
, struct tcphdr
*th
,
210 __u8
*hash_location
);
211 int tcp_ao_hash_skb(unsigned short int family
,
212 char *ao_hash
, struct tcp_ao_key
*key
,
213 const struct sock
*sk
, const struct sk_buff
*skb
,
214 const u8
*tkey
, int hash_offset
, u32 sne
);
215 int tcp_parse_ao(struct sock
*sk
, int cmd
, unsigned short int family
,
216 sockptr_t optval
, int optlen
);
217 struct tcp_ao_key
*tcp_ao_established_key(struct tcp_ao_info
*ao
,
218 int sndid
, int rcvid
);
219 int tcp_ao_copy_all_matching(const struct sock
*sk
, struct sock
*newsk
,
220 struct request_sock
*req
, struct sk_buff
*skb
,
222 int tcp_ao_calc_traffic_key(struct tcp_ao_key
*mkt
, u8
*key
, void *ctx
,
223 unsigned int len
, struct tcp_sigpool
*hp
);
224 void tcp_ao_destroy_sock(struct sock
*sk
, bool twsk
);
225 void tcp_ao_time_wait(struct tcp_timewait_sock
*tcptw
, struct tcp_sock
*tp
);
226 bool tcp_ao_ignore_icmp(const struct sock
*sk
, int family
, int type
, int code
);
227 int tcp_ao_get_mkts(struct sock
*sk
, sockptr_t optval
, sockptr_t optlen
);
228 int tcp_ao_get_sock_info(struct sock
*sk
, sockptr_t optval
, sockptr_t optlen
);
229 int tcp_ao_get_repair(struct sock
*sk
, sockptr_t optval
, sockptr_t optlen
);
230 int tcp_ao_set_repair(struct sock
*sk
, sockptr_t optval
, unsigned int optlen
);
231 enum skb_drop_reason
tcp_inbound_ao_hash(struct sock
*sk
,
232 const struct sk_buff
*skb
, unsigned short int family
,
233 const struct request_sock
*req
, int l3index
,
234 const struct tcp_ao_hdr
*aoh
);
235 u32
tcp_ao_compute_sne(u32 next_sne
, u32 next_seq
, u32 seq
);
236 struct tcp_ao_key
*tcp_ao_do_lookup(const struct sock
*sk
, int l3index
,
237 const union tcp_ao_addr
*addr
,
238 int family
, int sndid
, int rcvid
);
239 int tcp_ao_hash_hdr(unsigned short family
, char *ao_hash
,
240 struct tcp_ao_key
*key
, const u8
*tkey
,
241 const union tcp_ao_addr
*daddr
,
242 const union tcp_ao_addr
*saddr
,
243 const struct tcphdr
*th
, u32 sne
);
244 int tcp_ao_prepare_reset(const struct sock
*sk
, struct sk_buff
*skb
,
245 const struct tcp_ao_hdr
*aoh
, int l3index
, u32 seq
,
246 struct tcp_ao_key
**key
, char **traffic_key
,
247 bool *allocated_traffic_key
, u8
*keyid
, u32
*sne
);
249 /* ipv4 specific functions */
250 int tcp_v4_parse_ao(struct sock
*sk
, int cmd
, sockptr_t optval
, int optlen
);
251 struct tcp_ao_key
*tcp_v4_ao_lookup(const struct sock
*sk
, struct sock
*addr_sk
,
252 int sndid
, int rcvid
);
253 int tcp_v4_ao_synack_hash(char *ao_hash
, struct tcp_ao_key
*mkt
,
254 struct request_sock
*req
, const struct sk_buff
*skb
,
255 int hash_offset
, u32 sne
);
256 int tcp_v4_ao_calc_key_sk(struct tcp_ao_key
*mkt
, u8
*key
,
257 const struct sock
*sk
,
258 __be32 sisn
, __be32 disn
, bool send
);
259 int tcp_v4_ao_calc_key_rsk(struct tcp_ao_key
*mkt
, u8
*key
,
260 struct request_sock
*req
);
261 struct tcp_ao_key
*tcp_v4_ao_lookup_rsk(const struct sock
*sk
,
262 struct request_sock
*req
,
263 int sndid
, int rcvid
);
264 int tcp_v4_ao_hash_skb(char *ao_hash
, struct tcp_ao_key
*key
,
265 const struct sock
*sk
, const struct sk_buff
*skb
,
266 const u8
*tkey
, int hash_offset
, u32 sne
);
267 /* ipv6 specific functions */
268 int tcp_v6_ao_hash_pseudoheader(struct tcp_sigpool
*hp
,
269 const struct in6_addr
*daddr
,
270 const struct in6_addr
*saddr
, int nbytes
);
271 int tcp_v6_ao_calc_key_skb(struct tcp_ao_key
*mkt
, u8
*key
,
272 const struct sk_buff
*skb
, __be32 sisn
, __be32 disn
);
273 int tcp_v6_ao_calc_key_sk(struct tcp_ao_key
*mkt
, u8
*key
,
274 const struct sock
*sk
, __be32 sisn
,
275 __be32 disn
, bool send
);
276 int tcp_v6_ao_calc_key_rsk(struct tcp_ao_key
*mkt
, u8
*key
,
277 struct request_sock
*req
);
278 struct tcp_ao_key
*tcp_v6_ao_lookup(const struct sock
*sk
,
279 struct sock
*addr_sk
, int sndid
, int rcvid
);
280 struct tcp_ao_key
*tcp_v6_ao_lookup_rsk(const struct sock
*sk
,
281 struct request_sock
*req
,
282 int sndid
, int rcvid
);
283 int tcp_v6_ao_hash_skb(char *ao_hash
, struct tcp_ao_key
*key
,
284 const struct sock
*sk
, const struct sk_buff
*skb
,
285 const u8
*tkey
, int hash_offset
, u32 sne
);
286 int tcp_v6_parse_ao(struct sock
*sk
, int cmd
, sockptr_t optval
, int optlen
);
287 int tcp_v6_ao_synack_hash(char *ao_hash
, struct tcp_ao_key
*ao_key
,
288 struct request_sock
*req
, const struct sk_buff
*skb
,
289 int hash_offset
, u32 sne
);
290 void tcp_ao_established(struct sock
*sk
);
291 void tcp_ao_finish_connect(struct sock
*sk
, struct sk_buff
*skb
);
292 void tcp_ao_connect_init(struct sock
*sk
);
293 void tcp_ao_syncookie(struct sock
*sk
, const struct sk_buff
*skb
,
294 struct request_sock
*req
, unsigned short int family
);
295 #else /* CONFIG_TCP_AO */
297 static inline int tcp_ao_transmit_skb(struct sock
*sk
, struct sk_buff
*skb
,
298 struct tcp_ao_key
*key
, struct tcphdr
*th
,
304 static inline void tcp_ao_syncookie(struct sock
*sk
, const struct sk_buff
*skb
,
305 struct request_sock
*req
, unsigned short int family
)
309 static inline bool tcp_ao_ignore_icmp(const struct sock
*sk
, int family
,
315 static inline enum skb_drop_reason
tcp_inbound_ao_hash(struct sock
*sk
,
316 const struct sk_buff
*skb
, unsigned short int family
,
317 const struct request_sock
*req
, int l3index
,
318 const struct tcp_ao_hdr
*aoh
)
320 return SKB_NOT_DROPPED_YET
;
323 static inline struct tcp_ao_key
*tcp_ao_do_lookup(const struct sock
*sk
,
324 int l3index
, const union tcp_ao_addr
*addr
,
325 int family
, int sndid
, int rcvid
)
330 static inline void tcp_ao_destroy_sock(struct sock
*sk
, bool twsk
)
334 static inline void tcp_ao_established(struct sock
*sk
)
338 static inline void tcp_ao_finish_connect(struct sock
*sk
, struct sk_buff
*skb
)
342 static inline void tcp_ao_time_wait(struct tcp_timewait_sock
*tcptw
,
347 static inline void tcp_ao_connect_init(struct sock
*sk
)
351 static inline int tcp_ao_get_mkts(struct sock
*sk
, sockptr_t optval
, sockptr_t optlen
)
356 static inline int tcp_ao_get_sock_info(struct sock
*sk
, sockptr_t optval
, sockptr_t optlen
)
361 static inline int tcp_ao_get_repair(struct sock
*sk
,
362 sockptr_t optval
, sockptr_t optlen
)
367 static inline int tcp_ao_set_repair(struct sock
*sk
,
368 sockptr_t optval
, unsigned int optlen
)
374 #if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
375 int tcp_do_parse_auth_options(const struct tcphdr
*th
,
376 const u8
**md5_hash
, const u8
**ao_hash
);
378 static inline int tcp_do_parse_auth_options(const struct tcphdr
*th
,
379 const u8
**md5_hash
, const u8
**ao_hash
)
387 #endif /* _TCP_AO_H */