1 /* SPDX-License-Identifier: GPL-2.0-or-later */ 2 #ifndef _TCP_AO_H 3 #define _TCP_AO_H 4 5 #define TCP_AO_KEY_ALIGN 1 6 #define __tcp_ao_key_align __aligned(TCP_AO_KEY_ALIGN) 7 8 union tcp_ao_addr { 9 struct in_addr a4; 10 #if IS_ENABLED(CONFIG_IPV6) 11 struct in6_addr a6; 12 #endif 13 }; 14 15 struct tcp_ao_hdr { 16 u8 kind; 17 u8 length; 18 u8 keyid; 19 u8 rnext_keyid; 20 }; 21 22 struct tcp_ao_counters { 23 atomic64_t pkt_good; 24 atomic64_t pkt_bad; 25 atomic64_t key_not_found; 26 atomic64_t ao_required; 27 atomic64_t dropped_icmp; 28 }; 29 30 struct tcp_ao_key { 31 struct hlist_node node; 32 union tcp_ao_addr addr; 33 u8 key[TCP_AO_MAXKEYLEN] __tcp_ao_key_align; 34 unsigned int tcp_sigpool_id; 35 unsigned int digest_size; 36 int l3index; 37 u8 prefixlen; 38 u8 family; 39 u8 keylen; 40 u8 keyflags; 41 u8 sndid; 42 u8 rcvid; 43 u8 maclen; 44 struct rcu_head rcu; 45 atomic64_t pkt_good; 46 atomic64_t pkt_bad; 47 u8 traffic_keys[]; 48 }; 49 50 static inline u8 *rcv_other_key(struct tcp_ao_key *key) 51 { 52 return key->traffic_keys; 53 } 54 55 static inline u8 *snd_other_key(struct tcp_ao_key *key) 56 { 57 return key->traffic_keys + key->digest_size; 58 } 59 60 static inline int tcp_ao_maclen(const struct tcp_ao_key *key) 61 { 62 return key->maclen; 63 } 64 65 /* Use tcp_ao_len_aligned() for TCP header calculations */ 66 static inline int tcp_ao_len(const struct tcp_ao_key *key) 67 { 68 return tcp_ao_maclen(key) + sizeof(struct tcp_ao_hdr); 69 } 70 71 static inline int tcp_ao_len_aligned(const struct tcp_ao_key *key) 72 { 73 return round_up(tcp_ao_len(key), 4); 74 } 75 76 static inline unsigned int tcp_ao_digest_size(struct tcp_ao_key *key) 77 { 78 return key->digest_size; 79 } 80 81 static inline int tcp_ao_sizeof_key(const struct tcp_ao_key *key) 82 { 83 return sizeof(struct tcp_ao_key) + (key->digest_size << 1); 84 } 85 86 struct tcp_ao_info { 87 /* List of tcp_ao_key's */ 88 struct hlist_head head; 89 /* current_key and rnext_key are maintained on sockets 90 * in TCP_AO_ESTABLISHED states. 91 * Their purpose is to cache keys on established connections, 92 * saving needless lookups. Never dereference any of them from 93 * listen sockets. 94 * ::current_key may change in RX to the key that was requested by 95 * the peer, please use READ_ONCE()/WRITE_ONCE() in order to avoid 96 * load/store tearing. 97 * Do the same for ::rnext_key, if you don't hold socket lock 98 * (it's changed only by userspace request in setsockopt()). 99 */ 100 struct tcp_ao_key *current_key; 101 struct tcp_ao_key *rnext_key; 102 struct tcp_ao_counters counters; 103 u32 ao_required :1, 104 accept_icmps :1, 105 __unused :30; 106 __be32 lisn; 107 __be32 risn; 108 /* Sequence Number Extension (SNE) are upper 4 bytes for SEQ, 109 * that protect TCP-AO connection from replayed old TCP segments. 110 * See RFC5925 (6.2). 111 * In order to get correct SNE, there's a helper tcp_ao_compute_sne(). 112 * It needs SEQ basis to understand whereabouts are lower SEQ numbers. 113 * According to that basis vector, it can provide incremented SNE 114 * when SEQ rolls over or provide decremented SNE when there's 115 * a retransmitted segment from before-rolling over. 116 * - for request sockets such basis is rcv_isn/snt_isn, which seems 117 * good enough as it's unexpected to receive 4 Gbytes on reqsk. 118 * - for full sockets the basis is rcv_nxt/snd_una. snd_una is 119 * taken instead of snd_nxt as currently it's easier to track 120 * in tcp_snd_una_update(), rather than updating SNE in all 121 * WRITE_ONCE(tp->snd_nxt, ...) 122 * - for time-wait sockets the basis is tw_rcv_nxt/tw_snd_nxt. 123 * tw_snd_nxt is not expected to change, while tw_rcv_nxt may. 124 */ 125 u32 snd_sne; 126 u32 rcv_sne; 127 refcount_t refcnt; /* Protects twsk destruction */ 128 struct rcu_head rcu; 129 }; 130 131 #ifdef CONFIG_TCP_MD5SIG 132 #include <linux/jump_label.h> 133 extern struct static_key_false_deferred tcp_md5_needed; 134 #define static_branch_tcp_md5() static_branch_unlikely(&tcp_md5_needed.key) 135 #else 136 #define static_branch_tcp_md5() false 137 #endif 138 #ifdef CONFIG_TCP_AO 139 /* TCP-AO structures and functions */ 140 #include <linux/jump_label.h> 141 extern struct static_key_false_deferred tcp_ao_needed; 142 #define static_branch_tcp_ao() static_branch_unlikely(&tcp_ao_needed.key) 143 #else 144 #define static_branch_tcp_ao() false 145 #endif 146 147 static inline bool tcp_hash_should_produce_warnings(void) 148 { 149 return static_branch_tcp_md5() || static_branch_tcp_ao(); 150 } 151 152 #define tcp_hash_fail(msg, family, skb, fmt, ...) \ 153 do { \ 154 const struct tcphdr *th = tcp_hdr(skb); \ 155 char hdr_flags[6]; \ 156 char *f = hdr_flags; \ 157 \ 158 if (!tcp_hash_should_produce_warnings()) \ 159 break; \ 160 if (th->fin) \ 161 *f++ = 'F'; \ 162 if (th->syn) \ 163 *f++ = 'S'; \ 164 if (th->rst) \ 165 *f++ = 'R'; \ 166 if (th->psh) \ 167 *f++ = 'P'; \ 168 if (th->ack) \ 169 *f++ = '.'; \ 170 *f = 0; \ 171 if ((family) == AF_INET) { \ 172 net_info_ratelimited("%s for %pI4.%d->%pI4.%d [%s] " fmt "\n", \ 173 msg, &ip_hdr(skb)->saddr, ntohs(th->source), \ 174 &ip_hdr(skb)->daddr, ntohs(th->dest), \ 175 hdr_flags, ##__VA_ARGS__); \ 176 } else { \ 177 net_info_ratelimited("%s for [%pI6c].%d->[%pI6c].%d [%s]" fmt "\n", \ 178 msg, &ipv6_hdr(skb)->saddr, ntohs(th->source), \ 179 &ipv6_hdr(skb)->daddr, ntohs(th->dest), \ 180 hdr_flags, ##__VA_ARGS__); \ 181 } \ 182 } while (0) 183 184 #ifdef CONFIG_TCP_AO 185 /* TCP-AO structures and functions */ 186 struct tcp4_ao_context { 187 __be32 saddr; 188 __be32 daddr; 189 __be16 sport; 190 __be16 dport; 191 __be32 sisn; 192 __be32 disn; 193 }; 194 195 struct tcp6_ao_context { 196 struct in6_addr saddr; 197 struct in6_addr daddr; 198 __be16 sport; 199 __be16 dport; 200 __be32 sisn; 201 __be32 disn; 202 }; 203 204 struct tcp_sigpool; 205 /* Established states are fast-path and there always is current_key/rnext_key */ 206 #define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \ 207 TCPF_CLOSE_WAIT | TCPF_LAST_ACK | TCPF_CLOSING) 208 209 int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb, 210 struct tcp_ao_key *key, struct tcphdr *th, 211 __u8 *hash_location); 212 int tcp_ao_hash_skb(unsigned short int family, 213 char *ao_hash, struct tcp_ao_key *key, 214 const struct sock *sk, const struct sk_buff *skb, 215 const u8 *tkey, int hash_offset, u32 sne); 216 int tcp_parse_ao(struct sock *sk, int cmd, unsigned short int family, 217 sockptr_t optval, int optlen); 218 struct tcp_ao_key *tcp_ao_established_key(struct tcp_ao_info *ao, 219 int sndid, int rcvid); 220 int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk, 221 struct request_sock *req, struct sk_buff *skb, 222 int family); 223 int tcp_ao_calc_traffic_key(struct tcp_ao_key *mkt, u8 *key, void *ctx, 224 unsigned int len, struct tcp_sigpool *hp); 225 void tcp_ao_destroy_sock(struct sock *sk, bool twsk); 226 void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp); 227 bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code); 228 int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen); 229 int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen); 230 int tcp_ao_get_repair(struct sock *sk, sockptr_t optval, sockptr_t optlen); 231 int tcp_ao_set_repair(struct sock *sk, sockptr_t optval, unsigned int optlen); 232 enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk, 233 const struct sk_buff *skb, unsigned short int family, 234 const struct request_sock *req, int l3index, 235 const struct tcp_ao_hdr *aoh); 236 u32 tcp_ao_compute_sne(u32 next_sne, u32 next_seq, u32 seq); 237 struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk, int l3index, 238 const union tcp_ao_addr *addr, 239 int family, int sndid, int rcvid); 240 int tcp_ao_hash_hdr(unsigned short family, char *ao_hash, 241 struct tcp_ao_key *key, const u8 *tkey, 242 const union tcp_ao_addr *daddr, 243 const union tcp_ao_addr *saddr, 244 const struct tcphdr *th, u32 sne); 245 int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb, 246 const struct tcp_ao_hdr *aoh, int l3index, u32 seq, 247 struct tcp_ao_key **key, char **traffic_key, 248 bool *allocated_traffic_key, u8 *keyid, u32 *sne); 249 250 /* ipv4 specific functions */ 251 int tcp_v4_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen); 252 struct tcp_ao_key *tcp_v4_ao_lookup(const struct sock *sk, struct sock *addr_sk, 253 int sndid, int rcvid); 254 int tcp_v4_ao_synack_hash(char *ao_hash, struct tcp_ao_key *mkt, 255 struct request_sock *req, const struct sk_buff *skb, 256 int hash_offset, u32 sne); 257 int tcp_v4_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key, 258 const struct sock *sk, 259 __be32 sisn, __be32 disn, bool send); 260 int tcp_v4_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key, 261 struct request_sock *req); 262 struct tcp_ao_key *tcp_v4_ao_lookup_rsk(const struct sock *sk, 263 struct request_sock *req, 264 int sndid, int rcvid); 265 int tcp_v4_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key, 266 const struct sock *sk, const struct sk_buff *skb, 267 const u8 *tkey, int hash_offset, u32 sne); 268 /* ipv6 specific functions */ 269 int tcp_v6_ao_hash_pseudoheader(struct tcp_sigpool *hp, 270 const struct in6_addr *daddr, 271 const struct in6_addr *saddr, int nbytes); 272 int tcp_v6_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key, 273 const struct sk_buff *skb, __be32 sisn, __be32 disn); 274 int tcp_v6_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key, 275 const struct sock *sk, __be32 sisn, 276 __be32 disn, bool send); 277 int tcp_v6_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key, 278 struct request_sock *req); 279 struct tcp_ao_key *tcp_v6_ao_lookup(const struct sock *sk, 280 struct sock *addr_sk, int sndid, int rcvid); 281 struct tcp_ao_key *tcp_v6_ao_lookup_rsk(const struct sock *sk, 282 struct request_sock *req, 283 int sndid, int rcvid); 284 int tcp_v6_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key, 285 const struct sock *sk, const struct sk_buff *skb, 286 const u8 *tkey, int hash_offset, u32 sne); 287 int tcp_v6_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen); 288 int tcp_v6_ao_synack_hash(char *ao_hash, struct tcp_ao_key *ao_key, 289 struct request_sock *req, const struct sk_buff *skb, 290 int hash_offset, u32 sne); 291 void tcp_ao_established(struct sock *sk); 292 void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb); 293 void tcp_ao_connect_init(struct sock *sk); 294 void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, 295 struct request_sock *req, unsigned short int family); 296 #else /* CONFIG_TCP_AO */ 297 298 static inline int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb, 299 struct tcp_ao_key *key, struct tcphdr *th, 300 __u8 *hash_location) 301 { 302 return 0; 303 } 304 305 static inline void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, 306 struct request_sock *req, unsigned short int family) 307 { 308 } 309 310 static inline bool tcp_ao_ignore_icmp(const struct sock *sk, int family, 311 int type, int code) 312 { 313 return false; 314 } 315 316 static inline enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk, 317 const struct sk_buff *skb, unsigned short int family, 318 const struct request_sock *req, int l3index, 319 const struct tcp_ao_hdr *aoh) 320 { 321 return SKB_NOT_DROPPED_YET; 322 } 323 324 static inline struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk, 325 int l3index, const union tcp_ao_addr *addr, 326 int family, int sndid, int rcvid) 327 { 328 return NULL; 329 } 330 331 static inline void tcp_ao_destroy_sock(struct sock *sk, bool twsk) 332 { 333 } 334 335 static inline void tcp_ao_established(struct sock *sk) 336 { 337 } 338 339 static inline void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb) 340 { 341 } 342 343 static inline void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, 344 struct tcp_sock *tp) 345 { 346 } 347 348 static inline void tcp_ao_connect_init(struct sock *sk) 349 { 350 } 351 352 static inline int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen) 353 { 354 return -ENOPROTOOPT; 355 } 356 357 static inline int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen) 358 { 359 return -ENOPROTOOPT; 360 } 361 362 static inline int tcp_ao_get_repair(struct sock *sk, 363 sockptr_t optval, sockptr_t optlen) 364 { 365 return -ENOPROTOOPT; 366 } 367 368 static inline int tcp_ao_set_repair(struct sock *sk, 369 sockptr_t optval, unsigned int optlen) 370 { 371 return -ENOPROTOOPT; 372 } 373 #endif 374 375 #if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO) 376 int tcp_do_parse_auth_options(const struct tcphdr *th, 377 const u8 **md5_hash, const u8 **ao_hash); 378 #else 379 static inline int tcp_do_parse_auth_options(const struct tcphdr *th, 380 const u8 **md5_hash, const u8 **ao_hash) 381 { 382 *md5_hash = NULL; 383 *ao_hash = NULL; 384 return 0; 385 } 386 #endif 387 388 #endif /* _TCP_AO_H */ 389