1 /* SPDX-License-Identifier: GPL-2.0-or-later */ 2 #ifndef _TCP_AO_H 3 #define _TCP_AO_H 4 5 #define TCP_AO_KEY_ALIGN 1 6 #define __tcp_ao_key_align __aligned(TCP_AO_KEY_ALIGN) 7 8 union tcp_ao_addr { 9 struct in_addr a4; 10 #if IS_ENABLED(CONFIG_IPV6) 11 struct in6_addr a6; 12 #endif 13 }; 14 15 struct tcp_ao_hdr { 16 u8 kind; 17 u8 length; 18 u8 keyid; 19 u8 rnext_keyid; 20 }; 21 22 static inline u8 tcp_ao_hdr_maclen(const struct tcp_ao_hdr *aoh) 23 { 24 return aoh->length - sizeof(struct tcp_ao_hdr); 25 } 26 27 struct tcp_ao_counters { 28 atomic64_t pkt_good; 29 atomic64_t pkt_bad; 30 atomic64_t key_not_found; 31 atomic64_t ao_required; 32 atomic64_t dropped_icmp; 33 }; 34 35 struct tcp_ao_key { 36 struct hlist_node node; 37 union tcp_ao_addr addr; 38 u8 key[TCP_AO_MAXKEYLEN] __tcp_ao_key_align; 39 unsigned int tcp_sigpool_id; 40 unsigned int digest_size; 41 int l3index; 42 u8 prefixlen; 43 u8 family; 44 u8 keylen; 45 u8 keyflags; 46 u8 sndid; 47 u8 rcvid; 48 u8 maclen; 49 struct rcu_head rcu; 50 atomic64_t pkt_good; 51 atomic64_t pkt_bad; 52 u8 traffic_keys[]; 53 }; 54 55 static inline u8 *rcv_other_key(struct tcp_ao_key *key) 56 { 57 return key->traffic_keys; 58 } 59 60 static inline u8 *snd_other_key(struct tcp_ao_key *key) 61 { 62 return key->traffic_keys + key->digest_size; 63 } 64 65 static inline int tcp_ao_maclen(const struct tcp_ao_key *key) 66 { 67 return key->maclen; 68 } 69 70 /* Use tcp_ao_len_aligned() for TCP header calculations */ 71 static inline int tcp_ao_len(const struct tcp_ao_key *key) 72 { 73 return tcp_ao_maclen(key) + sizeof(struct tcp_ao_hdr); 74 } 75 76 static inline int tcp_ao_len_aligned(const struct tcp_ao_key *key) 77 { 78 return round_up(tcp_ao_len(key), 4); 79 } 80 81 static inline unsigned int tcp_ao_digest_size(struct tcp_ao_key *key) 82 { 83 return key->digest_size; 84 } 85 86 static inline int tcp_ao_sizeof_key(const struct tcp_ao_key *key) 87 { 88 return sizeof(struct tcp_ao_key) + (key->digest_size << 1); 89 } 90 91 struct tcp_ao_info { 92 /* List of tcp_ao_key's */ 93 struct hlist_head head; 94 /* current_key and rnext_key are maintained on sockets 95 * in TCP_AO_ESTABLISHED states. 96 * Their purpose is to cache keys on established connections, 97 * saving needless lookups. Never dereference any of them from 98 * listen sockets. 99 * ::current_key may change in RX to the key that was requested by 100 * the peer, please use READ_ONCE()/WRITE_ONCE() in order to avoid 101 * load/store tearing. 102 * Do the same for ::rnext_key, if you don't hold socket lock 103 * (it's changed only by userspace request in setsockopt()). 104 */ 105 struct tcp_ao_key *current_key; 106 struct tcp_ao_key *rnext_key; 107 struct tcp_ao_counters counters; 108 u32 ao_required :1, 109 accept_icmps :1, 110 __unused :30; 111 __be32 lisn; 112 __be32 risn; 113 /* Sequence Number Extension (SNE) are upper 4 bytes for SEQ, 114 * that protect TCP-AO connection from replayed old TCP segments. 115 * See RFC5925 (6.2). 116 * In order to get correct SNE, there's a helper tcp_ao_compute_sne(). 117 * It needs SEQ basis to understand whereabouts are lower SEQ numbers. 118 * According to that basis vector, it can provide incremented SNE 119 * when SEQ rolls over or provide decremented SNE when there's 120 * a retransmitted segment from before-rolling over. 121 * - for request sockets such basis is rcv_isn/snt_isn, which seems 122 * good enough as it's unexpected to receive 4 Gbytes on reqsk. 123 * - for full sockets the basis is rcv_nxt/snd_una. snd_una is 124 * taken instead of snd_nxt as currently it's easier to track 125 * in tcp_snd_una_update(), rather than updating SNE in all 126 * WRITE_ONCE(tp->snd_nxt, ...) 127 * - for time-wait sockets the basis is tw_rcv_nxt/tw_snd_nxt. 128 * tw_snd_nxt is not expected to change, while tw_rcv_nxt may. 129 */ 130 u32 snd_sne; 131 u32 rcv_sne; 132 refcount_t refcnt; /* Protects twsk destruction */ 133 struct rcu_head rcu; 134 }; 135 136 #ifdef CONFIG_TCP_MD5SIG 137 #include <linux/jump_label.h> 138 extern struct static_key_false_deferred tcp_md5_needed; 139 #define static_branch_tcp_md5() static_branch_unlikely(&tcp_md5_needed.key) 140 #else 141 #define static_branch_tcp_md5() false 142 #endif 143 #ifdef CONFIG_TCP_AO 144 /* TCP-AO structures and functions */ 145 #include <linux/jump_label.h> 146 extern struct static_key_false_deferred tcp_ao_needed; 147 #define static_branch_tcp_ao() static_branch_unlikely(&tcp_ao_needed.key) 148 #else 149 #define static_branch_tcp_ao() false 150 #endif 151 152 #ifdef CONFIG_TCP_AO 153 /* TCP-AO structures and functions */ 154 struct tcp4_ao_context { 155 __be32 saddr; 156 __be32 daddr; 157 __be16 sport; 158 __be16 dport; 159 __be32 sisn; 160 __be32 disn; 161 }; 162 163 struct tcp6_ao_context { 164 struct in6_addr saddr; 165 struct in6_addr daddr; 166 __be16 sport; 167 __be16 dport; 168 __be32 sisn; 169 __be32 disn; 170 }; 171 172 struct tcp_sigpool; 173 /* Established states are fast-path and there always is current_key/rnext_key */ 174 #define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \ 175 TCPF_CLOSE_WAIT | TCPF_LAST_ACK | TCPF_CLOSING) 176 177 int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb, 178 struct tcp_ao_key *key, struct tcphdr *th, 179 __u8 *hash_location); 180 int tcp_ao_hash_skb(unsigned short int family, 181 char *ao_hash, struct tcp_ao_key *key, 182 const struct sock *sk, const struct sk_buff *skb, 183 const u8 *tkey, int hash_offset, u32 sne); 184 int tcp_parse_ao(struct sock *sk, int cmd, unsigned short int family, 185 sockptr_t optval, int optlen); 186 struct tcp_ao_key *tcp_ao_established_key(const struct sock *sk, 187 struct tcp_ao_info *ao, 188 int sndid, int rcvid); 189 int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk, 190 struct request_sock *req, struct sk_buff *skb, 191 int family); 192 int tcp_ao_calc_traffic_key(struct tcp_ao_key *mkt, u8 *key, void *ctx, 193 unsigned int len, struct tcp_sigpool *hp); 194 void tcp_ao_destroy_sock(struct sock *sk, bool twsk); 195 void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp); 196 bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code); 197 int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen); 198 int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen); 199 int tcp_ao_get_repair(struct sock *sk, sockptr_t optval, sockptr_t optlen); 200 int tcp_ao_set_repair(struct sock *sk, sockptr_t optval, unsigned int optlen); 201 enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk, 202 const struct sk_buff *skb, unsigned short int family, 203 const struct request_sock *req, int l3index, 204 const struct tcp_ao_hdr *aoh); 205 u32 tcp_ao_compute_sne(u32 next_sne, u32 next_seq, u32 seq); 206 struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk, int l3index, 207 const union tcp_ao_addr *addr, 208 int family, int sndid, int rcvid); 209 int tcp_ao_hash_hdr(unsigned short family, char *ao_hash, 210 struct tcp_ao_key *key, const u8 *tkey, 211 const union tcp_ao_addr *daddr, 212 const union tcp_ao_addr *saddr, 213 const struct tcphdr *th, u32 sne); 214 int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb, 215 const struct tcp_ao_hdr *aoh, int l3index, u32 seq, 216 struct tcp_ao_key **key, char **traffic_key, 217 bool *allocated_traffic_key, u8 *keyid, u32 *sne); 218 219 /* ipv4 specific functions */ 220 int tcp_v4_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen); 221 struct tcp_ao_key *tcp_v4_ao_lookup(const struct sock *sk, struct sock *addr_sk, 222 int sndid, int rcvid); 223 int tcp_v4_ao_synack_hash(char *ao_hash, struct tcp_ao_key *mkt, 224 struct request_sock *req, const struct sk_buff *skb, 225 int hash_offset, u32 sne); 226 int tcp_v4_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key, 227 const struct sock *sk, 228 __be32 sisn, __be32 disn, bool send); 229 int tcp_v4_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key, 230 struct request_sock *req); 231 struct tcp_ao_key *tcp_v4_ao_lookup_rsk(const struct sock *sk, 232 struct request_sock *req, 233 int sndid, int rcvid); 234 int tcp_v4_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key, 235 const struct sock *sk, const struct sk_buff *skb, 236 const u8 *tkey, int hash_offset, u32 sne); 237 /* ipv6 specific functions */ 238 int tcp_v6_ao_hash_pseudoheader(struct tcp_sigpool *hp, 239 const struct in6_addr *daddr, 240 const struct in6_addr *saddr, int nbytes); 241 int tcp_v6_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key, 242 const struct sk_buff *skb, __be32 sisn, __be32 disn); 243 int tcp_v6_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key, 244 const struct sock *sk, __be32 sisn, 245 __be32 disn, bool send); 246 int tcp_v6_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key, 247 struct request_sock *req); 248 struct tcp_ao_key *tcp_v6_ao_lookup(const struct sock *sk, 249 struct sock *addr_sk, int sndid, int rcvid); 250 struct tcp_ao_key *tcp_v6_ao_lookup_rsk(const struct sock *sk, 251 struct request_sock *req, 252 int sndid, int rcvid); 253 int tcp_v6_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key, 254 const struct sock *sk, const struct sk_buff *skb, 255 const u8 *tkey, int hash_offset, u32 sne); 256 int tcp_v6_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen); 257 int tcp_v6_ao_synack_hash(char *ao_hash, struct tcp_ao_key *ao_key, 258 struct request_sock *req, const struct sk_buff *skb, 259 int hash_offset, u32 sne); 260 void tcp_ao_established(struct sock *sk); 261 void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb); 262 void tcp_ao_connect_init(struct sock *sk); 263 void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, 264 struct request_sock *req, unsigned short int family); 265 #else /* CONFIG_TCP_AO */ 266 267 static inline int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb, 268 struct tcp_ao_key *key, struct tcphdr *th, 269 __u8 *hash_location) 270 { 271 return 0; 272 } 273 274 static inline void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, 275 struct request_sock *req, unsigned short int family) 276 { 277 } 278 279 static inline bool tcp_ao_ignore_icmp(const struct sock *sk, int family, 280 int type, int code) 281 { 282 return false; 283 } 284 285 static inline enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk, 286 const struct sk_buff *skb, unsigned short int family, 287 const struct request_sock *req, int l3index, 288 const struct tcp_ao_hdr *aoh) 289 { 290 return SKB_NOT_DROPPED_YET; 291 } 292 293 static inline struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk, 294 int l3index, const union tcp_ao_addr *addr, 295 int family, int sndid, int rcvid) 296 { 297 return NULL; 298 } 299 300 static inline void tcp_ao_destroy_sock(struct sock *sk, bool twsk) 301 { 302 } 303 304 static inline void tcp_ao_established(struct sock *sk) 305 { 306 } 307 308 static inline void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb) 309 { 310 } 311 312 static inline void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, 313 struct tcp_sock *tp) 314 { 315 } 316 317 static inline void tcp_ao_connect_init(struct sock *sk) 318 { 319 } 320 321 static inline int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen) 322 { 323 return -ENOPROTOOPT; 324 } 325 326 static inline int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen) 327 { 328 return -ENOPROTOOPT; 329 } 330 331 static inline int tcp_ao_get_repair(struct sock *sk, 332 sockptr_t optval, sockptr_t optlen) 333 { 334 return -ENOPROTOOPT; 335 } 336 337 static inline int tcp_ao_set_repair(struct sock *sk, 338 sockptr_t optval, unsigned int optlen) 339 { 340 return -ENOPROTOOPT; 341 } 342 #endif 343 344 #if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO) 345 int tcp_do_parse_auth_options(const struct tcphdr *th, 346 const u8 **md5_hash, const u8 **ao_hash); 347 #else 348 static inline int tcp_do_parse_auth_options(const struct tcphdr *th, 349 const u8 **md5_hash, const u8 **ao_hash) 350 { 351 *md5_hash = NULL; 352 *ao_hash = NULL; 353 return 0; 354 } 355 #endif 356 357 #endif /* _TCP_AO_H */ 358