1 /* SPDX-License-Identifier: GPL-2.0-or-later */
5 #define TCP_AO_KEY_ALIGN 1
6 #define __tcp_ao_key_align __aligned(TCP_AO_KEY_ALIGN)
10 #if IS_ENABLED(CONFIG_IPV6)
22 struct tcp_ao_counters {
25 atomic64_t key_not_found;
26 atomic64_t ao_required;
27 atomic64_t dropped_icmp;
31 struct hlist_node node;
32 union tcp_ao_addr addr;
33 u8 key[TCP_AO_MAXKEYLEN] __tcp_ao_key_align;
34 unsigned int tcp_sigpool_id;
35 unsigned int digest_size;
50 static inline u8 *rcv_other_key(struct tcp_ao_key *key)
52 return key->traffic_keys;
55 static inline u8 *snd_other_key(struct tcp_ao_key *key)
57 return key->traffic_keys + key->digest_size;
60 static inline int tcp_ao_maclen(const struct tcp_ao_key *key)
65 /* Use tcp_ao_len_aligned() for TCP header calculations */
66 static inline int tcp_ao_len(const struct tcp_ao_key *key)
68 return tcp_ao_maclen(key) + sizeof(struct tcp_ao_hdr);
71 static inline int tcp_ao_len_aligned(const struct tcp_ao_key *key)
73 return round_up(tcp_ao_len(key), 4);
76 static inline unsigned int tcp_ao_digest_size(struct tcp_ao_key *key)
78 return key->digest_size;
81 static inline int tcp_ao_sizeof_key(const struct tcp_ao_key *key)
83 return sizeof(struct tcp_ao_key) + (key->digest_size << 1);
87 /* List of tcp_ao_key's */
88 struct hlist_head head;
89 /* current_key and rnext_key aren't maintained on listen sockets.
90 * Their purpose is to cache keys on established connections,
91 * saving needless lookups. Never dereference any of them from
93 * ::current_key may change in RX to the key that was requested by
94 * the peer, please use READ_ONCE()/WRITE_ONCE() in order to avoid
96 * Do the same for ::rnext_key, if you don't hold socket lock
97 * (it's changed only by userspace request in setsockopt()).
99 struct tcp_ao_key *current_key;
100 struct tcp_ao_key *rnext_key;
101 struct tcp_ao_counters counters;
107 /* Sequence Number Extension (SNE) are upper 4 bytes for SEQ,
108 * that protect TCP-AO connection from replayed old TCP segments.
110 * In order to get correct SNE, there's a helper tcp_ao_compute_sne().
111 * It needs SEQ basis to understand whereabouts are lower SEQ numbers.
112 * According to that basis vector, it can provide incremented SNE
113 * when SEQ rolls over or provide decremented SNE when there's
114 * a retransmitted segment from before-rolling over.
115 * - for request sockets such basis is rcv_isn/snt_isn, which seems
116 * good enough as it's unexpected to receive 4 Gbytes on reqsk.
117 * - for full sockets the basis is rcv_nxt/snd_una. snd_una is
118 * taken instead of snd_nxt as currently it's easier to track
119 * in tcp_snd_una_update(), rather than updating SNE in all
120 * WRITE_ONCE(tp->snd_nxt, ...)
121 * - for time-wait sockets the basis is tw_rcv_nxt/tw_snd_nxt.
122 * tw_snd_nxt is not expected to change, while tw_rcv_nxt may.
126 refcount_t refcnt; /* Protects twsk destruction */
130 #define tcp_hash_fail(msg, family, skb, fmt, ...) \
132 const struct tcphdr *th = tcp_hdr(skb); \
134 char *f = hdr_flags; \
147 if ((family) == AF_INET) { \
148 net_info_ratelimited("%s for %pI4.%d->%pI4.%d [%s] " fmt "\n", \
149 msg, &ip_hdr(skb)->saddr, ntohs(th->source), \
150 &ip_hdr(skb)->daddr, ntohs(th->dest), \
151 hdr_flags, ##__VA_ARGS__); \
153 net_info_ratelimited("%s for [%pI6c].%d->[%pI6c].%d [%s]" fmt "\n", \
154 msg, &ipv6_hdr(skb)->saddr, ntohs(th->source), \
155 &ipv6_hdr(skb)->daddr, ntohs(th->dest), \
156 hdr_flags, ##__VA_ARGS__); \
161 /* TCP-AO structures and functions */
162 #include <linux/jump_label.h>
163 extern struct static_key_false_deferred tcp_ao_needed;
165 struct tcp4_ao_context {
174 struct tcp6_ao_context {
175 struct in6_addr saddr;
176 struct in6_addr daddr;
184 #define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \
185 TCPF_CLOSE | TCPF_CLOSE_WAIT | \
186 TCPF_LAST_ACK | TCPF_CLOSING)
188 int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
189 struct tcp_ao_key *key, struct tcphdr *th,
190 __u8 *hash_location);
191 int tcp_ao_hash_skb(unsigned short int family,
192 char *ao_hash, struct tcp_ao_key *key,
193 const struct sock *sk, const struct sk_buff *skb,
194 const u8 *tkey, int hash_offset, u32 sne);
195 int tcp_parse_ao(struct sock *sk, int cmd, unsigned short int family,
196 sockptr_t optval, int optlen);
197 struct tcp_ao_key *tcp_ao_established_key(struct tcp_ao_info *ao,
198 int sndid, int rcvid);
199 int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk,
200 struct request_sock *req, struct sk_buff *skb,
202 int tcp_ao_calc_traffic_key(struct tcp_ao_key *mkt, u8 *key, void *ctx,
203 unsigned int len, struct tcp_sigpool *hp);
204 void tcp_ao_destroy_sock(struct sock *sk, bool twsk);
205 void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp);
206 bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code);
207 int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen);
208 int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen);
209 int tcp_ao_get_repair(struct sock *sk, sockptr_t optval, sockptr_t optlen);
210 int tcp_ao_set_repair(struct sock *sk, sockptr_t optval, unsigned int optlen);
211 enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk,
212 const struct sk_buff *skb, unsigned short int family,
213 const struct request_sock *req, int l3index,
214 const struct tcp_ao_hdr *aoh);
215 u32 tcp_ao_compute_sne(u32 next_sne, u32 next_seq, u32 seq);
216 struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk, int l3index,
217 const union tcp_ao_addr *addr,
218 int family, int sndid, int rcvid);
219 int tcp_ao_hash_hdr(unsigned short family, char *ao_hash,
220 struct tcp_ao_key *key, const u8 *tkey,
221 const union tcp_ao_addr *daddr,
222 const union tcp_ao_addr *saddr,
223 const struct tcphdr *th, u32 sne);
224 int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb,
225 const struct tcp_ao_hdr *aoh, int l3index, u32 seq,
226 struct tcp_ao_key **key, char **traffic_key,
227 bool *allocated_traffic_key, u8 *keyid, u32 *sne);
229 /* ipv4 specific functions */
230 int tcp_v4_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen);
231 struct tcp_ao_key *tcp_v4_ao_lookup(const struct sock *sk, struct sock *addr_sk,
232 int sndid, int rcvid);
233 int tcp_v4_ao_synack_hash(char *ao_hash, struct tcp_ao_key *mkt,
234 struct request_sock *req, const struct sk_buff *skb,
235 int hash_offset, u32 sne);
236 int tcp_v4_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key,
237 const struct sock *sk,
238 __be32 sisn, __be32 disn, bool send);
239 int tcp_v4_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key,
240 struct request_sock *req);
241 struct tcp_ao_key *tcp_v4_ao_lookup_rsk(const struct sock *sk,
242 struct request_sock *req,
243 int sndid, int rcvid);
244 int tcp_v4_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key,
245 const struct sock *sk, const struct sk_buff *skb,
246 const u8 *tkey, int hash_offset, u32 sne);
247 /* ipv6 specific functions */
248 int tcp_v6_ao_hash_pseudoheader(struct tcp_sigpool *hp,
249 const struct in6_addr *daddr,
250 const struct in6_addr *saddr, int nbytes);
251 int tcp_v6_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key,
252 const struct sk_buff *skb, __be32 sisn, __be32 disn);
253 int tcp_v6_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key,
254 const struct sock *sk, __be32 sisn,
255 __be32 disn, bool send);
256 int tcp_v6_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key,
257 struct request_sock *req);
258 struct tcp_ao_key *tcp_v6_ao_lookup(const struct sock *sk,
259 struct sock *addr_sk, int sndid, int rcvid);
260 struct tcp_ao_key *tcp_v6_ao_lookup_rsk(const struct sock *sk,
261 struct request_sock *req,
262 int sndid, int rcvid);
263 int tcp_v6_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key,
264 const struct sock *sk, const struct sk_buff *skb,
265 const u8 *tkey, int hash_offset, u32 sne);
266 int tcp_v6_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen);
267 int tcp_v6_ao_synack_hash(char *ao_hash, struct tcp_ao_key *ao_key,
268 struct request_sock *req, const struct sk_buff *skb,
269 int hash_offset, u32 sne);
270 void tcp_ao_established(struct sock *sk);
271 void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb);
272 void tcp_ao_connect_init(struct sock *sk);
273 void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
274 struct tcp_request_sock *treq,
275 unsigned short int family, int l3index);
276 #else /* CONFIG_TCP_AO */
278 static inline int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
279 struct tcp_ao_key *key, struct tcphdr *th,
285 static inline void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
286 struct tcp_request_sock *treq,
287 unsigned short int family, int l3index)
291 static inline bool tcp_ao_ignore_icmp(const struct sock *sk, int family,
297 static inline enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk,
298 const struct sk_buff *skb, unsigned short int family,
299 const struct request_sock *req, int l3index,
300 const struct tcp_ao_hdr *aoh)
302 return SKB_NOT_DROPPED_YET;
305 static inline struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk,
306 int l3index, const union tcp_ao_addr *addr,
307 int family, int sndid, int rcvid)
312 static inline void tcp_ao_destroy_sock(struct sock *sk, bool twsk)
316 static inline void tcp_ao_established(struct sock *sk)
320 static inline void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb)
324 static inline void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw,
329 static inline void tcp_ao_connect_init(struct sock *sk)
333 static inline int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen)
338 static inline int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen)
343 static inline int tcp_ao_get_repair(struct sock *sk,
344 sockptr_t optval, sockptr_t optlen)
349 static inline int tcp_ao_set_repair(struct sock *sk,
350 sockptr_t optval, unsigned int optlen)
356 #if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
357 int tcp_do_parse_auth_options(const struct tcphdr *th,
358 const u8 **md5_hash, const u8 **ao_hash);
360 static inline int tcp_do_parse_auth_options(const struct tcphdr *th,
361 const u8 **md5_hash, const u8 **ao_hash)
369 #endif /* _TCP_AO_H */