include/net/tcp_ao.h

   1 /* SPDX-License-Identifier: GPL-2.0-or-later */
   2 #ifndef _TCP_AO_H
   3 #define _TCP_AO_H
   4
   5 #define TCP_AO_KEY_ALIGN        1
   6 #define __tcp_ao_key_align __aligned(TCP_AO_KEY_ALIGN)
   7
   8 union tcp_ao_addr {
   9         struct in_addr  a4;
  10 #if IS_ENABLED(CONFIG_IPV6)
  11         struct in6_addr a6;
  12 #endif
  13 };
  14
  15 struct tcp_ao_hdr {
  16         u8      kind;
  17         u8      length;
  18         u8      keyid;
  19         u8      rnext_keyid;
  20 };
  21
  22 static inline u8 tcp_ao_hdr_maclen(const struct tcp_ao_hdr *aoh)
  23 {
  24         return aoh->length - sizeof(struct tcp_ao_hdr);
  25 }
  26
  27 struct tcp_ao_counters {
  28         atomic64_t      pkt_good;
  29         atomic64_t      pkt_bad;
  30         atomic64_t      key_not_found;
  31         atomic64_t      ao_required;
  32         atomic64_t      dropped_icmp;
  33 };
  34
  35 struct tcp_ao_key {
  36         struct hlist_node       node;
  37         union tcp_ao_addr       addr;
  38         u8                      key[TCP_AO_MAXKEYLEN] __tcp_ao_key_align;
  39         unsigned int            tcp_sigpool_id;
  40         unsigned int            digest_size;
  41         int                     l3index;
  42         u8                      prefixlen;
  43         u8                      family;
  44         u8                      keylen;
  45         u8                      keyflags;
  46         u8                      sndid;
  47         u8                      rcvid;
  48         u8                      maclen;
  49         struct rcu_head         rcu;
  50         atomic64_t              pkt_good;
  51         atomic64_t              pkt_bad;
  52         u8                      traffic_keys[];
  53 };
  54
  55 static inline u8 *rcv_other_key(struct tcp_ao_key *key)
  56 {
  57         return key->traffic_keys;
  58 }
  59
  60 static inline u8 *snd_other_key(struct tcp_ao_key *key)
  61 {
  62         return key->traffic_keys + key->digest_size;
  63 }
  64
  65 static inline int tcp_ao_maclen(const struct tcp_ao_key *key)
  66 {
  67         return key->maclen;
  68 }
  69
  70 /* Use tcp_ao_len_aligned() for TCP header calculations */
  71 static inline int tcp_ao_len(const struct tcp_ao_key *key)
  72 {
  73         return tcp_ao_maclen(key) + sizeof(struct tcp_ao_hdr);
  74 }
  75
  76 static inline int tcp_ao_len_aligned(const struct tcp_ao_key *key)
  77 {
  78         return round_up(tcp_ao_len(key), 4);
  79 }
  80
  81 static inline unsigned int tcp_ao_digest_size(struct tcp_ao_key *key)
  82 {
  83         return key->digest_size;
  84 }
  85
  86 static inline int tcp_ao_sizeof_key(const struct tcp_ao_key *key)
  87 {
  88         return sizeof(struct tcp_ao_key) + (key->digest_size << 1);
  89 }
  90
  91 struct tcp_ao_info {
  92         /* List of tcp_ao_key's */
  93         struct hlist_head       head;
  94         /* current_key and rnext_key are maintained on sockets
  95          * in TCP_AO_ESTABLISHED states.
  96          * Their purpose is to cache keys on established connections,
  97          * saving needless lookups. Never dereference any of them from
  98          * listen sockets.
  99          * ::current_key may change in RX to the key that was requested by
 100          * the peer, please use READ_ONCE()/WRITE_ONCE() in order to avoid
 101          * load/store tearing.
 102          * Do the same for ::rnext_key, if you don't hold socket lock
 103          * (it's changed only by userspace request in setsockopt()).
 104          */
 105         struct tcp_ao_key       *current_key;
 106         struct tcp_ao_key       *rnext_key;
 107         struct tcp_ao_counters  counters;
 108         u32                     ao_required     :1,
 109                                 accept_icmps    :1,
 110                                 __unused        :30;
 111         __be32                  lisn;
 112         __be32                  risn;
 113         /* Sequence Number Extension (SNE) are upper 4 bytes for SEQ,
 114          * that protect TCP-AO connection from replayed old TCP segments.
 115          * See RFC5925 (6.2).
 116          * In order to get correct SNE, there's a helper tcp_ao_compute_sne().
 117          * It needs SEQ basis to understand whereabouts are lower SEQ numbers.
 118          * According to that basis vector, it can provide incremented SNE
 119          * when SEQ rolls over or provide decremented SNE when there's
 120          * a retransmitted segment from before-rolling over.
 121          * - for request sockets such basis is rcv_isn/snt_isn, which seems
 122          *   good enough as it's unexpected to receive 4 Gbytes on reqsk.
 123          * - for full sockets the basis is rcv_nxt/snd_una. snd_una is
 124          *   taken instead of snd_nxt as currently it's easier to track
 125          *   in tcp_snd_una_update(), rather than updating SNE in all
 126          *   WRITE_ONCE(tp->snd_nxt, ...)
 127          * - for time-wait sockets the basis is tw_rcv_nxt/tw_snd_nxt.
 128          *   tw_snd_nxt is not expected to change, while tw_rcv_nxt may.
 129          */
 130         u32                     snd_sne;
 131         u32                     rcv_sne;
 132         refcount_t              refcnt;         /* Protects twsk destruction */
 133         struct rcu_head         rcu;
 134 };
 135
 136 #ifdef CONFIG_TCP_MD5SIG
 137 #include <linux/jump_label.h>
 138 extern struct static_key_false_deferred tcp_md5_needed;
 139 #define static_branch_tcp_md5() static_branch_unlikely(&tcp_md5_needed.key)
 140 #else
 141 #define static_branch_tcp_md5() false
 142 #endif
 143 #ifdef CONFIG_TCP_AO
 144 /* TCP-AO structures and functions */
 145 #include <linux/jump_label.h>
 146 extern struct static_key_false_deferred tcp_ao_needed;
 147 #define static_branch_tcp_ao()  static_branch_unlikely(&tcp_ao_needed.key)
 148 #else
 149 #define static_branch_tcp_ao()  false
 150 #endif
 151
 152 #ifdef CONFIG_TCP_AO
 153 /* TCP-AO structures and functions */
 154 struct tcp4_ao_context {
 155         __be32          saddr;
 156         __be32          daddr;
 157         __be16          sport;
 158         __be16          dport;
 159         __be32          sisn;
 160         __be32          disn;
 161 };
 162
 163 struct tcp6_ao_context {
 164         struct in6_addr saddr;
 165         struct in6_addr daddr;
 166         __be16          sport;
 167         __be16          dport;
 168         __be32          sisn;
 169         __be32          disn;
 170 };
 171
 172 struct tcp_sigpool;
 173 /* Established states are fast-path and there always is current_key/rnext_key */
 174 #define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \
 175                             TCPF_CLOSE_WAIT | TCPF_LAST_ACK | TCPF_CLOSING)
 176
 177 int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
 178                         struct tcp_ao_key *key, struct tcphdr *th,
 179                         __u8 *hash_location);
 180 int tcp_ao_hash_skb(unsigned short int family,
 181                     char *ao_hash, struct tcp_ao_key *key,
 182                     const struct sock *sk, const struct sk_buff *skb,
 183                     const u8 *tkey, int hash_offset, u32 sne);
 184 int tcp_parse_ao(struct sock *sk, int cmd, unsigned short int family,
 185                  sockptr_t optval, int optlen);
 186 struct tcp_ao_key *tcp_ao_established_key(const struct sock *sk,
 187                                           struct tcp_ao_info *ao,
 188                                           int sndid, int rcvid);
 189 int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk,
 190                              struct request_sock *req, struct sk_buff *skb,
 191                              int family);
 192 int tcp_ao_calc_traffic_key(struct tcp_ao_key *mkt, u8 *key, void *ctx,
 193                             unsigned int len, struct tcp_sigpool *hp);
 194 void tcp_ao_destroy_sock(struct sock *sk, bool twsk);
 195 void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp);
 196 bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code);
 197 int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen);
 198 int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen);
 199 int tcp_ao_get_repair(struct sock *sk, sockptr_t optval, sockptr_t optlen);
 200 int tcp_ao_set_repair(struct sock *sk, sockptr_t optval, unsigned int optlen);
 201 enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk,
 202                         const struct sk_buff *skb, unsigned short int family,
 203                         const struct request_sock *req, int l3index,
 204                         const struct tcp_ao_hdr *aoh);
 205 u32 tcp_ao_compute_sne(u32 next_sne, u32 next_seq, u32 seq);
 206 struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk, int l3index,
 207                                     const union tcp_ao_addr *addr,
 208                                     int family, int sndid, int rcvid);
 209 int tcp_ao_hash_hdr(unsigned short family, char *ao_hash,
 210                     struct tcp_ao_key *key, const u8 *tkey,
 211                     const union tcp_ao_addr *daddr,
 212                     const union tcp_ao_addr *saddr,
 213                     const struct tcphdr *th, u32 sne);
 214 int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb,
 215                          const struct tcp_ao_hdr *aoh, int l3index, u32 seq,
 216                          struct tcp_ao_key **key, char **traffic_key,
 217                          bool *allocated_traffic_key, u8 *keyid, u32 *sne);
 218
 219 /* ipv4 specific functions */
 220 int tcp_v4_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen);
 221 struct tcp_ao_key *tcp_v4_ao_lookup(const struct sock *sk, struct sock *addr_sk,
 222                                     int sndid, int rcvid);
 223 int tcp_v4_ao_synack_hash(char *ao_hash, struct tcp_ao_key *mkt,
 224                           struct request_sock *req, const struct sk_buff *skb,
 225                           int hash_offset, u32 sne);
 226 int tcp_v4_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key,
 227                           const struct sock *sk,
 228                           __be32 sisn, __be32 disn, bool send);
 229 int tcp_v4_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key,
 230                            struct request_sock *req);
 231 struct tcp_ao_key *tcp_v4_ao_lookup_rsk(const struct sock *sk,
 232                                         struct request_sock *req,
 233                                         int sndid, int rcvid);
 234 int tcp_v4_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key,
 235                        const struct sock *sk, const struct sk_buff *skb,
 236                        const u8 *tkey, int hash_offset, u32 sne);
 237 /* ipv6 specific functions */
 238 int tcp_v6_ao_hash_pseudoheader(struct tcp_sigpool *hp,
 239                                 const struct in6_addr *daddr,
 240                                 const struct in6_addr *saddr, int nbytes);
 241 int tcp_v6_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key,
 242                            const struct sk_buff *skb, __be32 sisn, __be32 disn);
 243 int tcp_v6_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key,
 244                           const struct sock *sk, __be32 sisn,
 245                           __be32 disn, bool send);
 246 int tcp_v6_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key,
 247                            struct request_sock *req);
 248 struct tcp_ao_key *tcp_v6_ao_lookup(const struct sock *sk,
 249                                     struct sock *addr_sk, int sndid, int rcvid);
 250 struct tcp_ao_key *tcp_v6_ao_lookup_rsk(const struct sock *sk,
 251                                         struct request_sock *req,
 252                                         int sndid, int rcvid);
 253 int tcp_v6_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key,
 254                        const struct sock *sk, const struct sk_buff *skb,
 255                        const u8 *tkey, int hash_offset, u32 sne);
 256 int tcp_v6_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen);
 257 int tcp_v6_ao_synack_hash(char *ao_hash, struct tcp_ao_key *ao_key,
 258                           struct request_sock *req, const struct sk_buff *skb,
 259                           int hash_offset, u32 sne);
 260 void tcp_ao_established(struct sock *sk);
 261 void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb);
 262 void tcp_ao_connect_init(struct sock *sk);
 263 void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
 264                       struct request_sock *req, unsigned short int family);
 265 #else /* CONFIG_TCP_AO */
 266
 267 static inline int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
 268                                       struct tcp_ao_key *key, struct tcphdr *th,
 269                                       __u8 *hash_location)
 270 {
 271         return 0;
 272 }
 273
 274 static inline void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
 275                                     struct request_sock *req, unsigned short int family)
 276 {
 277 }
 278
 279 static inline bool tcp_ao_ignore_icmp(const struct sock *sk, int family,
 280                                       int type, int code)
 281 {
 282         return false;
 283 }
 284
 285 static inline enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk,
 286                 const struct sk_buff *skb, unsigned short int family,
 287                 const struct request_sock *req, int l3index,
 288                 const struct tcp_ao_hdr *aoh)
 289 {
 290         return SKB_NOT_DROPPED_YET;
 291 }
 292
 293 static inline struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk,
 294                 int l3index, const union tcp_ao_addr *addr,
 295                 int family, int sndid, int rcvid)
 296 {
 297         return NULL;
 298 }
 299
 300 static inline void tcp_ao_destroy_sock(struct sock *sk, bool twsk)
 301 {
 302 }
 303
 304 static inline void tcp_ao_established(struct sock *sk)
 305 {
 306 }
 307
 308 static inline void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb)
 309 {
 310 }
 311
 312 static inline void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw,
 313                                     struct tcp_sock *tp)
 314 {
 315 }
 316
 317 static inline void tcp_ao_connect_init(struct sock *sk)
 318 {
 319 }
 320
 321 static inline int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen)
 322 {
 323         return -ENOPROTOOPT;
 324 }
 325
 326 static inline int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen)
 327 {
 328         return -ENOPROTOOPT;
 329 }
 330
 331 static inline int tcp_ao_get_repair(struct sock *sk,
 332                                     sockptr_t optval, sockptr_t optlen)
 333 {
 334         return -ENOPROTOOPT;
 335 }
 336
 337 static inline int tcp_ao_set_repair(struct sock *sk,
 338                                     sockptr_t optval, unsigned int optlen)
 339 {
 340         return -ENOPROTOOPT;
 341 }
 342 #endif
 343
 344 #if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
 345 int tcp_do_parse_auth_options(const struct tcphdr *th,
 346                               const u8 **md5_hash, const u8 **ao_hash);
 347 #else
 348 static inline int tcp_do_parse_auth_options(const struct tcphdr *th,
 349                 const u8 **md5_hash, const u8 **ao_hash)
 350 {
 351         *md5_hash = NULL;
 352         *ao_hash = NULL;
 353         return 0;
 354 }
 355 #endif
 356
 357 #endif /* _TCP_AO_H */