1/* SPDX-License-Identifier: GPL-2.0-or-later */
  2#ifndef _TCP_AO_H
  3#define _TCP_AO_H
  4
  5#define TCP_AO_KEY_ALIGN	1
  6#define __tcp_ao_key_align __aligned(TCP_AO_KEY_ALIGN)
  7
  8union tcp_ao_addr {
  9	struct in_addr  a4;
 10#if IS_ENABLED(CONFIG_IPV6)
 11	struct in6_addr	a6;
 12#endif
 13};
 14
 15struct tcp_ao_hdr {
 16	u8	kind;
 17	u8	length;
 18	u8	keyid;
 19	u8	rnext_keyid;
 20};
 21
 22struct tcp_ao_counters {
 23	atomic64_t	pkt_good;
 24	atomic64_t	pkt_bad;
 25	atomic64_t	key_not_found;
 26	atomic64_t	ao_required;
 27	atomic64_t	dropped_icmp;
 28};
 29
 30struct tcp_ao_key {
 31	struct hlist_node	node;
 32	union tcp_ao_addr	addr;
 33	u8			key[TCP_AO_MAXKEYLEN] __tcp_ao_key_align;
 34	unsigned int		tcp_sigpool_id;
 35	unsigned int		digest_size;
 36	int			l3index;
 37	u8			prefixlen;
 38	u8			family;
 39	u8			keylen;
 40	u8			keyflags;
 41	u8			sndid;
 42	u8			rcvid;
 43	u8			maclen;
 44	struct rcu_head		rcu;
 45	atomic64_t		pkt_good;
 46	atomic64_t		pkt_bad;
 47	u8			traffic_keys[];
 48};
 49
 50static inline u8 *rcv_other_key(struct tcp_ao_key *key)
 51{
 52	return key->traffic_keys;
 53}
 54
 55static inline u8 *snd_other_key(struct tcp_ao_key *key)
 56{
 57	return key->traffic_keys + key->digest_size;
 58}
 59
 60static inline int tcp_ao_maclen(const struct tcp_ao_key *key)
 61{
 62	return key->maclen;
 63}
 64
 65/* Use tcp_ao_len_aligned() for TCP header calculations */
 66static inline int tcp_ao_len(const struct tcp_ao_key *key)
 67{
 68	return tcp_ao_maclen(key) + sizeof(struct tcp_ao_hdr);
 69}
 70
 71static inline int tcp_ao_len_aligned(const struct tcp_ao_key *key)
 72{
 73	return round_up(tcp_ao_len(key), 4);
 74}
 75
 76static inline unsigned int tcp_ao_digest_size(struct tcp_ao_key *key)
 77{
 78	return key->digest_size;
 79}
 80
 81static inline int tcp_ao_sizeof_key(const struct tcp_ao_key *key)
 82{
 83	return sizeof(struct tcp_ao_key) + (key->digest_size << 1);
 84}
 85
 86struct tcp_ao_info {
 87	/* List of tcp_ao_key's */
 88	struct hlist_head	head;
 89	/* current_key and rnext_key aren't maintained on listen sockets.
 90	 * Their purpose is to cache keys on established connections,
 91	 * saving needless lookups. Never dereference any of them from
 92	 * listen sockets.
 93	 * ::current_key may change in RX to the key that was requested by
 94	 * the peer, please use READ_ONCE()/WRITE_ONCE() in order to avoid
 95	 * load/store tearing.
 96	 * Do the same for ::rnext_key, if you don't hold socket lock
 97	 * (it's changed only by userspace request in setsockopt()).
 98	 */
 99	struct tcp_ao_key	*current_key;
100	struct tcp_ao_key	*rnext_key;
101	struct tcp_ao_counters	counters;
102	u32			ao_required	:1,
103				accept_icmps	:1,
104				__unused	:30;
105	__be32			lisn;
106	__be32			risn;
107	/* Sequence Number Extension (SNE) are upper 4 bytes for SEQ,
108	 * that protect TCP-AO connection from replayed old TCP segments.
109	 * See RFC5925 (6.2).
110	 * In order to get correct SNE, there's a helper tcp_ao_compute_sne().
111	 * It needs SEQ basis to understand whereabouts are lower SEQ numbers.
112	 * According to that basis vector, it can provide incremented SNE
113	 * when SEQ rolls over or provide decremented SNE when there's
114	 * a retransmitted segment from before-rolling over.
115	 * - for request sockets such basis is rcv_isn/snt_isn, which seems
116	 *   good enough as it's unexpected to receive 4 Gbytes on reqsk.
117	 * - for full sockets the basis is rcv_nxt/snd_una. snd_una is
118	 *   taken instead of snd_nxt as currently it's easier to track
119	 *   in tcp_snd_una_update(), rather than updating SNE in all
120	 *   WRITE_ONCE(tp->snd_nxt, ...)
121	 * - for time-wait sockets the basis is tw_rcv_nxt/tw_snd_nxt.
122	 *   tw_snd_nxt is not expected to change, while tw_rcv_nxt may.
123	 */
124	u32			snd_sne;
125	u32			rcv_sne;
126	refcount_t		refcnt;		/* Protects twsk destruction */
127	struct rcu_head		rcu;
128};
129
130#ifdef CONFIG_TCP_MD5SIG
131#include <linux/jump_label.h>
132extern struct static_key_false_deferred tcp_md5_needed;
133#define static_branch_tcp_md5()	static_branch_unlikely(&tcp_md5_needed.key)
134#else
135#define static_branch_tcp_md5()	false
136#endif
137#ifdef CONFIG_TCP_AO
138/* TCP-AO structures and functions */
139#include <linux/jump_label.h>
140extern struct static_key_false_deferred tcp_ao_needed;
141#define static_branch_tcp_ao()	static_branch_unlikely(&tcp_ao_needed.key)
142#else
143#define static_branch_tcp_ao()	false
144#endif
145
146static inline bool tcp_hash_should_produce_warnings(void)
147{
148	return static_branch_tcp_md5() || static_branch_tcp_ao();
149}
150
151#define tcp_hash_fail(msg, family, skb, fmt, ...)			\
152do {									\
153	const struct tcphdr *th = tcp_hdr(skb);				\
154	char hdr_flags[6];						\
155	char *f = hdr_flags;						\
156									\
157	if (!tcp_hash_should_produce_warnings())			\
158		break;							\
159	if (th->fin)							\
160		*f++ = 'F';						\
161	if (th->syn)							\
162		*f++ = 'S';						\
163	if (th->rst)							\
164		*f++ = 'R';						\
165	if (th->psh)							\
166		*f++ = 'P';						\
167	if (th->ack)							\
168		*f++ = '.';						\
169	*f = 0;								\
170	if ((family) == AF_INET) {					\
171		net_info_ratelimited("%s for %pI4.%d->%pI4.%d [%s] " fmt "\n", \
172				msg, &ip_hdr(skb)->saddr, ntohs(th->source), \
173				&ip_hdr(skb)->daddr, ntohs(th->dest),	\
174				hdr_flags, ##__VA_ARGS__);		\
175	} else {							\
176		net_info_ratelimited("%s for [%pI6c].%d->[%pI6c].%d [%s]" fmt "\n", \
177				msg, &ipv6_hdr(skb)->saddr, ntohs(th->source), \
178				&ipv6_hdr(skb)->daddr, ntohs(th->dest),	\
179				hdr_flags, ##__VA_ARGS__);		\
180	}								\
181} while (0)
182
183#ifdef CONFIG_TCP_AO
184/* TCP-AO structures and functions */
185struct tcp4_ao_context {
186	__be32		saddr;
187	__be32		daddr;
188	__be16		sport;
189	__be16		dport;
190	__be32		sisn;
191	__be32		disn;
192};
193
194struct tcp6_ao_context {
195	struct in6_addr	saddr;
196	struct in6_addr	daddr;
197	__be16		sport;
198	__be16		dport;
199	__be32		sisn;
200	__be32		disn;
201};
202
203struct tcp_sigpool;
204#define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \
205			    TCPF_CLOSE | TCPF_CLOSE_WAIT | \
206			    TCPF_LAST_ACK | TCPF_CLOSING)
207
208int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
209			struct tcp_ao_key *key, struct tcphdr *th,
210			__u8 *hash_location);
211int tcp_ao_hash_skb(unsigned short int family,
212		    char *ao_hash, struct tcp_ao_key *key,
213		    const struct sock *sk, const struct sk_buff *skb,
214		    const u8 *tkey, int hash_offset, u32 sne);
215int tcp_parse_ao(struct sock *sk, int cmd, unsigned short int family,
216		 sockptr_t optval, int optlen);
217struct tcp_ao_key *tcp_ao_established_key(struct tcp_ao_info *ao,
218					  int sndid, int rcvid);
219int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk,
220			     struct request_sock *req, struct sk_buff *skb,
221			     int family);
222int tcp_ao_calc_traffic_key(struct tcp_ao_key *mkt, u8 *key, void *ctx,
223			    unsigned int len, struct tcp_sigpool *hp);
224void tcp_ao_destroy_sock(struct sock *sk, bool twsk);
225void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp);
226bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code);
227int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen);
228int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen);
229int tcp_ao_get_repair(struct sock *sk, sockptr_t optval, sockptr_t optlen);
230int tcp_ao_set_repair(struct sock *sk, sockptr_t optval, unsigned int optlen);
231enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk,
232			const struct sk_buff *skb, unsigned short int family,
233			const struct request_sock *req, int l3index,
234			const struct tcp_ao_hdr *aoh);
235u32 tcp_ao_compute_sne(u32 next_sne, u32 next_seq, u32 seq);
236struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk, int l3index,
237				    const union tcp_ao_addr *addr,
238				    int family, int sndid, int rcvid);
239int tcp_ao_hash_hdr(unsigned short family, char *ao_hash,
240		    struct tcp_ao_key *key, const u8 *tkey,
241		    const union tcp_ao_addr *daddr,
242		    const union tcp_ao_addr *saddr,
243		    const struct tcphdr *th, u32 sne);
244int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb,
245			 const struct tcp_ao_hdr *aoh, int l3index, u32 seq,
246			 struct tcp_ao_key **key, char **traffic_key,
247			 bool *allocated_traffic_key, u8 *keyid, u32 *sne);
248
249/* ipv4 specific functions */
250int tcp_v4_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen);
251struct tcp_ao_key *tcp_v4_ao_lookup(const struct sock *sk, struct sock *addr_sk,
252				    int sndid, int rcvid);
253int tcp_v4_ao_synack_hash(char *ao_hash, struct tcp_ao_key *mkt,
254			  struct request_sock *req, const struct sk_buff *skb,
255			  int hash_offset, u32 sne);
256int tcp_v4_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key,
257			  const struct sock *sk,
258			  __be32 sisn, __be32 disn, bool send);
259int tcp_v4_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key,
260			   struct request_sock *req);
261struct tcp_ao_key *tcp_v4_ao_lookup_rsk(const struct sock *sk,
262					struct request_sock *req,
263					int sndid, int rcvid);
264int tcp_v4_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key,
265		       const struct sock *sk, const struct sk_buff *skb,
266		       const u8 *tkey, int hash_offset, u32 sne);
267/* ipv6 specific functions */
268int tcp_v6_ao_hash_pseudoheader(struct tcp_sigpool *hp,
269				const struct in6_addr *daddr,
270				const struct in6_addr *saddr, int nbytes);
271int tcp_v6_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key,
272			   const struct sk_buff *skb, __be32 sisn, __be32 disn);
273int tcp_v6_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key,
274			  const struct sock *sk, __be32 sisn,
275			  __be32 disn, bool send);
276int tcp_v6_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key,
277			   struct request_sock *req);
278struct tcp_ao_key *tcp_v6_ao_lookup(const struct sock *sk,
279				    struct sock *addr_sk, int sndid, int rcvid);
280struct tcp_ao_key *tcp_v6_ao_lookup_rsk(const struct sock *sk,
281					struct request_sock *req,
282					int sndid, int rcvid);
283int tcp_v6_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key,
284		       const struct sock *sk, const struct sk_buff *skb,
285		       const u8 *tkey, int hash_offset, u32 sne);
286int tcp_v6_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen);
287int tcp_v6_ao_synack_hash(char *ao_hash, struct tcp_ao_key *ao_key,
288			  struct request_sock *req, const struct sk_buff *skb,
289			  int hash_offset, u32 sne);
290void tcp_ao_established(struct sock *sk);
291void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb);
292void tcp_ao_connect_init(struct sock *sk);
293void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
294		      struct request_sock *req, unsigned short int family);
295#else /* CONFIG_TCP_AO */
296
297static inline int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
298				      struct tcp_ao_key *key, struct tcphdr *th,
299				      __u8 *hash_location)
300{
301	return 0;
302}
303
304static inline void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
305				    struct request_sock *req, unsigned short int family)
306{
307}
308
309static inline bool tcp_ao_ignore_icmp(const struct sock *sk, int family,
310				      int type, int code)
311{
312	return false;
313}
314
315static inline enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk,
316		const struct sk_buff *skb, unsigned short int family,
317		const struct request_sock *req, int l3index,
318		const struct tcp_ao_hdr *aoh)
319{
320	return SKB_NOT_DROPPED_YET;
321}
322
323static inline struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk,
324		int l3index, const union tcp_ao_addr *addr,
325		int family, int sndid, int rcvid)
326{
327	return NULL;
328}
329
330static inline void tcp_ao_destroy_sock(struct sock *sk, bool twsk)
331{
332}
333
334static inline void tcp_ao_established(struct sock *sk)
335{
336}
337
338static inline void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb)
339{
340}
341
342static inline void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw,
343				    struct tcp_sock *tp)
344{
345}
346
347static inline void tcp_ao_connect_init(struct sock *sk)
348{
349}
350
351static inline int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen)
352{
353	return -ENOPROTOOPT;
354}
355
356static inline int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen)
357{
358	return -ENOPROTOOPT;
359}
360
361static inline int tcp_ao_get_repair(struct sock *sk,
362				    sockptr_t optval, sockptr_t optlen)
363{
364	return -ENOPROTOOPT;
365}
366
367static inline int tcp_ao_set_repair(struct sock *sk,
368				    sockptr_t optval, unsigned int optlen)
369{
370	return -ENOPROTOOPT;
371}
372#endif
373
374#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
375int tcp_do_parse_auth_options(const struct tcphdr *th,
376			      const u8 **md5_hash, const u8 **ao_hash);
377#else
378static inline int tcp_do_parse_auth_options(const struct tcphdr *th,
379		const u8 **md5_hash, const u8 **ao_hash)
380{
381	*md5_hash = NULL;
382	*ao_hash = NULL;
383	return 0;
384}
385#endif
386
387#endif /* _TCP_AO_H */