Loading...
1/* SPDX-License-Identifier: GPL-2.0-or-later */
2#ifndef _TCP_AO_H
3#define _TCP_AO_H
4
5#define TCP_AO_KEY_ALIGN 1
6#define __tcp_ao_key_align __aligned(TCP_AO_KEY_ALIGN)
7
8union tcp_ao_addr {
9 struct in_addr a4;
10#if IS_ENABLED(CONFIG_IPV6)
11 struct in6_addr a6;
12#endif
13};
14
15struct tcp_ao_hdr {
16 u8 kind;
17 u8 length;
18 u8 keyid;
19 u8 rnext_keyid;
20};
21
22static inline u8 tcp_ao_hdr_maclen(const struct tcp_ao_hdr *aoh)
23{
24 return aoh->length - sizeof(struct tcp_ao_hdr);
25}
26
27struct tcp_ao_counters {
28 atomic64_t pkt_good;
29 atomic64_t pkt_bad;
30 atomic64_t key_not_found;
31 atomic64_t ao_required;
32 atomic64_t dropped_icmp;
33};
34
35struct tcp_ao_key {
36 struct hlist_node node;
37 union tcp_ao_addr addr;
38 u8 key[TCP_AO_MAXKEYLEN] __tcp_ao_key_align;
39 unsigned int tcp_sigpool_id;
40 unsigned int digest_size;
41 int l3index;
42 u8 prefixlen;
43 u8 family;
44 u8 keylen;
45 u8 keyflags;
46 u8 sndid;
47 u8 rcvid;
48 u8 maclen;
49 struct rcu_head rcu;
50 atomic64_t pkt_good;
51 atomic64_t pkt_bad;
52 u8 traffic_keys[];
53};
54
55static inline u8 *rcv_other_key(struct tcp_ao_key *key)
56{
57 return key->traffic_keys;
58}
59
60static inline u8 *snd_other_key(struct tcp_ao_key *key)
61{
62 return key->traffic_keys + key->digest_size;
63}
64
65static inline int tcp_ao_maclen(const struct tcp_ao_key *key)
66{
67 return key->maclen;
68}
69
70/* Use tcp_ao_len_aligned() for TCP header calculations */
71static inline int tcp_ao_len(const struct tcp_ao_key *key)
72{
73 return tcp_ao_maclen(key) + sizeof(struct tcp_ao_hdr);
74}
75
76static inline int tcp_ao_len_aligned(const struct tcp_ao_key *key)
77{
78 return round_up(tcp_ao_len(key), 4);
79}
80
81static inline unsigned int tcp_ao_digest_size(struct tcp_ao_key *key)
82{
83 return key->digest_size;
84}
85
86static inline int tcp_ao_sizeof_key(const struct tcp_ao_key *key)
87{
88 return sizeof(struct tcp_ao_key) + (key->digest_size << 1);
89}
90
91struct tcp_ao_info {
92 /* List of tcp_ao_key's */
93 struct hlist_head head;
94 /* current_key and rnext_key are maintained on sockets
95 * in TCP_AO_ESTABLISHED states.
96 * Their purpose is to cache keys on established connections,
97 * saving needless lookups. Never dereference any of them from
98 * listen sockets.
99 * ::current_key may change in RX to the key that was requested by
100 * the peer, please use READ_ONCE()/WRITE_ONCE() in order to avoid
101 * load/store tearing.
102 * Do the same for ::rnext_key, if you don't hold socket lock
103 * (it's changed only by userspace request in setsockopt()).
104 */
105 struct tcp_ao_key *current_key;
106 struct tcp_ao_key *rnext_key;
107 struct tcp_ao_counters counters;
108 u32 ao_required :1,
109 accept_icmps :1,
110 __unused :30;
111 __be32 lisn;
112 __be32 risn;
113 /* Sequence Number Extension (SNE) are upper 4 bytes for SEQ,
114 * that protect TCP-AO connection from replayed old TCP segments.
115 * See RFC5925 (6.2).
116 * In order to get correct SNE, there's a helper tcp_ao_compute_sne().
117 * It needs SEQ basis to understand whereabouts are lower SEQ numbers.
118 * According to that basis vector, it can provide incremented SNE
119 * when SEQ rolls over or provide decremented SNE when there's
120 * a retransmitted segment from before-rolling over.
121 * - for request sockets such basis is rcv_isn/snt_isn, which seems
122 * good enough as it's unexpected to receive 4 Gbytes on reqsk.
123 * - for full sockets the basis is rcv_nxt/snd_una. snd_una is
124 * taken instead of snd_nxt as currently it's easier to track
125 * in tcp_snd_una_update(), rather than updating SNE in all
126 * WRITE_ONCE(tp->snd_nxt, ...)
127 * - for time-wait sockets the basis is tw_rcv_nxt/tw_snd_nxt.
128 * tw_snd_nxt is not expected to change, while tw_rcv_nxt may.
129 */
130 u32 snd_sne;
131 u32 rcv_sne;
132 refcount_t refcnt; /* Protects twsk destruction */
133 struct rcu_head rcu;
134};
135
136#ifdef CONFIG_TCP_MD5SIG
137#include <linux/jump_label.h>
138extern struct static_key_false_deferred tcp_md5_needed;
139#define static_branch_tcp_md5() static_branch_unlikely(&tcp_md5_needed.key)
140#else
141#define static_branch_tcp_md5() false
142#endif
143#ifdef CONFIG_TCP_AO
144/* TCP-AO structures and functions */
145#include <linux/jump_label.h>
146extern struct static_key_false_deferred tcp_ao_needed;
147#define static_branch_tcp_ao() static_branch_unlikely(&tcp_ao_needed.key)
148#else
149#define static_branch_tcp_ao() false
150#endif
151
152#ifdef CONFIG_TCP_AO
153/* TCP-AO structures and functions */
154struct tcp4_ao_context {
155 __be32 saddr;
156 __be32 daddr;
157 __be16 sport;
158 __be16 dport;
159 __be32 sisn;
160 __be32 disn;
161};
162
163struct tcp6_ao_context {
164 struct in6_addr saddr;
165 struct in6_addr daddr;
166 __be16 sport;
167 __be16 dport;
168 __be32 sisn;
169 __be32 disn;
170};
171
172struct tcp_sigpool;
173/* Established states are fast-path and there always is current_key/rnext_key */
174#define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \
175 TCPF_CLOSE_WAIT | TCPF_LAST_ACK | TCPF_CLOSING)
176
177int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
178 struct tcp_ao_key *key, struct tcphdr *th,
179 __u8 *hash_location);
180int tcp_ao_hash_skb(unsigned short int family,
181 char *ao_hash, struct tcp_ao_key *key,
182 const struct sock *sk, const struct sk_buff *skb,
183 const u8 *tkey, int hash_offset, u32 sne);
184int tcp_parse_ao(struct sock *sk, int cmd, unsigned short int family,
185 sockptr_t optval, int optlen);
186struct tcp_ao_key *tcp_ao_established_key(const struct sock *sk,
187 struct tcp_ao_info *ao,
188 int sndid, int rcvid);
189int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk,
190 struct request_sock *req, struct sk_buff *skb,
191 int family);
192int tcp_ao_calc_traffic_key(struct tcp_ao_key *mkt, u8 *key, void *ctx,
193 unsigned int len, struct tcp_sigpool *hp);
194void tcp_ao_destroy_sock(struct sock *sk, bool twsk);
195void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp);
196bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code);
197int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen);
198int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen);
199int tcp_ao_get_repair(struct sock *sk, sockptr_t optval, sockptr_t optlen);
200int tcp_ao_set_repair(struct sock *sk, sockptr_t optval, unsigned int optlen);
201enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk,
202 const struct sk_buff *skb, unsigned short int family,
203 const struct request_sock *req, int l3index,
204 const struct tcp_ao_hdr *aoh);
205u32 tcp_ao_compute_sne(u32 next_sne, u32 next_seq, u32 seq);
206struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk, int l3index,
207 const union tcp_ao_addr *addr,
208 int family, int sndid, int rcvid);
209int tcp_ao_hash_hdr(unsigned short family, char *ao_hash,
210 struct tcp_ao_key *key, const u8 *tkey,
211 const union tcp_ao_addr *daddr,
212 const union tcp_ao_addr *saddr,
213 const struct tcphdr *th, u32 sne);
214int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb,
215 const struct tcp_ao_hdr *aoh, int l3index, u32 seq,
216 struct tcp_ao_key **key, char **traffic_key,
217 bool *allocated_traffic_key, u8 *keyid, u32 *sne);
218
219/* ipv4 specific functions */
220int tcp_v4_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen);
221struct tcp_ao_key *tcp_v4_ao_lookup(const struct sock *sk, struct sock *addr_sk,
222 int sndid, int rcvid);
223int tcp_v4_ao_synack_hash(char *ao_hash, struct tcp_ao_key *mkt,
224 struct request_sock *req, const struct sk_buff *skb,
225 int hash_offset, u32 sne);
226int tcp_v4_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key,
227 const struct sock *sk,
228 __be32 sisn, __be32 disn, bool send);
229int tcp_v4_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key,
230 struct request_sock *req);
231struct tcp_ao_key *tcp_v4_ao_lookup_rsk(const struct sock *sk,
232 struct request_sock *req,
233 int sndid, int rcvid);
234int tcp_v4_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key,
235 const struct sock *sk, const struct sk_buff *skb,
236 const u8 *tkey, int hash_offset, u32 sne);
237/* ipv6 specific functions */
238int tcp_v6_ao_hash_pseudoheader(struct tcp_sigpool *hp,
239 const struct in6_addr *daddr,
240 const struct in6_addr *saddr, int nbytes);
241int tcp_v6_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key,
242 const struct sk_buff *skb, __be32 sisn, __be32 disn);
243int tcp_v6_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key,
244 const struct sock *sk, __be32 sisn,
245 __be32 disn, bool send);
246int tcp_v6_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key,
247 struct request_sock *req);
248struct tcp_ao_key *tcp_v6_ao_lookup(const struct sock *sk,
249 struct sock *addr_sk, int sndid, int rcvid);
250struct tcp_ao_key *tcp_v6_ao_lookup_rsk(const struct sock *sk,
251 struct request_sock *req,
252 int sndid, int rcvid);
253int tcp_v6_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key,
254 const struct sock *sk, const struct sk_buff *skb,
255 const u8 *tkey, int hash_offset, u32 sne);
256int tcp_v6_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen);
257int tcp_v6_ao_synack_hash(char *ao_hash, struct tcp_ao_key *ao_key,
258 struct request_sock *req, const struct sk_buff *skb,
259 int hash_offset, u32 sne);
260void tcp_ao_established(struct sock *sk);
261void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb);
262void tcp_ao_connect_init(struct sock *sk);
263void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
264 struct request_sock *req, unsigned short int family);
265#else /* CONFIG_TCP_AO */
266
267static inline int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
268 struct tcp_ao_key *key, struct tcphdr *th,
269 __u8 *hash_location)
270{
271 return 0;
272}
273
274static inline void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
275 struct request_sock *req, unsigned short int family)
276{
277}
278
279static inline bool tcp_ao_ignore_icmp(const struct sock *sk, int family,
280 int type, int code)
281{
282 return false;
283}
284
285static inline enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk,
286 const struct sk_buff *skb, unsigned short int family,
287 const struct request_sock *req, int l3index,
288 const struct tcp_ao_hdr *aoh)
289{
290 return SKB_NOT_DROPPED_YET;
291}
292
293static inline struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk,
294 int l3index, const union tcp_ao_addr *addr,
295 int family, int sndid, int rcvid)
296{
297 return NULL;
298}
299
300static inline void tcp_ao_destroy_sock(struct sock *sk, bool twsk)
301{
302}
303
304static inline void tcp_ao_established(struct sock *sk)
305{
306}
307
308static inline void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb)
309{
310}
311
312static inline void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw,
313 struct tcp_sock *tp)
314{
315}
316
317static inline void tcp_ao_connect_init(struct sock *sk)
318{
319}
320
321static inline int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen)
322{
323 return -ENOPROTOOPT;
324}
325
326static inline int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen)
327{
328 return -ENOPROTOOPT;
329}
330
331static inline int tcp_ao_get_repair(struct sock *sk,
332 sockptr_t optval, sockptr_t optlen)
333{
334 return -ENOPROTOOPT;
335}
336
337static inline int tcp_ao_set_repair(struct sock *sk,
338 sockptr_t optval, unsigned int optlen)
339{
340 return -ENOPROTOOPT;
341}
342#endif
343
344#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
345int tcp_do_parse_auth_options(const struct tcphdr *th,
346 const u8 **md5_hash, const u8 **ao_hash);
347#else
348static inline int tcp_do_parse_auth_options(const struct tcphdr *th,
349 const u8 **md5_hash, const u8 **ao_hash)
350{
351 *md5_hash = NULL;
352 *ao_hash = NULL;
353 return 0;
354}
355#endif
356
357#endif /* _TCP_AO_H */
1/* SPDX-License-Identifier: GPL-2.0-or-later */
2#ifndef _TCP_AO_H
3#define _TCP_AO_H
4
5#define TCP_AO_KEY_ALIGN 1
6#define __tcp_ao_key_align __aligned(TCP_AO_KEY_ALIGN)
7
8union tcp_ao_addr {
9 struct in_addr a4;
10#if IS_ENABLED(CONFIG_IPV6)
11 struct in6_addr a6;
12#endif
13};
14
15struct tcp_ao_hdr {
16 u8 kind;
17 u8 length;
18 u8 keyid;
19 u8 rnext_keyid;
20};
21
22struct tcp_ao_counters {
23 atomic64_t pkt_good;
24 atomic64_t pkt_bad;
25 atomic64_t key_not_found;
26 atomic64_t ao_required;
27 atomic64_t dropped_icmp;
28};
29
30struct tcp_ao_key {
31 struct hlist_node node;
32 union tcp_ao_addr addr;
33 u8 key[TCP_AO_MAXKEYLEN] __tcp_ao_key_align;
34 unsigned int tcp_sigpool_id;
35 unsigned int digest_size;
36 int l3index;
37 u8 prefixlen;
38 u8 family;
39 u8 keylen;
40 u8 keyflags;
41 u8 sndid;
42 u8 rcvid;
43 u8 maclen;
44 struct rcu_head rcu;
45 atomic64_t pkt_good;
46 atomic64_t pkt_bad;
47 u8 traffic_keys[];
48};
49
50static inline u8 *rcv_other_key(struct tcp_ao_key *key)
51{
52 return key->traffic_keys;
53}
54
55static inline u8 *snd_other_key(struct tcp_ao_key *key)
56{
57 return key->traffic_keys + key->digest_size;
58}
59
60static inline int tcp_ao_maclen(const struct tcp_ao_key *key)
61{
62 return key->maclen;
63}
64
65/* Use tcp_ao_len_aligned() for TCP header calculations */
66static inline int tcp_ao_len(const struct tcp_ao_key *key)
67{
68 return tcp_ao_maclen(key) + sizeof(struct tcp_ao_hdr);
69}
70
71static inline int tcp_ao_len_aligned(const struct tcp_ao_key *key)
72{
73 return round_up(tcp_ao_len(key), 4);
74}
75
76static inline unsigned int tcp_ao_digest_size(struct tcp_ao_key *key)
77{
78 return key->digest_size;
79}
80
81static inline int tcp_ao_sizeof_key(const struct tcp_ao_key *key)
82{
83 return sizeof(struct tcp_ao_key) + (key->digest_size << 1);
84}
85
86struct tcp_ao_info {
87 /* List of tcp_ao_key's */
88 struct hlist_head head;
89 /* current_key and rnext_key aren't maintained on listen sockets.
90 * Their purpose is to cache keys on established connections,
91 * saving needless lookups. Never dereference any of them from
92 * listen sockets.
93 * ::current_key may change in RX to the key that was requested by
94 * the peer, please use READ_ONCE()/WRITE_ONCE() in order to avoid
95 * load/store tearing.
96 * Do the same for ::rnext_key, if you don't hold socket lock
97 * (it's changed only by userspace request in setsockopt()).
98 */
99 struct tcp_ao_key *current_key;
100 struct tcp_ao_key *rnext_key;
101 struct tcp_ao_counters counters;
102 u32 ao_required :1,
103 accept_icmps :1,
104 __unused :30;
105 __be32 lisn;
106 __be32 risn;
107 /* Sequence Number Extension (SNE) are upper 4 bytes for SEQ,
108 * that protect TCP-AO connection from replayed old TCP segments.
109 * See RFC5925 (6.2).
110 * In order to get correct SNE, there's a helper tcp_ao_compute_sne().
111 * It needs SEQ basis to understand whereabouts are lower SEQ numbers.
112 * According to that basis vector, it can provide incremented SNE
113 * when SEQ rolls over or provide decremented SNE when there's
114 * a retransmitted segment from before-rolling over.
115 * - for request sockets such basis is rcv_isn/snt_isn, which seems
116 * good enough as it's unexpected to receive 4 Gbytes on reqsk.
117 * - for full sockets the basis is rcv_nxt/snd_una. snd_una is
118 * taken instead of snd_nxt as currently it's easier to track
119 * in tcp_snd_una_update(), rather than updating SNE in all
120 * WRITE_ONCE(tp->snd_nxt, ...)
121 * - for time-wait sockets the basis is tw_rcv_nxt/tw_snd_nxt.
122 * tw_snd_nxt is not expected to change, while tw_rcv_nxt may.
123 */
124 u32 snd_sne;
125 u32 rcv_sne;
126 refcount_t refcnt; /* Protects twsk destruction */
127 struct rcu_head rcu;
128};
129
130#ifdef CONFIG_TCP_MD5SIG
131#include <linux/jump_label.h>
132extern struct static_key_false_deferred tcp_md5_needed;
133#define static_branch_tcp_md5() static_branch_unlikely(&tcp_md5_needed.key)
134#else
135#define static_branch_tcp_md5() false
136#endif
137#ifdef CONFIG_TCP_AO
138/* TCP-AO structures and functions */
139#include <linux/jump_label.h>
140extern struct static_key_false_deferred tcp_ao_needed;
141#define static_branch_tcp_ao() static_branch_unlikely(&tcp_ao_needed.key)
142#else
143#define static_branch_tcp_ao() false
144#endif
145
146static inline bool tcp_hash_should_produce_warnings(void)
147{
148 return static_branch_tcp_md5() || static_branch_tcp_ao();
149}
150
151#define tcp_hash_fail(msg, family, skb, fmt, ...) \
152do { \
153 const struct tcphdr *th = tcp_hdr(skb); \
154 char hdr_flags[6]; \
155 char *f = hdr_flags; \
156 \
157 if (!tcp_hash_should_produce_warnings()) \
158 break; \
159 if (th->fin) \
160 *f++ = 'F'; \
161 if (th->syn) \
162 *f++ = 'S'; \
163 if (th->rst) \
164 *f++ = 'R'; \
165 if (th->psh) \
166 *f++ = 'P'; \
167 if (th->ack) \
168 *f++ = '.'; \
169 *f = 0; \
170 if ((family) == AF_INET) { \
171 net_info_ratelimited("%s for %pI4.%d->%pI4.%d [%s] " fmt "\n", \
172 msg, &ip_hdr(skb)->saddr, ntohs(th->source), \
173 &ip_hdr(skb)->daddr, ntohs(th->dest), \
174 hdr_flags, ##__VA_ARGS__); \
175 } else { \
176 net_info_ratelimited("%s for [%pI6c].%d->[%pI6c].%d [%s]" fmt "\n", \
177 msg, &ipv6_hdr(skb)->saddr, ntohs(th->source), \
178 &ipv6_hdr(skb)->daddr, ntohs(th->dest), \
179 hdr_flags, ##__VA_ARGS__); \
180 } \
181} while (0)
182
183#ifdef CONFIG_TCP_AO
184/* TCP-AO structures and functions */
185struct tcp4_ao_context {
186 __be32 saddr;
187 __be32 daddr;
188 __be16 sport;
189 __be16 dport;
190 __be32 sisn;
191 __be32 disn;
192};
193
194struct tcp6_ao_context {
195 struct in6_addr saddr;
196 struct in6_addr daddr;
197 __be16 sport;
198 __be16 dport;
199 __be32 sisn;
200 __be32 disn;
201};
202
203struct tcp_sigpool;
204#define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \
205 TCPF_CLOSE | TCPF_CLOSE_WAIT | \
206 TCPF_LAST_ACK | TCPF_CLOSING)
207
208int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
209 struct tcp_ao_key *key, struct tcphdr *th,
210 __u8 *hash_location);
211int tcp_ao_hash_skb(unsigned short int family,
212 char *ao_hash, struct tcp_ao_key *key,
213 const struct sock *sk, const struct sk_buff *skb,
214 const u8 *tkey, int hash_offset, u32 sne);
215int tcp_parse_ao(struct sock *sk, int cmd, unsigned short int family,
216 sockptr_t optval, int optlen);
217struct tcp_ao_key *tcp_ao_established_key(struct tcp_ao_info *ao,
218 int sndid, int rcvid);
219int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk,
220 struct request_sock *req, struct sk_buff *skb,
221 int family);
222int tcp_ao_calc_traffic_key(struct tcp_ao_key *mkt, u8 *key, void *ctx,
223 unsigned int len, struct tcp_sigpool *hp);
224void tcp_ao_destroy_sock(struct sock *sk, bool twsk);
225void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp);
226bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code);
227int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen);
228int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen);
229int tcp_ao_get_repair(struct sock *sk, sockptr_t optval, sockptr_t optlen);
230int tcp_ao_set_repair(struct sock *sk, sockptr_t optval, unsigned int optlen);
231enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk,
232 const struct sk_buff *skb, unsigned short int family,
233 const struct request_sock *req, int l3index,
234 const struct tcp_ao_hdr *aoh);
235u32 tcp_ao_compute_sne(u32 next_sne, u32 next_seq, u32 seq);
236struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk, int l3index,
237 const union tcp_ao_addr *addr,
238 int family, int sndid, int rcvid);
239int tcp_ao_hash_hdr(unsigned short family, char *ao_hash,
240 struct tcp_ao_key *key, const u8 *tkey,
241 const union tcp_ao_addr *daddr,
242 const union tcp_ao_addr *saddr,
243 const struct tcphdr *th, u32 sne);
244int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb,
245 const struct tcp_ao_hdr *aoh, int l3index, u32 seq,
246 struct tcp_ao_key **key, char **traffic_key,
247 bool *allocated_traffic_key, u8 *keyid, u32 *sne);
248
249/* ipv4 specific functions */
250int tcp_v4_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen);
251struct tcp_ao_key *tcp_v4_ao_lookup(const struct sock *sk, struct sock *addr_sk,
252 int sndid, int rcvid);
253int tcp_v4_ao_synack_hash(char *ao_hash, struct tcp_ao_key *mkt,
254 struct request_sock *req, const struct sk_buff *skb,
255 int hash_offset, u32 sne);
256int tcp_v4_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key,
257 const struct sock *sk,
258 __be32 sisn, __be32 disn, bool send);
259int tcp_v4_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key,
260 struct request_sock *req);
261struct tcp_ao_key *tcp_v4_ao_lookup_rsk(const struct sock *sk,
262 struct request_sock *req,
263 int sndid, int rcvid);
264int tcp_v4_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key,
265 const struct sock *sk, const struct sk_buff *skb,
266 const u8 *tkey, int hash_offset, u32 sne);
267/* ipv6 specific functions */
268int tcp_v6_ao_hash_pseudoheader(struct tcp_sigpool *hp,
269 const struct in6_addr *daddr,
270 const struct in6_addr *saddr, int nbytes);
271int tcp_v6_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key,
272 const struct sk_buff *skb, __be32 sisn, __be32 disn);
273int tcp_v6_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key,
274 const struct sock *sk, __be32 sisn,
275 __be32 disn, bool send);
276int tcp_v6_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key,
277 struct request_sock *req);
278struct tcp_ao_key *tcp_v6_ao_lookup(const struct sock *sk,
279 struct sock *addr_sk, int sndid, int rcvid);
280struct tcp_ao_key *tcp_v6_ao_lookup_rsk(const struct sock *sk,
281 struct request_sock *req,
282 int sndid, int rcvid);
283int tcp_v6_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key,
284 const struct sock *sk, const struct sk_buff *skb,
285 const u8 *tkey, int hash_offset, u32 sne);
286int tcp_v6_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen);
287int tcp_v6_ao_synack_hash(char *ao_hash, struct tcp_ao_key *ao_key,
288 struct request_sock *req, const struct sk_buff *skb,
289 int hash_offset, u32 sne);
290void tcp_ao_established(struct sock *sk);
291void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb);
292void tcp_ao_connect_init(struct sock *sk);
293void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
294 struct request_sock *req, unsigned short int family);
295#else /* CONFIG_TCP_AO */
296
297static inline int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
298 struct tcp_ao_key *key, struct tcphdr *th,
299 __u8 *hash_location)
300{
301 return 0;
302}
303
304static inline void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb,
305 struct request_sock *req, unsigned short int family)
306{
307}
308
309static inline bool tcp_ao_ignore_icmp(const struct sock *sk, int family,
310 int type, int code)
311{
312 return false;
313}
314
315static inline enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk,
316 const struct sk_buff *skb, unsigned short int family,
317 const struct request_sock *req, int l3index,
318 const struct tcp_ao_hdr *aoh)
319{
320 return SKB_NOT_DROPPED_YET;
321}
322
323static inline struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk,
324 int l3index, const union tcp_ao_addr *addr,
325 int family, int sndid, int rcvid)
326{
327 return NULL;
328}
329
330static inline void tcp_ao_destroy_sock(struct sock *sk, bool twsk)
331{
332}
333
334static inline void tcp_ao_established(struct sock *sk)
335{
336}
337
338static inline void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb)
339{
340}
341
342static inline void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw,
343 struct tcp_sock *tp)
344{
345}
346
347static inline void tcp_ao_connect_init(struct sock *sk)
348{
349}
350
351static inline int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen)
352{
353 return -ENOPROTOOPT;
354}
355
356static inline int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen)
357{
358 return -ENOPROTOOPT;
359}
360
361static inline int tcp_ao_get_repair(struct sock *sk,
362 sockptr_t optval, sockptr_t optlen)
363{
364 return -ENOPROTOOPT;
365}
366
367static inline int tcp_ao_set_repair(struct sock *sk,
368 sockptr_t optval, unsigned int optlen)
369{
370 return -ENOPROTOOPT;
371}
372#endif
373
374#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
375int tcp_do_parse_auth_options(const struct tcphdr *th,
376 const u8 **md5_hash, const u8 **ao_hash);
377#else
378static inline int tcp_do_parse_auth_options(const struct tcphdr *th,
379 const u8 **md5_hash, const u8 **ao_hash)
380{
381 *md5_hash = NULL;
382 *ao_hash = NULL;
383 return 0;
384}
385#endif
386
387#endif /* _TCP_AO_H */