// SPDX-License-Identifier: GPL-2.0-or-later /* * INET An implementation of the TCP Authentication Option (TCP-AO). * See RFC5925. * * Authors: Dmitry Safonov <[email protected]> * Francesco Ruggeri <[email protected]> * Salam Noureddine <[email protected]> */ #define pr_fmt(fmt) … #include <crypto/hash.h> #include <linux/inetdevice.h> #include <linux/tcp.h> #include <net/tcp.h> #include <net/ipv6.h> #include <net/icmp.h> #include <trace/events/tcp.h> DEFINE_STATIC_KEY_DEFERRED_FALSE(…) …; int tcp_ao_calc_traffic_key(struct tcp_ao_key *mkt, u8 *key, void *ctx, unsigned int len, struct tcp_sigpool *hp) { … } bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code) { … } /* Optimized version of tcp_ao_do_lookup(): only for sockets for which * it's known that the keys in ao_info are matching peer's * family/address/VRF/etc. */ struct tcp_ao_key *tcp_ao_established_key(struct tcp_ao_info *ao, int sndid, int rcvid) { … } static int ipv4_prefix_cmp(const struct in_addr *addr1, const struct in_addr *addr2, unsigned int prefixlen) { … } static int __tcp_ao_key_cmp(const struct tcp_ao_key *key, int l3index, const union tcp_ao_addr *addr, u8 prefixlen, int family, int sndid, int rcvid) { … } static int tcp_ao_key_cmp(const struct tcp_ao_key *key, int l3index, const union tcp_ao_addr *addr, u8 prefixlen, int family, int sndid, int rcvid) { … } static struct tcp_ao_key *__tcp_ao_do_lookup(const struct sock *sk, int l3index, const union tcp_ao_addr *addr, int family, u8 prefix, int sndid, int rcvid) { … } struct tcp_ao_key *tcp_ao_do_lookup(const struct sock *sk, int l3index, const union tcp_ao_addr *addr, int family, int sndid, int rcvid) { … } static struct tcp_ao_info *tcp_ao_alloc_info(gfp_t flags) { … } static void tcp_ao_link_mkt(struct tcp_ao_info *ao, struct tcp_ao_key *mkt) { … } static struct tcp_ao_key *tcp_ao_copy_key(struct sock *sk, struct tcp_ao_key *key) { … } static void tcp_ao_key_free_rcu(struct rcu_head *head) { … } static void tcp_ao_info_free_rcu(struct rcu_head *head) { … } static void tcp_ao_sk_omem_free(struct sock *sk, struct tcp_ao_info *ao) { … } void tcp_ao_destroy_sock(struct sock *sk, bool twsk) { … } void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp) { … } /* 4 tuple and ISNs are expected in NBO */ static int tcp_v4_ao_calc_key(struct tcp_ao_key *mkt, u8 *key, __be32 saddr, __be32 daddr, __be16 sport, __be16 dport, __be32 sisn, __be32 disn) { … } int tcp_v4_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key, const struct sock *sk, __be32 sisn, __be32 disn, bool send) { … } static int tcp_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key, const struct sock *sk, __be32 sisn, __be32 disn, bool send) { … } int tcp_v4_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key, struct request_sock *req) { … } static int tcp_v4_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key, const struct sk_buff *skb, __be32 sisn, __be32 disn) { … } static int tcp_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key, const struct sk_buff *skb, __be32 sisn, __be32 disn, int family) { … } static int tcp_v4_ao_hash_pseudoheader(struct tcp_sigpool *hp, __be32 daddr, __be32 saddr, int nbytes) { … } static int tcp_ao_hash_pseudoheader(unsigned short int family, const struct sock *sk, const struct sk_buff *skb, struct tcp_sigpool *hp, int nbytes) { … } u32 tcp_ao_compute_sne(u32 next_sne, u32 next_seq, u32 seq) { … } /* tcp_ao_hash_sne(struct tcp_sigpool *hp) * @hp - used for hashing * @sne - sne value */ static int tcp_ao_hash_sne(struct tcp_sigpool *hp, u32 sne) { … } static int tcp_ao_hash_header(struct tcp_sigpool *hp, const struct tcphdr *th, bool exclude_options, u8 *hash, int hash_offset, int hash_len) { … } int tcp_ao_hash_hdr(unsigned short int family, char *ao_hash, struct tcp_ao_key *key, const u8 *tkey, const union tcp_ao_addr *daddr, const union tcp_ao_addr *saddr, const struct tcphdr *th, u32 sne) { … } int tcp_ao_hash_skb(unsigned short int family, char *ao_hash, struct tcp_ao_key *key, const struct sock *sk, const struct sk_buff *skb, const u8 *tkey, int hash_offset, u32 sne) { … } int tcp_v4_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key, const struct sock *sk, const struct sk_buff *skb, const u8 *tkey, int hash_offset, u32 sne) { … } int tcp_v4_ao_synack_hash(char *ao_hash, struct tcp_ao_key *ao_key, struct request_sock *req, const struct sk_buff *skb, int hash_offset, u32 sne) { … } struct tcp_ao_key *tcp_v4_ao_lookup_rsk(const struct sock *sk, struct request_sock *req, int sndid, int rcvid) { … } struct tcp_ao_key *tcp_v4_ao_lookup(const struct sock *sk, struct sock *addr_sk, int sndid, int rcvid) { … } int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb, const struct tcp_ao_hdr *aoh, int l3index, u32 seq, struct tcp_ao_key **key, char **traffic_key, bool *allocated_traffic_key, u8 *keyid, u32 *sne) { … } int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb, struct tcp_ao_key *key, struct tcphdr *th, __u8 *hash_location) { … } static struct tcp_ao_key *tcp_ao_inbound_lookup(unsigned short int family, const struct sock *sk, const struct sk_buff *skb, int sndid, int rcvid, int l3index) { … } void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, struct request_sock *req, unsigned short int family) { … } static enum skb_drop_reason tcp_ao_verify_hash(const struct sock *sk, const struct sk_buff *skb, unsigned short int family, struct tcp_ao_info *info, const struct tcp_ao_hdr *aoh, struct tcp_ao_key *key, u8 *traffic_key, u8 *phash, u32 sne, int l3index) { … } enum skb_drop_reason tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb, unsigned short int family, const struct request_sock *req, int l3index, const struct tcp_ao_hdr *aoh) { … } static int tcp_ao_cache_traffic_keys(const struct sock *sk, struct tcp_ao_info *ao, struct tcp_ao_key *ao_key) { … } void tcp_ao_connect_init(struct sock *sk) { … } void tcp_ao_established(struct sock *sk) { … } void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb) { … } int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk, struct request_sock *req, struct sk_buff *skb, int family) { … } static bool tcp_ao_can_set_current_rnext(struct sock *sk) { … } static int tcp_ao_verify_ipv4(struct sock *sk, struct tcp_ao_add *cmd, union tcp_ao_addr **addr) { … } static int tcp_ao_parse_crypto(struct tcp_ao_add *cmd, struct tcp_ao_key *key) { … } #if IS_ENABLED(CONFIG_IPV6) static int tcp_ao_verify_ipv6(struct sock *sk, struct tcp_ao_add *cmd, union tcp_ao_addr **paddr, unsigned short int *family) { … } #else static int tcp_ao_verify_ipv6(struct sock *sk, struct tcp_ao_add *cmd, union tcp_ao_addr **paddr, unsigned short int *family) { return -EOPNOTSUPP; } #endif static struct tcp_ao_info *setsockopt_ao_info(struct sock *sk) { … } static struct tcp_ao_info *getsockopt_ao_info(struct sock *sk) { … } #define TCP_AO_KEYF_ALL … #define TCP_AO_GET_KEYF_VALID … static struct tcp_ao_key *tcp_ao_key_alloc(struct sock *sk, struct tcp_ao_add *cmd) { … } static int tcp_ao_add_cmd(struct sock *sk, unsigned short int family, sockptr_t optval, int optlen) { … } static int tcp_ao_delete_key(struct sock *sk, struct tcp_ao_info *ao_info, bool del_async, struct tcp_ao_key *key, struct tcp_ao_key *new_current, struct tcp_ao_key *new_rnext) { … } #define TCP_AO_DEL_KEYF_ALL … static int tcp_ao_del_cmd(struct sock *sk, unsigned short int family, sockptr_t optval, int optlen) { … } /* cmd.ao_required makes a socket TCP-AO only. * Don't allow any md5 keys for any l3intf on the socket together with it. * Restricting it early in setsockopt() removes a check for * ao_info->ao_required on inbound tcp segment fast-path. */ static int tcp_ao_required_verify(struct sock *sk) { … } static int tcp_ao_info_cmd(struct sock *sk, unsigned short int family, sockptr_t optval, int optlen) { … } int tcp_parse_ao(struct sock *sk, int cmd, unsigned short int family, sockptr_t optval, int optlen) { … } int tcp_v4_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen) { … } /* tcp_ao_copy_mkts_to_user(ao_info, optval, optlen) * * @ao_info: struct tcp_ao_info on the socket that * socket getsockopt(TCP_AO_GET_KEYS) is executed on * @optval: pointer to array of tcp_ao_getsockopt structures in user space. * Must be != NULL. * @optlen: pointer to size of tcp_ao_getsockopt structure. * Must be != NULL. * * Return value: 0 on success, a negative error number otherwise. * * optval points to an array of tcp_ao_getsockopt structures in user space. * optval[0] is used as both input and output to getsockopt. It determines * which keys are returned by the kernel. * optval[0].nkeys is the size of the array in user space. On return it contains * the number of keys matching the search criteria. * If tcp_ao_getsockopt::get_all is set, then all keys in the socket are * returned, otherwise only keys matching <addr, prefix, sndid, rcvid> * in optval[0] are returned. * optlen is also used as both input and output. The user provides the size * of struct tcp_ao_getsockopt in user space, and the kernel returns the size * of the structure in kernel space. * The size of struct tcp_ao_getsockopt may differ between user and kernel. * There are three cases to consider: * * If usize == ksize, then keys are copied verbatim. * * If usize < ksize, then the userspace has passed an old struct to a * newer kernel. The rest of the trailing bytes in optval[0] * (ksize - usize) are interpreted as 0 by the kernel. * * If usize > ksize, then the userspace has passed a new struct to an * older kernel. The trailing bytes unknown to the kernel (usize - ksize) * are checked to ensure they are zeroed, otherwise -E2BIG is returned. * On return the kernel fills in min(usize, ksize) in each entry of the array. * The layout of the fields in the user and kernel structures is expected to * be the same (including in the 32bit vs 64bit case). */ static int tcp_ao_copy_mkts_to_user(struct tcp_ao_info *ao_info, sockptr_t optval, sockptr_t optlen) { … } int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen) { … } int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen) { … } int tcp_ao_set_repair(struct sock *sk, sockptr_t optval, unsigned int optlen) { … } int tcp_ao_get_repair(struct sock *sk, sockptr_t optval, sockptr_t optlen) { … }
Codebase Browser
linux