Commit 67fa83f7 authored by Dmitry Safonov's avatar Dmitry Safonov Committed by David S. Miller
Browse files

net/tcp: Add static_key for TCP-AO 



Similarly to TCP-MD5, add a static key to TCP-AO that is patched out
when there are no keys on a machine and dynamically enabled with the
first setsockopt(TCP_AO) adds a key on any socket. The static key is as
well dynamically disabled later when the socket is destructed.

The lifetime of enabled static key here is the same as ao_info: it is
enabled on allocation, passed over from full socket to twsk and
destructed when ao_info is scheduled for destruction.

Signed-off-by: default avatarDmitry Safonov <dima@arista.com>
Acked-by: default avatarDavid Ahern <dsahern@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d6732b95

include/net/tcp.h

+16 −8
Original line number Diff line number Diff line
@@ -2288,15 +2288,19 @@ static inline void tcp_get_current_key(const struct sock *sk, 
#if defined(CONFIG_TCP_AO) || defined(CONFIG_TCP_MD5SIG)

	const struct tcp_sock *tp = tcp_sk(sk);

#endif



#ifdef CONFIG_TCP_AO

	if (static_branch_unlikely(&tcp_ao_needed.key)) {

		struct tcp_ao_info *ao;



	ao = rcu_dereference_protected(tp->ao_info, lockdep_sock_is_held(sk));

		ao = rcu_dereference_protected(tp->ao_info,

					       lockdep_sock_is_held(sk));

		if (ao) {

			out->ao_key = READ_ONCE(ao->current_key);

			out->type = TCP_KEY_AO;

			return;

		}

	}

#endif

#ifdef CONFIG_TCP_MD5SIG

	if (static_branch_unlikely(&tcp_md5_needed.key) &&
@@ -2324,7 +2328,8 @@ static inline bool tcp_key_is_md5(const struct tcp_key *key) 
static inline bool tcp_key_is_ao(const struct tcp_key *key)

{

#ifdef CONFIG_TCP_AO

	if (key->type == TCP_KEY_AO)

	if (static_branch_unlikely(&tcp_ao_needed.key) &&

	    key->type == TCP_KEY_AO)

		return true;

#endif

	return false;
@@ -2718,6 +2723,9 @@ static inline bool tcp_ao_required(struct sock *sk, const void *saddr, 
	struct tcp_ao_info *ao_info;

	struct tcp_ao_key *ao_key;



	if (!static_branch_unlikely(&tcp_ao_needed.key))

		return false;



	ao_info = rcu_dereference_check(tcp_sk(sk)->ao_info,

					lockdep_sock_is_held(sk));

	if (!ao_info)

include/net/tcp_ao.h

+2 −0
Original line number Diff line number Diff line
@@ -151,6 +151,8 @@ do { \ 


#ifdef CONFIG_TCP_AO

/* TCP-AO structures and functions */

#include <linux/jump_label.h>

extern struct static_key_false_deferred tcp_ao_needed;



struct tcp4_ao_context {

	__be32		saddr;

net/ipv4/tcp_ao.c

+22 −0
Original line number Diff line number Diff line
@@ -17,6 +17,8 @@ 
#include <net/ipv6.h>

#include <net/icmp.h>



DEFINE_STATIC_KEY_DEFERRED_FALSE(tcp_ao_needed, HZ);



int tcp_ao_calc_traffic_key(struct tcp_ao_key *mkt, u8 *key, void *ctx,

			    unsigned int len, struct tcp_sigpool *hp)

{
@@ -50,6 +52,9 @@ bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code) 
	bool ignore_icmp = false;

	struct tcp_ao_info *ao;



	if (!static_branch_unlikely(&tcp_ao_needed.key))

		return false;



	/* RFC5925, 7.8:

	 * >> A TCP-AO implementation MUST default to ignore incoming ICMPv4

	 * messages of Type 3 (destination unreachable), Codes 2-4 (protocol
@@ -185,6 +190,9 @@ static struct tcp_ao_key *__tcp_ao_do_lookup(const struct sock *sk, 
	struct tcp_ao_key *key;

	struct tcp_ao_info *ao;



	if (!static_branch_unlikely(&tcp_ao_needed.key))

		return NULL;



	ao = rcu_dereference_check(tcp_sk(sk)->ao_info,

				   lockdep_sock_is_held(sk));

	if (!ao)
@@ -276,6 +284,7 @@ void tcp_ao_destroy_sock(struct sock *sk, bool twsk) 
	}



	kfree_rcu(ao, rcu);

	static_branch_slow_dec_deferred(&tcp_ao_needed);

}



void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp)
@@ -1180,6 +1189,11 @@ int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk, 
		goto free_and_exit;

	}



	if (!static_key_fast_inc_not_disabled(&tcp_ao_needed.key.key)) {

		ret = -EUSERS;

		goto free_and_exit;

	}



	key_head = rcu_dereference(hlist_first_rcu(&new_ao->head));

	first_key = hlist_entry_safe(key_head, struct tcp_ao_key, node);
@@ -1607,6 +1621,10 @@ static int tcp_ao_add_cmd(struct sock *sk, unsigned short int family, 


	tcp_ao_link_mkt(ao_info, key);

	if (first) {

		if (!static_branch_inc(&tcp_ao_needed.key)) {

			ret = -EUSERS;

			goto err_free_sock;

		}

		sk_gso_disable(sk);

		rcu_assign_pointer(tcp_sk(sk)->ao_info, ao_info);

	}
@@ -1875,6 +1893,10 @@ static int tcp_ao_info_cmd(struct sock *sk, unsigned short int family, 
	if (new_rnext)

		WRITE_ONCE(ao_info->rnext_key, new_rnext);

	if (first) {

		if (!static_branch_inc(&tcp_ao_needed.key)) {

			err = -EUSERS;

			goto out;

		}

		sk_gso_disable(sk);

		rcu_assign_pointer(tcp_sk(sk)->ao_info, ao_info);

	}

net/ipv4/tcp_input.c

+28 −14
Original line number Diff line number Diff line
@@ -3572,41 +3572,55 @@ static inline bool tcp_may_update_window(const struct tcp_sock *tp, 
		(ack_seq == tp->snd_wl1 && (nwin > tp->snd_wnd || !nwin));

}



/* If we update tp->snd_una, also update tp->bytes_acked */

static void tcp_snd_una_update(struct tcp_sock *tp, u32 ack)

static void tcp_snd_sne_update(struct tcp_sock *tp, u32 ack)

{

	u32 delta = ack - tp->snd_una;

#ifdef CONFIG_TCP_AO

	struct tcp_ao_info *ao;

#endif



	sock_owned_by_me((struct sock *)tp);

	tp->bytes_acked += delta;

#ifdef CONFIG_TCP_AO

	if (!static_branch_unlikely(&tcp_ao_needed.key))

		return;



	ao = rcu_dereference_protected(tp->ao_info,

				       lockdep_sock_is_held((struct sock *)tp));

	if (ao && ack < tp->snd_una)

		ao->snd_sne++;

#endif

}



/* If we update tp->snd_una, also update tp->bytes_acked */

static void tcp_snd_una_update(struct tcp_sock *tp, u32 ack)

{

	u32 delta = ack - tp->snd_una;



	sock_owned_by_me((struct sock *)tp);

	tp->bytes_acked += delta;

	tcp_snd_sne_update(tp, ack);

	tp->snd_una = ack;

}



/* If we update tp->rcv_nxt, also update tp->bytes_received */

static void tcp_rcv_nxt_update(struct tcp_sock *tp, u32 seq)

static void tcp_rcv_sne_update(struct tcp_sock *tp, u32 seq)

{

	u32 delta = seq - tp->rcv_nxt;

#ifdef CONFIG_TCP_AO

	struct tcp_ao_info *ao;

#endif



	sock_owned_by_me((struct sock *)tp);

	tp->bytes_received += delta;

#ifdef CONFIG_TCP_AO

	if (!static_branch_unlikely(&tcp_ao_needed.key))

		return;



	ao = rcu_dereference_protected(tp->ao_info,

				       lockdep_sock_is_held((struct sock *)tp));

	if (ao && seq < tp->rcv_nxt)

		ao->rcv_sne++;

#endif

}



/* If we update tp->rcv_nxt, also update tp->bytes_received */

static void tcp_rcv_nxt_update(struct tcp_sock *tp, u32 seq)

{

	u32 delta = seq - tp->rcv_nxt;



	sock_owned_by_me((struct sock *)tp);

	tp->bytes_received += delta;

	tcp_rcv_sne_update(tp, seq);

	WRITE_ONCE(tp->rcv_nxt, seq);

}

net/ipv4/tcp_ipv4.c

+14 −11
Original line number Diff line number Diff line
@@ -1024,6 +1024,7 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb) 
#ifdef CONFIG_TCP_AO

	struct tcp_ao_info *ao_info;



	if (static_branch_unlikely(&tcp_ao_needed.key)) {

		/* FIXME: the segment to-be-acked is not verified yet */

		ao_info = rcu_dereference(tcptw->ao_info);

		if (ao_info) {
@@ -1037,6 +1038,7 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb) 
			if (aoh)

				key.ao_key = tcp_ao_established_key(ao_info, aoh->rnext_keyid, -1);

		}

	}

	if (key.ao_key) {

		struct tcp_ao_key *rnext_key;
@@ -1081,7 +1083,8 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, 
					     tcp_sk(sk)->snd_nxt;



#ifdef CONFIG_TCP_AO

	if (tcp_rsk_used_ao(req)) {

	if (static_branch_unlikely(&tcp_ao_needed.key) &&

	    tcp_rsk_used_ao(req)) {

		const union tcp_md5_addr *addr;

		const struct tcp_ao_hdr *aoh;