1 // SPDX-License-Identifier: GPL-2.0
2 /* Multipath TCP
3 *
4 * Copyright (c) 2017 - 2019, Intel Corporation.
5 */
6
7 #define pr_fmt(fmt) "MPTCP: " fmt
8
9 #include <linux/kernel.h>
10 #include <crypto/sha.h>
11 #include <net/tcp.h>
12 #include <net/mptcp.h>
13 #include "protocol.h"
14 #include "mib.h"
15
mptcp_cap_flag_sha256(u8 flags)16 static bool mptcp_cap_flag_sha256(u8 flags)
17 {
18 return (flags & MPTCP_CAP_FLAG_MASK) == MPTCP_CAP_HMAC_SHA256;
19 }
20
mptcp_parse_option(const struct sk_buff * skb,const unsigned char * ptr,int opsize,struct mptcp_options_received * mp_opt)21 static void mptcp_parse_option(const struct sk_buff *skb,
22 const unsigned char *ptr, int opsize,
23 struct mptcp_options_received *mp_opt)
24 {
25 u8 subtype = *ptr >> 4;
26 int expected_opsize;
27 u8 version;
28 u8 flags;
29
30 switch (subtype) {
31 case MPTCPOPT_MP_CAPABLE:
32 /* strict size checking */
33 if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) {
34 if (skb->len > tcp_hdr(skb)->doff << 2)
35 expected_opsize = TCPOLEN_MPTCP_MPC_ACK_DATA;
36 else
37 expected_opsize = TCPOLEN_MPTCP_MPC_ACK;
38 } else {
39 if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_ACK)
40 expected_opsize = TCPOLEN_MPTCP_MPC_SYNACK;
41 else
42 expected_opsize = TCPOLEN_MPTCP_MPC_SYN;
43 }
44 if (opsize != expected_opsize)
45 break;
46
47 /* try to be gentle vs future versions on the initial syn */
48 version = *ptr++ & MPTCP_VERSION_MASK;
49 if (opsize != TCPOLEN_MPTCP_MPC_SYN) {
50 if (version != MPTCP_SUPPORTED_VERSION)
51 break;
52 } else if (version < MPTCP_SUPPORTED_VERSION) {
53 break;
54 }
55
56 flags = *ptr++;
57 if (!mptcp_cap_flag_sha256(flags) ||
58 (flags & MPTCP_CAP_EXTENSIBILITY))
59 break;
60
61 /* RFC 6824, Section 3.1:
62 * "For the Checksum Required bit (labeled "A"), if either
63 * host requires the use of checksums, checksums MUST be used.
64 * In other words, the only way for checksums not to be used
65 * is if both hosts in their SYNs set A=0."
66 *
67 * Section 3.3.0:
68 * "If a checksum is not present when its use has been
69 * negotiated, the receiver MUST close the subflow with a RST as
70 * it is considered broken."
71 *
72 * We don't implement DSS checksum - fall back to TCP.
73 */
74 if (flags & MPTCP_CAP_CHECKSUM_REQD)
75 break;
76
77 mp_opt->mp_capable = 1;
78 if (opsize >= TCPOLEN_MPTCP_MPC_SYNACK) {
79 mp_opt->sndr_key = get_unaligned_be64(ptr);
80 ptr += 8;
81 }
82 if (opsize >= TCPOLEN_MPTCP_MPC_ACK) {
83 mp_opt->rcvr_key = get_unaligned_be64(ptr);
84 ptr += 8;
85 }
86 if (opsize == TCPOLEN_MPTCP_MPC_ACK_DATA) {
87 /* Section 3.1.:
88 * "the data parameters in a MP_CAPABLE are semantically
89 * equivalent to those in a DSS option and can be used
90 * interchangeably."
91 */
92 mp_opt->dss = 1;
93 mp_opt->use_map = 1;
94 mp_opt->mpc_map = 1;
95 mp_opt->data_len = get_unaligned_be16(ptr);
96 ptr += 2;
97 }
98 pr_debug("MP_CAPABLE version=%x, flags=%x, optlen=%d sndr=%llu, rcvr=%llu len=%d",
99 version, flags, opsize, mp_opt->sndr_key,
100 mp_opt->rcvr_key, mp_opt->data_len);
101 break;
102
103 case MPTCPOPT_MP_JOIN:
104 mp_opt->mp_join = 1;
105 if (opsize == TCPOLEN_MPTCP_MPJ_SYN) {
106 mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP;
107 mp_opt->join_id = *ptr++;
108 mp_opt->token = get_unaligned_be32(ptr);
109 ptr += 4;
110 mp_opt->nonce = get_unaligned_be32(ptr);
111 ptr += 4;
112 pr_debug("MP_JOIN bkup=%u, id=%u, token=%u, nonce=%u",
113 mp_opt->backup, mp_opt->join_id,
114 mp_opt->token, mp_opt->nonce);
115 } else if (opsize == TCPOLEN_MPTCP_MPJ_SYNACK) {
116 mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP;
117 mp_opt->join_id = *ptr++;
118 mp_opt->thmac = get_unaligned_be64(ptr);
119 ptr += 8;
120 mp_opt->nonce = get_unaligned_be32(ptr);
121 ptr += 4;
122 pr_debug("MP_JOIN bkup=%u, id=%u, thmac=%llu, nonce=%u",
123 mp_opt->backup, mp_opt->join_id,
124 mp_opt->thmac, mp_opt->nonce);
125 } else if (opsize == TCPOLEN_MPTCP_MPJ_ACK) {
126 ptr += 2;
127 memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN);
128 pr_debug("MP_JOIN hmac");
129 } else {
130 mp_opt->mp_join = 0;
131 }
132 break;
133
134 case MPTCPOPT_DSS:
135 pr_debug("DSS");
136 ptr++;
137
138 /* we must clear 'mpc_map' be able to detect MP_CAPABLE
139 * map vs DSS map in mptcp_incoming_options(), and reconstruct
140 * map info accordingly
141 */
142 mp_opt->mpc_map = 0;
143 flags = (*ptr++) & MPTCP_DSS_FLAG_MASK;
144 mp_opt->data_fin = (flags & MPTCP_DSS_DATA_FIN) != 0;
145 mp_opt->dsn64 = (flags & MPTCP_DSS_DSN64) != 0;
146 mp_opt->use_map = (flags & MPTCP_DSS_HAS_MAP) != 0;
147 mp_opt->ack64 = (flags & MPTCP_DSS_ACK64) != 0;
148 mp_opt->use_ack = (flags & MPTCP_DSS_HAS_ACK);
149
150 pr_debug("data_fin=%d dsn64=%d use_map=%d ack64=%d use_ack=%d",
151 mp_opt->data_fin, mp_opt->dsn64,
152 mp_opt->use_map, mp_opt->ack64,
153 mp_opt->use_ack);
154
155 expected_opsize = TCPOLEN_MPTCP_DSS_BASE;
156
157 if (mp_opt->use_ack) {
158 if (mp_opt->ack64)
159 expected_opsize += TCPOLEN_MPTCP_DSS_ACK64;
160 else
161 expected_opsize += TCPOLEN_MPTCP_DSS_ACK32;
162 }
163
164 if (mp_opt->use_map) {
165 if (mp_opt->dsn64)
166 expected_opsize += TCPOLEN_MPTCP_DSS_MAP64;
167 else
168 expected_opsize += TCPOLEN_MPTCP_DSS_MAP32;
169 }
170
171 /* RFC 6824, Section 3.3:
172 * If a checksum is present, but its use had
173 * not been negotiated in the MP_CAPABLE handshake,
174 * the checksum field MUST be ignored.
175 */
176 if (opsize != expected_opsize &&
177 opsize != expected_opsize + TCPOLEN_MPTCP_DSS_CHECKSUM)
178 break;
179
180 mp_opt->dss = 1;
181
182 if (mp_opt->use_ack) {
183 if (mp_opt->ack64) {
184 mp_opt->data_ack = get_unaligned_be64(ptr);
185 ptr += 8;
186 } else {
187 mp_opt->data_ack = get_unaligned_be32(ptr);
188 ptr += 4;
189 }
190
191 pr_debug("data_ack=%llu", mp_opt->data_ack);
192 }
193
194 if (mp_opt->use_map) {
195 if (mp_opt->dsn64) {
196 mp_opt->data_seq = get_unaligned_be64(ptr);
197 ptr += 8;
198 } else {
199 mp_opt->data_seq = get_unaligned_be32(ptr);
200 ptr += 4;
201 }
202
203 mp_opt->subflow_seq = get_unaligned_be32(ptr);
204 ptr += 4;
205
206 mp_opt->data_len = get_unaligned_be16(ptr);
207 ptr += 2;
208
209 pr_debug("data_seq=%llu subflow_seq=%u data_len=%u",
210 mp_opt->data_seq, mp_opt->subflow_seq,
211 mp_opt->data_len);
212 }
213
214 break;
215
216 case MPTCPOPT_ADD_ADDR:
217 mp_opt->echo = (*ptr++) & MPTCP_ADDR_ECHO;
218 if (!mp_opt->echo) {
219 if (opsize == TCPOLEN_MPTCP_ADD_ADDR ||
220 opsize == TCPOLEN_MPTCP_ADD_ADDR_PORT)
221 mp_opt->family = MPTCP_ADDR_IPVERSION_4;
222 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
223 else if (opsize == TCPOLEN_MPTCP_ADD_ADDR6 ||
224 opsize == TCPOLEN_MPTCP_ADD_ADDR6_PORT)
225 mp_opt->family = MPTCP_ADDR_IPVERSION_6;
226 #endif
227 else
228 break;
229 } else {
230 if (opsize == TCPOLEN_MPTCP_ADD_ADDR_BASE ||
231 opsize == TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT)
232 mp_opt->family = MPTCP_ADDR_IPVERSION_4;
233 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
234 else if (opsize == TCPOLEN_MPTCP_ADD_ADDR6_BASE ||
235 opsize == TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT)
236 mp_opt->family = MPTCP_ADDR_IPVERSION_6;
237 #endif
238 else
239 break;
240 }
241
242 mp_opt->add_addr = 1;
243 mp_opt->addr_id = *ptr++;
244 pr_debug("ADD_ADDR: id=%d, echo=%d", mp_opt->addr_id, mp_opt->echo);
245 if (mp_opt->family == MPTCP_ADDR_IPVERSION_4) {
246 memcpy((u8 *)&mp_opt->addr.s_addr, (u8 *)ptr, 4);
247 ptr += 4;
248 if (opsize == TCPOLEN_MPTCP_ADD_ADDR_PORT ||
249 opsize == TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT) {
250 mp_opt->port = get_unaligned_be16(ptr);
251 ptr += 2;
252 }
253 }
254 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
255 else {
256 memcpy(mp_opt->addr6.s6_addr, (u8 *)ptr, 16);
257 ptr += 16;
258 if (opsize == TCPOLEN_MPTCP_ADD_ADDR6_PORT ||
259 opsize == TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT) {
260 mp_opt->port = get_unaligned_be16(ptr);
261 ptr += 2;
262 }
263 }
264 #endif
265 if (!mp_opt->echo) {
266 mp_opt->ahmac = get_unaligned_be64(ptr);
267 ptr += 8;
268 }
269 break;
270
271 case MPTCPOPT_RM_ADDR:
272 if (opsize != TCPOLEN_MPTCP_RM_ADDR_BASE)
273 break;
274
275 ptr++;
276
277 mp_opt->rm_addr = 1;
278 mp_opt->rm_id = *ptr++;
279 pr_debug("RM_ADDR: id=%d", mp_opt->rm_id);
280 break;
281
282 default:
283 break;
284 }
285 }
286
mptcp_get_options(const struct sk_buff * skb,struct mptcp_options_received * mp_opt)287 void mptcp_get_options(const struct sk_buff *skb,
288 struct mptcp_options_received *mp_opt)
289 {
290 const struct tcphdr *th = tcp_hdr(skb);
291 const unsigned char *ptr;
292 int length;
293
294 /* initialize option status */
295 mp_opt->mp_capable = 0;
296 mp_opt->mp_join = 0;
297 mp_opt->add_addr = 0;
298 mp_opt->ahmac = 0;
299 mp_opt->port = 0;
300 mp_opt->rm_addr = 0;
301 mp_opt->dss = 0;
302
303 length = (th->doff * 4) - sizeof(struct tcphdr);
304 ptr = (const unsigned char *)(th + 1);
305
306 while (length > 0) {
307 int opcode = *ptr++;
308 int opsize;
309
310 switch (opcode) {
311 case TCPOPT_EOL:
312 return;
313 case TCPOPT_NOP: /* Ref: RFC 793 section 3.1 */
314 length--;
315 continue;
316 default:
317 if (length < 2)
318 return;
319 opsize = *ptr++;
320 if (opsize < 2) /* "silly options" */
321 return;
322 if (opsize > length)
323 return; /* don't parse partial options */
324 if (opcode == TCPOPT_MPTCP)
325 mptcp_parse_option(skb, ptr, opsize, mp_opt);
326 ptr += opsize - 2;
327 length -= opsize;
328 }
329 }
330 }
331
mptcp_syn_options(struct sock * sk,const struct sk_buff * skb,unsigned int * size,struct mptcp_out_options * opts)332 bool mptcp_syn_options(struct sock *sk, const struct sk_buff *skb,
333 unsigned int *size, struct mptcp_out_options *opts)
334 {
335 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
336
337 /* we will use snd_isn to detect first pkt [re]transmission
338 * in mptcp_established_options_mp()
339 */
340 subflow->snd_isn = TCP_SKB_CB(skb)->end_seq;
341 if (subflow->request_mptcp) {
342 opts->suboptions = OPTION_MPTCP_MPC_SYN;
343 *size = TCPOLEN_MPTCP_MPC_SYN;
344 return true;
345 } else if (subflow->request_join) {
346 pr_debug("remote_token=%u, nonce=%u", subflow->remote_token,
347 subflow->local_nonce);
348 opts->suboptions = OPTION_MPTCP_MPJ_SYN;
349 opts->join_id = subflow->local_id;
350 opts->token = subflow->remote_token;
351 opts->nonce = subflow->local_nonce;
352 opts->backup = subflow->request_bkup;
353 *size = TCPOLEN_MPTCP_MPJ_SYN;
354 return true;
355 }
356 return false;
357 }
358
359 /* MP_JOIN client subflow must wait for 4th ack before sending any data:
360 * TCP can't schedule delack timer before the subflow is fully established.
361 * MPTCP uses the delack timer to do 3rd ack retransmissions
362 */
schedule_3rdack_retransmission(struct sock * sk)363 static void schedule_3rdack_retransmission(struct sock *sk)
364 {
365 struct inet_connection_sock *icsk = inet_csk(sk);
366 struct tcp_sock *tp = tcp_sk(sk);
367 unsigned long timeout;
368
369 /* reschedule with a timeout above RTT, as we must look only for drop */
370 if (tp->srtt_us)
371 timeout = tp->srtt_us << 1;
372 else
373 timeout = TCP_TIMEOUT_INIT;
374
375 WARN_ON_ONCE(icsk->icsk_ack.pending & ICSK_ACK_TIMER);
376 icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER;
377 icsk->icsk_ack.timeout = timeout;
378 sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout);
379 }
380
clear_3rdack_retransmission(struct sock * sk)381 static void clear_3rdack_retransmission(struct sock *sk)
382 {
383 struct inet_connection_sock *icsk = inet_csk(sk);
384
385 sk_stop_timer(sk, &icsk->icsk_delack_timer);
386 icsk->icsk_ack.timeout = 0;
387 icsk->icsk_ack.ato = 0;
388 icsk->icsk_ack.pending &= ~(ICSK_ACK_SCHED | ICSK_ACK_TIMER);
389 }
390
mptcp_established_options_mp(struct sock * sk,struct sk_buff * skb,unsigned int * size,unsigned int remaining,struct mptcp_out_options * opts)391 static bool mptcp_established_options_mp(struct sock *sk, struct sk_buff *skb,
392 unsigned int *size,
393 unsigned int remaining,
394 struct mptcp_out_options *opts)
395 {
396 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
397 struct mptcp_ext *mpext;
398 unsigned int data_len;
399
400 /* When skb is not available, we better over-estimate the emitted
401 * options len. A full DSS option (28 bytes) is longer than
402 * TCPOLEN_MPTCP_MPC_ACK_DATA(22) or TCPOLEN_MPTCP_MPJ_ACK(24), so
403 * tell the caller to defer the estimate to
404 * mptcp_established_options_dss(), which will reserve enough space.
405 */
406 if (!skb)
407 return false;
408
409 /* MPC/MPJ needed only on 3rd ack packet */
410 if (subflow->fully_established ||
411 subflow->snd_isn != TCP_SKB_CB(skb)->seq)
412 return false;
413
414 if (subflow->mp_capable) {
415 mpext = mptcp_get_ext(skb);
416 data_len = mpext ? mpext->data_len : 0;
417
418 /* we will check ext_copy.data_len in mptcp_write_options() to
419 * discriminate between TCPOLEN_MPTCP_MPC_ACK_DATA and
420 * TCPOLEN_MPTCP_MPC_ACK
421 */
422 opts->ext_copy.data_len = data_len;
423 opts->suboptions = OPTION_MPTCP_MPC_ACK;
424 opts->sndr_key = subflow->local_key;
425 opts->rcvr_key = subflow->remote_key;
426
427 /* Section 3.1.
428 * The MP_CAPABLE option is carried on the SYN, SYN/ACK, and ACK
429 * packets that start the first subflow of an MPTCP connection,
430 * as well as the first packet that carries data
431 */
432 if (data_len > 0)
433 *size = ALIGN(TCPOLEN_MPTCP_MPC_ACK_DATA, 4);
434 else
435 *size = TCPOLEN_MPTCP_MPC_ACK;
436
437 pr_debug("subflow=%p, local_key=%llu, remote_key=%llu map_len=%d",
438 subflow, subflow->local_key, subflow->remote_key,
439 data_len);
440
441 return true;
442 } else if (subflow->mp_join) {
443 opts->suboptions = OPTION_MPTCP_MPJ_ACK;
444 memcpy(opts->hmac, subflow->hmac, MPTCPOPT_HMAC_LEN);
445 *size = TCPOLEN_MPTCP_MPJ_ACK;
446 pr_debug("subflow=%p", subflow);
447
448 schedule_3rdack_retransmission(sk);
449 return true;
450 }
451 return false;
452 }
453
mptcp_write_data_fin(struct mptcp_subflow_context * subflow,struct sk_buff * skb,struct mptcp_ext * ext)454 static void mptcp_write_data_fin(struct mptcp_subflow_context *subflow,
455 struct sk_buff *skb, struct mptcp_ext *ext)
456 {
457 /* The write_seq value has already been incremented, so the actual
458 * sequence number for the DATA_FIN is one less.
459 */
460 u64 data_fin_tx_seq = READ_ONCE(mptcp_sk(subflow->conn)->write_seq) - 1;
461
462 if (!ext->use_map || !skb->len) {
463 /* RFC6824 requires a DSS mapping with specific values
464 * if DATA_FIN is set but no data payload is mapped
465 */
466 ext->data_fin = 1;
467 ext->use_map = 1;
468 ext->dsn64 = 1;
469 ext->data_seq = data_fin_tx_seq;
470 ext->subflow_seq = 0;
471 ext->data_len = 1;
472 } else if (ext->data_seq + ext->data_len == data_fin_tx_seq) {
473 /* If there's an existing DSS mapping and it is the
474 * final mapping, DATA_FIN consumes 1 additional byte of
475 * mapping space.
476 */
477 ext->data_fin = 1;
478 ext->data_len++;
479 }
480 }
481
mptcp_established_options_dss(struct sock * sk,struct sk_buff * skb,unsigned int * size,unsigned int remaining,struct mptcp_out_options * opts)482 static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,
483 unsigned int *size,
484 unsigned int remaining,
485 struct mptcp_out_options *opts)
486 {
487 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
488 struct mptcp_sock *msk = mptcp_sk(subflow->conn);
489 unsigned int dss_size = 0;
490 u64 snd_data_fin_enable;
491 struct mptcp_ext *mpext;
492 unsigned int ack_size;
493 bool ret = false;
494
495 mpext = skb ? mptcp_get_ext(skb) : NULL;
496 snd_data_fin_enable = READ_ONCE(msk->snd_data_fin_enable);
497
498 if (!skb || (mpext && mpext->use_map) || snd_data_fin_enable) {
499 unsigned int map_size;
500
501 map_size = TCPOLEN_MPTCP_DSS_BASE + TCPOLEN_MPTCP_DSS_MAP64;
502
503 remaining -= map_size;
504 dss_size = map_size;
505 if (mpext)
506 opts->ext_copy = *mpext;
507
508 if (skb && snd_data_fin_enable)
509 mptcp_write_data_fin(subflow, skb, &opts->ext_copy);
510 ret = true;
511 }
512
513 /* passive sockets msk will set the 'can_ack' after accept(), even
514 * if the first subflow may have the already the remote key handy
515 */
516 opts->ext_copy.use_ack = 0;
517 if (!READ_ONCE(msk->can_ack)) {
518 *size = ALIGN(dss_size, 4);
519 return ret;
520 }
521
522 if (READ_ONCE(msk->use_64bit_ack)) {
523 ack_size = TCPOLEN_MPTCP_DSS_ACK64;
524 opts->ext_copy.data_ack = READ_ONCE(msk->ack_seq);
525 opts->ext_copy.ack64 = 1;
526 } else {
527 ack_size = TCPOLEN_MPTCP_DSS_ACK32;
528 opts->ext_copy.data_ack32 = (uint32_t)READ_ONCE(msk->ack_seq);
529 opts->ext_copy.ack64 = 0;
530 }
531 opts->ext_copy.use_ack = 1;
532
533 /* Add kind/length/subtype/flag overhead if mapping is not populated */
534 if (dss_size == 0)
535 ack_size += TCPOLEN_MPTCP_DSS_BASE;
536
537 dss_size += ack_size;
538
539 *size = ALIGN(dss_size, 4);
540 return true;
541 }
542
add_addr_generate_hmac(u64 key1,u64 key2,u8 addr_id,struct in_addr * addr)543 static u64 add_addr_generate_hmac(u64 key1, u64 key2, u8 addr_id,
544 struct in_addr *addr)
545 {
546 u8 hmac[SHA256_DIGEST_SIZE];
547 u8 msg[7];
548
549 msg[0] = addr_id;
550 memcpy(&msg[1], &addr->s_addr, 4);
551 msg[5] = 0;
552 msg[6] = 0;
553
554 mptcp_crypto_hmac_sha(key1, key2, msg, 7, hmac);
555
556 return get_unaligned_be64(&hmac[SHA256_DIGEST_SIZE - sizeof(u64)]);
557 }
558
559 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
add_addr6_generate_hmac(u64 key1,u64 key2,u8 addr_id,struct in6_addr * addr)560 static u64 add_addr6_generate_hmac(u64 key1, u64 key2, u8 addr_id,
561 struct in6_addr *addr)
562 {
563 u8 hmac[SHA256_DIGEST_SIZE];
564 u8 msg[19];
565
566 msg[0] = addr_id;
567 memcpy(&msg[1], &addr->s6_addr, 16);
568 msg[17] = 0;
569 msg[18] = 0;
570
571 mptcp_crypto_hmac_sha(key1, key2, msg, 19, hmac);
572
573 return get_unaligned_be64(&hmac[SHA256_DIGEST_SIZE - sizeof(u64)]);
574 }
575 #endif
576
mptcp_established_options_add_addr(struct sock * sk,unsigned int * size,unsigned int remaining,struct mptcp_out_options * opts)577 static bool mptcp_established_options_add_addr(struct sock *sk,
578 unsigned int *size,
579 unsigned int remaining,
580 struct mptcp_out_options *opts)
581 {
582 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
583 struct mptcp_sock *msk = mptcp_sk(subflow->conn);
584 struct mptcp_addr_info saddr;
585 bool echo;
586 int len;
587
588 if (!mptcp_pm_should_add_signal(msk) ||
589 !(mptcp_pm_add_addr_signal(msk, remaining, &saddr, &echo)))
590 return false;
591
592 len = mptcp_add_addr_len(saddr.family, echo);
593 if (remaining < len)
594 return false;
595
596 *size = len;
597 opts->addr_id = saddr.id;
598 if (saddr.family == AF_INET) {
599 opts->suboptions |= OPTION_MPTCP_ADD_ADDR;
600 opts->addr = saddr.addr;
601 if (!echo) {
602 opts->ahmac = add_addr_generate_hmac(msk->local_key,
603 msk->remote_key,
604 opts->addr_id,
605 &opts->addr);
606 }
607 }
608 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
609 else if (saddr.family == AF_INET6) {
610 opts->suboptions |= OPTION_MPTCP_ADD_ADDR6;
611 opts->addr6 = saddr.addr6;
612 if (!echo) {
613 opts->ahmac = add_addr6_generate_hmac(msk->local_key,
614 msk->remote_key,
615 opts->addr_id,
616 &opts->addr6);
617 }
618 }
619 #endif
620 pr_debug("addr_id=%d, ahmac=%llu, echo=%d", opts->addr_id, opts->ahmac, echo);
621
622 return true;
623 }
624
mptcp_established_options_rm_addr(struct sock * sk,unsigned int * size,unsigned int remaining,struct mptcp_out_options * opts)625 static bool mptcp_established_options_rm_addr(struct sock *sk,
626 unsigned int *size,
627 unsigned int remaining,
628 struct mptcp_out_options *opts)
629 {
630 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
631 struct mptcp_sock *msk = mptcp_sk(subflow->conn);
632 u8 rm_id;
633
634 if (!mptcp_pm_should_rm_signal(msk) ||
635 !(mptcp_pm_rm_addr_signal(msk, remaining, &rm_id)))
636 return false;
637
638 if (remaining < TCPOLEN_MPTCP_RM_ADDR_BASE)
639 return false;
640
641 *size = TCPOLEN_MPTCP_RM_ADDR_BASE;
642 opts->suboptions |= OPTION_MPTCP_RM_ADDR;
643 opts->rm_id = rm_id;
644
645 pr_debug("rm_id=%d", opts->rm_id);
646
647 return true;
648 }
649
mptcp_established_options(struct sock * sk,struct sk_buff * skb,unsigned int * size,unsigned int remaining,struct mptcp_out_options * opts)650 bool mptcp_established_options(struct sock *sk, struct sk_buff *skb,
651 unsigned int *size, unsigned int remaining,
652 struct mptcp_out_options *opts)
653 {
654 unsigned int opt_size = 0;
655 bool ret = false;
656
657 opts->suboptions = 0;
658
659 if (unlikely(mptcp_check_fallback(sk)))
660 return false;
661
662 /* prevent adding of any MPTCP related options on reset packet
663 * until we support MP_TCPRST/MP_FASTCLOSE
664 */
665 if (unlikely(skb && TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST))
666 return false;
667
668 if (mptcp_established_options_mp(sk, skb, &opt_size, remaining, opts))
669 ret = true;
670 else if (mptcp_established_options_dss(sk, skb, &opt_size, remaining,
671 opts))
672 ret = true;
673
674 /* we reserved enough space for the above options, and exceeding the
675 * TCP option space would be fatal
676 */
677 if (WARN_ON_ONCE(opt_size > remaining))
678 return false;
679
680 *size += opt_size;
681 remaining -= opt_size;
682 if (mptcp_established_options_add_addr(sk, &opt_size, remaining, opts)) {
683 *size += opt_size;
684 remaining -= opt_size;
685 ret = true;
686 } else if (mptcp_established_options_rm_addr(sk, &opt_size, remaining, opts)) {
687 *size += opt_size;
688 remaining -= opt_size;
689 ret = true;
690 }
691
692 return ret;
693 }
694
mptcp_synack_options(const struct request_sock * req,unsigned int * size,struct mptcp_out_options * opts)695 bool mptcp_synack_options(const struct request_sock *req, unsigned int *size,
696 struct mptcp_out_options *opts)
697 {
698 struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
699
700 if (subflow_req->mp_capable) {
701 opts->suboptions = OPTION_MPTCP_MPC_SYNACK;
702 opts->sndr_key = subflow_req->local_key;
703 *size = TCPOLEN_MPTCP_MPC_SYNACK;
704 pr_debug("subflow_req=%p, local_key=%llu",
705 subflow_req, subflow_req->local_key);
706 return true;
707 } else if (subflow_req->mp_join) {
708 opts->suboptions = OPTION_MPTCP_MPJ_SYNACK;
709 opts->backup = subflow_req->backup;
710 opts->join_id = subflow_req->local_id;
711 opts->thmac = subflow_req->thmac;
712 opts->nonce = subflow_req->local_nonce;
713 pr_debug("req=%p, bkup=%u, id=%u, thmac=%llu, nonce=%u",
714 subflow_req, opts->backup, opts->join_id,
715 opts->thmac, opts->nonce);
716 *size = TCPOLEN_MPTCP_MPJ_SYNACK;
717 return true;
718 }
719 return false;
720 }
721
check_fully_established(struct mptcp_sock * msk,struct sock * ssk,struct mptcp_subflow_context * subflow,struct sk_buff * skb,struct mptcp_options_received * mp_opt)722 static bool check_fully_established(struct mptcp_sock *msk, struct sock *ssk,
723 struct mptcp_subflow_context *subflow,
724 struct sk_buff *skb,
725 struct mptcp_options_received *mp_opt)
726 {
727 /* here we can process OoO, in-window pkts, only in-sequence 4th ack
728 * will make the subflow fully established
729 */
730 if (likely(subflow->fully_established)) {
731 /* on passive sockets, check for 3rd ack retransmission
732 * note that msk is always set by subflow_syn_recv_sock()
733 * for mp_join subflows
734 */
735 if (TCP_SKB_CB(skb)->seq == subflow->ssn_offset + 1 &&
736 TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq &&
737 subflow->mp_join && mp_opt->mp_join &&
738 READ_ONCE(msk->pm.server_side))
739 tcp_send_ack(ssk);
740 goto fully_established;
741 }
742
743 /* we must process OoO packets before the first subflow is fully
744 * established. OoO packets are instead a protocol violation
745 * for MP_JOIN subflows as the peer must not send any data
746 * before receiving the forth ack - cfr. RFC 8684 section 3.2.
747 */
748 if (TCP_SKB_CB(skb)->seq != subflow->ssn_offset + 1) {
749 if (subflow->mp_join)
750 goto reset;
751 return subflow->mp_capable;
752 }
753
754 if (mp_opt->dss && mp_opt->use_ack) {
755 /* subflows are fully established as soon as we get any
756 * additional ack.
757 */
758 subflow->fully_established = 1;
759 WRITE_ONCE(msk->fully_established, true);
760 goto fully_established;
761 }
762
763 /* If the first established packet does not contain MP_CAPABLE + data
764 * then fallback to TCP. Fallback scenarios requires a reset for
765 * MP_JOIN subflows.
766 */
767 if (!mp_opt->mp_capable) {
768 if (subflow->mp_join)
769 goto reset;
770 subflow->mp_capable = 0;
771 pr_fallback(msk);
772 __mptcp_do_fallback(msk);
773 return false;
774 }
775
776 if (unlikely(!READ_ONCE(msk->pm.server_side)))
777 pr_warn_once("bogus mpc option on established client sk");
778 mptcp_subflow_fully_established(subflow, mp_opt);
779
780 fully_established:
781 if (likely(subflow->pm_notified))
782 return true;
783
784 subflow->pm_notified = 1;
785 if (subflow->mp_join) {
786 clear_3rdack_retransmission(ssk);
787 mptcp_pm_subflow_established(msk, subflow);
788 } else {
789 mptcp_pm_fully_established(msk);
790 }
791 return true;
792
793 reset:
794 mptcp_subflow_reset(ssk);
795 return false;
796 }
797
expand_ack(u64 old_ack,u64 cur_ack,bool use_64bit)798 static u64 expand_ack(u64 old_ack, u64 cur_ack, bool use_64bit)
799 {
800 u32 old_ack32, cur_ack32;
801
802 if (use_64bit)
803 return cur_ack;
804
805 old_ack32 = (u32)old_ack;
806 cur_ack32 = (u32)cur_ack;
807 cur_ack = (old_ack & GENMASK_ULL(63, 32)) + cur_ack32;
808 if (unlikely(before(cur_ack32, old_ack32)))
809 return cur_ack + (1LL << 32);
810 return cur_ack;
811 }
812
update_una(struct mptcp_sock * msk,struct mptcp_options_received * mp_opt)813 static void update_una(struct mptcp_sock *msk,
814 struct mptcp_options_received *mp_opt)
815 {
816 u64 new_snd_una, snd_una, old_snd_una = atomic64_read(&msk->snd_una);
817 u64 write_seq = READ_ONCE(msk->write_seq);
818
819 /* avoid ack expansion on update conflict, to reduce the risk of
820 * wrongly expanding to a future ack sequence number, which is way
821 * more dangerous than missing an ack
822 */
823 new_snd_una = expand_ack(old_snd_una, mp_opt->data_ack, mp_opt->ack64);
824
825 /* ACK for data not even sent yet? Ignore. */
826 if (after64(new_snd_una, write_seq))
827 new_snd_una = old_snd_una;
828
829 while (after64(new_snd_una, old_snd_una)) {
830 snd_una = old_snd_una;
831 old_snd_una = atomic64_cmpxchg(&msk->snd_una, snd_una,
832 new_snd_una);
833 if (old_snd_una == snd_una) {
834 mptcp_data_acked((struct sock *)msk);
835 break;
836 }
837 }
838 }
839
mptcp_update_rcv_data_fin(struct mptcp_sock * msk,u64 data_fin_seq,bool use_64bit)840 bool mptcp_update_rcv_data_fin(struct mptcp_sock *msk, u64 data_fin_seq, bool use_64bit)
841 {
842 /* Skip if DATA_FIN was already received.
843 * If updating simultaneously with the recvmsg loop, values
844 * should match. If they mismatch, the peer is misbehaving and
845 * we will prefer the most recent information.
846 */
847 if (READ_ONCE(msk->rcv_data_fin) || !READ_ONCE(msk->first))
848 return false;
849
850 WRITE_ONCE(msk->rcv_data_fin_seq,
851 expand_ack(READ_ONCE(msk->ack_seq), data_fin_seq, use_64bit));
852 WRITE_ONCE(msk->rcv_data_fin, 1);
853
854 return true;
855 }
856
add_addr_hmac_valid(struct mptcp_sock * msk,struct mptcp_options_received * mp_opt)857 static bool add_addr_hmac_valid(struct mptcp_sock *msk,
858 struct mptcp_options_received *mp_opt)
859 {
860 u64 hmac = 0;
861
862 if (mp_opt->echo)
863 return true;
864
865 if (mp_opt->family == MPTCP_ADDR_IPVERSION_4)
866 hmac = add_addr_generate_hmac(msk->remote_key,
867 msk->local_key,
868 mp_opt->addr_id, &mp_opt->addr);
869 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
870 else
871 hmac = add_addr6_generate_hmac(msk->remote_key,
872 msk->local_key,
873 mp_opt->addr_id, &mp_opt->addr6);
874 #endif
875
876 pr_debug("msk=%p, ahmac=%llu, mp_opt->ahmac=%llu\n",
877 msk, (unsigned long long)hmac,
878 (unsigned long long)mp_opt->ahmac);
879
880 return hmac == mp_opt->ahmac;
881 }
882
mptcp_incoming_options(struct sock * sk,struct sk_buff * skb)883 void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb)
884 {
885 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
886 struct mptcp_sock *msk = mptcp_sk(subflow->conn);
887 struct mptcp_options_received mp_opt;
888 struct mptcp_ext *mpext;
889
890 if (__mptcp_check_fallback(msk))
891 return;
892
893 mptcp_get_options(skb, &mp_opt);
894 if (!check_fully_established(msk, sk, subflow, skb, &mp_opt))
895 return;
896
897 if (mp_opt.add_addr && add_addr_hmac_valid(msk, &mp_opt)) {
898 struct mptcp_addr_info addr;
899
900 addr.port = htons(mp_opt.port);
901 addr.id = mp_opt.addr_id;
902 if (mp_opt.family == MPTCP_ADDR_IPVERSION_4) {
903 addr.family = AF_INET;
904 addr.addr = mp_opt.addr;
905 }
906 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
907 else if (mp_opt.family == MPTCP_ADDR_IPVERSION_6) {
908 addr.family = AF_INET6;
909 addr.addr6 = mp_opt.addr6;
910 }
911 #endif
912 if (!mp_opt.echo) {
913 mptcp_pm_add_addr_received(msk, &addr);
914 MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ADDADDR);
915 } else {
916 mptcp_pm_del_add_timer(msk, &addr);
917 MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ECHOADD);
918 }
919 mp_opt.add_addr = 0;
920 }
921
922 if (mp_opt.rm_addr) {
923 mptcp_pm_rm_addr_received(msk, mp_opt.rm_id);
924 mp_opt.rm_addr = 0;
925 }
926
927 if (!mp_opt.dss)
928 return;
929
930 /* we can't wait for recvmsg() to update the ack_seq, otherwise
931 * monodirectional flows will stuck
932 */
933 if (mp_opt.use_ack)
934 update_una(msk, &mp_opt);
935
936 /* Zero-data-length packets are dropped by the caller and not
937 * propagated to the MPTCP layer, so the skb extension does not
938 * need to be allocated or populated. DATA_FIN information, if
939 * present, needs to be updated here before the skb is freed.
940 */
941 if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) {
942 if (mp_opt.data_fin && mp_opt.data_len == 1 &&
943 mptcp_update_rcv_data_fin(msk, mp_opt.data_seq, mp_opt.dsn64) &&
944 schedule_work(&msk->work))
945 sock_hold(subflow->conn);
946
947 return;
948 }
949
950 mpext = skb_ext_add(skb, SKB_EXT_MPTCP);
951 if (!mpext)
952 return;
953
954 memset(mpext, 0, sizeof(*mpext));
955
956 if (mp_opt.use_map) {
957 if (mp_opt.mpc_map) {
958 /* this is an MP_CAPABLE carrying MPTCP data
959 * we know this map the first chunk of data
960 */
961 mptcp_crypto_key_sha(subflow->remote_key, NULL,
962 &mpext->data_seq);
963 mpext->data_seq++;
964 mpext->subflow_seq = 1;
965 mpext->dsn64 = 1;
966 mpext->mpc_map = 1;
967 mpext->data_fin = 0;
968 } else {
969 mpext->data_seq = mp_opt.data_seq;
970 mpext->subflow_seq = mp_opt.subflow_seq;
971 mpext->dsn64 = mp_opt.dsn64;
972 mpext->data_fin = mp_opt.data_fin;
973 }
974 mpext->data_len = mp_opt.data_len;
975 mpext->use_map = 1;
976 }
977 }
978
mptcp_write_options(__be32 * ptr,struct mptcp_out_options * opts)979 void mptcp_write_options(__be32 *ptr, struct mptcp_out_options *opts)
980 {
981 if ((OPTION_MPTCP_MPC_SYN | OPTION_MPTCP_MPC_SYNACK |
982 OPTION_MPTCP_MPC_ACK) & opts->suboptions) {
983 u8 len;
984
985 if (OPTION_MPTCP_MPC_SYN & opts->suboptions)
986 len = TCPOLEN_MPTCP_MPC_SYN;
987 else if (OPTION_MPTCP_MPC_SYNACK & opts->suboptions)
988 len = TCPOLEN_MPTCP_MPC_SYNACK;
989 else if (opts->ext_copy.data_len)
990 len = TCPOLEN_MPTCP_MPC_ACK_DATA;
991 else
992 len = TCPOLEN_MPTCP_MPC_ACK;
993
994 *ptr++ = mptcp_option(MPTCPOPT_MP_CAPABLE, len,
995 MPTCP_SUPPORTED_VERSION,
996 MPTCP_CAP_HMAC_SHA256);
997
998 if (!((OPTION_MPTCP_MPC_SYNACK | OPTION_MPTCP_MPC_ACK) &
999 opts->suboptions))
1000 goto mp_capable_done;
1001
1002 put_unaligned_be64(opts->sndr_key, ptr);
1003 ptr += 2;
1004 if (!((OPTION_MPTCP_MPC_ACK) & opts->suboptions))
1005 goto mp_capable_done;
1006
1007 put_unaligned_be64(opts->rcvr_key, ptr);
1008 ptr += 2;
1009 if (!opts->ext_copy.data_len)
1010 goto mp_capable_done;
1011
1012 put_unaligned_be32(opts->ext_copy.data_len << 16 |
1013 TCPOPT_NOP << 8 | TCPOPT_NOP, ptr);
1014 ptr += 1;
1015 }
1016
1017 mp_capable_done:
1018 if (OPTION_MPTCP_ADD_ADDR & opts->suboptions) {
1019 if (opts->ahmac)
1020 *ptr++ = mptcp_option(MPTCPOPT_ADD_ADDR,
1021 TCPOLEN_MPTCP_ADD_ADDR, 0,
1022 opts->addr_id);
1023 else
1024 *ptr++ = mptcp_option(MPTCPOPT_ADD_ADDR,
1025 TCPOLEN_MPTCP_ADD_ADDR_BASE,
1026 MPTCP_ADDR_ECHO,
1027 opts->addr_id);
1028 memcpy((u8 *)ptr, (u8 *)&opts->addr.s_addr, 4);
1029 ptr += 1;
1030 if (opts->ahmac) {
1031 put_unaligned_be64(opts->ahmac, ptr);
1032 ptr += 2;
1033 }
1034 }
1035
1036 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1037 if (OPTION_MPTCP_ADD_ADDR6 & opts->suboptions) {
1038 if (opts->ahmac)
1039 *ptr++ = mptcp_option(MPTCPOPT_ADD_ADDR,
1040 TCPOLEN_MPTCP_ADD_ADDR6, 0,
1041 opts->addr_id);
1042 else
1043 *ptr++ = mptcp_option(MPTCPOPT_ADD_ADDR,
1044 TCPOLEN_MPTCP_ADD_ADDR6_BASE,
1045 MPTCP_ADDR_ECHO,
1046 opts->addr_id);
1047 memcpy((u8 *)ptr, opts->addr6.s6_addr, 16);
1048 ptr += 4;
1049 if (opts->ahmac) {
1050 put_unaligned_be64(opts->ahmac, ptr);
1051 ptr += 2;
1052 }
1053 }
1054 #endif
1055
1056 if (OPTION_MPTCP_RM_ADDR & opts->suboptions) {
1057 *ptr++ = mptcp_option(MPTCPOPT_RM_ADDR,
1058 TCPOLEN_MPTCP_RM_ADDR_BASE,
1059 0, opts->rm_id);
1060 }
1061
1062 if (OPTION_MPTCP_MPJ_SYN & opts->suboptions) {
1063 *ptr++ = mptcp_option(MPTCPOPT_MP_JOIN,
1064 TCPOLEN_MPTCP_MPJ_SYN,
1065 opts->backup, opts->join_id);
1066 put_unaligned_be32(opts->token, ptr);
1067 ptr += 1;
1068 put_unaligned_be32(opts->nonce, ptr);
1069 ptr += 1;
1070 }
1071
1072 if (OPTION_MPTCP_MPJ_SYNACK & opts->suboptions) {
1073 *ptr++ = mptcp_option(MPTCPOPT_MP_JOIN,
1074 TCPOLEN_MPTCP_MPJ_SYNACK,
1075 opts->backup, opts->join_id);
1076 put_unaligned_be64(opts->thmac, ptr);
1077 ptr += 2;
1078 put_unaligned_be32(opts->nonce, ptr);
1079 ptr += 1;
1080 }
1081
1082 if (OPTION_MPTCP_MPJ_ACK & opts->suboptions) {
1083 *ptr++ = mptcp_option(MPTCPOPT_MP_JOIN,
1084 TCPOLEN_MPTCP_MPJ_ACK, 0, 0);
1085 memcpy(ptr, opts->hmac, MPTCPOPT_HMAC_LEN);
1086 ptr += 5;
1087 }
1088
1089 if (opts->ext_copy.use_ack || opts->ext_copy.use_map) {
1090 struct mptcp_ext *mpext = &opts->ext_copy;
1091 u8 len = TCPOLEN_MPTCP_DSS_BASE;
1092 u8 flags = 0;
1093
1094 if (mpext->use_ack) {
1095 flags = MPTCP_DSS_HAS_ACK;
1096 if (mpext->ack64) {
1097 len += TCPOLEN_MPTCP_DSS_ACK64;
1098 flags |= MPTCP_DSS_ACK64;
1099 } else {
1100 len += TCPOLEN_MPTCP_DSS_ACK32;
1101 }
1102 }
1103
1104 if (mpext->use_map) {
1105 len += TCPOLEN_MPTCP_DSS_MAP64;
1106
1107 /* Use only 64-bit mapping flags for now, add
1108 * support for optional 32-bit mappings later.
1109 */
1110 flags |= MPTCP_DSS_HAS_MAP | MPTCP_DSS_DSN64;
1111 if (mpext->data_fin)
1112 flags |= MPTCP_DSS_DATA_FIN;
1113 }
1114
1115 *ptr++ = mptcp_option(MPTCPOPT_DSS, len, 0, flags);
1116
1117 if (mpext->use_ack) {
1118 if (mpext->ack64) {
1119 put_unaligned_be64(mpext->data_ack, ptr);
1120 ptr += 2;
1121 } else {
1122 put_unaligned_be32(mpext->data_ack32, ptr);
1123 ptr += 1;
1124 }
1125 }
1126
1127 if (mpext->use_map) {
1128 put_unaligned_be64(mpext->data_seq, ptr);
1129 ptr += 2;
1130 put_unaligned_be32(mpext->subflow_seq, ptr);
1131 ptr += 1;
1132 put_unaligned_be32(mpext->data_len << 16 |
1133 TCPOPT_NOP << 8 | TCPOPT_NOP, ptr);
1134 }
1135 }
1136 }
1137