1 // SPDX-License-Identifier: GPL-2.0
2 /* Multipath TCP
3 *
4 * Copyright (c) 2017 - 2019, Intel Corporation.
5 */
6
7 #define pr_fmt(fmt) "MPTCP: " fmt
8
9 #include <linux/kernel.h>
10 #include <crypto/sha.h>
11 #include <net/tcp.h>
12 #include <net/mptcp.h>
13 #include "protocol.h"
14 #include "mib.h"
15
mptcp_cap_flag_sha256(u8 flags)16 static bool mptcp_cap_flag_sha256(u8 flags)
17 {
18 return (flags & MPTCP_CAP_FLAG_MASK) == MPTCP_CAP_HMAC_SHA256;
19 }
20
mptcp_parse_option(const struct sk_buff * skb,const unsigned char * ptr,int opsize,struct mptcp_options_received * mp_opt)21 static void mptcp_parse_option(const struct sk_buff *skb,
22 const unsigned char *ptr, int opsize,
23 struct mptcp_options_received *mp_opt)
24 {
25 u8 subtype = *ptr >> 4;
26 int expected_opsize;
27 u8 version;
28 u8 flags;
29
30 switch (subtype) {
31 case MPTCPOPT_MP_CAPABLE:
32 /* strict size checking */
33 if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) {
34 if (skb->len > tcp_hdr(skb)->doff << 2)
35 expected_opsize = TCPOLEN_MPTCP_MPC_ACK_DATA;
36 else
37 expected_opsize = TCPOLEN_MPTCP_MPC_ACK;
38 } else {
39 if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_ACK)
40 expected_opsize = TCPOLEN_MPTCP_MPC_SYNACK;
41 else
42 expected_opsize = TCPOLEN_MPTCP_MPC_SYN;
43 }
44 if (opsize != expected_opsize)
45 break;
46
47 /* try to be gentle vs future versions on the initial syn */
48 version = *ptr++ & MPTCP_VERSION_MASK;
49 if (opsize != TCPOLEN_MPTCP_MPC_SYN) {
50 if (version != MPTCP_SUPPORTED_VERSION)
51 break;
52 } else if (version < MPTCP_SUPPORTED_VERSION) {
53 break;
54 }
55
56 flags = *ptr++;
57 if (!mptcp_cap_flag_sha256(flags) ||
58 (flags & MPTCP_CAP_EXTENSIBILITY))
59 break;
60
61 /* RFC 6824, Section 3.1:
62 * "For the Checksum Required bit (labeled "A"), if either
63 * host requires the use of checksums, checksums MUST be used.
64 * In other words, the only way for checksums not to be used
65 * is if both hosts in their SYNs set A=0."
66 *
67 * Section 3.3.0:
68 * "If a checksum is not present when its use has been
69 * negotiated, the receiver MUST close the subflow with a RST as
70 * it is considered broken."
71 *
72 * We don't implement DSS checksum - fall back to TCP.
73 */
74 if (flags & MPTCP_CAP_CHECKSUM_REQD)
75 break;
76
77 mp_opt->mp_capable = 1;
78 if (opsize >= TCPOLEN_MPTCP_MPC_SYNACK) {
79 mp_opt->sndr_key = get_unaligned_be64(ptr);
80 ptr += 8;
81 }
82 if (opsize >= TCPOLEN_MPTCP_MPC_ACK) {
83 mp_opt->rcvr_key = get_unaligned_be64(ptr);
84 ptr += 8;
85 }
86 if (opsize == TCPOLEN_MPTCP_MPC_ACK_DATA) {
87 /* Section 3.1.:
88 * "the data parameters in a MP_CAPABLE are semantically
89 * equivalent to those in a DSS option and can be used
90 * interchangeably."
91 */
92 mp_opt->dss = 1;
93 mp_opt->use_map = 1;
94 mp_opt->mpc_map = 1;
95 mp_opt->data_len = get_unaligned_be16(ptr);
96 ptr += 2;
97 }
98 pr_debug("MP_CAPABLE version=%x, flags=%x, optlen=%d sndr=%llu, rcvr=%llu len=%d",
99 version, flags, opsize, mp_opt->sndr_key,
100 mp_opt->rcvr_key, mp_opt->data_len);
101 break;
102
103 case MPTCPOPT_MP_JOIN:
104 mp_opt->mp_join = 1;
105 if (opsize == TCPOLEN_MPTCP_MPJ_SYN) {
106 mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP;
107 mp_opt->join_id = *ptr++;
108 mp_opt->token = get_unaligned_be32(ptr);
109 ptr += 4;
110 mp_opt->nonce = get_unaligned_be32(ptr);
111 ptr += 4;
112 pr_debug("MP_JOIN bkup=%u, id=%u, token=%u, nonce=%u",
113 mp_opt->backup, mp_opt->join_id,
114 mp_opt->token, mp_opt->nonce);
115 } else if (opsize == TCPOLEN_MPTCP_MPJ_SYNACK) {
116 mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP;
117 mp_opt->join_id = *ptr++;
118 mp_opt->thmac = get_unaligned_be64(ptr);
119 ptr += 8;
120 mp_opt->nonce = get_unaligned_be32(ptr);
121 ptr += 4;
122 pr_debug("MP_JOIN bkup=%u, id=%u, thmac=%llu, nonce=%u",
123 mp_opt->backup, mp_opt->join_id,
124 mp_opt->thmac, mp_opt->nonce);
125 } else if (opsize == TCPOLEN_MPTCP_MPJ_ACK) {
126 ptr += 2;
127 memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN);
128 pr_debug("MP_JOIN hmac");
129 } else {
130 mp_opt->mp_join = 0;
131 }
132 break;
133
134 case MPTCPOPT_DSS:
135 pr_debug("DSS");
136 ptr++;
137
138 /* we must clear 'mpc_map' be able to detect MP_CAPABLE
139 * map vs DSS map in mptcp_incoming_options(), and reconstruct
140 * map info accordingly
141 */
142 mp_opt->mpc_map = 0;
143 flags = (*ptr++) & MPTCP_DSS_FLAG_MASK;
144 mp_opt->data_fin = (flags & MPTCP_DSS_DATA_FIN) != 0;
145 mp_opt->dsn64 = (flags & MPTCP_DSS_DSN64) != 0;
146 mp_opt->use_map = (flags & MPTCP_DSS_HAS_MAP) != 0;
147 mp_opt->ack64 = (flags & MPTCP_DSS_ACK64) != 0;
148 mp_opt->use_ack = (flags & MPTCP_DSS_HAS_ACK);
149
150 pr_debug("data_fin=%d dsn64=%d use_map=%d ack64=%d use_ack=%d",
151 mp_opt->data_fin, mp_opt->dsn64,
152 mp_opt->use_map, mp_opt->ack64,
153 mp_opt->use_ack);
154
155 expected_opsize = TCPOLEN_MPTCP_DSS_BASE;
156
157 if (mp_opt->use_ack) {
158 if (mp_opt->ack64)
159 expected_opsize += TCPOLEN_MPTCP_DSS_ACK64;
160 else
161 expected_opsize += TCPOLEN_MPTCP_DSS_ACK32;
162 }
163
164 if (mp_opt->use_map) {
165 if (mp_opt->dsn64)
166 expected_opsize += TCPOLEN_MPTCP_DSS_MAP64;
167 else
168 expected_opsize += TCPOLEN_MPTCP_DSS_MAP32;
169 }
170
171 /* RFC 6824, Section 3.3:
172 * If a checksum is present, but its use had
173 * not been negotiated in the MP_CAPABLE handshake,
174 * the checksum field MUST be ignored.
175 */
176 if (opsize != expected_opsize &&
177 opsize != expected_opsize + TCPOLEN_MPTCP_DSS_CHECKSUM)
178 break;
179
180 mp_opt->dss = 1;
181
182 if (mp_opt->use_ack) {
183 if (mp_opt->ack64) {
184 mp_opt->data_ack = get_unaligned_be64(ptr);
185 ptr += 8;
186 } else {
187 mp_opt->data_ack = get_unaligned_be32(ptr);
188 ptr += 4;
189 }
190
191 pr_debug("data_ack=%llu", mp_opt->data_ack);
192 }
193
194 if (mp_opt->use_map) {
195 if (mp_opt->dsn64) {
196 mp_opt->data_seq = get_unaligned_be64(ptr);
197 ptr += 8;
198 } else {
199 mp_opt->data_seq = get_unaligned_be32(ptr);
200 ptr += 4;
201 }
202
203 mp_opt->subflow_seq = get_unaligned_be32(ptr);
204 ptr += 4;
205
206 mp_opt->data_len = get_unaligned_be16(ptr);
207 ptr += 2;
208
209 pr_debug("data_seq=%llu subflow_seq=%u data_len=%u",
210 mp_opt->data_seq, mp_opt->subflow_seq,
211 mp_opt->data_len);
212 }
213
214 break;
215
216 case MPTCPOPT_ADD_ADDR:
217 mp_opt->echo = (*ptr++) & MPTCP_ADDR_ECHO;
218 if (!mp_opt->echo) {
219 if (opsize == TCPOLEN_MPTCP_ADD_ADDR ||
220 opsize == TCPOLEN_MPTCP_ADD_ADDR_PORT)
221 mp_opt->family = MPTCP_ADDR_IPVERSION_4;
222 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
223 else if (opsize == TCPOLEN_MPTCP_ADD_ADDR6 ||
224 opsize == TCPOLEN_MPTCP_ADD_ADDR6_PORT)
225 mp_opt->family = MPTCP_ADDR_IPVERSION_6;
226 #endif
227 else
228 break;
229 } else {
230 if (opsize == TCPOLEN_MPTCP_ADD_ADDR_BASE ||
231 opsize == TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT)
232 mp_opt->family = MPTCP_ADDR_IPVERSION_4;
233 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
234 else if (opsize == TCPOLEN_MPTCP_ADD_ADDR6_BASE ||
235 opsize == TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT)
236 mp_opt->family = MPTCP_ADDR_IPVERSION_6;
237 #endif
238 else
239 break;
240 }
241
242 mp_opt->add_addr = 1;
243 mp_opt->addr_id = *ptr++;
244 pr_debug("ADD_ADDR: id=%d, echo=%d", mp_opt->addr_id, mp_opt->echo);
245 if (mp_opt->family == MPTCP_ADDR_IPVERSION_4) {
246 memcpy((u8 *)&mp_opt->addr.s_addr, (u8 *)ptr, 4);
247 ptr += 4;
248 if (opsize == TCPOLEN_MPTCP_ADD_ADDR_PORT ||
249 opsize == TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT) {
250 mp_opt->port = get_unaligned_be16(ptr);
251 ptr += 2;
252 }
253 }
254 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
255 else {
256 memcpy(mp_opt->addr6.s6_addr, (u8 *)ptr, 16);
257 ptr += 16;
258 if (opsize == TCPOLEN_MPTCP_ADD_ADDR6_PORT ||
259 opsize == TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT) {
260 mp_opt->port = get_unaligned_be16(ptr);
261 ptr += 2;
262 }
263 }
264 #endif
265 if (!mp_opt->echo) {
266 mp_opt->ahmac = get_unaligned_be64(ptr);
267 ptr += 8;
268 }
269 break;
270
271 case MPTCPOPT_RM_ADDR:
272 if (opsize != TCPOLEN_MPTCP_RM_ADDR_BASE)
273 break;
274
275 ptr++;
276
277 mp_opt->rm_addr = 1;
278 mp_opt->rm_id = *ptr++;
279 pr_debug("RM_ADDR: id=%d", mp_opt->rm_id);
280 break;
281
282 default:
283 break;
284 }
285 }
286
mptcp_get_options(const struct sk_buff * skb,struct mptcp_options_received * mp_opt)287 void mptcp_get_options(const struct sk_buff *skb,
288 struct mptcp_options_received *mp_opt)
289 {
290 const struct tcphdr *th = tcp_hdr(skb);
291 const unsigned char *ptr;
292 int length;
293
294 /* initialize option status */
295 mp_opt->mp_capable = 0;
296 mp_opt->mp_join = 0;
297 mp_opt->add_addr = 0;
298 mp_opt->ahmac = 0;
299 mp_opt->port = 0;
300 mp_opt->rm_addr = 0;
301 mp_opt->dss = 0;
302
303 length = (th->doff * 4) - sizeof(struct tcphdr);
304 ptr = (const unsigned char *)(th + 1);
305
306 while (length > 0) {
307 int opcode = *ptr++;
308 int opsize;
309
310 switch (opcode) {
311 case TCPOPT_EOL:
312 return;
313 case TCPOPT_NOP: /* Ref: RFC 793 section 3.1 */
314 length--;
315 continue;
316 default:
317 if (length < 2)
318 return;
319 opsize = *ptr++;
320 if (opsize < 2) /* "silly options" */
321 return;
322 if (opsize > length)
323 return; /* don't parse partial options */
324 if (opcode == TCPOPT_MPTCP)
325 mptcp_parse_option(skb, ptr, opsize, mp_opt);
326 ptr += opsize - 2;
327 length -= opsize;
328 }
329 }
330 }
331
mptcp_syn_options(struct sock * sk,const struct sk_buff * skb,unsigned int * size,struct mptcp_out_options * opts)332 bool mptcp_syn_options(struct sock *sk, const struct sk_buff *skb,
333 unsigned int *size, struct mptcp_out_options *opts)
334 {
335 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
336
337 /* we will use snd_isn to detect first pkt [re]transmission
338 * in mptcp_established_options_mp()
339 */
340 subflow->snd_isn = TCP_SKB_CB(skb)->end_seq;
341 if (subflow->request_mptcp) {
342 opts->suboptions = OPTION_MPTCP_MPC_SYN;
343 *size = TCPOLEN_MPTCP_MPC_SYN;
344 return true;
345 } else if (subflow->request_join) {
346 pr_debug("remote_token=%u, nonce=%u", subflow->remote_token,
347 subflow->local_nonce);
348 opts->suboptions = OPTION_MPTCP_MPJ_SYN;
349 opts->join_id = subflow->local_id;
350 opts->token = subflow->remote_token;
351 opts->nonce = subflow->local_nonce;
352 opts->backup = subflow->request_bkup;
353 *size = TCPOLEN_MPTCP_MPJ_SYN;
354 return true;
355 }
356 return false;
357 }
358
359 /* MP_JOIN client subflow must wait for 4th ack before sending any data:
360 * TCP can't schedule delack timer before the subflow is fully established.
361 * MPTCP uses the delack timer to do 3rd ack retransmissions
362 */
schedule_3rdack_retransmission(struct sock * sk)363 static void schedule_3rdack_retransmission(struct sock *sk)
364 {
365 struct inet_connection_sock *icsk = inet_csk(sk);
366 struct tcp_sock *tp = tcp_sk(sk);
367 unsigned long timeout;
368
369 /* reschedule with a timeout above RTT, as we must look only for drop */
370 if (tp->srtt_us)
371 timeout = usecs_to_jiffies(tp->srtt_us >> (3 - 1));
372 else
373 timeout = TCP_TIMEOUT_INIT;
374 timeout += jiffies;
375
376 WARN_ON_ONCE(icsk->icsk_ack.pending & ICSK_ACK_TIMER);
377 icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER;
378 icsk->icsk_ack.timeout = timeout;
379 sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout);
380 }
381
clear_3rdack_retransmission(struct sock * sk)382 static void clear_3rdack_retransmission(struct sock *sk)
383 {
384 struct inet_connection_sock *icsk = inet_csk(sk);
385
386 sk_stop_timer(sk, &icsk->icsk_delack_timer);
387 icsk->icsk_ack.timeout = 0;
388 icsk->icsk_ack.ato = 0;
389 icsk->icsk_ack.pending &= ~(ICSK_ACK_SCHED | ICSK_ACK_TIMER);
390 }
391
mptcp_established_options_mp(struct sock * sk,struct sk_buff * skb,unsigned int * size,unsigned int remaining,struct mptcp_out_options * opts)392 static bool mptcp_established_options_mp(struct sock *sk, struct sk_buff *skb,
393 unsigned int *size,
394 unsigned int remaining,
395 struct mptcp_out_options *opts)
396 {
397 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
398 struct mptcp_ext *mpext;
399 unsigned int data_len;
400
401 /* When skb is not available, we better over-estimate the emitted
402 * options len. A full DSS option (28 bytes) is longer than
403 * TCPOLEN_MPTCP_MPC_ACK_DATA(22) or TCPOLEN_MPTCP_MPJ_ACK(24), so
404 * tell the caller to defer the estimate to
405 * mptcp_established_options_dss(), which will reserve enough space.
406 */
407 if (!skb)
408 return false;
409
410 /* MPC/MPJ needed only on 3rd ack packet */
411 if (subflow->fully_established ||
412 subflow->snd_isn != TCP_SKB_CB(skb)->seq)
413 return false;
414
415 if (subflow->mp_capable) {
416 mpext = mptcp_get_ext(skb);
417 data_len = mpext ? mpext->data_len : 0;
418
419 /* we will check ext_copy.data_len in mptcp_write_options() to
420 * discriminate between TCPOLEN_MPTCP_MPC_ACK_DATA and
421 * TCPOLEN_MPTCP_MPC_ACK
422 */
423 opts->ext_copy.data_len = data_len;
424 opts->suboptions = OPTION_MPTCP_MPC_ACK;
425 opts->sndr_key = subflow->local_key;
426 opts->rcvr_key = subflow->remote_key;
427
428 /* Section 3.1.
429 * The MP_CAPABLE option is carried on the SYN, SYN/ACK, and ACK
430 * packets that start the first subflow of an MPTCP connection,
431 * as well as the first packet that carries data
432 */
433 if (data_len > 0)
434 *size = ALIGN(TCPOLEN_MPTCP_MPC_ACK_DATA, 4);
435 else
436 *size = TCPOLEN_MPTCP_MPC_ACK;
437
438 pr_debug("subflow=%p, local_key=%llu, remote_key=%llu map_len=%d",
439 subflow, subflow->local_key, subflow->remote_key,
440 data_len);
441
442 return true;
443 } else if (subflow->mp_join) {
444 opts->suboptions = OPTION_MPTCP_MPJ_ACK;
445 memcpy(opts->hmac, subflow->hmac, MPTCPOPT_HMAC_LEN);
446 *size = TCPOLEN_MPTCP_MPJ_ACK;
447 pr_debug("subflow=%p", subflow);
448
449 schedule_3rdack_retransmission(sk);
450 return true;
451 }
452 return false;
453 }
454
mptcp_write_data_fin(struct mptcp_subflow_context * subflow,struct sk_buff * skb,struct mptcp_ext * ext)455 static void mptcp_write_data_fin(struct mptcp_subflow_context *subflow,
456 struct sk_buff *skb, struct mptcp_ext *ext)
457 {
458 /* The write_seq value has already been incremented, so the actual
459 * sequence number for the DATA_FIN is one less.
460 */
461 u64 data_fin_tx_seq = READ_ONCE(mptcp_sk(subflow->conn)->write_seq) - 1;
462
463 if (!ext->use_map || !skb->len) {
464 /* RFC6824 requires a DSS mapping with specific values
465 * if DATA_FIN is set but no data payload is mapped
466 */
467 ext->data_fin = 1;
468 ext->use_map = 1;
469 ext->dsn64 = 1;
470 ext->data_seq = data_fin_tx_seq;
471 ext->subflow_seq = 0;
472 ext->data_len = 1;
473 } else if (ext->data_seq + ext->data_len == data_fin_tx_seq) {
474 /* If there's an existing DSS mapping and it is the
475 * final mapping, DATA_FIN consumes 1 additional byte of
476 * mapping space.
477 */
478 ext->data_fin = 1;
479 ext->data_len++;
480 }
481 }
482
mptcp_established_options_dss(struct sock * sk,struct sk_buff * skb,unsigned int * size,unsigned int remaining,struct mptcp_out_options * opts)483 static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,
484 unsigned int *size,
485 unsigned int remaining,
486 struct mptcp_out_options *opts)
487 {
488 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
489 struct mptcp_sock *msk = mptcp_sk(subflow->conn);
490 unsigned int dss_size = 0;
491 u64 snd_data_fin_enable;
492 struct mptcp_ext *mpext;
493 unsigned int ack_size;
494 bool ret = false;
495
496 mpext = skb ? mptcp_get_ext(skb) : NULL;
497 snd_data_fin_enable = READ_ONCE(msk->snd_data_fin_enable);
498
499 if (!skb || (mpext && mpext->use_map) || snd_data_fin_enable) {
500 unsigned int map_size;
501
502 map_size = TCPOLEN_MPTCP_DSS_BASE + TCPOLEN_MPTCP_DSS_MAP64;
503
504 remaining -= map_size;
505 dss_size = map_size;
506 if (mpext)
507 opts->ext_copy = *mpext;
508
509 if (skb && snd_data_fin_enable)
510 mptcp_write_data_fin(subflow, skb, &opts->ext_copy);
511 ret = true;
512 }
513
514 /* passive sockets msk will set the 'can_ack' after accept(), even
515 * if the first subflow may have the already the remote key handy
516 */
517 opts->ext_copy.use_ack = 0;
518 if (!READ_ONCE(msk->can_ack)) {
519 *size = ALIGN(dss_size, 4);
520 return ret;
521 }
522
523 if (READ_ONCE(msk->use_64bit_ack)) {
524 ack_size = TCPOLEN_MPTCP_DSS_ACK64;
525 opts->ext_copy.data_ack = READ_ONCE(msk->ack_seq);
526 opts->ext_copy.ack64 = 1;
527 } else {
528 ack_size = TCPOLEN_MPTCP_DSS_ACK32;
529 opts->ext_copy.data_ack32 = (uint32_t)READ_ONCE(msk->ack_seq);
530 opts->ext_copy.ack64 = 0;
531 }
532 opts->ext_copy.use_ack = 1;
533
534 /* Add kind/length/subtype/flag overhead if mapping is not populated */
535 if (dss_size == 0)
536 ack_size += TCPOLEN_MPTCP_DSS_BASE;
537
538 dss_size += ack_size;
539
540 *size = ALIGN(dss_size, 4);
541 return true;
542 }
543
add_addr_generate_hmac(u64 key1,u64 key2,u8 addr_id,struct in_addr * addr)544 static u64 add_addr_generate_hmac(u64 key1, u64 key2, u8 addr_id,
545 struct in_addr *addr)
546 {
547 u8 hmac[SHA256_DIGEST_SIZE];
548 u8 msg[7];
549
550 msg[0] = addr_id;
551 memcpy(&msg[1], &addr->s_addr, 4);
552 msg[5] = 0;
553 msg[6] = 0;
554
555 mptcp_crypto_hmac_sha(key1, key2, msg, 7, hmac);
556
557 return get_unaligned_be64(&hmac[SHA256_DIGEST_SIZE - sizeof(u64)]);
558 }
559
560 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
add_addr6_generate_hmac(u64 key1,u64 key2,u8 addr_id,struct in6_addr * addr)561 static u64 add_addr6_generate_hmac(u64 key1, u64 key2, u8 addr_id,
562 struct in6_addr *addr)
563 {
564 u8 hmac[SHA256_DIGEST_SIZE];
565 u8 msg[19];
566
567 msg[0] = addr_id;
568 memcpy(&msg[1], &addr->s6_addr, 16);
569 msg[17] = 0;
570 msg[18] = 0;
571
572 mptcp_crypto_hmac_sha(key1, key2, msg, 19, hmac);
573
574 return get_unaligned_be64(&hmac[SHA256_DIGEST_SIZE - sizeof(u64)]);
575 }
576 #endif
577
mptcp_established_options_add_addr(struct sock * sk,unsigned int * size,unsigned int remaining,struct mptcp_out_options * opts)578 static bool mptcp_established_options_add_addr(struct sock *sk,
579 unsigned int *size,
580 unsigned int remaining,
581 struct mptcp_out_options *opts)
582 {
583 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
584 struct mptcp_sock *msk = mptcp_sk(subflow->conn);
585 struct mptcp_addr_info saddr;
586 bool echo;
587 int len;
588
589 if (!mptcp_pm_should_add_signal(msk) ||
590 !(mptcp_pm_add_addr_signal(msk, remaining, &saddr, &echo)))
591 return false;
592
593 len = mptcp_add_addr_len(saddr.family, echo);
594 if (remaining < len)
595 return false;
596
597 *size = len;
598 opts->addr_id = saddr.id;
599 if (saddr.family == AF_INET) {
600 opts->suboptions |= OPTION_MPTCP_ADD_ADDR;
601 opts->addr = saddr.addr;
602 if (!echo) {
603 opts->ahmac = add_addr_generate_hmac(msk->local_key,
604 msk->remote_key,
605 opts->addr_id,
606 &opts->addr);
607 }
608 }
609 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
610 else if (saddr.family == AF_INET6) {
611 opts->suboptions |= OPTION_MPTCP_ADD_ADDR6;
612 opts->addr6 = saddr.addr6;
613 if (!echo) {
614 opts->ahmac = add_addr6_generate_hmac(msk->local_key,
615 msk->remote_key,
616 opts->addr_id,
617 &opts->addr6);
618 }
619 }
620 #endif
621 pr_debug("addr_id=%d, ahmac=%llu, echo=%d", opts->addr_id, opts->ahmac, echo);
622
623 return true;
624 }
625
mptcp_established_options_rm_addr(struct sock * sk,unsigned int * size,unsigned int remaining,struct mptcp_out_options * opts)626 static bool mptcp_established_options_rm_addr(struct sock *sk,
627 unsigned int *size,
628 unsigned int remaining,
629 struct mptcp_out_options *opts)
630 {
631 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
632 struct mptcp_sock *msk = mptcp_sk(subflow->conn);
633 u8 rm_id;
634
635 if (!mptcp_pm_should_rm_signal(msk) ||
636 !(mptcp_pm_rm_addr_signal(msk, remaining, &rm_id)))
637 return false;
638
639 if (remaining < TCPOLEN_MPTCP_RM_ADDR_BASE)
640 return false;
641
642 *size = TCPOLEN_MPTCP_RM_ADDR_BASE;
643 opts->suboptions |= OPTION_MPTCP_RM_ADDR;
644 opts->rm_id = rm_id;
645
646 pr_debug("rm_id=%d", opts->rm_id);
647
648 return true;
649 }
650
mptcp_established_options(struct sock * sk,struct sk_buff * skb,unsigned int * size,unsigned int remaining,struct mptcp_out_options * opts)651 bool mptcp_established_options(struct sock *sk, struct sk_buff *skb,
652 unsigned int *size, unsigned int remaining,
653 struct mptcp_out_options *opts)
654 {
655 unsigned int opt_size = 0;
656 bool ret = false;
657
658 opts->suboptions = 0;
659
660 if (unlikely(mptcp_check_fallback(sk)))
661 return false;
662
663 /* prevent adding of any MPTCP related options on reset packet
664 * until we support MP_TCPRST/MP_FASTCLOSE
665 */
666 if (unlikely(skb && TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST))
667 return false;
668
669 if (mptcp_established_options_mp(sk, skb, &opt_size, remaining, opts))
670 ret = true;
671 else if (mptcp_established_options_dss(sk, skb, &opt_size, remaining,
672 opts))
673 ret = true;
674
675 /* we reserved enough space for the above options, and exceeding the
676 * TCP option space would be fatal
677 */
678 if (WARN_ON_ONCE(opt_size > remaining))
679 return false;
680
681 *size += opt_size;
682 remaining -= opt_size;
683 if (mptcp_established_options_add_addr(sk, &opt_size, remaining, opts)) {
684 *size += opt_size;
685 remaining -= opt_size;
686 ret = true;
687 } else if (mptcp_established_options_rm_addr(sk, &opt_size, remaining, opts)) {
688 *size += opt_size;
689 remaining -= opt_size;
690 ret = true;
691 }
692
693 return ret;
694 }
695
mptcp_synack_options(const struct request_sock * req,unsigned int * size,struct mptcp_out_options * opts)696 bool mptcp_synack_options(const struct request_sock *req, unsigned int *size,
697 struct mptcp_out_options *opts)
698 {
699 struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
700
701 if (subflow_req->mp_capable) {
702 opts->suboptions = OPTION_MPTCP_MPC_SYNACK;
703 opts->sndr_key = subflow_req->local_key;
704 *size = TCPOLEN_MPTCP_MPC_SYNACK;
705 pr_debug("subflow_req=%p, local_key=%llu",
706 subflow_req, subflow_req->local_key);
707 return true;
708 } else if (subflow_req->mp_join) {
709 opts->suboptions = OPTION_MPTCP_MPJ_SYNACK;
710 opts->backup = subflow_req->backup;
711 opts->join_id = subflow_req->local_id;
712 opts->thmac = subflow_req->thmac;
713 opts->nonce = subflow_req->local_nonce;
714 pr_debug("req=%p, bkup=%u, id=%u, thmac=%llu, nonce=%u",
715 subflow_req, opts->backup, opts->join_id,
716 opts->thmac, opts->nonce);
717 *size = TCPOLEN_MPTCP_MPJ_SYNACK;
718 return true;
719 }
720 return false;
721 }
722
check_fully_established(struct mptcp_sock * msk,struct sock * ssk,struct mptcp_subflow_context * subflow,struct sk_buff * skb,struct mptcp_options_received * mp_opt)723 static bool check_fully_established(struct mptcp_sock *msk, struct sock *ssk,
724 struct mptcp_subflow_context *subflow,
725 struct sk_buff *skb,
726 struct mptcp_options_received *mp_opt)
727 {
728 /* here we can process OoO, in-window pkts, only in-sequence 4th ack
729 * will make the subflow fully established
730 */
731 if (likely(subflow->fully_established)) {
732 /* on passive sockets, check for 3rd ack retransmission
733 * note that msk is always set by subflow_syn_recv_sock()
734 * for mp_join subflows
735 */
736 if (TCP_SKB_CB(skb)->seq == subflow->ssn_offset + 1 &&
737 TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq &&
738 subflow->mp_join && mp_opt->mp_join &&
739 READ_ONCE(msk->pm.server_side))
740 tcp_send_ack(ssk);
741 goto fully_established;
742 }
743
744 /* we must process OoO packets before the first subflow is fully
745 * established. OoO packets are instead a protocol violation
746 * for MP_JOIN subflows as the peer must not send any data
747 * before receiving the forth ack - cfr. RFC 8684 section 3.2.
748 */
749 if (TCP_SKB_CB(skb)->seq != subflow->ssn_offset + 1) {
750 if (subflow->mp_join)
751 goto reset;
752 return subflow->mp_capable;
753 }
754
755 if (mp_opt->dss && mp_opt->use_ack) {
756 /* subflows are fully established as soon as we get any
757 * additional ack.
758 */
759 subflow->fully_established = 1;
760 WRITE_ONCE(msk->fully_established, true);
761 goto fully_established;
762 }
763
764 /* If the first established packet does not contain MP_CAPABLE + data
765 * then fallback to TCP. Fallback scenarios requires a reset for
766 * MP_JOIN subflows.
767 */
768 if (!mp_opt->mp_capable) {
769 if (subflow->mp_join)
770 goto reset;
771 subflow->mp_capable = 0;
772 pr_fallback(msk);
773 __mptcp_do_fallback(msk);
774 return false;
775 }
776
777 if (unlikely(!READ_ONCE(msk->pm.server_side)))
778 pr_warn_once("bogus mpc option on established client sk");
779 mptcp_subflow_fully_established(subflow, mp_opt);
780
781 fully_established:
782 if (likely(subflow->pm_notified))
783 return true;
784
785 subflow->pm_notified = 1;
786 if (subflow->mp_join) {
787 clear_3rdack_retransmission(ssk);
788 mptcp_pm_subflow_established(msk, subflow);
789 } else {
790 mptcp_pm_fully_established(msk);
791 }
792 return true;
793
794 reset:
795 mptcp_subflow_reset(ssk);
796 return false;
797 }
798
expand_ack(u64 old_ack,u64 cur_ack,bool use_64bit)799 static u64 expand_ack(u64 old_ack, u64 cur_ack, bool use_64bit)
800 {
801 u32 old_ack32, cur_ack32;
802
803 if (use_64bit)
804 return cur_ack;
805
806 old_ack32 = (u32)old_ack;
807 cur_ack32 = (u32)cur_ack;
808 cur_ack = (old_ack & GENMASK_ULL(63, 32)) + cur_ack32;
809 if (unlikely(before(cur_ack32, old_ack32)))
810 return cur_ack + (1LL << 32);
811 return cur_ack;
812 }
813
update_una(struct mptcp_sock * msk,struct mptcp_options_received * mp_opt)814 static void update_una(struct mptcp_sock *msk,
815 struct mptcp_options_received *mp_opt)
816 {
817 u64 new_snd_una, snd_una, old_snd_una = atomic64_read(&msk->snd_una);
818 u64 write_seq = READ_ONCE(msk->write_seq);
819
820 /* avoid ack expansion on update conflict, to reduce the risk of
821 * wrongly expanding to a future ack sequence number, which is way
822 * more dangerous than missing an ack
823 */
824 new_snd_una = expand_ack(old_snd_una, mp_opt->data_ack, mp_opt->ack64);
825
826 /* ACK for data not even sent yet? Ignore. */
827 if (after64(new_snd_una, write_seq))
828 new_snd_una = old_snd_una;
829
830 while (after64(new_snd_una, old_snd_una)) {
831 snd_una = old_snd_una;
832 old_snd_una = atomic64_cmpxchg(&msk->snd_una, snd_una,
833 new_snd_una);
834 if (old_snd_una == snd_una) {
835 mptcp_data_acked((struct sock *)msk);
836 break;
837 }
838 }
839 }
840
mptcp_update_rcv_data_fin(struct mptcp_sock * msk,u64 data_fin_seq,bool use_64bit)841 bool mptcp_update_rcv_data_fin(struct mptcp_sock *msk, u64 data_fin_seq, bool use_64bit)
842 {
843 /* Skip if DATA_FIN was already received.
844 * If updating simultaneously with the recvmsg loop, values
845 * should match. If they mismatch, the peer is misbehaving and
846 * we will prefer the most recent information.
847 */
848 if (READ_ONCE(msk->rcv_data_fin) || !READ_ONCE(msk->first))
849 return false;
850
851 WRITE_ONCE(msk->rcv_data_fin_seq,
852 expand_ack(READ_ONCE(msk->ack_seq), data_fin_seq, use_64bit));
853 WRITE_ONCE(msk->rcv_data_fin, 1);
854
855 return true;
856 }
857
add_addr_hmac_valid(struct mptcp_sock * msk,struct mptcp_options_received * mp_opt)858 static bool add_addr_hmac_valid(struct mptcp_sock *msk,
859 struct mptcp_options_received *mp_opt)
860 {
861 u64 hmac = 0;
862
863 if (mp_opt->echo)
864 return true;
865
866 if (mp_opt->family == MPTCP_ADDR_IPVERSION_4)
867 hmac = add_addr_generate_hmac(msk->remote_key,
868 msk->local_key,
869 mp_opt->addr_id, &mp_opt->addr);
870 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
871 else
872 hmac = add_addr6_generate_hmac(msk->remote_key,
873 msk->local_key,
874 mp_opt->addr_id, &mp_opt->addr6);
875 #endif
876
877 pr_debug("msk=%p, ahmac=%llu, mp_opt->ahmac=%llu\n",
878 msk, (unsigned long long)hmac,
879 (unsigned long long)mp_opt->ahmac);
880
881 return hmac == mp_opt->ahmac;
882 }
883
mptcp_incoming_options(struct sock * sk,struct sk_buff * skb)884 void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb)
885 {
886 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
887 struct mptcp_sock *msk = mptcp_sk(subflow->conn);
888 struct mptcp_options_received mp_opt;
889 struct mptcp_ext *mpext;
890
891 if (__mptcp_check_fallback(msk))
892 return;
893
894 mptcp_get_options(skb, &mp_opt);
895 if (!check_fully_established(msk, sk, subflow, skb, &mp_opt))
896 return;
897
898 if (mp_opt.add_addr && add_addr_hmac_valid(msk, &mp_opt)) {
899 struct mptcp_addr_info addr;
900
901 addr.port = htons(mp_opt.port);
902 addr.id = mp_opt.addr_id;
903 if (mp_opt.family == MPTCP_ADDR_IPVERSION_4) {
904 addr.family = AF_INET;
905 addr.addr = mp_opt.addr;
906 }
907 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
908 else if (mp_opt.family == MPTCP_ADDR_IPVERSION_6) {
909 addr.family = AF_INET6;
910 addr.addr6 = mp_opt.addr6;
911 }
912 #endif
913 if (!mp_opt.echo) {
914 mptcp_pm_add_addr_received(msk, &addr);
915 MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ADDADDR);
916 } else {
917 mptcp_pm_del_add_timer(msk, &addr);
918 MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ECHOADD);
919 }
920 mp_opt.add_addr = 0;
921 }
922
923 if (mp_opt.rm_addr) {
924 mptcp_pm_rm_addr_received(msk, mp_opt.rm_id);
925 mp_opt.rm_addr = 0;
926 }
927
928 if (!mp_opt.dss)
929 return;
930
931 /* we can't wait for recvmsg() to update the ack_seq, otherwise
932 * monodirectional flows will stuck
933 */
934 if (mp_opt.use_ack)
935 update_una(msk, &mp_opt);
936
937 /* Zero-data-length packets are dropped by the caller and not
938 * propagated to the MPTCP layer, so the skb extension does not
939 * need to be allocated or populated. DATA_FIN information, if
940 * present, needs to be updated here before the skb is freed.
941 */
942 if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) {
943 if (mp_opt.data_fin && mp_opt.data_len == 1 &&
944 mptcp_update_rcv_data_fin(msk, mp_opt.data_seq, mp_opt.dsn64) &&
945 schedule_work(&msk->work))
946 sock_hold(subflow->conn);
947
948 return;
949 }
950
951 mpext = skb_ext_add(skb, SKB_EXT_MPTCP);
952 if (!mpext)
953 return;
954
955 memset(mpext, 0, sizeof(*mpext));
956
957 if (mp_opt.use_map) {
958 if (mp_opt.mpc_map) {
959 /* this is an MP_CAPABLE carrying MPTCP data
960 * we know this map the first chunk of data
961 */
962 mptcp_crypto_key_sha(subflow->remote_key, NULL,
963 &mpext->data_seq);
964 mpext->data_seq++;
965 mpext->subflow_seq = 1;
966 mpext->dsn64 = 1;
967 mpext->mpc_map = 1;
968 mpext->data_fin = 0;
969 } else {
970 mpext->data_seq = mp_opt.data_seq;
971 mpext->subflow_seq = mp_opt.subflow_seq;
972 mpext->dsn64 = mp_opt.dsn64;
973 mpext->data_fin = mp_opt.data_fin;
974 }
975 mpext->data_len = mp_opt.data_len;
976 mpext->use_map = 1;
977 }
978 }
979
mptcp_write_options(__be32 * ptr,struct mptcp_out_options * opts)980 void mptcp_write_options(__be32 *ptr, struct mptcp_out_options *opts)
981 {
982 if ((OPTION_MPTCP_MPC_SYN | OPTION_MPTCP_MPC_SYNACK |
983 OPTION_MPTCP_MPC_ACK) & opts->suboptions) {
984 u8 len;
985
986 if (OPTION_MPTCP_MPC_SYN & opts->suboptions)
987 len = TCPOLEN_MPTCP_MPC_SYN;
988 else if (OPTION_MPTCP_MPC_SYNACK & opts->suboptions)
989 len = TCPOLEN_MPTCP_MPC_SYNACK;
990 else if (opts->ext_copy.data_len)
991 len = TCPOLEN_MPTCP_MPC_ACK_DATA;
992 else
993 len = TCPOLEN_MPTCP_MPC_ACK;
994
995 *ptr++ = mptcp_option(MPTCPOPT_MP_CAPABLE, len,
996 MPTCP_SUPPORTED_VERSION,
997 MPTCP_CAP_HMAC_SHA256);
998
999 if (!((OPTION_MPTCP_MPC_SYNACK | OPTION_MPTCP_MPC_ACK) &
1000 opts->suboptions))
1001 goto mp_capable_done;
1002
1003 put_unaligned_be64(opts->sndr_key, ptr);
1004 ptr += 2;
1005 if (!((OPTION_MPTCP_MPC_ACK) & opts->suboptions))
1006 goto mp_capable_done;
1007
1008 put_unaligned_be64(opts->rcvr_key, ptr);
1009 ptr += 2;
1010 if (!opts->ext_copy.data_len)
1011 goto mp_capable_done;
1012
1013 put_unaligned_be32(opts->ext_copy.data_len << 16 |
1014 TCPOPT_NOP << 8 | TCPOPT_NOP, ptr);
1015 ptr += 1;
1016 }
1017
1018 mp_capable_done:
1019 if (OPTION_MPTCP_ADD_ADDR & opts->suboptions) {
1020 if (opts->ahmac)
1021 *ptr++ = mptcp_option(MPTCPOPT_ADD_ADDR,
1022 TCPOLEN_MPTCP_ADD_ADDR, 0,
1023 opts->addr_id);
1024 else
1025 *ptr++ = mptcp_option(MPTCPOPT_ADD_ADDR,
1026 TCPOLEN_MPTCP_ADD_ADDR_BASE,
1027 MPTCP_ADDR_ECHO,
1028 opts->addr_id);
1029 memcpy((u8 *)ptr, (u8 *)&opts->addr.s_addr, 4);
1030 ptr += 1;
1031 if (opts->ahmac) {
1032 put_unaligned_be64(opts->ahmac, ptr);
1033 ptr += 2;
1034 }
1035 }
1036
1037 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1038 if (OPTION_MPTCP_ADD_ADDR6 & opts->suboptions) {
1039 if (opts->ahmac)
1040 *ptr++ = mptcp_option(MPTCPOPT_ADD_ADDR,
1041 TCPOLEN_MPTCP_ADD_ADDR6, 0,
1042 opts->addr_id);
1043 else
1044 *ptr++ = mptcp_option(MPTCPOPT_ADD_ADDR,
1045 TCPOLEN_MPTCP_ADD_ADDR6_BASE,
1046 MPTCP_ADDR_ECHO,
1047 opts->addr_id);
1048 memcpy((u8 *)ptr, opts->addr6.s6_addr, 16);
1049 ptr += 4;
1050 if (opts->ahmac) {
1051 put_unaligned_be64(opts->ahmac, ptr);
1052 ptr += 2;
1053 }
1054 }
1055 #endif
1056
1057 if (OPTION_MPTCP_RM_ADDR & opts->suboptions) {
1058 *ptr++ = mptcp_option(MPTCPOPT_RM_ADDR,
1059 TCPOLEN_MPTCP_RM_ADDR_BASE,
1060 0, opts->rm_id);
1061 }
1062
1063 if (OPTION_MPTCP_MPJ_SYN & opts->suboptions) {
1064 *ptr++ = mptcp_option(MPTCPOPT_MP_JOIN,
1065 TCPOLEN_MPTCP_MPJ_SYN,
1066 opts->backup, opts->join_id);
1067 put_unaligned_be32(opts->token, ptr);
1068 ptr += 1;
1069 put_unaligned_be32(opts->nonce, ptr);
1070 ptr += 1;
1071 }
1072
1073 if (OPTION_MPTCP_MPJ_SYNACK & opts->suboptions) {
1074 *ptr++ = mptcp_option(MPTCPOPT_MP_JOIN,
1075 TCPOLEN_MPTCP_MPJ_SYNACK,
1076 opts->backup, opts->join_id);
1077 put_unaligned_be64(opts->thmac, ptr);
1078 ptr += 2;
1079 put_unaligned_be32(opts->nonce, ptr);
1080 ptr += 1;
1081 }
1082
1083 if (OPTION_MPTCP_MPJ_ACK & opts->suboptions) {
1084 *ptr++ = mptcp_option(MPTCPOPT_MP_JOIN,
1085 TCPOLEN_MPTCP_MPJ_ACK, 0, 0);
1086 memcpy(ptr, opts->hmac, MPTCPOPT_HMAC_LEN);
1087 ptr += 5;
1088 }
1089
1090 if (opts->ext_copy.use_ack || opts->ext_copy.use_map) {
1091 struct mptcp_ext *mpext = &opts->ext_copy;
1092 u8 len = TCPOLEN_MPTCP_DSS_BASE;
1093 u8 flags = 0;
1094
1095 if (mpext->use_ack) {
1096 flags = MPTCP_DSS_HAS_ACK;
1097 if (mpext->ack64) {
1098 len += TCPOLEN_MPTCP_DSS_ACK64;
1099 flags |= MPTCP_DSS_ACK64;
1100 } else {
1101 len += TCPOLEN_MPTCP_DSS_ACK32;
1102 }
1103 }
1104
1105 if (mpext->use_map) {
1106 len += TCPOLEN_MPTCP_DSS_MAP64;
1107
1108 /* Use only 64-bit mapping flags for now, add
1109 * support for optional 32-bit mappings later.
1110 */
1111 flags |= MPTCP_DSS_HAS_MAP | MPTCP_DSS_DSN64;
1112 if (mpext->data_fin)
1113 flags |= MPTCP_DSS_DATA_FIN;
1114 }
1115
1116 *ptr++ = mptcp_option(MPTCPOPT_DSS, len, 0, flags);
1117
1118 if (mpext->use_ack) {
1119 if (mpext->ack64) {
1120 put_unaligned_be64(mpext->data_ack, ptr);
1121 ptr += 2;
1122 } else {
1123 put_unaligned_be32(mpext->data_ack32, ptr);
1124 ptr += 1;
1125 }
1126 }
1127
1128 if (mpext->use_map) {
1129 put_unaligned_be64(mpext->data_seq, ptr);
1130 ptr += 2;
1131 put_unaligned_be32(mpext->subflow_seq, ptr);
1132 ptr += 1;
1133 put_unaligned_be32(mpext->data_len << 16 |
1134 TCPOPT_NOP << 8 | TCPOPT_NOP, ptr);
1135 }
1136 }
1137 }
1138