1 /* connection-level event handling
2 *
3 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13
14 #include <linux/module.h>
15 #include <linux/net.h>
16 #include <linux/skbuff.h>
17 #include <linux/errqueue.h>
18 #include <net/sock.h>
19 #include <net/af_rxrpc.h>
20 #include <net/ip.h>
21 #include "ar-internal.h"
22
23 /*
24 * Retransmit terminal ACK or ABORT of the previous call.
25 */
rxrpc_conn_retransmit_call(struct rxrpc_connection * conn,struct sk_buff * skb)26 static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
27 struct sk_buff *skb)
28 {
29 struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
30 struct rxrpc_channel *chan;
31 struct msghdr msg;
32 struct kvec iov;
33 struct {
34 struct rxrpc_wire_header whdr;
35 union {
36 struct {
37 __be32 code;
38 } abort;
39 struct {
40 struct rxrpc_ackpacket ack;
41 u8 padding[3];
42 struct rxrpc_ackinfo info;
43 };
44 };
45 } __attribute__((packed)) pkt;
46 size_t len;
47 u32 serial, mtu, call_id;
48
49 _enter("%d", conn->debug_id);
50
51 chan = &conn->channels[sp->hdr.cid & RXRPC_CHANNELMASK];
52
53 /* If the last call got moved on whilst we were waiting to run, just
54 * ignore this packet.
55 */
56 call_id = READ_ONCE(chan->last_call);
57 /* Sync with __rxrpc_disconnect_call() */
58 smp_rmb();
59 if (call_id != sp->hdr.callNumber)
60 return;
61
62 msg.msg_name = &conn->params.peer->srx.transport;
63 msg.msg_namelen = conn->params.peer->srx.transport_len;
64 msg.msg_control = NULL;
65 msg.msg_controllen = 0;
66 msg.msg_flags = 0;
67
68 pkt.whdr.epoch = htonl(sp->hdr.epoch);
69 pkt.whdr.cid = htonl(sp->hdr.cid);
70 pkt.whdr.callNumber = htonl(sp->hdr.callNumber);
71 pkt.whdr.seq = 0;
72 pkt.whdr.type = chan->last_type;
73 pkt.whdr.flags = conn->out_clientflag;
74 pkt.whdr.userStatus = 0;
75 pkt.whdr.securityIndex = conn->security_ix;
76 pkt.whdr._rsvd = 0;
77 pkt.whdr.serviceId = htons(conn->service_id);
78
79 len = sizeof(pkt.whdr);
80 switch (chan->last_type) {
81 case RXRPC_PACKET_TYPE_ABORT:
82 pkt.abort.code = htonl(chan->last_abort);
83 len += sizeof(pkt.abort);
84 break;
85
86 case RXRPC_PACKET_TYPE_ACK:
87 mtu = conn->params.peer->if_mtu;
88 mtu -= conn->params.peer->hdrsize;
89 pkt.ack.bufferSpace = 0;
90 pkt.ack.maxSkew = htons(skb->priority);
91 pkt.ack.firstPacket = htonl(chan->last_seq);
92 pkt.ack.previousPacket = htonl(chan->last_seq - 1);
93 pkt.ack.serial = htonl(sp->hdr.serial);
94 pkt.ack.reason = RXRPC_ACK_DUPLICATE;
95 pkt.ack.nAcks = 0;
96 pkt.info.rxMTU = htonl(rxrpc_rx_mtu);
97 pkt.info.maxMTU = htonl(mtu);
98 pkt.info.rwind = htonl(rxrpc_rx_window_size);
99 pkt.info.jumbo_max = htonl(rxrpc_rx_jumbo_max);
100 pkt.whdr.flags |= RXRPC_SLOW_START_OK;
101 len += sizeof(pkt.ack) + sizeof(pkt.info);
102 break;
103 }
104
105 /* Resync with __rxrpc_disconnect_call() and check that the last call
106 * didn't get advanced whilst we were filling out the packets.
107 */
108 smp_rmb();
109 if (READ_ONCE(chan->last_call) != call_id)
110 return;
111
112 iov.iov_base = &pkt;
113 iov.iov_len = len;
114
115 serial = atomic_inc_return(&conn->serial);
116 pkt.whdr.serial = htonl(serial);
117
118 switch (chan->last_type) {
119 case RXRPC_PACKET_TYPE_ABORT:
120 _proto("Tx ABORT %%%u { %d } [re]", serial, conn->abort_code);
121 break;
122 case RXRPC_PACKET_TYPE_ACK:
123 trace_rxrpc_tx_ack(NULL, serial, chan->last_seq, 0,
124 RXRPC_ACK_DUPLICATE, 0);
125 _proto("Tx ACK %%%u [re]", serial);
126 break;
127 }
128
129 kernel_sendmsg(conn->params.local->socket, &msg, &iov, 1, len);
130 _leave("");
131 return;
132 }
133
134 /*
135 * pass a connection-level abort onto all calls on that connection
136 */
rxrpc_abort_calls(struct rxrpc_connection * conn,enum rxrpc_call_completion compl)137 static void rxrpc_abort_calls(struct rxrpc_connection *conn,
138 enum rxrpc_call_completion compl)
139 {
140 struct rxrpc_call *call;
141 int i;
142
143 _enter("{%d},%x", conn->debug_id, conn->abort_code);
144
145 spin_lock(&conn->channel_lock);
146
147 for (i = 0; i < RXRPC_MAXCALLS; i++) {
148 call = rcu_dereference_protected(
149 conn->channels[i].call,
150 lockdep_is_held(&conn->channel_lock));
151 if (call) {
152 if (compl == RXRPC_CALL_LOCALLY_ABORTED)
153 trace_rxrpc_abort("CON", call->cid,
154 call->call_id, 0,
155 conn->abort_code,
156 conn->error);
157 if (rxrpc_set_call_completion(call, compl,
158 conn->abort_code,
159 conn->error))
160 rxrpc_notify_socket(call);
161 }
162 }
163
164 spin_unlock(&conn->channel_lock);
165 _leave("");
166 }
167
168 /*
169 * generate a connection-level abort
170 */
rxrpc_abort_connection(struct rxrpc_connection * conn,int error,u32 abort_code)171 static int rxrpc_abort_connection(struct rxrpc_connection *conn,
172 int error, u32 abort_code)
173 {
174 struct rxrpc_wire_header whdr;
175 struct msghdr msg;
176 struct kvec iov[2];
177 __be32 word;
178 size_t len;
179 u32 serial;
180 int ret;
181
182 _enter("%d,,%u,%u", conn->debug_id, error, abort_code);
183
184 /* generate a connection-level abort */
185 spin_lock_bh(&conn->state_lock);
186 if (conn->state >= RXRPC_CONN_REMOTELY_ABORTED) {
187 spin_unlock_bh(&conn->state_lock);
188 _leave(" = 0 [already dead]");
189 return 0;
190 }
191
192 conn->error = error;
193 conn->abort_code = abort_code;
194 conn->state = RXRPC_CONN_LOCALLY_ABORTED;
195 spin_unlock_bh(&conn->state_lock);
196
197 rxrpc_abort_calls(conn, RXRPC_CALL_LOCALLY_ABORTED);
198
199 msg.msg_name = &conn->params.peer->srx.transport;
200 msg.msg_namelen = conn->params.peer->srx.transport_len;
201 msg.msg_control = NULL;
202 msg.msg_controllen = 0;
203 msg.msg_flags = 0;
204
205 whdr.epoch = htonl(conn->proto.epoch);
206 whdr.cid = htonl(conn->proto.cid);
207 whdr.callNumber = 0;
208 whdr.seq = 0;
209 whdr.type = RXRPC_PACKET_TYPE_ABORT;
210 whdr.flags = conn->out_clientflag;
211 whdr.userStatus = 0;
212 whdr.securityIndex = conn->security_ix;
213 whdr._rsvd = 0;
214 whdr.serviceId = htons(conn->service_id);
215
216 word = htonl(conn->abort_code);
217
218 iov[0].iov_base = &whdr;
219 iov[0].iov_len = sizeof(whdr);
220 iov[1].iov_base = &word;
221 iov[1].iov_len = sizeof(word);
222
223 len = iov[0].iov_len + iov[1].iov_len;
224
225 serial = atomic_inc_return(&conn->serial);
226 whdr.serial = htonl(serial);
227 _proto("Tx CONN ABORT %%%u { %d }", serial, conn->abort_code);
228
229 ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len);
230 if (ret < 0) {
231 _debug("sendmsg failed: %d", ret);
232 return -EAGAIN;
233 }
234
235 _leave(" = 0");
236 return 0;
237 }
238
239 /*
240 * mark a call as being on a now-secured channel
241 * - must be called with BH's disabled.
242 */
rxrpc_call_is_secure(struct rxrpc_call * call)243 static void rxrpc_call_is_secure(struct rxrpc_call *call)
244 {
245 _enter("%p", call);
246 if (call) {
247 write_lock_bh(&call->state_lock);
248 if (call->state == RXRPC_CALL_SERVER_SECURING) {
249 call->state = RXRPC_CALL_SERVER_ACCEPTING;
250 rxrpc_notify_socket(call);
251 }
252 write_unlock_bh(&call->state_lock);
253 }
254 }
255
256 /*
257 * connection-level Rx packet processor
258 */
rxrpc_process_event(struct rxrpc_connection * conn,struct sk_buff * skb,u32 * _abort_code)259 static int rxrpc_process_event(struct rxrpc_connection *conn,
260 struct sk_buff *skb,
261 u32 *_abort_code)
262 {
263 struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
264 __be32 wtmp;
265 u32 abort_code;
266 int loop, ret;
267
268 if (conn->state >= RXRPC_CONN_REMOTELY_ABORTED) {
269 _leave(" = -ECONNABORTED [%u]", conn->state);
270 return -ECONNABORTED;
271 }
272
273 _enter("{%d},{%u,%%%u},", conn->debug_id, sp->hdr.type, sp->hdr.serial);
274
275 switch (sp->hdr.type) {
276 case RXRPC_PACKET_TYPE_DATA:
277 case RXRPC_PACKET_TYPE_ACK:
278 rxrpc_conn_retransmit_call(conn, skb);
279 return 0;
280
281 case RXRPC_PACKET_TYPE_BUSY:
282 /* Just ignore BUSY packets for now. */
283 return 0;
284
285 case RXRPC_PACKET_TYPE_ABORT:
286 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
287 &wtmp, sizeof(wtmp)) < 0) {
288 trace_rxrpc_rx_eproto(NULL, sp->hdr.serial,
289 tracepoint_string("bad_abort"));
290 return -EPROTO;
291 }
292 abort_code = ntohl(wtmp);
293 _proto("Rx ABORT %%%u { ac=%d }", sp->hdr.serial, abort_code);
294
295 conn->error = -ECONNABORTED;
296 conn->abort_code = abort_code;
297 conn->state = RXRPC_CONN_REMOTELY_ABORTED;
298 rxrpc_abort_calls(conn, RXRPC_CALL_REMOTELY_ABORTED);
299 return -ECONNABORTED;
300
301 case RXRPC_PACKET_TYPE_CHALLENGE:
302 return conn->security->respond_to_challenge(conn, skb,
303 _abort_code);
304
305 case RXRPC_PACKET_TYPE_RESPONSE:
306 ret = conn->security->verify_response(conn, skb, _abort_code);
307 if (ret < 0)
308 return ret;
309
310 ret = conn->security->init_connection_security(conn);
311 if (ret < 0)
312 return ret;
313
314 ret = conn->security->prime_packet_security(conn);
315 if (ret < 0)
316 return ret;
317
318 spin_lock(&conn->channel_lock);
319 spin_lock(&conn->state_lock);
320
321 if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) {
322 conn->state = RXRPC_CONN_SERVICE;
323 spin_unlock(&conn->state_lock);
324 for (loop = 0; loop < RXRPC_MAXCALLS; loop++)
325 rxrpc_call_is_secure(
326 rcu_dereference_protected(
327 conn->channels[loop].call,
328 lockdep_is_held(&conn->channel_lock)));
329 } else {
330 spin_unlock(&conn->state_lock);
331 }
332
333 spin_unlock(&conn->channel_lock);
334 return 0;
335
336 default:
337 trace_rxrpc_rx_eproto(NULL, sp->hdr.serial,
338 tracepoint_string("bad_conn_pkt"));
339 return -EPROTO;
340 }
341 }
342
343 /*
344 * set up security and issue a challenge
345 */
rxrpc_secure_connection(struct rxrpc_connection * conn)346 static void rxrpc_secure_connection(struct rxrpc_connection *conn)
347 {
348 u32 abort_code;
349 int ret;
350
351 _enter("{%d}", conn->debug_id);
352
353 ASSERT(conn->security_ix != 0);
354
355 if (!conn->params.key) {
356 _debug("set up security");
357 ret = rxrpc_init_server_conn_security(conn);
358 switch (ret) {
359 case 0:
360 break;
361 case -ENOENT:
362 abort_code = RX_CALL_DEAD;
363 goto abort;
364 default:
365 abort_code = RXKADNOAUTH;
366 goto abort;
367 }
368 }
369
370 if (conn->security->issue_challenge(conn) < 0) {
371 abort_code = RX_CALL_DEAD;
372 ret = -ENOMEM;
373 goto abort;
374 }
375
376 _leave("");
377 return;
378
379 abort:
380 _debug("abort %d, %d", ret, abort_code);
381 rxrpc_abort_connection(conn, ret, abort_code);
382 _leave(" [aborted]");
383 }
384
385 /*
386 * connection-level event processor
387 */
rxrpc_process_connection(struct work_struct * work)388 void rxrpc_process_connection(struct work_struct *work)
389 {
390 struct rxrpc_connection *conn =
391 container_of(work, struct rxrpc_connection, processor);
392 struct sk_buff *skb;
393 u32 abort_code = RX_PROTOCOL_ERROR;
394 int ret;
395
396 rxrpc_see_connection(conn);
397
398 if (test_and_clear_bit(RXRPC_CONN_EV_CHALLENGE, &conn->events))
399 rxrpc_secure_connection(conn);
400
401 /* go through the conn-level event packets, releasing the ref on this
402 * connection that each one has when we've finished with it */
403 while ((skb = skb_dequeue(&conn->rx_queue))) {
404 rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
405 ret = rxrpc_process_event(conn, skb, &abort_code);
406 switch (ret) {
407 case -EPROTO:
408 case -EKEYEXPIRED:
409 case -EKEYREJECTED:
410 goto protocol_error;
411 case -ENOMEM:
412 case -EAGAIN:
413 goto requeue_and_leave;
414 case -ECONNABORTED:
415 default:
416 rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
417 break;
418 }
419 }
420
421 out:
422 rxrpc_put_connection(conn);
423 _leave("");
424 return;
425
426 requeue_and_leave:
427 skb_queue_head(&conn->rx_queue, skb);
428 goto out;
429
430 protocol_error:
431 if (rxrpc_abort_connection(conn, ret, abort_code) < 0)
432 goto requeue_and_leave;
433 rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
434 goto out;
435 }
436