Skip to content

Commit 1fba70e

Browse files
yuchungchengdavem330
yuchungcheng
authored and
davem330
committed
tcp: socket option to set TCP fast open key
New socket option TCP_FASTOPEN_KEY to allow different keys per listener. The listener by default uses the global key until the socket option is set. The key is a 16 bytes long binary data. This option has no effect on regular non-listener TCP sockets. Signed-off-by: Yuchung Cheng <ycheng@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Christoph Paasch <cpaasch@apple.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent ce12f7d commit 1fba70e

File tree

7 files changed

+82
-19
lines changed

7 files changed

+82
-19
lines changed

‎include/net/request_sock.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,8 @@ struct fastopen_queue {
150150
spinlock_t lock;
151151
int qlen; /* # of pending (TCP_SYN_RECV) reqs */
152152
int max_qlen; /* != 0 iff TFO is currently enabled */
153+
154+
struct tcp_fastopen_context __rcu *ctx; /* cipher context for cookie */
153155
};
154156

155157
/** struct request_sock_queue - queue of request_socks

‎include/net/tcp.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1555,9 +1555,10 @@ struct tcp_fastopen_request {
15551555
int copied; /* queued in tcp_connect() */
15561556
};
15571557
void tcp_free_fastopen_req(struct tcp_sock *tp);
1558-
1558+
void tcp_fastopen_destroy_cipher(struct sock *sk);
15591559
void tcp_fastopen_ctx_destroy(struct net *net);
1560-
int tcp_fastopen_reset_cipher(struct net *net, void *key, unsigned int len);
1560+
int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk,
1561+
void *key, unsigned int len);
15611562
void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb);
15621563
struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
15631564
struct request_sock *req,

‎include/uapi/linux/tcp.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ enum {
119119
#define TCP_FASTOPEN_CONNECT 30 /* Attempt FastOpen with connect */
120120
#define TCP_ULP 31 /* Attach a ULP to a TCP connection */
121121
#define TCP_MD5SIG_EXT 32 /* TCP MD5 Signature with extensions */
122+
#define TCP_FASTOPEN_KEY 33 /* Set the key for Fast Open (cookie) */
122123

123124
struct tcp_repair_opt {
124125
__u32 opt_code;

‎net/ipv4/sysctl_net_ipv4.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,8 @@ static int proc_tcp_fastopen_key(struct ctl_table *table, int write,
284284
ret = -EINVAL;
285285
goto bad_key;
286286
}
287-
tcp_fastopen_reset_cipher(net, user_key, TCP_FASTOPEN_KEY_LENGTH);
287+
tcp_fastopen_reset_cipher(net, NULL, user_key,
288+
TCP_FASTOPEN_KEY_LENGTH);
288289
}
289290

290291
bad_key:

‎net/ipv4/tcp.c

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2571,6 +2571,17 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
25712571
release_sock(sk);
25722572
return err;
25732573
}
2574+
case TCP_FASTOPEN_KEY: {
2575+
__u8 key[TCP_FASTOPEN_KEY_LENGTH];
2576+
2577+
if (optlen != sizeof(key))
2578+
return -EINVAL;
2579+
2580+
if (copy_from_user(key, optval, optlen))
2581+
return -EFAULT;
2582+
2583+
return tcp_fastopen_reset_cipher(net, sk, key, sizeof(key));
2584+
}
25742585
default:
25752586
/* fallthru */
25762587
break;
@@ -3157,6 +3168,28 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
31573168
return -EFAULT;
31583169
return 0;
31593170

3171+
case TCP_FASTOPEN_KEY: {
3172+
__u8 key[TCP_FASTOPEN_KEY_LENGTH];
3173+
struct tcp_fastopen_context *ctx;
3174+
3175+
if (get_user(len, optlen))
3176+
return -EFAULT;
3177+
3178+
rcu_read_lock();
3179+
ctx = rcu_dereference(icsk->icsk_accept_queue.fastopenq.ctx);
3180+
if (ctx)
3181+
memcpy(key, ctx->key, sizeof(key));
3182+
else
3183+
len = 0;
3184+
rcu_read_unlock();
3185+
3186+
len = min_t(unsigned int, len, sizeof(key));
3187+
if (put_user(len, optlen))
3188+
return -EFAULT;
3189+
if (copy_to_user(optval, key, len))
3190+
return -EFAULT;
3191+
return 0;
3192+
}
31603193
case TCP_THIN_LINEAR_TIMEOUTS:
31613194
val = tp->thin_lto;
31623195
break;

‎net/ipv4/tcp_fastopen.c

Lines changed: 40 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ void tcp_fastopen_init_key_once(struct net *net)
2929
* for a valid cookie, so this is an acceptable risk.
3030
*/
3131
get_random_bytes(key, sizeof(key));
32-
tcp_fastopen_reset_cipher(net, key, sizeof(key));
32+
tcp_fastopen_reset_cipher(net, NULL, key, sizeof(key));
3333
}
3434

3535
static void tcp_fastopen_ctx_free(struct rcu_head *head)
@@ -40,6 +40,16 @@ static void tcp_fastopen_ctx_free(struct rcu_head *head)
4040
kfree(ctx);
4141
}
4242

43+
void tcp_fastopen_destroy_cipher(struct sock *sk)
44+
{
45+
struct tcp_fastopen_context *ctx;
46+
47+
ctx = rcu_dereference_protected(
48+
inet_csk(sk)->icsk_accept_queue.fastopenq.ctx, 1);
49+
if (ctx)
50+
call_rcu(&ctx->rcu, tcp_fastopen_ctx_free);
51+
}
52+
4353
void tcp_fastopen_ctx_destroy(struct net *net)
4454
{
4555
struct tcp_fastopen_context *ctxt;
@@ -55,10 +65,12 @@ void tcp_fastopen_ctx_destroy(struct net *net)
5565
call_rcu(&ctxt->rcu, tcp_fastopen_ctx_free);
5666
}
5767

58-
int tcp_fastopen_reset_cipher(struct net *net, void *key, unsigned int len)
68+
int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk,
69+
void *key, unsigned int len)
5970
{
60-
int err;
6171
struct tcp_fastopen_context *ctx, *octx;
72+
struct fastopen_queue *q;
73+
int err;
6274

6375
ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
6476
if (!ctx)
@@ -79,27 +91,39 @@ error: kfree(ctx);
7991
}
8092
memcpy(ctx->key, key, len);
8193

82-
spin_lock(&net->ipv4.tcp_fastopen_ctx_lock);
8394

84-
octx = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx,
85-
lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock));
86-
rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, ctx);
87-
spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock);
95+
if (sk) {
96+
q = &inet_csk(sk)->icsk_accept_queue.fastopenq;
97+
spin_lock_bh(&q->lock);
98+
octx = rcu_dereference_protected(q->ctx,
99+
lockdep_is_held(&q->lock));
100+
rcu_assign_pointer(q->ctx, ctx);
101+
spin_unlock_bh(&q->lock);
102+
} else {
103+
spin_lock(&net->ipv4.tcp_fastopen_ctx_lock);
104+
octx = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx,
105+
lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock));
106+
rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, ctx);
107+
spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock);
108+
}
88109

89110
if (octx)
90111
call_rcu(&octx->rcu, tcp_fastopen_ctx_free);
91112
return err;
92113
}
93114

94-
static bool __tcp_fastopen_cookie_gen(struct net *net,
95-
const void *path,
115+
static bool __tcp_fastopen_cookie_gen(struct sock *sk, const void *path,
96116
struct tcp_fastopen_cookie *foc)
97117
{
98118
struct tcp_fastopen_context *ctx;
99119
bool ok = false;
100120

101121
rcu_read_lock();
102-
ctx = rcu_dereference(net->ipv4.tcp_fastopen_ctx);
122+
123+
ctx = rcu_dereference(inet_csk(sk)->icsk_accept_queue.fastopenq.ctx);
124+
if (!ctx)
125+
ctx = rcu_dereference(sock_net(sk)->ipv4.tcp_fastopen_ctx);
126+
103127
if (ctx) {
104128
crypto_cipher_encrypt_one(ctx->tfm, foc->val, path);
105129
foc->len = TCP_FASTOPEN_COOKIE_SIZE;
@@ -115,7 +139,7 @@ static bool __tcp_fastopen_cookie_gen(struct net *net,
115139
*
116140
* XXX (TFO) - refactor when TCP_FASTOPEN_COOKIE_SIZE != AES_BLOCK_SIZE.
117141
*/
118-
static bool tcp_fastopen_cookie_gen(struct net *net,
142+
static bool tcp_fastopen_cookie_gen(struct sock *sk,
119143
struct request_sock *req,
120144
struct sk_buff *syn,
121145
struct tcp_fastopen_cookie *foc)
@@ -124,21 +148,21 @@ static bool tcp_fastopen_cookie_gen(struct net *net,
124148
const struct iphdr *iph = ip_hdr(syn);
125149

126150
__be32 path[4] = { iph->saddr, iph->daddr, 0, 0 };
127-
return __tcp_fastopen_cookie_gen(net, path, foc);
151+
return __tcp_fastopen_cookie_gen(sk, path, foc);
128152
}
129153

130154
#if IS_ENABLED(CONFIG_IPV6)
131155
if (req->rsk_ops->family == AF_INET6) {
132156
const struct ipv6hdr *ip6h = ipv6_hdr(syn);
133157
struct tcp_fastopen_cookie tmp;
134158

135-
if (__tcp_fastopen_cookie_gen(net, &ip6h->saddr, &tmp)) {
159+
if (__tcp_fastopen_cookie_gen(sk, &ip6h->saddr, &tmp)) {
136160
struct in6_addr *buf = &tmp.addr;
137161
int i;
138162

139163
for (i = 0; i < 4; i++)
140164
buf->s6_addr32[i] ^= ip6h->daddr.s6_addr32[i];
141-
return __tcp_fastopen_cookie_gen(net, buf, foc);
165+
return __tcp_fastopen_cookie_gen(sk, buf, foc);
142166
}
143167
}
144168
#endif
@@ -313,7 +337,7 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
313337
goto fastopen;
314338

315339
if (foc->len >= 0 && /* Client presents or requests a cookie */
316-
tcp_fastopen_cookie_gen(sock_net(sk), req, skb, &valid_foc) &&
340+
tcp_fastopen_cookie_gen(sk, req, skb, &valid_foc) &&
317341
foc->len == TCP_FASTOPEN_COOKIE_SIZE &&
318342
foc->len == valid_foc.len &&
319343
!memcmp(foc->val, valid_foc.val, foc->len)) {

‎net/ipv4/tcp_ipv4.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1893,6 +1893,7 @@ void tcp_v4_destroy_sock(struct sock *sk)
18931893

18941894
/* If socket is aborted during connect operation */
18951895
tcp_free_fastopen_req(tp);
1896+
tcp_fastopen_destroy_cipher(sk);
18961897
tcp_saved_syn_free(tp);
18971898

18981899
sk_sockets_allocated_dec(sk);

0 commit comments

Comments
 (0)