Add 3 setsockopt()s: 1. TCP_AO_ADD_KEY to add a new Master Key Tuple (MKT) on a socket 2. TCP_AO_DEL_KEY to delete present MKT from a socket 3. TCP_AO_INFO to change flags, Current_key/RNext_key on a TCP-AO sk Userspace has to introduce keys on every socket it wants to use TCP-AO option on, similarly to TCP_MD5SIG/TCP_MD5SIG_EXT. RFC5925 prohibits definition of MKTs that would match the same peer, so do sanity checks on the data provided by userspace. Be as conservative as possible, including refusal of defining MKT on an established connection with no AO, removing the key in-use and etc. (1) and (2) are to be used by userspace key manager to add/remove keys. (3) main purpose is to set RNext_key, which (as prescribed by RFC5925) is the KeyID that will be requested in TCP-AO header from the peer to sign their segments with. At this moment the life of ao_info ends in tcp_v4_destroy_sock().
Showing the changes to include/uapi (1 of 11 files). Show all
Unified · Split
| @@ -129,6 +129,9 @@ enum { · 128 unmodified lines | |||
| 129 | 129 | ||
| 130 | #define TCP_TX_DELAY 37 /* delay outgoing packets by XX usec */ | 130 | #define TCP_TX_DELAY 37 /* delay outgoing packets by XX usec */ |
| 131 | 131 | ||
| 132 | #define TCP_AO_ADD_KEY 38 /* Add/Set MKT */ | ||
| 133 | #define TCP_AO_DEL_KEY 39 /* Delete MKT */ | ||
| 134 | #define TCP_AO_INFO 40 /* Modify TCP-AO per-socket options */ | ||
| 132 | 135 | ||
| 133 | #define TCP_REPAIR_ON 1 | 136 | #define TCP_REPAIR_ON 1 |
| 134 | #define TCP_REPAIR_OFF 0 | 137 | #define TCP_REPAIR_OFF 0 |
| @@ -363,6 +366,49 @@ struct tcp_diag_md5sig { · 228 unmodified lines | |||
| 363 | 366 | ||
| 364 | #define TCP_AO_MAXKEYLEN 80 | 367 | #define TCP_AO_MAXKEYLEN 80 |
| 365 | 368 | ||
| 369 | #define TCP_AO_KEYF_IFINDEX (1 << 0) /* L3 ifindex for VRF */ | ||
| 370 | |||
| 371 | struct tcp_ao_add { /* setsockopt(TCP_AO_ADD_KEY) */ | ||
| 372 | struct __kernel_sockaddr_storage addr; /* peer's address for the key */ | ||
| 373 | char alg_name[64]; /* crypto hash algorithm to use */ | ||
| 374 | __s32 ifindex; /* L3 dev index for VRF */ | ||
| 375 | __u32 set_current :1, /* set key as Current_key at once */ | ||
| 376 | set_rnext :1, /* request it from peer with RNext_key */ | ||
| 377 | reserved :30; /* must be 0 */ | ||
| 378 | __u16 reserved2; /* padding, must be 0 */ | ||
| 379 | __u8 prefix; /* peer's address prefix */ | ||
| 380 | __u8 sndid; /* SendID for outgoing segments */ | ||
| 381 | __u8 rcvid; /* RecvID to match for incoming seg */ | ||
| 382 | __u8 maclen; /* length of authentication code (hash) */ | ||
| 383 | __u8 keyflags; /* see TCP_AO_KEYF_ */ | ||
| 384 | __u8 keylen; /* length of ::key */ | ||
| 385 | __u8 key[TCP_AO_MAXKEYLEN]; | ||
| 386 | } __attribute__((aligned(8))); | ||
| 387 | |||
| 388 | struct tcp_ao_del { /* setsockopt(TCP_AO_DEL_KEY) */ | ||
| 389 | struct __kernel_sockaddr_storage addr; /* peer's address for the key */ | ||
| 390 | __s32 ifindex; /* L3 dev index for VRF */ | ||
| 391 | __u32 set_current :1, /* corresponding ::current_key */ | ||
| 392 | set_rnext :1, /* corresponding ::rnext */ | ||
| 393 | reserved :30; /* must be 0 */ | ||
| 394 | __u16 reserved2; /* padding, must be 0 */ | ||
| 395 | __u8 prefix; /* peer's address prefix */ | ||
| 396 | __u8 sndid; /* SendID for outgoing segments */ | ||
| 397 | __u8 rcvid; /* RecvID to match for incoming seg */ | ||
| 398 | __u8 current_key; /* KeyID to set as Current_key */ | ||
| 399 | __u8 rnext; /* KeyID to set as Rnext_key */ | ||
| 400 | __u8 keyflags; /* see TCP_AO_KEYF_ */ | ||
| 401 | } __attribute__((aligned(8))); | ||
| 402 | |||
| 403 | struct tcp_ao_info_opt { /* setsockopt(TCP_AO_INFO) */ | ||
| 404 | __u32 set_current :1, /* corresponding ::current_key */ | ||
| 405 | set_rnext :1, /* corresponding ::rnext */ | ||
| 406 | ao_required :1, /* don't accept non-AO connects */ | ||
| 407 | reserved :29; /* must be 0 */ | ||
| 408 | __u8 current_key; /* KeyID to set as Current_key */ | ||
| 409 | __u8 rnext; /* KeyID to set as Rnext_key */ | ||
| 410 | } __attribute__((aligned(8))); | ||
| 411 | |||
| 366 | /* setsockopt(fd, IPPROTO_TCP, TCP_ZEROCOPY_RECEIVE, ...) */ | 412 | /* setsockopt(fd, IPPROTO_TCP, TCP_ZEROCOPY_RECEIVE, ...) */ |
| 367 | 413 | ||
| 368 | #define TCP_RECEIVE_ZEROCOPY_FLAG_TLB_CLEAN_HINT 0x1 | 414 | #define TCP_RECEIVE_ZEROCOPY_FLAG_TLB_CLEAN_HINT 0x1 |