net/tcp: Add static_key for TCP-AO

Similarly to TCP-MD5, add a static key to TCP-AO that is patched out
when there are no keys on a machine and dynamically enabled with the
first setsockopt(TCP_AO) adds a key on any socket. The static key is as
well dynamically disabled later when the socket is destructed.

The lifetime of enabled static key here is the same as ao_info: it is
enabled on allocation, passed over from full socket to twsk and
destructed when ao_info is scheduled for destruction.

Signed-off-by: Dmitry Safonov <dima@arista.com>
Acked-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 54226d85feb8e0ee2672e4a7988e96402a9760bf..e3617c433cf158ddcbdc922cf06a77f3c6413a04 100644 (file)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -2288,14 +2288,18 @@ static inline void tcp_get_current_key(const struct sock *sk,
 #if defined(CONFIG_TCP_AO) || defined(CONFIG_TCP_MD5SIG)
        const struct tcp_sock *tp = tcp_sk(sk);
 #endif
-#ifdef CONFIG_TCP_AO
-       struct tcp_ao_info *ao;
 
-       ao = rcu_dereference_protected(tp->ao_info, lockdep_sock_is_held(sk));
-       if (ao) {
-               out->ao_key = READ_ONCE(ao->current_key);
-               out->type = TCP_KEY_AO;
-               return;
+#ifdef CONFIG_TCP_AO
+       if (static_branch_unlikely(&tcp_ao_needed.key)) {
+               struct tcp_ao_info *ao;
+
+               ao = rcu_dereference_protected(tp->ao_info,
+                                              lockdep_sock_is_held(sk));
+               if (ao) {
+                       out->ao_key = READ_ONCE(ao->current_key);
+                       out->type = TCP_KEY_AO;
+                       return;
+               }
        }
 #endif
 #ifdef CONFIG_TCP_MD5SIG
@@ -2324,7 +2328,8 @@ static inline bool tcp_key_is_md5(const struct tcp_key *key)
 static inline bool tcp_key_is_ao(const struct tcp_key *key)
 {
 #ifdef CONFIG_TCP_AO
-       if (key->type == TCP_KEY_AO)
+       if (static_branch_unlikely(&tcp_ao_needed.key) &&
+           key->type == TCP_KEY_AO)
                return true;
 #endif
        return false;
@@ -2718,6 +2723,9 @@ static inline bool tcp_ao_required(struct sock *sk, const void *saddr,
        struct tcp_ao_info *ao_info;
        struct tcp_ao_key *ao_key;
 
+       if (!static_branch_unlikely(&tcp_ao_needed.key))
+               return false;
+
        ao_info = rcu_dereference_check(tcp_sk(sk)->ao_info,
                                        lockdep_sock_is_held(sk));
        if (!ao_info)

diff --git a/include/net/tcp_ao.h b/include/net/tcp_ao.h
index 061c358a3c8ae72e72183c90d71c084c38bfac3a..a38408072ea89234d5820649ebf5ad0a148d3585 100644 (file)
--- a/include/net/tcp_ao.h
+++ b/include/net/tcp_ao.h
@@ -151,6 +151,8 @@ do {                                                                        \
 
 #ifdef CONFIG_TCP_AO
 /* TCP-AO structures and functions */
+#include <linux/jump_label.h>
+extern struct static_key_false_deferred tcp_ao_needed;
 
 struct tcp4_ao_context {
        __be32          saddr;

diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c
index acbeb635fe297d3b6dabe92b77a1f5acf94e15e1..ffce8ca60ff211aa801163abd9d63133a297a472 100644 (file)
--- a/net/ipv4/tcp_ao.c
+++ b/net/ipv4/tcp_ao.c
@@ -17,6 +17,8 @@
 #include <net/ipv6.h>
 #include <net/icmp.h>
 
+DEFINE_STATIC_KEY_DEFERRED_FALSE(tcp_ao_needed, HZ);
+
 int tcp_ao_calc_traffic_key(struct tcp_ao_key *mkt, u8 *key, void *ctx,
                            unsigned int len, struct tcp_sigpool *hp)
 {
@@ -50,6 +52,9 @@ bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code)
        bool ignore_icmp = false;
        struct tcp_ao_info *ao;
 
+       if (!static_branch_unlikely(&tcp_ao_needed.key))
+               return false;
+
        /* RFC5925, 7.8:
         * >> A TCP-AO implementation MUST default to ignore incoming ICMPv4
         * messages of Type 3 (destination unreachable), Codes 2-4 (protocol
@@ -185,6 +190,9 @@ static struct tcp_ao_key *__tcp_ao_do_lookup(const struct sock *sk,
        struct tcp_ao_key *key;
        struct tcp_ao_info *ao;
 
+       if (!static_branch_unlikely(&tcp_ao_needed.key))
+               return NULL;
+
        ao = rcu_dereference_check(tcp_sk(sk)->ao_info,
                                   lockdep_sock_is_held(sk));
        if (!ao)
@@ -276,6 +284,7 @@ void tcp_ao_destroy_sock(struct sock *sk, bool twsk)
        }
 
        kfree_rcu(ao, rcu);
+       static_branch_slow_dec_deferred(&tcp_ao_needed);
 }
 
 void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp)
@@ -1180,6 +1189,11 @@ int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk,
                goto free_and_exit;
        }
 
+       if (!static_key_fast_inc_not_disabled(&tcp_ao_needed.key.key)) {
+               ret = -EUSERS;
+               goto free_and_exit;
+       }
+
        key_head = rcu_dereference(hlist_first_rcu(&new_ao->head));
        first_key = hlist_entry_safe(key_head, struct tcp_ao_key, node);
 
@@ -1607,6 +1621,10 @@ static int tcp_ao_add_cmd(struct sock *sk, unsigned short int family,
 
        tcp_ao_link_mkt(ao_info, key);
        if (first) {
+               if (!static_branch_inc(&tcp_ao_needed.key)) {
+                       ret = -EUSERS;
+                       goto err_free_sock;
+               }
                sk_gso_disable(sk);
                rcu_assign_pointer(tcp_sk(sk)->ao_info, ao_info);
        }
@@ -1875,6 +1893,10 @@ static int tcp_ao_info_cmd(struct sock *sk, unsigned short int family,
        if (new_rnext)
                WRITE_ONCE(ao_info->rnext_key, new_rnext);
        if (first) {
+               if (!static_branch_inc(&tcp_ao_needed.key)) {
+                       err = -EUSERS;
+                       goto out;
+               }
                sk_gso_disable(sk);
                rcu_assign_pointer(tcp_sk(sk)->ao_info, ao_info);
        }

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 67ca72185f141c36fd37c99d616cc5faeefba5d8..50aaa1527150bd8adabce125775aab8b97018d53 100644 (file)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3572,41 +3572,55 @@ static inline bool tcp_may_update_window(const struct tcp_sock *tp,
                (ack_seq == tp->snd_wl1 && (nwin > tp->snd_wnd || !nwin));
 }
 
-/* If we update tp->snd_una, also update tp->bytes_acked */
-static void tcp_snd_una_update(struct tcp_sock *tp, u32 ack)
+static void tcp_snd_sne_update(struct tcp_sock *tp, u32 ack)
 {
-       u32 delta = ack - tp->snd_una;
 #ifdef CONFIG_TCP_AO
        struct tcp_ao_info *ao;
-#endif
 
-       sock_owned_by_me((struct sock *)tp);
-       tp->bytes_acked += delta;
-#ifdef CONFIG_TCP_AO
+       if (!static_branch_unlikely(&tcp_ao_needed.key))
+               return;
+
        ao = rcu_dereference_protected(tp->ao_info,
                                       lockdep_sock_is_held((struct sock *)tp));
        if (ao && ack < tp->snd_una)
                ao->snd_sne++;
 #endif
+}
+
+/* If we update tp->snd_una, also update tp->bytes_acked */
+static void tcp_snd_una_update(struct tcp_sock *tp, u32 ack)
+{
+       u32 delta = ack - tp->snd_una;
+
+       sock_owned_by_me((struct sock *)tp);
+       tp->bytes_acked += delta;
+       tcp_snd_sne_update(tp, ack);
        tp->snd_una = ack;
 }
 
-/* If we update tp->rcv_nxt, also update tp->bytes_received */
-static void tcp_rcv_nxt_update(struct tcp_sock *tp, u32 seq)
+static void tcp_rcv_sne_update(struct tcp_sock *tp, u32 seq)
 {
-       u32 delta = seq - tp->rcv_nxt;
 #ifdef CONFIG_TCP_AO
        struct tcp_ao_info *ao;
-#endif
 
-       sock_owned_by_me((struct sock *)tp);
-       tp->bytes_received += delta;
-#ifdef CONFIG_TCP_AO
+       if (!static_branch_unlikely(&tcp_ao_needed.key))
+               return;
+
        ao = rcu_dereference_protected(tp->ao_info,
                                       lockdep_sock_is_held((struct sock *)tp));
        if (ao && seq < tp->rcv_nxt)
                ao->rcv_sne++;
 #endif
+}
+
+/* If we update tp->rcv_nxt, also update tp->bytes_received */
+static void tcp_rcv_nxt_update(struct tcp_sock *tp, u32 seq)
+{
+       u32 delta = seq - tp->rcv_nxt;
+
+       sock_owned_by_me((struct sock *)tp);
+       tp->bytes_received += delta;
+       tcp_rcv_sne_update(tp, seq);
        WRITE_ONCE(tp->rcv_nxt, seq);
 }
 

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 8f98c58e26891b3dd923e716435470f0bc2f36ae..18c5595e3814f3f76ba804b487ef82453ce54312 100644 (file)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1024,18 +1024,20 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
 #ifdef CONFIG_TCP_AO
        struct tcp_ao_info *ao_info;
 
-       /* FIXME: the segment to-be-acked is not verified yet */
-       ao_info = rcu_dereference(tcptw->ao_info);
-       if (ao_info) {
-               const struct tcp_ao_hdr *aoh;
+       if (static_branch_unlikely(&tcp_ao_needed.key)) {
+               /* FIXME: the segment to-be-acked is not verified yet */
+               ao_info = rcu_dereference(tcptw->ao_info);
+               if (ao_info) {
+                       const struct tcp_ao_hdr *aoh;
+
+                       if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh)) {
+                               inet_twsk_put(tw);
+                               return;
+                       }
 
-               if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh)) {
-                       inet_twsk_put(tw);
-                       return;
+                       if (aoh)
+                               key.ao_key = tcp_ao_established_key(ao_info, aoh->rnext_keyid, -1);
                }
-
-               if (aoh)
-                       key.ao_key = tcp_ao_established_key(ao_info, aoh->rnext_keyid, -1);
        }
        if (key.ao_key) {
                struct tcp_ao_key *rnext_key;
@@ -1081,7 +1083,8 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
                                             tcp_sk(sk)->snd_nxt;
 
 #ifdef CONFIG_TCP_AO
-       if (tcp_rsk_used_ao(req)) {
+       if (static_branch_unlikely(&tcp_ao_needed.key) &&
+           tcp_rsk_used_ao(req)) {
                const union tcp_md5_addr *addr;
                const struct tcp_ao_hdr *aoh;
 

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index fa7050579e9afa125096eca89dc75c64a00cb788..b5936294dba223484f22df4dcab2496aad3b6686 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1154,17 +1154,19 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 #ifdef CONFIG_TCP_AO
        struct tcp_ao_info *ao_info;
 
-       /* FIXME: the segment to-be-acked is not verified yet */
-       ao_info = rcu_dereference(tcptw->ao_info);
-       if (ao_info) {
-               const struct tcp_ao_hdr *aoh;
+       if (static_branch_unlikely(&tcp_ao_needed.key)) {
 
-               /* Invalid TCP option size or twice included auth */
-               if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh))
-                       goto out;
-               if (aoh) {
-                       key.ao_key = tcp_ao_established_key(ao_info,
-                                                           aoh->rnext_keyid, -1);
+               /* FIXME: the segment to-be-acked is not verified yet */
+               ao_info = rcu_dereference(tcptw->ao_info);
+               if (ao_info) {
+                       const struct tcp_ao_hdr *aoh;
+
+                       /* Invalid TCP option size or twice included auth */
+                       if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh))
+                               goto out;
+                       if (aoh)
+                               key.ao_key = tcp_ao_established_key(ao_info,
+                                               aoh->rnext_keyid, -1);
                }
        }
        if (key.ao_key) {
@@ -1206,7 +1208,8 @@ static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
        struct tcp_key key = {};
 
 #ifdef CONFIG_TCP_AO
-       if (tcp_rsk_used_ao(req)) {
+       if (static_branch_unlikely(&tcp_ao_needed.key) &&
+           tcp_rsk_used_ao(req)) {
                const struct in6_addr *addr = &ipv6_hdr(skb)->saddr;
                const struct tcp_ao_hdr *aoh;
                int l3index;