1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Handshake request lifetime events
4 *
5 * Author: Chuck Lever <chuck.lever@oracle.com>
6 *
7 * Copyright (c) 2023, Oracle and/or its affiliates.
8 */
9
10#include <linux/types.h>
11#include <linux/socket.h>
12#include <linux/kernel.h>
13#include <linux/module.h>
14#include <linux/skbuff.h>
15#include <linux/inet.h>
16#include <linux/rhashtable.h>
17
18#include <net/sock.h>
19#include <net/genetlink.h>
20#include <net/netns/generic.h>
21
22#include <kunit/visibility.h>
23
24#include <uapi/linux/handshake.h>
25#include "handshake.h"
26
27#include <trace/events/handshake.h>
28
29/*
30 * We need both a handshake_req -> sock mapping, and a sock ->
31 * handshake_req mapping. Both are one-to-one.
32 *
33 * To avoid adding another pointer field to struct sock, net/handshake
34 * maintains a hash table, indexed by the memory address of @sock, to
35 * find the struct handshake_req outstanding for that socket. The
36 * reverse direction uses a simple pointer field in the handshake_req
37 * struct.
38 */
39
40static struct rhashtable handshake_rhashtbl ____cacheline_aligned_in_smp;
41
42static const struct rhashtable_params handshake_rhash_params = {
43 .key_len = sizeof_field(struct handshake_req, hr_sk),
44 .key_offset = offsetof(struct handshake_req, hr_sk),
45 .head_offset = offsetof(struct handshake_req, hr_rhash),
46 .automatic_shrinking = true,
47};
48
49int handshake_req_hash_init(void)
50{
51 return rhashtable_init(&handshake_rhashtbl, &handshake_rhash_params);
52}
53
54void handshake_req_hash_destroy(void)
55{
56 rhashtable_destroy(ht: &handshake_rhashtbl);
57}
58
59struct handshake_req *handshake_req_hash_lookup(struct sock *sk)
60{
61 return rhashtable_lookup_fast(ht: &handshake_rhashtbl, key: &sk,
62 params: handshake_rhash_params);
63}
64EXPORT_SYMBOL_IF_KUNIT(handshake_req_hash_lookup);
65
66static bool handshake_req_hash_add(struct handshake_req *req)
67{
68 int ret;
69
70 ret = rhashtable_lookup_insert_fast(ht: &handshake_rhashtbl,
71 obj: &req->hr_rhash,
72 params: handshake_rhash_params);
73 return ret == 0;
74}
75
76static void handshake_req_destroy(struct handshake_req *req)
77{
78 if (req->hr_proto->hp_destroy)
79 req->hr_proto->hp_destroy(req);
80 rhashtable_remove_fast(ht: &handshake_rhashtbl, obj: &req->hr_rhash,
81 params: handshake_rhash_params);
82 kfree(objp: req);
83}
84
85static void handshake_sk_destruct(struct sock *sk)
86{
87 void (*sk_destruct)(struct sock *sk);
88 struct handshake_req *req;
89
90 req = handshake_req_hash_lookup(sk);
91 if (!req)
92 return;
93
94 trace_handshake_destruct(net: sock_net(sk), req, sk);
95 sk_destruct = req->hr_odestruct;
96 handshake_req_destroy(req);
97 if (sk_destruct)
98 sk_destruct(sk);
99}
100
101/**
102 * handshake_req_alloc - Allocate a handshake request
103 * @proto: security protocol
104 * @flags: memory allocation flags
105 *
106 * Returns an initialized handshake_req or NULL.
107 */
108struct handshake_req *handshake_req_alloc(const struct handshake_proto *proto,
109 gfp_t flags)
110{
111 struct handshake_req *req;
112
113 if (!proto)
114 return NULL;
115 if (proto->hp_handler_class <= HANDSHAKE_HANDLER_CLASS_NONE)
116 return NULL;
117 if (proto->hp_handler_class >= HANDSHAKE_HANDLER_CLASS_MAX)
118 return NULL;
119 if (!proto->hp_accept || !proto->hp_done)
120 return NULL;
121
122 req = kzalloc(struct_size(req, hr_priv, proto->hp_privsize), flags);
123 if (!req)
124 return NULL;
125
126 INIT_LIST_HEAD(list: &req->hr_list);
127 req->hr_proto = proto;
128 return req;
129}
130EXPORT_SYMBOL(handshake_req_alloc);
131
132/**
133 * handshake_req_private - Get per-handshake private data
134 * @req: handshake arguments
135 *
136 */
137void *handshake_req_private(struct handshake_req *req)
138{
139 return (void *)&req->hr_priv;
140}
141EXPORT_SYMBOL(handshake_req_private);
142
143static bool __add_pending_locked(struct handshake_net *hn,
144 struct handshake_req *req)
145{
146 if (WARN_ON_ONCE(!list_empty(&req->hr_list)))
147 return false;
148 hn->hn_pending++;
149 list_add_tail(new: &req->hr_list, head: &hn->hn_requests);
150 return true;
151}
152
153static void __remove_pending_locked(struct handshake_net *hn,
154 struct handshake_req *req)
155{
156 hn->hn_pending--;
157 list_del_init(entry: &req->hr_list);
158}
159
160/*
161 * Returns %true if the request was found on @net's pending list,
162 * otherwise %false.
163 *
164 * If @req was on a pending list, it has not yet been accepted.
165 */
166static bool remove_pending(struct handshake_net *hn, struct handshake_req *req)
167{
168 bool ret = false;
169
170 spin_lock(lock: &hn->hn_lock);
171 if (!list_empty(head: &req->hr_list)) {
172 __remove_pending_locked(hn, req);
173 ret = true;
174 }
175 spin_unlock(lock: &hn->hn_lock);
176
177 return ret;
178}
179
180struct handshake_req *handshake_req_next(struct handshake_net *hn, int class)
181{
182 struct handshake_req *req, *pos;
183
184 req = NULL;
185 spin_lock(lock: &hn->hn_lock);
186 list_for_each_entry(pos, &hn->hn_requests, hr_list) {
187 if (pos->hr_proto->hp_handler_class != class)
188 continue;
189 __remove_pending_locked(hn, req: pos);
190 req = pos;
191 break;
192 }
193 spin_unlock(lock: &hn->hn_lock);
194
195 return req;
196}
197EXPORT_SYMBOL_IF_KUNIT(handshake_req_next);
198
199/**
200 * handshake_req_submit - Submit a handshake request
201 * @sock: open socket on which to perform the handshake
202 * @req: handshake arguments
203 * @flags: memory allocation flags
204 *
205 * Return values:
206 * %0: Request queued
207 * %-EINVAL: Invalid argument
208 * %-EBUSY: A handshake is already under way for this socket
209 * %-ESRCH: No handshake agent is available
210 * %-EAGAIN: Too many pending handshake requests
211 * %-ENOMEM: Failed to allocate memory
212 * %-EMSGSIZE: Failed to construct notification message
213 * %-EOPNOTSUPP: Handshake module not initialized
214 *
215 * A zero return value from handshake_req_submit() means that
216 * exactly one subsequent completion callback is guaranteed.
217 *
218 * A negative return value from handshake_req_submit() means that
219 * no completion callback will be done and that @req has been
220 * destroyed.
221 */
222int handshake_req_submit(struct socket *sock, struct handshake_req *req,
223 gfp_t flags)
224{
225 struct handshake_net *hn;
226 struct net *net;
227 int ret;
228
229 if (!sock || !req || !sock->file) {
230 kfree(objp: req);
231 return -EINVAL;
232 }
233
234 req->hr_sk = sock->sk;
235 if (!req->hr_sk) {
236 kfree(objp: req);
237 return -EINVAL;
238 }
239 req->hr_odestruct = req->hr_sk->sk_destruct;
240 req->hr_sk->sk_destruct = handshake_sk_destruct;
241
242 ret = -EOPNOTSUPP;
243 net = sock_net(sk: req->hr_sk);
244 hn = handshake_pernet(net);
245 if (!hn)
246 goto out_err;
247
248 ret = -EAGAIN;
249 if (READ_ONCE(hn->hn_pending) >= hn->hn_pending_max)
250 goto out_err;
251
252 spin_lock(lock: &hn->hn_lock);
253 ret = -EOPNOTSUPP;
254 if (test_bit(HANDSHAKE_F_NET_DRAINING, &hn->hn_flags))
255 goto out_unlock;
256 ret = -EBUSY;
257 if (!handshake_req_hash_add(req))
258 goto out_unlock;
259 if (!__add_pending_locked(hn, req))
260 goto out_unlock;
261 spin_unlock(lock: &hn->hn_lock);
262
263 ret = handshake_genl_notify(net, proto: req->hr_proto, flags);
264 if (ret) {
265 trace_handshake_notify_err(net, req, sk: req->hr_sk, err: ret);
266 if (remove_pending(hn, req))
267 goto out_err;
268 }
269
270 /* Prevent socket release while a handshake request is pending */
271 sock_hold(sk: req->hr_sk);
272
273 trace_handshake_submit(net, req, sk: req->hr_sk);
274 return 0;
275
276out_unlock:
277 spin_unlock(lock: &hn->hn_lock);
278out_err:
279 /* Restore original destructor so socket teardown still runs on failure */
280 req->hr_sk->sk_destruct = req->hr_odestruct;
281 trace_handshake_submit_err(net, req, sk: req->hr_sk, err: ret);
282 handshake_req_destroy(req);
283 return ret;
284}
285EXPORT_SYMBOL(handshake_req_submit);
286
287void handshake_complete(struct handshake_req *req, unsigned int status,
288 struct genl_info *info)
289{
290 struct sock *sk = req->hr_sk;
291 struct net *net = sock_net(sk);
292
293 if (!test_and_set_bit(nr: HANDSHAKE_F_REQ_COMPLETED, addr: &req->hr_flags)) {
294 trace_handshake_complete(net, req, sk, status);
295 req->hr_proto->hp_done(req, status, info);
296
297 /* Handshake request is no longer pending */
298 sock_put(sk);
299 }
300}
301EXPORT_SYMBOL_IF_KUNIT(handshake_complete);
302
303/**
304 * handshake_req_cancel - Cancel an in-progress handshake
305 * @sk: socket on which there is an ongoing handshake
306 *
307 * Request cancellation races with request completion. To determine
308 * who won, callers examine the return value from this function.
309 *
310 * Return values:
311 * %true - Uncompleted handshake request was canceled
312 * %false - Handshake request already completed or not found
313 */
314bool handshake_req_cancel(struct sock *sk)
315{
316 struct handshake_req *req;
317 struct handshake_net *hn;
318 struct net *net;
319
320 net = sock_net(sk);
321 req = handshake_req_hash_lookup(sk);
322 if (!req) {
323 trace_handshake_cancel_none(net, req, sk);
324 return false;
325 }
326
327 hn = handshake_pernet(net);
328 if (hn && remove_pending(hn, req)) {
329 /* Request hadn't been accepted - mark cancelled */
330 if (test_and_set_bit(nr: HANDSHAKE_F_REQ_COMPLETED, addr: &req->hr_flags)) {
331 trace_handshake_cancel_busy(net, req, sk);
332 return false;
333 }
334 goto out_true;
335 }
336 if (test_and_set_bit(nr: HANDSHAKE_F_REQ_COMPLETED, addr: &req->hr_flags)) {
337 /* Request already completed */
338 trace_handshake_cancel_busy(net, req, sk);
339 return false;
340 }
341
342out_true:
343 trace_handshake_cancel(net, req, sk);
344
345 /* Handshake request is no longer pending */
346 sock_put(sk);
347 return true;
348}
349EXPORT_SYMBOL(handshake_req_cancel);
350

source code of linux/net/handshake/request.c