1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Handshake request lifetime events 4 * 5 * Author: Chuck Lever <chuck.lever@oracle.com> 6 * 7 * Copyright (c) 2023, Oracle and/or its affiliates. 8 */ 9 10 #include <linux/types.h> 11 #include <linux/socket.h> 12 #include <linux/kernel.h> 13 #include <linux/module.h> 14 #include <linux/skbuff.h> 15 #include <linux/inet.h> 16 #include <linux/fdtable.h> 17 #include <linux/rhashtable.h> 18 19 #include <net/sock.h> 20 #include <net/genetlink.h> 21 #include <net/netns/generic.h> 22 23 #include <kunit/visibility.h> 24 25 #include <uapi/linux/handshake.h> 26 #include "handshake.h" 27 28 #include <trace/events/handshake.h> 29 30 /* 31 * We need both a handshake_req -> sock mapping, and a sock -> 32 * handshake_req mapping. Both are one-to-one. 33 * 34 * To avoid adding another pointer field to struct sock, net/handshake 35 * maintains a hash table, indexed by the memory address of @sock, to 36 * find the struct handshake_req outstanding for that socket. The 37 * reverse direction uses a simple pointer field in the handshake_req 38 * struct. 39 */ 40 41 static struct rhashtable handshake_rhashtbl ____cacheline_aligned_in_smp; 42 43 static const struct rhashtable_params handshake_rhash_params = { 44 .key_len = sizeof_field(struct handshake_req, hr_sk), 45 .key_offset = offsetof(struct handshake_req, hr_sk), 46 .head_offset = offsetof(struct handshake_req, hr_rhash), 47 .automatic_shrinking = true, 48 }; 49 50 int handshake_req_hash_init(void) 51 { 52 return rhashtable_init(&handshake_rhashtbl, &handshake_rhash_params); 53 } 54 55 void handshake_req_hash_destroy(void) 56 { 57 rhashtable_destroy(&handshake_rhashtbl); 58 } 59 60 struct handshake_req *handshake_req_hash_lookup(struct sock *sk) 61 { 62 return rhashtable_lookup_fast(&handshake_rhashtbl, &sk, 63 handshake_rhash_params); 64 } 65 EXPORT_SYMBOL_IF_KUNIT(handshake_req_hash_lookup); 66 67 static bool handshake_req_hash_add(struct handshake_req *req) 68 { 69 int ret; 70 71 ret = rhashtable_lookup_insert_fast(&handshake_rhashtbl, 72 &req->hr_rhash, 73 handshake_rhash_params); 74 return ret == 0; 75 } 76 77 static void handshake_req_destroy(struct handshake_req *req) 78 { 79 if (req->hr_proto->hp_destroy) 80 req->hr_proto->hp_destroy(req); 81 rhashtable_remove_fast(&handshake_rhashtbl, &req->hr_rhash, 82 handshake_rhash_params); 83 kfree(req); 84 } 85 86 static void handshake_sk_destruct(struct sock *sk) 87 { 88 void (*sk_destruct)(struct sock *sk); 89 struct handshake_req *req; 90 91 req = handshake_req_hash_lookup(sk); 92 if (!req) 93 return; 94 95 trace_handshake_destruct(sock_net(sk), req, sk); 96 sk_destruct = req->hr_odestruct; 97 handshake_req_destroy(req); 98 if (sk_destruct) 99 sk_destruct(sk); 100 } 101 102 /** 103 * handshake_req_alloc - Allocate a handshake request 104 * @proto: security protocol 105 * @flags: memory allocation flags 106 * 107 * Returns an initialized handshake_req or NULL. 108 */ 109 struct handshake_req *handshake_req_alloc(const struct handshake_proto *proto, 110 gfp_t flags) 111 { 112 struct handshake_req *req; 113 114 if (!proto) 115 return NULL; 116 if (proto->hp_handler_class <= HANDSHAKE_HANDLER_CLASS_NONE) 117 return NULL; 118 if (proto->hp_handler_class >= HANDSHAKE_HANDLER_CLASS_MAX) 119 return NULL; 120 if (!proto->hp_accept || !proto->hp_done) 121 return NULL; 122 123 req = kzalloc(struct_size(req, hr_priv, proto->hp_privsize), flags); 124 if (!req) 125 return NULL; 126 127 INIT_LIST_HEAD(&req->hr_list); 128 req->hr_proto = proto; 129 return req; 130 } 131 EXPORT_SYMBOL(handshake_req_alloc); 132 133 /** 134 * handshake_req_private - Get per-handshake private data 135 * @req: handshake arguments 136 * 137 */ 138 void *handshake_req_private(struct handshake_req *req) 139 { 140 return (void *)&req->hr_priv; 141 } 142 EXPORT_SYMBOL(handshake_req_private); 143 144 static bool __add_pending_locked(struct handshake_net *hn, 145 struct handshake_req *req) 146 { 147 if (WARN_ON_ONCE(!list_empty(&req->hr_list))) 148 return false; 149 hn->hn_pending++; 150 list_add_tail(&req->hr_list, &hn->hn_requests); 151 return true; 152 } 153 154 static void __remove_pending_locked(struct handshake_net *hn, 155 struct handshake_req *req) 156 { 157 hn->hn_pending--; 158 list_del_init(&req->hr_list); 159 } 160 161 /* 162 * Returns %true if the request was found on @net's pending list, 163 * otherwise %false. 164 * 165 * If @req was on a pending list, it has not yet been accepted. 166 */ 167 static bool remove_pending(struct handshake_net *hn, struct handshake_req *req) 168 { 169 bool ret = false; 170 171 spin_lock(&hn->hn_lock); 172 if (!list_empty(&req->hr_list)) { 173 __remove_pending_locked(hn, req); 174 ret = true; 175 } 176 spin_unlock(&hn->hn_lock); 177 178 return ret; 179 } 180 181 struct handshake_req *handshake_req_next(struct handshake_net *hn, int class) 182 { 183 struct handshake_req *req, *pos; 184 185 req = NULL; 186 spin_lock(&hn->hn_lock); 187 list_for_each_entry(pos, &hn->hn_requests, hr_list) { 188 if (pos->hr_proto->hp_handler_class != class) 189 continue; 190 __remove_pending_locked(hn, pos); 191 req = pos; 192 break; 193 } 194 spin_unlock(&hn->hn_lock); 195 196 return req; 197 } 198 EXPORT_SYMBOL_IF_KUNIT(handshake_req_next); 199 200 /** 201 * handshake_req_submit - Submit a handshake request 202 * @sock: open socket on which to perform the handshake 203 * @req: handshake arguments 204 * @flags: memory allocation flags 205 * 206 * Return values: 207 * %0: Request queued 208 * %-EINVAL: Invalid argument 209 * %-EBUSY: A handshake is already under way for this socket 210 * %-ESRCH: No handshake agent is available 211 * %-EAGAIN: Too many pending handshake requests 212 * %-ENOMEM: Failed to allocate memory 213 * %-EMSGSIZE: Failed to construct notification message 214 * %-EOPNOTSUPP: Handshake module not initialized 215 * 216 * A zero return value from handshake_req_submit() means that 217 * exactly one subsequent completion callback is guaranteed. 218 * 219 * A negative return value from handshake_req_submit() means that 220 * no completion callback will be done and that @req has been 221 * destroyed. 222 */ 223 int handshake_req_submit(struct socket *sock, struct handshake_req *req, 224 gfp_t flags) 225 { 226 struct handshake_net *hn; 227 struct net *net; 228 int ret; 229 230 if (!sock || !req || !sock->file) { 231 kfree(req); 232 return -EINVAL; 233 } 234 235 req->hr_sk = sock->sk; 236 if (!req->hr_sk) { 237 kfree(req); 238 return -EINVAL; 239 } 240 req->hr_odestruct = req->hr_sk->sk_destruct; 241 req->hr_sk->sk_destruct = handshake_sk_destruct; 242 req->hr_file = sock->file; 243 244 ret = -EOPNOTSUPP; 245 net = sock_net(req->hr_sk); 246 hn = handshake_pernet(net); 247 if (!hn) 248 goto out_err; 249 250 ret = -EAGAIN; 251 if (READ_ONCE(hn->hn_pending) >= hn->hn_pending_max) 252 goto out_err; 253 254 spin_lock(&hn->hn_lock); 255 ret = -EOPNOTSUPP; 256 if (test_bit(HANDSHAKE_F_NET_DRAINING, &hn->hn_flags)) 257 goto out_unlock; 258 ret = -EBUSY; 259 if (!handshake_req_hash_add(req)) 260 goto out_unlock; 261 if (!__add_pending_locked(hn, req)) 262 goto out_unlock; 263 spin_unlock(&hn->hn_lock); 264 265 ret = handshake_genl_notify(net, req->hr_proto, flags); 266 if (ret) { 267 trace_handshake_notify_err(net, req, req->hr_sk, ret); 268 if (remove_pending(hn, req)) 269 goto out_err; 270 } 271 272 /* Prevent socket release while a handshake request is pending */ 273 sock_hold(req->hr_sk); 274 275 trace_handshake_submit(net, req, req->hr_sk); 276 return 0; 277 278 out_unlock: 279 spin_unlock(&hn->hn_lock); 280 out_err: 281 trace_handshake_submit_err(net, req, req->hr_sk, ret); 282 handshake_req_destroy(req); 283 return ret; 284 } 285 EXPORT_SYMBOL(handshake_req_submit); 286 287 void handshake_complete(struct handshake_req *req, unsigned int status, 288 struct genl_info *info) 289 { 290 struct sock *sk = req->hr_sk; 291 struct net *net = sock_net(sk); 292 293 if (!test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED, &req->hr_flags)) { 294 trace_handshake_complete(net, req, sk, status); 295 req->hr_proto->hp_done(req, status, info); 296 297 /* Handshake request is no longer pending */ 298 sock_put(sk); 299 } 300 } 301 EXPORT_SYMBOL_IF_KUNIT(handshake_complete); 302 303 /** 304 * handshake_req_cancel - Cancel an in-progress handshake 305 * @sk: socket on which there is an ongoing handshake 306 * 307 * Request cancellation races with request completion. To determine 308 * who won, callers examine the return value from this function. 309 * 310 * Return values: 311 * %true - Uncompleted handshake request was canceled 312 * %false - Handshake request already completed or not found 313 */ 314 bool handshake_req_cancel(struct sock *sk) 315 { 316 struct handshake_req *req; 317 struct handshake_net *hn; 318 struct net *net; 319 320 net = sock_net(sk); 321 req = handshake_req_hash_lookup(sk); 322 if (!req) { 323 trace_handshake_cancel_none(net, req, sk); 324 return false; 325 } 326 327 hn = handshake_pernet(net); 328 if (hn && remove_pending(hn, req)) { 329 /* Request hadn't been accepted */ 330 goto out_true; 331 } 332 if (test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED, &req->hr_flags)) { 333 /* Request already completed */ 334 trace_handshake_cancel_busy(net, req, sk); 335 return false; 336 } 337 338 /* Request accepted and waiting for DONE */ 339 fput(req->hr_file); 340 341 out_true: 342 trace_handshake_cancel(net, req, sk); 343 344 /* Handshake request is no longer pending */ 345 sock_put(sk); 346 return true; 347 } 348 EXPORT_SYMBOL(handshake_req_cancel); 349