1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* connection-level event handling 3 * 4 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved. 5 * Written by David Howells (dhowells@redhat.com) 6 */ 7 8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 9 10 #include <linux/module.h> 11 #include <linux/net.h> 12 #include <linux/skbuff.h> 13 #include <linux/errqueue.h> 14 #include <net/sock.h> 15 #include <net/af_rxrpc.h> 16 #include <net/ip.h> 17 #include "ar-internal.h" 18 19 /* 20 * Retransmit terminal ACK or ABORT of the previous call. 21 */ 22 static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn, 23 struct sk_buff *skb, 24 unsigned int channel) 25 { 26 struct rxrpc_skb_priv *sp = skb ? rxrpc_skb(skb) : NULL; 27 struct rxrpc_channel *chan; 28 struct msghdr msg; 29 struct kvec iov[3]; 30 struct { 31 struct rxrpc_wire_header whdr; 32 union { 33 __be32 abort_code; 34 struct rxrpc_ackpacket ack; 35 }; 36 } __attribute__((packed)) pkt; 37 struct rxrpc_ackinfo ack_info; 38 size_t len; 39 int ret, ioc; 40 u32 serial, mtu, call_id, padding; 41 42 _enter("%d", conn->debug_id); 43 44 chan = &conn->channels[channel]; 45 46 /* If the last call got moved on whilst we were waiting to run, just 47 * ignore this packet. 48 */ 49 call_id = READ_ONCE(chan->last_call); 50 /* Sync with __rxrpc_disconnect_call() */ 51 smp_rmb(); 52 if (skb && call_id != sp->hdr.callNumber) 53 return; 54 55 msg.msg_name = &conn->peer->srx.transport; 56 msg.msg_namelen = conn->peer->srx.transport_len; 57 msg.msg_control = NULL; 58 msg.msg_controllen = 0; 59 msg.msg_flags = 0; 60 61 iov[0].iov_base = &pkt; 62 iov[0].iov_len = sizeof(pkt.whdr); 63 iov[1].iov_base = &padding; 64 iov[1].iov_len = 3; 65 iov[2].iov_base = &ack_info; 66 iov[2].iov_len = sizeof(ack_info); 67 68 pkt.whdr.epoch = htonl(conn->proto.epoch); 69 pkt.whdr.cid = htonl(conn->proto.cid | channel); 70 pkt.whdr.callNumber = htonl(call_id); 71 pkt.whdr.seq = 0; 72 pkt.whdr.type = chan->last_type; 73 pkt.whdr.flags = conn->out_clientflag; 74 pkt.whdr.userStatus = 0; 75 pkt.whdr.securityIndex = conn->security_ix; 76 pkt.whdr._rsvd = 0; 77 pkt.whdr.serviceId = htons(conn->service_id); 78 79 len = sizeof(pkt.whdr); 80 switch (chan->last_type) { 81 case RXRPC_PACKET_TYPE_ABORT: 82 pkt.abort_code = htonl(chan->last_abort); 83 iov[0].iov_len += sizeof(pkt.abort_code); 84 len += sizeof(pkt.abort_code); 85 ioc = 1; 86 break; 87 88 case RXRPC_PACKET_TYPE_ACK: 89 mtu = conn->peer->if_mtu; 90 mtu -= conn->peer->hdrsize; 91 pkt.ack.bufferSpace = 0; 92 pkt.ack.maxSkew = htons(skb ? skb->priority : 0); 93 pkt.ack.firstPacket = htonl(chan->last_seq + 1); 94 pkt.ack.previousPacket = htonl(chan->last_seq); 95 pkt.ack.serial = htonl(skb ? sp->hdr.serial : 0); 96 pkt.ack.reason = skb ? RXRPC_ACK_DUPLICATE : RXRPC_ACK_IDLE; 97 pkt.ack.nAcks = 0; 98 ack_info.rxMTU = htonl(rxrpc_rx_mtu); 99 ack_info.maxMTU = htonl(mtu); 100 ack_info.rwind = htonl(rxrpc_rx_window_size); 101 ack_info.jumbo_max = htonl(rxrpc_rx_jumbo_max); 102 pkt.whdr.flags |= RXRPC_SLOW_START_OK; 103 padding = 0; 104 iov[0].iov_len += sizeof(pkt.ack); 105 len += sizeof(pkt.ack) + 3 + sizeof(ack_info); 106 ioc = 3; 107 break; 108 109 default: 110 return; 111 } 112 113 /* Resync with __rxrpc_disconnect_call() and check that the last call 114 * didn't get advanced whilst we were filling out the packets. 115 */ 116 smp_rmb(); 117 if (READ_ONCE(chan->last_call) != call_id) 118 return; 119 120 serial = atomic_inc_return(&conn->serial); 121 pkt.whdr.serial = htonl(serial); 122 123 switch (chan->last_type) { 124 case RXRPC_PACKET_TYPE_ABORT: 125 break; 126 case RXRPC_PACKET_TYPE_ACK: 127 trace_rxrpc_tx_ack(chan->call_debug_id, serial, 128 ntohl(pkt.ack.firstPacket), 129 ntohl(pkt.ack.serial), 130 pkt.ack.reason, 0); 131 break; 132 } 133 134 ret = kernel_sendmsg(conn->local->socket, &msg, iov, ioc, len); 135 conn->peer->last_tx_at = ktime_get_seconds(); 136 if (ret < 0) 137 trace_rxrpc_tx_fail(chan->call_debug_id, serial, ret, 138 rxrpc_tx_point_call_final_resend); 139 else 140 trace_rxrpc_tx_packet(chan->call_debug_id, &pkt.whdr, 141 rxrpc_tx_point_call_final_resend); 142 143 _leave(""); 144 } 145 146 /* 147 * pass a connection-level abort onto all calls on that connection 148 */ 149 static void rxrpc_abort_calls(struct rxrpc_connection *conn, 150 enum rxrpc_call_completion compl, 151 rxrpc_serial_t serial) 152 { 153 struct rxrpc_call *call; 154 int i; 155 156 _enter("{%d},%x", conn->debug_id, conn->abort_code); 157 158 spin_lock(&conn->bundle->channel_lock); 159 160 for (i = 0; i < RXRPC_MAXCALLS; i++) { 161 call = rcu_dereference_protected( 162 conn->channels[i].call, 163 lockdep_is_held(&conn->bundle->channel_lock)); 164 if (call) { 165 if (compl == RXRPC_CALL_LOCALLY_ABORTED) 166 trace_rxrpc_abort(call->debug_id, 167 "CON", call->cid, 168 call->call_id, 0, 169 conn->abort_code, 170 conn->error); 171 else 172 trace_rxrpc_rx_abort(call, serial, 173 conn->abort_code); 174 rxrpc_set_call_completion(call, compl, 175 conn->abort_code, 176 conn->error); 177 } 178 } 179 180 spin_unlock(&conn->bundle->channel_lock); 181 _leave(""); 182 } 183 184 /* 185 * generate a connection-level abort 186 */ 187 static int rxrpc_abort_connection(struct rxrpc_connection *conn, 188 int error, u32 abort_code) 189 { 190 struct rxrpc_wire_header whdr; 191 struct msghdr msg; 192 struct kvec iov[2]; 193 __be32 word; 194 size_t len; 195 u32 serial; 196 int ret; 197 198 _enter("%d,,%u,%u", conn->debug_id, error, abort_code); 199 200 /* generate a connection-level abort */ 201 spin_lock(&conn->state_lock); 202 if (conn->state >= RXRPC_CONN_REMOTELY_ABORTED) { 203 spin_unlock(&conn->state_lock); 204 _leave(" = 0 [already dead]"); 205 return 0; 206 } 207 208 conn->error = error; 209 conn->abort_code = abort_code; 210 conn->state = RXRPC_CONN_LOCALLY_ABORTED; 211 set_bit(RXRPC_CONN_DONT_REUSE, &conn->flags); 212 spin_unlock(&conn->state_lock); 213 214 msg.msg_name = &conn->peer->srx.transport; 215 msg.msg_namelen = conn->peer->srx.transport_len; 216 msg.msg_control = NULL; 217 msg.msg_controllen = 0; 218 msg.msg_flags = 0; 219 220 whdr.epoch = htonl(conn->proto.epoch); 221 whdr.cid = htonl(conn->proto.cid); 222 whdr.callNumber = 0; 223 whdr.seq = 0; 224 whdr.type = RXRPC_PACKET_TYPE_ABORT; 225 whdr.flags = conn->out_clientflag; 226 whdr.userStatus = 0; 227 whdr.securityIndex = conn->security_ix; 228 whdr._rsvd = 0; 229 whdr.serviceId = htons(conn->service_id); 230 231 word = htonl(conn->abort_code); 232 233 iov[0].iov_base = &whdr; 234 iov[0].iov_len = sizeof(whdr); 235 iov[1].iov_base = &word; 236 iov[1].iov_len = sizeof(word); 237 238 len = iov[0].iov_len + iov[1].iov_len; 239 240 serial = atomic_inc_return(&conn->serial); 241 rxrpc_abort_calls(conn, RXRPC_CALL_LOCALLY_ABORTED, serial); 242 whdr.serial = htonl(serial); 243 244 ret = kernel_sendmsg(conn->local->socket, &msg, iov, 2, len); 245 if (ret < 0) { 246 trace_rxrpc_tx_fail(conn->debug_id, serial, ret, 247 rxrpc_tx_point_conn_abort); 248 _debug("sendmsg failed: %d", ret); 249 return -EAGAIN; 250 } 251 252 trace_rxrpc_tx_packet(conn->debug_id, &whdr, rxrpc_tx_point_conn_abort); 253 254 conn->peer->last_tx_at = ktime_get_seconds(); 255 256 _leave(" = 0"); 257 return 0; 258 } 259 260 /* 261 * mark a call as being on a now-secured channel 262 * - must be called with BH's disabled. 263 */ 264 static void rxrpc_call_is_secure(struct rxrpc_call *call) 265 { 266 _enter("%p", call); 267 if (call) { 268 write_lock(&call->state_lock); 269 if (call->state == RXRPC_CALL_SERVER_SECURING) { 270 call->state = RXRPC_CALL_SERVER_RECV_REQUEST; 271 rxrpc_notify_socket(call); 272 } 273 write_unlock(&call->state_lock); 274 } 275 } 276 277 /* 278 * connection-level Rx packet processor 279 */ 280 static int rxrpc_process_event(struct rxrpc_connection *conn, 281 struct sk_buff *skb, 282 u32 *_abort_code) 283 { 284 struct rxrpc_skb_priv *sp = rxrpc_skb(skb); 285 int loop, ret; 286 287 if (conn->state >= RXRPC_CONN_REMOTELY_ABORTED) { 288 _leave(" = -ECONNABORTED [%u]", conn->state); 289 return -ECONNABORTED; 290 } 291 292 _enter("{%d},{%u,%%%u},", conn->debug_id, sp->hdr.type, sp->hdr.serial); 293 294 switch (sp->hdr.type) { 295 case RXRPC_PACKET_TYPE_DATA: 296 case RXRPC_PACKET_TYPE_ACK: 297 rxrpc_conn_retransmit_call(conn, skb, 298 sp->hdr.cid & RXRPC_CHANNELMASK); 299 return 0; 300 301 case RXRPC_PACKET_TYPE_BUSY: 302 /* Just ignore BUSY packets for now. */ 303 return 0; 304 305 case RXRPC_PACKET_TYPE_ABORT: 306 conn->error = -ECONNABORTED; 307 conn->abort_code = skb->priority; 308 conn->state = RXRPC_CONN_REMOTELY_ABORTED; 309 set_bit(RXRPC_CONN_DONT_REUSE, &conn->flags); 310 rxrpc_abort_calls(conn, RXRPC_CALL_REMOTELY_ABORTED, sp->hdr.serial); 311 return -ECONNABORTED; 312 313 case RXRPC_PACKET_TYPE_CHALLENGE: 314 return conn->security->respond_to_challenge(conn, skb, 315 _abort_code); 316 317 case RXRPC_PACKET_TYPE_RESPONSE: 318 ret = conn->security->verify_response(conn, skb, _abort_code); 319 if (ret < 0) 320 return ret; 321 322 ret = conn->security->init_connection_security( 323 conn, conn->key->payload.data[0]); 324 if (ret < 0) 325 return ret; 326 327 spin_lock(&conn->bundle->channel_lock); 328 spin_lock(&conn->state_lock); 329 330 if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) { 331 conn->state = RXRPC_CONN_SERVICE; 332 spin_unlock(&conn->state_lock); 333 for (loop = 0; loop < RXRPC_MAXCALLS; loop++) 334 rxrpc_call_is_secure( 335 rcu_dereference_protected( 336 conn->channels[loop].call, 337 lockdep_is_held(&conn->bundle->channel_lock))); 338 } else { 339 spin_unlock(&conn->state_lock); 340 } 341 342 spin_unlock(&conn->bundle->channel_lock); 343 return 0; 344 345 default: 346 trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, 347 tracepoint_string("bad_conn_pkt")); 348 return -EPROTO; 349 } 350 } 351 352 /* 353 * set up security and issue a challenge 354 */ 355 static void rxrpc_secure_connection(struct rxrpc_connection *conn) 356 { 357 u32 abort_code; 358 int ret; 359 360 _enter("{%d}", conn->debug_id); 361 362 ASSERT(conn->security_ix != 0); 363 364 if (conn->security->issue_challenge(conn) < 0) { 365 abort_code = RX_CALL_DEAD; 366 ret = -ENOMEM; 367 goto abort; 368 } 369 370 _leave(""); 371 return; 372 373 abort: 374 _debug("abort %d, %d", ret, abort_code); 375 rxrpc_abort_connection(conn, ret, abort_code); 376 _leave(" [aborted]"); 377 } 378 379 /* 380 * Process delayed final ACKs that we haven't subsumed into a subsequent call. 381 */ 382 void rxrpc_process_delayed_final_acks(struct rxrpc_connection *conn, bool force) 383 { 384 unsigned long j = jiffies, next_j; 385 unsigned int channel; 386 bool set; 387 388 again: 389 next_j = j + LONG_MAX; 390 set = false; 391 for (channel = 0; channel < RXRPC_MAXCALLS; channel++) { 392 struct rxrpc_channel *chan = &conn->channels[channel]; 393 unsigned long ack_at; 394 395 if (!test_bit(RXRPC_CONN_FINAL_ACK_0 + channel, &conn->flags)) 396 continue; 397 398 smp_rmb(); /* vs rxrpc_disconnect_client_call */ 399 ack_at = READ_ONCE(chan->final_ack_at); 400 401 if (time_before(j, ack_at) && !force) { 402 if (time_before(ack_at, next_j)) { 403 next_j = ack_at; 404 set = true; 405 } 406 continue; 407 } 408 409 if (test_and_clear_bit(RXRPC_CONN_FINAL_ACK_0 + channel, 410 &conn->flags)) 411 rxrpc_conn_retransmit_call(conn, NULL, channel); 412 } 413 414 j = jiffies; 415 if (time_before_eq(next_j, j)) 416 goto again; 417 if (set) 418 rxrpc_reduce_conn_timer(conn, next_j); 419 } 420 421 /* 422 * connection-level event processor 423 */ 424 static void rxrpc_do_process_connection(struct rxrpc_connection *conn) 425 { 426 struct sk_buff *skb; 427 u32 abort_code = RX_PROTOCOL_ERROR; 428 int ret; 429 430 if (test_and_clear_bit(RXRPC_CONN_EV_CHALLENGE, &conn->events)) 431 rxrpc_secure_connection(conn); 432 433 /* Process delayed ACKs whose time has come. */ 434 if (conn->flags & RXRPC_CONN_FINAL_ACK_MASK) 435 rxrpc_process_delayed_final_acks(conn, false); 436 437 /* go through the conn-level event packets, releasing the ref on this 438 * connection that each one has when we've finished with it */ 439 while ((skb = skb_dequeue(&conn->rx_queue))) { 440 rxrpc_see_skb(skb, rxrpc_skb_see_conn_work); 441 ret = rxrpc_process_event(conn, skb, &abort_code); 442 switch (ret) { 443 case -EPROTO: 444 case -EKEYEXPIRED: 445 case -EKEYREJECTED: 446 goto protocol_error; 447 case -ENOMEM: 448 case -EAGAIN: 449 goto requeue_and_leave; 450 case -ECONNABORTED: 451 default: 452 rxrpc_free_skb(skb, rxrpc_skb_put_conn_work); 453 break; 454 } 455 } 456 457 return; 458 459 requeue_and_leave: 460 skb_queue_head(&conn->rx_queue, skb); 461 return; 462 463 protocol_error: 464 if (rxrpc_abort_connection(conn, ret, abort_code) < 0) 465 goto requeue_and_leave; 466 rxrpc_free_skb(skb, rxrpc_skb_put_conn_work); 467 return; 468 } 469 470 void rxrpc_process_connection(struct work_struct *work) 471 { 472 struct rxrpc_connection *conn = 473 container_of(work, struct rxrpc_connection, processor); 474 475 rxrpc_see_connection(conn, rxrpc_conn_see_work); 476 477 if (__rxrpc_use_local(conn->local, rxrpc_local_use_conn_work)) { 478 rxrpc_do_process_connection(conn); 479 rxrpc_unuse_local(conn->local, rxrpc_local_unuse_conn_work); 480 } 481 } 482 483 /* 484 * post connection-level events to the connection 485 * - this includes challenges, responses, some aborts and call terminal packet 486 * retransmission. 487 */ 488 static void rxrpc_post_packet_to_conn(struct rxrpc_connection *conn, 489 struct sk_buff *skb) 490 { 491 _enter("%p,%p", conn, skb); 492 493 rxrpc_get_skb(skb, rxrpc_skb_get_conn_work); 494 skb_queue_tail(&conn->rx_queue, skb); 495 rxrpc_queue_conn(conn, rxrpc_conn_queue_rx_work); 496 } 497 498 /* 499 * Input a connection-level packet. 500 */ 501 int rxrpc_input_conn_packet(struct rxrpc_connection *conn, struct sk_buff *skb) 502 { 503 struct rxrpc_skb_priv *sp = rxrpc_skb(skb); 504 505 if (conn->state >= RXRPC_CONN_REMOTELY_ABORTED) { 506 _leave(" = -ECONNABORTED [%u]", conn->state); 507 return -ECONNABORTED; 508 } 509 510 _enter("{%d},{%u,%%%u},", conn->debug_id, sp->hdr.type, sp->hdr.serial); 511 512 switch (sp->hdr.type) { 513 case RXRPC_PACKET_TYPE_DATA: 514 case RXRPC_PACKET_TYPE_ACK: 515 rxrpc_conn_retransmit_call(conn, skb, 516 sp->hdr.cid & RXRPC_CHANNELMASK); 517 return 0; 518 519 case RXRPC_PACKET_TYPE_BUSY: 520 /* Just ignore BUSY packets for now. */ 521 return 0; 522 523 case RXRPC_PACKET_TYPE_ABORT: 524 conn->error = -ECONNABORTED; 525 conn->abort_code = skb->priority; 526 conn->state = RXRPC_CONN_REMOTELY_ABORTED; 527 set_bit(RXRPC_CONN_DONT_REUSE, &conn->flags); 528 rxrpc_abort_calls(conn, RXRPC_CALL_REMOTELY_ABORTED, sp->hdr.serial); 529 return -ECONNABORTED; 530 531 case RXRPC_PACKET_TYPE_CHALLENGE: 532 case RXRPC_PACKET_TYPE_RESPONSE: 533 rxrpc_post_packet_to_conn(conn, skb); 534 return 0; 535 536 default: 537 trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, 538 tracepoint_string("bad_conn_pkt")); 539 return -EPROTO; 540 } 541 } 542