Commit 0f1ce023 authored by Jason Baron's avatar Jason Baron Committed by David S. Miller

tcp: add support to TCP_FASTOPEN_KEY for optional backup key

Add support for get/set of an optional backup key via TCP_FASTOPEN_KEY, in
addition to the current 'primary' key. The primary key is used to encrypt
and decrypt TFO cookies, while the backup is only used to decrypt TFO
cookies. The backup key is used to maximize successful TFO connections when
TFO keys are rotated.

Currently, TCP_FASTOPEN_KEY allows a single 16-byte primary key to be set.
This patch now allows a 32-byte value to be set, where the first 16 bytes
are used as the primary key and the second 16 bytes are used for the backup
key. Similarly, for getsockopt(), we can receive a 32-byte value as output
if requested. If a 16-byte value is used to set the primary key via
TCP_FASTOPEN_KEY, then any previously set backup key will be removed.
Signed-off-by: default avatarJason Baron <jbaron@akamai.com>
Signed-off-by: default avatarChristoph Paasch <cpaasch@apple.com>
Acked-by: default avatarYuchung Cheng <ycheng@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9092a76d
...@@ -2790,16 +2790,24 @@ static int do_tcp_setsockopt(struct sock *sk, int level, ...@@ -2790,16 +2790,24 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
return err; return err;
} }
case TCP_FASTOPEN_KEY: { case TCP_FASTOPEN_KEY: {
__u8 key[TCP_FASTOPEN_KEY_LENGTH]; __u8 key[TCP_FASTOPEN_KEY_BUF_LENGTH];
__u8 *backup_key = NULL;
if (optlen != sizeof(key)) /* Allow a backup key as well to facilitate key rotation
* First key is the active one.
*/
if (optlen != TCP_FASTOPEN_KEY_LENGTH &&
optlen != TCP_FASTOPEN_KEY_BUF_LENGTH)
return -EINVAL; return -EINVAL;
if (copy_from_user(key, optval, optlen)) if (copy_from_user(key, optval, optlen))
return -EFAULT; return -EFAULT;
return tcp_fastopen_reset_cipher(net, sk, key, NULL, if (optlen == TCP_FASTOPEN_KEY_BUF_LENGTH)
sizeof(key)); backup_key = key + TCP_FASTOPEN_KEY_LENGTH;
return tcp_fastopen_reset_cipher(net, sk, key, backup_key,
TCP_FASTOPEN_KEY_LENGTH);
} }
default: default:
/* fallthru */ /* fallthru */
...@@ -3453,21 +3461,23 @@ static int do_tcp_getsockopt(struct sock *sk, int level, ...@@ -3453,21 +3461,23 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
return 0; return 0;
case TCP_FASTOPEN_KEY: { case TCP_FASTOPEN_KEY: {
__u8 key[TCP_FASTOPEN_KEY_LENGTH]; __u8 key[TCP_FASTOPEN_KEY_BUF_LENGTH];
struct tcp_fastopen_context *ctx; struct tcp_fastopen_context *ctx;
unsigned int key_len = 0;
if (get_user(len, optlen)) if (get_user(len, optlen))
return -EFAULT; return -EFAULT;
rcu_read_lock(); rcu_read_lock();
ctx = rcu_dereference(icsk->icsk_accept_queue.fastopenq.ctx); ctx = rcu_dereference(icsk->icsk_accept_queue.fastopenq.ctx);
if (ctx) if (ctx) {
memcpy(key, ctx->key, sizeof(key)); key_len = tcp_fastopen_context_len(ctx) *
else TCP_FASTOPEN_KEY_LENGTH;
len = 0; memcpy(&key[0], &ctx->key[0], key_len);
}
rcu_read_unlock(); rcu_read_unlock();
len = min_t(unsigned int, len, sizeof(key)); len = min_t(unsigned int, len, key_len);
if (put_user(len, optlen)) if (put_user(len, optlen))
return -EFAULT; return -EFAULT;
if (copy_to_user(optval, key, len)) if (copy_to_user(optval, key, len))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment