1 /* 2 * linux/net/sunrpc/gss_krb5_crypto.c 3 * 4 * Copyright (c) 2000-2008 The Regents of the University of Michigan. 5 * All rights reserved. 6 * 7 * Andy Adamson <andros@umich.edu> 8 * Bruce Fields <bfields@umich.edu> 9 */ 10 11 /* 12 * Copyright (C) 1998 by the FundsXpress, INC. 13 * 14 * All rights reserved. 15 * 16 * Export of this software from the United States of America may require 17 * a specific license from the United States Government. It is the 18 * responsibility of any person or organization contemplating export to 19 * obtain such a license before exporting. 20 * 21 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 22 * distribute this software and its documentation for any purpose and 23 * without fee is hereby granted, provided that the above copyright 24 * notice appear in all copies and that both that copyright notice and 25 * this permission notice appear in supporting documentation, and that 26 * the name of FundsXpress. not be used in advertising or publicity pertaining 27 * to distribution of the software without specific, written prior 28 * permission. FundsXpress makes no representations about the suitability of 29 * this software for any purpose. It is provided "as is" without express 30 * or implied warranty. 31 * 32 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 34 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 35 */ 36 37 #include <crypto/hash.h> 38 #include <crypto/skcipher.h> 39 #include <crypto/utils.h> 40 #include <linux/err.h> 41 #include <linux/types.h> 42 #include <linux/mm.h> 43 #include <linux/scatterlist.h> 44 #include <linux/highmem.h> 45 #include <linux/pagemap.h> 46 #include <linux/random.h> 47 #include <linux/sunrpc/gss_krb5.h> 48 #include <linux/sunrpc/xdr.h> 49 #include <kunit/visibility.h> 50 51 #include "gss_krb5_internal.h" 52 53 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) 54 # define RPCDBG_FACILITY RPCDBG_AUTH 55 #endif 56 57 /** 58 * krb5_make_confounder - Generate a confounder string 59 * @p: memory location into which to write the string 60 * @conflen: string length to write, in octets 61 * 62 * RFCs 1964 and 3961 mention only "a random confounder" without going 63 * into detail about its function or cryptographic requirements. The 64 * assumed purpose is to prevent repeated encryption of a plaintext with 65 * the same key from generating the same ciphertext. It is also used to 66 * pad minimum plaintext length to at least a single cipher block. 67 * 68 * However, in situations like the GSS Kerberos 5 mechanism, where the 69 * encryption IV is always all zeroes, the confounder also effectively 70 * functions like an IV. Thus, not only must it be unique from message 71 * to message, but it must also be difficult to predict. Otherwise an 72 * attacker can correlate the confounder to previous or future values, 73 * making the encryption easier to break. 74 * 75 * Given that the primary consumer of this encryption mechanism is a 76 * network storage protocol, a type of traffic that often carries 77 * predictable payloads (eg, all zeroes when reading unallocated blocks 78 * from a file), our confounder generation has to be cryptographically 79 * strong. 80 */ 81 void krb5_make_confounder(u8 *p, int conflen) 82 { 83 get_random_bytes(p, conflen); 84 } 85 86 /** 87 * krb5_encrypt - simple encryption of an RPCSEC GSS payload 88 * @tfm: initialized cipher transform 89 * @iv: pointer to an IV 90 * @in: plaintext to encrypt 91 * @out: OUT: ciphertext 92 * @length: length of input and output buffers, in bytes 93 * 94 * @iv may be NULL to force the use of an all-zero IV. 95 * The buffer containing the IV must be as large as the 96 * cipher's ivsize. 97 * 98 * Return values: 99 * %0: @in successfully encrypted into @out 100 * negative errno: @in not encrypted 101 */ 102 u32 103 krb5_encrypt( 104 struct crypto_sync_skcipher *tfm, 105 void * iv, 106 void * in, 107 void * out, 108 int length) 109 { 110 u32 ret = -EINVAL; 111 struct scatterlist sg[1]; 112 u8 local_iv[GSS_KRB5_MAX_BLOCKSIZE] = {0}; 113 SYNC_SKCIPHER_REQUEST_ON_STACK(req, tfm); 114 115 if (length % crypto_sync_skcipher_blocksize(tfm) != 0) 116 goto out; 117 118 if (crypto_sync_skcipher_ivsize(tfm) > GSS_KRB5_MAX_BLOCKSIZE) { 119 dprintk("RPC: gss_k5encrypt: tfm iv size too large %d\n", 120 crypto_sync_skcipher_ivsize(tfm)); 121 goto out; 122 } 123 124 if (iv) 125 memcpy(local_iv, iv, crypto_sync_skcipher_ivsize(tfm)); 126 127 memcpy(out, in, length); 128 sg_init_one(sg, out, length); 129 130 skcipher_request_set_sync_tfm(req, tfm); 131 skcipher_request_set_callback(req, 0, NULL, NULL); 132 skcipher_request_set_crypt(req, sg, sg, length, local_iv); 133 134 ret = crypto_skcipher_encrypt(req); 135 skcipher_request_zero(req); 136 out: 137 dprintk("RPC: krb5_encrypt returns %d\n", ret); 138 return ret; 139 } 140 141 /** 142 * krb5_decrypt - simple decryption of an RPCSEC GSS payload 143 * @tfm: initialized cipher transform 144 * @iv: pointer to an IV 145 * @in: ciphertext to decrypt 146 * @out: OUT: plaintext 147 * @length: length of input and output buffers, in bytes 148 * 149 * @iv may be NULL to force the use of an all-zero IV. 150 * The buffer containing the IV must be as large as the 151 * cipher's ivsize. 152 * 153 * Return values: 154 * %0: @in successfully decrypted into @out 155 * negative errno: @in not decrypted 156 */ 157 u32 158 krb5_decrypt( 159 struct crypto_sync_skcipher *tfm, 160 void * iv, 161 void * in, 162 void * out, 163 int length) 164 { 165 u32 ret = -EINVAL; 166 struct scatterlist sg[1]; 167 u8 local_iv[GSS_KRB5_MAX_BLOCKSIZE] = {0}; 168 SYNC_SKCIPHER_REQUEST_ON_STACK(req, tfm); 169 170 if (length % crypto_sync_skcipher_blocksize(tfm) != 0) 171 goto out; 172 173 if (crypto_sync_skcipher_ivsize(tfm) > GSS_KRB5_MAX_BLOCKSIZE) { 174 dprintk("RPC: gss_k5decrypt: tfm iv size too large %d\n", 175 crypto_sync_skcipher_ivsize(tfm)); 176 goto out; 177 } 178 if (iv) 179 memcpy(local_iv, iv, crypto_sync_skcipher_ivsize(tfm)); 180 181 memcpy(out, in, length); 182 sg_init_one(sg, out, length); 183 184 skcipher_request_set_sync_tfm(req, tfm); 185 skcipher_request_set_callback(req, 0, NULL, NULL); 186 skcipher_request_set_crypt(req, sg, sg, length, local_iv); 187 188 ret = crypto_skcipher_decrypt(req); 189 skcipher_request_zero(req); 190 out: 191 dprintk("RPC: gss_k5decrypt returns %d\n",ret); 192 return ret; 193 } 194 195 static int 196 checksummer(struct scatterlist *sg, void *data) 197 { 198 struct ahash_request *req = data; 199 200 ahash_request_set_crypt(req, sg, NULL, sg->length); 201 202 return crypto_ahash_update(req); 203 } 204 205 /* 206 * checksum the plaintext data and hdrlen bytes of the token header 207 * The checksum is performed over the first 8 bytes of the 208 * gss token header and then over the data body 209 */ 210 u32 211 make_checksum(struct krb5_ctx *kctx, char *header, int hdrlen, 212 struct xdr_buf *body, int body_offset, u8 *cksumkey, 213 unsigned int usage, struct xdr_netobj *cksumout) 214 { 215 struct crypto_ahash *tfm; 216 struct ahash_request *req; 217 struct scatterlist sg[1]; 218 int err = -1; 219 u8 *checksumdata; 220 unsigned int checksumlen; 221 222 if (cksumout->len < kctx->gk5e->cksumlength) { 223 dprintk("%s: checksum buffer length, %u, too small for %s\n", 224 __func__, cksumout->len, kctx->gk5e->name); 225 return GSS_S_FAILURE; 226 } 227 228 checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_KERNEL); 229 if (checksumdata == NULL) 230 return GSS_S_FAILURE; 231 232 tfm = crypto_alloc_ahash(kctx->gk5e->cksum_name, 0, CRYPTO_ALG_ASYNC); 233 if (IS_ERR(tfm)) 234 goto out_free_cksum; 235 236 req = ahash_request_alloc(tfm, GFP_KERNEL); 237 if (!req) 238 goto out_free_ahash; 239 240 ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL); 241 242 checksumlen = crypto_ahash_digestsize(tfm); 243 244 if (cksumkey != NULL) { 245 err = crypto_ahash_setkey(tfm, cksumkey, 246 kctx->gk5e->keylength); 247 if (err) 248 goto out; 249 } 250 251 err = crypto_ahash_init(req); 252 if (err) 253 goto out; 254 sg_init_one(sg, header, hdrlen); 255 ahash_request_set_crypt(req, sg, NULL, hdrlen); 256 err = crypto_ahash_update(req); 257 if (err) 258 goto out; 259 err = xdr_process_buf(body, body_offset, body->len - body_offset, 260 checksummer, req); 261 if (err) 262 goto out; 263 ahash_request_set_crypt(req, NULL, checksumdata, 0); 264 err = crypto_ahash_final(req); 265 if (err) 266 goto out; 267 268 switch (kctx->gk5e->ctype) { 269 case CKSUMTYPE_RSA_MD5: 270 err = krb5_encrypt(kctx->seq, NULL, checksumdata, 271 checksumdata, checksumlen); 272 if (err) 273 goto out; 274 memcpy(cksumout->data, 275 checksumdata + checksumlen - kctx->gk5e->cksumlength, 276 kctx->gk5e->cksumlength); 277 break; 278 case CKSUMTYPE_HMAC_SHA1_DES3: 279 memcpy(cksumout->data, checksumdata, kctx->gk5e->cksumlength); 280 break; 281 default: 282 BUG(); 283 break; 284 } 285 cksumout->len = kctx->gk5e->cksumlength; 286 out: 287 ahash_request_free(req); 288 out_free_ahash: 289 crypto_free_ahash(tfm); 290 out_free_cksum: 291 kfree(checksumdata); 292 return err ? GSS_S_FAILURE : 0; 293 } 294 295 /** 296 * gss_krb5_checksum - Compute the MAC for a GSS Wrap or MIC token 297 * @tfm: an initialized hash transform 298 * @header: pointer to a buffer containing the token header, or NULL 299 * @hdrlen: number of octets in @header 300 * @body: xdr_buf containing an RPC message (body.len is the message length) 301 * @body_offset: byte offset into @body to start checksumming 302 * @cksumout: OUT: a buffer to be filled in with the computed HMAC 303 * 304 * Usually expressed as H = HMAC(K, message)[1..h] . 305 * 306 * Caller provides the truncation length of the output token (h) in 307 * cksumout.len. 308 * 309 * Return values: 310 * %GSS_S_COMPLETE: Digest computed, @cksumout filled in 311 * %GSS_S_FAILURE: Call failed 312 */ 313 u32 314 gss_krb5_checksum(struct crypto_ahash *tfm, char *header, int hdrlen, 315 const struct xdr_buf *body, int body_offset, 316 struct xdr_netobj *cksumout) 317 { 318 struct ahash_request *req; 319 int err = -ENOMEM; 320 u8 *checksumdata; 321 322 checksumdata = kmalloc(crypto_ahash_digestsize(tfm), GFP_KERNEL); 323 if (!checksumdata) 324 return GSS_S_FAILURE; 325 326 req = ahash_request_alloc(tfm, GFP_KERNEL); 327 if (!req) 328 goto out_free_cksum; 329 ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL); 330 err = crypto_ahash_init(req); 331 if (err) 332 goto out_free_ahash; 333 334 /* 335 * Per RFC 4121 Section 4.2.4, the checksum is performed over the 336 * data body first, then over the octets in "header". 337 */ 338 err = xdr_process_buf(body, body_offset, body->len - body_offset, 339 checksummer, req); 340 if (err) 341 goto out_free_ahash; 342 if (header) { 343 struct scatterlist sg[1]; 344 345 sg_init_one(sg, header, hdrlen); 346 ahash_request_set_crypt(req, sg, NULL, hdrlen); 347 err = crypto_ahash_update(req); 348 if (err) 349 goto out_free_ahash; 350 } 351 352 ahash_request_set_crypt(req, NULL, checksumdata, 0); 353 err = crypto_ahash_final(req); 354 if (err) 355 goto out_free_ahash; 356 357 memcpy(cksumout->data, checksumdata, 358 min_t(int, cksumout->len, crypto_ahash_digestsize(tfm))); 359 360 out_free_ahash: 361 ahash_request_free(req); 362 out_free_cksum: 363 kfree_sensitive(checksumdata); 364 return err ? GSS_S_FAILURE : GSS_S_COMPLETE; 365 } 366 EXPORT_SYMBOL_IF_KUNIT(gss_krb5_checksum); 367 368 struct encryptor_desc { 369 u8 iv[GSS_KRB5_MAX_BLOCKSIZE]; 370 struct skcipher_request *req; 371 int pos; 372 struct xdr_buf *outbuf; 373 struct page **pages; 374 struct scatterlist infrags[4]; 375 struct scatterlist outfrags[4]; 376 int fragno; 377 int fraglen; 378 }; 379 380 static int 381 encryptor(struct scatterlist *sg, void *data) 382 { 383 struct encryptor_desc *desc = data; 384 struct xdr_buf *outbuf = desc->outbuf; 385 struct crypto_sync_skcipher *tfm = 386 crypto_sync_skcipher_reqtfm(desc->req); 387 struct page *in_page; 388 int thislen = desc->fraglen + sg->length; 389 int fraglen, ret; 390 int page_pos; 391 392 /* Worst case is 4 fragments: head, end of page 1, start 393 * of page 2, tail. Anything more is a bug. */ 394 BUG_ON(desc->fragno > 3); 395 396 page_pos = desc->pos - outbuf->head[0].iov_len; 397 if (page_pos >= 0 && page_pos < outbuf->page_len) { 398 /* pages are not in place: */ 399 int i = (page_pos + outbuf->page_base) >> PAGE_SHIFT; 400 in_page = desc->pages[i]; 401 } else { 402 in_page = sg_page(sg); 403 } 404 sg_set_page(&desc->infrags[desc->fragno], in_page, sg->length, 405 sg->offset); 406 sg_set_page(&desc->outfrags[desc->fragno], sg_page(sg), sg->length, 407 sg->offset); 408 desc->fragno++; 409 desc->fraglen += sg->length; 410 desc->pos += sg->length; 411 412 fraglen = thislen & (crypto_sync_skcipher_blocksize(tfm) - 1); 413 thislen -= fraglen; 414 415 if (thislen == 0) 416 return 0; 417 418 sg_mark_end(&desc->infrags[desc->fragno - 1]); 419 sg_mark_end(&desc->outfrags[desc->fragno - 1]); 420 421 skcipher_request_set_crypt(desc->req, desc->infrags, desc->outfrags, 422 thislen, desc->iv); 423 424 ret = crypto_skcipher_encrypt(desc->req); 425 if (ret) 426 return ret; 427 428 sg_init_table(desc->infrags, 4); 429 sg_init_table(desc->outfrags, 4); 430 431 if (fraglen) { 432 sg_set_page(&desc->outfrags[0], sg_page(sg), fraglen, 433 sg->offset + sg->length - fraglen); 434 desc->infrags[0] = desc->outfrags[0]; 435 sg_assign_page(&desc->infrags[0], in_page); 436 desc->fragno = 1; 437 desc->fraglen = fraglen; 438 } else { 439 desc->fragno = 0; 440 desc->fraglen = 0; 441 } 442 return 0; 443 } 444 445 struct decryptor_desc { 446 u8 iv[GSS_KRB5_MAX_BLOCKSIZE]; 447 struct skcipher_request *req; 448 struct scatterlist frags[4]; 449 int fragno; 450 int fraglen; 451 }; 452 453 static int 454 decryptor(struct scatterlist *sg, void *data) 455 { 456 struct decryptor_desc *desc = data; 457 int thislen = desc->fraglen + sg->length; 458 struct crypto_sync_skcipher *tfm = 459 crypto_sync_skcipher_reqtfm(desc->req); 460 int fraglen, ret; 461 462 /* Worst case is 4 fragments: head, end of page 1, start 463 * of page 2, tail. Anything more is a bug. */ 464 BUG_ON(desc->fragno > 3); 465 sg_set_page(&desc->frags[desc->fragno], sg_page(sg), sg->length, 466 sg->offset); 467 desc->fragno++; 468 desc->fraglen += sg->length; 469 470 fraglen = thislen & (crypto_sync_skcipher_blocksize(tfm) - 1); 471 thislen -= fraglen; 472 473 if (thislen == 0) 474 return 0; 475 476 sg_mark_end(&desc->frags[desc->fragno - 1]); 477 478 skcipher_request_set_crypt(desc->req, desc->frags, desc->frags, 479 thislen, desc->iv); 480 481 ret = crypto_skcipher_decrypt(desc->req); 482 if (ret) 483 return ret; 484 485 sg_init_table(desc->frags, 4); 486 487 if (fraglen) { 488 sg_set_page(&desc->frags[0], sg_page(sg), fraglen, 489 sg->offset + sg->length - fraglen); 490 desc->fragno = 1; 491 desc->fraglen = fraglen; 492 } else { 493 desc->fragno = 0; 494 desc->fraglen = 0; 495 } 496 return 0; 497 } 498 499 /* 500 * This function makes the assumption that it was ultimately called 501 * from gss_wrap(). 502 * 503 * The client auth_gss code moves any existing tail data into a 504 * separate page before calling gss_wrap. 505 * The server svcauth_gss code ensures that both the head and the 506 * tail have slack space of RPC_MAX_AUTH_SIZE before calling gss_wrap. 507 * 508 * Even with that guarantee, this function may be called more than 509 * once in the processing of gss_wrap(). The best we can do is 510 * verify at compile-time (see GSS_KRB5_SLACK_CHECK) that the 511 * largest expected shift will fit within RPC_MAX_AUTH_SIZE. 512 * At run-time we can verify that a single invocation of this 513 * function doesn't attempt to use more the RPC_MAX_AUTH_SIZE. 514 */ 515 516 int 517 xdr_extend_head(struct xdr_buf *buf, unsigned int base, unsigned int shiftlen) 518 { 519 u8 *p; 520 521 if (shiftlen == 0) 522 return 0; 523 524 BUG_ON(shiftlen > RPC_MAX_AUTH_SIZE); 525 526 p = buf->head[0].iov_base + base; 527 528 memmove(p + shiftlen, p, buf->head[0].iov_len - base); 529 530 buf->head[0].iov_len += shiftlen; 531 buf->len += shiftlen; 532 533 return 0; 534 } 535 536 static u32 537 gss_krb5_cts_crypt(struct crypto_sync_skcipher *cipher, struct xdr_buf *buf, 538 u32 offset, u8 *iv, struct page **pages, int encrypt) 539 { 540 u32 ret; 541 struct scatterlist sg[1]; 542 SYNC_SKCIPHER_REQUEST_ON_STACK(req, cipher); 543 u8 *data; 544 struct page **save_pages; 545 u32 len = buf->len - offset; 546 547 if (len > GSS_KRB5_MAX_BLOCKSIZE * 2) { 548 WARN_ON(0); 549 return -ENOMEM; 550 } 551 data = kmalloc(GSS_KRB5_MAX_BLOCKSIZE * 2, GFP_KERNEL); 552 if (!data) 553 return -ENOMEM; 554 555 /* 556 * For encryption, we want to read from the cleartext 557 * page cache pages, and write the encrypted data to 558 * the supplied xdr_buf pages. 559 */ 560 save_pages = buf->pages; 561 if (encrypt) 562 buf->pages = pages; 563 564 ret = read_bytes_from_xdr_buf(buf, offset, data, len); 565 buf->pages = save_pages; 566 if (ret) 567 goto out; 568 569 sg_init_one(sg, data, len); 570 571 skcipher_request_set_sync_tfm(req, cipher); 572 skcipher_request_set_callback(req, 0, NULL, NULL); 573 skcipher_request_set_crypt(req, sg, sg, len, iv); 574 575 if (encrypt) 576 ret = crypto_skcipher_encrypt(req); 577 else 578 ret = crypto_skcipher_decrypt(req); 579 580 skcipher_request_zero(req); 581 582 if (ret) 583 goto out; 584 585 ret = write_bytes_to_xdr_buf(buf, offset, data, len); 586 587 #if IS_ENABLED(CONFIG_KUNIT) 588 /* 589 * CBC-CTS does not define an output IV but RFC 3962 defines it as the 590 * penultimate block of ciphertext, so copy that into the IV buffer 591 * before returning. 592 */ 593 if (encrypt) 594 memcpy(iv, data, crypto_sync_skcipher_ivsize(cipher)); 595 #endif 596 597 out: 598 kfree(data); 599 return ret; 600 } 601 602 /** 603 * krb5_cbc_cts_encrypt - encrypt in CBC mode with CTS 604 * @cts_tfm: CBC cipher with CTS 605 * @cbc_tfm: base CBC cipher 606 * @offset: starting byte offset for plaintext 607 * @buf: OUT: output buffer 608 * @pages: plaintext 609 * @iv: output CBC initialization vector, or NULL 610 * @ivsize: size of @iv, in octets 611 * 612 * To provide confidentiality, encrypt using cipher block chaining 613 * with ciphertext stealing. Message integrity is handled separately. 614 * 615 * Return values: 616 * %0: encryption successful 617 * negative errno: encryption could not be completed 618 */ 619 VISIBLE_IF_KUNIT 620 int krb5_cbc_cts_encrypt(struct crypto_sync_skcipher *cts_tfm, 621 struct crypto_sync_skcipher *cbc_tfm, 622 u32 offset, struct xdr_buf *buf, struct page **pages, 623 u8 *iv, unsigned int ivsize) 624 { 625 u32 blocksize, nbytes, nblocks, cbcbytes; 626 struct encryptor_desc desc; 627 int err; 628 629 blocksize = crypto_sync_skcipher_blocksize(cts_tfm); 630 nbytes = buf->len - offset; 631 nblocks = (nbytes + blocksize - 1) / blocksize; 632 cbcbytes = 0; 633 if (nblocks > 2) 634 cbcbytes = (nblocks - 2) * blocksize; 635 636 memset(desc.iv, 0, sizeof(desc.iv)); 637 638 /* Handle block-sized chunks of plaintext with CBC. */ 639 if (cbcbytes) { 640 SYNC_SKCIPHER_REQUEST_ON_STACK(req, cbc_tfm); 641 642 desc.pos = offset; 643 desc.fragno = 0; 644 desc.fraglen = 0; 645 desc.pages = pages; 646 desc.outbuf = buf; 647 desc.req = req; 648 649 skcipher_request_set_sync_tfm(req, cbc_tfm); 650 skcipher_request_set_callback(req, 0, NULL, NULL); 651 652 sg_init_table(desc.infrags, 4); 653 sg_init_table(desc.outfrags, 4); 654 655 err = xdr_process_buf(buf, offset, cbcbytes, encryptor, &desc); 656 skcipher_request_zero(req); 657 if (err) 658 return err; 659 } 660 661 /* Remaining plaintext is handled with CBC-CTS. */ 662 err = gss_krb5_cts_crypt(cts_tfm, buf, offset + cbcbytes, 663 desc.iv, pages, 1); 664 if (err) 665 return err; 666 667 if (unlikely(iv)) 668 memcpy(iv, desc.iv, ivsize); 669 return 0; 670 } 671 EXPORT_SYMBOL_IF_KUNIT(krb5_cbc_cts_encrypt); 672 673 /** 674 * krb5_cbc_cts_decrypt - decrypt in CBC mode with CTS 675 * @cts_tfm: CBC cipher with CTS 676 * @cbc_tfm: base CBC cipher 677 * @offset: starting byte offset for plaintext 678 * @buf: OUT: output buffer 679 * 680 * Return values: 681 * %0: decryption successful 682 * negative errno: decryption could not be completed 683 */ 684 VISIBLE_IF_KUNIT 685 int krb5_cbc_cts_decrypt(struct crypto_sync_skcipher *cts_tfm, 686 struct crypto_sync_skcipher *cbc_tfm, 687 u32 offset, struct xdr_buf *buf) 688 { 689 u32 blocksize, nblocks, cbcbytes; 690 struct decryptor_desc desc; 691 int err; 692 693 blocksize = crypto_sync_skcipher_blocksize(cts_tfm); 694 nblocks = (buf->len + blocksize - 1) / blocksize; 695 cbcbytes = 0; 696 if (nblocks > 2) 697 cbcbytes = (nblocks - 2) * blocksize; 698 699 memset(desc.iv, 0, sizeof(desc.iv)); 700 701 /* Handle block-sized chunks of plaintext with CBC. */ 702 if (cbcbytes) { 703 SYNC_SKCIPHER_REQUEST_ON_STACK(req, cbc_tfm); 704 705 desc.fragno = 0; 706 desc.fraglen = 0; 707 desc.req = req; 708 709 skcipher_request_set_sync_tfm(req, cbc_tfm); 710 skcipher_request_set_callback(req, 0, NULL, NULL); 711 712 sg_init_table(desc.frags, 4); 713 714 err = xdr_process_buf(buf, 0, cbcbytes, decryptor, &desc); 715 skcipher_request_zero(req); 716 if (err) 717 return err; 718 } 719 720 /* Remaining plaintext is handled with CBC-CTS. */ 721 return gss_krb5_cts_crypt(cts_tfm, buf, cbcbytes, desc.iv, NULL, 0); 722 } 723 EXPORT_SYMBOL_IF_KUNIT(krb5_cbc_cts_decrypt); 724 725 u32 726 gss_krb5_aes_encrypt(struct krb5_ctx *kctx, u32 offset, 727 struct xdr_buf *buf, struct page **pages) 728 { 729 u32 err; 730 struct xdr_netobj hmac; 731 u8 *ecptr; 732 struct crypto_sync_skcipher *cipher, *aux_cipher; 733 struct crypto_ahash *ahash; 734 struct page **save_pages; 735 unsigned int conflen; 736 737 if (kctx->initiate) { 738 cipher = kctx->initiator_enc; 739 aux_cipher = kctx->initiator_enc_aux; 740 ahash = kctx->initiator_integ; 741 } else { 742 cipher = kctx->acceptor_enc; 743 aux_cipher = kctx->acceptor_enc_aux; 744 ahash = kctx->acceptor_integ; 745 } 746 conflen = crypto_sync_skcipher_blocksize(cipher); 747 748 /* hide the gss token header and insert the confounder */ 749 offset += GSS_KRB5_TOK_HDR_LEN; 750 if (xdr_extend_head(buf, offset, conflen)) 751 return GSS_S_FAILURE; 752 krb5_make_confounder(buf->head[0].iov_base + offset, conflen); 753 offset -= GSS_KRB5_TOK_HDR_LEN; 754 755 if (buf->tail[0].iov_base != NULL) { 756 ecptr = buf->tail[0].iov_base + buf->tail[0].iov_len; 757 } else { 758 buf->tail[0].iov_base = buf->head[0].iov_base 759 + buf->head[0].iov_len; 760 buf->tail[0].iov_len = 0; 761 ecptr = buf->tail[0].iov_base; 762 } 763 764 /* copy plaintext gss token header after filler (if any) */ 765 memcpy(ecptr, buf->head[0].iov_base + offset, GSS_KRB5_TOK_HDR_LEN); 766 buf->tail[0].iov_len += GSS_KRB5_TOK_HDR_LEN; 767 buf->len += GSS_KRB5_TOK_HDR_LEN; 768 769 hmac.len = kctx->gk5e->cksumlength; 770 hmac.data = buf->tail[0].iov_base + buf->tail[0].iov_len; 771 772 /* 773 * When we are called, pages points to the real page cache 774 * data -- which we can't go and encrypt! buf->pages points 775 * to scratch pages which we are going to send off to the 776 * client/server. Swap in the plaintext pages to calculate 777 * the hmac. 778 */ 779 save_pages = buf->pages; 780 buf->pages = pages; 781 782 err = gss_krb5_checksum(ahash, NULL, 0, buf, 783 offset + GSS_KRB5_TOK_HDR_LEN, &hmac); 784 buf->pages = save_pages; 785 if (err) 786 return GSS_S_FAILURE; 787 788 err = krb5_cbc_cts_encrypt(cipher, aux_cipher, 789 offset + GSS_KRB5_TOK_HDR_LEN, 790 buf, pages, NULL, 0); 791 if (err) 792 return GSS_S_FAILURE; 793 794 /* Now update buf to account for HMAC */ 795 buf->tail[0].iov_len += kctx->gk5e->cksumlength; 796 buf->len += kctx->gk5e->cksumlength; 797 798 return GSS_S_COMPLETE; 799 } 800 801 u32 802 gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len, 803 struct xdr_buf *buf, u32 *headskip, u32 *tailskip) 804 { 805 struct crypto_sync_skcipher *cipher, *aux_cipher; 806 struct crypto_ahash *ahash; 807 struct xdr_netobj our_hmac_obj; 808 u8 our_hmac[GSS_KRB5_MAX_CKSUM_LEN]; 809 u8 pkt_hmac[GSS_KRB5_MAX_CKSUM_LEN]; 810 struct xdr_buf subbuf; 811 u32 ret = 0; 812 813 if (kctx->initiate) { 814 cipher = kctx->acceptor_enc; 815 aux_cipher = kctx->acceptor_enc_aux; 816 ahash = kctx->acceptor_integ; 817 } else { 818 cipher = kctx->initiator_enc; 819 aux_cipher = kctx->initiator_enc_aux; 820 ahash = kctx->initiator_integ; 821 } 822 823 /* create a segment skipping the header and leaving out the checksum */ 824 xdr_buf_subsegment(buf, &subbuf, offset + GSS_KRB5_TOK_HDR_LEN, 825 (len - offset - GSS_KRB5_TOK_HDR_LEN - 826 kctx->gk5e->cksumlength)); 827 828 ret = krb5_cbc_cts_decrypt(cipher, aux_cipher, 0, &subbuf); 829 if (ret) 830 goto out_err; 831 832 our_hmac_obj.len = kctx->gk5e->cksumlength; 833 our_hmac_obj.data = our_hmac; 834 ret = gss_krb5_checksum(ahash, NULL, 0, &subbuf, 0, &our_hmac_obj); 835 if (ret) 836 goto out_err; 837 838 /* Get the packet's hmac value */ 839 ret = read_bytes_from_xdr_buf(buf, len - kctx->gk5e->cksumlength, 840 pkt_hmac, kctx->gk5e->cksumlength); 841 if (ret) 842 goto out_err; 843 844 if (crypto_memneq(pkt_hmac, our_hmac, kctx->gk5e->cksumlength) != 0) { 845 ret = GSS_S_BAD_SIG; 846 goto out_err; 847 } 848 *headskip = crypto_sync_skcipher_blocksize(cipher); 849 *tailskip = kctx->gk5e->cksumlength; 850 out_err: 851 if (ret && ret != GSS_S_BAD_SIG) 852 ret = GSS_S_FAILURE; 853 return ret; 854 } 855 856 /** 857 * krb5_etm_checksum - Compute a MAC for a GSS Wrap token 858 * @cipher: an initialized cipher transform 859 * @tfm: an initialized hash transform 860 * @body: xdr_buf containing an RPC message (body.len is the message length) 861 * @body_offset: byte offset into @body to start checksumming 862 * @cksumout: OUT: a buffer to be filled in with the computed HMAC 863 * 864 * Usually expressed as H = HMAC(K, IV | ciphertext)[1..h] . 865 * 866 * Caller provides the truncation length of the output token (h) in 867 * cksumout.len. 868 * 869 * Return values: 870 * %GSS_S_COMPLETE: Digest computed, @cksumout filled in 871 * %GSS_S_FAILURE: Call failed 872 */ 873 VISIBLE_IF_KUNIT 874 u32 krb5_etm_checksum(struct crypto_sync_skcipher *cipher, 875 struct crypto_ahash *tfm, const struct xdr_buf *body, 876 int body_offset, struct xdr_netobj *cksumout) 877 { 878 unsigned int ivsize = crypto_sync_skcipher_ivsize(cipher); 879 struct ahash_request *req; 880 struct scatterlist sg[1]; 881 u8 *iv, *checksumdata; 882 int err = -ENOMEM; 883 884 checksumdata = kmalloc(crypto_ahash_digestsize(tfm), GFP_KERNEL); 885 if (!checksumdata) 886 return GSS_S_FAILURE; 887 /* For RPCSEC, the "initial cipher state" is always all zeroes. */ 888 iv = kzalloc(ivsize, GFP_KERNEL); 889 if (!iv) 890 goto out_free_mem; 891 892 req = ahash_request_alloc(tfm, GFP_KERNEL); 893 if (!req) 894 goto out_free_mem; 895 ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL); 896 err = crypto_ahash_init(req); 897 if (err) 898 goto out_free_ahash; 899 900 sg_init_one(sg, iv, ivsize); 901 ahash_request_set_crypt(req, sg, NULL, ivsize); 902 err = crypto_ahash_update(req); 903 if (err) 904 goto out_free_ahash; 905 err = xdr_process_buf(body, body_offset, body->len - body_offset, 906 checksummer, req); 907 if (err) 908 goto out_free_ahash; 909 910 ahash_request_set_crypt(req, NULL, checksumdata, 0); 911 err = crypto_ahash_final(req); 912 if (err) 913 goto out_free_ahash; 914 memcpy(cksumout->data, checksumdata, cksumout->len); 915 916 out_free_ahash: 917 ahash_request_free(req); 918 out_free_mem: 919 kfree(iv); 920 kfree_sensitive(checksumdata); 921 return err ? GSS_S_FAILURE : GSS_S_COMPLETE; 922 } 923 EXPORT_SYMBOL_IF_KUNIT(krb5_etm_checksum); 924 925 /** 926 * krb5_etm_encrypt - Encrypt using the RFC 8009 rules 927 * @kctx: Kerberos context 928 * @offset: starting offset of the payload, in bytes 929 * @buf: OUT: send buffer to contain the encrypted payload 930 * @pages: plaintext payload 931 * 932 * The main difference with aes_encrypt is that "The HMAC is 933 * calculated over the cipher state concatenated with the AES 934 * output, instead of being calculated over the confounder and 935 * plaintext. This allows the message receiver to verify the 936 * integrity of the message before decrypting the message." 937 * 938 * RFC 8009 Section 5: 939 * 940 * encryption function: as follows, where E() is AES encryption in 941 * CBC-CS3 mode, and h is the size of truncated HMAC (128 bits or 942 * 192 bits as described above). 943 * 944 * N = random value of length 128 bits (the AES block size) 945 * IV = cipher state 946 * C = E(Ke, N | plaintext, IV) 947 * H = HMAC(Ki, IV | C) 948 * ciphertext = C | H[1..h] 949 * 950 * This encryption formula provides AEAD EtM with key separation. 951 * 952 * Return values: 953 * %GSS_S_COMPLETE: Encryption successful 954 * %GSS_S_FAILURE: Encryption failed 955 */ 956 u32 957 krb5_etm_encrypt(struct krb5_ctx *kctx, u32 offset, 958 struct xdr_buf *buf, struct page **pages) 959 { 960 struct crypto_sync_skcipher *cipher, *aux_cipher; 961 struct crypto_ahash *ahash; 962 struct xdr_netobj hmac; 963 unsigned int conflen; 964 u8 *ecptr; 965 u32 err; 966 967 if (kctx->initiate) { 968 cipher = kctx->initiator_enc; 969 aux_cipher = kctx->initiator_enc_aux; 970 ahash = kctx->initiator_integ; 971 } else { 972 cipher = kctx->acceptor_enc; 973 aux_cipher = kctx->acceptor_enc_aux; 974 ahash = kctx->acceptor_integ; 975 } 976 conflen = crypto_sync_skcipher_blocksize(cipher); 977 978 offset += GSS_KRB5_TOK_HDR_LEN; 979 if (xdr_extend_head(buf, offset, conflen)) 980 return GSS_S_FAILURE; 981 krb5_make_confounder(buf->head[0].iov_base + offset, conflen); 982 offset -= GSS_KRB5_TOK_HDR_LEN; 983 984 if (buf->tail[0].iov_base) { 985 ecptr = buf->tail[0].iov_base + buf->tail[0].iov_len; 986 } else { 987 buf->tail[0].iov_base = buf->head[0].iov_base 988 + buf->head[0].iov_len; 989 buf->tail[0].iov_len = 0; 990 ecptr = buf->tail[0].iov_base; 991 } 992 993 memcpy(ecptr, buf->head[0].iov_base + offset, GSS_KRB5_TOK_HDR_LEN); 994 buf->tail[0].iov_len += GSS_KRB5_TOK_HDR_LEN; 995 buf->len += GSS_KRB5_TOK_HDR_LEN; 996 997 err = krb5_cbc_cts_encrypt(cipher, aux_cipher, 998 offset + GSS_KRB5_TOK_HDR_LEN, 999 buf, pages, NULL, 0); 1000 if (err) 1001 return GSS_S_FAILURE; 1002 1003 hmac.data = buf->tail[0].iov_base + buf->tail[0].iov_len; 1004 hmac.len = kctx->gk5e->cksumlength; 1005 err = krb5_etm_checksum(cipher, ahash, 1006 buf, offset + GSS_KRB5_TOK_HDR_LEN, &hmac); 1007 if (err) 1008 goto out_err; 1009 buf->tail[0].iov_len += kctx->gk5e->cksumlength; 1010 buf->len += kctx->gk5e->cksumlength; 1011 1012 return GSS_S_COMPLETE; 1013 1014 out_err: 1015 return GSS_S_FAILURE; 1016 } 1017 1018 /** 1019 * krb5_etm_decrypt - Decrypt using the RFC 8009 rules 1020 * @kctx: Kerberos context 1021 * @offset: starting offset of the ciphertext, in bytes 1022 * @len: 1023 * @buf: 1024 * @headskip: OUT: the enctype's confounder length, in octets 1025 * @tailskip: OUT: the enctype's HMAC length, in octets 1026 * 1027 * RFC 8009 Section 5: 1028 * 1029 * decryption function: as follows, where D() is AES decryption in 1030 * CBC-CS3 mode, and h is the size of truncated HMAC. 1031 * 1032 * (C, H) = ciphertext 1033 * (Note: H is the last h bits of the ciphertext.) 1034 * IV = cipher state 1035 * if H != HMAC(Ki, IV | C)[1..h] 1036 * stop, report error 1037 * (N, P) = D(Ke, C, IV) 1038 * 1039 * Return values: 1040 * %GSS_S_COMPLETE: Decryption successful 1041 * %GSS_S_BAD_SIG: computed HMAC != received HMAC 1042 * %GSS_S_FAILURE: Decryption failed 1043 */ 1044 u32 1045 krb5_etm_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len, 1046 struct xdr_buf *buf, u32 *headskip, u32 *tailskip) 1047 { 1048 struct crypto_sync_skcipher *cipher, *aux_cipher; 1049 u8 our_hmac[GSS_KRB5_MAX_CKSUM_LEN]; 1050 u8 pkt_hmac[GSS_KRB5_MAX_CKSUM_LEN]; 1051 struct xdr_netobj our_hmac_obj; 1052 struct crypto_ahash *ahash; 1053 struct xdr_buf subbuf; 1054 u32 ret = 0; 1055 1056 if (kctx->initiate) { 1057 cipher = kctx->acceptor_enc; 1058 aux_cipher = kctx->acceptor_enc_aux; 1059 ahash = kctx->acceptor_integ; 1060 } else { 1061 cipher = kctx->initiator_enc; 1062 aux_cipher = kctx->initiator_enc_aux; 1063 ahash = kctx->initiator_integ; 1064 } 1065 1066 /* Extract the ciphertext into @subbuf. */ 1067 xdr_buf_subsegment(buf, &subbuf, offset + GSS_KRB5_TOK_HDR_LEN, 1068 (len - offset - GSS_KRB5_TOK_HDR_LEN - 1069 kctx->gk5e->cksumlength)); 1070 1071 our_hmac_obj.data = our_hmac; 1072 our_hmac_obj.len = kctx->gk5e->cksumlength; 1073 ret = krb5_etm_checksum(cipher, ahash, &subbuf, 0, &our_hmac_obj); 1074 if (ret) 1075 goto out_err; 1076 ret = read_bytes_from_xdr_buf(buf, len - kctx->gk5e->cksumlength, 1077 pkt_hmac, kctx->gk5e->cksumlength); 1078 if (ret) 1079 goto out_err; 1080 if (crypto_memneq(pkt_hmac, our_hmac, kctx->gk5e->cksumlength) != 0) { 1081 ret = GSS_S_BAD_SIG; 1082 goto out_err; 1083 } 1084 1085 ret = krb5_cbc_cts_decrypt(cipher, aux_cipher, 0, &subbuf); 1086 if (ret) { 1087 ret = GSS_S_FAILURE; 1088 goto out_err; 1089 } 1090 1091 *headskip = crypto_sync_skcipher_blocksize(cipher); 1092 *tailskip = kctx->gk5e->cksumlength; 1093 return GSS_S_COMPLETE; 1094 1095 out_err: 1096 if (ret != GSS_S_BAD_SIG) 1097 ret = GSS_S_FAILURE; 1098 return ret; 1099 } 1100