1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* Kerberos-based RxRPC security
3 *
4 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
6 */
7
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9
10 #include <crypto/skcipher.h>
11 #include <linux/module.h>
12 #include <linux/net.h>
13 #include <linux/skbuff.h>
14 #include <linux/udp.h>
15 #include <linux/scatterlist.h>
16 #include <linux/ctype.h>
17 #include <linux/slab.h>
18 #include <linux/key-type.h>
19 #include <net/sock.h>
20 #include <net/af_rxrpc.h>
21 #include <keys/rxrpc-type.h>
22 #include "ar-internal.h"
23
24 #define RXKAD_VERSION 2
25 #define MAXKRB5TICKETLEN 1024
26 #define RXKAD_TKT_TYPE_KERBEROS_V5 256
27 #define ANAME_SZ 40 /* size of authentication name */
28 #define INST_SZ 40 /* size of principal's instance */
29 #define REALM_SZ 40 /* size of principal's auth domain */
30 #define SNAME_SZ 40 /* size of service name */
31 #define RXKAD_ALIGN 8
32
33 struct rxkad_level1_hdr {
34 __be32 data_size; /* true data size (excluding padding) */
35 };
36
37 struct rxkad_level2_hdr {
38 __be32 data_size; /* true data size (excluding padding) */
39 __be32 checksum; /* decrypted data checksum */
40 };
41
42 static int rxkad_prime_packet_security(struct rxrpc_connection *conn,
43 struct crypto_sync_skcipher *ci);
44
45 /*
46 * this holds a pinned cipher so that keventd doesn't get called by the cipher
47 * alloc routine, but since we have it to hand, we use it to decrypt RESPONSE
48 * packets
49 */
50 static struct crypto_sync_skcipher *rxkad_ci;
51 static struct skcipher_request *rxkad_ci_req;
52 static DEFINE_MUTEX(rxkad_ci_mutex);
53
54 /*
55 * Parse the information from a server key
56 *
57 * The data should be the 8-byte secret key.
58 */
rxkad_preparse_server_key(struct key_preparsed_payload * prep)59 static int rxkad_preparse_server_key(struct key_preparsed_payload *prep)
60 {
61 struct crypto_skcipher *ci;
62
63 if (prep->datalen != 8)
64 return -EINVAL;
65
66 memcpy(&prep->payload.data[2], prep->data, 8);
67
68 ci = crypto_alloc_skcipher("pcbc(des)", 0, CRYPTO_ALG_ASYNC);
69 if (IS_ERR(ci)) {
70 _leave(" = %ld", PTR_ERR(ci));
71 return PTR_ERR(ci);
72 }
73
74 if (crypto_skcipher_setkey(ci, prep->data, 8) < 0)
75 BUG();
76
77 prep->payload.data[0] = ci;
78 _leave(" = 0");
79 return 0;
80 }
81
rxkad_free_preparse_server_key(struct key_preparsed_payload * prep)82 static void rxkad_free_preparse_server_key(struct key_preparsed_payload *prep)
83 {
84
85 if (prep->payload.data[0])
86 crypto_free_skcipher(prep->payload.data[0]);
87 }
88
rxkad_destroy_server_key(struct key * key)89 static void rxkad_destroy_server_key(struct key *key)
90 {
91 if (key->payload.data[0]) {
92 crypto_free_skcipher(key->payload.data[0]);
93 key->payload.data[0] = NULL;
94 }
95 }
96
97 /*
98 * initialise connection security
99 */
rxkad_init_connection_security(struct rxrpc_connection * conn,struct rxrpc_key_token * token)100 static int rxkad_init_connection_security(struct rxrpc_connection *conn,
101 struct rxrpc_key_token *token)
102 {
103 struct crypto_sync_skcipher *ci;
104 int ret;
105
106 _enter("{%d},{%x}", conn->debug_id, key_serial(conn->key));
107
108 conn->security_ix = token->security_index;
109
110 ci = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);
111 if (IS_ERR(ci)) {
112 _debug("no cipher");
113 ret = PTR_ERR(ci);
114 goto error;
115 }
116
117 if (crypto_sync_skcipher_setkey(ci, token->kad->session_key,
118 sizeof(token->kad->session_key)) < 0)
119 BUG();
120
121 switch (conn->security_level) {
122 case RXRPC_SECURITY_PLAIN:
123 case RXRPC_SECURITY_AUTH:
124 case RXRPC_SECURITY_ENCRYPT:
125 break;
126 default:
127 ret = -EKEYREJECTED;
128 goto error;
129 }
130
131 ret = rxkad_prime_packet_security(conn, ci);
132 if (ret < 0)
133 goto error_ci;
134
135 conn->rxkad.cipher = ci;
136 return 0;
137
138 error_ci:
139 crypto_free_sync_skcipher(ci);
140 error:
141 _leave(" = %d", ret);
142 return ret;
143 }
144
145 /*
146 * Work out how much data we can put in a packet.
147 */
rxkad_alloc_txbuf(struct rxrpc_call * call,size_t remain,gfp_t gfp)148 static struct rxrpc_txbuf *rxkad_alloc_txbuf(struct rxrpc_call *call, size_t remain, gfp_t gfp)
149 {
150 struct rxrpc_txbuf *txb;
151 size_t shdr, alloc, limit, part;
152
153 remain = umin(remain, 65535 - sizeof(struct rxrpc_wire_header));
154
155 switch (call->conn->security_level) {
156 default:
157 alloc = umin(remain, RXRPC_JUMBO_DATALEN);
158 return rxrpc_alloc_data_txbuf(call, alloc, 1, gfp);
159 case RXRPC_SECURITY_AUTH:
160 shdr = sizeof(struct rxkad_level1_hdr);
161 break;
162 case RXRPC_SECURITY_ENCRYPT:
163 shdr = sizeof(struct rxkad_level2_hdr);
164 break;
165 }
166
167 limit = round_down(RXRPC_JUMBO_DATALEN, RXKAD_ALIGN) - shdr;
168 if (remain < limit) {
169 part = remain;
170 alloc = round_up(shdr + part, RXKAD_ALIGN);
171 } else {
172 part = limit;
173 alloc = RXRPC_JUMBO_DATALEN;
174 }
175
176 txb = rxrpc_alloc_data_txbuf(call, alloc, RXKAD_ALIGN, gfp);
177 if (!txb)
178 return NULL;
179
180 txb->crypto_header = 0;
181 txb->sec_header = shdr;
182 txb->offset += shdr;
183 txb->space = part;
184 return txb;
185 }
186
187 /*
188 * prime the encryption state with the invariant parts of a connection's
189 * description
190 */
rxkad_prime_packet_security(struct rxrpc_connection * conn,struct crypto_sync_skcipher * ci)191 static int rxkad_prime_packet_security(struct rxrpc_connection *conn,
192 struct crypto_sync_skcipher *ci)
193 {
194 struct skcipher_request *req;
195 struct rxrpc_key_token *token;
196 struct scatterlist sg;
197 struct rxrpc_crypt iv;
198 __be32 *tmpbuf;
199 size_t tmpsize = 4 * sizeof(__be32);
200 int ret;
201
202 _enter("");
203
204 if (!conn->key)
205 return 0;
206
207 tmpbuf = kmalloc(tmpsize, GFP_KERNEL);
208 if (!tmpbuf)
209 return -ENOMEM;
210
211 req = skcipher_request_alloc(&ci->base, GFP_NOFS);
212 if (!req) {
213 kfree(tmpbuf);
214 return -ENOMEM;
215 }
216
217 token = conn->key->payload.data[0];
218 memcpy(&iv, token->kad->session_key, sizeof(iv));
219
220 tmpbuf[0] = htonl(conn->proto.epoch);
221 tmpbuf[1] = htonl(conn->proto.cid);
222 tmpbuf[2] = 0;
223 tmpbuf[3] = htonl(conn->security_ix);
224
225 sg_init_one(&sg, tmpbuf, tmpsize);
226 skcipher_request_set_sync_tfm(req, ci);
227 skcipher_request_set_callback(req, 0, NULL, NULL);
228 skcipher_request_set_crypt(req, &sg, &sg, tmpsize, iv.x);
229 ret = crypto_skcipher_encrypt(req);
230 skcipher_request_free(req);
231
232 memcpy(&conn->rxkad.csum_iv, tmpbuf + 2, sizeof(conn->rxkad.csum_iv));
233 kfree(tmpbuf);
234 _leave(" = %d", ret);
235 return ret;
236 }
237
238 /*
239 * Allocate and prepare the crypto request on a call. For any particular call,
240 * this is called serially for the packets, so no lock should be necessary.
241 */
rxkad_get_call_crypto(struct rxrpc_call * call)242 static struct skcipher_request *rxkad_get_call_crypto(struct rxrpc_call *call)
243 {
244 struct crypto_skcipher *tfm = &call->conn->rxkad.cipher->base;
245
246 return skcipher_request_alloc(tfm, GFP_NOFS);
247 }
248
249 /*
250 * Clean up the crypto on a call.
251 */
rxkad_free_call_crypto(struct rxrpc_call * call)252 static void rxkad_free_call_crypto(struct rxrpc_call *call)
253 {
254 }
255
256 /*
257 * partially encrypt a packet (level 1 security)
258 */
rxkad_secure_packet_auth(const struct rxrpc_call * call,struct rxrpc_txbuf * txb,struct skcipher_request * req)259 static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
260 struct rxrpc_txbuf *txb,
261 struct skcipher_request *req)
262 {
263 struct rxkad_level1_hdr *hdr = txb->data;
264 struct rxrpc_crypt iv;
265 struct scatterlist sg;
266 size_t pad;
267 u16 check;
268 int ret;
269
270 _enter("");
271
272 check = txb->seq ^ call->call_id;
273 hdr->data_size = htonl((u32)check << 16 | txb->len);
274
275 txb->pkt_len = sizeof(struct rxkad_level1_hdr) + txb->len;
276 pad = txb->pkt_len;
277 pad = RXKAD_ALIGN - pad;
278 pad &= RXKAD_ALIGN - 1;
279 if (pad) {
280 memset(txb->data + txb->offset, 0, pad);
281 txb->pkt_len += pad;
282 }
283
284 /* start the encryption afresh */
285 memset(&iv, 0, sizeof(iv));
286
287 sg_init_one(&sg, hdr, 8);
288 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
289 skcipher_request_set_callback(req, 0, NULL, NULL);
290 skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
291 ret = crypto_skcipher_encrypt(req);
292 skcipher_request_zero(req);
293
294 _leave(" = %d", ret);
295 return ret;
296 }
297
298 /*
299 * wholly encrypt a packet (level 2 security)
300 */
rxkad_secure_packet_encrypt(const struct rxrpc_call * call,struct rxrpc_txbuf * txb,struct skcipher_request * req)301 static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
302 struct rxrpc_txbuf *txb,
303 struct skcipher_request *req)
304 {
305 const struct rxrpc_key_token *token;
306 struct rxkad_level2_hdr *rxkhdr = txb->data;
307 struct rxrpc_crypt iv;
308 struct scatterlist sg;
309 size_t content, pad;
310 u16 check;
311 int ret;
312
313 _enter("");
314
315 check = txb->seq ^ call->call_id;
316
317 rxkhdr->data_size = htonl(txb->len | (u32)check << 16);
318 rxkhdr->checksum = 0;
319
320 content = sizeof(struct rxkad_level2_hdr) + txb->len;
321 txb->pkt_len = round_up(content, RXKAD_ALIGN);
322 pad = txb->pkt_len - content;
323 if (pad)
324 memset(txb->data + txb->offset, 0, pad);
325
326 /* encrypt from the session key */
327 token = call->conn->key->payload.data[0];
328 memcpy(&iv, token->kad->session_key, sizeof(iv));
329
330 sg_init_one(&sg, rxkhdr, txb->pkt_len);
331 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
332 skcipher_request_set_callback(req, 0, NULL, NULL);
333 skcipher_request_set_crypt(req, &sg, &sg, txb->pkt_len, iv.x);
334 ret = crypto_skcipher_encrypt(req);
335 skcipher_request_zero(req);
336 return ret;
337 }
338
339 /*
340 * checksum an RxRPC packet header
341 */
rxkad_secure_packet(struct rxrpc_call * call,struct rxrpc_txbuf * txb)342 static int rxkad_secure_packet(struct rxrpc_call *call, struct rxrpc_txbuf *txb)
343 {
344 struct skcipher_request *req;
345 struct rxrpc_crypt iv;
346 struct scatterlist sg;
347 union {
348 __be32 buf[2];
349 } crypto __aligned(8);
350 u32 x, y = 0;
351 int ret;
352
353 _enter("{%d{%x}},{#%u},%u,",
354 call->debug_id, key_serial(call->conn->key),
355 txb->seq, txb->len);
356
357 if (!call->conn->rxkad.cipher)
358 return 0;
359
360 ret = key_validate(call->conn->key);
361 if (ret < 0)
362 return ret;
363
364 req = rxkad_get_call_crypto(call);
365 if (!req)
366 return -ENOMEM;
367
368 /* continue encrypting from where we left off */
369 memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv));
370
371 /* calculate the security checksum */
372 x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
373 x |= txb->seq & 0x3fffffff;
374 crypto.buf[0] = htonl(call->call_id);
375 crypto.buf[1] = htonl(x);
376
377 sg_init_one(&sg, crypto.buf, 8);
378 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
379 skcipher_request_set_callback(req, 0, NULL, NULL);
380 skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
381 ret = crypto_skcipher_encrypt(req);
382 skcipher_request_zero(req);
383 if (ret < 0)
384 goto out;
385
386 y = ntohl(crypto.buf[1]);
387 y = (y >> 16) & 0xffff;
388 if (y == 0)
389 y = 1; /* zero checksums are not permitted */
390 txb->cksum = htons(y);
391
392 switch (call->conn->security_level) {
393 case RXRPC_SECURITY_PLAIN:
394 txb->pkt_len = txb->len;
395 ret = 0;
396 break;
397 case RXRPC_SECURITY_AUTH:
398 ret = rxkad_secure_packet_auth(call, txb, req);
399 if (txb->alloc_size == RXRPC_JUMBO_DATALEN)
400 txb->jumboable = true;
401 break;
402 case RXRPC_SECURITY_ENCRYPT:
403 ret = rxkad_secure_packet_encrypt(call, txb, req);
404 if (txb->alloc_size == RXRPC_JUMBO_DATALEN)
405 txb->jumboable = true;
406 break;
407 default:
408 ret = -EPERM;
409 break;
410 }
411
412 /* Clear excess space in the packet */
413 if (txb->pkt_len < txb->alloc_size) {
414 size_t gap = txb->alloc_size - txb->pkt_len;
415 void *p = txb->data;
416
417 memset(p + txb->pkt_len, 0, gap);
418 }
419
420 out:
421 skcipher_request_free(req);
422 _leave(" = %d [set %x]", ret, y);
423 return ret;
424 }
425
426 /*
427 * decrypt partial encryption on a packet (level 1 security)
428 */
rxkad_verify_packet_1(struct rxrpc_call * call,struct sk_buff * skb,rxrpc_seq_t seq,struct skcipher_request * req)429 static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
430 rxrpc_seq_t seq,
431 struct skcipher_request *req)
432 {
433 struct rxkad_level1_hdr sechdr;
434 struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
435 struct rxrpc_crypt iv;
436 struct scatterlist sg[16];
437 u32 data_size, buf;
438 u16 check;
439 int ret;
440
441 _enter("");
442
443 if (sp->len < 8)
444 return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
445 rxkad_abort_1_short_header);
446
447 /* Decrypt the skbuff in-place. TODO: We really want to decrypt
448 * directly into the target buffer.
449 */
450 sg_init_table(sg, ARRAY_SIZE(sg));
451 ret = skb_to_sgvec(skb, sg, sp->offset, 8);
452 if (unlikely(ret < 0))
453 return ret;
454
455 /* start the decryption afresh */
456 memset(&iv, 0, sizeof(iv));
457
458 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
459 skcipher_request_set_callback(req, 0, NULL, NULL);
460 skcipher_request_set_crypt(req, sg, sg, 8, iv.x);
461 ret = crypto_skcipher_decrypt(req);
462 skcipher_request_zero(req);
463 if (ret < 0)
464 return ret;
465
466 /* Extract the decrypted packet length */
467 if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0)
468 return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
469 rxkad_abort_1_short_encdata);
470 sp->offset += sizeof(sechdr);
471 sp->len -= sizeof(sechdr);
472
473 buf = ntohl(sechdr.data_size);
474 data_size = buf & 0xffff;
475
476 check = buf >> 16;
477 check ^= seq ^ call->call_id;
478 check &= 0xffff;
479 if (check != 0)
480 return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
481 rxkad_abort_1_short_check);
482 if (data_size > sp->len)
483 return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
484 rxkad_abort_1_short_data);
485 sp->len = data_size;
486
487 _leave(" = 0 [dlen=%x]", data_size);
488 return 0;
489 }
490
491 /*
492 * wholly decrypt a packet (level 2 security)
493 */
rxkad_verify_packet_2(struct rxrpc_call * call,struct sk_buff * skb,rxrpc_seq_t seq,struct skcipher_request * req)494 static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
495 rxrpc_seq_t seq,
496 struct skcipher_request *req)
497 {
498 const struct rxrpc_key_token *token;
499 struct rxkad_level2_hdr sechdr;
500 struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
501 struct rxrpc_crypt iv;
502 struct scatterlist _sg[4], *sg;
503 u32 data_size, buf;
504 u16 check;
505 int nsg, ret;
506
507 _enter(",{%d}", sp->len);
508
509 if (sp->len < 8)
510 return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
511 rxkad_abort_2_short_header);
512
513 /* Decrypt the skbuff in-place. TODO: We really want to decrypt
514 * directly into the target buffer.
515 */
516 sg = _sg;
517 nsg = skb_shinfo(skb)->nr_frags + 1;
518 if (nsg <= 4) {
519 nsg = 4;
520 } else {
521 sg = kmalloc_objs(*sg, nsg, GFP_NOIO);
522 if (!sg)
523 return -ENOMEM;
524 }
525
526 sg_init_table(sg, nsg);
527 ret = skb_to_sgvec(skb, sg, sp->offset, sp->len);
528 if (unlikely(ret < 0)) {
529 if (sg != _sg)
530 kfree(sg);
531 return ret;
532 }
533
534 /* decrypt from the session key */
535 token = call->conn->key->payload.data[0];
536 memcpy(&iv, token->kad->session_key, sizeof(iv));
537
538 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
539 skcipher_request_set_callback(req, 0, NULL, NULL);
540 skcipher_request_set_crypt(req, sg, sg, sp->len, iv.x);
541 ret = crypto_skcipher_decrypt(req);
542 skcipher_request_zero(req);
543 if (sg != _sg)
544 kfree(sg);
545 if (ret < 0) {
546 WARN_ON_ONCE(ret != -ENOMEM);
547 return ret;
548 }
549
550 /* Extract the decrypted packet length */
551 if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0)
552 return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
553 rxkad_abort_2_short_len);
554 sp->offset += sizeof(sechdr);
555 sp->len -= sizeof(sechdr);
556
557 buf = ntohl(sechdr.data_size);
558 data_size = buf & 0xffff;
559
560 check = buf >> 16;
561 check ^= seq ^ call->call_id;
562 check &= 0xffff;
563 if (check != 0)
564 return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
565 rxkad_abort_2_short_check);
566
567 if (data_size > sp->len)
568 return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
569 rxkad_abort_2_short_data);
570
571 sp->len = data_size;
572 _leave(" = 0 [dlen=%x]", data_size);
573 return 0;
574 }
575
576 /*
577 * Verify the security on a received packet and the subpackets therein.
578 */
rxkad_verify_packet(struct rxrpc_call * call,struct sk_buff * skb)579 static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb)
580 {
581 struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
582 struct skcipher_request *req;
583 struct rxrpc_crypt iv;
584 struct scatterlist sg;
585 union {
586 __be32 buf[2];
587 } crypto __aligned(8);
588 rxrpc_seq_t seq = sp->hdr.seq;
589 int ret;
590 u16 cksum;
591 u32 x, y;
592
593 _enter("{%d{%x}},{#%u}",
594 call->debug_id, key_serial(call->conn->key), seq);
595
596 if (!call->conn->rxkad.cipher)
597 return 0;
598
599 req = rxkad_get_call_crypto(call);
600 if (!req)
601 return -ENOMEM;
602
603 /* continue encrypting from where we left off */
604 memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv));
605
606 /* validate the security checksum */
607 x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
608 x |= seq & 0x3fffffff;
609 crypto.buf[0] = htonl(call->call_id);
610 crypto.buf[1] = htonl(x);
611
612 sg_init_one(&sg, crypto.buf, 8);
613 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
614 skcipher_request_set_callback(req, 0, NULL, NULL);
615 skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
616 ret = crypto_skcipher_encrypt(req);
617 skcipher_request_zero(req);
618 if (ret < 0)
619 goto out;
620
621 y = ntohl(crypto.buf[1]);
622 cksum = (y >> 16) & 0xffff;
623 if (cksum == 0)
624 cksum = 1; /* zero checksums are not permitted */
625
626 if (cksum != sp->hdr.cksum) {
627 ret = rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
628 rxkad_abort_bad_checksum);
629 goto out;
630 }
631
632 switch (call->conn->security_level) {
633 case RXRPC_SECURITY_PLAIN:
634 ret = 0;
635 break;
636 case RXRPC_SECURITY_AUTH:
637 ret = rxkad_verify_packet_1(call, skb, seq, req);
638 break;
639 case RXRPC_SECURITY_ENCRYPT:
640 ret = rxkad_verify_packet_2(call, skb, seq, req);
641 break;
642 default:
643 ret = -ENOANO;
644 break;
645 }
646
647 out:
648 skcipher_request_free(req);
649 return ret;
650 }
651
652 /*
653 * issue a challenge
654 */
rxkad_issue_challenge(struct rxrpc_connection * conn)655 static int rxkad_issue_challenge(struct rxrpc_connection *conn)
656 {
657 struct rxkad_challenge challenge;
658 struct rxrpc_wire_header whdr;
659 struct msghdr msg;
660 struct kvec iov[2];
661 size_t len;
662 u32 serial;
663 int ret;
664
665 _enter("{%d}", conn->debug_id);
666
667 get_random_bytes(&conn->rxkad.nonce, sizeof(conn->rxkad.nonce));
668
669 challenge.version = htonl(2);
670 challenge.nonce = htonl(conn->rxkad.nonce);
671 challenge.min_level = htonl(0);
672 challenge.__padding = 0;
673
674 msg.msg_name = &conn->peer->srx.transport;
675 msg.msg_namelen = conn->peer->srx.transport_len;
676 msg.msg_control = NULL;
677 msg.msg_controllen = 0;
678 msg.msg_flags = 0;
679
680 whdr.epoch = htonl(conn->proto.epoch);
681 whdr.cid = htonl(conn->proto.cid);
682 whdr.callNumber = 0;
683 whdr.seq = 0;
684 whdr.type = RXRPC_PACKET_TYPE_CHALLENGE;
685 whdr.flags = conn->out_clientflag;
686 whdr.userStatus = 0;
687 whdr.securityIndex = conn->security_ix;
688 whdr._rsvd = 0;
689 whdr.serviceId = htons(conn->service_id);
690
691 iov[0].iov_base = &whdr;
692 iov[0].iov_len = sizeof(whdr);
693 iov[1].iov_base = &challenge;
694 iov[1].iov_len = sizeof(challenge);
695
696 len = iov[0].iov_len + iov[1].iov_len;
697
698 serial = rxrpc_get_next_serial(conn);
699 whdr.serial = htonl(serial);
700
701 trace_rxrpc_tx_challenge(conn, serial, 0, conn->rxkad.nonce);
702
703 ret = kernel_sendmsg(conn->local->socket, &msg, iov, 2, len);
704 if (ret < 0) {
705 trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
706 rxrpc_tx_point_rxkad_challenge);
707 return -EAGAIN;
708 }
709
710 rxrpc_peer_mark_tx(conn->peer);
711 trace_rxrpc_tx_packet(conn->debug_id, &whdr,
712 rxrpc_tx_point_rxkad_challenge);
713 _leave(" = 0");
714 return 0;
715 }
716
717 /*
718 * calculate the response checksum
719 */
rxkad_calc_response_checksum(struct rxkad_response * response)720 static void rxkad_calc_response_checksum(struct rxkad_response *response)
721 {
722 u32 csum = 1000003;
723 int loop;
724 u8 *p = (u8 *) response;
725
726 for (loop = sizeof(*response); loop > 0; loop--)
727 csum = csum * 0x10204081 + *p++;
728
729 response->encrypted.checksum = htonl(csum);
730 }
731
732 /*
733 * encrypt the response packet
734 */
rxkad_encrypt_response(struct rxrpc_connection * conn,struct sk_buff * response,const struct rxkad_key * s2)735 static int rxkad_encrypt_response(struct rxrpc_connection *conn,
736 struct sk_buff *response,
737 const struct rxkad_key *s2)
738 {
739 struct skcipher_request *req;
740 struct rxrpc_crypt iv;
741 struct scatterlist sg[1];
742 size_t encsize = sizeof(((struct rxkad_response *)0)->encrypted);
743 int ret;
744
745 sg_init_table(sg, ARRAY_SIZE(sg));
746 ret = skb_to_sgvec(response, sg,
747 sizeof(struct rxrpc_wire_header) +
748 offsetof(struct rxkad_response, encrypted), encsize);
749 if (ret < 0)
750 return ret;
751
752 req = skcipher_request_alloc(&conn->rxkad.cipher->base, GFP_NOFS);
753 if (!req)
754 return -ENOMEM;
755
756 /* continue encrypting from where we left off */
757 memcpy(&iv, s2->session_key, sizeof(iv));
758
759 skcipher_request_set_sync_tfm(req, conn->rxkad.cipher);
760 skcipher_request_set_callback(req, 0, NULL, NULL);
761 skcipher_request_set_crypt(req, sg, sg, encsize, iv.x);
762 ret = crypto_skcipher_encrypt(req);
763 skcipher_request_free(req);
764 return ret;
765 }
766
767 /*
768 * Validate a challenge packet.
769 */
rxkad_validate_challenge(struct rxrpc_connection * conn,struct sk_buff * skb)770 static bool rxkad_validate_challenge(struct rxrpc_connection *conn,
771 struct sk_buff *skb)
772 {
773 struct rxkad_challenge challenge;
774 struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
775 u32 version, min_level;
776 int ret;
777
778 _enter("{%d,%x}", conn->debug_id, key_serial(conn->key));
779
780 if (!conn->key) {
781 rxrpc_abort_conn(conn, skb, RX_PROTOCOL_ERROR, -EPROTO,
782 rxkad_abort_chall_no_key);
783 return false;
784 }
785
786 ret = key_validate(conn->key);
787 if (ret < 0) {
788 rxrpc_abort_conn(conn, skb, RXKADEXPIRED, ret,
789 rxkad_abort_chall_key_expired);
790 return false;
791 }
792
793 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
794 &challenge, sizeof(challenge)) < 0) {
795 rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
796 rxkad_abort_chall_short);
797 return false;
798 }
799
800 version = ntohl(challenge.version);
801 sp->chall.rxkad_nonce = ntohl(challenge.nonce);
802 min_level = ntohl(challenge.min_level);
803
804 trace_rxrpc_rx_challenge(conn, sp->hdr.serial, version,
805 sp->chall.rxkad_nonce, min_level);
806
807 if (version != RXKAD_VERSION) {
808 rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO,
809 rxkad_abort_chall_version);
810 return false;
811 }
812
813 if (conn->security_level < min_level) {
814 rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EACCES,
815 rxkad_abort_chall_level);
816 return false;
817 }
818 return true;
819 }
820
821 /*
822 * Insert the header into the response.
823 */
824 static noinline
rxkad_insert_response_header(struct rxrpc_connection * conn,const struct rxrpc_key_token * token,struct sk_buff * challenge,struct sk_buff * response,size_t * offset)825 int rxkad_insert_response_header(struct rxrpc_connection *conn,
826 const struct rxrpc_key_token *token,
827 struct sk_buff *challenge,
828 struct sk_buff *response,
829 size_t *offset)
830 {
831 struct rxrpc_skb_priv *csp = rxrpc_skb(challenge);
832 struct {
833 struct rxrpc_wire_header whdr;
834 struct rxkad_response resp;
835 } h;
836 int ret;
837
838 h.whdr.epoch = htonl(conn->proto.epoch);
839 h.whdr.cid = htonl(conn->proto.cid);
840 h.whdr.callNumber = 0;
841 h.whdr.serial = 0;
842 h.whdr.seq = 0;
843 h.whdr.type = RXRPC_PACKET_TYPE_RESPONSE;
844 h.whdr.flags = conn->out_clientflag;
845 h.whdr.userStatus = 0;
846 h.whdr.securityIndex = conn->security_ix;
847 h.whdr.cksum = 0;
848 h.whdr.serviceId = htons(conn->service_id);
849 h.resp.version = htonl(RXKAD_VERSION);
850 h.resp.__pad = 0;
851 h.resp.encrypted.epoch = htonl(conn->proto.epoch);
852 h.resp.encrypted.cid = htonl(conn->proto.cid);
853 h.resp.encrypted.checksum = 0;
854 h.resp.encrypted.securityIndex = htonl(conn->security_ix);
855 h.resp.encrypted.call_id[0] = htonl(conn->channels[0].call_counter);
856 h.resp.encrypted.call_id[1] = htonl(conn->channels[1].call_counter);
857 h.resp.encrypted.call_id[2] = htonl(conn->channels[2].call_counter);
858 h.resp.encrypted.call_id[3] = htonl(conn->channels[3].call_counter);
859 h.resp.encrypted.inc_nonce = htonl(csp->chall.rxkad_nonce + 1);
860 h.resp.encrypted.level = htonl(conn->security_level);
861 h.resp.kvno = htonl(token->kad->kvno);
862 h.resp.ticket_len = htonl(token->kad->ticket_len);
863
864 rxkad_calc_response_checksum(&h.resp);
865
866 ret = skb_store_bits(response, *offset, &h, sizeof(h));
867 *offset += sizeof(h);
868 return ret;
869 }
870
871 /*
872 * respond to a challenge packet
873 */
rxkad_respond_to_challenge(struct rxrpc_connection * conn,struct sk_buff * challenge)874 static int rxkad_respond_to_challenge(struct rxrpc_connection *conn,
875 struct sk_buff *challenge)
876 {
877 const struct rxrpc_key_token *token;
878 struct rxrpc_skb_priv *csp, *rsp;
879 struct sk_buff *response;
880 size_t len, offset = 0;
881 int ret = -EPROTO;
882
883 _enter("{%d,%x}", conn->debug_id, key_serial(conn->key));
884
885 ret = key_validate(conn->key);
886 if (ret < 0)
887 return rxrpc_abort_conn(conn, challenge, RXKADEXPIRED, ret,
888 rxkad_abort_chall_key_expired);
889
890 token = conn->key->payload.data[0];
891
892 /* build the response packet */
893 len = sizeof(struct rxrpc_wire_header) +
894 sizeof(struct rxkad_response) +
895 token->kad->ticket_len;
896
897 response = alloc_skb_with_frags(0, len, 0, &ret, GFP_NOFS);
898 if (!response)
899 goto error;
900 rxrpc_new_skb(response, rxrpc_skb_new_response_rxkad);
901 response->len = len;
902 response->data_len = len;
903
904 offset = 0;
905 ret = rxkad_insert_response_header(conn, token, challenge, response,
906 &offset);
907 if (ret < 0)
908 goto error;
909
910 ret = rxkad_encrypt_response(conn, response, token->kad);
911 if (ret < 0)
912 goto error;
913
914 ret = skb_store_bits(response, offset, token->kad->ticket,
915 token->kad->ticket_len);
916 if (ret < 0)
917 goto error;
918
919 csp = rxrpc_skb(challenge);
920 rsp = rxrpc_skb(response);
921 rsp->resp.len = len;
922 rsp->resp.challenge_serial = csp->hdr.serial;
923 rxrpc_post_response(conn, response);
924 response = NULL;
925 ret = 0;
926
927 error:
928 rxrpc_free_skb(response, rxrpc_skb_put_response);
929 return ret;
930 }
931
932 /*
933 * RxKAD does automatic response only as there's nothing to manage that isn't
934 * already in the key.
935 */
rxkad_sendmsg_respond_to_challenge(struct sk_buff * challenge,struct msghdr * msg)936 static int rxkad_sendmsg_respond_to_challenge(struct sk_buff *challenge,
937 struct msghdr *msg)
938 {
939 return -EINVAL;
940 }
941
942 /**
943 * rxkad_kernel_respond_to_challenge - Respond to a challenge with appdata
944 * @challenge: The challenge to respond to
945 *
946 * Allow a kernel application to respond to a CHALLENGE.
947 *
948 * Return: %0 if successful and a negative error code otherwise.
949 */
rxkad_kernel_respond_to_challenge(struct sk_buff * challenge)950 int rxkad_kernel_respond_to_challenge(struct sk_buff *challenge)
951 {
952 struct rxrpc_skb_priv *csp = rxrpc_skb(challenge);
953
954 return rxkad_respond_to_challenge(csp->chall.conn, challenge);
955 }
956 EXPORT_SYMBOL(rxkad_kernel_respond_to_challenge);
957
958 /*
959 * decrypt the kerberos IV ticket in the response
960 */
rxkad_decrypt_ticket(struct rxrpc_connection * conn,struct key * server_key,struct sk_buff * skb,void * ticket,size_t ticket_len,struct rxrpc_crypt * _session_key,time64_t * _expiry)961 static int rxkad_decrypt_ticket(struct rxrpc_connection *conn,
962 struct key *server_key,
963 struct sk_buff *skb,
964 void *ticket, size_t ticket_len,
965 struct rxrpc_crypt *_session_key,
966 time64_t *_expiry)
967 {
968 struct skcipher_request *req;
969 struct rxrpc_crypt iv, key;
970 struct scatterlist sg[1];
971 struct in_addr addr;
972 unsigned int life;
973 time64_t issue, now;
974 int ret;
975 bool little_endian;
976 u8 *p, *q, *name, *end;
977
978 _enter("{%d},{%x}", conn->debug_id, key_serial(server_key));
979
980 *_expiry = 0;
981
982 ASSERT(server_key->payload.data[0] != NULL);
983 ASSERTCMP((unsigned long) ticket & 7UL, ==, 0);
984
985 memcpy(&iv, &server_key->payload.data[2], sizeof(iv));
986
987 req = skcipher_request_alloc(server_key->payload.data[0], GFP_NOFS);
988 if (!req)
989 return -ENOMEM;
990
991 sg_init_one(&sg[0], ticket, ticket_len);
992 skcipher_request_set_callback(req, 0, NULL, NULL);
993 skcipher_request_set_crypt(req, sg, sg, ticket_len, iv.x);
994 ret = crypto_skcipher_decrypt(req);
995 skcipher_request_free(req);
996 if (ret < 0)
997 return rxrpc_abort_conn(conn, skb, RXKADBADTICKET, -EPROTO,
998 rxkad_abort_resp_tkt_short);
999
1000 p = ticket;
1001 end = p + ticket_len;
1002
1003 #define Z(field, fieldl) \
1004 ({ \
1005 u8 *__str = p; \
1006 q = memchr(p, 0, end - p); \
1007 if (!q || q - p > field##_SZ) \
1008 return rxrpc_abort_conn( \
1009 conn, skb, RXKADBADTICKET, -EPROTO, \
1010 rxkad_abort_resp_tkt_##fieldl); \
1011 for (; p < q; p++) \
1012 if (!isprint(*p)) \
1013 return rxrpc_abort_conn( \
1014 conn, skb, RXKADBADTICKET, -EPROTO, \
1015 rxkad_abort_resp_tkt_##fieldl); \
1016 p++; \
1017 __str; \
1018 })
1019
1020 /* extract the ticket flags */
1021 _debug("KIV FLAGS: %x", *p);
1022 little_endian = *p & 1;
1023 p++;
1024
1025 /* extract the authentication name */
1026 name = Z(ANAME, aname);
1027 _debug("KIV ANAME: %s", name);
1028
1029 /* extract the principal's instance */
1030 name = Z(INST, inst);
1031 _debug("KIV INST : %s", name);
1032
1033 /* extract the principal's authentication domain */
1034 name = Z(REALM, realm);
1035 _debug("KIV REALM: %s", name);
1036
1037 if (end - p < 4 + 8 + 4 + 2)
1038 return rxrpc_abort_conn(conn, skb, RXKADBADTICKET, -EPROTO,
1039 rxkad_abort_resp_tkt_short);
1040
1041 /* get the IPv4 address of the entity that requested the ticket */
1042 memcpy(&addr, p, sizeof(addr));
1043 p += 4;
1044 _debug("KIV ADDR : %pI4", &addr);
1045
1046 /* get the session key from the ticket */
1047 memcpy(&key, p, sizeof(key));
1048 p += 8;
1049 _debug("KIV KEY : %08x %08x", ntohl(key.n[0]), ntohl(key.n[1]));
1050 memcpy(_session_key, &key, sizeof(key));
1051
1052 /* get the ticket's lifetime */
1053 life = *p++ * 5 * 60;
1054 _debug("KIV LIFE : %u", life);
1055
1056 /* get the issue time of the ticket */
1057 if (little_endian) {
1058 __le32 stamp;
1059 memcpy(&stamp, p, 4);
1060 issue = rxrpc_u32_to_time64(le32_to_cpu(stamp));
1061 } else {
1062 __be32 stamp;
1063 memcpy(&stamp, p, 4);
1064 issue = rxrpc_u32_to_time64(be32_to_cpu(stamp));
1065 }
1066 p += 4;
1067 now = ktime_get_real_seconds();
1068 _debug("KIV ISSUE: %llx [%llx]", issue, now);
1069
1070 /* check the ticket is in date */
1071 if (issue > now)
1072 return rxrpc_abort_conn(conn, skb, RXKADNOAUTH, -EKEYREJECTED,
1073 rxkad_abort_resp_tkt_future);
1074 if (issue < now - life)
1075 return rxrpc_abort_conn(conn, skb, RXKADEXPIRED, -EKEYEXPIRED,
1076 rxkad_abort_resp_tkt_expired);
1077
1078 *_expiry = issue + life;
1079
1080 /* get the service name */
1081 name = Z(SNAME, sname);
1082 _debug("KIV SNAME: %s", name);
1083
1084 /* get the service instance name */
1085 name = Z(INST, sinst);
1086 _debug("KIV SINST: %s", name);
1087 return 0;
1088 }
1089
1090 /*
1091 * decrypt the response packet
1092 */
rxkad_decrypt_response(struct rxrpc_connection * conn,struct rxkad_response * resp,const struct rxrpc_crypt * session_key)1093 static int rxkad_decrypt_response(struct rxrpc_connection *conn,
1094 struct rxkad_response *resp,
1095 const struct rxrpc_crypt *session_key)
1096 {
1097 struct skcipher_request *req = rxkad_ci_req;
1098 struct scatterlist sg[1];
1099 struct rxrpc_crypt iv;
1100 int ret;
1101
1102 _enter(",,%08x%08x",
1103 ntohl(session_key->n[0]), ntohl(session_key->n[1]));
1104
1105 mutex_lock(&rxkad_ci_mutex);
1106 ret = crypto_sync_skcipher_setkey(rxkad_ci, session_key->x,
1107 sizeof(*session_key));
1108 if (ret < 0)
1109 goto unlock;
1110
1111 memcpy(&iv, session_key, sizeof(iv));
1112
1113 sg_init_table(sg, 1);
1114 sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted));
1115 skcipher_request_set_sync_tfm(req, rxkad_ci);
1116 skcipher_request_set_callback(req, 0, NULL, NULL);
1117 skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x);
1118 ret = crypto_skcipher_decrypt(req);
1119 skcipher_request_zero(req);
1120
1121 unlock:
1122 mutex_unlock(&rxkad_ci_mutex);
1123
1124 _leave("");
1125 return ret;
1126 }
1127
1128 /*
1129 * verify a response
1130 */
rxkad_verify_response(struct rxrpc_connection * conn,struct sk_buff * skb)1131 static int rxkad_verify_response(struct rxrpc_connection *conn,
1132 struct sk_buff *skb)
1133 {
1134 struct rxkad_response *response;
1135 struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
1136 struct rxrpc_crypt session_key;
1137 struct key *server_key;
1138 time64_t expiry;
1139 void *ticket;
1140 u32 version, kvno, ticket_len, level;
1141 __be32 csum;
1142 int ret, i;
1143
1144 _enter("{%d}", conn->debug_id);
1145
1146 server_key = rxrpc_look_up_server_security(conn, skb, 0, 0);
1147 if (IS_ERR(server_key)) {
1148 ret = PTR_ERR(server_key);
1149 switch (ret) {
1150 case -ENOKEY:
1151 return rxrpc_abort_conn(conn, skb, RXKADUNKNOWNKEY, ret,
1152 rxkad_abort_resp_nokey);
1153 case -EKEYEXPIRED:
1154 return rxrpc_abort_conn(conn, skb, RXKADEXPIRED, ret,
1155 rxkad_abort_resp_key_expired);
1156 default:
1157 return rxrpc_abort_conn(conn, skb, RXKADNOAUTH, ret,
1158 rxkad_abort_resp_key_rejected);
1159 }
1160 }
1161
1162 ret = -ENOMEM;
1163 response = kzalloc_obj(struct rxkad_response, GFP_NOFS);
1164 if (!response)
1165 goto temporary_error;
1166
1167 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
1168 response, sizeof(*response)) < 0) {
1169 rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
1170 rxkad_abort_resp_short);
1171 goto protocol_error;
1172 }
1173
1174 version = ntohl(response->version);
1175 ticket_len = ntohl(response->ticket_len);
1176 kvno = ntohl(response->kvno);
1177
1178 trace_rxrpc_rx_response(conn, sp->hdr.serial, version, kvno, ticket_len);
1179
1180 if (version != RXKAD_VERSION) {
1181 rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO,
1182 rxkad_abort_resp_version);
1183 goto protocol_error;
1184 }
1185
1186 if (ticket_len < 4 || ticket_len > MAXKRB5TICKETLEN) {
1187 rxrpc_abort_conn(conn, skb, RXKADTICKETLEN, -EPROTO,
1188 rxkad_abort_resp_tkt_len);
1189 goto protocol_error;
1190 }
1191
1192 if (kvno >= RXKAD_TKT_TYPE_KERBEROS_V5) {
1193 rxrpc_abort_conn(conn, skb, RXKADUNKNOWNKEY, -EPROTO,
1194 rxkad_abort_resp_unknown_tkt);
1195 goto protocol_error;
1196 }
1197
1198 /* extract the kerberos ticket and decrypt and decode it */
1199 ret = -ENOMEM;
1200 ticket = kmalloc(ticket_len, GFP_NOFS);
1201 if (!ticket)
1202 goto temporary_error_free_resp;
1203
1204 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header) + sizeof(*response),
1205 ticket, ticket_len) < 0) {
1206 rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
1207 rxkad_abort_resp_short_tkt);
1208 goto protocol_error;
1209 }
1210
1211 ret = rxkad_decrypt_ticket(conn, server_key, skb, ticket, ticket_len,
1212 &session_key, &expiry);
1213 if (ret < 0)
1214 goto temporary_error_free_ticket;
1215
1216 /* use the session key from inside the ticket to decrypt the
1217 * response */
1218 ret = rxkad_decrypt_response(conn, response, &session_key);
1219 if (ret < 0)
1220 goto temporary_error_free_ticket;
1221
1222 if (ntohl(response->encrypted.epoch) != conn->proto.epoch ||
1223 ntohl(response->encrypted.cid) != conn->proto.cid ||
1224 ntohl(response->encrypted.securityIndex) != conn->security_ix) {
1225 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1226 rxkad_abort_resp_bad_param);
1227 goto protocol_error_free;
1228 }
1229
1230 csum = response->encrypted.checksum;
1231 response->encrypted.checksum = 0;
1232 rxkad_calc_response_checksum(response);
1233 if (response->encrypted.checksum != csum) {
1234 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1235 rxkad_abort_resp_bad_checksum);
1236 goto protocol_error_free;
1237 }
1238
1239 for (i = 0; i < RXRPC_MAXCALLS; i++) {
1240 u32 call_id = ntohl(response->encrypted.call_id[i]);
1241 u32 counter = READ_ONCE(conn->channels[i].call_counter);
1242
1243 if (call_id > INT_MAX) {
1244 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1245 rxkad_abort_resp_bad_callid);
1246 goto protocol_error_free;
1247 }
1248
1249 if (call_id < counter) {
1250 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1251 rxkad_abort_resp_call_ctr);
1252 goto protocol_error_free;
1253 }
1254
1255 if (call_id > counter) {
1256 if (conn->channels[i].call) {
1257 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1258 rxkad_abort_resp_call_state);
1259 goto protocol_error_free;
1260 }
1261 conn->channels[i].call_counter = call_id;
1262 }
1263 }
1264
1265 if (ntohl(response->encrypted.inc_nonce) != conn->rxkad.nonce + 1) {
1266 rxrpc_abort_conn(conn, skb, RXKADOUTOFSEQUENCE, -EPROTO,
1267 rxkad_abort_resp_ooseq);
1268 goto protocol_error_free;
1269 }
1270
1271 level = ntohl(response->encrypted.level);
1272 if (level > RXRPC_SECURITY_ENCRYPT) {
1273 rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EPROTO,
1274 rxkad_abort_resp_level);
1275 goto protocol_error_free;
1276 }
1277 conn->security_level = level;
1278
1279 /* create a key to hold the security data and expiration time - after
1280 * this the connection security can be handled in exactly the same way
1281 * as for a client connection */
1282 ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno);
1283 if (ret < 0)
1284 goto temporary_error_free_ticket;
1285
1286 kfree(ticket);
1287 kfree(response);
1288 _leave(" = 0");
1289 return 0;
1290
1291 protocol_error_free:
1292 kfree(ticket);
1293 protocol_error:
1294 kfree(response);
1295 key_put(server_key);
1296 return -EPROTO;
1297
1298 temporary_error_free_ticket:
1299 kfree(ticket);
1300 temporary_error_free_resp:
1301 kfree(response);
1302 temporary_error:
1303 /* Ignore the response packet if we got a temporary error such as
1304 * ENOMEM. We just want to send the challenge again. Note that we
1305 * also come out this way if the ticket decryption fails.
1306 */
1307 key_put(server_key);
1308 return ret;
1309 }
1310
1311 /*
1312 * clear the connection security
1313 */
rxkad_clear(struct rxrpc_connection * conn)1314 static void rxkad_clear(struct rxrpc_connection *conn)
1315 {
1316 _enter("");
1317
1318 if (conn->rxkad.cipher)
1319 crypto_free_sync_skcipher(conn->rxkad.cipher);
1320 }
1321
1322 /*
1323 * Initialise the rxkad security service.
1324 */
rxkad_init(void)1325 static int rxkad_init(void)
1326 {
1327 struct crypto_sync_skcipher *tfm;
1328 struct skcipher_request *req;
1329
1330 /* pin the cipher we need so that the crypto layer doesn't invoke
1331 * keventd to go get it */
1332 tfm = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);
1333 if (IS_ERR(tfm))
1334 return PTR_ERR(tfm);
1335
1336 req = skcipher_request_alloc(&tfm->base, GFP_KERNEL);
1337 if (!req)
1338 goto nomem_tfm;
1339
1340 rxkad_ci_req = req;
1341 rxkad_ci = tfm;
1342 return 0;
1343
1344 nomem_tfm:
1345 crypto_free_sync_skcipher(tfm);
1346 return -ENOMEM;
1347 }
1348
1349 /*
1350 * Clean up the rxkad security service.
1351 */
rxkad_exit(void)1352 static void rxkad_exit(void)
1353 {
1354 crypto_free_sync_skcipher(rxkad_ci);
1355 skcipher_request_free(rxkad_ci_req);
1356 }
1357
1358 /*
1359 * RxRPC Kerberos-based security
1360 */
1361 const struct rxrpc_security rxkad = {
1362 .name = "rxkad",
1363 .security_index = RXRPC_SECURITY_RXKAD,
1364 .no_key_abort = RXKADUNKNOWNKEY,
1365 .init = rxkad_init,
1366 .exit = rxkad_exit,
1367 .preparse_server_key = rxkad_preparse_server_key,
1368 .free_preparse_server_key = rxkad_free_preparse_server_key,
1369 .destroy_server_key = rxkad_destroy_server_key,
1370 .init_connection_security = rxkad_init_connection_security,
1371 .alloc_txbuf = rxkad_alloc_txbuf,
1372 .secure_packet = rxkad_secure_packet,
1373 .verify_packet = rxkad_verify_packet,
1374 .free_call_crypto = rxkad_free_call_crypto,
1375 .issue_challenge = rxkad_issue_challenge,
1376 .validate_challenge = rxkad_validate_challenge,
1377 .sendmsg_respond_to_challenge = rxkad_sendmsg_respond_to_challenge,
1378 .respond_to_challenge = rxkad_respond_to_challenge,
1379 .verify_response = rxkad_verify_response,
1380 .clear = rxkad_clear,
1381 };
1382