xref: /linux/net/rxrpc/rxkad.c (revision a55f7f5f29b32c2c53cc291899cf9b0c25a07f7c)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* Kerberos-based RxRPC security
3  *
4  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
5  * Written by David Howells (dhowells@redhat.com)
6  */
7 
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 
10 #include <crypto/skcipher.h>
11 #include <linux/module.h>
12 #include <linux/net.h>
13 #include <linux/skbuff.h>
14 #include <linux/udp.h>
15 #include <linux/scatterlist.h>
16 #include <linux/ctype.h>
17 #include <linux/slab.h>
18 #include <linux/key-type.h>
19 #include <net/sock.h>
20 #include <net/af_rxrpc.h>
21 #include <keys/rxrpc-type.h>
22 #include "ar-internal.h"
23 
24 #define RXKAD_VERSION			2
25 #define MAXKRB5TICKETLEN		1024
26 #define RXKAD_TKT_TYPE_KERBEROS_V5	256
27 #define ANAME_SZ			40	/* size of authentication name */
28 #define INST_SZ				40	/* size of principal's instance */
29 #define REALM_SZ			40	/* size of principal's auth domain */
30 #define SNAME_SZ			40	/* size of service name */
31 #define RXKAD_ALIGN			8
32 
33 struct rxkad_level1_hdr {
34 	__be32	data_size;	/* true data size (excluding padding) */
35 };
36 
37 struct rxkad_level2_hdr {
38 	__be32	data_size;	/* true data size (excluding padding) */
39 	__be32	checksum;	/* decrypted data checksum */
40 };
41 
42 static int rxkad_prime_packet_security(struct rxrpc_connection *conn,
43 				       struct crypto_sync_skcipher *ci);
44 
45 /*
46  * this holds a pinned cipher so that keventd doesn't get called by the cipher
47  * alloc routine, but since we have it to hand, we use it to decrypt RESPONSE
48  * packets
49  */
50 static struct crypto_sync_skcipher *rxkad_ci;
51 static struct skcipher_request *rxkad_ci_req;
52 static DEFINE_MUTEX(rxkad_ci_mutex);
53 
54 /*
55  * Parse the information from a server key
56  *
57  * The data should be the 8-byte secret key.
58  */
rxkad_preparse_server_key(struct key_preparsed_payload * prep)59 static int rxkad_preparse_server_key(struct key_preparsed_payload *prep)
60 {
61 	struct crypto_skcipher *ci;
62 
63 	if (prep->datalen != 8)
64 		return -EINVAL;
65 
66 	memcpy(&prep->payload.data[2], prep->data, 8);
67 
68 	ci = crypto_alloc_skcipher("pcbc(des)", 0, CRYPTO_ALG_ASYNC);
69 	if (IS_ERR(ci)) {
70 		_leave(" = %ld", PTR_ERR(ci));
71 		return PTR_ERR(ci);
72 	}
73 
74 	if (crypto_skcipher_setkey(ci, prep->data, 8) < 0)
75 		BUG();
76 
77 	prep->payload.data[0] = ci;
78 	_leave(" = 0");
79 	return 0;
80 }
81 
rxkad_free_preparse_server_key(struct key_preparsed_payload * prep)82 static void rxkad_free_preparse_server_key(struct key_preparsed_payload *prep)
83 {
84 
85 	if (prep->payload.data[0])
86 		crypto_free_skcipher(prep->payload.data[0]);
87 }
88 
rxkad_destroy_server_key(struct key * key)89 static void rxkad_destroy_server_key(struct key *key)
90 {
91 	if (key->payload.data[0]) {
92 		crypto_free_skcipher(key->payload.data[0]);
93 		key->payload.data[0] = NULL;
94 	}
95 }
96 
97 /*
98  * initialise connection security
99  */
rxkad_init_connection_security(struct rxrpc_connection * conn,struct rxrpc_key_token * token)100 static int rxkad_init_connection_security(struct rxrpc_connection *conn,
101 					  struct rxrpc_key_token *token)
102 {
103 	struct crypto_sync_skcipher *ci;
104 	int ret;
105 
106 	_enter("{%d},{%x}", conn->debug_id, key_serial(conn->key));
107 
108 	conn->security_ix = token->security_index;
109 
110 	ci = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);
111 	if (IS_ERR(ci)) {
112 		_debug("no cipher");
113 		ret = PTR_ERR(ci);
114 		goto error;
115 	}
116 
117 	if (crypto_sync_skcipher_setkey(ci, token->kad->session_key,
118 				   sizeof(token->kad->session_key)) < 0)
119 		BUG();
120 
121 	switch (conn->security_level) {
122 	case RXRPC_SECURITY_PLAIN:
123 	case RXRPC_SECURITY_AUTH:
124 	case RXRPC_SECURITY_ENCRYPT:
125 		break;
126 	default:
127 		ret = -EKEYREJECTED;
128 		goto error;
129 	}
130 
131 	ret = rxkad_prime_packet_security(conn, ci);
132 	if (ret < 0)
133 		goto error_ci;
134 
135 	conn->rxkad.cipher = ci;
136 	return 0;
137 
138 error_ci:
139 	crypto_free_sync_skcipher(ci);
140 error:
141 	_leave(" = %d", ret);
142 	return ret;
143 }
144 
145 /*
146  * Work out how much data we can put in a packet.
147  */
rxkad_alloc_txbuf(struct rxrpc_call * call,size_t remain,gfp_t gfp)148 static struct rxrpc_txbuf *rxkad_alloc_txbuf(struct rxrpc_call *call, size_t remain, gfp_t gfp)
149 {
150 	struct rxrpc_txbuf *txb;
151 	size_t shdr, alloc, limit, part;
152 
153 	remain = umin(remain, 65535 - sizeof(struct rxrpc_wire_header));
154 
155 	switch (call->conn->security_level) {
156 	default:
157 		alloc = umin(remain, RXRPC_JUMBO_DATALEN);
158 		return rxrpc_alloc_data_txbuf(call, alloc, 1, gfp);
159 	case RXRPC_SECURITY_AUTH:
160 		shdr = sizeof(struct rxkad_level1_hdr);
161 		break;
162 	case RXRPC_SECURITY_ENCRYPT:
163 		shdr = sizeof(struct rxkad_level2_hdr);
164 		break;
165 	}
166 
167 	limit = round_down(RXRPC_JUMBO_DATALEN, RXKAD_ALIGN) - shdr;
168 	if (remain < limit) {
169 		part = remain;
170 		alloc = round_up(shdr + part, RXKAD_ALIGN);
171 	} else {
172 		part = limit;
173 		alloc = RXRPC_JUMBO_DATALEN;
174 	}
175 
176 	txb = rxrpc_alloc_data_txbuf(call, alloc, RXKAD_ALIGN, gfp);
177 	if (!txb)
178 		return NULL;
179 
180 	txb->crypto_header	= 0;
181 	txb->sec_header		= shdr;
182 	txb->offset		+= shdr;
183 	txb->space		= part;
184 	return txb;
185 }
186 
187 /*
188  * prime the encryption state with the invariant parts of a connection's
189  * description
190  */
rxkad_prime_packet_security(struct rxrpc_connection * conn,struct crypto_sync_skcipher * ci)191 static int rxkad_prime_packet_security(struct rxrpc_connection *conn,
192 				       struct crypto_sync_skcipher *ci)
193 {
194 	struct skcipher_request *req;
195 	struct rxrpc_key_token *token;
196 	struct scatterlist sg;
197 	struct rxrpc_crypt iv;
198 	__be32 *tmpbuf;
199 	size_t tmpsize = 4 * sizeof(__be32);
200 	int ret;
201 
202 	_enter("");
203 
204 	if (!conn->key)
205 		return 0;
206 
207 	tmpbuf = kmalloc(tmpsize, GFP_KERNEL);
208 	if (!tmpbuf)
209 		return -ENOMEM;
210 
211 	req = skcipher_request_alloc(&ci->base, GFP_NOFS);
212 	if (!req) {
213 		kfree(tmpbuf);
214 		return -ENOMEM;
215 	}
216 
217 	token = conn->key->payload.data[0];
218 	memcpy(&iv, token->kad->session_key, sizeof(iv));
219 
220 	tmpbuf[0] = htonl(conn->proto.epoch);
221 	tmpbuf[1] = htonl(conn->proto.cid);
222 	tmpbuf[2] = 0;
223 	tmpbuf[3] = htonl(conn->security_ix);
224 
225 	sg_init_one(&sg, tmpbuf, tmpsize);
226 	skcipher_request_set_sync_tfm(req, ci);
227 	skcipher_request_set_callback(req, 0, NULL, NULL);
228 	skcipher_request_set_crypt(req, &sg, &sg, tmpsize, iv.x);
229 	ret = crypto_skcipher_encrypt(req);
230 	skcipher_request_free(req);
231 
232 	memcpy(&conn->rxkad.csum_iv, tmpbuf + 2, sizeof(conn->rxkad.csum_iv));
233 	kfree(tmpbuf);
234 	_leave(" = %d", ret);
235 	return ret;
236 }
237 
238 /*
239  * Allocate and prepare the crypto request on a call.  For any particular call,
240  * this is called serially for the packets, so no lock should be necessary.
241  */
rxkad_get_call_crypto(struct rxrpc_call * call)242 static struct skcipher_request *rxkad_get_call_crypto(struct rxrpc_call *call)
243 {
244 	struct crypto_skcipher *tfm = &call->conn->rxkad.cipher->base;
245 
246 	return skcipher_request_alloc(tfm, GFP_NOFS);
247 }
248 
249 /*
250  * Clean up the crypto on a call.
251  */
rxkad_free_call_crypto(struct rxrpc_call * call)252 static void rxkad_free_call_crypto(struct rxrpc_call *call)
253 {
254 }
255 
256 /*
257  * partially encrypt a packet (level 1 security)
258  */
rxkad_secure_packet_auth(const struct rxrpc_call * call,struct rxrpc_txbuf * txb,struct skcipher_request * req)259 static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
260 				    struct rxrpc_txbuf *txb,
261 				    struct skcipher_request *req)
262 {
263 	struct rxkad_level1_hdr *hdr = txb->data;
264 	struct rxrpc_crypt iv;
265 	struct scatterlist sg;
266 	size_t pad;
267 	u16 check;
268 	int ret;
269 
270 	_enter("");
271 
272 	check = txb->seq ^ call->call_id;
273 	hdr->data_size = htonl((u32)check << 16 | txb->len);
274 
275 	txb->pkt_len = sizeof(struct rxkad_level1_hdr) + txb->len;
276 	pad = txb->pkt_len;
277 	pad = RXKAD_ALIGN - pad;
278 	pad &= RXKAD_ALIGN - 1;
279 	if (pad) {
280 		memset(txb->data + txb->offset, 0, pad);
281 		txb->pkt_len += pad;
282 	}
283 
284 	/* start the encryption afresh */
285 	memset(&iv, 0, sizeof(iv));
286 
287 	sg_init_one(&sg, hdr, 8);
288 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
289 	skcipher_request_set_callback(req, 0, NULL, NULL);
290 	skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
291 	ret = crypto_skcipher_encrypt(req);
292 	skcipher_request_zero(req);
293 
294 	_leave(" = %d", ret);
295 	return ret;
296 }
297 
298 /*
299  * wholly encrypt a packet (level 2 security)
300  */
rxkad_secure_packet_encrypt(const struct rxrpc_call * call,struct rxrpc_txbuf * txb,struct skcipher_request * req)301 static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
302 				       struct rxrpc_txbuf *txb,
303 				       struct skcipher_request *req)
304 {
305 	const struct rxrpc_key_token *token;
306 	struct rxkad_level2_hdr *rxkhdr = txb->data;
307 	struct rxrpc_crypt iv;
308 	struct scatterlist sg;
309 	size_t content, pad;
310 	u16 check;
311 	int ret;
312 
313 	_enter("");
314 
315 	check = txb->seq ^ call->call_id;
316 
317 	rxkhdr->data_size = htonl(txb->len | (u32)check << 16);
318 	rxkhdr->checksum = 0;
319 
320 	content = sizeof(struct rxkad_level2_hdr) + txb->len;
321 	txb->pkt_len = round_up(content, RXKAD_ALIGN);
322 	pad = txb->pkt_len - content;
323 	if (pad)
324 		memset(txb->data + txb->offset, 0, pad);
325 
326 	/* encrypt from the session key */
327 	token = call->conn->key->payload.data[0];
328 	memcpy(&iv, token->kad->session_key, sizeof(iv));
329 
330 	sg_init_one(&sg, rxkhdr, txb->pkt_len);
331 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
332 	skcipher_request_set_callback(req, 0, NULL, NULL);
333 	skcipher_request_set_crypt(req, &sg, &sg, txb->pkt_len, iv.x);
334 	ret = crypto_skcipher_encrypt(req);
335 	skcipher_request_zero(req);
336 	return ret;
337 }
338 
339 /*
340  * checksum an RxRPC packet header
341  */
rxkad_secure_packet(struct rxrpc_call * call,struct rxrpc_txbuf * txb)342 static int rxkad_secure_packet(struct rxrpc_call *call, struct rxrpc_txbuf *txb)
343 {
344 	struct skcipher_request	*req;
345 	struct rxrpc_crypt iv;
346 	struct scatterlist sg;
347 	union {
348 		__be32 buf[2];
349 	} crypto __aligned(8);
350 	u32 x, y = 0;
351 	int ret;
352 
353 	_enter("{%d{%x}},{#%u},%u,",
354 	       call->debug_id, key_serial(call->conn->key),
355 	       txb->seq, txb->len);
356 
357 	if (!call->conn->rxkad.cipher)
358 		return 0;
359 
360 	ret = key_validate(call->conn->key);
361 	if (ret < 0)
362 		return ret;
363 
364 	req = rxkad_get_call_crypto(call);
365 	if (!req)
366 		return -ENOMEM;
367 
368 	/* continue encrypting from where we left off */
369 	memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv));
370 
371 	/* calculate the security checksum */
372 	x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
373 	x |= txb->seq & 0x3fffffff;
374 	crypto.buf[0] = htonl(call->call_id);
375 	crypto.buf[1] = htonl(x);
376 
377 	sg_init_one(&sg, crypto.buf, 8);
378 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
379 	skcipher_request_set_callback(req, 0, NULL, NULL);
380 	skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
381 	ret = crypto_skcipher_encrypt(req);
382 	skcipher_request_zero(req);
383 	if (ret < 0)
384 		goto out;
385 
386 	y = ntohl(crypto.buf[1]);
387 	y = (y >> 16) & 0xffff;
388 	if (y == 0)
389 		y = 1; /* zero checksums are not permitted */
390 	txb->cksum = htons(y);
391 
392 	switch (call->conn->security_level) {
393 	case RXRPC_SECURITY_PLAIN:
394 		txb->pkt_len = txb->len;
395 		ret = 0;
396 		break;
397 	case RXRPC_SECURITY_AUTH:
398 		ret = rxkad_secure_packet_auth(call, txb, req);
399 		if (txb->alloc_size == RXRPC_JUMBO_DATALEN)
400 			txb->jumboable = true;
401 		break;
402 	case RXRPC_SECURITY_ENCRYPT:
403 		ret = rxkad_secure_packet_encrypt(call, txb, req);
404 		if (txb->alloc_size == RXRPC_JUMBO_DATALEN)
405 			txb->jumboable = true;
406 		break;
407 	default:
408 		ret = -EPERM;
409 		break;
410 	}
411 
412 	/* Clear excess space in the packet */
413 	if (txb->pkt_len < txb->alloc_size) {
414 		size_t gap = txb->alloc_size - txb->pkt_len;
415 		void *p = txb->data;
416 
417 		memset(p + txb->pkt_len, 0, gap);
418 	}
419 
420 out:
421 	skcipher_request_free(req);
422 	_leave(" = %d [set %x]", ret, y);
423 	return ret;
424 }
425 
426 /*
427  * decrypt partial encryption on a packet (level 1 security)
428  */
rxkad_verify_packet_1(struct rxrpc_call * call,struct sk_buff * skb,rxrpc_seq_t seq,struct skcipher_request * req)429 static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
430 				 rxrpc_seq_t seq,
431 				 struct skcipher_request *req)
432 {
433 	struct rxkad_level1_hdr sechdr;
434 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
435 	struct rxrpc_crypt iv;
436 	struct scatterlist sg[16];
437 	u32 data_size, buf;
438 	u16 check;
439 	int ret;
440 
441 	_enter("");
442 
443 	if (sp->len < 8)
444 		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
445 					  rxkad_abort_1_short_header);
446 
447 	/* Decrypt the skbuff in-place.  TODO: We really want to decrypt
448 	 * directly into the target buffer.
449 	 */
450 	sg_init_table(sg, ARRAY_SIZE(sg));
451 	ret = skb_to_sgvec(skb, sg, sp->offset, 8);
452 	if (unlikely(ret < 0))
453 		return ret;
454 
455 	/* start the decryption afresh */
456 	memset(&iv, 0, sizeof(iv));
457 
458 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
459 	skcipher_request_set_callback(req, 0, NULL, NULL);
460 	skcipher_request_set_crypt(req, sg, sg, 8, iv.x);
461 	ret = crypto_skcipher_decrypt(req);
462 	skcipher_request_zero(req);
463 	if (ret < 0)
464 		return ret;
465 
466 	/* Extract the decrypted packet length */
467 	if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0)
468 		return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
469 					  rxkad_abort_1_short_encdata);
470 	sp->offset += sizeof(sechdr);
471 	sp->len    -= sizeof(sechdr);
472 
473 	buf = ntohl(sechdr.data_size);
474 	data_size = buf & 0xffff;
475 
476 	check = buf >> 16;
477 	check ^= seq ^ call->call_id;
478 	check &= 0xffff;
479 	if (check != 0)
480 		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
481 					  rxkad_abort_1_short_check);
482 	if (data_size > sp->len)
483 		return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
484 					  rxkad_abort_1_short_data);
485 	sp->len = data_size;
486 
487 	_leave(" = 0 [dlen=%x]", data_size);
488 	return 0;
489 }
490 
491 /*
492  * wholly decrypt a packet (level 2 security)
493  */
rxkad_verify_packet_2(struct rxrpc_call * call,struct sk_buff * skb,rxrpc_seq_t seq,struct skcipher_request * req)494 static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
495 				 rxrpc_seq_t seq,
496 				 struct skcipher_request *req)
497 {
498 	const struct rxrpc_key_token *token;
499 	struct rxkad_level2_hdr sechdr;
500 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
501 	struct rxrpc_crypt iv;
502 	struct scatterlist _sg[4], *sg;
503 	u32 data_size, buf;
504 	u16 check;
505 	int nsg, ret;
506 
507 	_enter(",{%d}", sp->len);
508 
509 	if (sp->len < 8)
510 		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
511 					  rxkad_abort_2_short_header);
512 
513 	/* Decrypt the skbuff in-place.  TODO: We really want to decrypt
514 	 * directly into the target buffer.
515 	 */
516 	sg = _sg;
517 	nsg = skb_shinfo(skb)->nr_frags + 1;
518 	if (nsg <= 4) {
519 		nsg = 4;
520 	} else {
521 		sg = kmalloc_objs(*sg, nsg, GFP_NOIO);
522 		if (!sg)
523 			return -ENOMEM;
524 	}
525 
526 	sg_init_table(sg, nsg);
527 	ret = skb_to_sgvec(skb, sg, sp->offset, sp->len);
528 	if (unlikely(ret < 0)) {
529 		if (sg != _sg)
530 			kfree(sg);
531 		return ret;
532 	}
533 
534 	/* decrypt from the session key */
535 	token = call->conn->key->payload.data[0];
536 	memcpy(&iv, token->kad->session_key, sizeof(iv));
537 
538 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
539 	skcipher_request_set_callback(req, 0, NULL, NULL);
540 	skcipher_request_set_crypt(req, sg, sg, sp->len, iv.x);
541 	ret = crypto_skcipher_decrypt(req);
542 	skcipher_request_zero(req);
543 	if (sg != _sg)
544 		kfree(sg);
545 	if (ret < 0) {
546 		WARN_ON_ONCE(ret != -ENOMEM);
547 		return ret;
548 	}
549 
550 	/* Extract the decrypted packet length */
551 	if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0)
552 		return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
553 					  rxkad_abort_2_short_len);
554 	sp->offset += sizeof(sechdr);
555 	sp->len    -= sizeof(sechdr);
556 
557 	buf = ntohl(sechdr.data_size);
558 	data_size = buf & 0xffff;
559 
560 	check = buf >> 16;
561 	check ^= seq ^ call->call_id;
562 	check &= 0xffff;
563 	if (check != 0)
564 		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
565 					  rxkad_abort_2_short_check);
566 
567 	if (data_size > sp->len)
568 		return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
569 					  rxkad_abort_2_short_data);
570 
571 	sp->len = data_size;
572 	_leave(" = 0 [dlen=%x]", data_size);
573 	return 0;
574 }
575 
576 /*
577  * Verify the security on a received packet and the subpackets therein.
578  */
rxkad_verify_packet(struct rxrpc_call * call,struct sk_buff * skb)579 static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb)
580 {
581 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
582 	struct skcipher_request	*req;
583 	struct rxrpc_crypt iv;
584 	struct scatterlist sg;
585 	union {
586 		__be32 buf[2];
587 	} crypto __aligned(8);
588 	rxrpc_seq_t seq = sp->hdr.seq;
589 	int ret;
590 	u16 cksum;
591 	u32 x, y;
592 
593 	_enter("{%d{%x}},{#%u}",
594 	       call->debug_id, key_serial(call->conn->key), seq);
595 
596 	if (!call->conn->rxkad.cipher)
597 		return 0;
598 
599 	req = rxkad_get_call_crypto(call);
600 	if (!req)
601 		return -ENOMEM;
602 
603 	/* continue encrypting from where we left off */
604 	memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv));
605 
606 	/* validate the security checksum */
607 	x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
608 	x |= seq & 0x3fffffff;
609 	crypto.buf[0] = htonl(call->call_id);
610 	crypto.buf[1] = htonl(x);
611 
612 	sg_init_one(&sg, crypto.buf, 8);
613 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
614 	skcipher_request_set_callback(req, 0, NULL, NULL);
615 	skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
616 	ret = crypto_skcipher_encrypt(req);
617 	skcipher_request_zero(req);
618 	if (ret < 0)
619 		goto out;
620 
621 	y = ntohl(crypto.buf[1]);
622 	cksum = (y >> 16) & 0xffff;
623 	if (cksum == 0)
624 		cksum = 1; /* zero checksums are not permitted */
625 
626 	if (cksum != sp->hdr.cksum) {
627 		ret = rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
628 					 rxkad_abort_bad_checksum);
629 		goto out;
630 	}
631 
632 	switch (call->conn->security_level) {
633 	case RXRPC_SECURITY_PLAIN:
634 		ret = 0;
635 		break;
636 	case RXRPC_SECURITY_AUTH:
637 		ret = rxkad_verify_packet_1(call, skb, seq, req);
638 		break;
639 	case RXRPC_SECURITY_ENCRYPT:
640 		ret = rxkad_verify_packet_2(call, skb, seq, req);
641 		break;
642 	default:
643 		ret = -ENOANO;
644 		break;
645 	}
646 
647 out:
648 	skcipher_request_free(req);
649 	return ret;
650 }
651 
652 /*
653  * issue a challenge
654  */
rxkad_issue_challenge(struct rxrpc_connection * conn)655 static int rxkad_issue_challenge(struct rxrpc_connection *conn)
656 {
657 	struct rxkad_challenge challenge;
658 	struct rxrpc_wire_header whdr;
659 	struct msghdr msg;
660 	struct kvec iov[2];
661 	size_t len;
662 	u32 serial;
663 	int ret;
664 
665 	_enter("{%d}", conn->debug_id);
666 
667 	get_random_bytes(&conn->rxkad.nonce, sizeof(conn->rxkad.nonce));
668 
669 	challenge.version	= htonl(2);
670 	challenge.nonce		= htonl(conn->rxkad.nonce);
671 	challenge.min_level	= htonl(0);
672 	challenge.__padding	= 0;
673 
674 	msg.msg_name	= &conn->peer->srx.transport;
675 	msg.msg_namelen	= conn->peer->srx.transport_len;
676 	msg.msg_control	= NULL;
677 	msg.msg_controllen = 0;
678 	msg.msg_flags	= 0;
679 
680 	whdr.epoch	= htonl(conn->proto.epoch);
681 	whdr.cid	= htonl(conn->proto.cid);
682 	whdr.callNumber	= 0;
683 	whdr.seq	= 0;
684 	whdr.type	= RXRPC_PACKET_TYPE_CHALLENGE;
685 	whdr.flags	= conn->out_clientflag;
686 	whdr.userStatus	= 0;
687 	whdr.securityIndex = conn->security_ix;
688 	whdr._rsvd	= 0;
689 	whdr.serviceId	= htons(conn->service_id);
690 
691 	iov[0].iov_base	= &whdr;
692 	iov[0].iov_len	= sizeof(whdr);
693 	iov[1].iov_base	= &challenge;
694 	iov[1].iov_len	= sizeof(challenge);
695 
696 	len = iov[0].iov_len + iov[1].iov_len;
697 
698 	serial = rxrpc_get_next_serial(conn);
699 	whdr.serial = htonl(serial);
700 
701 	trace_rxrpc_tx_challenge(conn, serial, 0, conn->rxkad.nonce);
702 
703 	ret = kernel_sendmsg(conn->local->socket, &msg, iov, 2, len);
704 	if (ret < 0) {
705 		trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
706 				    rxrpc_tx_point_rxkad_challenge);
707 		return -EAGAIN;
708 	}
709 
710 	rxrpc_peer_mark_tx(conn->peer);
711 	trace_rxrpc_tx_packet(conn->debug_id, &whdr,
712 			      rxrpc_tx_point_rxkad_challenge);
713 	_leave(" = 0");
714 	return 0;
715 }
716 
717 /*
718  * calculate the response checksum
719  */
rxkad_calc_response_checksum(struct rxkad_response * response)720 static void rxkad_calc_response_checksum(struct rxkad_response *response)
721 {
722 	u32 csum = 1000003;
723 	int loop;
724 	u8 *p = (u8 *) response;
725 
726 	for (loop = sizeof(*response); loop > 0; loop--)
727 		csum = csum * 0x10204081 + *p++;
728 
729 	response->encrypted.checksum = htonl(csum);
730 }
731 
732 /*
733  * encrypt the response packet
734  */
rxkad_encrypt_response(struct rxrpc_connection * conn,struct sk_buff * response,const struct rxkad_key * s2)735 static int rxkad_encrypt_response(struct rxrpc_connection *conn,
736 				  struct sk_buff *response,
737 				  const struct rxkad_key *s2)
738 {
739 	struct skcipher_request *req;
740 	struct rxrpc_crypt iv;
741 	struct scatterlist sg[1];
742 	size_t encsize = sizeof(((struct rxkad_response *)0)->encrypted);
743 	int ret;
744 
745 	sg_init_table(sg, ARRAY_SIZE(sg));
746 	ret = skb_to_sgvec(response, sg,
747 			   sizeof(struct rxrpc_wire_header) +
748 			   offsetof(struct rxkad_response, encrypted), encsize);
749 	if (ret < 0)
750 		return ret;
751 
752 	req = skcipher_request_alloc(&conn->rxkad.cipher->base, GFP_NOFS);
753 	if (!req)
754 		return -ENOMEM;
755 
756 	/* continue encrypting from where we left off */
757 	memcpy(&iv, s2->session_key, sizeof(iv));
758 
759 	skcipher_request_set_sync_tfm(req, conn->rxkad.cipher);
760 	skcipher_request_set_callback(req, 0, NULL, NULL);
761 	skcipher_request_set_crypt(req, sg, sg, encsize, iv.x);
762 	ret = crypto_skcipher_encrypt(req);
763 	skcipher_request_free(req);
764 	return ret;
765 }
766 
767 /*
768  * Validate a challenge packet.
769  */
rxkad_validate_challenge(struct rxrpc_connection * conn,struct sk_buff * skb)770 static bool rxkad_validate_challenge(struct rxrpc_connection *conn,
771 				     struct sk_buff *skb)
772 {
773 	struct rxkad_challenge challenge;
774 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
775 	u32 version, min_level;
776 	int ret;
777 
778 	_enter("{%d,%x}", conn->debug_id, key_serial(conn->key));
779 
780 	if (!conn->key) {
781 		rxrpc_abort_conn(conn, skb, RX_PROTOCOL_ERROR, -EPROTO,
782 				 rxkad_abort_chall_no_key);
783 		return false;
784 	}
785 
786 	ret = key_validate(conn->key);
787 	if (ret < 0) {
788 		rxrpc_abort_conn(conn, skb, RXKADEXPIRED, ret,
789 				 rxkad_abort_chall_key_expired);
790 		return false;
791 	}
792 
793 	if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
794 			  &challenge, sizeof(challenge)) < 0) {
795 		rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
796 				 rxkad_abort_chall_short);
797 		return false;
798 	}
799 
800 	version = ntohl(challenge.version);
801 	sp->chall.rxkad_nonce = ntohl(challenge.nonce);
802 	min_level = ntohl(challenge.min_level);
803 
804 	trace_rxrpc_rx_challenge(conn, sp->hdr.serial, version,
805 				 sp->chall.rxkad_nonce, min_level);
806 
807 	if (version != RXKAD_VERSION) {
808 		rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO,
809 				 rxkad_abort_chall_version);
810 		return false;
811 	}
812 
813 	if (conn->security_level < min_level) {
814 		rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EACCES,
815 				 rxkad_abort_chall_level);
816 		return false;
817 	}
818 	return true;
819 }
820 
821 /*
822  * Insert the header into the response.
823  */
824 static noinline
rxkad_insert_response_header(struct rxrpc_connection * conn,const struct rxrpc_key_token * token,struct sk_buff * challenge,struct sk_buff * response,size_t * offset)825 int rxkad_insert_response_header(struct rxrpc_connection *conn,
826 				 const struct rxrpc_key_token *token,
827 				 struct sk_buff *challenge,
828 				 struct sk_buff *response,
829 				 size_t *offset)
830 {
831 	struct rxrpc_skb_priv *csp = rxrpc_skb(challenge);
832 	struct {
833 		struct rxrpc_wire_header whdr;
834 		struct rxkad_response	resp;
835 	} h;
836 	int ret;
837 
838 	h.whdr.epoch			= htonl(conn->proto.epoch);
839 	h.whdr.cid			= htonl(conn->proto.cid);
840 	h.whdr.callNumber		= 0;
841 	h.whdr.serial			= 0;
842 	h.whdr.seq			= 0;
843 	h.whdr.type			= RXRPC_PACKET_TYPE_RESPONSE;
844 	h.whdr.flags			= conn->out_clientflag;
845 	h.whdr.userStatus		= 0;
846 	h.whdr.securityIndex		= conn->security_ix;
847 	h.whdr.cksum			= 0;
848 	h.whdr.serviceId		= htons(conn->service_id);
849 	h.resp.version			= htonl(RXKAD_VERSION);
850 	h.resp.__pad			= 0;
851 	h.resp.encrypted.epoch		= htonl(conn->proto.epoch);
852 	h.resp.encrypted.cid		= htonl(conn->proto.cid);
853 	h.resp.encrypted.checksum	= 0;
854 	h.resp.encrypted.securityIndex	= htonl(conn->security_ix);
855 	h.resp.encrypted.call_id[0]	= htonl(conn->channels[0].call_counter);
856 	h.resp.encrypted.call_id[1]	= htonl(conn->channels[1].call_counter);
857 	h.resp.encrypted.call_id[2]	= htonl(conn->channels[2].call_counter);
858 	h.resp.encrypted.call_id[3]	= htonl(conn->channels[3].call_counter);
859 	h.resp.encrypted.inc_nonce	= htonl(csp->chall.rxkad_nonce + 1);
860 	h.resp.encrypted.level		= htonl(conn->security_level);
861 	h.resp.kvno			= htonl(token->kad->kvno);
862 	h.resp.ticket_len		= htonl(token->kad->ticket_len);
863 
864 	rxkad_calc_response_checksum(&h.resp);
865 
866 	ret = skb_store_bits(response, *offset, &h, sizeof(h));
867 	*offset += sizeof(h);
868 	return ret;
869 }
870 
871 /*
872  * respond to a challenge packet
873  */
rxkad_respond_to_challenge(struct rxrpc_connection * conn,struct sk_buff * challenge)874 static int rxkad_respond_to_challenge(struct rxrpc_connection *conn,
875 				      struct sk_buff *challenge)
876 {
877 	const struct rxrpc_key_token *token;
878 	struct rxrpc_skb_priv *csp, *rsp;
879 	struct sk_buff *response;
880 	size_t len, offset = 0;
881 	int ret = -EPROTO;
882 
883 	_enter("{%d,%x}", conn->debug_id, key_serial(conn->key));
884 
885 	ret = key_validate(conn->key);
886 	if (ret < 0)
887 		return rxrpc_abort_conn(conn, challenge, RXKADEXPIRED, ret,
888 					rxkad_abort_chall_key_expired);
889 
890 	token = conn->key->payload.data[0];
891 
892 	/* build the response packet */
893 	len = sizeof(struct rxrpc_wire_header) +
894 		sizeof(struct rxkad_response) +
895 		token->kad->ticket_len;
896 
897 	response = alloc_skb_with_frags(0, len, 0, &ret, GFP_NOFS);
898 	if (!response)
899 		goto error;
900 	rxrpc_new_skb(response, rxrpc_skb_new_response_rxkad);
901 	response->len = len;
902 	response->data_len = len;
903 
904 	offset = 0;
905 	ret = rxkad_insert_response_header(conn, token, challenge, response,
906 					   &offset);
907 	if (ret < 0)
908 		goto error;
909 
910 	ret = rxkad_encrypt_response(conn, response, token->kad);
911 	if (ret < 0)
912 		goto error;
913 
914 	ret = skb_store_bits(response, offset, token->kad->ticket,
915 			     token->kad->ticket_len);
916 	if (ret < 0)
917 		goto error;
918 
919 	csp = rxrpc_skb(challenge);
920 	rsp = rxrpc_skb(response);
921 	rsp->resp.len = len;
922 	rsp->resp.challenge_serial = csp->hdr.serial;
923 	rxrpc_post_response(conn, response);
924 	response = NULL;
925 	ret = 0;
926 
927 error:
928 	rxrpc_free_skb(response, rxrpc_skb_put_response);
929 	return ret;
930 }
931 
932 /*
933  * RxKAD does automatic response only as there's nothing to manage that isn't
934  * already in the key.
935  */
rxkad_sendmsg_respond_to_challenge(struct sk_buff * challenge,struct msghdr * msg)936 static int rxkad_sendmsg_respond_to_challenge(struct sk_buff *challenge,
937 					      struct msghdr *msg)
938 {
939 	return -EINVAL;
940 }
941 
942 /**
943  * rxkad_kernel_respond_to_challenge - Respond to a challenge with appdata
944  * @challenge: The challenge to respond to
945  *
946  * Allow a kernel application to respond to a CHALLENGE.
947  *
948  * Return: %0 if successful and a negative error code otherwise.
949  */
rxkad_kernel_respond_to_challenge(struct sk_buff * challenge)950 int rxkad_kernel_respond_to_challenge(struct sk_buff *challenge)
951 {
952 	struct rxrpc_skb_priv *csp = rxrpc_skb(challenge);
953 
954 	return rxkad_respond_to_challenge(csp->chall.conn, challenge);
955 }
956 EXPORT_SYMBOL(rxkad_kernel_respond_to_challenge);
957 
958 /*
959  * decrypt the kerberos IV ticket in the response
960  */
rxkad_decrypt_ticket(struct rxrpc_connection * conn,struct key * server_key,struct sk_buff * skb,void * ticket,size_t ticket_len,struct rxrpc_crypt * _session_key,time64_t * _expiry)961 static int rxkad_decrypt_ticket(struct rxrpc_connection *conn,
962 				struct key *server_key,
963 				struct sk_buff *skb,
964 				void *ticket, size_t ticket_len,
965 				struct rxrpc_crypt *_session_key,
966 				time64_t *_expiry)
967 {
968 	struct skcipher_request *req;
969 	struct rxrpc_crypt iv, key;
970 	struct scatterlist sg[1];
971 	struct in_addr addr;
972 	unsigned int life;
973 	time64_t issue, now;
974 	int ret;
975 	bool little_endian;
976 	u8 *p, *q, *name, *end;
977 
978 	_enter("{%d},{%x}", conn->debug_id, key_serial(server_key));
979 
980 	*_expiry = 0;
981 
982 	ASSERT(server_key->payload.data[0] != NULL);
983 	ASSERTCMP((unsigned long) ticket & 7UL, ==, 0);
984 
985 	memcpy(&iv, &server_key->payload.data[2], sizeof(iv));
986 
987 	req = skcipher_request_alloc(server_key->payload.data[0], GFP_NOFS);
988 	if (!req)
989 		return -ENOMEM;
990 
991 	sg_init_one(&sg[0], ticket, ticket_len);
992 	skcipher_request_set_callback(req, 0, NULL, NULL);
993 	skcipher_request_set_crypt(req, sg, sg, ticket_len, iv.x);
994 	ret = crypto_skcipher_decrypt(req);
995 	skcipher_request_free(req);
996 	if (ret < 0)
997 		return rxrpc_abort_conn(conn, skb, RXKADBADTICKET, -EPROTO,
998 					rxkad_abort_resp_tkt_short);
999 
1000 	p = ticket;
1001 	end = p + ticket_len;
1002 
1003 #define Z(field, fieldl)						\
1004 	({								\
1005 		u8 *__str = p;						\
1006 		q = memchr(p, 0, end - p);				\
1007 		if (!q || q - p > field##_SZ)				\
1008 			return rxrpc_abort_conn(			\
1009 				conn, skb, RXKADBADTICKET, -EPROTO,	\
1010 				rxkad_abort_resp_tkt_##fieldl);		\
1011 		for (; p < q; p++)					\
1012 			if (!isprint(*p))				\
1013 				return rxrpc_abort_conn(		\
1014 					conn, skb, RXKADBADTICKET, -EPROTO, \
1015 					rxkad_abort_resp_tkt_##fieldl);	\
1016 		p++;							\
1017 		__str;							\
1018 	})
1019 
1020 	/* extract the ticket flags */
1021 	_debug("KIV FLAGS: %x", *p);
1022 	little_endian = *p & 1;
1023 	p++;
1024 
1025 	/* extract the authentication name */
1026 	name = Z(ANAME, aname);
1027 	_debug("KIV ANAME: %s", name);
1028 
1029 	/* extract the principal's instance */
1030 	name = Z(INST, inst);
1031 	_debug("KIV INST : %s", name);
1032 
1033 	/* extract the principal's authentication domain */
1034 	name = Z(REALM, realm);
1035 	_debug("KIV REALM: %s", name);
1036 
1037 	if (end - p < 4 + 8 + 4 + 2)
1038 		return rxrpc_abort_conn(conn, skb, RXKADBADTICKET, -EPROTO,
1039 					rxkad_abort_resp_tkt_short);
1040 
1041 	/* get the IPv4 address of the entity that requested the ticket */
1042 	memcpy(&addr, p, sizeof(addr));
1043 	p += 4;
1044 	_debug("KIV ADDR : %pI4", &addr);
1045 
1046 	/* get the session key from the ticket */
1047 	memcpy(&key, p, sizeof(key));
1048 	p += 8;
1049 	_debug("KIV KEY  : %08x %08x", ntohl(key.n[0]), ntohl(key.n[1]));
1050 	memcpy(_session_key, &key, sizeof(key));
1051 
1052 	/* get the ticket's lifetime */
1053 	life = *p++ * 5 * 60;
1054 	_debug("KIV LIFE : %u", life);
1055 
1056 	/* get the issue time of the ticket */
1057 	if (little_endian) {
1058 		__le32 stamp;
1059 		memcpy(&stamp, p, 4);
1060 		issue = rxrpc_u32_to_time64(le32_to_cpu(stamp));
1061 	} else {
1062 		__be32 stamp;
1063 		memcpy(&stamp, p, 4);
1064 		issue = rxrpc_u32_to_time64(be32_to_cpu(stamp));
1065 	}
1066 	p += 4;
1067 	now = ktime_get_real_seconds();
1068 	_debug("KIV ISSUE: %llx [%llx]", issue, now);
1069 
1070 	/* check the ticket is in date */
1071 	if (issue > now)
1072 		return rxrpc_abort_conn(conn, skb, RXKADNOAUTH, -EKEYREJECTED,
1073 					rxkad_abort_resp_tkt_future);
1074 	if (issue < now - life)
1075 		return rxrpc_abort_conn(conn, skb, RXKADEXPIRED, -EKEYEXPIRED,
1076 					rxkad_abort_resp_tkt_expired);
1077 
1078 	*_expiry = issue + life;
1079 
1080 	/* get the service name */
1081 	name = Z(SNAME, sname);
1082 	_debug("KIV SNAME: %s", name);
1083 
1084 	/* get the service instance name */
1085 	name = Z(INST, sinst);
1086 	_debug("KIV SINST: %s", name);
1087 	return 0;
1088 }
1089 
1090 /*
1091  * decrypt the response packet
1092  */
rxkad_decrypt_response(struct rxrpc_connection * conn,struct rxkad_response * resp,const struct rxrpc_crypt * session_key)1093 static int rxkad_decrypt_response(struct rxrpc_connection *conn,
1094 				  struct rxkad_response *resp,
1095 				  const struct rxrpc_crypt *session_key)
1096 {
1097 	struct skcipher_request *req = rxkad_ci_req;
1098 	struct scatterlist sg[1];
1099 	struct rxrpc_crypt iv;
1100 	int ret;
1101 
1102 	_enter(",,%08x%08x",
1103 	       ntohl(session_key->n[0]), ntohl(session_key->n[1]));
1104 
1105 	mutex_lock(&rxkad_ci_mutex);
1106 	ret = crypto_sync_skcipher_setkey(rxkad_ci, session_key->x,
1107 					  sizeof(*session_key));
1108 	if (ret < 0)
1109 		goto unlock;
1110 
1111 	memcpy(&iv, session_key, sizeof(iv));
1112 
1113 	sg_init_table(sg, 1);
1114 	sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted));
1115 	skcipher_request_set_sync_tfm(req, rxkad_ci);
1116 	skcipher_request_set_callback(req, 0, NULL, NULL);
1117 	skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x);
1118 	ret = crypto_skcipher_decrypt(req);
1119 	skcipher_request_zero(req);
1120 
1121 unlock:
1122 	mutex_unlock(&rxkad_ci_mutex);
1123 
1124 	_leave("");
1125 	return ret;
1126 }
1127 
1128 /*
1129  * verify a response
1130  */
rxkad_verify_response(struct rxrpc_connection * conn,struct sk_buff * skb)1131 static int rxkad_verify_response(struct rxrpc_connection *conn,
1132 				 struct sk_buff *skb)
1133 {
1134 	struct rxkad_response *response;
1135 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
1136 	struct rxrpc_crypt session_key;
1137 	struct key *server_key;
1138 	time64_t expiry;
1139 	void *ticket;
1140 	u32 version, kvno, ticket_len, level;
1141 	__be32 csum;
1142 	int ret, i;
1143 
1144 	_enter("{%d}", conn->debug_id);
1145 
1146 	server_key = rxrpc_look_up_server_security(conn, skb, 0, 0);
1147 	if (IS_ERR(server_key)) {
1148 		ret = PTR_ERR(server_key);
1149 		switch (ret) {
1150 		case -ENOKEY:
1151 			return rxrpc_abort_conn(conn, skb, RXKADUNKNOWNKEY, ret,
1152 						rxkad_abort_resp_nokey);
1153 		case -EKEYEXPIRED:
1154 			return rxrpc_abort_conn(conn, skb, RXKADEXPIRED, ret,
1155 						rxkad_abort_resp_key_expired);
1156 		default:
1157 			return rxrpc_abort_conn(conn, skb, RXKADNOAUTH, ret,
1158 						rxkad_abort_resp_key_rejected);
1159 		}
1160 	}
1161 
1162 	ret = -ENOMEM;
1163 	response = kzalloc_obj(struct rxkad_response, GFP_NOFS);
1164 	if (!response)
1165 		goto temporary_error;
1166 
1167 	if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
1168 			  response, sizeof(*response)) < 0) {
1169 		rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
1170 				 rxkad_abort_resp_short);
1171 		goto protocol_error;
1172 	}
1173 
1174 	version = ntohl(response->version);
1175 	ticket_len = ntohl(response->ticket_len);
1176 	kvno = ntohl(response->kvno);
1177 
1178 	trace_rxrpc_rx_response(conn, sp->hdr.serial, version, kvno, ticket_len);
1179 
1180 	if (version != RXKAD_VERSION) {
1181 		rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO,
1182 				 rxkad_abort_resp_version);
1183 		goto protocol_error;
1184 	}
1185 
1186 	if (ticket_len < 4 || ticket_len > MAXKRB5TICKETLEN) {
1187 		rxrpc_abort_conn(conn, skb, RXKADTICKETLEN, -EPROTO,
1188 				 rxkad_abort_resp_tkt_len);
1189 		goto protocol_error;
1190 	}
1191 
1192 	if (kvno >= RXKAD_TKT_TYPE_KERBEROS_V5) {
1193 		rxrpc_abort_conn(conn, skb, RXKADUNKNOWNKEY, -EPROTO,
1194 				 rxkad_abort_resp_unknown_tkt);
1195 		goto protocol_error;
1196 	}
1197 
1198 	/* extract the kerberos ticket and decrypt and decode it */
1199 	ret = -ENOMEM;
1200 	ticket = kmalloc(ticket_len, GFP_NOFS);
1201 	if (!ticket)
1202 		goto temporary_error_free_resp;
1203 
1204 	if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header) + sizeof(*response),
1205 			  ticket, ticket_len) < 0) {
1206 		rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
1207 				 rxkad_abort_resp_short_tkt);
1208 		goto protocol_error;
1209 	}
1210 
1211 	ret = rxkad_decrypt_ticket(conn, server_key, skb, ticket, ticket_len,
1212 				   &session_key, &expiry);
1213 	if (ret < 0)
1214 		goto temporary_error_free_ticket;
1215 
1216 	/* use the session key from inside the ticket to decrypt the
1217 	 * response */
1218 	ret = rxkad_decrypt_response(conn, response, &session_key);
1219 	if (ret < 0)
1220 		goto temporary_error_free_ticket;
1221 
1222 	if (ntohl(response->encrypted.epoch) != conn->proto.epoch ||
1223 	    ntohl(response->encrypted.cid) != conn->proto.cid ||
1224 	    ntohl(response->encrypted.securityIndex) != conn->security_ix) {
1225 		rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1226 				 rxkad_abort_resp_bad_param);
1227 		goto protocol_error_free;
1228 	}
1229 
1230 	csum = response->encrypted.checksum;
1231 	response->encrypted.checksum = 0;
1232 	rxkad_calc_response_checksum(response);
1233 	if (response->encrypted.checksum != csum) {
1234 		rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1235 				 rxkad_abort_resp_bad_checksum);
1236 		goto protocol_error_free;
1237 	}
1238 
1239 	for (i = 0; i < RXRPC_MAXCALLS; i++) {
1240 		u32 call_id = ntohl(response->encrypted.call_id[i]);
1241 		u32 counter = READ_ONCE(conn->channels[i].call_counter);
1242 
1243 		if (call_id > INT_MAX) {
1244 			rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1245 					 rxkad_abort_resp_bad_callid);
1246 			goto protocol_error_free;
1247 		}
1248 
1249 		if (call_id < counter) {
1250 			rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1251 					 rxkad_abort_resp_call_ctr);
1252 			goto protocol_error_free;
1253 		}
1254 
1255 		if (call_id > counter) {
1256 			if (conn->channels[i].call) {
1257 				rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1258 						 rxkad_abort_resp_call_state);
1259 				goto protocol_error_free;
1260 			}
1261 			conn->channels[i].call_counter = call_id;
1262 		}
1263 	}
1264 
1265 	if (ntohl(response->encrypted.inc_nonce) != conn->rxkad.nonce + 1) {
1266 		rxrpc_abort_conn(conn, skb, RXKADOUTOFSEQUENCE, -EPROTO,
1267 				 rxkad_abort_resp_ooseq);
1268 		goto protocol_error_free;
1269 	}
1270 
1271 	level = ntohl(response->encrypted.level);
1272 	if (level > RXRPC_SECURITY_ENCRYPT) {
1273 		rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EPROTO,
1274 				 rxkad_abort_resp_level);
1275 		goto protocol_error_free;
1276 	}
1277 	conn->security_level = level;
1278 
1279 	/* create a key to hold the security data and expiration time - after
1280 	 * this the connection security can be handled in exactly the same way
1281 	 * as for a client connection */
1282 	ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno);
1283 	if (ret < 0)
1284 		goto temporary_error_free_ticket;
1285 
1286 	kfree(ticket);
1287 	kfree(response);
1288 	_leave(" = 0");
1289 	return 0;
1290 
1291 protocol_error_free:
1292 	kfree(ticket);
1293 protocol_error:
1294 	kfree(response);
1295 	key_put(server_key);
1296 	return -EPROTO;
1297 
1298 temporary_error_free_ticket:
1299 	kfree(ticket);
1300 temporary_error_free_resp:
1301 	kfree(response);
1302 temporary_error:
1303 	/* Ignore the response packet if we got a temporary error such as
1304 	 * ENOMEM.  We just want to send the challenge again.  Note that we
1305 	 * also come out this way if the ticket decryption fails.
1306 	 */
1307 	key_put(server_key);
1308 	return ret;
1309 }
1310 
1311 /*
1312  * clear the connection security
1313  */
rxkad_clear(struct rxrpc_connection * conn)1314 static void rxkad_clear(struct rxrpc_connection *conn)
1315 {
1316 	_enter("");
1317 
1318 	if (conn->rxkad.cipher)
1319 		crypto_free_sync_skcipher(conn->rxkad.cipher);
1320 }
1321 
1322 /*
1323  * Initialise the rxkad security service.
1324  */
rxkad_init(void)1325 static int rxkad_init(void)
1326 {
1327 	struct crypto_sync_skcipher *tfm;
1328 	struct skcipher_request *req;
1329 
1330 	/* pin the cipher we need so that the crypto layer doesn't invoke
1331 	 * keventd to go get it */
1332 	tfm = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);
1333 	if (IS_ERR(tfm))
1334 		return PTR_ERR(tfm);
1335 
1336 	req = skcipher_request_alloc(&tfm->base, GFP_KERNEL);
1337 	if (!req)
1338 		goto nomem_tfm;
1339 
1340 	rxkad_ci_req = req;
1341 	rxkad_ci = tfm;
1342 	return 0;
1343 
1344 nomem_tfm:
1345 	crypto_free_sync_skcipher(tfm);
1346 	return -ENOMEM;
1347 }
1348 
1349 /*
1350  * Clean up the rxkad security service.
1351  */
rxkad_exit(void)1352 static void rxkad_exit(void)
1353 {
1354 	crypto_free_sync_skcipher(rxkad_ci);
1355 	skcipher_request_free(rxkad_ci_req);
1356 }
1357 
1358 /*
1359  * RxRPC Kerberos-based security
1360  */
1361 const struct rxrpc_security rxkad = {
1362 	.name				= "rxkad",
1363 	.security_index			= RXRPC_SECURITY_RXKAD,
1364 	.no_key_abort			= RXKADUNKNOWNKEY,
1365 	.init				= rxkad_init,
1366 	.exit				= rxkad_exit,
1367 	.preparse_server_key		= rxkad_preparse_server_key,
1368 	.free_preparse_server_key	= rxkad_free_preparse_server_key,
1369 	.destroy_server_key		= rxkad_destroy_server_key,
1370 	.init_connection_security	= rxkad_init_connection_security,
1371 	.alloc_txbuf			= rxkad_alloc_txbuf,
1372 	.secure_packet			= rxkad_secure_packet,
1373 	.verify_packet			= rxkad_verify_packet,
1374 	.free_call_crypto		= rxkad_free_call_crypto,
1375 	.issue_challenge		= rxkad_issue_challenge,
1376 	.validate_challenge		= rxkad_validate_challenge,
1377 	.sendmsg_respond_to_challenge	= rxkad_sendmsg_respond_to_challenge,
1378 	.respond_to_challenge		= rxkad_respond_to_challenge,
1379 	.verify_response		= rxkad_verify_response,
1380 	.clear				= rxkad_clear,
1381 };
1382