xref: /linux/net/rxrpc/rxkad.c (revision 68993ced0f618e36cf33388f1e50223e5e6e78cc)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* Kerberos-based RxRPC security
3  *
4  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
5  * Written by David Howells (dhowells@redhat.com)
6  */
7 
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 
10 #include <crypto/skcipher.h>
11 #include <linux/module.h>
12 #include <linux/net.h>
13 #include <linux/skbuff.h>
14 #include <linux/udp.h>
15 #include <linux/scatterlist.h>
16 #include <linux/ctype.h>
17 #include <linux/slab.h>
18 #include <linux/key-type.h>
19 #include <net/sock.h>
20 #include <net/af_rxrpc.h>
21 #include <keys/rxrpc-type.h>
22 #include "ar-internal.h"
23 
24 #define RXKAD_VERSION			2
25 #define MAXKRB5TICKETLEN		1024
26 #define RXKAD_TKT_TYPE_KERBEROS_V5	256
27 #define ANAME_SZ			40	/* size of authentication name */
28 #define INST_SZ				40	/* size of principal's instance */
29 #define REALM_SZ			40	/* size of principal's auth domain */
30 #define SNAME_SZ			40	/* size of service name */
31 #define RXKAD_ALIGN			8
32 
33 struct rxkad_level1_hdr {
34 	__be32	data_size;	/* true data size (excluding padding) */
35 };
36 
37 struct rxkad_level2_hdr {
38 	__be32	data_size;	/* true data size (excluding padding) */
39 	__be32	checksum;	/* decrypted data checksum */
40 };
41 
42 static int rxkad_prime_packet_security(struct rxrpc_connection *conn,
43 				       struct crypto_sync_skcipher *ci);
44 
45 /*
46  * this holds a pinned cipher so that keventd doesn't get called by the cipher
47  * alloc routine, but since we have it to hand, we use it to decrypt RESPONSE
48  * packets
49  */
50 static struct crypto_sync_skcipher *rxkad_ci;
51 static struct skcipher_request *rxkad_ci_req;
52 static DEFINE_MUTEX(rxkad_ci_mutex);
53 
54 /*
55  * Parse the information from a server key
56  *
57  * The data should be the 8-byte secret key.
58  */
rxkad_preparse_server_key(struct key_preparsed_payload * prep)59 static int rxkad_preparse_server_key(struct key_preparsed_payload *prep)
60 {
61 	struct crypto_skcipher *ci;
62 
63 	if (prep->datalen != 8)
64 		return -EINVAL;
65 
66 	memcpy(&prep->payload.data[2], prep->data, 8);
67 
68 	ci = crypto_alloc_skcipher("pcbc(des)", 0, CRYPTO_ALG_ASYNC);
69 	if (IS_ERR(ci)) {
70 		_leave(" = %ld", PTR_ERR(ci));
71 		return PTR_ERR(ci);
72 	}
73 
74 	if (crypto_skcipher_setkey(ci, prep->data, 8) < 0)
75 		BUG();
76 
77 	prep->payload.data[0] = ci;
78 	_leave(" = 0");
79 	return 0;
80 }
81 
rxkad_free_preparse_server_key(struct key_preparsed_payload * prep)82 static void rxkad_free_preparse_server_key(struct key_preparsed_payload *prep)
83 {
84 
85 	if (prep->payload.data[0])
86 		crypto_free_skcipher(prep->payload.data[0]);
87 }
88 
rxkad_destroy_server_key(struct key * key)89 static void rxkad_destroy_server_key(struct key *key)
90 {
91 	if (key->payload.data[0]) {
92 		crypto_free_skcipher(key->payload.data[0]);
93 		key->payload.data[0] = NULL;
94 	}
95 }
96 
97 /*
98  * initialise connection security
99  */
rxkad_init_connection_security(struct rxrpc_connection * conn,struct rxrpc_key_token * token)100 static int rxkad_init_connection_security(struct rxrpc_connection *conn,
101 					  struct rxrpc_key_token *token)
102 {
103 	struct crypto_sync_skcipher *ci;
104 	int ret;
105 
106 	_enter("{%d},{%x}", conn->debug_id, key_serial(conn->key));
107 
108 	conn->security_ix = token->security_index;
109 
110 	ci = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);
111 	if (IS_ERR(ci)) {
112 		_debug("no cipher");
113 		ret = PTR_ERR(ci);
114 		goto error;
115 	}
116 
117 	if (crypto_sync_skcipher_setkey(ci, token->kad->session_key,
118 				   sizeof(token->kad->session_key)) < 0)
119 		BUG();
120 
121 	switch (conn->security_level) {
122 	case RXRPC_SECURITY_PLAIN:
123 	case RXRPC_SECURITY_AUTH:
124 	case RXRPC_SECURITY_ENCRYPT:
125 		break;
126 	default:
127 		ret = -EKEYREJECTED;
128 		goto error;
129 	}
130 
131 	ret = rxkad_prime_packet_security(conn, ci);
132 	if (ret < 0)
133 		goto error_ci;
134 
135 	conn->rxkad.cipher = ci;
136 	return 0;
137 
138 error_ci:
139 	crypto_free_sync_skcipher(ci);
140 error:
141 	_leave(" = %d", ret);
142 	return ret;
143 }
144 
145 /*
146  * Work out how much data we can put in a packet.
147  */
rxkad_alloc_txbuf(struct rxrpc_call * call,size_t remain,gfp_t gfp)148 static struct rxrpc_txbuf *rxkad_alloc_txbuf(struct rxrpc_call *call, size_t remain, gfp_t gfp)
149 {
150 	struct rxrpc_txbuf *txb;
151 	size_t shdr, alloc, limit, part;
152 
153 	remain = umin(remain, 65535 - sizeof(struct rxrpc_wire_header));
154 
155 	switch (call->conn->security_level) {
156 	default:
157 		alloc = umin(remain, RXRPC_JUMBO_DATALEN);
158 		return rxrpc_alloc_data_txbuf(call, alloc, 1, gfp);
159 	case RXRPC_SECURITY_AUTH:
160 		shdr = sizeof(struct rxkad_level1_hdr);
161 		break;
162 	case RXRPC_SECURITY_ENCRYPT:
163 		shdr = sizeof(struct rxkad_level2_hdr);
164 		break;
165 	}
166 
167 	limit = round_down(RXRPC_JUMBO_DATALEN, RXKAD_ALIGN) - shdr;
168 	if (remain < limit) {
169 		part = remain;
170 		alloc = round_up(shdr + part, RXKAD_ALIGN);
171 	} else {
172 		part = limit;
173 		alloc = RXRPC_JUMBO_DATALEN;
174 	}
175 
176 	txb = rxrpc_alloc_data_txbuf(call, alloc, RXKAD_ALIGN, gfp);
177 	if (!txb)
178 		return NULL;
179 
180 	txb->crypto_header	= 0;
181 	txb->sec_header		= shdr;
182 	txb->offset		+= shdr;
183 	txb->space		= part;
184 	return txb;
185 }
186 
187 /*
188  * prime the encryption state with the invariant parts of a connection's
189  * description
190  */
rxkad_prime_packet_security(struct rxrpc_connection * conn,struct crypto_sync_skcipher * ci)191 static int rxkad_prime_packet_security(struct rxrpc_connection *conn,
192 				       struct crypto_sync_skcipher *ci)
193 {
194 	struct skcipher_request *req;
195 	struct rxrpc_key_token *token;
196 	struct scatterlist sg;
197 	struct rxrpc_crypt iv;
198 	__be32 *tmpbuf;
199 	size_t tmpsize = 4 * sizeof(__be32);
200 	int ret;
201 
202 	_enter("");
203 
204 	if (!conn->key)
205 		return 0;
206 
207 	tmpbuf = kmalloc(tmpsize, GFP_KERNEL);
208 	if (!tmpbuf)
209 		return -ENOMEM;
210 
211 	req = skcipher_request_alloc(&ci->base, GFP_NOFS);
212 	if (!req) {
213 		kfree(tmpbuf);
214 		return -ENOMEM;
215 	}
216 
217 	token = conn->key->payload.data[0];
218 	memcpy(&iv, token->kad->session_key, sizeof(iv));
219 
220 	tmpbuf[0] = htonl(conn->proto.epoch);
221 	tmpbuf[1] = htonl(conn->proto.cid);
222 	tmpbuf[2] = 0;
223 	tmpbuf[3] = htonl(conn->security_ix);
224 
225 	sg_init_one(&sg, tmpbuf, tmpsize);
226 	skcipher_request_set_sync_tfm(req, ci);
227 	skcipher_request_set_callback(req, 0, NULL, NULL);
228 	skcipher_request_set_crypt(req, &sg, &sg, tmpsize, iv.x);
229 	ret = crypto_skcipher_encrypt(req);
230 	skcipher_request_free(req);
231 
232 	memcpy(&conn->rxkad.csum_iv, tmpbuf + 2, sizeof(conn->rxkad.csum_iv));
233 	kfree(tmpbuf);
234 	_leave(" = %d", ret);
235 	return ret;
236 }
237 
238 /*
239  * Allocate and prepare the crypto request on a call.  For any particular call,
240  * this is called serially for the packets, so no lock should be necessary.
241  */
rxkad_get_call_crypto(struct rxrpc_call * call)242 static struct skcipher_request *rxkad_get_call_crypto(struct rxrpc_call *call)
243 {
244 	struct crypto_skcipher *tfm = &call->conn->rxkad.cipher->base;
245 
246 	return skcipher_request_alloc(tfm, GFP_NOFS);
247 }
248 
249 /*
250  * Clean up the crypto on a call.
251  */
rxkad_free_call_crypto(struct rxrpc_call * call)252 static void rxkad_free_call_crypto(struct rxrpc_call *call)
253 {
254 }
255 
256 /*
257  * partially encrypt a packet (level 1 security)
258  */
rxkad_secure_packet_auth(const struct rxrpc_call * call,struct rxrpc_txbuf * txb,struct skcipher_request * req)259 static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
260 				    struct rxrpc_txbuf *txb,
261 				    struct skcipher_request *req)
262 {
263 	struct rxkad_level1_hdr *hdr = txb->data;
264 	struct rxrpc_crypt iv;
265 	struct scatterlist sg;
266 	size_t pad;
267 	u16 check;
268 	int ret;
269 
270 	_enter("");
271 
272 	check = txb->seq ^ call->call_id;
273 	hdr->data_size = htonl((u32)check << 16 | txb->len);
274 
275 	txb->pkt_len = sizeof(struct rxkad_level1_hdr) + txb->len;
276 	pad = txb->pkt_len;
277 	pad = RXKAD_ALIGN - pad;
278 	pad &= RXKAD_ALIGN - 1;
279 	if (pad) {
280 		memset(txb->data + txb->offset, 0, pad);
281 		txb->pkt_len += pad;
282 	}
283 
284 	/* start the encryption afresh */
285 	memset(&iv, 0, sizeof(iv));
286 
287 	sg_init_one(&sg, hdr, 8);
288 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
289 	skcipher_request_set_callback(req, 0, NULL, NULL);
290 	skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
291 	ret = crypto_skcipher_encrypt(req);
292 	skcipher_request_zero(req);
293 
294 	_leave(" = %d", ret);
295 	return ret;
296 }
297 
298 /*
299  * wholly encrypt a packet (level 2 security)
300  */
rxkad_secure_packet_encrypt(const struct rxrpc_call * call,struct rxrpc_txbuf * txb,struct skcipher_request * req)301 static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
302 				       struct rxrpc_txbuf *txb,
303 				       struct skcipher_request *req)
304 {
305 	const struct rxrpc_key_token *token;
306 	struct rxkad_level2_hdr *rxkhdr = txb->data;
307 	struct rxrpc_crypt iv;
308 	struct scatterlist sg;
309 	size_t content, pad;
310 	u16 check;
311 	int ret;
312 
313 	_enter("");
314 
315 	check = txb->seq ^ call->call_id;
316 
317 	rxkhdr->data_size = htonl(txb->len | (u32)check << 16);
318 	rxkhdr->checksum = 0;
319 
320 	content = sizeof(struct rxkad_level2_hdr) + txb->len;
321 	txb->pkt_len = round_up(content, RXKAD_ALIGN);
322 	pad = txb->pkt_len - content;
323 	if (pad)
324 		memset(txb->data + txb->offset, 0, pad);
325 
326 	/* encrypt from the session key */
327 	token = call->conn->key->payload.data[0];
328 	memcpy(&iv, token->kad->session_key, sizeof(iv));
329 
330 	sg_init_one(&sg, rxkhdr, txb->pkt_len);
331 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
332 	skcipher_request_set_callback(req, 0, NULL, NULL);
333 	skcipher_request_set_crypt(req, &sg, &sg, txb->pkt_len, iv.x);
334 	ret = crypto_skcipher_encrypt(req);
335 	skcipher_request_zero(req);
336 	return ret;
337 }
338 
339 /*
340  * checksum an RxRPC packet header
341  */
rxkad_secure_packet(struct rxrpc_call * call,struct rxrpc_txbuf * txb)342 static int rxkad_secure_packet(struct rxrpc_call *call, struct rxrpc_txbuf *txb)
343 {
344 	struct skcipher_request	*req;
345 	struct rxrpc_crypt iv;
346 	struct scatterlist sg;
347 	union {
348 		__be32 buf[2];
349 	} crypto __aligned(8);
350 	u32 x, y = 0;
351 	int ret;
352 
353 	_enter("{%d{%x}},{#%u},%u,",
354 	       call->debug_id, key_serial(call->conn->key),
355 	       txb->seq, txb->len);
356 
357 	if (!call->conn->rxkad.cipher)
358 		return 0;
359 
360 	ret = key_validate(call->conn->key);
361 	if (ret < 0)
362 		return ret;
363 
364 	req = rxkad_get_call_crypto(call);
365 	if (!req)
366 		return -ENOMEM;
367 
368 	/* continue encrypting from where we left off */
369 	memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv));
370 
371 	/* calculate the security checksum */
372 	x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
373 	x |= txb->seq & 0x3fffffff;
374 	crypto.buf[0] = htonl(call->call_id);
375 	crypto.buf[1] = htonl(x);
376 
377 	sg_init_one(&sg, crypto.buf, 8);
378 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
379 	skcipher_request_set_callback(req, 0, NULL, NULL);
380 	skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
381 	ret = crypto_skcipher_encrypt(req);
382 	skcipher_request_zero(req);
383 	if (ret < 0)
384 		goto out;
385 
386 	y = ntohl(crypto.buf[1]);
387 	y = (y >> 16) & 0xffff;
388 	if (y == 0)
389 		y = 1; /* zero checksums are not permitted */
390 	txb->cksum = htons(y);
391 
392 	switch (call->conn->security_level) {
393 	case RXRPC_SECURITY_PLAIN:
394 		txb->pkt_len = txb->len;
395 		ret = 0;
396 		break;
397 	case RXRPC_SECURITY_AUTH:
398 		ret = rxkad_secure_packet_auth(call, txb, req);
399 		if (txb->alloc_size == RXRPC_JUMBO_DATALEN)
400 			txb->jumboable = true;
401 		break;
402 	case RXRPC_SECURITY_ENCRYPT:
403 		ret = rxkad_secure_packet_encrypt(call, txb, req);
404 		if (txb->alloc_size == RXRPC_JUMBO_DATALEN)
405 			txb->jumboable = true;
406 		break;
407 	default:
408 		ret = -EPERM;
409 		break;
410 	}
411 
412 	/* Clear excess space in the packet */
413 	if (txb->pkt_len < txb->alloc_size) {
414 		size_t gap = txb->alloc_size - txb->pkt_len;
415 		void *p = txb->data;
416 
417 		memset(p + txb->pkt_len, 0, gap);
418 	}
419 
420 out:
421 	skcipher_request_free(req);
422 	_leave(" = %d [set %x]", ret, y);
423 	return ret;
424 }
425 
426 /*
427  * decrypt partial encryption on a packet (level 1 security)
428  */
rxkad_verify_packet_1(struct rxrpc_call * call,struct sk_buff * skb,rxrpc_seq_t seq,struct skcipher_request * req)429 static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
430 				 rxrpc_seq_t seq,
431 				 struct skcipher_request *req)
432 {
433 	struct rxkad_level1_hdr *sechdr;
434 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
435 	struct rxrpc_crypt iv;
436 	struct scatterlist sg[1];
437 	void *data = call->rx_dec_buffer;
438 	u32 len = sp->len, data_size, buf;
439 	u16 check;
440 	int ret;
441 
442 	_enter("");
443 
444 	if (len < 8)
445 		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
446 					  rxkad_abort_1_short_header);
447 
448 	/* Decrypt the skbuff in-place.  TODO: We really want to decrypt
449 	 * directly into the target buffer.
450 	 */
451 	sg_init_one(sg, data, len);
452 
453 	/* start the decryption afresh */
454 	memset(&iv, 0, sizeof(iv));
455 
456 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
457 	skcipher_request_set_callback(req, 0, NULL, NULL);
458 	skcipher_request_set_crypt(req, sg, sg, 8, iv.x);
459 	ret = crypto_skcipher_decrypt(req);
460 	skcipher_request_zero(req);
461 	if (ret < 0)
462 		return ret;
463 
464 	/* Extract the decrypted packet length */
465 	sechdr = data;
466 	call->rx_dec_offset = sizeof(*sechdr);
467 	len -= sizeof(*sechdr);
468 
469 	buf = ntohl(sechdr->data_size);
470 	data_size = buf & 0xffff;
471 
472 	check = buf >> 16;
473 	check ^= seq ^ call->call_id;
474 	check &= 0xffff;
475 	if (check != 0)
476 		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
477 					  rxkad_abort_1_short_check);
478 	if (data_size > len)
479 		return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
480 					  rxkad_abort_1_short_data);
481 	call->rx_dec_len = data_size;
482 
483 	_leave(" = 0 [dlen=%x]", data_size);
484 	return 0;
485 }
486 
487 /*
488  * wholly decrypt a packet (level 2 security)
489  */
rxkad_verify_packet_2(struct rxrpc_call * call,struct sk_buff * skb,rxrpc_seq_t seq,struct skcipher_request * req)490 static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
491 				 rxrpc_seq_t seq,
492 				 struct skcipher_request *req)
493 {
494 	const struct rxrpc_key_token *token;
495 	struct rxkad_level2_hdr *sechdr;
496 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
497 	struct rxrpc_crypt iv;
498 	struct scatterlist sg[1];
499 	void *data = call->rx_dec_buffer;
500 	u32 len = sp->len, data_size, buf;
501 	u16 check;
502 	int ret;
503 
504 	_enter(",{%d}", len);
505 
506 	if (len < 8)
507 		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
508 					  rxkad_abort_2_short_header);
509 
510 	/* Don't let the crypto algo see a misaligned length. */
511 	len = round_down(len, 8);
512 
513 	/* Decrypt in place in the call's decryption buffer.  TODO: We really
514 	 * want to decrypt directly into the target buffer.
515 	 */
516 	sg_init_one(sg, data, len);
517 
518 	/* decrypt from the session key */
519 	token = call->conn->key->payload.data[0];
520 	memcpy(&iv, token->kad->session_key, sizeof(iv));
521 
522 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
523 	skcipher_request_set_callback(req, 0, NULL, NULL);
524 	skcipher_request_set_crypt(req, sg, sg, len, iv.x);
525 	ret = crypto_skcipher_decrypt(req);
526 	skcipher_request_zero(req);
527 	if (ret < 0) {
528 		if (ret == -ENOMEM)
529 			return ret;
530 		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
531 					  rxkad_abort_2_crypto_unaligned);
532 	}
533 
534 	/* Extract the decrypted packet length */
535 	sechdr = data;
536 	call->rx_dec_offset = sizeof(*sechdr);
537 	len -= sizeof(*sechdr);
538 
539 	buf = ntohl(sechdr->data_size);
540 	data_size = buf & 0xffff;
541 
542 	check = buf >> 16;
543 	check ^= seq ^ call->call_id;
544 	check &= 0xffff;
545 	if (check != 0)
546 		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
547 					  rxkad_abort_2_short_check);
548 
549 	if (data_size > len)
550 		return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
551 					  rxkad_abort_2_short_data);
552 
553 	call->rx_dec_len = data_size;
554 	_leave(" = 0 [dlen=%x]", data_size);
555 	return 0;
556 }
557 
558 /*
559  * Verify the security on a received (sub)packet.  If the packet needs
560  * modifying (e.g. decrypting), it must be copied.
561  */
rxkad_verify_packet(struct rxrpc_call * call,struct sk_buff * skb)562 static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb)
563 {
564 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
565 	struct skcipher_request	*req;
566 	struct rxrpc_crypt iv;
567 	struct scatterlist sg;
568 	union {
569 		__be32 buf[2];
570 	} crypto __aligned(8);
571 	rxrpc_seq_t seq = sp->hdr.seq;
572 	int ret;
573 	u16 cksum;
574 	u32 x, y;
575 
576 	_enter("{%d{%x}},{#%u}",
577 	       call->debug_id, key_serial(call->conn->key), seq);
578 
579 	if (!call->conn->rxkad.cipher)
580 		return 0;
581 
582 	req = rxkad_get_call_crypto(call);
583 	if (!req)
584 		return -ENOMEM;
585 
586 	/* continue encrypting from where we left off */
587 	memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv));
588 
589 	/* validate the security checksum */
590 	x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
591 	x |= seq & 0x3fffffff;
592 	crypto.buf[0] = htonl(call->call_id);
593 	crypto.buf[1] = htonl(x);
594 
595 	sg_init_one(&sg, crypto.buf, 8);
596 	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
597 	skcipher_request_set_callback(req, 0, NULL, NULL);
598 	skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
599 	ret = crypto_skcipher_encrypt(req);
600 	skcipher_request_zero(req);
601 	if (ret < 0)
602 		goto out;
603 
604 	y = ntohl(crypto.buf[1]);
605 	cksum = (y >> 16) & 0xffff;
606 	if (cksum == 0)
607 		cksum = 1; /* zero checksums are not permitted */
608 
609 	if (cksum != sp->hdr.cksum) {
610 		ret = rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
611 					 rxkad_abort_bad_checksum);
612 		goto out;
613 	}
614 
615 	switch (call->conn->security_level) {
616 	case RXRPC_SECURITY_PLAIN:
617 		ret = 0;
618 		break;
619 	case RXRPC_SECURITY_AUTH:
620 		ret = rxkad_verify_packet_1(call, skb, seq, req);
621 		break;
622 	case RXRPC_SECURITY_ENCRYPT:
623 		ret = rxkad_verify_packet_2(call, skb, seq, req);
624 		break;
625 	default:
626 		ret = -ENOANO;
627 		break;
628 	}
629 
630 out:
631 	skcipher_request_free(req);
632 	return ret;
633 }
634 
635 /*
636  * issue a challenge
637  */
rxkad_issue_challenge(struct rxrpc_connection * conn)638 static int rxkad_issue_challenge(struct rxrpc_connection *conn)
639 {
640 	struct rxkad_challenge challenge;
641 	struct rxrpc_wire_header whdr;
642 	struct msghdr msg;
643 	struct kvec iov[2];
644 	size_t len;
645 	u32 serial;
646 	int ret;
647 
648 	_enter("{%d}", conn->debug_id);
649 
650 	get_random_bytes(&conn->rxkad.nonce, sizeof(conn->rxkad.nonce));
651 
652 	challenge.version	= htonl(2);
653 	challenge.nonce		= htonl(conn->rxkad.nonce);
654 	challenge.min_level	= htonl(0);
655 	challenge.__padding	= 0;
656 
657 	msg.msg_name	= &conn->peer->srx.transport;
658 	msg.msg_namelen	= conn->peer->srx.transport_len;
659 	msg.msg_control	= NULL;
660 	msg.msg_controllen = 0;
661 	msg.msg_flags	= 0;
662 
663 	whdr.epoch	= htonl(conn->proto.epoch);
664 	whdr.cid	= htonl(conn->proto.cid);
665 	whdr.callNumber	= 0;
666 	whdr.seq	= 0;
667 	whdr.type	= RXRPC_PACKET_TYPE_CHALLENGE;
668 	whdr.flags	= conn->out_clientflag;
669 	whdr.userStatus	= 0;
670 	whdr.securityIndex = conn->security_ix;
671 	whdr._rsvd	= 0;
672 	whdr.serviceId	= htons(conn->service_id);
673 
674 	iov[0].iov_base	= &whdr;
675 	iov[0].iov_len	= sizeof(whdr);
676 	iov[1].iov_base	= &challenge;
677 	iov[1].iov_len	= sizeof(challenge);
678 
679 	len = iov[0].iov_len + iov[1].iov_len;
680 
681 	serial = rxrpc_get_next_serial(conn);
682 	whdr.serial = htonl(serial);
683 
684 	trace_rxrpc_tx_challenge(conn, serial, 0, conn->rxkad.nonce);
685 
686 	ret = kernel_sendmsg(conn->local->socket, &msg, iov, 2, len);
687 	if (ret < 0) {
688 		trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
689 				    rxrpc_tx_point_rxkad_challenge);
690 		return -EAGAIN;
691 	}
692 
693 	rxrpc_peer_mark_tx(conn->peer);
694 	trace_rxrpc_tx_packet(conn->debug_id, &whdr,
695 			      rxrpc_tx_point_rxkad_challenge);
696 	_leave(" = 0");
697 	return 0;
698 }
699 
700 /*
701  * calculate the response checksum
702  */
rxkad_calc_response_checksum(struct rxkad_response * response)703 static void rxkad_calc_response_checksum(struct rxkad_response *response)
704 {
705 	u32 csum = 1000003;
706 	int loop;
707 	u8 *p = (u8 *) response;
708 
709 	for (loop = sizeof(*response); loop > 0; loop--)
710 		csum = csum * 0x10204081 + *p++;
711 
712 	response->encrypted.checksum = htonl(csum);
713 }
714 
715 /*
716  * encrypt the response packet
717  */
rxkad_encrypt_response(struct rxrpc_connection * conn,struct sk_buff * response,const struct rxkad_key * s2)718 static int rxkad_encrypt_response(struct rxrpc_connection *conn,
719 				  struct sk_buff *response,
720 				  const struct rxkad_key *s2)
721 {
722 	struct skcipher_request *req;
723 	struct rxrpc_crypt iv;
724 	struct scatterlist sg[1];
725 	size_t encsize = sizeof(((struct rxkad_response *)0)->encrypted);
726 	int ret;
727 
728 	sg_init_table(sg, ARRAY_SIZE(sg));
729 	ret = skb_to_sgvec(response, sg,
730 			   sizeof(struct rxrpc_wire_header) +
731 			   offsetof(struct rxkad_response, encrypted), encsize);
732 	if (ret < 0)
733 		return ret;
734 
735 	req = skcipher_request_alloc(&conn->rxkad.cipher->base, GFP_NOFS);
736 	if (!req)
737 		return -ENOMEM;
738 
739 	/* continue encrypting from where we left off */
740 	memcpy(&iv, s2->session_key, sizeof(iv));
741 
742 	skcipher_request_set_sync_tfm(req, conn->rxkad.cipher);
743 	skcipher_request_set_callback(req, 0, NULL, NULL);
744 	skcipher_request_set_crypt(req, sg, sg, encsize, iv.x);
745 	ret = crypto_skcipher_encrypt(req);
746 	skcipher_request_free(req);
747 	return ret;
748 }
749 
750 /*
751  * Validate a challenge packet.
752  */
rxkad_validate_challenge(struct rxrpc_connection * conn,struct sk_buff * skb)753 static bool rxkad_validate_challenge(struct rxrpc_connection *conn,
754 				     struct sk_buff *skb)
755 {
756 	struct rxkad_challenge challenge;
757 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
758 	u32 version, min_level;
759 	int ret;
760 
761 	_enter("{%d,%x}", conn->debug_id, key_serial(conn->key));
762 
763 	if (!conn->key) {
764 		rxrpc_abort_conn(conn, skb, RX_PROTOCOL_ERROR, -EPROTO,
765 				 rxkad_abort_chall_no_key);
766 		return false;
767 	}
768 
769 	ret = key_validate(conn->key);
770 	if (ret < 0) {
771 		rxrpc_abort_conn(conn, skb, RXKADEXPIRED, ret,
772 				 rxkad_abort_chall_key_expired);
773 		return false;
774 	}
775 
776 	if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
777 			  &challenge, sizeof(challenge)) < 0) {
778 		rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
779 				 rxkad_abort_chall_short);
780 		return false;
781 	}
782 
783 	version = ntohl(challenge.version);
784 	sp->chall.rxkad_nonce = ntohl(challenge.nonce);
785 	min_level = ntohl(challenge.min_level);
786 
787 	trace_rxrpc_rx_challenge(conn, sp->hdr.serial, version,
788 				 sp->chall.rxkad_nonce, min_level);
789 
790 	if (version != RXKAD_VERSION) {
791 		rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO,
792 				 rxkad_abort_chall_version);
793 		return false;
794 	}
795 
796 	if (conn->security_level < min_level) {
797 		rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EACCES,
798 				 rxkad_abort_chall_level);
799 		return false;
800 	}
801 	return true;
802 }
803 
804 /*
805  * Insert the header into the response.
806  */
807 static noinline
rxkad_insert_response_header(struct rxrpc_connection * conn,const struct rxrpc_key_token * token,struct sk_buff * challenge,struct sk_buff * response,size_t * offset)808 int rxkad_insert_response_header(struct rxrpc_connection *conn,
809 				 const struct rxrpc_key_token *token,
810 				 struct sk_buff *challenge,
811 				 struct sk_buff *response,
812 				 size_t *offset)
813 {
814 	struct rxrpc_skb_priv *csp = rxrpc_skb(challenge);
815 	struct {
816 		struct rxrpc_wire_header whdr;
817 		struct rxkad_response	resp;
818 	} h;
819 	int ret;
820 
821 	h.whdr.epoch			= htonl(conn->proto.epoch);
822 	h.whdr.cid			= htonl(conn->proto.cid);
823 	h.whdr.callNumber		= 0;
824 	h.whdr.serial			= 0;
825 	h.whdr.seq			= 0;
826 	h.whdr.type			= RXRPC_PACKET_TYPE_RESPONSE;
827 	h.whdr.flags			= conn->out_clientflag;
828 	h.whdr.userStatus		= 0;
829 	h.whdr.securityIndex		= conn->security_ix;
830 	h.whdr.cksum			= 0;
831 	h.whdr.serviceId		= htons(conn->service_id);
832 	h.resp.version			= htonl(RXKAD_VERSION);
833 	h.resp.__pad			= 0;
834 	h.resp.encrypted.epoch		= htonl(conn->proto.epoch);
835 	h.resp.encrypted.cid		= htonl(conn->proto.cid);
836 	h.resp.encrypted.checksum	= 0;
837 	h.resp.encrypted.securityIndex	= htonl(conn->security_ix);
838 	h.resp.encrypted.call_id[0]	= htonl(conn->channels[0].call_counter);
839 	h.resp.encrypted.call_id[1]	= htonl(conn->channels[1].call_counter);
840 	h.resp.encrypted.call_id[2]	= htonl(conn->channels[2].call_counter);
841 	h.resp.encrypted.call_id[3]	= htonl(conn->channels[3].call_counter);
842 	h.resp.encrypted.inc_nonce	= htonl(csp->chall.rxkad_nonce + 1);
843 	h.resp.encrypted.level		= htonl(conn->security_level);
844 	h.resp.kvno			= htonl(token->kad->kvno);
845 	h.resp.ticket_len		= htonl(token->kad->ticket_len);
846 
847 	rxkad_calc_response_checksum(&h.resp);
848 
849 	ret = skb_store_bits(response, *offset, &h, sizeof(h));
850 	*offset += sizeof(h);
851 	return ret;
852 }
853 
854 /*
855  * respond to a challenge packet
856  */
rxkad_respond_to_challenge(struct rxrpc_connection * conn,struct sk_buff * challenge)857 static int rxkad_respond_to_challenge(struct rxrpc_connection *conn,
858 				      struct sk_buff *challenge)
859 {
860 	const struct rxrpc_key_token *token;
861 	struct rxrpc_skb_priv *csp, *rsp;
862 	struct sk_buff *response;
863 	size_t len, offset = 0;
864 	int ret = -EPROTO;
865 
866 	_enter("{%d,%x}", conn->debug_id, key_serial(conn->key));
867 
868 	ret = key_validate(conn->key);
869 	if (ret < 0)
870 		return rxrpc_abort_conn(conn, challenge, RXKADEXPIRED, ret,
871 					rxkad_abort_chall_key_expired);
872 
873 	token = conn->key->payload.data[0];
874 
875 	/* build the response packet */
876 	len = sizeof(struct rxrpc_wire_header) +
877 		sizeof(struct rxkad_response) +
878 		token->kad->ticket_len;
879 
880 	response = alloc_skb_with_frags(0, len, 0, &ret, GFP_NOFS);
881 	if (!response)
882 		goto error;
883 	rxrpc_new_skb(response, rxrpc_skb_new_response_rxkad);
884 	response->len = len;
885 	response->data_len = len;
886 
887 	offset = 0;
888 	ret = rxkad_insert_response_header(conn, token, challenge, response,
889 					   &offset);
890 	if (ret < 0)
891 		goto error;
892 
893 	ret = rxkad_encrypt_response(conn, response, token->kad);
894 	if (ret < 0)
895 		goto error;
896 
897 	ret = skb_store_bits(response, offset, token->kad->ticket,
898 			     token->kad->ticket_len);
899 	if (ret < 0)
900 		goto error;
901 
902 	csp = rxrpc_skb(challenge);
903 	rsp = rxrpc_skb(response);
904 	rsp->resp.len = len;
905 	rsp->resp.challenge_serial = csp->hdr.serial;
906 	rxrpc_post_response(conn, response);
907 	response = NULL;
908 	ret = 0;
909 
910 error:
911 	rxrpc_free_skb(response, rxrpc_skb_put_response);
912 	return ret;
913 }
914 
915 /*
916  * RxKAD does automatic response only as there's nothing to manage that isn't
917  * already in the key.
918  */
rxkad_sendmsg_respond_to_challenge(struct sk_buff * challenge,struct msghdr * msg)919 static int rxkad_sendmsg_respond_to_challenge(struct sk_buff *challenge,
920 					      struct msghdr *msg)
921 {
922 	return -EINVAL;
923 }
924 
925 /**
926  * rxkad_kernel_respond_to_challenge - Respond to a challenge with appdata
927  * @challenge: The challenge to respond to
928  *
929  * Allow a kernel application to respond to a CHALLENGE.
930  *
931  * Return: %0 if successful and a negative error code otherwise.
932  */
rxkad_kernel_respond_to_challenge(struct sk_buff * challenge)933 int rxkad_kernel_respond_to_challenge(struct sk_buff *challenge)
934 {
935 	struct rxrpc_skb_priv *csp = rxrpc_skb(challenge);
936 
937 	return rxkad_respond_to_challenge(csp->chall.conn, challenge);
938 }
939 EXPORT_SYMBOL(rxkad_kernel_respond_to_challenge);
940 
941 /*
942  * decrypt the kerberos IV ticket in the response
943  */
rxkad_decrypt_ticket(struct rxrpc_connection * conn,struct key * server_key,struct sk_buff * skb,void * ticket,size_t ticket_len,struct rxrpc_crypt * _session_key,time64_t * _expiry)944 static int rxkad_decrypt_ticket(struct rxrpc_connection *conn,
945 				struct key *server_key,
946 				struct sk_buff *skb,
947 				void *ticket, size_t ticket_len,
948 				struct rxrpc_crypt *_session_key,
949 				time64_t *_expiry)
950 {
951 	struct skcipher_request *req;
952 	struct rxrpc_crypt iv, key;
953 	struct scatterlist sg[1];
954 	struct in_addr addr;
955 	unsigned int life;
956 	time64_t issue, now;
957 	int ret;
958 	bool little_endian;
959 	u8 *p, *q, *name, *end;
960 
961 	_enter("{%d},{%x}", conn->debug_id, key_serial(server_key));
962 
963 	*_expiry = 0;
964 
965 	ASSERT(server_key->payload.data[0] != NULL);
966 
967 	memcpy(&iv, &server_key->payload.data[2], sizeof(iv));
968 
969 	req = skcipher_request_alloc(server_key->payload.data[0], GFP_NOFS);
970 	if (!req)
971 		return -ENOMEM;
972 
973 	sg_init_one(&sg[0], ticket, ticket_len);
974 	skcipher_request_set_callback(req, 0, NULL, NULL);
975 	skcipher_request_set_crypt(req, sg, sg, ticket_len, iv.x);
976 	ret = crypto_skcipher_decrypt(req);
977 	skcipher_request_free(req);
978 	if (ret < 0)
979 		return rxrpc_abort_conn(conn, skb, RXKADBADTICKET, -EPROTO,
980 					rxkad_abort_resp_tkt_short);
981 
982 	p = ticket;
983 	end = p + ticket_len;
984 
985 #define Z(field, fieldl)						\
986 	({								\
987 		u8 *__str = p;						\
988 		q = memchr(p, 0, end - p);				\
989 		if (!q || q - p > field##_SZ)				\
990 			return rxrpc_abort_conn(			\
991 				conn, skb, RXKADBADTICKET, -EPROTO,	\
992 				rxkad_abort_resp_tkt_##fieldl);		\
993 		for (; p < q; p++)					\
994 			if (!isprint(*p))				\
995 				return rxrpc_abort_conn(		\
996 					conn, skb, RXKADBADTICKET, -EPROTO, \
997 					rxkad_abort_resp_tkt_##fieldl);	\
998 		p++;							\
999 		__str;							\
1000 	})
1001 
1002 	/* extract the ticket flags */
1003 	_debug("KIV FLAGS: %x", *p);
1004 	little_endian = *p & 1;
1005 	p++;
1006 
1007 	/* extract the authentication name */
1008 	name = Z(ANAME, aname);
1009 	_debug("KIV ANAME: %s", name);
1010 
1011 	/* extract the principal's instance */
1012 	name = Z(INST, inst);
1013 	_debug("KIV INST : %s", name);
1014 
1015 	/* extract the principal's authentication domain */
1016 	name = Z(REALM, realm);
1017 	_debug("KIV REALM: %s", name);
1018 
1019 	if (end - p < 4 + 8 + 4 + 2)
1020 		return rxrpc_abort_conn(conn, skb, RXKADBADTICKET, -EPROTO,
1021 					rxkad_abort_resp_tkt_short);
1022 
1023 	/* get the IPv4 address of the entity that requested the ticket */
1024 	memcpy(&addr, p, sizeof(addr));
1025 	p += 4;
1026 	_debug("KIV ADDR : %pI4", &addr);
1027 
1028 	/* get the session key from the ticket */
1029 	memcpy(&key, p, sizeof(key));
1030 	p += 8;
1031 	_debug("KIV KEY  : %08x %08x", ntohl(key.n[0]), ntohl(key.n[1]));
1032 	memcpy(_session_key, &key, sizeof(key));
1033 
1034 	/* get the ticket's lifetime */
1035 	life = *p++ * 5 * 60;
1036 	_debug("KIV LIFE : %u", life);
1037 
1038 	/* get the issue time of the ticket */
1039 	if (little_endian) {
1040 		__le32 stamp;
1041 		memcpy(&stamp, p, 4);
1042 		issue = rxrpc_u32_to_time64(le32_to_cpu(stamp));
1043 	} else {
1044 		__be32 stamp;
1045 		memcpy(&stamp, p, 4);
1046 		issue = rxrpc_u32_to_time64(be32_to_cpu(stamp));
1047 	}
1048 	p += 4;
1049 	now = ktime_get_real_seconds();
1050 	_debug("KIV ISSUE: %llx [%llx]", issue, now);
1051 
1052 	/* check the ticket is in date */
1053 	if (issue > now)
1054 		return rxrpc_abort_conn(conn, skb, RXKADNOAUTH, -EKEYREJECTED,
1055 					rxkad_abort_resp_tkt_future);
1056 	if (issue < now - life)
1057 		return rxrpc_abort_conn(conn, skb, RXKADEXPIRED, -EKEYEXPIRED,
1058 					rxkad_abort_resp_tkt_expired);
1059 
1060 	*_expiry = issue + life;
1061 
1062 	/* get the service name */
1063 	name = Z(SNAME, sname);
1064 	_debug("KIV SNAME: %s", name);
1065 
1066 	/* get the service instance name */
1067 	name = Z(INST, sinst);
1068 	_debug("KIV SINST: %s", name);
1069 	return 0;
1070 }
1071 
1072 /*
1073  * decrypt the response packet
1074  */
rxkad_decrypt_response(struct rxrpc_connection * conn,struct rxkad_response * resp,const struct rxrpc_crypt * session_key)1075 static int rxkad_decrypt_response(struct rxrpc_connection *conn,
1076 				  struct rxkad_response *resp,
1077 				  const struct rxrpc_crypt *session_key)
1078 {
1079 	struct skcipher_request *req = rxkad_ci_req;
1080 	struct scatterlist sg[1];
1081 	struct rxrpc_crypt iv;
1082 	int ret;
1083 
1084 	_enter(",,%08x%08x",
1085 	       ntohl(session_key->n[0]), ntohl(session_key->n[1]));
1086 
1087 	mutex_lock(&rxkad_ci_mutex);
1088 	ret = crypto_sync_skcipher_setkey(rxkad_ci, session_key->x,
1089 					  sizeof(*session_key));
1090 	if (ret < 0)
1091 		goto unlock;
1092 
1093 	memcpy(&iv, session_key, sizeof(iv));
1094 
1095 	sg_init_table(sg, 1);
1096 	sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted));
1097 	skcipher_request_set_sync_tfm(req, rxkad_ci);
1098 	skcipher_request_set_callback(req, 0, NULL, NULL);
1099 	skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x);
1100 	ret = crypto_skcipher_decrypt(req);
1101 	skcipher_request_zero(req);
1102 
1103 unlock:
1104 	mutex_unlock(&rxkad_ci_mutex);
1105 
1106 	_leave("");
1107 	return ret;
1108 }
1109 
1110 /*
1111  * verify a response
1112  */
rxkad_verify_response(struct rxrpc_connection * conn,struct sk_buff * skb,void * buffer,unsigned int len)1113 static int rxkad_verify_response(struct rxrpc_connection *conn,
1114 				 struct sk_buff *skb,
1115 				 void *buffer, unsigned int len)
1116 {
1117 	struct rxkad_response *response;
1118 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
1119 	struct rxrpc_crypt session_key;
1120 	struct key *server_key;
1121 	time64_t expiry;
1122 	void *ticket;
1123 	u32 version, kvno, ticket_len, level;
1124 	__be32 csum;
1125 	int ret, i;
1126 
1127 	_enter("{%d}", conn->debug_id);
1128 
1129 	server_key = rxrpc_look_up_server_security(conn, skb, 0, 0);
1130 	if (IS_ERR(server_key)) {
1131 		ret = PTR_ERR(server_key);
1132 		switch (ret) {
1133 		case -ENOKEY:
1134 			return rxrpc_abort_conn(conn, skb, RXKADUNKNOWNKEY, ret,
1135 						rxkad_abort_resp_nokey);
1136 		case -EKEYEXPIRED:
1137 			return rxrpc_abort_conn(conn, skb, RXKADEXPIRED, ret,
1138 						rxkad_abort_resp_key_expired);
1139 		default:
1140 			return rxrpc_abort_conn(conn, skb, RXKADNOAUTH, ret,
1141 						rxkad_abort_resp_key_rejected);
1142 		}
1143 	}
1144 
1145 	response = buffer;
1146 	if (len < sizeof(*response)) {
1147 		ret = rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
1148 				       rxkad_abort_resp_short);
1149 		goto error;
1150 	}
1151 
1152 	version = ntohl(response->version);
1153 	ticket_len = ntohl(response->ticket_len);
1154 	kvno = ntohl(response->kvno);
1155 
1156 	trace_rxrpc_rx_response(conn, sp->hdr.serial, version, kvno, ticket_len);
1157 
1158 	buffer	+= sizeof(*response);
1159 	len	-= sizeof(*response);
1160 
1161 	if (version != RXKAD_VERSION) {
1162 		ret = rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO,
1163 				       rxkad_abort_resp_version);
1164 		goto error;
1165 	}
1166 
1167 	if (ticket_len < 4 || ticket_len > MAXKRB5TICKETLEN) {
1168 		ret = rxrpc_abort_conn(conn, skb, RXKADTICKETLEN, -EPROTO,
1169 				       rxkad_abort_resp_tkt_len);
1170 		goto error;
1171 	}
1172 
1173 	if (kvno >= RXKAD_TKT_TYPE_KERBEROS_V5) {
1174 		ret = rxrpc_abort_conn(conn, skb, RXKADUNKNOWNKEY, -EPROTO,
1175 				       rxkad_abort_resp_unknown_tkt);
1176 		goto error;
1177 	}
1178 
1179 	/* extract the kerberos ticket and decrypt and decode it */
1180 	ticket = buffer;
1181 	if (ticket_len > len) {
1182 		ret = rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
1183 				       rxkad_abort_resp_short_tkt);
1184 		goto error;
1185 	}
1186 
1187 	ret = rxkad_decrypt_ticket(conn, server_key, skb, ticket, ticket_len,
1188 				   &session_key, &expiry);
1189 	if (ret < 0)
1190 		goto error;
1191 
1192 	/* use the session key from inside the ticket to decrypt the
1193 	 * response */
1194 	ret = rxkad_decrypt_response(conn, response, &session_key);
1195 	if (ret < 0)
1196 		goto error;
1197 
1198 	if (ntohl(response->encrypted.epoch) != conn->proto.epoch ||
1199 	    ntohl(response->encrypted.cid) != conn->proto.cid ||
1200 	    ntohl(response->encrypted.securityIndex) != conn->security_ix) {
1201 		ret = rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1202 				       rxkad_abort_resp_bad_param);
1203 		goto error;
1204 	}
1205 
1206 	csum = response->encrypted.checksum;
1207 	response->encrypted.checksum = 0;
1208 	rxkad_calc_response_checksum(response);
1209 	if (response->encrypted.checksum != csum) {
1210 		ret = rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1211 				       rxkad_abort_resp_bad_checksum);
1212 		goto error;
1213 	}
1214 
1215 	for (i = 0; i < RXRPC_MAXCALLS; i++) {
1216 		u32 call_id = ntohl(response->encrypted.call_id[i]);
1217 		u32 counter = READ_ONCE(conn->channels[i].call_counter);
1218 
1219 		if (call_id > INT_MAX) {
1220 			ret = rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1221 					       rxkad_abort_resp_bad_callid);
1222 			goto error;
1223 		}
1224 
1225 		if (call_id < counter) {
1226 			ret = rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1227 					       rxkad_abort_resp_call_ctr);
1228 			goto error;
1229 		}
1230 
1231 		if (call_id > counter) {
1232 			if (conn->channels[i].call) {
1233 				ret = rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1234 						 rxkad_abort_resp_call_state);
1235 				goto error;
1236 			}
1237 			conn->channels[i].call_counter = call_id;
1238 		}
1239 	}
1240 
1241 	if (ntohl(response->encrypted.inc_nonce) != conn->rxkad.nonce + 1) {
1242 		ret = rxrpc_abort_conn(conn, skb, RXKADOUTOFSEQUENCE, -EPROTO,
1243 				       rxkad_abort_resp_ooseq);
1244 		goto error;
1245 	}
1246 
1247 	level = ntohl(response->encrypted.level);
1248 	if (level > RXRPC_SECURITY_ENCRYPT) {
1249 		ret = rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EPROTO,
1250 				       rxkad_abort_resp_level);
1251 		goto error;
1252 	}
1253 	conn->security_level = level;
1254 
1255 	/* create a key to hold the security data and expiration time - after
1256 	 * this the connection security can be handled in exactly the same way
1257 	 * as for a client connection */
1258 	ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno);
1259 
1260 error:
1261 	key_put(server_key);
1262 	_leave(" = %d", ret);
1263 	return ret;
1264 }
1265 
1266 /*
1267  * clear the connection security
1268  */
rxkad_clear(struct rxrpc_connection * conn)1269 static void rxkad_clear(struct rxrpc_connection *conn)
1270 {
1271 	_enter("");
1272 
1273 	if (conn->rxkad.cipher)
1274 		crypto_free_sync_skcipher(conn->rxkad.cipher);
1275 }
1276 
1277 /*
1278  * Initialise the rxkad security service.
1279  */
rxkad_init(void)1280 static int rxkad_init(void)
1281 {
1282 	struct crypto_sync_skcipher *tfm;
1283 	struct skcipher_request *req;
1284 
1285 	/* pin the cipher we need so that the crypto layer doesn't invoke
1286 	 * keventd to go get it */
1287 	tfm = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);
1288 	if (IS_ERR(tfm))
1289 		return PTR_ERR(tfm);
1290 
1291 	req = skcipher_request_alloc(&tfm->base, GFP_KERNEL);
1292 	if (!req)
1293 		goto nomem_tfm;
1294 
1295 	rxkad_ci_req = req;
1296 	rxkad_ci = tfm;
1297 	return 0;
1298 
1299 nomem_tfm:
1300 	crypto_free_sync_skcipher(tfm);
1301 	return -ENOMEM;
1302 }
1303 
1304 /*
1305  * Clean up the rxkad security service.
1306  */
rxkad_exit(void)1307 static void rxkad_exit(void)
1308 {
1309 	crypto_free_sync_skcipher(rxkad_ci);
1310 	skcipher_request_free(rxkad_ci_req);
1311 }
1312 
1313 /*
1314  * RxRPC Kerberos-based security
1315  */
1316 const struct rxrpc_security rxkad = {
1317 	.name				= "rxkad",
1318 	.security_index			= RXRPC_SECURITY_RXKAD,
1319 	.no_key_abort			= RXKADUNKNOWNKEY,
1320 	.init				= rxkad_init,
1321 	.exit				= rxkad_exit,
1322 	.preparse_server_key		= rxkad_preparse_server_key,
1323 	.free_preparse_server_key	= rxkad_free_preparse_server_key,
1324 	.destroy_server_key		= rxkad_destroy_server_key,
1325 	.init_connection_security	= rxkad_init_connection_security,
1326 	.alloc_txbuf			= rxkad_alloc_txbuf,
1327 	.secure_packet			= rxkad_secure_packet,
1328 	.verify_packet			= rxkad_verify_packet,
1329 	.free_call_crypto		= rxkad_free_call_crypto,
1330 	.issue_challenge		= rxkad_issue_challenge,
1331 	.validate_challenge		= rxkad_validate_challenge,
1332 	.sendmsg_respond_to_challenge	= rxkad_sendmsg_respond_to_challenge,
1333 	.respond_to_challenge		= rxkad_respond_to_challenge,
1334 	.verify_response		= rxkad_verify_response,
1335 	.clear				= rxkad_clear,
1336 };
1337