1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* Kerberos-based RxRPC security 3 * 4 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved. 5 * Written by David Howells (dhowells@redhat.com) 6 */ 7 8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 9 10 #include <crypto/skcipher.h> 11 #include <linux/module.h> 12 #include <linux/net.h> 13 #include <linux/skbuff.h> 14 #include <linux/udp.h> 15 #include <linux/scatterlist.h> 16 #include <linux/ctype.h> 17 #include <linux/slab.h> 18 #include <linux/key-type.h> 19 #include <net/sock.h> 20 #include <net/af_rxrpc.h> 21 #include <keys/rxrpc-type.h> 22 #include "ar-internal.h" 23 24 #define RXKAD_VERSION 2 25 #define MAXKRB5TICKETLEN 1024 26 #define RXKAD_TKT_TYPE_KERBEROS_V5 256 27 #define ANAME_SZ 40 /* size of authentication name */ 28 #define INST_SZ 40 /* size of principal's instance */ 29 #define REALM_SZ 40 /* size of principal's auth domain */ 30 #define SNAME_SZ 40 /* size of service name */ 31 #define RXKAD_ALIGN 8 32 33 struct rxkad_level1_hdr { 34 __be32 data_size; /* true data size (excluding padding) */ 35 }; 36 37 struct rxkad_level2_hdr { 38 __be32 data_size; /* true data size (excluding padding) */ 39 __be32 checksum; /* decrypted data checksum */ 40 }; 41 42 static int rxkad_prime_packet_security(struct rxrpc_connection *conn, 43 struct crypto_sync_skcipher *ci); 44 45 /* 46 * this holds a pinned cipher so that keventd doesn't get called by the cipher 47 * alloc routine, but since we have it to hand, we use it to decrypt RESPONSE 48 * packets 49 */ 50 static struct crypto_sync_skcipher *rxkad_ci; 51 static struct skcipher_request *rxkad_ci_req; 52 static DEFINE_MUTEX(rxkad_ci_mutex); 53 54 /* 55 * Parse the information from a server key 56 * 57 * The data should be the 8-byte secret key. 58 */ 59 static int rxkad_preparse_server_key(struct key_preparsed_payload *prep) 60 { 61 struct crypto_skcipher *ci; 62 63 if (prep->datalen != 8) 64 return -EINVAL; 65 66 memcpy(&prep->payload.data[2], prep->data, 8); 67 68 ci = crypto_alloc_skcipher("pcbc(des)", 0, CRYPTO_ALG_ASYNC); 69 if (IS_ERR(ci)) { 70 _leave(" = %ld", PTR_ERR(ci)); 71 return PTR_ERR(ci); 72 } 73 74 if (crypto_skcipher_setkey(ci, prep->data, 8) < 0) 75 BUG(); 76 77 prep->payload.data[0] = ci; 78 _leave(" = 0"); 79 return 0; 80 } 81 82 static void rxkad_free_preparse_server_key(struct key_preparsed_payload *prep) 83 { 84 85 if (prep->payload.data[0]) 86 crypto_free_skcipher(prep->payload.data[0]); 87 } 88 89 static void rxkad_destroy_server_key(struct key *key) 90 { 91 if (key->payload.data[0]) { 92 crypto_free_skcipher(key->payload.data[0]); 93 key->payload.data[0] = NULL; 94 } 95 } 96 97 /* 98 * initialise connection security 99 */ 100 static int rxkad_init_connection_security(struct rxrpc_connection *conn, 101 struct rxrpc_key_token *token) 102 { 103 struct crypto_sync_skcipher *ci; 104 int ret; 105 106 _enter("{%d},{%x}", conn->debug_id, key_serial(conn->key)); 107 108 conn->security_ix = token->security_index; 109 110 ci = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0); 111 if (IS_ERR(ci)) { 112 _debug("no cipher"); 113 ret = PTR_ERR(ci); 114 goto error; 115 } 116 117 if (crypto_sync_skcipher_setkey(ci, token->kad->session_key, 118 sizeof(token->kad->session_key)) < 0) 119 BUG(); 120 121 switch (conn->security_level) { 122 case RXRPC_SECURITY_PLAIN: 123 case RXRPC_SECURITY_AUTH: 124 case RXRPC_SECURITY_ENCRYPT: 125 break; 126 default: 127 ret = -EKEYREJECTED; 128 goto error; 129 } 130 131 ret = rxkad_prime_packet_security(conn, ci); 132 if (ret < 0) 133 goto error_ci; 134 135 conn->rxkad.cipher = ci; 136 return 0; 137 138 error_ci: 139 crypto_free_sync_skcipher(ci); 140 error: 141 _leave(" = %d", ret); 142 return ret; 143 } 144 145 /* 146 * Work out how much data we can put in a packet. 147 */ 148 static struct rxrpc_txbuf *rxkad_alloc_txbuf(struct rxrpc_call *call, size_t remain, gfp_t gfp) 149 { 150 struct rxrpc_txbuf *txb; 151 size_t shdr, alloc, limit, part; 152 153 remain = umin(remain, 65535 - sizeof(struct rxrpc_wire_header)); 154 155 switch (call->conn->security_level) { 156 default: 157 alloc = umin(remain, RXRPC_JUMBO_DATALEN); 158 return rxrpc_alloc_data_txbuf(call, alloc, 1, gfp); 159 case RXRPC_SECURITY_AUTH: 160 shdr = sizeof(struct rxkad_level1_hdr); 161 break; 162 case RXRPC_SECURITY_ENCRYPT: 163 shdr = sizeof(struct rxkad_level2_hdr); 164 break; 165 } 166 167 limit = round_down(RXRPC_JUMBO_DATALEN, RXKAD_ALIGN) - shdr; 168 if (remain < limit) { 169 part = remain; 170 alloc = round_up(shdr + part, RXKAD_ALIGN); 171 } else { 172 part = limit; 173 alloc = RXRPC_JUMBO_DATALEN; 174 } 175 176 txb = rxrpc_alloc_data_txbuf(call, alloc, RXKAD_ALIGN, gfp); 177 if (!txb) 178 return NULL; 179 180 txb->crypto_header = 0; 181 txb->sec_header = shdr; 182 txb->offset += shdr; 183 txb->space = part; 184 return txb; 185 } 186 187 /* 188 * prime the encryption state with the invariant parts of a connection's 189 * description 190 */ 191 static int rxkad_prime_packet_security(struct rxrpc_connection *conn, 192 struct crypto_sync_skcipher *ci) 193 { 194 struct skcipher_request *req; 195 struct rxrpc_key_token *token; 196 struct scatterlist sg; 197 struct rxrpc_crypt iv; 198 __be32 *tmpbuf; 199 size_t tmpsize = 4 * sizeof(__be32); 200 int ret; 201 202 _enter(""); 203 204 if (!conn->key) 205 return 0; 206 207 tmpbuf = kmalloc(tmpsize, GFP_KERNEL); 208 if (!tmpbuf) 209 return -ENOMEM; 210 211 req = skcipher_request_alloc(&ci->base, GFP_NOFS); 212 if (!req) { 213 kfree(tmpbuf); 214 return -ENOMEM; 215 } 216 217 token = conn->key->payload.data[0]; 218 memcpy(&iv, token->kad->session_key, sizeof(iv)); 219 220 tmpbuf[0] = htonl(conn->proto.epoch); 221 tmpbuf[1] = htonl(conn->proto.cid); 222 tmpbuf[2] = 0; 223 tmpbuf[3] = htonl(conn->security_ix); 224 225 sg_init_one(&sg, tmpbuf, tmpsize); 226 skcipher_request_set_sync_tfm(req, ci); 227 skcipher_request_set_callback(req, 0, NULL, NULL); 228 skcipher_request_set_crypt(req, &sg, &sg, tmpsize, iv.x); 229 ret = crypto_skcipher_encrypt(req); 230 skcipher_request_free(req); 231 232 memcpy(&conn->rxkad.csum_iv, tmpbuf + 2, sizeof(conn->rxkad.csum_iv)); 233 kfree(tmpbuf); 234 _leave(" = %d", ret); 235 return ret; 236 } 237 238 /* 239 * Allocate and prepare the crypto request on a call. For any particular call, 240 * this is called serially for the packets, so no lock should be necessary. 241 */ 242 static struct skcipher_request *rxkad_get_call_crypto(struct rxrpc_call *call) 243 { 244 struct crypto_skcipher *tfm = &call->conn->rxkad.cipher->base; 245 246 return skcipher_request_alloc(tfm, GFP_NOFS); 247 } 248 249 /* 250 * Clean up the crypto on a call. 251 */ 252 static void rxkad_free_call_crypto(struct rxrpc_call *call) 253 { 254 } 255 256 /* 257 * partially encrypt a packet (level 1 security) 258 */ 259 static int rxkad_secure_packet_auth(const struct rxrpc_call *call, 260 struct rxrpc_txbuf *txb, 261 struct skcipher_request *req) 262 { 263 struct rxkad_level1_hdr *hdr = txb->data; 264 struct rxrpc_crypt iv; 265 struct scatterlist sg; 266 size_t pad; 267 u16 check; 268 int ret; 269 270 _enter(""); 271 272 check = txb->seq ^ call->call_id; 273 hdr->data_size = htonl((u32)check << 16 | txb->len); 274 275 txb->pkt_len = sizeof(struct rxkad_level1_hdr) + txb->len; 276 pad = txb->pkt_len; 277 pad = RXKAD_ALIGN - pad; 278 pad &= RXKAD_ALIGN - 1; 279 if (pad) { 280 memset(txb->data + txb->offset, 0, pad); 281 txb->pkt_len += pad; 282 } 283 284 /* start the encryption afresh */ 285 memset(&iv, 0, sizeof(iv)); 286 287 sg_init_one(&sg, hdr, 8); 288 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); 289 skcipher_request_set_callback(req, 0, NULL, NULL); 290 skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); 291 ret = crypto_skcipher_encrypt(req); 292 skcipher_request_zero(req); 293 294 _leave(" = %d", ret); 295 return ret; 296 } 297 298 /* 299 * wholly encrypt a packet (level 2 security) 300 */ 301 static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call, 302 struct rxrpc_txbuf *txb, 303 struct skcipher_request *req) 304 { 305 const struct rxrpc_key_token *token; 306 struct rxkad_level2_hdr *rxkhdr = txb->data; 307 struct rxrpc_crypt iv; 308 struct scatterlist sg; 309 size_t content, pad; 310 u16 check; 311 int ret; 312 313 _enter(""); 314 315 check = txb->seq ^ call->call_id; 316 317 rxkhdr->data_size = htonl(txb->len | (u32)check << 16); 318 rxkhdr->checksum = 0; 319 320 content = sizeof(struct rxkad_level2_hdr) + txb->len; 321 txb->pkt_len = round_up(content, RXKAD_ALIGN); 322 pad = txb->pkt_len - content; 323 if (pad) 324 memset(txb->data + txb->offset, 0, pad); 325 326 /* encrypt from the session key */ 327 token = call->conn->key->payload.data[0]; 328 memcpy(&iv, token->kad->session_key, sizeof(iv)); 329 330 sg_init_one(&sg, rxkhdr, txb->pkt_len); 331 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); 332 skcipher_request_set_callback(req, 0, NULL, NULL); 333 skcipher_request_set_crypt(req, &sg, &sg, txb->pkt_len, iv.x); 334 ret = crypto_skcipher_encrypt(req); 335 skcipher_request_zero(req); 336 return ret; 337 } 338 339 /* 340 * checksum an RxRPC packet header 341 */ 342 static int rxkad_secure_packet(struct rxrpc_call *call, struct rxrpc_txbuf *txb) 343 { 344 struct skcipher_request *req; 345 struct rxrpc_crypt iv; 346 struct scatterlist sg; 347 union { 348 __be32 buf[2]; 349 } crypto __aligned(8); 350 u32 x, y = 0; 351 int ret; 352 353 _enter("{%d{%x}},{#%u},%u,", 354 call->debug_id, key_serial(call->conn->key), 355 txb->seq, txb->len); 356 357 if (!call->conn->rxkad.cipher) 358 return 0; 359 360 ret = key_validate(call->conn->key); 361 if (ret < 0) 362 return ret; 363 364 req = rxkad_get_call_crypto(call); 365 if (!req) 366 return -ENOMEM; 367 368 /* continue encrypting from where we left off */ 369 memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv)); 370 371 /* calculate the security checksum */ 372 x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT); 373 x |= txb->seq & 0x3fffffff; 374 crypto.buf[0] = htonl(call->call_id); 375 crypto.buf[1] = htonl(x); 376 377 sg_init_one(&sg, crypto.buf, 8); 378 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); 379 skcipher_request_set_callback(req, 0, NULL, NULL); 380 skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); 381 ret = crypto_skcipher_encrypt(req); 382 skcipher_request_zero(req); 383 if (ret < 0) 384 goto out; 385 386 y = ntohl(crypto.buf[1]); 387 y = (y >> 16) & 0xffff; 388 if (y == 0) 389 y = 1; /* zero checksums are not permitted */ 390 txb->cksum = htons(y); 391 392 switch (call->conn->security_level) { 393 case RXRPC_SECURITY_PLAIN: 394 txb->pkt_len = txb->len; 395 ret = 0; 396 break; 397 case RXRPC_SECURITY_AUTH: 398 ret = rxkad_secure_packet_auth(call, txb, req); 399 if (txb->alloc_size == RXRPC_JUMBO_DATALEN) 400 txb->jumboable = true; 401 break; 402 case RXRPC_SECURITY_ENCRYPT: 403 ret = rxkad_secure_packet_encrypt(call, txb, req); 404 if (txb->alloc_size == RXRPC_JUMBO_DATALEN) 405 txb->jumboable = true; 406 break; 407 default: 408 ret = -EPERM; 409 break; 410 } 411 412 /* Clear excess space in the packet */ 413 if (txb->pkt_len < txb->alloc_size) { 414 size_t gap = txb->alloc_size - txb->pkt_len; 415 void *p = txb->data; 416 417 memset(p + txb->pkt_len, 0, gap); 418 } 419 420 out: 421 skcipher_request_free(req); 422 _leave(" = %d [set %x]", ret, y); 423 return ret; 424 } 425 426 /* 427 * decrypt partial encryption on a packet (level 1 security) 428 */ 429 static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb, 430 rxrpc_seq_t seq, 431 struct skcipher_request *req) 432 { 433 struct rxkad_level1_hdr sechdr; 434 struct rxrpc_skb_priv *sp = rxrpc_skb(skb); 435 struct rxrpc_crypt iv; 436 struct scatterlist sg[16]; 437 u32 data_size, buf; 438 u16 check; 439 int ret; 440 441 _enter(""); 442 443 if (sp->len < 8) 444 return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON, 445 rxkad_abort_1_short_header); 446 447 /* Decrypt the skbuff in-place. TODO: We really want to decrypt 448 * directly into the target buffer. 449 */ 450 sg_init_table(sg, ARRAY_SIZE(sg)); 451 ret = skb_to_sgvec(skb, sg, sp->offset, 8); 452 if (unlikely(ret < 0)) 453 return ret; 454 455 /* start the decryption afresh */ 456 memset(&iv, 0, sizeof(iv)); 457 458 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); 459 skcipher_request_set_callback(req, 0, NULL, NULL); 460 skcipher_request_set_crypt(req, sg, sg, 8, iv.x); 461 ret = crypto_skcipher_decrypt(req); 462 skcipher_request_zero(req); 463 if (ret < 0) 464 return ret; 465 466 /* Extract the decrypted packet length */ 467 if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0) 468 return rxrpc_abort_eproto(call, skb, RXKADDATALEN, 469 rxkad_abort_1_short_encdata); 470 sp->offset += sizeof(sechdr); 471 sp->len -= sizeof(sechdr); 472 473 buf = ntohl(sechdr.data_size); 474 data_size = buf & 0xffff; 475 476 check = buf >> 16; 477 check ^= seq ^ call->call_id; 478 check &= 0xffff; 479 if (check != 0) 480 return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON, 481 rxkad_abort_1_short_check); 482 if (data_size > sp->len) 483 return rxrpc_abort_eproto(call, skb, RXKADDATALEN, 484 rxkad_abort_1_short_data); 485 sp->len = data_size; 486 487 _leave(" = 0 [dlen=%x]", data_size); 488 return 0; 489 } 490 491 /* 492 * wholly decrypt a packet (level 2 security) 493 */ 494 static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb, 495 rxrpc_seq_t seq, 496 struct skcipher_request *req) 497 { 498 const struct rxrpc_key_token *token; 499 struct rxkad_level2_hdr sechdr; 500 struct rxrpc_skb_priv *sp = rxrpc_skb(skb); 501 struct rxrpc_crypt iv; 502 struct scatterlist _sg[4], *sg; 503 u32 data_size, buf; 504 u16 check; 505 int nsg, ret; 506 507 _enter(",{%d}", sp->len); 508 509 if (sp->len < 8) 510 return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON, 511 rxkad_abort_2_short_header); 512 513 /* Decrypt the skbuff in-place. TODO: We really want to decrypt 514 * directly into the target buffer. 515 */ 516 sg = _sg; 517 nsg = skb_shinfo(skb)->nr_frags + 1; 518 if (nsg <= 4) { 519 nsg = 4; 520 } else { 521 sg = kmalloc_objs(*sg, nsg, GFP_NOIO); 522 if (!sg) 523 return -ENOMEM; 524 } 525 526 sg_init_table(sg, nsg); 527 ret = skb_to_sgvec(skb, sg, sp->offset, sp->len); 528 if (unlikely(ret < 0)) { 529 if (sg != _sg) 530 kfree(sg); 531 return ret; 532 } 533 534 /* decrypt from the session key */ 535 token = call->conn->key->payload.data[0]; 536 memcpy(&iv, token->kad->session_key, sizeof(iv)); 537 538 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); 539 skcipher_request_set_callback(req, 0, NULL, NULL); 540 skcipher_request_set_crypt(req, sg, sg, sp->len, iv.x); 541 ret = crypto_skcipher_decrypt(req); 542 skcipher_request_zero(req); 543 if (sg != _sg) 544 kfree(sg); 545 if (ret < 0) { 546 WARN_ON_ONCE(ret != -ENOMEM); 547 return ret; 548 } 549 550 /* Extract the decrypted packet length */ 551 if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0) 552 return rxrpc_abort_eproto(call, skb, RXKADDATALEN, 553 rxkad_abort_2_short_len); 554 sp->offset += sizeof(sechdr); 555 sp->len -= sizeof(sechdr); 556 557 buf = ntohl(sechdr.data_size); 558 data_size = buf & 0xffff; 559 560 check = buf >> 16; 561 check ^= seq ^ call->call_id; 562 check &= 0xffff; 563 if (check != 0) 564 return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON, 565 rxkad_abort_2_short_check); 566 567 if (data_size > sp->len) 568 return rxrpc_abort_eproto(call, skb, RXKADDATALEN, 569 rxkad_abort_2_short_data); 570 571 sp->len = data_size; 572 _leave(" = 0 [dlen=%x]", data_size); 573 return 0; 574 } 575 576 /* 577 * Verify the security on a received packet and the subpackets therein. 578 */ 579 static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb) 580 { 581 struct rxrpc_skb_priv *sp = rxrpc_skb(skb); 582 struct skcipher_request *req; 583 struct rxrpc_crypt iv; 584 struct scatterlist sg; 585 union { 586 __be32 buf[2]; 587 } crypto __aligned(8); 588 rxrpc_seq_t seq = sp->hdr.seq; 589 int ret; 590 u16 cksum; 591 u32 x, y; 592 593 _enter("{%d{%x}},{#%u}", 594 call->debug_id, key_serial(call->conn->key), seq); 595 596 if (!call->conn->rxkad.cipher) 597 return 0; 598 599 req = rxkad_get_call_crypto(call); 600 if (!req) 601 return -ENOMEM; 602 603 /* continue encrypting from where we left off */ 604 memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv)); 605 606 /* validate the security checksum */ 607 x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT); 608 x |= seq & 0x3fffffff; 609 crypto.buf[0] = htonl(call->call_id); 610 crypto.buf[1] = htonl(x); 611 612 sg_init_one(&sg, crypto.buf, 8); 613 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); 614 skcipher_request_set_callback(req, 0, NULL, NULL); 615 skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); 616 ret = crypto_skcipher_encrypt(req); 617 skcipher_request_zero(req); 618 if (ret < 0) 619 goto out; 620 621 y = ntohl(crypto.buf[1]); 622 cksum = (y >> 16) & 0xffff; 623 if (cksum == 0) 624 cksum = 1; /* zero checksums are not permitted */ 625 626 if (cksum != sp->hdr.cksum) { 627 ret = rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON, 628 rxkad_abort_bad_checksum); 629 goto out; 630 } 631 632 switch (call->conn->security_level) { 633 case RXRPC_SECURITY_PLAIN: 634 ret = 0; 635 break; 636 case RXRPC_SECURITY_AUTH: 637 ret = rxkad_verify_packet_1(call, skb, seq, req); 638 break; 639 case RXRPC_SECURITY_ENCRYPT: 640 ret = rxkad_verify_packet_2(call, skb, seq, req); 641 break; 642 default: 643 ret = -ENOANO; 644 break; 645 } 646 647 out: 648 skcipher_request_free(req); 649 return ret; 650 } 651 652 /* 653 * issue a challenge 654 */ 655 static int rxkad_issue_challenge(struct rxrpc_connection *conn) 656 { 657 struct rxkad_challenge challenge; 658 struct rxrpc_wire_header whdr; 659 struct msghdr msg; 660 struct kvec iov[2]; 661 size_t len; 662 u32 serial; 663 int ret; 664 665 _enter("{%d}", conn->debug_id); 666 667 get_random_bytes(&conn->rxkad.nonce, sizeof(conn->rxkad.nonce)); 668 669 challenge.version = htonl(2); 670 challenge.nonce = htonl(conn->rxkad.nonce); 671 challenge.min_level = htonl(0); 672 challenge.__padding = 0; 673 674 msg.msg_name = &conn->peer->srx.transport; 675 msg.msg_namelen = conn->peer->srx.transport_len; 676 msg.msg_control = NULL; 677 msg.msg_controllen = 0; 678 msg.msg_flags = 0; 679 680 whdr.epoch = htonl(conn->proto.epoch); 681 whdr.cid = htonl(conn->proto.cid); 682 whdr.callNumber = 0; 683 whdr.seq = 0; 684 whdr.type = RXRPC_PACKET_TYPE_CHALLENGE; 685 whdr.flags = conn->out_clientflag; 686 whdr.userStatus = 0; 687 whdr.securityIndex = conn->security_ix; 688 whdr._rsvd = 0; 689 whdr.serviceId = htons(conn->service_id); 690 691 iov[0].iov_base = &whdr; 692 iov[0].iov_len = sizeof(whdr); 693 iov[1].iov_base = &challenge; 694 iov[1].iov_len = sizeof(challenge); 695 696 len = iov[0].iov_len + iov[1].iov_len; 697 698 serial = rxrpc_get_next_serial(conn); 699 whdr.serial = htonl(serial); 700 701 trace_rxrpc_tx_challenge(conn, serial, 0, conn->rxkad.nonce); 702 703 ret = kernel_sendmsg(conn->local->socket, &msg, iov, 2, len); 704 if (ret < 0) { 705 trace_rxrpc_tx_fail(conn->debug_id, serial, ret, 706 rxrpc_tx_point_rxkad_challenge); 707 return -EAGAIN; 708 } 709 710 rxrpc_peer_mark_tx(conn->peer); 711 trace_rxrpc_tx_packet(conn->debug_id, &whdr, 712 rxrpc_tx_point_rxkad_challenge); 713 _leave(" = 0"); 714 return 0; 715 } 716 717 /* 718 * calculate the response checksum 719 */ 720 static void rxkad_calc_response_checksum(struct rxkad_response *response) 721 { 722 u32 csum = 1000003; 723 int loop; 724 u8 *p = (u8 *) response; 725 726 for (loop = sizeof(*response); loop > 0; loop--) 727 csum = csum * 0x10204081 + *p++; 728 729 response->encrypted.checksum = htonl(csum); 730 } 731 732 /* 733 * encrypt the response packet 734 */ 735 static int rxkad_encrypt_response(struct rxrpc_connection *conn, 736 struct sk_buff *response, 737 const struct rxkad_key *s2) 738 { 739 struct skcipher_request *req; 740 struct rxrpc_crypt iv; 741 struct scatterlist sg[1]; 742 size_t encsize = sizeof(((struct rxkad_response *)0)->encrypted); 743 int ret; 744 745 sg_init_table(sg, ARRAY_SIZE(sg)); 746 ret = skb_to_sgvec(response, sg, 747 sizeof(struct rxrpc_wire_header) + 748 offsetof(struct rxkad_response, encrypted), encsize); 749 if (ret < 0) 750 return ret; 751 752 req = skcipher_request_alloc(&conn->rxkad.cipher->base, GFP_NOFS); 753 if (!req) 754 return -ENOMEM; 755 756 /* continue encrypting from where we left off */ 757 memcpy(&iv, s2->session_key, sizeof(iv)); 758 759 skcipher_request_set_sync_tfm(req, conn->rxkad.cipher); 760 skcipher_request_set_callback(req, 0, NULL, NULL); 761 skcipher_request_set_crypt(req, sg, sg, encsize, iv.x); 762 ret = crypto_skcipher_encrypt(req); 763 skcipher_request_free(req); 764 return ret; 765 } 766 767 /* 768 * Validate a challenge packet. 769 */ 770 static bool rxkad_validate_challenge(struct rxrpc_connection *conn, 771 struct sk_buff *skb) 772 { 773 struct rxkad_challenge challenge; 774 struct rxrpc_skb_priv *sp = rxrpc_skb(skb); 775 u32 version, min_level; 776 int ret; 777 778 _enter("{%d,%x}", conn->debug_id, key_serial(conn->key)); 779 780 if (!conn->key) { 781 rxrpc_abort_conn(conn, skb, RX_PROTOCOL_ERROR, -EPROTO, 782 rxkad_abort_chall_no_key); 783 return false; 784 } 785 786 ret = key_validate(conn->key); 787 if (ret < 0) { 788 rxrpc_abort_conn(conn, skb, RXKADEXPIRED, ret, 789 rxkad_abort_chall_key_expired); 790 return false; 791 } 792 793 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header), 794 &challenge, sizeof(challenge)) < 0) { 795 rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO, 796 rxkad_abort_chall_short); 797 return false; 798 } 799 800 version = ntohl(challenge.version); 801 sp->chall.rxkad_nonce = ntohl(challenge.nonce); 802 min_level = ntohl(challenge.min_level); 803 804 trace_rxrpc_rx_challenge(conn, sp->hdr.serial, version, 805 sp->chall.rxkad_nonce, min_level); 806 807 if (version != RXKAD_VERSION) { 808 rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO, 809 rxkad_abort_chall_version); 810 return false; 811 } 812 813 if (conn->security_level < min_level) { 814 rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EACCES, 815 rxkad_abort_chall_level); 816 return false; 817 } 818 return true; 819 } 820 821 /* 822 * Insert the header into the response. 823 */ 824 static noinline 825 int rxkad_insert_response_header(struct rxrpc_connection *conn, 826 const struct rxrpc_key_token *token, 827 struct sk_buff *challenge, 828 struct sk_buff *response, 829 size_t *offset) 830 { 831 struct rxrpc_skb_priv *csp = rxrpc_skb(challenge); 832 struct { 833 struct rxrpc_wire_header whdr; 834 struct rxkad_response resp; 835 } h; 836 int ret; 837 838 h.whdr.epoch = htonl(conn->proto.epoch); 839 h.whdr.cid = htonl(conn->proto.cid); 840 h.whdr.callNumber = 0; 841 h.whdr.serial = 0; 842 h.whdr.seq = 0; 843 h.whdr.type = RXRPC_PACKET_TYPE_RESPONSE; 844 h.whdr.flags = conn->out_clientflag; 845 h.whdr.userStatus = 0; 846 h.whdr.securityIndex = conn->security_ix; 847 h.whdr.cksum = 0; 848 h.whdr.serviceId = htons(conn->service_id); 849 h.resp.version = htonl(RXKAD_VERSION); 850 h.resp.__pad = 0; 851 h.resp.encrypted.epoch = htonl(conn->proto.epoch); 852 h.resp.encrypted.cid = htonl(conn->proto.cid); 853 h.resp.encrypted.checksum = 0; 854 h.resp.encrypted.securityIndex = htonl(conn->security_ix); 855 h.resp.encrypted.call_id[0] = htonl(conn->channels[0].call_counter); 856 h.resp.encrypted.call_id[1] = htonl(conn->channels[1].call_counter); 857 h.resp.encrypted.call_id[2] = htonl(conn->channels[2].call_counter); 858 h.resp.encrypted.call_id[3] = htonl(conn->channels[3].call_counter); 859 h.resp.encrypted.inc_nonce = htonl(csp->chall.rxkad_nonce + 1); 860 h.resp.encrypted.level = htonl(conn->security_level); 861 h.resp.kvno = htonl(token->kad->kvno); 862 h.resp.ticket_len = htonl(token->kad->ticket_len); 863 864 rxkad_calc_response_checksum(&h.resp); 865 866 ret = skb_store_bits(response, *offset, &h, sizeof(h)); 867 *offset += sizeof(h); 868 return ret; 869 } 870 871 /* 872 * respond to a challenge packet 873 */ 874 static int rxkad_respond_to_challenge(struct rxrpc_connection *conn, 875 struct sk_buff *challenge) 876 { 877 const struct rxrpc_key_token *token; 878 struct rxrpc_skb_priv *csp, *rsp; 879 struct sk_buff *response; 880 size_t len, offset = 0; 881 int ret = -EPROTO; 882 883 _enter("{%d,%x}", conn->debug_id, key_serial(conn->key)); 884 885 ret = key_validate(conn->key); 886 if (ret < 0) 887 return rxrpc_abort_conn(conn, challenge, RXKADEXPIRED, ret, 888 rxkad_abort_chall_key_expired); 889 890 token = conn->key->payload.data[0]; 891 892 /* build the response packet */ 893 len = sizeof(struct rxrpc_wire_header) + 894 sizeof(struct rxkad_response) + 895 token->kad->ticket_len; 896 897 response = alloc_skb_with_frags(0, len, 0, &ret, GFP_NOFS); 898 if (!response) 899 goto error; 900 rxrpc_new_skb(response, rxrpc_skb_new_response_rxkad); 901 response->len = len; 902 response->data_len = len; 903 904 offset = 0; 905 ret = rxkad_insert_response_header(conn, token, challenge, response, 906 &offset); 907 if (ret < 0) 908 goto error; 909 910 ret = rxkad_encrypt_response(conn, response, token->kad); 911 if (ret < 0) 912 goto error; 913 914 ret = skb_store_bits(response, offset, token->kad->ticket, 915 token->kad->ticket_len); 916 if (ret < 0) 917 goto error; 918 919 csp = rxrpc_skb(challenge); 920 rsp = rxrpc_skb(response); 921 rsp->resp.len = len; 922 rsp->resp.challenge_serial = csp->hdr.serial; 923 rxrpc_post_response(conn, response); 924 response = NULL; 925 ret = 0; 926 927 error: 928 rxrpc_free_skb(response, rxrpc_skb_put_response); 929 return ret; 930 } 931 932 /* 933 * RxKAD does automatic response only as there's nothing to manage that isn't 934 * already in the key. 935 */ 936 static int rxkad_sendmsg_respond_to_challenge(struct sk_buff *challenge, 937 struct msghdr *msg) 938 { 939 return -EINVAL; 940 } 941 942 /** 943 * rxkad_kernel_respond_to_challenge - Respond to a challenge with appdata 944 * @challenge: The challenge to respond to 945 * 946 * Allow a kernel application to respond to a CHALLENGE. 947 * 948 * Return: %0 if successful and a negative error code otherwise. 949 */ 950 int rxkad_kernel_respond_to_challenge(struct sk_buff *challenge) 951 { 952 struct rxrpc_skb_priv *csp = rxrpc_skb(challenge); 953 954 return rxkad_respond_to_challenge(csp->chall.conn, challenge); 955 } 956 EXPORT_SYMBOL(rxkad_kernel_respond_to_challenge); 957 958 /* 959 * decrypt the kerberos IV ticket in the response 960 */ 961 static int rxkad_decrypt_ticket(struct rxrpc_connection *conn, 962 struct key *server_key, 963 struct sk_buff *skb, 964 void *ticket, size_t ticket_len, 965 struct rxrpc_crypt *_session_key, 966 time64_t *_expiry) 967 { 968 struct skcipher_request *req; 969 struct rxrpc_crypt iv, key; 970 struct scatterlist sg[1]; 971 struct in_addr addr; 972 unsigned int life; 973 time64_t issue, now; 974 int ret; 975 bool little_endian; 976 u8 *p, *q, *name, *end; 977 978 _enter("{%d},{%x}", conn->debug_id, key_serial(server_key)); 979 980 *_expiry = 0; 981 982 ASSERT(server_key->payload.data[0] != NULL); 983 ASSERTCMP((unsigned long) ticket & 7UL, ==, 0); 984 985 memcpy(&iv, &server_key->payload.data[2], sizeof(iv)); 986 987 req = skcipher_request_alloc(server_key->payload.data[0], GFP_NOFS); 988 if (!req) 989 return -ENOMEM; 990 991 sg_init_one(&sg[0], ticket, ticket_len); 992 skcipher_request_set_callback(req, 0, NULL, NULL); 993 skcipher_request_set_crypt(req, sg, sg, ticket_len, iv.x); 994 ret = crypto_skcipher_decrypt(req); 995 skcipher_request_free(req); 996 if (ret < 0) 997 return rxrpc_abort_conn(conn, skb, RXKADBADTICKET, -EPROTO, 998 rxkad_abort_resp_tkt_short); 999 1000 p = ticket; 1001 end = p + ticket_len; 1002 1003 #define Z(field, fieldl) \ 1004 ({ \ 1005 u8 *__str = p; \ 1006 q = memchr(p, 0, end - p); \ 1007 if (!q || q - p > field##_SZ) \ 1008 return rxrpc_abort_conn( \ 1009 conn, skb, RXKADBADTICKET, -EPROTO, \ 1010 rxkad_abort_resp_tkt_##fieldl); \ 1011 for (; p < q; p++) \ 1012 if (!isprint(*p)) \ 1013 return rxrpc_abort_conn( \ 1014 conn, skb, RXKADBADTICKET, -EPROTO, \ 1015 rxkad_abort_resp_tkt_##fieldl); \ 1016 p++; \ 1017 __str; \ 1018 }) 1019 1020 /* extract the ticket flags */ 1021 _debug("KIV FLAGS: %x", *p); 1022 little_endian = *p & 1; 1023 p++; 1024 1025 /* extract the authentication name */ 1026 name = Z(ANAME, aname); 1027 _debug("KIV ANAME: %s", name); 1028 1029 /* extract the principal's instance */ 1030 name = Z(INST, inst); 1031 _debug("KIV INST : %s", name); 1032 1033 /* extract the principal's authentication domain */ 1034 name = Z(REALM, realm); 1035 _debug("KIV REALM: %s", name); 1036 1037 if (end - p < 4 + 8 + 4 + 2) 1038 return rxrpc_abort_conn(conn, skb, RXKADBADTICKET, -EPROTO, 1039 rxkad_abort_resp_tkt_short); 1040 1041 /* get the IPv4 address of the entity that requested the ticket */ 1042 memcpy(&addr, p, sizeof(addr)); 1043 p += 4; 1044 _debug("KIV ADDR : %pI4", &addr); 1045 1046 /* get the session key from the ticket */ 1047 memcpy(&key, p, sizeof(key)); 1048 p += 8; 1049 _debug("KIV KEY : %08x %08x", ntohl(key.n[0]), ntohl(key.n[1])); 1050 memcpy(_session_key, &key, sizeof(key)); 1051 1052 /* get the ticket's lifetime */ 1053 life = *p++ * 5 * 60; 1054 _debug("KIV LIFE : %u", life); 1055 1056 /* get the issue time of the ticket */ 1057 if (little_endian) { 1058 __le32 stamp; 1059 memcpy(&stamp, p, 4); 1060 issue = rxrpc_u32_to_time64(le32_to_cpu(stamp)); 1061 } else { 1062 __be32 stamp; 1063 memcpy(&stamp, p, 4); 1064 issue = rxrpc_u32_to_time64(be32_to_cpu(stamp)); 1065 } 1066 p += 4; 1067 now = ktime_get_real_seconds(); 1068 _debug("KIV ISSUE: %llx [%llx]", issue, now); 1069 1070 /* check the ticket is in date */ 1071 if (issue > now) 1072 return rxrpc_abort_conn(conn, skb, RXKADNOAUTH, -EKEYREJECTED, 1073 rxkad_abort_resp_tkt_future); 1074 if (issue < now - life) 1075 return rxrpc_abort_conn(conn, skb, RXKADEXPIRED, -EKEYEXPIRED, 1076 rxkad_abort_resp_tkt_expired); 1077 1078 *_expiry = issue + life; 1079 1080 /* get the service name */ 1081 name = Z(SNAME, sname); 1082 _debug("KIV SNAME: %s", name); 1083 1084 /* get the service instance name */ 1085 name = Z(INST, sinst); 1086 _debug("KIV SINST: %s", name); 1087 return 0; 1088 } 1089 1090 /* 1091 * decrypt the response packet 1092 */ 1093 static int rxkad_decrypt_response(struct rxrpc_connection *conn, 1094 struct rxkad_response *resp, 1095 const struct rxrpc_crypt *session_key) 1096 { 1097 struct skcipher_request *req = rxkad_ci_req; 1098 struct scatterlist sg[1]; 1099 struct rxrpc_crypt iv; 1100 int ret; 1101 1102 _enter(",,%08x%08x", 1103 ntohl(session_key->n[0]), ntohl(session_key->n[1])); 1104 1105 mutex_lock(&rxkad_ci_mutex); 1106 ret = crypto_sync_skcipher_setkey(rxkad_ci, session_key->x, 1107 sizeof(*session_key)); 1108 if (ret < 0) 1109 goto unlock; 1110 1111 memcpy(&iv, session_key, sizeof(iv)); 1112 1113 sg_init_table(sg, 1); 1114 sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted)); 1115 skcipher_request_set_sync_tfm(req, rxkad_ci); 1116 skcipher_request_set_callback(req, 0, NULL, NULL); 1117 skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x); 1118 ret = crypto_skcipher_decrypt(req); 1119 skcipher_request_zero(req); 1120 1121 unlock: 1122 mutex_unlock(&rxkad_ci_mutex); 1123 1124 _leave(""); 1125 return ret; 1126 } 1127 1128 /* 1129 * verify a response 1130 */ 1131 static int rxkad_verify_response(struct rxrpc_connection *conn, 1132 struct sk_buff *skb) 1133 { 1134 struct rxkad_response *response; 1135 struct rxrpc_skb_priv *sp = rxrpc_skb(skb); 1136 struct rxrpc_crypt session_key; 1137 struct key *server_key; 1138 time64_t expiry; 1139 void *ticket; 1140 u32 version, kvno, ticket_len, level; 1141 __be32 csum; 1142 int ret, i; 1143 1144 _enter("{%d}", conn->debug_id); 1145 1146 server_key = rxrpc_look_up_server_security(conn, skb, 0, 0); 1147 if (IS_ERR(server_key)) { 1148 ret = PTR_ERR(server_key); 1149 switch (ret) { 1150 case -ENOKEY: 1151 return rxrpc_abort_conn(conn, skb, RXKADUNKNOWNKEY, ret, 1152 rxkad_abort_resp_nokey); 1153 case -EKEYEXPIRED: 1154 return rxrpc_abort_conn(conn, skb, RXKADEXPIRED, ret, 1155 rxkad_abort_resp_key_expired); 1156 default: 1157 return rxrpc_abort_conn(conn, skb, RXKADNOAUTH, ret, 1158 rxkad_abort_resp_key_rejected); 1159 } 1160 } 1161 1162 ret = -ENOMEM; 1163 response = kzalloc_obj(struct rxkad_response, GFP_NOFS); 1164 if (!response) 1165 goto temporary_error; 1166 1167 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header), 1168 response, sizeof(*response)) < 0) { 1169 rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO, 1170 rxkad_abort_resp_short); 1171 goto protocol_error; 1172 } 1173 1174 version = ntohl(response->version); 1175 ticket_len = ntohl(response->ticket_len); 1176 kvno = ntohl(response->kvno); 1177 1178 trace_rxrpc_rx_response(conn, sp->hdr.serial, version, kvno, ticket_len); 1179 1180 if (version != RXKAD_VERSION) { 1181 rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO, 1182 rxkad_abort_resp_version); 1183 goto protocol_error; 1184 } 1185 1186 if (ticket_len < 4 || ticket_len > MAXKRB5TICKETLEN) { 1187 rxrpc_abort_conn(conn, skb, RXKADTICKETLEN, -EPROTO, 1188 rxkad_abort_resp_tkt_len); 1189 goto protocol_error; 1190 } 1191 1192 if (kvno >= RXKAD_TKT_TYPE_KERBEROS_V5) { 1193 rxrpc_abort_conn(conn, skb, RXKADUNKNOWNKEY, -EPROTO, 1194 rxkad_abort_resp_unknown_tkt); 1195 goto protocol_error; 1196 } 1197 1198 /* extract the kerberos ticket and decrypt and decode it */ 1199 ret = -ENOMEM; 1200 ticket = kmalloc(ticket_len, GFP_NOFS); 1201 if (!ticket) 1202 goto temporary_error_free_resp; 1203 1204 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header) + sizeof(*response), 1205 ticket, ticket_len) < 0) { 1206 rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO, 1207 rxkad_abort_resp_short_tkt); 1208 goto protocol_error; 1209 } 1210 1211 ret = rxkad_decrypt_ticket(conn, server_key, skb, ticket, ticket_len, 1212 &session_key, &expiry); 1213 if (ret < 0) 1214 goto temporary_error_free_ticket; 1215 1216 /* use the session key from inside the ticket to decrypt the 1217 * response */ 1218 ret = rxkad_decrypt_response(conn, response, &session_key); 1219 if (ret < 0) 1220 goto temporary_error_free_ticket; 1221 1222 if (ntohl(response->encrypted.epoch) != conn->proto.epoch || 1223 ntohl(response->encrypted.cid) != conn->proto.cid || 1224 ntohl(response->encrypted.securityIndex) != conn->security_ix) { 1225 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO, 1226 rxkad_abort_resp_bad_param); 1227 goto protocol_error_free; 1228 } 1229 1230 csum = response->encrypted.checksum; 1231 response->encrypted.checksum = 0; 1232 rxkad_calc_response_checksum(response); 1233 if (response->encrypted.checksum != csum) { 1234 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO, 1235 rxkad_abort_resp_bad_checksum); 1236 goto protocol_error_free; 1237 } 1238 1239 for (i = 0; i < RXRPC_MAXCALLS; i++) { 1240 u32 call_id = ntohl(response->encrypted.call_id[i]); 1241 u32 counter = READ_ONCE(conn->channels[i].call_counter); 1242 1243 if (call_id > INT_MAX) { 1244 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO, 1245 rxkad_abort_resp_bad_callid); 1246 goto protocol_error_free; 1247 } 1248 1249 if (call_id < counter) { 1250 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO, 1251 rxkad_abort_resp_call_ctr); 1252 goto protocol_error_free; 1253 } 1254 1255 if (call_id > counter) { 1256 if (conn->channels[i].call) { 1257 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO, 1258 rxkad_abort_resp_call_state); 1259 goto protocol_error_free; 1260 } 1261 conn->channels[i].call_counter = call_id; 1262 } 1263 } 1264 1265 if (ntohl(response->encrypted.inc_nonce) != conn->rxkad.nonce + 1) { 1266 rxrpc_abort_conn(conn, skb, RXKADOUTOFSEQUENCE, -EPROTO, 1267 rxkad_abort_resp_ooseq); 1268 goto protocol_error_free; 1269 } 1270 1271 level = ntohl(response->encrypted.level); 1272 if (level > RXRPC_SECURITY_ENCRYPT) { 1273 rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EPROTO, 1274 rxkad_abort_resp_level); 1275 goto protocol_error_free; 1276 } 1277 conn->security_level = level; 1278 1279 /* create a key to hold the security data and expiration time - after 1280 * this the connection security can be handled in exactly the same way 1281 * as for a client connection */ 1282 ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno); 1283 if (ret < 0) 1284 goto temporary_error_free_ticket; 1285 1286 kfree(ticket); 1287 kfree(response); 1288 _leave(" = 0"); 1289 return 0; 1290 1291 protocol_error_free: 1292 kfree(ticket); 1293 protocol_error: 1294 kfree(response); 1295 key_put(server_key); 1296 return -EPROTO; 1297 1298 temporary_error_free_ticket: 1299 kfree(ticket); 1300 temporary_error_free_resp: 1301 kfree(response); 1302 temporary_error: 1303 /* Ignore the response packet if we got a temporary error such as 1304 * ENOMEM. We just want to send the challenge again. Note that we 1305 * also come out this way if the ticket decryption fails. 1306 */ 1307 key_put(server_key); 1308 return ret; 1309 } 1310 1311 /* 1312 * clear the connection security 1313 */ 1314 static void rxkad_clear(struct rxrpc_connection *conn) 1315 { 1316 _enter(""); 1317 1318 if (conn->rxkad.cipher) 1319 crypto_free_sync_skcipher(conn->rxkad.cipher); 1320 } 1321 1322 /* 1323 * Initialise the rxkad security service. 1324 */ 1325 static int rxkad_init(void) 1326 { 1327 struct crypto_sync_skcipher *tfm; 1328 struct skcipher_request *req; 1329 1330 /* pin the cipher we need so that the crypto layer doesn't invoke 1331 * keventd to go get it */ 1332 tfm = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0); 1333 if (IS_ERR(tfm)) 1334 return PTR_ERR(tfm); 1335 1336 req = skcipher_request_alloc(&tfm->base, GFP_KERNEL); 1337 if (!req) 1338 goto nomem_tfm; 1339 1340 rxkad_ci_req = req; 1341 rxkad_ci = tfm; 1342 return 0; 1343 1344 nomem_tfm: 1345 crypto_free_sync_skcipher(tfm); 1346 return -ENOMEM; 1347 } 1348 1349 /* 1350 * Clean up the rxkad security service. 1351 */ 1352 static void rxkad_exit(void) 1353 { 1354 crypto_free_sync_skcipher(rxkad_ci); 1355 skcipher_request_free(rxkad_ci_req); 1356 } 1357 1358 /* 1359 * RxRPC Kerberos-based security 1360 */ 1361 const struct rxrpc_security rxkad = { 1362 .name = "rxkad", 1363 .security_index = RXRPC_SECURITY_RXKAD, 1364 .no_key_abort = RXKADUNKNOWNKEY, 1365 .init = rxkad_init, 1366 .exit = rxkad_exit, 1367 .preparse_server_key = rxkad_preparse_server_key, 1368 .free_preparse_server_key = rxkad_free_preparse_server_key, 1369 .destroy_server_key = rxkad_destroy_server_key, 1370 .init_connection_security = rxkad_init_connection_security, 1371 .alloc_txbuf = rxkad_alloc_txbuf, 1372 .secure_packet = rxkad_secure_packet, 1373 .verify_packet = rxkad_verify_packet, 1374 .free_call_crypto = rxkad_free_call_crypto, 1375 .issue_challenge = rxkad_issue_challenge, 1376 .validate_challenge = rxkad_validate_challenge, 1377 .sendmsg_respond_to_challenge = rxkad_sendmsg_respond_to_challenge, 1378 .respond_to_challenge = rxkad_respond_to_challenge, 1379 .verify_response = rxkad_verify_response, 1380 .clear = rxkad_clear, 1381 }; 1382