Commit | Line | Data |
---|---|---|
2874c5fd | 1 | // SPDX-License-Identifier: GPL-2.0-or-later |
17926a79 DH |
2 | /* Kerberos-based RxRPC security |
3 | * | |
4 | * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved. | |
5 | * Written by David Howells (dhowells@redhat.com) | |
17926a79 DH |
6 | */ |
7 | ||
9b6d5398 JP |
8 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
9 | ||
1afe593b | 10 | #include <crypto/skcipher.h> |
17926a79 DH |
11 | #include <linux/module.h> |
12 | #include <linux/net.h> | |
13 | #include <linux/skbuff.h> | |
14 | #include <linux/udp.h> | |
17926a79 DH |
15 | #include <linux/scatterlist.h> |
16 | #include <linux/ctype.h> | |
5a0e3ad6 | 17 | #include <linux/slab.h> |
12da59fc | 18 | #include <linux/key-type.h> |
17926a79 DH |
19 | #include <net/sock.h> |
20 | #include <net/af_rxrpc.h> | |
33941284 | 21 | #include <keys/rxrpc-type.h> |
17926a79 DH |
22 | #include "ar-internal.h" |
23 | ||
24 | #define RXKAD_VERSION 2 | |
25 | #define MAXKRB5TICKETLEN 1024 | |
26 | #define RXKAD_TKT_TYPE_KERBEROS_V5 256 | |
27 | #define ANAME_SZ 40 /* size of authentication name */ | |
28 | #define INST_SZ 40 /* size of principal's instance */ | |
29 | #define REALM_SZ 40 /* size of principal's auth domain */ | |
30 | #define SNAME_SZ 40 /* size of service name */ | |
d7d775b1 | 31 | #define RXKAD_ALIGN 8 |
17926a79 | 32 | |
17926a79 DH |
33 | struct rxkad_level1_hdr { |
34 | __be32 data_size; /* true data size (excluding padding) */ | |
35 | }; | |
36 | ||
37 | struct rxkad_level2_hdr { | |
38 | __be32 data_size; /* true data size (excluding padding) */ | |
39 | __be32 checksum; /* decrypted data checksum */ | |
40 | }; | |
41 | ||
8d47a43c DH |
42 | static int rxkad_prime_packet_security(struct rxrpc_connection *conn, |
43 | struct crypto_sync_skcipher *ci); | |
44 | ||
17926a79 DH |
45 | /* |
46 | * this holds a pinned cipher so that keventd doesn't get called by the cipher | |
47 | * alloc routine, but since we have it to hand, we use it to decrypt RESPONSE | |
48 | * packets | |
49 | */ | |
69d826fa | 50 | static struct crypto_sync_skcipher *rxkad_ci; |
1db88c53 | 51 | static struct skcipher_request *rxkad_ci_req; |
17926a79 DH |
52 | static DEFINE_MUTEX(rxkad_ci_mutex); |
53 | ||
12da59fc DH |
54 | /* |
55 | * Parse the information from a server key | |
56 | * | |
57 | * The data should be the 8-byte secret key. | |
58 | */ | |
59 | static int rxkad_preparse_server_key(struct key_preparsed_payload *prep) | |
60 | { | |
61 | struct crypto_skcipher *ci; | |
62 | ||
63 | if (prep->datalen != 8) | |
64 | return -EINVAL; | |
65 | ||
66 | memcpy(&prep->payload.data[2], prep->data, 8); | |
67 | ||
68 | ci = crypto_alloc_skcipher("pcbc(des)", 0, CRYPTO_ALG_ASYNC); | |
69 | if (IS_ERR(ci)) { | |
70 | _leave(" = %ld", PTR_ERR(ci)); | |
71 | return PTR_ERR(ci); | |
72 | } | |
73 | ||
74 | if (crypto_skcipher_setkey(ci, prep->data, 8) < 0) | |
75 | BUG(); | |
76 | ||
77 | prep->payload.data[0] = ci; | |
78 | _leave(" = 0"); | |
79 | return 0; | |
80 | } | |
81 | ||
82 | static void rxkad_free_preparse_server_key(struct key_preparsed_payload *prep) | |
83 | { | |
d7d775b1 | 84 | |
12da59fc DH |
85 | if (prep->payload.data[0]) |
86 | crypto_free_skcipher(prep->payload.data[0]); | |
87 | } | |
88 | ||
89 | static void rxkad_destroy_server_key(struct key *key) | |
90 | { | |
91 | if (key->payload.data[0]) { | |
92 | crypto_free_skcipher(key->payload.data[0]); | |
93 | key->payload.data[0] = NULL; | |
94 | } | |
95 | } | |
96 | ||
17926a79 DH |
97 | /* |
98 | * initialise connection security | |
99 | */ | |
41057ebd DH |
100 | static int rxkad_init_connection_security(struct rxrpc_connection *conn, |
101 | struct rxrpc_key_token *token) | |
17926a79 | 102 | { |
69d826fa | 103 | struct crypto_sync_skcipher *ci; |
17926a79 DH |
104 | int ret; |
105 | ||
19ffa01c | 106 | _enter("{%d},{%x}", conn->debug_id, key_serial(conn->params.key)); |
17926a79 | 107 | |
33941284 | 108 | conn->security_ix = token->security_index; |
17926a79 | 109 | |
69d826fa | 110 | ci = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0); |
17926a79 DH |
111 | if (IS_ERR(ci)) { |
112 | _debug("no cipher"); | |
113 | ret = PTR_ERR(ci); | |
114 | goto error; | |
115 | } | |
116 | ||
69d826fa | 117 | if (crypto_sync_skcipher_setkey(ci, token->kad->session_key, |
1afe593b | 118 | sizeof(token->kad->session_key)) < 0) |
17926a79 DH |
119 | BUG(); |
120 | ||
19ffa01c | 121 | switch (conn->params.security_level) { |
17926a79 | 122 | case RXRPC_SECURITY_PLAIN: |
17926a79 | 123 | case RXRPC_SECURITY_AUTH: |
17926a79 | 124 | case RXRPC_SECURITY_ENCRYPT: |
17926a79 DH |
125 | break; |
126 | default: | |
127 | ret = -EKEYREJECTED; | |
128 | goto error; | |
129 | } | |
130 | ||
8d47a43c DH |
131 | ret = rxkad_prime_packet_security(conn, ci); |
132 | if (ret < 0) | |
133 | goto error_ci; | |
134 | ||
521bb304 | 135 | conn->rxkad.cipher = ci; |
8d47a43c DH |
136 | return 0; |
137 | ||
138 | error_ci: | |
139 | crypto_free_sync_skcipher(ci); | |
17926a79 DH |
140 | error: |
141 | _leave(" = %d", ret); | |
142 | return ret; | |
143 | } | |
144 | ||
d7d775b1 DH |
145 | /* |
146 | * Work out how much data we can put in a packet. | |
147 | */ | |
148 | static int rxkad_how_much_data(struct rxrpc_call *call, size_t remain, | |
149 | size_t *_buf_size, size_t *_data_size, size_t *_offset) | |
150 | { | |
151 | size_t shdr, buf_size, chunk; | |
152 | ||
153 | switch (call->conn->params.security_level) { | |
154 | default: | |
155 | buf_size = chunk = min_t(size_t, remain, RXRPC_JUMBO_DATALEN); | |
156 | shdr = 0; | |
157 | goto out; | |
158 | case RXRPC_SECURITY_AUTH: | |
159 | shdr = sizeof(struct rxkad_level1_hdr); | |
160 | break; | |
161 | case RXRPC_SECURITY_ENCRYPT: | |
162 | shdr = sizeof(struct rxkad_level2_hdr); | |
163 | break; | |
164 | } | |
165 | ||
166 | buf_size = round_down(RXRPC_JUMBO_DATALEN, RXKAD_ALIGN); | |
167 | ||
168 | chunk = buf_size - shdr; | |
169 | if (remain < chunk) | |
170 | buf_size = round_up(shdr + remain, RXKAD_ALIGN); | |
171 | ||
172 | out: | |
173 | *_buf_size = buf_size; | |
174 | *_data_size = chunk; | |
175 | *_offset = shdr; | |
176 | return 0; | |
177 | } | |
178 | ||
17926a79 DH |
179 | /* |
180 | * prime the encryption state with the invariant parts of a connection's | |
181 | * description | |
182 | */ | |
8d47a43c DH |
183 | static int rxkad_prime_packet_security(struct rxrpc_connection *conn, |
184 | struct crypto_sync_skcipher *ci) | |
17926a79 | 185 | { |
1db88c53 | 186 | struct skcipher_request *req; |
33941284 | 187 | struct rxrpc_key_token *token; |
a263629d | 188 | struct scatterlist sg; |
17926a79 | 189 | struct rxrpc_crypt iv; |
a263629d HX |
190 | __be32 *tmpbuf; |
191 | size_t tmpsize = 4 * sizeof(__be32); | |
17926a79 DH |
192 | |
193 | _enter(""); | |
194 | ||
19ffa01c | 195 | if (!conn->params.key) |
a263629d HX |
196 | return 0; |
197 | ||
198 | tmpbuf = kmalloc(tmpsize, GFP_KERNEL); | |
199 | if (!tmpbuf) | |
200 | return -ENOMEM; | |
17926a79 | 201 | |
8d47a43c | 202 | req = skcipher_request_alloc(&ci->base, GFP_NOFS); |
1db88c53 DH |
203 | if (!req) { |
204 | kfree(tmpbuf); | |
205 | return -ENOMEM; | |
206 | } | |
207 | ||
19ffa01c | 208 | token = conn->params.key->payload.data[0]; |
33941284 | 209 | memcpy(&iv, token->kad->session_key, sizeof(iv)); |
17926a79 | 210 | |
a263629d HX |
211 | tmpbuf[0] = htonl(conn->proto.epoch); |
212 | tmpbuf[1] = htonl(conn->proto.cid); | |
213 | tmpbuf[2] = 0; | |
214 | tmpbuf[3] = htonl(conn->security_ix); | |
1afe593b | 215 | |
a263629d | 216 | sg_init_one(&sg, tmpbuf, tmpsize); |
8d47a43c | 217 | skcipher_request_set_sync_tfm(req, ci); |
1afe593b | 218 | skcipher_request_set_callback(req, 0, NULL, NULL); |
a263629d | 219 | skcipher_request_set_crypt(req, &sg, &sg, tmpsize, iv.x); |
1afe593b | 220 | crypto_skcipher_encrypt(req); |
1db88c53 | 221 | skcipher_request_free(req); |
17926a79 | 222 | |
521bb304 | 223 | memcpy(&conn->rxkad.csum_iv, tmpbuf + 2, sizeof(conn->rxkad.csum_iv)); |
a263629d HX |
224 | kfree(tmpbuf); |
225 | _leave(" = 0"); | |
226 | return 0; | |
17926a79 DH |
227 | } |
228 | ||
1db88c53 DH |
229 | /* |
230 | * Allocate and prepare the crypto request on a call. For any particular call, | |
231 | * this is called serially for the packets, so no lock should be necessary. | |
232 | */ | |
233 | static struct skcipher_request *rxkad_get_call_crypto(struct rxrpc_call *call) | |
234 | { | |
521bb304 | 235 | struct crypto_skcipher *tfm = &call->conn->rxkad.cipher->base; |
1db88c53 DH |
236 | struct skcipher_request *cipher_req = call->cipher_req; |
237 | ||
238 | if (!cipher_req) { | |
239 | cipher_req = skcipher_request_alloc(tfm, GFP_NOFS); | |
240 | if (!cipher_req) | |
241 | return NULL; | |
242 | call->cipher_req = cipher_req; | |
243 | } | |
244 | ||
245 | return cipher_req; | |
246 | } | |
247 | ||
248 | /* | |
249 | * Clean up the crypto on a call. | |
250 | */ | |
251 | static void rxkad_free_call_crypto(struct rxrpc_call *call) | |
252 | { | |
253 | if (call->cipher_req) | |
254 | skcipher_request_free(call->cipher_req); | |
255 | call->cipher_req = NULL; | |
256 | } | |
257 | ||
17926a79 DH |
258 | /* |
259 | * partially encrypt a packet (level 1 security) | |
260 | */ | |
261 | static int rxkad_secure_packet_auth(const struct rxrpc_call *call, | |
f4bdf3d6 | 262 | struct sk_buff *skb, u32 data_size, |
54424d38 | 263 | struct skcipher_request *req) |
17926a79 | 264 | { |
fb46f6ee | 265 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
a263629d | 266 | struct rxkad_level1_hdr hdr; |
17926a79 | 267 | struct rxrpc_crypt iv; |
a263629d | 268 | struct scatterlist sg; |
d7d775b1 | 269 | size_t pad; |
17926a79 DH |
270 | u16 check; |
271 | ||
17926a79 DH |
272 | _enter(""); |
273 | ||
5a924b89 | 274 | check = sp->hdr.seq ^ call->call_id; |
0d12f8a4 | 275 | data_size |= (u32)check << 16; |
17926a79 | 276 | |
a263629d | 277 | hdr.data_size = htonl(data_size); |
f4bdf3d6 | 278 | memcpy(skb->head, &hdr, sizeof(hdr)); |
17926a79 | 279 | |
d7d775b1 DH |
280 | pad = sizeof(struct rxkad_level1_hdr) + data_size; |
281 | pad = RXKAD_ALIGN - pad; | |
282 | pad &= RXKAD_ALIGN - 1; | |
283 | if (pad) | |
284 | skb_put_zero(skb, pad); | |
285 | ||
17926a79 DH |
286 | /* start the encryption afresh */ |
287 | memset(&iv, 0, sizeof(iv)); | |
17926a79 | 288 | |
f4bdf3d6 | 289 | sg_init_one(&sg, skb->head, 8); |
521bb304 | 290 | skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); |
1afe593b | 291 | skcipher_request_set_callback(req, 0, NULL, NULL); |
a263629d | 292 | skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); |
1afe593b HX |
293 | crypto_skcipher_encrypt(req); |
294 | skcipher_request_zero(req); | |
17926a79 | 295 | |
17926a79 DH |
296 | _leave(" = 0"); |
297 | return 0; | |
298 | } | |
299 | ||
300 | /* | |
301 | * wholly encrypt a packet (level 2 security) | |
302 | */ | |
303 | static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call, | |
b4f1342f DH |
304 | struct sk_buff *skb, |
305 | u32 data_size, | |
54424d38 | 306 | struct skcipher_request *req) |
17926a79 | 307 | { |
33941284 | 308 | const struct rxrpc_key_token *token; |
a263629d | 309 | struct rxkad_level2_hdr rxkhdr; |
17926a79 | 310 | struct rxrpc_skb_priv *sp; |
17926a79 DH |
311 | struct rxrpc_crypt iv; |
312 | struct scatterlist sg[16]; | |
95c96174 | 313 | unsigned int len; |
d7d775b1 | 314 | size_t pad; |
17926a79 | 315 | u16 check; |
1afe593b | 316 | int err; |
17926a79 DH |
317 | |
318 | sp = rxrpc_skb(skb); | |
319 | ||
320 | _enter(""); | |
321 | ||
5a924b89 | 322 | check = sp->hdr.seq ^ call->call_id; |
17926a79 | 323 | |
0d12f8a4 | 324 | rxkhdr.data_size = htonl(data_size | (u32)check << 16); |
17926a79 | 325 | rxkhdr.checksum = 0; |
f4bdf3d6 | 326 | memcpy(skb->head, &rxkhdr, sizeof(rxkhdr)); |
17926a79 | 327 | |
d7d775b1 DH |
328 | pad = sizeof(struct rxkad_level2_hdr) + data_size; |
329 | pad = RXKAD_ALIGN - pad; | |
330 | pad &= RXKAD_ALIGN - 1; | |
331 | if (pad) | |
332 | skb_put_zero(skb, pad); | |
333 | ||
17926a79 | 334 | /* encrypt from the session key */ |
19ffa01c | 335 | token = call->conn->params.key->payload.data[0]; |
33941284 | 336 | memcpy(&iv, token->kad->session_key, sizeof(iv)); |
17926a79 | 337 | |
f4bdf3d6 | 338 | sg_init_one(&sg[0], skb->head, sizeof(rxkhdr)); |
521bb304 | 339 | skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); |
1afe593b | 340 | skcipher_request_set_callback(req, 0, NULL, NULL); |
a263629d | 341 | skcipher_request_set_crypt(req, &sg[0], &sg[0], sizeof(rxkhdr), iv.x); |
1afe593b | 342 | crypto_skcipher_encrypt(req); |
17926a79 DH |
343 | |
344 | /* we want to encrypt the skbuff in-place */ | |
d0d5c0cd DH |
345 | err = -EMSGSIZE; |
346 | if (skb_shinfo(skb)->nr_frags > 16) | |
1afe593b | 347 | goto out; |
17926a79 | 348 | |
d7d775b1 | 349 | len = round_up(data_size, RXKAD_ALIGN); |
17926a79 | 350 | |
d0d5c0cd | 351 | sg_init_table(sg, ARRAY_SIZE(sg)); |
f4bdf3d6 | 352 | err = skb_to_sgvec(skb, sg, 8, len); |
89a5ea99 JD |
353 | if (unlikely(err < 0)) |
354 | goto out; | |
1afe593b | 355 | skcipher_request_set_crypt(req, sg, sg, len, iv.x); |
1afe593b | 356 | crypto_skcipher_encrypt(req); |
17926a79 DH |
357 | |
358 | _leave(" = 0"); | |
1afe593b HX |
359 | err = 0; |
360 | ||
361 | out: | |
362 | skcipher_request_zero(req); | |
363 | return err; | |
17926a79 DH |
364 | } |
365 | ||
366 | /* | |
367 | * checksum an RxRPC packet header | |
368 | */ | |
a263629d | 369 | static int rxkad_secure_packet(struct rxrpc_call *call, |
b4f1342f | 370 | struct sk_buff *skb, |
f4bdf3d6 | 371 | size_t data_size) |
17926a79 DH |
372 | { |
373 | struct rxrpc_skb_priv *sp; | |
1db88c53 | 374 | struct skcipher_request *req; |
17926a79 | 375 | struct rxrpc_crypt iv; |
a263629d | 376 | struct scatterlist sg; |
0d12f8a4 | 377 | u32 x, y; |
17926a79 DH |
378 | int ret; |
379 | ||
380 | sp = rxrpc_skb(skb); | |
381 | ||
382 | _enter("{%d{%x}},{#%u},%zu,", | |
19ffa01c DH |
383 | call->debug_id, key_serial(call->conn->params.key), |
384 | sp->hdr.seq, data_size); | |
17926a79 | 385 | |
521bb304 | 386 | if (!call->conn->rxkad.cipher) |
17926a79 DH |
387 | return 0; |
388 | ||
19ffa01c | 389 | ret = key_validate(call->conn->params.key); |
17926a79 DH |
390 | if (ret < 0) |
391 | return ret; | |
392 | ||
1db88c53 DH |
393 | req = rxkad_get_call_crypto(call); |
394 | if (!req) | |
395 | return -ENOMEM; | |
396 | ||
17926a79 | 397 | /* continue encrypting from where we left off */ |
521bb304 | 398 | memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv)); |
17926a79 DH |
399 | |
400 | /* calculate the security checksum */ | |
01a90a45 | 401 | x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT); |
0d12f8a4 | 402 | x |= sp->hdr.seq & 0x3fffffff; |
5a924b89 | 403 | call->crypto_buf[0] = htonl(call->call_id); |
a263629d | 404 | call->crypto_buf[1] = htonl(x); |
1afe593b | 405 | |
a263629d | 406 | sg_init_one(&sg, call->crypto_buf, 8); |
521bb304 | 407 | skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); |
1afe593b | 408 | skcipher_request_set_callback(req, 0, NULL, NULL); |
a263629d | 409 | skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); |
1afe593b HX |
410 | crypto_skcipher_encrypt(req); |
411 | skcipher_request_zero(req); | |
17926a79 | 412 | |
a263629d | 413 | y = ntohl(call->crypto_buf[1]); |
91e916cf AV |
414 | y = (y >> 16) & 0xffff; |
415 | if (y == 0) | |
416 | y = 1; /* zero checksums are not permitted */ | |
0d12f8a4 | 417 | sp->hdr.cksum = y; |
17926a79 | 418 | |
19ffa01c | 419 | switch (call->conn->params.security_level) { |
17926a79 DH |
420 | case RXRPC_SECURITY_PLAIN: |
421 | ret = 0; | |
422 | break; | |
423 | case RXRPC_SECURITY_AUTH: | |
f4bdf3d6 | 424 | ret = rxkad_secure_packet_auth(call, skb, data_size, req); |
17926a79 DH |
425 | break; |
426 | case RXRPC_SECURITY_ENCRYPT: | |
f4bdf3d6 | 427 | ret = rxkad_secure_packet_encrypt(call, skb, data_size, req); |
17926a79 DH |
428 | break; |
429 | default: | |
430 | ret = -EPERM; | |
431 | break; | |
432 | } | |
433 | ||
5b47d236 | 434 | _leave(" = %d [set %x]", ret, y); |
17926a79 DH |
435 | return ret; |
436 | } | |
437 | ||
438 | /* | |
439 | * decrypt partial encryption on a packet (level 1 security) | |
440 | */ | |
5a42976d | 441 | static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb, |
248f219c | 442 | unsigned int offset, unsigned int len, |
54424d38 KC |
443 | rxrpc_seq_t seq, |
444 | struct skcipher_request *req) | |
17926a79 DH |
445 | { |
446 | struct rxkad_level1_hdr sechdr; | |
17926a79 | 447 | struct rxrpc_crypt iv; |
68e3f5dd | 448 | struct scatterlist sg[16]; |
fb46f6ee | 449 | bool aborted; |
17926a79 DH |
450 | u32 data_size, buf; |
451 | u16 check; | |
d0d5c0cd | 452 | int ret; |
17926a79 DH |
453 | |
454 | _enter(""); | |
455 | ||
248f219c | 456 | if (len < 8) { |
fb46f6ee DH |
457 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_1_hdr", "V1H", |
458 | RXKADSEALEDINCON); | |
5a42976d DH |
459 | goto protocol_error; |
460 | } | |
17926a79 | 461 | |
248f219c DH |
462 | /* Decrypt the skbuff in-place. TODO: We really want to decrypt |
463 | * directly into the target buffer. | |
464 | */ | |
d0d5c0cd | 465 | sg_init_table(sg, ARRAY_SIZE(sg)); |
89a5ea99 JD |
466 | ret = skb_to_sgvec(skb, sg, offset, 8); |
467 | if (unlikely(ret < 0)) | |
468 | return ret; | |
17926a79 DH |
469 | |
470 | /* start the decryption afresh */ | |
471 | memset(&iv, 0, sizeof(iv)); | |
17926a79 | 472 | |
521bb304 | 473 | skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); |
1afe593b HX |
474 | skcipher_request_set_callback(req, 0, NULL, NULL); |
475 | skcipher_request_set_crypt(req, sg, sg, 8, iv.x); | |
1afe593b HX |
476 | crypto_skcipher_decrypt(req); |
477 | skcipher_request_zero(req); | |
17926a79 | 478 | |
5a42976d | 479 | /* Extract the decrypted packet length */ |
248f219c | 480 | if (skb_copy_bits(skb, offset, &sechdr, sizeof(sechdr)) < 0) { |
fb46f6ee DH |
481 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_1_len", "XV1", |
482 | RXKADDATALEN); | |
5a42976d DH |
483 | goto protocol_error; |
484 | } | |
248f219c | 485 | len -= sizeof(sechdr); |
17926a79 DH |
486 | |
487 | buf = ntohl(sechdr.data_size); | |
488 | data_size = buf & 0xffff; | |
489 | ||
490 | check = buf >> 16; | |
5a42976d | 491 | check ^= seq ^ call->call_id; |
17926a79 DH |
492 | check &= 0xffff; |
493 | if (check != 0) { | |
fb46f6ee DH |
494 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_1_check", "V1C", |
495 | RXKADSEALEDINCON); | |
17926a79 DH |
496 | goto protocol_error; |
497 | } | |
498 | ||
248f219c | 499 | if (data_size > len) { |
fb46f6ee DH |
500 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_1_datalen", "V1L", |
501 | RXKADDATALEN); | |
5a42976d DH |
502 | goto protocol_error; |
503 | } | |
17926a79 DH |
504 | |
505 | _leave(" = 0 [dlen=%x]", data_size); | |
506 | return 0; | |
507 | ||
17926a79 | 508 | protocol_error: |
fb46f6ee DH |
509 | if (aborted) |
510 | rxrpc_send_abort_packet(call); | |
17926a79 | 511 | return -EPROTO; |
17926a79 DH |
512 | } |
513 | ||
514 | /* | |
515 | * wholly decrypt a packet (level 2 security) | |
516 | */ | |
5a42976d | 517 | static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb, |
248f219c | 518 | unsigned int offset, unsigned int len, |
54424d38 KC |
519 | rxrpc_seq_t seq, |
520 | struct skcipher_request *req) | |
17926a79 | 521 | { |
33941284 | 522 | const struct rxrpc_key_token *token; |
17926a79 | 523 | struct rxkad_level2_hdr sechdr; |
17926a79 DH |
524 | struct rxrpc_crypt iv; |
525 | struct scatterlist _sg[4], *sg; | |
fb46f6ee | 526 | bool aborted; |
17926a79 DH |
527 | u32 data_size, buf; |
528 | u16 check; | |
89a5ea99 | 529 | int nsg, ret; |
17926a79 DH |
530 | |
531 | _enter(",{%d}", skb->len); | |
532 | ||
248f219c | 533 | if (len < 8) { |
fb46f6ee DH |
534 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_2_hdr", "V2H", |
535 | RXKADSEALEDINCON); | |
5a42976d DH |
536 | goto protocol_error; |
537 | } | |
17926a79 | 538 | |
248f219c DH |
539 | /* Decrypt the skbuff in-place. TODO: We really want to decrypt |
540 | * directly into the target buffer. | |
541 | */ | |
17926a79 | 542 | sg = _sg; |
0d40f728 | 543 | nsg = skb_shinfo(skb)->nr_frags + 1; |
d0d5c0cd DH |
544 | if (nsg <= 4) { |
545 | nsg = 4; | |
546 | } else { | |
6da2ec56 | 547 | sg = kmalloc_array(nsg, sizeof(*sg), GFP_NOIO); |
17926a79 DH |
548 | if (!sg) |
549 | goto nomem; | |
550 | } | |
551 | ||
68e3f5dd | 552 | sg_init_table(sg, nsg); |
89a5ea99 JD |
553 | ret = skb_to_sgvec(skb, sg, offset, len); |
554 | if (unlikely(ret < 0)) { | |
555 | if (sg != _sg) | |
556 | kfree(sg); | |
557 | return ret; | |
558 | } | |
17926a79 DH |
559 | |
560 | /* decrypt from the session key */ | |
19ffa01c | 561 | token = call->conn->params.key->payload.data[0]; |
33941284 | 562 | memcpy(&iv, token->kad->session_key, sizeof(iv)); |
17926a79 | 563 | |
521bb304 | 564 | skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); |
1afe593b | 565 | skcipher_request_set_callback(req, 0, NULL, NULL); |
248f219c | 566 | skcipher_request_set_crypt(req, sg, sg, len, iv.x); |
1afe593b HX |
567 | crypto_skcipher_decrypt(req); |
568 | skcipher_request_zero(req); | |
17926a79 DH |
569 | if (sg != _sg) |
570 | kfree(sg); | |
571 | ||
5a42976d | 572 | /* Extract the decrypted packet length */ |
248f219c | 573 | if (skb_copy_bits(skb, offset, &sechdr, sizeof(sechdr)) < 0) { |
fb46f6ee DH |
574 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_2_len", "XV2", |
575 | RXKADDATALEN); | |
5a42976d DH |
576 | goto protocol_error; |
577 | } | |
248f219c | 578 | len -= sizeof(sechdr); |
17926a79 DH |
579 | |
580 | buf = ntohl(sechdr.data_size); | |
581 | data_size = buf & 0xffff; | |
582 | ||
583 | check = buf >> 16; | |
5a42976d | 584 | check ^= seq ^ call->call_id; |
17926a79 DH |
585 | check &= 0xffff; |
586 | if (check != 0) { | |
fb46f6ee DH |
587 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_2_check", "V2C", |
588 | RXKADSEALEDINCON); | |
17926a79 DH |
589 | goto protocol_error; |
590 | } | |
591 | ||
248f219c | 592 | if (data_size > len) { |
fb46f6ee DH |
593 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_2_datalen", "V2L", |
594 | RXKADDATALEN); | |
5a42976d DH |
595 | goto protocol_error; |
596 | } | |
17926a79 DH |
597 | |
598 | _leave(" = 0 [dlen=%x]", data_size); | |
599 | return 0; | |
600 | ||
17926a79 | 601 | protocol_error: |
fb46f6ee DH |
602 | if (aborted) |
603 | rxrpc_send_abort_packet(call); | |
17926a79 DH |
604 | return -EPROTO; |
605 | ||
606 | nomem: | |
607 | _leave(" = -ENOMEM"); | |
608 | return -ENOMEM; | |
609 | } | |
610 | ||
611 | /* | |
5a42976d DH |
612 | * Verify the security on a received packet or subpacket (if part of a |
613 | * jumbo packet). | |
17926a79 | 614 | */ |
5a42976d | 615 | static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb, |
248f219c | 616 | unsigned int offset, unsigned int len, |
5a42976d | 617 | rxrpc_seq_t seq, u16 expected_cksum) |
17926a79 | 618 | { |
1db88c53 | 619 | struct skcipher_request *req; |
17926a79 | 620 | struct rxrpc_crypt iv; |
a263629d | 621 | struct scatterlist sg; |
fb46f6ee | 622 | bool aborted; |
0d12f8a4 DH |
623 | u16 cksum; |
624 | u32 x, y; | |
17926a79 DH |
625 | |
626 | _enter("{%d{%x}},{#%u}", | |
5a42976d | 627 | call->debug_id, key_serial(call->conn->params.key), seq); |
17926a79 | 628 | |
521bb304 | 629 | if (!call->conn->rxkad.cipher) |
17926a79 DH |
630 | return 0; |
631 | ||
1db88c53 DH |
632 | req = rxkad_get_call_crypto(call); |
633 | if (!req) | |
634 | return -ENOMEM; | |
635 | ||
17926a79 | 636 | /* continue encrypting from where we left off */ |
521bb304 | 637 | memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv)); |
17926a79 DH |
638 | |
639 | /* validate the security checksum */ | |
01a90a45 | 640 | x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT); |
5a42976d | 641 | x |= seq & 0x3fffffff; |
a263629d HX |
642 | call->crypto_buf[0] = htonl(call->call_id); |
643 | call->crypto_buf[1] = htonl(x); | |
1afe593b | 644 | |
a263629d | 645 | sg_init_one(&sg, call->crypto_buf, 8); |
521bb304 | 646 | skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); |
1afe593b | 647 | skcipher_request_set_callback(req, 0, NULL, NULL); |
a263629d | 648 | skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); |
1afe593b HX |
649 | crypto_skcipher_encrypt(req); |
650 | skcipher_request_zero(req); | |
17926a79 | 651 | |
a263629d | 652 | y = ntohl(call->crypto_buf[1]); |
0d12f8a4 DH |
653 | cksum = (y >> 16) & 0xffff; |
654 | if (cksum == 0) | |
655 | cksum = 1; /* zero checksums are not permitted */ | |
17926a79 | 656 | |
5a42976d | 657 | if (cksum != expected_cksum) { |
fb46f6ee DH |
658 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_csum", "VCK", |
659 | RXKADSEALEDINCON); | |
660 | goto protocol_error; | |
17926a79 DH |
661 | } |
662 | ||
19ffa01c | 663 | switch (call->conn->params.security_level) { |
17926a79 | 664 | case RXRPC_SECURITY_PLAIN: |
5a42976d | 665 | return 0; |
17926a79 | 666 | case RXRPC_SECURITY_AUTH: |
54424d38 | 667 | return rxkad_verify_packet_1(call, skb, offset, len, seq, req); |
17926a79 | 668 | case RXRPC_SECURITY_ENCRYPT: |
54424d38 | 669 | return rxkad_verify_packet_2(call, skb, offset, len, seq, req); |
17926a79 | 670 | default: |
5a42976d | 671 | return -ENOANO; |
17926a79 | 672 | } |
fb46f6ee DH |
673 | |
674 | protocol_error: | |
675 | if (aborted) | |
676 | rxrpc_send_abort_packet(call); | |
677 | return -EPROTO; | |
17926a79 DH |
678 | } |
679 | ||
248f219c DH |
680 | /* |
681 | * Locate the data contained in a packet that was partially encrypted. | |
682 | */ | |
683 | static void rxkad_locate_data_1(struct rxrpc_call *call, struct sk_buff *skb, | |
684 | unsigned int *_offset, unsigned int *_len) | |
685 | { | |
686 | struct rxkad_level1_hdr sechdr; | |
687 | ||
688 | if (skb_copy_bits(skb, *_offset, &sechdr, sizeof(sechdr)) < 0) | |
689 | BUG(); | |
690 | *_offset += sizeof(sechdr); | |
691 | *_len = ntohl(sechdr.data_size) & 0xffff; | |
692 | } | |
693 | ||
694 | /* | |
695 | * Locate the data contained in a packet that was completely encrypted. | |
696 | */ | |
697 | static void rxkad_locate_data_2(struct rxrpc_call *call, struct sk_buff *skb, | |
698 | unsigned int *_offset, unsigned int *_len) | |
699 | { | |
700 | struct rxkad_level2_hdr sechdr; | |
701 | ||
702 | if (skb_copy_bits(skb, *_offset, &sechdr, sizeof(sechdr)) < 0) | |
703 | BUG(); | |
704 | *_offset += sizeof(sechdr); | |
705 | *_len = ntohl(sechdr.data_size) & 0xffff; | |
706 | } | |
707 | ||
708 | /* | |
709 | * Locate the data contained in an already decrypted packet. | |
710 | */ | |
711 | static void rxkad_locate_data(struct rxrpc_call *call, struct sk_buff *skb, | |
712 | unsigned int *_offset, unsigned int *_len) | |
713 | { | |
714 | switch (call->conn->params.security_level) { | |
715 | case RXRPC_SECURITY_AUTH: | |
716 | rxkad_locate_data_1(call, skb, _offset, _len); | |
717 | return; | |
718 | case RXRPC_SECURITY_ENCRYPT: | |
719 | rxkad_locate_data_2(call, skb, _offset, _len); | |
720 | return; | |
721 | default: | |
722 | return; | |
723 | } | |
724 | } | |
725 | ||
17926a79 DH |
726 | /* |
727 | * issue a challenge | |
728 | */ | |
729 | static int rxkad_issue_challenge(struct rxrpc_connection *conn) | |
730 | { | |
731 | struct rxkad_challenge challenge; | |
0d12f8a4 | 732 | struct rxrpc_wire_header whdr; |
17926a79 DH |
733 | struct msghdr msg; |
734 | struct kvec iov[2]; | |
735 | size_t len; | |
0d12f8a4 | 736 | u32 serial; |
17926a79 DH |
737 | int ret; |
738 | ||
ec832bd0 | 739 | _enter("{%d}", conn->debug_id); |
17926a79 | 740 | |
521bb304 | 741 | get_random_bytes(&conn->rxkad.nonce, sizeof(conn->rxkad.nonce)); |
17926a79 DH |
742 | |
743 | challenge.version = htonl(2); | |
521bb304 | 744 | challenge.nonce = htonl(conn->rxkad.nonce); |
17926a79 DH |
745 | challenge.min_level = htonl(0); |
746 | challenge.__padding = 0; | |
747 | ||
7b674e39 DH |
748 | msg.msg_name = &conn->params.peer->srx.transport; |
749 | msg.msg_namelen = conn->params.peer->srx.transport_len; | |
17926a79 DH |
750 | msg.msg_control = NULL; |
751 | msg.msg_controllen = 0; | |
752 | msg.msg_flags = 0; | |
753 | ||
19ffa01c DH |
754 | whdr.epoch = htonl(conn->proto.epoch); |
755 | whdr.cid = htonl(conn->proto.cid); | |
0d12f8a4 DH |
756 | whdr.callNumber = 0; |
757 | whdr.seq = 0; | |
758 | whdr.type = RXRPC_PACKET_TYPE_CHALLENGE; | |
759 | whdr.flags = conn->out_clientflag; | |
760 | whdr.userStatus = 0; | |
761 | whdr.securityIndex = conn->security_ix; | |
762 | whdr._rsvd = 0; | |
68d6d1ae | 763 | whdr.serviceId = htons(conn->service_id); |
0d12f8a4 DH |
764 | |
765 | iov[0].iov_base = &whdr; | |
766 | iov[0].iov_len = sizeof(whdr); | |
17926a79 DH |
767 | iov[1].iov_base = &challenge; |
768 | iov[1].iov_len = sizeof(challenge); | |
769 | ||
770 | len = iov[0].iov_len + iov[1].iov_len; | |
771 | ||
0d12f8a4 DH |
772 | serial = atomic_inc_return(&conn->serial); |
773 | whdr.serial = htonl(serial); | |
774 | _proto("Tx CHALLENGE %%%u", serial); | |
17926a79 | 775 | |
85f32278 | 776 | ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len); |
17926a79 | 777 | if (ret < 0) { |
6b47fe1d | 778 | trace_rxrpc_tx_fail(conn->debug_id, serial, ret, |
4764c0da | 779 | rxrpc_tx_point_rxkad_challenge); |
17926a79 DH |
780 | return -EAGAIN; |
781 | } | |
782 | ||
330bdcfa | 783 | conn->params.peer->last_tx_at = ktime_get_seconds(); |
4764c0da DH |
784 | trace_rxrpc_tx_packet(conn->debug_id, &whdr, |
785 | rxrpc_tx_point_rxkad_challenge); | |
17926a79 DH |
786 | _leave(" = 0"); |
787 | return 0; | |
788 | } | |
789 | ||
790 | /* | |
791 | * send a Kerberos security response | |
792 | */ | |
793 | static int rxkad_send_response(struct rxrpc_connection *conn, | |
0d12f8a4 | 794 | struct rxrpc_host_header *hdr, |
17926a79 DH |
795 | struct rxkad_response *resp, |
796 | const struct rxkad_key *s2) | |
797 | { | |
0d12f8a4 | 798 | struct rxrpc_wire_header whdr; |
17926a79 DH |
799 | struct msghdr msg; |
800 | struct kvec iov[3]; | |
801 | size_t len; | |
0d12f8a4 | 802 | u32 serial; |
17926a79 DH |
803 | int ret; |
804 | ||
805 | _enter(""); | |
806 | ||
7b674e39 DH |
807 | msg.msg_name = &conn->params.peer->srx.transport; |
808 | msg.msg_namelen = conn->params.peer->srx.transport_len; | |
17926a79 DH |
809 | msg.msg_control = NULL; |
810 | msg.msg_controllen = 0; | |
811 | msg.msg_flags = 0; | |
812 | ||
0d12f8a4 DH |
813 | memset(&whdr, 0, sizeof(whdr)); |
814 | whdr.epoch = htonl(hdr->epoch); | |
815 | whdr.cid = htonl(hdr->cid); | |
816 | whdr.type = RXRPC_PACKET_TYPE_RESPONSE; | |
817 | whdr.flags = conn->out_clientflag; | |
818 | whdr.securityIndex = hdr->securityIndex; | |
819 | whdr.serviceId = htons(hdr->serviceId); | |
17926a79 | 820 | |
0d12f8a4 DH |
821 | iov[0].iov_base = &whdr; |
822 | iov[0].iov_len = sizeof(whdr); | |
17926a79 DH |
823 | iov[1].iov_base = resp; |
824 | iov[1].iov_len = sizeof(*resp); | |
0d12f8a4 | 825 | iov[2].iov_base = (void *)s2->ticket; |
17926a79 DH |
826 | iov[2].iov_len = s2->ticket_len; |
827 | ||
828 | len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len; | |
829 | ||
0d12f8a4 DH |
830 | serial = atomic_inc_return(&conn->serial); |
831 | whdr.serial = htonl(serial); | |
832 | _proto("Tx RESPONSE %%%u", serial); | |
17926a79 | 833 | |
85f32278 | 834 | ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 3, len); |
17926a79 | 835 | if (ret < 0) { |
6b47fe1d | 836 | trace_rxrpc_tx_fail(conn->debug_id, serial, ret, |
4764c0da | 837 | rxrpc_tx_point_rxkad_response); |
17926a79 DH |
838 | return -EAGAIN; |
839 | } | |
840 | ||
330bdcfa | 841 | conn->params.peer->last_tx_at = ktime_get_seconds(); |
17926a79 DH |
842 | _leave(" = 0"); |
843 | return 0; | |
844 | } | |
845 | ||
846 | /* | |
847 | * calculate the response checksum | |
848 | */ | |
849 | static void rxkad_calc_response_checksum(struct rxkad_response *response) | |
850 | { | |
851 | u32 csum = 1000003; | |
852 | int loop; | |
853 | u8 *p = (u8 *) response; | |
854 | ||
855 | for (loop = sizeof(*response); loop > 0; loop--) | |
856 | csum = csum * 0x10204081 + *p++; | |
857 | ||
858 | response->encrypted.checksum = htonl(csum); | |
859 | } | |
860 | ||
17926a79 DH |
861 | /* |
862 | * encrypt the response packet | |
863 | */ | |
1db88c53 DH |
864 | static int rxkad_encrypt_response(struct rxrpc_connection *conn, |
865 | struct rxkad_response *resp, | |
866 | const struct rxkad_key *s2) | |
17926a79 | 867 | { |
1db88c53 | 868 | struct skcipher_request *req; |
17926a79 | 869 | struct rxrpc_crypt iv; |
a263629d | 870 | struct scatterlist sg[1]; |
17926a79 | 871 | |
521bb304 | 872 | req = skcipher_request_alloc(&conn->rxkad.cipher->base, GFP_NOFS); |
1db88c53 DH |
873 | if (!req) |
874 | return -ENOMEM; | |
875 | ||
17926a79 DH |
876 | /* continue encrypting from where we left off */ |
877 | memcpy(&iv, s2->session_key, sizeof(iv)); | |
17926a79 | 878 | |
a263629d HX |
879 | sg_init_table(sg, 1); |
880 | sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted)); | |
521bb304 | 881 | skcipher_request_set_sync_tfm(req, conn->rxkad.cipher); |
1afe593b HX |
882 | skcipher_request_set_callback(req, 0, NULL, NULL); |
883 | skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x); | |
1afe593b | 884 | crypto_skcipher_encrypt(req); |
1db88c53 DH |
885 | skcipher_request_free(req); |
886 | return 0; | |
17926a79 DH |
887 | } |
888 | ||
889 | /* | |
890 | * respond to a challenge packet | |
891 | */ | |
892 | static int rxkad_respond_to_challenge(struct rxrpc_connection *conn, | |
893 | struct sk_buff *skb, | |
894 | u32 *_abort_code) | |
895 | { | |
33941284 | 896 | const struct rxrpc_key_token *token; |
17926a79 | 897 | struct rxkad_challenge challenge; |
8c2f826d | 898 | struct rxkad_response *resp; |
248f219c | 899 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
fb46f6ee | 900 | const char *eproto; |
17926a79 DH |
901 | u32 version, nonce, min_level, abort_code; |
902 | int ret; | |
903 | ||
19ffa01c | 904 | _enter("{%d,%x}", conn->debug_id, key_serial(conn->params.key)); |
17926a79 | 905 | |
fb46f6ee | 906 | eproto = tracepoint_string("chall_no_key"); |
ef68622d DH |
907 | abort_code = RX_PROTOCOL_ERROR; |
908 | if (!conn->params.key) | |
909 | goto protocol_error; | |
17926a79 | 910 | |
ef68622d | 911 | abort_code = RXKADEXPIRED; |
19ffa01c | 912 | ret = key_validate(conn->params.key); |
ef68622d DH |
913 | if (ret < 0) |
914 | goto other_error; | |
17926a79 | 915 | |
fb46f6ee | 916 | eproto = tracepoint_string("chall_short"); |
17926a79 | 917 | abort_code = RXKADPACKETSHORT; |
775e5b71 DH |
918 | if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header), |
919 | &challenge, sizeof(challenge)) < 0) | |
17926a79 DH |
920 | goto protocol_error; |
921 | ||
922 | version = ntohl(challenge.version); | |
923 | nonce = ntohl(challenge.nonce); | |
924 | min_level = ntohl(challenge.min_level); | |
925 | ||
926 | _proto("Rx CHALLENGE %%%u { v=%u n=%u ml=%u }", | |
0d12f8a4 | 927 | sp->hdr.serial, version, nonce, min_level); |
17926a79 | 928 | |
fb46f6ee | 929 | eproto = tracepoint_string("chall_ver"); |
17926a79 DH |
930 | abort_code = RXKADINCONSISTENCY; |
931 | if (version != RXKAD_VERSION) | |
932 | goto protocol_error; | |
933 | ||
934 | abort_code = RXKADLEVELFAIL; | |
ef68622d | 935 | ret = -EACCES; |
19ffa01c | 936 | if (conn->params.security_level < min_level) |
ef68622d | 937 | goto other_error; |
17926a79 | 938 | |
19ffa01c | 939 | token = conn->params.key->payload.data[0]; |
17926a79 DH |
940 | |
941 | /* build the response packet */ | |
8c2f826d DH |
942 | resp = kzalloc(sizeof(struct rxkad_response), GFP_NOFS); |
943 | if (!resp) | |
944 | return -ENOMEM; | |
945 | ||
946 | resp->version = htonl(RXKAD_VERSION); | |
947 | resp->encrypted.epoch = htonl(conn->proto.epoch); | |
948 | resp->encrypted.cid = htonl(conn->proto.cid); | |
949 | resp->encrypted.securityIndex = htonl(conn->security_ix); | |
950 | resp->encrypted.inc_nonce = htonl(nonce + 1); | |
951 | resp->encrypted.level = htonl(conn->params.security_level); | |
952 | resp->kvno = htonl(token->kad->kvno); | |
953 | resp->ticket_len = htonl(token->kad->ticket_len); | |
954 | resp->encrypted.call_id[0] = htonl(conn->channels[0].call_counter); | |
955 | resp->encrypted.call_id[1] = htonl(conn->channels[1].call_counter); | |
956 | resp->encrypted.call_id[2] = htonl(conn->channels[2].call_counter); | |
957 | resp->encrypted.call_id[3] = htonl(conn->channels[3].call_counter); | |
17926a79 DH |
958 | |
959 | /* calculate the response checksum and then do the encryption */ | |
8c2f826d | 960 | rxkad_calc_response_checksum(resp); |
1db88c53 DH |
961 | ret = rxkad_encrypt_response(conn, resp, token->kad); |
962 | if (ret == 0) | |
963 | ret = rxkad_send_response(conn, &sp->hdr, resp, token->kad); | |
8c2f826d DH |
964 | kfree(resp); |
965 | return ret; | |
17926a79 DH |
966 | |
967 | protocol_error: | |
fb46f6ee | 968 | trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto); |
ef68622d DH |
969 | ret = -EPROTO; |
970 | other_error: | |
17926a79 | 971 | *_abort_code = abort_code; |
ef68622d | 972 | return ret; |
17926a79 DH |
973 | } |
974 | ||
975 | /* | |
976 | * decrypt the kerberos IV ticket in the response | |
977 | */ | |
978 | static int rxkad_decrypt_ticket(struct rxrpc_connection *conn, | |
ec832bd0 | 979 | struct key *server_key, |
fb46f6ee | 980 | struct sk_buff *skb, |
17926a79 DH |
981 | void *ticket, size_t ticket_len, |
982 | struct rxrpc_crypt *_session_key, | |
10674a03 | 983 | time64_t *_expiry, |
17926a79 DH |
984 | u32 *_abort_code) |
985 | { | |
1afe593b | 986 | struct skcipher_request *req; |
fb46f6ee | 987 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
17926a79 | 988 | struct rxrpc_crypt iv, key; |
68e3f5dd | 989 | struct scatterlist sg[1]; |
17926a79 | 990 | struct in_addr addr; |
95c96174 | 991 | unsigned int life; |
fb46f6ee | 992 | const char *eproto; |
10674a03 | 993 | time64_t issue, now; |
17926a79 DH |
994 | bool little_endian; |
995 | int ret; | |
fb46f6ee | 996 | u32 abort_code; |
17926a79 DH |
997 | u8 *p, *q, *name, *end; |
998 | ||
ec832bd0 | 999 | _enter("{%d},{%x}", conn->debug_id, key_serial(server_key)); |
17926a79 DH |
1000 | |
1001 | *_expiry = 0; | |
1002 | ||
ec832bd0 | 1003 | ASSERT(server_key->payload.data[0] != NULL); |
17926a79 DH |
1004 | ASSERTCMP((unsigned long) ticket & 7UL, ==, 0); |
1005 | ||
ec832bd0 | 1006 | memcpy(&iv, &server_key->payload.data[2], sizeof(iv)); |
17926a79 | 1007 | |
ef68622d | 1008 | ret = -ENOMEM; |
ec832bd0 | 1009 | req = skcipher_request_alloc(server_key->payload.data[0], GFP_NOFS); |
ef68622d DH |
1010 | if (!req) |
1011 | goto temporary_error; | |
17926a79 | 1012 | |
68e3f5dd | 1013 | sg_init_one(&sg[0], ticket, ticket_len); |
1afe593b HX |
1014 | skcipher_request_set_callback(req, 0, NULL, NULL); |
1015 | skcipher_request_set_crypt(req, sg, sg, ticket_len, iv.x); | |
1afe593b HX |
1016 | crypto_skcipher_decrypt(req); |
1017 | skcipher_request_free(req); | |
17926a79 DH |
1018 | |
1019 | p = ticket; | |
1020 | end = p + ticket_len; | |
1021 | ||
fb46f6ee | 1022 | #define Z(field) \ |
17926a79 DH |
1023 | ({ \ |
1024 | u8 *__str = p; \ | |
fb46f6ee | 1025 | eproto = tracepoint_string("rxkad_bad_"#field); \ |
17926a79 | 1026 | q = memchr(p, 0, end - p); \ |
fb46f6ee | 1027 | if (!q || q - p > (field##_SZ)) \ |
17926a79 DH |
1028 | goto bad_ticket; \ |
1029 | for (; p < q; p++) \ | |
1030 | if (!isprint(*p)) \ | |
1031 | goto bad_ticket; \ | |
1032 | p++; \ | |
1033 | __str; \ | |
1034 | }) | |
1035 | ||
1036 | /* extract the ticket flags */ | |
1037 | _debug("KIV FLAGS: %x", *p); | |
1038 | little_endian = *p & 1; | |
1039 | p++; | |
1040 | ||
1041 | /* extract the authentication name */ | |
fb46f6ee | 1042 | name = Z(ANAME); |
17926a79 DH |
1043 | _debug("KIV ANAME: %s", name); |
1044 | ||
1045 | /* extract the principal's instance */ | |
fb46f6ee | 1046 | name = Z(INST); |
17926a79 DH |
1047 | _debug("KIV INST : %s", name); |
1048 | ||
1049 | /* extract the principal's authentication domain */ | |
fb46f6ee | 1050 | name = Z(REALM); |
17926a79 DH |
1051 | _debug("KIV REALM: %s", name); |
1052 | ||
fb46f6ee | 1053 | eproto = tracepoint_string("rxkad_bad_len"); |
17926a79 DH |
1054 | if (end - p < 4 + 8 + 4 + 2) |
1055 | goto bad_ticket; | |
1056 | ||
1057 | /* get the IPv4 address of the entity that requested the ticket */ | |
1058 | memcpy(&addr, p, sizeof(addr)); | |
1059 | p += 4; | |
21454aaa | 1060 | _debug("KIV ADDR : %pI4", &addr); |
17926a79 DH |
1061 | |
1062 | /* get the session key from the ticket */ | |
1063 | memcpy(&key, p, sizeof(key)); | |
1064 | p += 8; | |
1065 | _debug("KIV KEY : %08x %08x", ntohl(key.n[0]), ntohl(key.n[1])); | |
1066 | memcpy(_session_key, &key, sizeof(key)); | |
1067 | ||
1068 | /* get the ticket's lifetime */ | |
1069 | life = *p++ * 5 * 60; | |
1070 | _debug("KIV LIFE : %u", life); | |
1071 | ||
1072 | /* get the issue time of the ticket */ | |
1073 | if (little_endian) { | |
1074 | __le32 stamp; | |
1075 | memcpy(&stamp, p, 4); | |
10674a03 | 1076 | issue = rxrpc_u32_to_time64(le32_to_cpu(stamp)); |
17926a79 DH |
1077 | } else { |
1078 | __be32 stamp; | |
1079 | memcpy(&stamp, p, 4); | |
10674a03 | 1080 | issue = rxrpc_u32_to_time64(be32_to_cpu(stamp)); |
17926a79 DH |
1081 | } |
1082 | p += 4; | |
10674a03 BW |
1083 | now = ktime_get_real_seconds(); |
1084 | _debug("KIV ISSUE: %llx [%llx]", issue, now); | |
17926a79 DH |
1085 | |
1086 | /* check the ticket is in date */ | |
1087 | if (issue > now) { | |
fb46f6ee | 1088 | abort_code = RXKADNOAUTH; |
17926a79 | 1089 | ret = -EKEYREJECTED; |
ef68622d | 1090 | goto other_error; |
17926a79 DH |
1091 | } |
1092 | ||
1093 | if (issue < now - life) { | |
fb46f6ee | 1094 | abort_code = RXKADEXPIRED; |
17926a79 | 1095 | ret = -EKEYEXPIRED; |
ef68622d | 1096 | goto other_error; |
17926a79 DH |
1097 | } |
1098 | ||
1099 | *_expiry = issue + life; | |
1100 | ||
1101 | /* get the service name */ | |
fb46f6ee | 1102 | name = Z(SNAME); |
17926a79 DH |
1103 | _debug("KIV SNAME: %s", name); |
1104 | ||
1105 | /* get the service instance name */ | |
fb46f6ee | 1106 | name = Z(INST); |
17926a79 | 1107 | _debug("KIV SINST: %s", name); |
ef68622d | 1108 | return 0; |
17926a79 DH |
1109 | |
1110 | bad_ticket: | |
fb46f6ee DH |
1111 | trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto); |
1112 | abort_code = RXKADBADTICKET; | |
ef68622d DH |
1113 | ret = -EPROTO; |
1114 | other_error: | |
fb46f6ee | 1115 | *_abort_code = abort_code; |
ef68622d DH |
1116 | return ret; |
1117 | temporary_error: | |
1118 | return ret; | |
17926a79 DH |
1119 | } |
1120 | ||
1121 | /* | |
1122 | * decrypt the response packet | |
1123 | */ | |
1124 | static void rxkad_decrypt_response(struct rxrpc_connection *conn, | |
1125 | struct rxkad_response *resp, | |
1126 | const struct rxrpc_crypt *session_key) | |
1127 | { | |
1db88c53 | 1128 | struct skcipher_request *req = rxkad_ci_req; |
a263629d | 1129 | struct scatterlist sg[1]; |
17926a79 DH |
1130 | struct rxrpc_crypt iv; |
1131 | ||
1132 | _enter(",,%08x%08x", | |
1133 | ntohl(session_key->n[0]), ntohl(session_key->n[1])); | |
1134 | ||
17926a79 | 1135 | mutex_lock(&rxkad_ci_mutex); |
69d826fa | 1136 | if (crypto_sync_skcipher_setkey(rxkad_ci, session_key->x, |
1db88c53 | 1137 | sizeof(*session_key)) < 0) |
17926a79 DH |
1138 | BUG(); |
1139 | ||
1140 | memcpy(&iv, session_key, sizeof(iv)); | |
17926a79 | 1141 | |
a263629d HX |
1142 | sg_init_table(sg, 1); |
1143 | sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted)); | |
69d826fa | 1144 | skcipher_request_set_sync_tfm(req, rxkad_ci); |
1afe593b HX |
1145 | skcipher_request_set_callback(req, 0, NULL, NULL); |
1146 | skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x); | |
1afe593b HX |
1147 | crypto_skcipher_decrypt(req); |
1148 | skcipher_request_zero(req); | |
1149 | ||
17926a79 DH |
1150 | mutex_unlock(&rxkad_ci_mutex); |
1151 | ||
1152 | _leave(""); | |
1153 | } | |
1154 | ||
1155 | /* | |
1156 | * verify a response | |
1157 | */ | |
1158 | static int rxkad_verify_response(struct rxrpc_connection *conn, | |
1159 | struct sk_buff *skb, | |
1160 | u32 *_abort_code) | |
1161 | { | |
8c2f826d | 1162 | struct rxkad_response *response; |
248f219c | 1163 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
17926a79 | 1164 | struct rxrpc_crypt session_key; |
ec832bd0 | 1165 | struct key *server_key; |
fb46f6ee | 1166 | const char *eproto; |
10674a03 | 1167 | time64_t expiry; |
17926a79 | 1168 | void *ticket; |
91e916cf AV |
1169 | u32 abort_code, version, kvno, ticket_len, level; |
1170 | __be32 csum; | |
a1399f8b | 1171 | int ret, i; |
17926a79 | 1172 | |
ec832bd0 DH |
1173 | _enter("{%d}", conn->debug_id); |
1174 | ||
1175 | server_key = rxrpc_look_up_server_security(conn, skb, 0, 0); | |
1176 | if (IS_ERR(server_key)) { | |
1177 | switch (PTR_ERR(server_key)) { | |
1178 | case -ENOKEY: | |
1179 | abort_code = RXKADUNKNOWNKEY; | |
1180 | break; | |
1181 | case -EKEYEXPIRED: | |
1182 | abort_code = RXKADEXPIRED; | |
1183 | break; | |
1184 | default: | |
1185 | abort_code = RXKADNOAUTH; | |
1186 | break; | |
1187 | } | |
1188 | trace_rxrpc_abort(0, "SVK", | |
1189 | sp->hdr.cid, sp->hdr.callNumber, sp->hdr.seq, | |
1190 | abort_code, PTR_ERR(server_key)); | |
1191 | *_abort_code = abort_code; | |
1192 | return -EPROTO; | |
1193 | } | |
17926a79 | 1194 | |
8c2f826d DH |
1195 | ret = -ENOMEM; |
1196 | response = kzalloc(sizeof(struct rxkad_response), GFP_NOFS); | |
1197 | if (!response) | |
1198 | goto temporary_error; | |
1199 | ||
fb46f6ee | 1200 | eproto = tracepoint_string("rxkad_rsp_short"); |
17926a79 | 1201 | abort_code = RXKADPACKETSHORT; |
775e5b71 | 1202 | if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header), |
8c2f826d | 1203 | response, sizeof(*response)) < 0) |
17926a79 | 1204 | goto protocol_error; |
17926a79 | 1205 | |
8c2f826d DH |
1206 | version = ntohl(response->version); |
1207 | ticket_len = ntohl(response->ticket_len); | |
1208 | kvno = ntohl(response->kvno); | |
17926a79 | 1209 | _proto("Rx RESPONSE %%%u { v=%u kv=%u tl=%u }", |
0d12f8a4 | 1210 | sp->hdr.serial, version, kvno, ticket_len); |
17926a79 | 1211 | |
fb46f6ee | 1212 | eproto = tracepoint_string("rxkad_rsp_ver"); |
17926a79 DH |
1213 | abort_code = RXKADINCONSISTENCY; |
1214 | if (version != RXKAD_VERSION) | |
4aa9cb32 | 1215 | goto protocol_error; |
17926a79 | 1216 | |
fb46f6ee | 1217 | eproto = tracepoint_string("rxkad_rsp_tktlen"); |
17926a79 DH |
1218 | abort_code = RXKADTICKETLEN; |
1219 | if (ticket_len < 4 || ticket_len > MAXKRB5TICKETLEN) | |
1220 | goto protocol_error; | |
1221 | ||
fb46f6ee | 1222 | eproto = tracepoint_string("rxkad_rsp_unkkey"); |
17926a79 DH |
1223 | abort_code = RXKADUNKNOWNKEY; |
1224 | if (kvno >= RXKAD_TKT_TYPE_KERBEROS_V5) | |
1225 | goto protocol_error; | |
1226 | ||
1227 | /* extract the kerberos ticket and decrypt and decode it */ | |
ef68622d | 1228 | ret = -ENOMEM; |
17926a79 DH |
1229 | ticket = kmalloc(ticket_len, GFP_NOFS); |
1230 | if (!ticket) | |
b43c75ab | 1231 | goto temporary_error_free_resp; |
17926a79 | 1232 | |
fb46f6ee | 1233 | eproto = tracepoint_string("rxkad_tkt_short"); |
17926a79 | 1234 | abort_code = RXKADPACKETSHORT; |
ceff522d | 1235 | if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header) + sizeof(*response), |
775e5b71 | 1236 | ticket, ticket_len) < 0) |
17926a79 DH |
1237 | goto protocol_error_free; |
1238 | ||
ec832bd0 DH |
1239 | ret = rxkad_decrypt_ticket(conn, server_key, skb, ticket, ticket_len, |
1240 | &session_key, &expiry, _abort_code); | |
ef68622d | 1241 | if (ret < 0) |
f45d01f4 | 1242 | goto temporary_error_free_ticket; |
17926a79 DH |
1243 | |
1244 | /* use the session key from inside the ticket to decrypt the | |
1245 | * response */ | |
8c2f826d | 1246 | rxkad_decrypt_response(conn, response, &session_key); |
17926a79 | 1247 | |
fb46f6ee | 1248 | eproto = tracepoint_string("rxkad_rsp_param"); |
17926a79 | 1249 | abort_code = RXKADSEALEDINCON; |
8c2f826d | 1250 | if (ntohl(response->encrypted.epoch) != conn->proto.epoch) |
17926a79 | 1251 | goto protocol_error_free; |
8c2f826d | 1252 | if (ntohl(response->encrypted.cid) != conn->proto.cid) |
17926a79 | 1253 | goto protocol_error_free; |
8c2f826d | 1254 | if (ntohl(response->encrypted.securityIndex) != conn->security_ix) |
17926a79 | 1255 | goto protocol_error_free; |
8c2f826d DH |
1256 | csum = response->encrypted.checksum; |
1257 | response->encrypted.checksum = 0; | |
1258 | rxkad_calc_response_checksum(response); | |
fb46f6ee | 1259 | eproto = tracepoint_string("rxkad_rsp_csum"); |
8c2f826d | 1260 | if (response->encrypted.checksum != csum) |
17926a79 DH |
1261 | goto protocol_error_free; |
1262 | ||
245500d8 | 1263 | spin_lock(&conn->bundle->channel_lock); |
a1399f8b DH |
1264 | for (i = 0; i < RXRPC_MAXCALLS; i++) { |
1265 | struct rxrpc_call *call; | |
8c2f826d | 1266 | u32 call_id = ntohl(response->encrypted.call_id[i]); |
a1399f8b | 1267 | |
fb46f6ee | 1268 | eproto = tracepoint_string("rxkad_rsp_callid"); |
a1399f8b DH |
1269 | if (call_id > INT_MAX) |
1270 | goto protocol_error_unlock; | |
1271 | ||
fb46f6ee | 1272 | eproto = tracepoint_string("rxkad_rsp_callctr"); |
a1399f8b DH |
1273 | if (call_id < conn->channels[i].call_counter) |
1274 | goto protocol_error_unlock; | |
fb46f6ee DH |
1275 | |
1276 | eproto = tracepoint_string("rxkad_rsp_callst"); | |
a1399f8b DH |
1277 | if (call_id > conn->channels[i].call_counter) { |
1278 | call = rcu_dereference_protected( | |
1279 | conn->channels[i].call, | |
245500d8 | 1280 | lockdep_is_held(&conn->bundle->channel_lock)); |
a1399f8b DH |
1281 | if (call && call->state < RXRPC_CALL_COMPLETE) |
1282 | goto protocol_error_unlock; | |
1283 | conn->channels[i].call_counter = call_id; | |
1284 | } | |
1285 | } | |
245500d8 | 1286 | spin_unlock(&conn->bundle->channel_lock); |
17926a79 | 1287 | |
fb46f6ee | 1288 | eproto = tracepoint_string("rxkad_rsp_seq"); |
17926a79 | 1289 | abort_code = RXKADOUTOFSEQUENCE; |
521bb304 | 1290 | if (ntohl(response->encrypted.inc_nonce) != conn->rxkad.nonce + 1) |
17926a79 DH |
1291 | goto protocol_error_free; |
1292 | ||
fb46f6ee | 1293 | eproto = tracepoint_string("rxkad_rsp_level"); |
17926a79 | 1294 | abort_code = RXKADLEVELFAIL; |
8c2f826d | 1295 | level = ntohl(response->encrypted.level); |
17926a79 DH |
1296 | if (level > RXRPC_SECURITY_ENCRYPT) |
1297 | goto protocol_error_free; | |
19ffa01c | 1298 | conn->params.security_level = level; |
17926a79 DH |
1299 | |
1300 | /* create a key to hold the security data and expiration time - after | |
1301 | * this the connection security can be handled in exactly the same way | |
1302 | * as for a client connection */ | |
1303 | ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno); | |
ef68622d | 1304 | if (ret < 0) |
8c2f826d | 1305 | goto temporary_error_free_ticket; |
17926a79 DH |
1306 | |
1307 | kfree(ticket); | |
8c2f826d | 1308 | kfree(response); |
17926a79 DH |
1309 | _leave(" = 0"); |
1310 | return 0; | |
1311 | ||
a1399f8b | 1312 | protocol_error_unlock: |
245500d8 | 1313 | spin_unlock(&conn->bundle->channel_lock); |
17926a79 DH |
1314 | protocol_error_free: |
1315 | kfree(ticket); | |
1316 | protocol_error: | |
8c2f826d | 1317 | kfree(response); |
fb46f6ee | 1318 | trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto); |
ec832bd0 | 1319 | key_put(server_key); |
17926a79 | 1320 | *_abort_code = abort_code; |
17926a79 | 1321 | return -EPROTO; |
ef68622d | 1322 | |
8c2f826d | 1323 | temporary_error_free_ticket: |
ef68622d | 1324 | kfree(ticket); |
b43c75ab | 1325 | temporary_error_free_resp: |
8c2f826d | 1326 | kfree(response); |
ef68622d DH |
1327 | temporary_error: |
1328 | /* Ignore the response packet if we got a temporary error such as | |
1329 | * ENOMEM. We just want to send the challenge again. Note that we | |
1330 | * also come out this way if the ticket decryption fails. | |
1331 | */ | |
ec832bd0 | 1332 | key_put(server_key); |
ef68622d | 1333 | return ret; |
17926a79 DH |
1334 | } |
1335 | ||
1336 | /* | |
1337 | * clear the connection security | |
1338 | */ | |
1339 | static void rxkad_clear(struct rxrpc_connection *conn) | |
1340 | { | |
1341 | _enter(""); | |
1342 | ||
521bb304 DH |
1343 | if (conn->rxkad.cipher) |
1344 | crypto_free_sync_skcipher(conn->rxkad.cipher); | |
17926a79 DH |
1345 | } |
1346 | ||
648af7fc DH |
1347 | /* |
1348 | * Initialise the rxkad security service. | |
1349 | */ | |
1350 | static int rxkad_init(void) | |
1351 | { | |
1db88c53 DH |
1352 | struct crypto_sync_skcipher *tfm; |
1353 | struct skcipher_request *req; | |
1354 | ||
648af7fc DH |
1355 | /* pin the cipher we need so that the crypto layer doesn't invoke |
1356 | * keventd to go get it */ | |
1db88c53 DH |
1357 | tfm = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0); |
1358 | if (IS_ERR(tfm)) | |
1359 | return PTR_ERR(tfm); | |
1360 | ||
1361 | req = skcipher_request_alloc(&tfm->base, GFP_KERNEL); | |
1362 | if (!req) | |
1363 | goto nomem_tfm; | |
1364 | ||
1365 | rxkad_ci_req = req; | |
1366 | rxkad_ci = tfm; | |
1367 | return 0; | |
1368 | ||
1369 | nomem_tfm: | |
1370 | crypto_free_sync_skcipher(tfm); | |
1371 | return -ENOMEM; | |
648af7fc DH |
1372 | } |
1373 | ||
1374 | /* | |
1375 | * Clean up the rxkad security service. | |
1376 | */ | |
1377 | static void rxkad_exit(void) | |
1378 | { | |
1db88c53 DH |
1379 | crypto_free_sync_skcipher(rxkad_ci); |
1380 | skcipher_request_free(rxkad_ci_req); | |
648af7fc DH |
1381 | } |
1382 | ||
17926a79 DH |
1383 | /* |
1384 | * RxRPC Kerberos-based security | |
1385 | */ | |
648af7fc | 1386 | const struct rxrpc_security rxkad = { |
17926a79 | 1387 | .name = "rxkad", |
8b815477 | 1388 | .security_index = RXRPC_SECURITY_RXKAD, |
063c60d3 | 1389 | .no_key_abort = RXKADUNKNOWNKEY, |
648af7fc DH |
1390 | .init = rxkad_init, |
1391 | .exit = rxkad_exit, | |
12da59fc DH |
1392 | .preparse_server_key = rxkad_preparse_server_key, |
1393 | .free_preparse_server_key = rxkad_free_preparse_server_key, | |
1394 | .destroy_server_key = rxkad_destroy_server_key, | |
17926a79 | 1395 | .init_connection_security = rxkad_init_connection_security, |
d7d775b1 | 1396 | .how_much_data = rxkad_how_much_data, |
17926a79 DH |
1397 | .secure_packet = rxkad_secure_packet, |
1398 | .verify_packet = rxkad_verify_packet, | |
1db88c53 | 1399 | .free_call_crypto = rxkad_free_call_crypto, |
248f219c | 1400 | .locate_data = rxkad_locate_data, |
17926a79 DH |
1401 | .issue_challenge = rxkad_issue_challenge, |
1402 | .respond_to_challenge = rxkad_respond_to_challenge, | |
1403 | .verify_response = rxkad_verify_response, | |
1404 | .clear = rxkad_clear, | |
1405 | }; |