Commit | Line | Data |
---|---|---|
17926a79 DH |
1 | /* Kerberos-based RxRPC security |
2 | * | |
3 | * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved. | |
4 | * Written by David Howells (dhowells@redhat.com) | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU General Public License | |
8 | * as published by the Free Software Foundation; either version | |
9 | * 2 of the License, or (at your option) any later version. | |
10 | */ | |
11 | ||
9b6d5398 JP |
12 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
13 | ||
1afe593b | 14 | #include <crypto/skcipher.h> |
17926a79 DH |
15 | #include <linux/module.h> |
16 | #include <linux/net.h> | |
17 | #include <linux/skbuff.h> | |
18 | #include <linux/udp.h> | |
17926a79 DH |
19 | #include <linux/scatterlist.h> |
20 | #include <linux/ctype.h> | |
5a0e3ad6 | 21 | #include <linux/slab.h> |
17926a79 DH |
22 | #include <net/sock.h> |
23 | #include <net/af_rxrpc.h> | |
33941284 | 24 | #include <keys/rxrpc-type.h> |
17926a79 DH |
25 | #include "ar-internal.h" |
26 | ||
27 | #define RXKAD_VERSION 2 | |
28 | #define MAXKRB5TICKETLEN 1024 | |
29 | #define RXKAD_TKT_TYPE_KERBEROS_V5 256 | |
30 | #define ANAME_SZ 40 /* size of authentication name */ | |
31 | #define INST_SZ 40 /* size of principal's instance */ | |
32 | #define REALM_SZ 40 /* size of principal's auth domain */ | |
33 | #define SNAME_SZ 40 /* size of service name */ | |
34 | ||
17926a79 DH |
35 | struct rxkad_level1_hdr { |
36 | __be32 data_size; /* true data size (excluding padding) */ | |
37 | }; | |
38 | ||
39 | struct rxkad_level2_hdr { | |
40 | __be32 data_size; /* true data size (excluding padding) */ | |
41 | __be32 checksum; /* decrypted data checksum */ | |
42 | }; | |
43 | ||
17926a79 DH |
44 | /* |
45 | * this holds a pinned cipher so that keventd doesn't get called by the cipher | |
46 | * alloc routine, but since we have it to hand, we use it to decrypt RESPONSE | |
47 | * packets | |
48 | */ | |
1afe593b | 49 | static struct crypto_skcipher *rxkad_ci; |
17926a79 DH |
50 | static DEFINE_MUTEX(rxkad_ci_mutex); |
51 | ||
52 | /* | |
53 | * initialise connection security | |
54 | */ | |
55 | static int rxkad_init_connection_security(struct rxrpc_connection *conn) | |
56 | { | |
1afe593b | 57 | struct crypto_skcipher *ci; |
33941284 | 58 | struct rxrpc_key_token *token; |
17926a79 DH |
59 | int ret; |
60 | ||
19ffa01c | 61 | _enter("{%d},{%x}", conn->debug_id, key_serial(conn->params.key)); |
17926a79 | 62 | |
19ffa01c | 63 | token = conn->params.key->payload.data[0]; |
33941284 | 64 | conn->security_ix = token->security_index; |
17926a79 | 65 | |
1afe593b | 66 | ci = crypto_alloc_skcipher("pcbc(fcrypt)", 0, CRYPTO_ALG_ASYNC); |
17926a79 DH |
67 | if (IS_ERR(ci)) { |
68 | _debug("no cipher"); | |
69 | ret = PTR_ERR(ci); | |
70 | goto error; | |
71 | } | |
72 | ||
1afe593b HX |
73 | if (crypto_skcipher_setkey(ci, token->kad->session_key, |
74 | sizeof(token->kad->session_key)) < 0) | |
17926a79 DH |
75 | BUG(); |
76 | ||
19ffa01c | 77 | switch (conn->params.security_level) { |
17926a79 DH |
78 | case RXRPC_SECURITY_PLAIN: |
79 | break; | |
80 | case RXRPC_SECURITY_AUTH: | |
81 | conn->size_align = 8; | |
82 | conn->security_size = sizeof(struct rxkad_level1_hdr); | |
17926a79 DH |
83 | break; |
84 | case RXRPC_SECURITY_ENCRYPT: | |
85 | conn->size_align = 8; | |
86 | conn->security_size = sizeof(struct rxkad_level2_hdr); | |
17926a79 DH |
87 | break; |
88 | default: | |
89 | ret = -EKEYREJECTED; | |
90 | goto error; | |
91 | } | |
92 | ||
93 | conn->cipher = ci; | |
94 | ret = 0; | |
95 | error: | |
96 | _leave(" = %d", ret); | |
97 | return ret; | |
98 | } | |
99 | ||
100 | /* | |
101 | * prime the encryption state with the invariant parts of a connection's | |
102 | * description | |
103 | */ | |
a263629d | 104 | static int rxkad_prime_packet_security(struct rxrpc_connection *conn) |
17926a79 | 105 | { |
33941284 | 106 | struct rxrpc_key_token *token; |
1afe593b | 107 | SKCIPHER_REQUEST_ON_STACK(req, conn->cipher); |
a263629d | 108 | struct scatterlist sg; |
17926a79 | 109 | struct rxrpc_crypt iv; |
a263629d HX |
110 | __be32 *tmpbuf; |
111 | size_t tmpsize = 4 * sizeof(__be32); | |
17926a79 DH |
112 | |
113 | _enter(""); | |
114 | ||
19ffa01c | 115 | if (!conn->params.key) |
a263629d HX |
116 | return 0; |
117 | ||
118 | tmpbuf = kmalloc(tmpsize, GFP_KERNEL); | |
119 | if (!tmpbuf) | |
120 | return -ENOMEM; | |
17926a79 | 121 | |
19ffa01c | 122 | token = conn->params.key->payload.data[0]; |
33941284 | 123 | memcpy(&iv, token->kad->session_key, sizeof(iv)); |
17926a79 | 124 | |
a263629d HX |
125 | tmpbuf[0] = htonl(conn->proto.epoch); |
126 | tmpbuf[1] = htonl(conn->proto.cid); | |
127 | tmpbuf[2] = 0; | |
128 | tmpbuf[3] = htonl(conn->security_ix); | |
1afe593b | 129 | |
a263629d | 130 | sg_init_one(&sg, tmpbuf, tmpsize); |
1afe593b HX |
131 | skcipher_request_set_tfm(req, conn->cipher); |
132 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
a263629d | 133 | skcipher_request_set_crypt(req, &sg, &sg, tmpsize, iv.x); |
1afe593b HX |
134 | crypto_skcipher_encrypt(req); |
135 | skcipher_request_zero(req); | |
17926a79 | 136 | |
a263629d HX |
137 | memcpy(&conn->csum_iv, tmpbuf + 2, sizeof(conn->csum_iv)); |
138 | kfree(tmpbuf); | |
139 | _leave(" = 0"); | |
140 | return 0; | |
17926a79 DH |
141 | } |
142 | ||
143 | /* | |
144 | * partially encrypt a packet (level 1 security) | |
145 | */ | |
146 | static int rxkad_secure_packet_auth(const struct rxrpc_call *call, | |
147 | struct sk_buff *skb, | |
148 | u32 data_size, | |
149 | void *sechdr) | |
150 | { | |
fb46f6ee | 151 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
1afe593b | 152 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
a263629d | 153 | struct rxkad_level1_hdr hdr; |
17926a79 | 154 | struct rxrpc_crypt iv; |
a263629d | 155 | struct scatterlist sg; |
17926a79 DH |
156 | u16 check; |
157 | ||
17926a79 DH |
158 | _enter(""); |
159 | ||
5a924b89 | 160 | check = sp->hdr.seq ^ call->call_id; |
0d12f8a4 | 161 | data_size |= (u32)check << 16; |
17926a79 | 162 | |
a263629d HX |
163 | hdr.data_size = htonl(data_size); |
164 | memcpy(sechdr, &hdr, sizeof(hdr)); | |
17926a79 DH |
165 | |
166 | /* start the encryption afresh */ | |
167 | memset(&iv, 0, sizeof(iv)); | |
17926a79 | 168 | |
a263629d | 169 | sg_init_one(&sg, sechdr, 8); |
1afe593b HX |
170 | skcipher_request_set_tfm(req, call->conn->cipher); |
171 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
a263629d | 172 | skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); |
1afe593b HX |
173 | crypto_skcipher_encrypt(req); |
174 | skcipher_request_zero(req); | |
17926a79 | 175 | |
17926a79 DH |
176 | _leave(" = 0"); |
177 | return 0; | |
178 | } | |
179 | ||
180 | /* | |
181 | * wholly encrypt a packet (level 2 security) | |
182 | */ | |
183 | static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call, | |
b4f1342f DH |
184 | struct sk_buff *skb, |
185 | u32 data_size, | |
186 | void *sechdr) | |
17926a79 | 187 | { |
33941284 | 188 | const struct rxrpc_key_token *token; |
a263629d | 189 | struct rxkad_level2_hdr rxkhdr; |
17926a79 | 190 | struct rxrpc_skb_priv *sp; |
1afe593b | 191 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
17926a79 DH |
192 | struct rxrpc_crypt iv; |
193 | struct scatterlist sg[16]; | |
194 | struct sk_buff *trailer; | |
95c96174 | 195 | unsigned int len; |
17926a79 DH |
196 | u16 check; |
197 | int nsg; | |
1afe593b | 198 | int err; |
17926a79 DH |
199 | |
200 | sp = rxrpc_skb(skb); | |
201 | ||
202 | _enter(""); | |
203 | ||
5a924b89 | 204 | check = sp->hdr.seq ^ call->call_id; |
17926a79 | 205 | |
0d12f8a4 | 206 | rxkhdr.data_size = htonl(data_size | (u32)check << 16); |
17926a79 | 207 | rxkhdr.checksum = 0; |
a263629d | 208 | memcpy(sechdr, &rxkhdr, sizeof(rxkhdr)); |
17926a79 DH |
209 | |
210 | /* encrypt from the session key */ | |
19ffa01c | 211 | token = call->conn->params.key->payload.data[0]; |
33941284 | 212 | memcpy(&iv, token->kad->session_key, sizeof(iv)); |
17926a79 | 213 | |
68e3f5dd | 214 | sg_init_one(&sg[0], sechdr, sizeof(rxkhdr)); |
1afe593b HX |
215 | skcipher_request_set_tfm(req, call->conn->cipher); |
216 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
a263629d | 217 | skcipher_request_set_crypt(req, &sg[0], &sg[0], sizeof(rxkhdr), iv.x); |
1afe593b | 218 | crypto_skcipher_encrypt(req); |
17926a79 DH |
219 | |
220 | /* we want to encrypt the skbuff in-place */ | |
221 | nsg = skb_cow_data(skb, 0, &trailer); | |
1afe593b | 222 | err = -ENOMEM; |
17926a79 | 223 | if (nsg < 0 || nsg > 16) |
1afe593b | 224 | goto out; |
17926a79 DH |
225 | |
226 | len = data_size + call->conn->size_align - 1; | |
227 | len &= ~(call->conn->size_align - 1); | |
228 | ||
51c739d1 | 229 | sg_init_table(sg, nsg); |
89a5ea99 JD |
230 | err = skb_to_sgvec(skb, sg, 0, len); |
231 | if (unlikely(err < 0)) | |
232 | goto out; | |
1afe593b | 233 | skcipher_request_set_crypt(req, sg, sg, len, iv.x); |
1afe593b | 234 | crypto_skcipher_encrypt(req); |
17926a79 DH |
235 | |
236 | _leave(" = 0"); | |
1afe593b HX |
237 | err = 0; |
238 | ||
239 | out: | |
240 | skcipher_request_zero(req); | |
241 | return err; | |
17926a79 DH |
242 | } |
243 | ||
244 | /* | |
245 | * checksum an RxRPC packet header | |
246 | */ | |
a263629d | 247 | static int rxkad_secure_packet(struct rxrpc_call *call, |
b4f1342f DH |
248 | struct sk_buff *skb, |
249 | size_t data_size, | |
250 | void *sechdr) | |
17926a79 DH |
251 | { |
252 | struct rxrpc_skb_priv *sp; | |
1afe593b | 253 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
17926a79 | 254 | struct rxrpc_crypt iv; |
a263629d | 255 | struct scatterlist sg; |
0d12f8a4 | 256 | u32 x, y; |
17926a79 DH |
257 | int ret; |
258 | ||
259 | sp = rxrpc_skb(skb); | |
260 | ||
261 | _enter("{%d{%x}},{#%u},%zu,", | |
19ffa01c DH |
262 | call->debug_id, key_serial(call->conn->params.key), |
263 | sp->hdr.seq, data_size); | |
17926a79 DH |
264 | |
265 | if (!call->conn->cipher) | |
266 | return 0; | |
267 | ||
19ffa01c | 268 | ret = key_validate(call->conn->params.key); |
17926a79 DH |
269 | if (ret < 0) |
270 | return ret; | |
271 | ||
272 | /* continue encrypting from where we left off */ | |
273 | memcpy(&iv, call->conn->csum_iv.x, sizeof(iv)); | |
17926a79 DH |
274 | |
275 | /* calculate the security checksum */ | |
01a90a45 | 276 | x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT); |
0d12f8a4 | 277 | x |= sp->hdr.seq & 0x3fffffff; |
5a924b89 | 278 | call->crypto_buf[0] = htonl(call->call_id); |
a263629d | 279 | call->crypto_buf[1] = htonl(x); |
1afe593b | 280 | |
a263629d | 281 | sg_init_one(&sg, call->crypto_buf, 8); |
1afe593b HX |
282 | skcipher_request_set_tfm(req, call->conn->cipher); |
283 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
a263629d | 284 | skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); |
1afe593b HX |
285 | crypto_skcipher_encrypt(req); |
286 | skcipher_request_zero(req); | |
17926a79 | 287 | |
a263629d | 288 | y = ntohl(call->crypto_buf[1]); |
91e916cf AV |
289 | y = (y >> 16) & 0xffff; |
290 | if (y == 0) | |
291 | y = 1; /* zero checksums are not permitted */ | |
0d12f8a4 | 292 | sp->hdr.cksum = y; |
17926a79 | 293 | |
19ffa01c | 294 | switch (call->conn->params.security_level) { |
17926a79 DH |
295 | case RXRPC_SECURITY_PLAIN: |
296 | ret = 0; | |
297 | break; | |
298 | case RXRPC_SECURITY_AUTH: | |
299 | ret = rxkad_secure_packet_auth(call, skb, data_size, sechdr); | |
300 | break; | |
301 | case RXRPC_SECURITY_ENCRYPT: | |
302 | ret = rxkad_secure_packet_encrypt(call, skb, data_size, | |
303 | sechdr); | |
304 | break; | |
305 | default: | |
306 | ret = -EPERM; | |
307 | break; | |
308 | } | |
309 | ||
91e916cf | 310 | _leave(" = %d [set %hx]", ret, y); |
17926a79 DH |
311 | return ret; |
312 | } | |
313 | ||
314 | /* | |
315 | * decrypt partial encryption on a packet (level 1 security) | |
316 | */ | |
5a42976d | 317 | static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb, |
248f219c | 318 | unsigned int offset, unsigned int len, |
5a42976d | 319 | rxrpc_seq_t seq) |
17926a79 DH |
320 | { |
321 | struct rxkad_level1_hdr sechdr; | |
1afe593b | 322 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
17926a79 | 323 | struct rxrpc_crypt iv; |
68e3f5dd | 324 | struct scatterlist sg[16]; |
17926a79 | 325 | struct sk_buff *trailer; |
fb46f6ee | 326 | bool aborted; |
17926a79 DH |
327 | u32 data_size, buf; |
328 | u16 check; | |
89a5ea99 | 329 | int nsg, ret; |
17926a79 DH |
330 | |
331 | _enter(""); | |
332 | ||
248f219c | 333 | if (len < 8) { |
fb46f6ee DH |
334 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_1_hdr", "V1H", |
335 | RXKADSEALEDINCON); | |
5a42976d DH |
336 | goto protocol_error; |
337 | } | |
17926a79 | 338 | |
248f219c DH |
339 | /* Decrypt the skbuff in-place. TODO: We really want to decrypt |
340 | * directly into the target buffer. | |
341 | */ | |
68e3f5dd HX |
342 | nsg = skb_cow_data(skb, 0, &trailer); |
343 | if (nsg < 0 || nsg > 16) | |
17926a79 DH |
344 | goto nomem; |
345 | ||
68e3f5dd | 346 | sg_init_table(sg, nsg); |
89a5ea99 JD |
347 | ret = skb_to_sgvec(skb, sg, offset, 8); |
348 | if (unlikely(ret < 0)) | |
349 | return ret; | |
17926a79 DH |
350 | |
351 | /* start the decryption afresh */ | |
352 | memset(&iv, 0, sizeof(iv)); | |
17926a79 | 353 | |
1afe593b HX |
354 | skcipher_request_set_tfm(req, call->conn->cipher); |
355 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
356 | skcipher_request_set_crypt(req, sg, sg, 8, iv.x); | |
1afe593b HX |
357 | crypto_skcipher_decrypt(req); |
358 | skcipher_request_zero(req); | |
17926a79 | 359 | |
5a42976d | 360 | /* Extract the decrypted packet length */ |
248f219c | 361 | if (skb_copy_bits(skb, offset, &sechdr, sizeof(sechdr)) < 0) { |
fb46f6ee DH |
362 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_1_len", "XV1", |
363 | RXKADDATALEN); | |
5a42976d DH |
364 | goto protocol_error; |
365 | } | |
248f219c DH |
366 | offset += sizeof(sechdr); |
367 | len -= sizeof(sechdr); | |
17926a79 DH |
368 | |
369 | buf = ntohl(sechdr.data_size); | |
370 | data_size = buf & 0xffff; | |
371 | ||
372 | check = buf >> 16; | |
5a42976d | 373 | check ^= seq ^ call->call_id; |
17926a79 DH |
374 | check &= 0xffff; |
375 | if (check != 0) { | |
fb46f6ee DH |
376 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_1_check", "V1C", |
377 | RXKADSEALEDINCON); | |
17926a79 DH |
378 | goto protocol_error; |
379 | } | |
380 | ||
248f219c | 381 | if (data_size > len) { |
fb46f6ee DH |
382 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_1_datalen", "V1L", |
383 | RXKADDATALEN); | |
5a42976d DH |
384 | goto protocol_error; |
385 | } | |
17926a79 DH |
386 | |
387 | _leave(" = 0 [dlen=%x]", data_size); | |
388 | return 0; | |
389 | ||
17926a79 | 390 | protocol_error: |
fb46f6ee DH |
391 | if (aborted) |
392 | rxrpc_send_abort_packet(call); | |
17926a79 DH |
393 | return -EPROTO; |
394 | ||
395 | nomem: | |
396 | _leave(" = -ENOMEM"); | |
397 | return -ENOMEM; | |
398 | } | |
399 | ||
400 | /* | |
401 | * wholly decrypt a packet (level 2 security) | |
402 | */ | |
5a42976d | 403 | static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb, |
248f219c | 404 | unsigned int offset, unsigned int len, |
5a42976d | 405 | rxrpc_seq_t seq) |
17926a79 | 406 | { |
33941284 | 407 | const struct rxrpc_key_token *token; |
17926a79 | 408 | struct rxkad_level2_hdr sechdr; |
1afe593b | 409 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
17926a79 DH |
410 | struct rxrpc_crypt iv; |
411 | struct scatterlist _sg[4], *sg; | |
412 | struct sk_buff *trailer; | |
fb46f6ee | 413 | bool aborted; |
17926a79 DH |
414 | u32 data_size, buf; |
415 | u16 check; | |
89a5ea99 | 416 | int nsg, ret; |
17926a79 DH |
417 | |
418 | _enter(",{%d}", skb->len); | |
419 | ||
248f219c | 420 | if (len < 8) { |
fb46f6ee DH |
421 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_2_hdr", "V2H", |
422 | RXKADSEALEDINCON); | |
5a42976d DH |
423 | goto protocol_error; |
424 | } | |
17926a79 | 425 | |
248f219c DH |
426 | /* Decrypt the skbuff in-place. TODO: We really want to decrypt |
427 | * directly into the target buffer. | |
428 | */ | |
17926a79 DH |
429 | nsg = skb_cow_data(skb, 0, &trailer); |
430 | if (nsg < 0) | |
431 | goto nomem; | |
432 | ||
433 | sg = _sg; | |
434 | if (unlikely(nsg > 4)) { | |
6da2ec56 | 435 | sg = kmalloc_array(nsg, sizeof(*sg), GFP_NOIO); |
17926a79 DH |
436 | if (!sg) |
437 | goto nomem; | |
438 | } | |
439 | ||
68e3f5dd | 440 | sg_init_table(sg, nsg); |
89a5ea99 JD |
441 | ret = skb_to_sgvec(skb, sg, offset, len); |
442 | if (unlikely(ret < 0)) { | |
443 | if (sg != _sg) | |
444 | kfree(sg); | |
445 | return ret; | |
446 | } | |
17926a79 DH |
447 | |
448 | /* decrypt from the session key */ | |
19ffa01c | 449 | token = call->conn->params.key->payload.data[0]; |
33941284 | 450 | memcpy(&iv, token->kad->session_key, sizeof(iv)); |
17926a79 | 451 | |
1afe593b HX |
452 | skcipher_request_set_tfm(req, call->conn->cipher); |
453 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
248f219c | 454 | skcipher_request_set_crypt(req, sg, sg, len, iv.x); |
1afe593b HX |
455 | crypto_skcipher_decrypt(req); |
456 | skcipher_request_zero(req); | |
17926a79 DH |
457 | if (sg != _sg) |
458 | kfree(sg); | |
459 | ||
5a42976d | 460 | /* Extract the decrypted packet length */ |
248f219c | 461 | if (skb_copy_bits(skb, offset, &sechdr, sizeof(sechdr)) < 0) { |
fb46f6ee DH |
462 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_2_len", "XV2", |
463 | RXKADDATALEN); | |
5a42976d DH |
464 | goto protocol_error; |
465 | } | |
248f219c DH |
466 | offset += sizeof(sechdr); |
467 | len -= sizeof(sechdr); | |
17926a79 DH |
468 | |
469 | buf = ntohl(sechdr.data_size); | |
470 | data_size = buf & 0xffff; | |
471 | ||
472 | check = buf >> 16; | |
5a42976d | 473 | check ^= seq ^ call->call_id; |
17926a79 DH |
474 | check &= 0xffff; |
475 | if (check != 0) { | |
fb46f6ee DH |
476 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_2_check", "V2C", |
477 | RXKADSEALEDINCON); | |
17926a79 DH |
478 | goto protocol_error; |
479 | } | |
480 | ||
248f219c | 481 | if (data_size > len) { |
fb46f6ee DH |
482 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_2_datalen", "V2L", |
483 | RXKADDATALEN); | |
5a42976d DH |
484 | goto protocol_error; |
485 | } | |
17926a79 DH |
486 | |
487 | _leave(" = 0 [dlen=%x]", data_size); | |
488 | return 0; | |
489 | ||
17926a79 | 490 | protocol_error: |
fb46f6ee DH |
491 | if (aborted) |
492 | rxrpc_send_abort_packet(call); | |
17926a79 DH |
493 | return -EPROTO; |
494 | ||
495 | nomem: | |
496 | _leave(" = -ENOMEM"); | |
497 | return -ENOMEM; | |
498 | } | |
499 | ||
500 | /* | |
5a42976d DH |
501 | * Verify the security on a received packet or subpacket (if part of a |
502 | * jumbo packet). | |
17926a79 | 503 | */ |
5a42976d | 504 | static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb, |
248f219c | 505 | unsigned int offset, unsigned int len, |
5a42976d | 506 | rxrpc_seq_t seq, u16 expected_cksum) |
17926a79 | 507 | { |
1afe593b | 508 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
17926a79 | 509 | struct rxrpc_crypt iv; |
a263629d | 510 | struct scatterlist sg; |
fb46f6ee | 511 | bool aborted; |
0d12f8a4 DH |
512 | u16 cksum; |
513 | u32 x, y; | |
17926a79 DH |
514 | |
515 | _enter("{%d{%x}},{#%u}", | |
5a42976d | 516 | call->debug_id, key_serial(call->conn->params.key), seq); |
17926a79 DH |
517 | |
518 | if (!call->conn->cipher) | |
519 | return 0; | |
520 | ||
17926a79 DH |
521 | /* continue encrypting from where we left off */ |
522 | memcpy(&iv, call->conn->csum_iv.x, sizeof(iv)); | |
17926a79 DH |
523 | |
524 | /* validate the security checksum */ | |
01a90a45 | 525 | x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT); |
5a42976d | 526 | x |= seq & 0x3fffffff; |
a263629d HX |
527 | call->crypto_buf[0] = htonl(call->call_id); |
528 | call->crypto_buf[1] = htonl(x); | |
1afe593b | 529 | |
a263629d | 530 | sg_init_one(&sg, call->crypto_buf, 8); |
1afe593b HX |
531 | skcipher_request_set_tfm(req, call->conn->cipher); |
532 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
a263629d | 533 | skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); |
1afe593b HX |
534 | crypto_skcipher_encrypt(req); |
535 | skcipher_request_zero(req); | |
17926a79 | 536 | |
a263629d | 537 | y = ntohl(call->crypto_buf[1]); |
0d12f8a4 DH |
538 | cksum = (y >> 16) & 0xffff; |
539 | if (cksum == 0) | |
540 | cksum = 1; /* zero checksums are not permitted */ | |
17926a79 | 541 | |
5a42976d | 542 | if (cksum != expected_cksum) { |
fb46f6ee DH |
543 | aborted = rxrpc_abort_eproto(call, skb, "rxkad_csum", "VCK", |
544 | RXKADSEALEDINCON); | |
545 | goto protocol_error; | |
17926a79 DH |
546 | } |
547 | ||
19ffa01c | 548 | switch (call->conn->params.security_level) { |
17926a79 | 549 | case RXRPC_SECURITY_PLAIN: |
5a42976d | 550 | return 0; |
17926a79 | 551 | case RXRPC_SECURITY_AUTH: |
248f219c | 552 | return rxkad_verify_packet_1(call, skb, offset, len, seq); |
17926a79 | 553 | case RXRPC_SECURITY_ENCRYPT: |
248f219c | 554 | return rxkad_verify_packet_2(call, skb, offset, len, seq); |
17926a79 | 555 | default: |
5a42976d | 556 | return -ENOANO; |
17926a79 | 557 | } |
fb46f6ee DH |
558 | |
559 | protocol_error: | |
560 | if (aborted) | |
561 | rxrpc_send_abort_packet(call); | |
562 | return -EPROTO; | |
17926a79 DH |
563 | } |
564 | ||
248f219c DH |
565 | /* |
566 | * Locate the data contained in a packet that was partially encrypted. | |
567 | */ | |
568 | static void rxkad_locate_data_1(struct rxrpc_call *call, struct sk_buff *skb, | |
569 | unsigned int *_offset, unsigned int *_len) | |
570 | { | |
571 | struct rxkad_level1_hdr sechdr; | |
572 | ||
573 | if (skb_copy_bits(skb, *_offset, &sechdr, sizeof(sechdr)) < 0) | |
574 | BUG(); | |
575 | *_offset += sizeof(sechdr); | |
576 | *_len = ntohl(sechdr.data_size) & 0xffff; | |
577 | } | |
578 | ||
579 | /* | |
580 | * Locate the data contained in a packet that was completely encrypted. | |
581 | */ | |
582 | static void rxkad_locate_data_2(struct rxrpc_call *call, struct sk_buff *skb, | |
583 | unsigned int *_offset, unsigned int *_len) | |
584 | { | |
585 | struct rxkad_level2_hdr sechdr; | |
586 | ||
587 | if (skb_copy_bits(skb, *_offset, &sechdr, sizeof(sechdr)) < 0) | |
588 | BUG(); | |
589 | *_offset += sizeof(sechdr); | |
590 | *_len = ntohl(sechdr.data_size) & 0xffff; | |
591 | } | |
592 | ||
593 | /* | |
594 | * Locate the data contained in an already decrypted packet. | |
595 | */ | |
596 | static void rxkad_locate_data(struct rxrpc_call *call, struct sk_buff *skb, | |
597 | unsigned int *_offset, unsigned int *_len) | |
598 | { | |
599 | switch (call->conn->params.security_level) { | |
600 | case RXRPC_SECURITY_AUTH: | |
601 | rxkad_locate_data_1(call, skb, _offset, _len); | |
602 | return; | |
603 | case RXRPC_SECURITY_ENCRYPT: | |
604 | rxkad_locate_data_2(call, skb, _offset, _len); | |
605 | return; | |
606 | default: | |
607 | return; | |
608 | } | |
609 | } | |
610 | ||
17926a79 DH |
611 | /* |
612 | * issue a challenge | |
613 | */ | |
614 | static int rxkad_issue_challenge(struct rxrpc_connection *conn) | |
615 | { | |
616 | struct rxkad_challenge challenge; | |
0d12f8a4 | 617 | struct rxrpc_wire_header whdr; |
17926a79 DH |
618 | struct msghdr msg; |
619 | struct kvec iov[2]; | |
620 | size_t len; | |
0d12f8a4 | 621 | u32 serial; |
17926a79 DH |
622 | int ret; |
623 | ||
19ffa01c | 624 | _enter("{%d,%x}", conn->debug_id, key_serial(conn->params.key)); |
17926a79 | 625 | |
19ffa01c | 626 | ret = key_validate(conn->params.key); |
17926a79 DH |
627 | if (ret < 0) |
628 | return ret; | |
629 | ||
630 | get_random_bytes(&conn->security_nonce, sizeof(conn->security_nonce)); | |
631 | ||
632 | challenge.version = htonl(2); | |
633 | challenge.nonce = htonl(conn->security_nonce); | |
634 | challenge.min_level = htonl(0); | |
635 | challenge.__padding = 0; | |
636 | ||
7b674e39 DH |
637 | msg.msg_name = &conn->params.peer->srx.transport; |
638 | msg.msg_namelen = conn->params.peer->srx.transport_len; | |
17926a79 DH |
639 | msg.msg_control = NULL; |
640 | msg.msg_controllen = 0; | |
641 | msg.msg_flags = 0; | |
642 | ||
19ffa01c DH |
643 | whdr.epoch = htonl(conn->proto.epoch); |
644 | whdr.cid = htonl(conn->proto.cid); | |
0d12f8a4 DH |
645 | whdr.callNumber = 0; |
646 | whdr.seq = 0; | |
647 | whdr.type = RXRPC_PACKET_TYPE_CHALLENGE; | |
648 | whdr.flags = conn->out_clientflag; | |
649 | whdr.userStatus = 0; | |
650 | whdr.securityIndex = conn->security_ix; | |
651 | whdr._rsvd = 0; | |
68d6d1ae | 652 | whdr.serviceId = htons(conn->service_id); |
0d12f8a4 DH |
653 | |
654 | iov[0].iov_base = &whdr; | |
655 | iov[0].iov_len = sizeof(whdr); | |
17926a79 DH |
656 | iov[1].iov_base = &challenge; |
657 | iov[1].iov_len = sizeof(challenge); | |
658 | ||
659 | len = iov[0].iov_len + iov[1].iov_len; | |
660 | ||
0d12f8a4 DH |
661 | serial = atomic_inc_return(&conn->serial); |
662 | whdr.serial = htonl(serial); | |
663 | _proto("Tx CHALLENGE %%%u", serial); | |
17926a79 | 664 | |
85f32278 | 665 | ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len); |
17926a79 | 666 | if (ret < 0) { |
6b47fe1d | 667 | trace_rxrpc_tx_fail(conn->debug_id, serial, ret, |
4764c0da | 668 | rxrpc_tx_point_rxkad_challenge); |
17926a79 DH |
669 | return -EAGAIN; |
670 | } | |
671 | ||
ace45bec | 672 | conn->params.peer->last_tx_at = ktime_get_real(); |
4764c0da DH |
673 | trace_rxrpc_tx_packet(conn->debug_id, &whdr, |
674 | rxrpc_tx_point_rxkad_challenge); | |
17926a79 DH |
675 | _leave(" = 0"); |
676 | return 0; | |
677 | } | |
678 | ||
679 | /* | |
680 | * send a Kerberos security response | |
681 | */ | |
682 | static int rxkad_send_response(struct rxrpc_connection *conn, | |
0d12f8a4 | 683 | struct rxrpc_host_header *hdr, |
17926a79 DH |
684 | struct rxkad_response *resp, |
685 | const struct rxkad_key *s2) | |
686 | { | |
0d12f8a4 | 687 | struct rxrpc_wire_header whdr; |
17926a79 DH |
688 | struct msghdr msg; |
689 | struct kvec iov[3]; | |
690 | size_t len; | |
0d12f8a4 | 691 | u32 serial; |
17926a79 DH |
692 | int ret; |
693 | ||
694 | _enter(""); | |
695 | ||
7b674e39 DH |
696 | msg.msg_name = &conn->params.peer->srx.transport; |
697 | msg.msg_namelen = conn->params.peer->srx.transport_len; | |
17926a79 DH |
698 | msg.msg_control = NULL; |
699 | msg.msg_controllen = 0; | |
700 | msg.msg_flags = 0; | |
701 | ||
0d12f8a4 DH |
702 | memset(&whdr, 0, sizeof(whdr)); |
703 | whdr.epoch = htonl(hdr->epoch); | |
704 | whdr.cid = htonl(hdr->cid); | |
705 | whdr.type = RXRPC_PACKET_TYPE_RESPONSE; | |
706 | whdr.flags = conn->out_clientflag; | |
707 | whdr.securityIndex = hdr->securityIndex; | |
708 | whdr.serviceId = htons(hdr->serviceId); | |
17926a79 | 709 | |
0d12f8a4 DH |
710 | iov[0].iov_base = &whdr; |
711 | iov[0].iov_len = sizeof(whdr); | |
17926a79 DH |
712 | iov[1].iov_base = resp; |
713 | iov[1].iov_len = sizeof(*resp); | |
0d12f8a4 | 714 | iov[2].iov_base = (void *)s2->ticket; |
17926a79 DH |
715 | iov[2].iov_len = s2->ticket_len; |
716 | ||
717 | len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len; | |
718 | ||
0d12f8a4 DH |
719 | serial = atomic_inc_return(&conn->serial); |
720 | whdr.serial = htonl(serial); | |
721 | _proto("Tx RESPONSE %%%u", serial); | |
17926a79 | 722 | |
85f32278 | 723 | ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 3, len); |
17926a79 | 724 | if (ret < 0) { |
6b47fe1d | 725 | trace_rxrpc_tx_fail(conn->debug_id, serial, ret, |
4764c0da | 726 | rxrpc_tx_point_rxkad_response); |
17926a79 DH |
727 | return -EAGAIN; |
728 | } | |
729 | ||
ace45bec | 730 | conn->params.peer->last_tx_at = ktime_get_real(); |
4764c0da | 731 | trace_rxrpc_tx_packet(0, &whdr, rxrpc_tx_point_rxkad_response); |
17926a79 DH |
732 | _leave(" = 0"); |
733 | return 0; | |
734 | } | |
735 | ||
736 | /* | |
737 | * calculate the response checksum | |
738 | */ | |
739 | static void rxkad_calc_response_checksum(struct rxkad_response *response) | |
740 | { | |
741 | u32 csum = 1000003; | |
742 | int loop; | |
743 | u8 *p = (u8 *) response; | |
744 | ||
745 | for (loop = sizeof(*response); loop > 0; loop--) | |
746 | csum = csum * 0x10204081 + *p++; | |
747 | ||
748 | response->encrypted.checksum = htonl(csum); | |
749 | } | |
750 | ||
17926a79 DH |
751 | /* |
752 | * encrypt the response packet | |
753 | */ | |
754 | static void rxkad_encrypt_response(struct rxrpc_connection *conn, | |
755 | struct rxkad_response *resp, | |
756 | const struct rxkad_key *s2) | |
757 | { | |
1afe593b | 758 | SKCIPHER_REQUEST_ON_STACK(req, conn->cipher); |
17926a79 | 759 | struct rxrpc_crypt iv; |
a263629d | 760 | struct scatterlist sg[1]; |
17926a79 DH |
761 | |
762 | /* continue encrypting from where we left off */ | |
763 | memcpy(&iv, s2->session_key, sizeof(iv)); | |
17926a79 | 764 | |
a263629d HX |
765 | sg_init_table(sg, 1); |
766 | sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted)); | |
1afe593b HX |
767 | skcipher_request_set_tfm(req, conn->cipher); |
768 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
769 | skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x); | |
1afe593b HX |
770 | crypto_skcipher_encrypt(req); |
771 | skcipher_request_zero(req); | |
17926a79 DH |
772 | } |
773 | ||
774 | /* | |
775 | * respond to a challenge packet | |
776 | */ | |
777 | static int rxkad_respond_to_challenge(struct rxrpc_connection *conn, | |
778 | struct sk_buff *skb, | |
779 | u32 *_abort_code) | |
780 | { | |
33941284 | 781 | const struct rxrpc_key_token *token; |
17926a79 | 782 | struct rxkad_challenge challenge; |
8c2f826d | 783 | struct rxkad_response *resp; |
248f219c | 784 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
fb46f6ee | 785 | const char *eproto; |
17926a79 DH |
786 | u32 version, nonce, min_level, abort_code; |
787 | int ret; | |
788 | ||
19ffa01c | 789 | _enter("{%d,%x}", conn->debug_id, key_serial(conn->params.key)); |
17926a79 | 790 | |
fb46f6ee | 791 | eproto = tracepoint_string("chall_no_key"); |
ef68622d DH |
792 | abort_code = RX_PROTOCOL_ERROR; |
793 | if (!conn->params.key) | |
794 | goto protocol_error; | |
17926a79 | 795 | |
ef68622d | 796 | abort_code = RXKADEXPIRED; |
19ffa01c | 797 | ret = key_validate(conn->params.key); |
ef68622d DH |
798 | if (ret < 0) |
799 | goto other_error; | |
17926a79 | 800 | |
fb46f6ee | 801 | eproto = tracepoint_string("chall_short"); |
17926a79 | 802 | abort_code = RXKADPACKETSHORT; |
775e5b71 DH |
803 | if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header), |
804 | &challenge, sizeof(challenge)) < 0) | |
17926a79 DH |
805 | goto protocol_error; |
806 | ||
807 | version = ntohl(challenge.version); | |
808 | nonce = ntohl(challenge.nonce); | |
809 | min_level = ntohl(challenge.min_level); | |
810 | ||
811 | _proto("Rx CHALLENGE %%%u { v=%u n=%u ml=%u }", | |
0d12f8a4 | 812 | sp->hdr.serial, version, nonce, min_level); |
17926a79 | 813 | |
fb46f6ee | 814 | eproto = tracepoint_string("chall_ver"); |
17926a79 DH |
815 | abort_code = RXKADINCONSISTENCY; |
816 | if (version != RXKAD_VERSION) | |
817 | goto protocol_error; | |
818 | ||
819 | abort_code = RXKADLEVELFAIL; | |
ef68622d | 820 | ret = -EACCES; |
19ffa01c | 821 | if (conn->params.security_level < min_level) |
ef68622d | 822 | goto other_error; |
17926a79 | 823 | |
19ffa01c | 824 | token = conn->params.key->payload.data[0]; |
17926a79 DH |
825 | |
826 | /* build the response packet */ | |
8c2f826d DH |
827 | resp = kzalloc(sizeof(struct rxkad_response), GFP_NOFS); |
828 | if (!resp) | |
829 | return -ENOMEM; | |
830 | ||
831 | resp->version = htonl(RXKAD_VERSION); | |
832 | resp->encrypted.epoch = htonl(conn->proto.epoch); | |
833 | resp->encrypted.cid = htonl(conn->proto.cid); | |
834 | resp->encrypted.securityIndex = htonl(conn->security_ix); | |
835 | resp->encrypted.inc_nonce = htonl(nonce + 1); | |
836 | resp->encrypted.level = htonl(conn->params.security_level); | |
837 | resp->kvno = htonl(token->kad->kvno); | |
838 | resp->ticket_len = htonl(token->kad->ticket_len); | |
839 | resp->encrypted.call_id[0] = htonl(conn->channels[0].call_counter); | |
840 | resp->encrypted.call_id[1] = htonl(conn->channels[1].call_counter); | |
841 | resp->encrypted.call_id[2] = htonl(conn->channels[2].call_counter); | |
842 | resp->encrypted.call_id[3] = htonl(conn->channels[3].call_counter); | |
17926a79 DH |
843 | |
844 | /* calculate the response checksum and then do the encryption */ | |
8c2f826d DH |
845 | rxkad_calc_response_checksum(resp); |
846 | rxkad_encrypt_response(conn, resp, token->kad); | |
847 | ret = rxkad_send_response(conn, &sp->hdr, resp, token->kad); | |
848 | kfree(resp); | |
849 | return ret; | |
17926a79 DH |
850 | |
851 | protocol_error: | |
fb46f6ee | 852 | trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto); |
ef68622d DH |
853 | ret = -EPROTO; |
854 | other_error: | |
17926a79 | 855 | *_abort_code = abort_code; |
ef68622d | 856 | return ret; |
17926a79 DH |
857 | } |
858 | ||
859 | /* | |
860 | * decrypt the kerberos IV ticket in the response | |
861 | */ | |
862 | static int rxkad_decrypt_ticket(struct rxrpc_connection *conn, | |
fb46f6ee | 863 | struct sk_buff *skb, |
17926a79 DH |
864 | void *ticket, size_t ticket_len, |
865 | struct rxrpc_crypt *_session_key, | |
10674a03 | 866 | time64_t *_expiry, |
17926a79 DH |
867 | u32 *_abort_code) |
868 | { | |
1afe593b | 869 | struct skcipher_request *req; |
fb46f6ee | 870 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
17926a79 | 871 | struct rxrpc_crypt iv, key; |
68e3f5dd | 872 | struct scatterlist sg[1]; |
17926a79 | 873 | struct in_addr addr; |
95c96174 | 874 | unsigned int life; |
fb46f6ee | 875 | const char *eproto; |
10674a03 | 876 | time64_t issue, now; |
17926a79 DH |
877 | bool little_endian; |
878 | int ret; | |
fb46f6ee | 879 | u32 abort_code; |
17926a79 DH |
880 | u8 *p, *q, *name, *end; |
881 | ||
882 | _enter("{%d},{%x}", conn->debug_id, key_serial(conn->server_key)); | |
883 | ||
884 | *_expiry = 0; | |
885 | ||
886 | ret = key_validate(conn->server_key); | |
887 | if (ret < 0) { | |
888 | switch (ret) { | |
889 | case -EKEYEXPIRED: | |
fb46f6ee | 890 | abort_code = RXKADEXPIRED; |
ef68622d | 891 | goto other_error; |
17926a79 | 892 | default: |
fb46f6ee | 893 | abort_code = RXKADNOAUTH; |
ef68622d | 894 | goto other_error; |
17926a79 DH |
895 | } |
896 | } | |
897 | ||
146aa8b1 | 898 | ASSERT(conn->server_key->payload.data[0] != NULL); |
17926a79 DH |
899 | ASSERTCMP((unsigned long) ticket & 7UL, ==, 0); |
900 | ||
146aa8b1 | 901 | memcpy(&iv, &conn->server_key->payload.data[2], sizeof(iv)); |
17926a79 | 902 | |
ef68622d | 903 | ret = -ENOMEM; |
1afe593b HX |
904 | req = skcipher_request_alloc(conn->server_key->payload.data[0], |
905 | GFP_NOFS); | |
ef68622d DH |
906 | if (!req) |
907 | goto temporary_error; | |
17926a79 | 908 | |
68e3f5dd | 909 | sg_init_one(&sg[0], ticket, ticket_len); |
1afe593b HX |
910 | skcipher_request_set_callback(req, 0, NULL, NULL); |
911 | skcipher_request_set_crypt(req, sg, sg, ticket_len, iv.x); | |
1afe593b HX |
912 | crypto_skcipher_decrypt(req); |
913 | skcipher_request_free(req); | |
17926a79 DH |
914 | |
915 | p = ticket; | |
916 | end = p + ticket_len; | |
917 | ||
fb46f6ee | 918 | #define Z(field) \ |
17926a79 DH |
919 | ({ \ |
920 | u8 *__str = p; \ | |
fb46f6ee | 921 | eproto = tracepoint_string("rxkad_bad_"#field); \ |
17926a79 | 922 | q = memchr(p, 0, end - p); \ |
fb46f6ee | 923 | if (!q || q - p > (field##_SZ)) \ |
17926a79 DH |
924 | goto bad_ticket; \ |
925 | for (; p < q; p++) \ | |
926 | if (!isprint(*p)) \ | |
927 | goto bad_ticket; \ | |
928 | p++; \ | |
929 | __str; \ | |
930 | }) | |
931 | ||
932 | /* extract the ticket flags */ | |
933 | _debug("KIV FLAGS: %x", *p); | |
934 | little_endian = *p & 1; | |
935 | p++; | |
936 | ||
937 | /* extract the authentication name */ | |
fb46f6ee | 938 | name = Z(ANAME); |
17926a79 DH |
939 | _debug("KIV ANAME: %s", name); |
940 | ||
941 | /* extract the principal's instance */ | |
fb46f6ee | 942 | name = Z(INST); |
17926a79 DH |
943 | _debug("KIV INST : %s", name); |
944 | ||
945 | /* extract the principal's authentication domain */ | |
fb46f6ee | 946 | name = Z(REALM); |
17926a79 DH |
947 | _debug("KIV REALM: %s", name); |
948 | ||
fb46f6ee | 949 | eproto = tracepoint_string("rxkad_bad_len"); |
17926a79 DH |
950 | if (end - p < 4 + 8 + 4 + 2) |
951 | goto bad_ticket; | |
952 | ||
953 | /* get the IPv4 address of the entity that requested the ticket */ | |
954 | memcpy(&addr, p, sizeof(addr)); | |
955 | p += 4; | |
21454aaa | 956 | _debug("KIV ADDR : %pI4", &addr); |
17926a79 DH |
957 | |
958 | /* get the session key from the ticket */ | |
959 | memcpy(&key, p, sizeof(key)); | |
960 | p += 8; | |
961 | _debug("KIV KEY : %08x %08x", ntohl(key.n[0]), ntohl(key.n[1])); | |
962 | memcpy(_session_key, &key, sizeof(key)); | |
963 | ||
964 | /* get the ticket's lifetime */ | |
965 | life = *p++ * 5 * 60; | |
966 | _debug("KIV LIFE : %u", life); | |
967 | ||
968 | /* get the issue time of the ticket */ | |
969 | if (little_endian) { | |
970 | __le32 stamp; | |
971 | memcpy(&stamp, p, 4); | |
10674a03 | 972 | issue = rxrpc_u32_to_time64(le32_to_cpu(stamp)); |
17926a79 DH |
973 | } else { |
974 | __be32 stamp; | |
975 | memcpy(&stamp, p, 4); | |
10674a03 | 976 | issue = rxrpc_u32_to_time64(be32_to_cpu(stamp)); |
17926a79 DH |
977 | } |
978 | p += 4; | |
10674a03 BW |
979 | now = ktime_get_real_seconds(); |
980 | _debug("KIV ISSUE: %llx [%llx]", issue, now); | |
17926a79 DH |
981 | |
982 | /* check the ticket is in date */ | |
983 | if (issue > now) { | |
fb46f6ee | 984 | abort_code = RXKADNOAUTH; |
17926a79 | 985 | ret = -EKEYREJECTED; |
ef68622d | 986 | goto other_error; |
17926a79 DH |
987 | } |
988 | ||
989 | if (issue < now - life) { | |
fb46f6ee | 990 | abort_code = RXKADEXPIRED; |
17926a79 | 991 | ret = -EKEYEXPIRED; |
ef68622d | 992 | goto other_error; |
17926a79 DH |
993 | } |
994 | ||
995 | *_expiry = issue + life; | |
996 | ||
997 | /* get the service name */ | |
fb46f6ee | 998 | name = Z(SNAME); |
17926a79 DH |
999 | _debug("KIV SNAME: %s", name); |
1000 | ||
1001 | /* get the service instance name */ | |
fb46f6ee | 1002 | name = Z(INST); |
17926a79 | 1003 | _debug("KIV SINST: %s", name); |
ef68622d | 1004 | return 0; |
17926a79 DH |
1005 | |
1006 | bad_ticket: | |
fb46f6ee DH |
1007 | trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto); |
1008 | abort_code = RXKADBADTICKET; | |
ef68622d DH |
1009 | ret = -EPROTO; |
1010 | other_error: | |
fb46f6ee | 1011 | *_abort_code = abort_code; |
ef68622d DH |
1012 | return ret; |
1013 | temporary_error: | |
1014 | return ret; | |
17926a79 DH |
1015 | } |
1016 | ||
1017 | /* | |
1018 | * decrypt the response packet | |
1019 | */ | |
1020 | static void rxkad_decrypt_response(struct rxrpc_connection *conn, | |
1021 | struct rxkad_response *resp, | |
1022 | const struct rxrpc_crypt *session_key) | |
1023 | { | |
1afe593b | 1024 | SKCIPHER_REQUEST_ON_STACK(req, rxkad_ci); |
a263629d | 1025 | struct scatterlist sg[1]; |
17926a79 DH |
1026 | struct rxrpc_crypt iv; |
1027 | ||
1028 | _enter(",,%08x%08x", | |
1029 | ntohl(session_key->n[0]), ntohl(session_key->n[1])); | |
1030 | ||
1031 | ASSERT(rxkad_ci != NULL); | |
1032 | ||
1033 | mutex_lock(&rxkad_ci_mutex); | |
1afe593b HX |
1034 | if (crypto_skcipher_setkey(rxkad_ci, session_key->x, |
1035 | sizeof(*session_key)) < 0) | |
17926a79 DH |
1036 | BUG(); |
1037 | ||
1038 | memcpy(&iv, session_key, sizeof(iv)); | |
17926a79 | 1039 | |
a263629d HX |
1040 | sg_init_table(sg, 1); |
1041 | sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted)); | |
1afe593b HX |
1042 | skcipher_request_set_tfm(req, rxkad_ci); |
1043 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
1044 | skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x); | |
1afe593b HX |
1045 | crypto_skcipher_decrypt(req); |
1046 | skcipher_request_zero(req); | |
1047 | ||
17926a79 DH |
1048 | mutex_unlock(&rxkad_ci_mutex); |
1049 | ||
1050 | _leave(""); | |
1051 | } | |
1052 | ||
1053 | /* | |
1054 | * verify a response | |
1055 | */ | |
1056 | static int rxkad_verify_response(struct rxrpc_connection *conn, | |
1057 | struct sk_buff *skb, | |
1058 | u32 *_abort_code) | |
1059 | { | |
8c2f826d | 1060 | struct rxkad_response *response; |
248f219c | 1061 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
17926a79 | 1062 | struct rxrpc_crypt session_key; |
fb46f6ee | 1063 | const char *eproto; |
10674a03 | 1064 | time64_t expiry; |
17926a79 | 1065 | void *ticket; |
91e916cf AV |
1066 | u32 abort_code, version, kvno, ticket_len, level; |
1067 | __be32 csum; | |
a1399f8b | 1068 | int ret, i; |
17926a79 DH |
1069 | |
1070 | _enter("{%d,%x}", conn->debug_id, key_serial(conn->server_key)); | |
1071 | ||
8c2f826d DH |
1072 | ret = -ENOMEM; |
1073 | response = kzalloc(sizeof(struct rxkad_response), GFP_NOFS); | |
1074 | if (!response) | |
1075 | goto temporary_error; | |
1076 | ||
fb46f6ee | 1077 | eproto = tracepoint_string("rxkad_rsp_short"); |
17926a79 | 1078 | abort_code = RXKADPACKETSHORT; |
775e5b71 | 1079 | if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header), |
8c2f826d | 1080 | response, sizeof(*response)) < 0) |
17926a79 | 1081 | goto protocol_error; |
8c2f826d | 1082 | if (!pskb_pull(skb, sizeof(*response))) |
17926a79 DH |
1083 | BUG(); |
1084 | ||
8c2f826d DH |
1085 | version = ntohl(response->version); |
1086 | ticket_len = ntohl(response->ticket_len); | |
1087 | kvno = ntohl(response->kvno); | |
17926a79 | 1088 | _proto("Rx RESPONSE %%%u { v=%u kv=%u tl=%u }", |
0d12f8a4 | 1089 | sp->hdr.serial, version, kvno, ticket_len); |
17926a79 | 1090 | |
fb46f6ee | 1091 | eproto = tracepoint_string("rxkad_rsp_ver"); |
17926a79 DH |
1092 | abort_code = RXKADINCONSISTENCY; |
1093 | if (version != RXKAD_VERSION) | |
4aa9cb32 | 1094 | goto protocol_error; |
17926a79 | 1095 | |
fb46f6ee | 1096 | eproto = tracepoint_string("rxkad_rsp_tktlen"); |
17926a79 DH |
1097 | abort_code = RXKADTICKETLEN; |
1098 | if (ticket_len < 4 || ticket_len > MAXKRB5TICKETLEN) | |
1099 | goto protocol_error; | |
1100 | ||
fb46f6ee | 1101 | eproto = tracepoint_string("rxkad_rsp_unkkey"); |
17926a79 DH |
1102 | abort_code = RXKADUNKNOWNKEY; |
1103 | if (kvno >= RXKAD_TKT_TYPE_KERBEROS_V5) | |
1104 | goto protocol_error; | |
1105 | ||
1106 | /* extract the kerberos ticket and decrypt and decode it */ | |
ef68622d | 1107 | ret = -ENOMEM; |
17926a79 DH |
1108 | ticket = kmalloc(ticket_len, GFP_NOFS); |
1109 | if (!ticket) | |
ef68622d | 1110 | goto temporary_error; |
17926a79 | 1111 | |
fb46f6ee | 1112 | eproto = tracepoint_string("rxkad_tkt_short"); |
17926a79 | 1113 | abort_code = RXKADPACKETSHORT; |
775e5b71 DH |
1114 | if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header), |
1115 | ticket, ticket_len) < 0) | |
17926a79 DH |
1116 | goto protocol_error_free; |
1117 | ||
fb46f6ee | 1118 | ret = rxkad_decrypt_ticket(conn, skb, ticket, ticket_len, &session_key, |
ef68622d DH |
1119 | &expiry, _abort_code); |
1120 | if (ret < 0) | |
8c2f826d | 1121 | goto temporary_error_free_resp; |
17926a79 DH |
1122 | |
1123 | /* use the session key from inside the ticket to decrypt the | |
1124 | * response */ | |
8c2f826d | 1125 | rxkad_decrypt_response(conn, response, &session_key); |
17926a79 | 1126 | |
fb46f6ee | 1127 | eproto = tracepoint_string("rxkad_rsp_param"); |
17926a79 | 1128 | abort_code = RXKADSEALEDINCON; |
8c2f826d | 1129 | if (ntohl(response->encrypted.epoch) != conn->proto.epoch) |
17926a79 | 1130 | goto protocol_error_free; |
8c2f826d | 1131 | if (ntohl(response->encrypted.cid) != conn->proto.cid) |
17926a79 | 1132 | goto protocol_error_free; |
8c2f826d | 1133 | if (ntohl(response->encrypted.securityIndex) != conn->security_ix) |
17926a79 | 1134 | goto protocol_error_free; |
8c2f826d DH |
1135 | csum = response->encrypted.checksum; |
1136 | response->encrypted.checksum = 0; | |
1137 | rxkad_calc_response_checksum(response); | |
fb46f6ee | 1138 | eproto = tracepoint_string("rxkad_rsp_csum"); |
8c2f826d | 1139 | if (response->encrypted.checksum != csum) |
17926a79 DH |
1140 | goto protocol_error_free; |
1141 | ||
a1399f8b DH |
1142 | spin_lock(&conn->channel_lock); |
1143 | for (i = 0; i < RXRPC_MAXCALLS; i++) { | |
1144 | struct rxrpc_call *call; | |
8c2f826d | 1145 | u32 call_id = ntohl(response->encrypted.call_id[i]); |
a1399f8b | 1146 | |
fb46f6ee | 1147 | eproto = tracepoint_string("rxkad_rsp_callid"); |
a1399f8b DH |
1148 | if (call_id > INT_MAX) |
1149 | goto protocol_error_unlock; | |
1150 | ||
fb46f6ee | 1151 | eproto = tracepoint_string("rxkad_rsp_callctr"); |
a1399f8b DH |
1152 | if (call_id < conn->channels[i].call_counter) |
1153 | goto protocol_error_unlock; | |
fb46f6ee DH |
1154 | |
1155 | eproto = tracepoint_string("rxkad_rsp_callst"); | |
a1399f8b DH |
1156 | if (call_id > conn->channels[i].call_counter) { |
1157 | call = rcu_dereference_protected( | |
1158 | conn->channels[i].call, | |
1159 | lockdep_is_held(&conn->channel_lock)); | |
1160 | if (call && call->state < RXRPC_CALL_COMPLETE) | |
1161 | goto protocol_error_unlock; | |
1162 | conn->channels[i].call_counter = call_id; | |
1163 | } | |
1164 | } | |
1165 | spin_unlock(&conn->channel_lock); | |
17926a79 | 1166 | |
fb46f6ee | 1167 | eproto = tracepoint_string("rxkad_rsp_seq"); |
17926a79 | 1168 | abort_code = RXKADOUTOFSEQUENCE; |
8c2f826d | 1169 | if (ntohl(response->encrypted.inc_nonce) != conn->security_nonce + 1) |
17926a79 DH |
1170 | goto protocol_error_free; |
1171 | ||
fb46f6ee | 1172 | eproto = tracepoint_string("rxkad_rsp_level"); |
17926a79 | 1173 | abort_code = RXKADLEVELFAIL; |
8c2f826d | 1174 | level = ntohl(response->encrypted.level); |
17926a79 DH |
1175 | if (level > RXRPC_SECURITY_ENCRYPT) |
1176 | goto protocol_error_free; | |
19ffa01c | 1177 | conn->params.security_level = level; |
17926a79 DH |
1178 | |
1179 | /* create a key to hold the security data and expiration time - after | |
1180 | * this the connection security can be handled in exactly the same way | |
1181 | * as for a client connection */ | |
1182 | ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno); | |
ef68622d | 1183 | if (ret < 0) |
8c2f826d | 1184 | goto temporary_error_free_ticket; |
17926a79 DH |
1185 | |
1186 | kfree(ticket); | |
8c2f826d | 1187 | kfree(response); |
17926a79 DH |
1188 | _leave(" = 0"); |
1189 | return 0; | |
1190 | ||
a1399f8b DH |
1191 | protocol_error_unlock: |
1192 | spin_unlock(&conn->channel_lock); | |
17926a79 DH |
1193 | protocol_error_free: |
1194 | kfree(ticket); | |
1195 | protocol_error: | |
8c2f826d | 1196 | kfree(response); |
fb46f6ee | 1197 | trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto); |
17926a79 | 1198 | *_abort_code = abort_code; |
17926a79 | 1199 | return -EPROTO; |
ef68622d | 1200 | |
8c2f826d | 1201 | temporary_error_free_ticket: |
ef68622d | 1202 | kfree(ticket); |
8c2f826d DH |
1203 | temporary_error_free_resp: |
1204 | kfree(response); | |
ef68622d DH |
1205 | temporary_error: |
1206 | /* Ignore the response packet if we got a temporary error such as | |
1207 | * ENOMEM. We just want to send the challenge again. Note that we | |
1208 | * also come out this way if the ticket decryption fails. | |
1209 | */ | |
1210 | return ret; | |
17926a79 DH |
1211 | } |
1212 | ||
1213 | /* | |
1214 | * clear the connection security | |
1215 | */ | |
1216 | static void rxkad_clear(struct rxrpc_connection *conn) | |
1217 | { | |
1218 | _enter(""); | |
1219 | ||
1220 | if (conn->cipher) | |
1afe593b | 1221 | crypto_free_skcipher(conn->cipher); |
17926a79 DH |
1222 | } |
1223 | ||
648af7fc DH |
1224 | /* |
1225 | * Initialise the rxkad security service. | |
1226 | */ | |
1227 | static int rxkad_init(void) | |
1228 | { | |
1229 | /* pin the cipher we need so that the crypto layer doesn't invoke | |
1230 | * keventd to go get it */ | |
1231 | rxkad_ci = crypto_alloc_skcipher("pcbc(fcrypt)", 0, CRYPTO_ALG_ASYNC); | |
fa54cc70 | 1232 | return PTR_ERR_OR_ZERO(rxkad_ci); |
648af7fc DH |
1233 | } |
1234 | ||
1235 | /* | |
1236 | * Clean up the rxkad security service. | |
1237 | */ | |
1238 | static void rxkad_exit(void) | |
1239 | { | |
1240 | if (rxkad_ci) | |
1241 | crypto_free_skcipher(rxkad_ci); | |
1242 | } | |
1243 | ||
17926a79 DH |
1244 | /* |
1245 | * RxRPC Kerberos-based security | |
1246 | */ | |
648af7fc | 1247 | const struct rxrpc_security rxkad = { |
17926a79 | 1248 | .name = "rxkad", |
8b815477 | 1249 | .security_index = RXRPC_SECURITY_RXKAD, |
648af7fc DH |
1250 | .init = rxkad_init, |
1251 | .exit = rxkad_exit, | |
17926a79 DH |
1252 | .init_connection_security = rxkad_init_connection_security, |
1253 | .prime_packet_security = rxkad_prime_packet_security, | |
1254 | .secure_packet = rxkad_secure_packet, | |
1255 | .verify_packet = rxkad_verify_packet, | |
248f219c | 1256 | .locate_data = rxkad_locate_data, |
17926a79 DH |
1257 | .issue_challenge = rxkad_issue_challenge, |
1258 | .respond_to_challenge = rxkad_respond_to_challenge, | |
1259 | .verify_response = rxkad_verify_response, | |
1260 | .clear = rxkad_clear, | |
1261 | }; |