Commit | Line | Data |
---|---|---|
17926a79 DH |
1 | /* Kerberos-based RxRPC security |
2 | * | |
3 | * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved. | |
4 | * Written by David Howells (dhowells@redhat.com) | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU General Public License | |
8 | * as published by the Free Software Foundation; either version | |
9 | * 2 of the License, or (at your option) any later version. | |
10 | */ | |
11 | ||
9b6d5398 JP |
12 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
13 | ||
1afe593b | 14 | #include <crypto/skcipher.h> |
17926a79 DH |
15 | #include <linux/module.h> |
16 | #include <linux/net.h> | |
17 | #include <linux/skbuff.h> | |
18 | #include <linux/udp.h> | |
17926a79 DH |
19 | #include <linux/scatterlist.h> |
20 | #include <linux/ctype.h> | |
5a0e3ad6 | 21 | #include <linux/slab.h> |
17926a79 DH |
22 | #include <net/sock.h> |
23 | #include <net/af_rxrpc.h> | |
33941284 | 24 | #include <keys/rxrpc-type.h> |
17926a79 DH |
25 | #include "ar-internal.h" |
26 | ||
27 | #define RXKAD_VERSION 2 | |
28 | #define MAXKRB5TICKETLEN 1024 | |
29 | #define RXKAD_TKT_TYPE_KERBEROS_V5 256 | |
30 | #define ANAME_SZ 40 /* size of authentication name */ | |
31 | #define INST_SZ 40 /* size of principal's instance */ | |
32 | #define REALM_SZ 40 /* size of principal's auth domain */ | |
33 | #define SNAME_SZ 40 /* size of service name */ | |
34 | ||
17926a79 DH |
35 | struct rxkad_level1_hdr { |
36 | __be32 data_size; /* true data size (excluding padding) */ | |
37 | }; | |
38 | ||
39 | struct rxkad_level2_hdr { | |
40 | __be32 data_size; /* true data size (excluding padding) */ | |
41 | __be32 checksum; /* decrypted data checksum */ | |
42 | }; | |
43 | ||
17926a79 DH |
44 | /* |
45 | * this holds a pinned cipher so that keventd doesn't get called by the cipher | |
46 | * alloc routine, but since we have it to hand, we use it to decrypt RESPONSE | |
47 | * packets | |
48 | */ | |
1afe593b | 49 | static struct crypto_skcipher *rxkad_ci; |
17926a79 DH |
50 | static DEFINE_MUTEX(rxkad_ci_mutex); |
51 | ||
52 | /* | |
53 | * initialise connection security | |
54 | */ | |
55 | static int rxkad_init_connection_security(struct rxrpc_connection *conn) | |
56 | { | |
1afe593b | 57 | struct crypto_skcipher *ci; |
33941284 | 58 | struct rxrpc_key_token *token; |
17926a79 DH |
59 | int ret; |
60 | ||
19ffa01c | 61 | _enter("{%d},{%x}", conn->debug_id, key_serial(conn->params.key)); |
17926a79 | 62 | |
19ffa01c | 63 | token = conn->params.key->payload.data[0]; |
33941284 | 64 | conn->security_ix = token->security_index; |
17926a79 | 65 | |
1afe593b | 66 | ci = crypto_alloc_skcipher("pcbc(fcrypt)", 0, CRYPTO_ALG_ASYNC); |
17926a79 DH |
67 | if (IS_ERR(ci)) { |
68 | _debug("no cipher"); | |
69 | ret = PTR_ERR(ci); | |
70 | goto error; | |
71 | } | |
72 | ||
1afe593b HX |
73 | if (crypto_skcipher_setkey(ci, token->kad->session_key, |
74 | sizeof(token->kad->session_key)) < 0) | |
17926a79 DH |
75 | BUG(); |
76 | ||
19ffa01c | 77 | switch (conn->params.security_level) { |
17926a79 DH |
78 | case RXRPC_SECURITY_PLAIN: |
79 | break; | |
80 | case RXRPC_SECURITY_AUTH: | |
81 | conn->size_align = 8; | |
82 | conn->security_size = sizeof(struct rxkad_level1_hdr); | |
83 | conn->header_size += sizeof(struct rxkad_level1_hdr); | |
84 | break; | |
85 | case RXRPC_SECURITY_ENCRYPT: | |
86 | conn->size_align = 8; | |
87 | conn->security_size = sizeof(struct rxkad_level2_hdr); | |
88 | conn->header_size += sizeof(struct rxkad_level2_hdr); | |
89 | break; | |
90 | default: | |
91 | ret = -EKEYREJECTED; | |
92 | goto error; | |
93 | } | |
94 | ||
95 | conn->cipher = ci; | |
96 | ret = 0; | |
97 | error: | |
98 | _leave(" = %d", ret); | |
99 | return ret; | |
100 | } | |
101 | ||
102 | /* | |
103 | * prime the encryption state with the invariant parts of a connection's | |
104 | * description | |
105 | */ | |
a263629d | 106 | static int rxkad_prime_packet_security(struct rxrpc_connection *conn) |
17926a79 | 107 | { |
33941284 | 108 | struct rxrpc_key_token *token; |
1afe593b | 109 | SKCIPHER_REQUEST_ON_STACK(req, conn->cipher); |
a263629d | 110 | struct scatterlist sg; |
17926a79 | 111 | struct rxrpc_crypt iv; |
a263629d HX |
112 | __be32 *tmpbuf; |
113 | size_t tmpsize = 4 * sizeof(__be32); | |
17926a79 DH |
114 | |
115 | _enter(""); | |
116 | ||
19ffa01c | 117 | if (!conn->params.key) |
a263629d HX |
118 | return 0; |
119 | ||
120 | tmpbuf = kmalloc(tmpsize, GFP_KERNEL); | |
121 | if (!tmpbuf) | |
122 | return -ENOMEM; | |
17926a79 | 123 | |
19ffa01c | 124 | token = conn->params.key->payload.data[0]; |
33941284 | 125 | memcpy(&iv, token->kad->session_key, sizeof(iv)); |
17926a79 | 126 | |
a263629d HX |
127 | tmpbuf[0] = htonl(conn->proto.epoch); |
128 | tmpbuf[1] = htonl(conn->proto.cid); | |
129 | tmpbuf[2] = 0; | |
130 | tmpbuf[3] = htonl(conn->security_ix); | |
1afe593b | 131 | |
a263629d | 132 | sg_init_one(&sg, tmpbuf, tmpsize); |
1afe593b HX |
133 | skcipher_request_set_tfm(req, conn->cipher); |
134 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
a263629d | 135 | skcipher_request_set_crypt(req, &sg, &sg, tmpsize, iv.x); |
1afe593b HX |
136 | crypto_skcipher_encrypt(req); |
137 | skcipher_request_zero(req); | |
17926a79 | 138 | |
a263629d HX |
139 | memcpy(&conn->csum_iv, tmpbuf + 2, sizeof(conn->csum_iv)); |
140 | kfree(tmpbuf); | |
141 | _leave(" = 0"); | |
142 | return 0; | |
17926a79 DH |
143 | } |
144 | ||
145 | /* | |
146 | * partially encrypt a packet (level 1 security) | |
147 | */ | |
148 | static int rxkad_secure_packet_auth(const struct rxrpc_call *call, | |
149 | struct sk_buff *skb, | |
150 | u32 data_size, | |
151 | void *sechdr) | |
152 | { | |
153 | struct rxrpc_skb_priv *sp; | |
1afe593b | 154 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
a263629d | 155 | struct rxkad_level1_hdr hdr; |
17926a79 | 156 | struct rxrpc_crypt iv; |
a263629d | 157 | struct scatterlist sg; |
17926a79 DH |
158 | u16 check; |
159 | ||
160 | sp = rxrpc_skb(skb); | |
161 | ||
162 | _enter(""); | |
163 | ||
0d12f8a4 DH |
164 | check = sp->hdr.seq ^ sp->hdr.callNumber; |
165 | data_size |= (u32)check << 16; | |
17926a79 | 166 | |
a263629d HX |
167 | hdr.data_size = htonl(data_size); |
168 | memcpy(sechdr, &hdr, sizeof(hdr)); | |
17926a79 DH |
169 | |
170 | /* start the encryption afresh */ | |
171 | memset(&iv, 0, sizeof(iv)); | |
17926a79 | 172 | |
a263629d | 173 | sg_init_one(&sg, sechdr, 8); |
1afe593b HX |
174 | skcipher_request_set_tfm(req, call->conn->cipher); |
175 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
a263629d | 176 | skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); |
1afe593b HX |
177 | crypto_skcipher_encrypt(req); |
178 | skcipher_request_zero(req); | |
17926a79 | 179 | |
17926a79 DH |
180 | _leave(" = 0"); |
181 | return 0; | |
182 | } | |
183 | ||
184 | /* | |
185 | * wholly encrypt a packet (level 2 security) | |
186 | */ | |
187 | static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call, | |
b4f1342f DH |
188 | struct sk_buff *skb, |
189 | u32 data_size, | |
190 | void *sechdr) | |
17926a79 | 191 | { |
33941284 | 192 | const struct rxrpc_key_token *token; |
a263629d | 193 | struct rxkad_level2_hdr rxkhdr; |
17926a79 | 194 | struct rxrpc_skb_priv *sp; |
1afe593b | 195 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
17926a79 DH |
196 | struct rxrpc_crypt iv; |
197 | struct scatterlist sg[16]; | |
198 | struct sk_buff *trailer; | |
95c96174 | 199 | unsigned int len; |
17926a79 DH |
200 | u16 check; |
201 | int nsg; | |
1afe593b | 202 | int err; |
17926a79 DH |
203 | |
204 | sp = rxrpc_skb(skb); | |
205 | ||
206 | _enter(""); | |
207 | ||
0d12f8a4 | 208 | check = sp->hdr.seq ^ sp->hdr.callNumber; |
17926a79 | 209 | |
0d12f8a4 | 210 | rxkhdr.data_size = htonl(data_size | (u32)check << 16); |
17926a79 | 211 | rxkhdr.checksum = 0; |
a263629d | 212 | memcpy(sechdr, &rxkhdr, sizeof(rxkhdr)); |
17926a79 DH |
213 | |
214 | /* encrypt from the session key */ | |
19ffa01c | 215 | token = call->conn->params.key->payload.data[0]; |
33941284 | 216 | memcpy(&iv, token->kad->session_key, sizeof(iv)); |
17926a79 | 217 | |
68e3f5dd | 218 | sg_init_one(&sg[0], sechdr, sizeof(rxkhdr)); |
1afe593b HX |
219 | skcipher_request_set_tfm(req, call->conn->cipher); |
220 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
a263629d | 221 | skcipher_request_set_crypt(req, &sg[0], &sg[0], sizeof(rxkhdr), iv.x); |
1afe593b | 222 | crypto_skcipher_encrypt(req); |
17926a79 DH |
223 | |
224 | /* we want to encrypt the skbuff in-place */ | |
225 | nsg = skb_cow_data(skb, 0, &trailer); | |
1afe593b | 226 | err = -ENOMEM; |
17926a79 | 227 | if (nsg < 0 || nsg > 16) |
1afe593b | 228 | goto out; |
17926a79 DH |
229 | |
230 | len = data_size + call->conn->size_align - 1; | |
231 | len &= ~(call->conn->size_align - 1); | |
232 | ||
51c739d1 DM |
233 | sg_init_table(sg, nsg); |
234 | skb_to_sgvec(skb, sg, 0, len); | |
1afe593b | 235 | skcipher_request_set_crypt(req, sg, sg, len, iv.x); |
1afe593b | 236 | crypto_skcipher_encrypt(req); |
17926a79 DH |
237 | |
238 | _leave(" = 0"); | |
1afe593b HX |
239 | err = 0; |
240 | ||
241 | out: | |
242 | skcipher_request_zero(req); | |
243 | return err; | |
17926a79 DH |
244 | } |
245 | ||
246 | /* | |
247 | * checksum an RxRPC packet header | |
248 | */ | |
a263629d | 249 | static int rxkad_secure_packet(struct rxrpc_call *call, |
b4f1342f DH |
250 | struct sk_buff *skb, |
251 | size_t data_size, | |
252 | void *sechdr) | |
17926a79 DH |
253 | { |
254 | struct rxrpc_skb_priv *sp; | |
1afe593b | 255 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
17926a79 | 256 | struct rxrpc_crypt iv; |
a263629d | 257 | struct scatterlist sg; |
0d12f8a4 | 258 | u32 x, y; |
17926a79 DH |
259 | int ret; |
260 | ||
261 | sp = rxrpc_skb(skb); | |
262 | ||
263 | _enter("{%d{%x}},{#%u},%zu,", | |
19ffa01c DH |
264 | call->debug_id, key_serial(call->conn->params.key), |
265 | sp->hdr.seq, data_size); | |
17926a79 DH |
266 | |
267 | if (!call->conn->cipher) | |
268 | return 0; | |
269 | ||
19ffa01c | 270 | ret = key_validate(call->conn->params.key); |
17926a79 DH |
271 | if (ret < 0) |
272 | return ret; | |
273 | ||
274 | /* continue encrypting from where we left off */ | |
275 | memcpy(&iv, call->conn->csum_iv.x, sizeof(iv)); | |
17926a79 DH |
276 | |
277 | /* calculate the security checksum */ | |
01a90a45 | 278 | x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT); |
0d12f8a4 | 279 | x |= sp->hdr.seq & 0x3fffffff; |
a263629d HX |
280 | call->crypto_buf[0] = htonl(sp->hdr.callNumber); |
281 | call->crypto_buf[1] = htonl(x); | |
1afe593b | 282 | |
a263629d | 283 | sg_init_one(&sg, call->crypto_buf, 8); |
1afe593b HX |
284 | skcipher_request_set_tfm(req, call->conn->cipher); |
285 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
a263629d | 286 | skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); |
1afe593b HX |
287 | crypto_skcipher_encrypt(req); |
288 | skcipher_request_zero(req); | |
17926a79 | 289 | |
a263629d | 290 | y = ntohl(call->crypto_buf[1]); |
91e916cf AV |
291 | y = (y >> 16) & 0xffff; |
292 | if (y == 0) | |
293 | y = 1; /* zero checksums are not permitted */ | |
0d12f8a4 | 294 | sp->hdr.cksum = y; |
17926a79 | 295 | |
19ffa01c | 296 | switch (call->conn->params.security_level) { |
17926a79 DH |
297 | case RXRPC_SECURITY_PLAIN: |
298 | ret = 0; | |
299 | break; | |
300 | case RXRPC_SECURITY_AUTH: | |
301 | ret = rxkad_secure_packet_auth(call, skb, data_size, sechdr); | |
302 | break; | |
303 | case RXRPC_SECURITY_ENCRYPT: | |
304 | ret = rxkad_secure_packet_encrypt(call, skb, data_size, | |
305 | sechdr); | |
306 | break; | |
307 | default: | |
308 | ret = -EPERM; | |
309 | break; | |
310 | } | |
311 | ||
91e916cf | 312 | _leave(" = %d [set %hx]", ret, y); |
17926a79 DH |
313 | return ret; |
314 | } | |
315 | ||
316 | /* | |
317 | * decrypt partial encryption on a packet (level 1 security) | |
318 | */ | |
5a42976d | 319 | static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb, |
248f219c | 320 | unsigned int offset, unsigned int len, |
5a42976d | 321 | rxrpc_seq_t seq) |
17926a79 DH |
322 | { |
323 | struct rxkad_level1_hdr sechdr; | |
1afe593b | 324 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
17926a79 | 325 | struct rxrpc_crypt iv; |
68e3f5dd | 326 | struct scatterlist sg[16]; |
17926a79 DH |
327 | struct sk_buff *trailer; |
328 | u32 data_size, buf; | |
329 | u16 check; | |
68e3f5dd | 330 | int nsg; |
17926a79 DH |
331 | |
332 | _enter(""); | |
333 | ||
248f219c | 334 | if (len < 8) { |
5a42976d DH |
335 | rxrpc_abort_call("V1H", call, seq, RXKADSEALEDINCON, EPROTO); |
336 | goto protocol_error; | |
337 | } | |
17926a79 | 338 | |
248f219c DH |
339 | /* Decrypt the skbuff in-place. TODO: We really want to decrypt |
340 | * directly into the target buffer. | |
341 | */ | |
68e3f5dd HX |
342 | nsg = skb_cow_data(skb, 0, &trailer); |
343 | if (nsg < 0 || nsg > 16) | |
17926a79 DH |
344 | goto nomem; |
345 | ||
68e3f5dd | 346 | sg_init_table(sg, nsg); |
248f219c | 347 | skb_to_sgvec(skb, sg, offset, 8); |
17926a79 DH |
348 | |
349 | /* start the decryption afresh */ | |
350 | memset(&iv, 0, sizeof(iv)); | |
17926a79 | 351 | |
1afe593b HX |
352 | skcipher_request_set_tfm(req, call->conn->cipher); |
353 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
354 | skcipher_request_set_crypt(req, sg, sg, 8, iv.x); | |
1afe593b HX |
355 | crypto_skcipher_decrypt(req); |
356 | skcipher_request_zero(req); | |
17926a79 | 357 | |
5a42976d | 358 | /* Extract the decrypted packet length */ |
248f219c | 359 | if (skb_copy_bits(skb, offset, &sechdr, sizeof(sechdr)) < 0) { |
5a42976d DH |
360 | rxrpc_abort_call("XV1", call, seq, RXKADDATALEN, EPROTO); |
361 | goto protocol_error; | |
362 | } | |
248f219c DH |
363 | offset += sizeof(sechdr); |
364 | len -= sizeof(sechdr); | |
17926a79 DH |
365 | |
366 | buf = ntohl(sechdr.data_size); | |
367 | data_size = buf & 0xffff; | |
368 | ||
369 | check = buf >> 16; | |
5a42976d | 370 | check ^= seq ^ call->call_id; |
17926a79 DH |
371 | check &= 0xffff; |
372 | if (check != 0) { | |
5a42976d | 373 | rxrpc_abort_call("V1C", call, seq, RXKADSEALEDINCON, EPROTO); |
17926a79 DH |
374 | goto protocol_error; |
375 | } | |
376 | ||
248f219c | 377 | if (data_size > len) { |
5a42976d DH |
378 | rxrpc_abort_call("V1L", call, seq, RXKADDATALEN, EPROTO); |
379 | goto protocol_error; | |
380 | } | |
17926a79 DH |
381 | |
382 | _leave(" = 0 [dlen=%x]", data_size); | |
383 | return 0; | |
384 | ||
17926a79 | 385 | protocol_error: |
248f219c | 386 | rxrpc_send_call_packet(call, RXRPC_PACKET_TYPE_ABORT); |
17926a79 DH |
387 | _leave(" = -EPROTO"); |
388 | return -EPROTO; | |
389 | ||
390 | nomem: | |
391 | _leave(" = -ENOMEM"); | |
392 | return -ENOMEM; | |
393 | } | |
394 | ||
395 | /* | |
396 | * wholly decrypt a packet (level 2 security) | |
397 | */ | |
5a42976d | 398 | static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb, |
248f219c | 399 | unsigned int offset, unsigned int len, |
5a42976d | 400 | rxrpc_seq_t seq) |
17926a79 | 401 | { |
33941284 | 402 | const struct rxrpc_key_token *token; |
17926a79 | 403 | struct rxkad_level2_hdr sechdr; |
1afe593b | 404 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
17926a79 DH |
405 | struct rxrpc_crypt iv; |
406 | struct scatterlist _sg[4], *sg; | |
407 | struct sk_buff *trailer; | |
408 | u32 data_size, buf; | |
409 | u16 check; | |
410 | int nsg; | |
411 | ||
412 | _enter(",{%d}", skb->len); | |
413 | ||
248f219c | 414 | if (len < 8) { |
5a42976d DH |
415 | rxrpc_abort_call("V2H", call, seq, RXKADSEALEDINCON, EPROTO); |
416 | goto protocol_error; | |
417 | } | |
17926a79 | 418 | |
248f219c DH |
419 | /* Decrypt the skbuff in-place. TODO: We really want to decrypt |
420 | * directly into the target buffer. | |
421 | */ | |
17926a79 DH |
422 | nsg = skb_cow_data(skb, 0, &trailer); |
423 | if (nsg < 0) | |
424 | goto nomem; | |
425 | ||
426 | sg = _sg; | |
427 | if (unlikely(nsg > 4)) { | |
428 | sg = kmalloc(sizeof(*sg) * nsg, GFP_NOIO); | |
429 | if (!sg) | |
430 | goto nomem; | |
431 | } | |
432 | ||
68e3f5dd | 433 | sg_init_table(sg, nsg); |
248f219c | 434 | skb_to_sgvec(skb, sg, offset, len); |
17926a79 DH |
435 | |
436 | /* decrypt from the session key */ | |
19ffa01c | 437 | token = call->conn->params.key->payload.data[0]; |
33941284 | 438 | memcpy(&iv, token->kad->session_key, sizeof(iv)); |
17926a79 | 439 | |
1afe593b HX |
440 | skcipher_request_set_tfm(req, call->conn->cipher); |
441 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
248f219c | 442 | skcipher_request_set_crypt(req, sg, sg, len, iv.x); |
1afe593b HX |
443 | crypto_skcipher_decrypt(req); |
444 | skcipher_request_zero(req); | |
17926a79 DH |
445 | if (sg != _sg) |
446 | kfree(sg); | |
447 | ||
5a42976d | 448 | /* Extract the decrypted packet length */ |
248f219c | 449 | if (skb_copy_bits(skb, offset, &sechdr, sizeof(sechdr)) < 0) { |
5a42976d DH |
450 | rxrpc_abort_call("XV2", call, seq, RXKADDATALEN, EPROTO); |
451 | goto protocol_error; | |
452 | } | |
248f219c DH |
453 | offset += sizeof(sechdr); |
454 | len -= sizeof(sechdr); | |
17926a79 DH |
455 | |
456 | buf = ntohl(sechdr.data_size); | |
457 | data_size = buf & 0xffff; | |
458 | ||
459 | check = buf >> 16; | |
5a42976d | 460 | check ^= seq ^ call->call_id; |
17926a79 DH |
461 | check &= 0xffff; |
462 | if (check != 0) { | |
5a42976d | 463 | rxrpc_abort_call("V2C", call, seq, RXKADSEALEDINCON, EPROTO); |
17926a79 DH |
464 | goto protocol_error; |
465 | } | |
466 | ||
248f219c | 467 | if (data_size > len) { |
5a42976d DH |
468 | rxrpc_abort_call("V2L", call, seq, RXKADDATALEN, EPROTO); |
469 | goto protocol_error; | |
470 | } | |
17926a79 DH |
471 | |
472 | _leave(" = 0 [dlen=%x]", data_size); | |
473 | return 0; | |
474 | ||
17926a79 | 475 | protocol_error: |
248f219c | 476 | rxrpc_send_call_packet(call, RXRPC_PACKET_TYPE_ABORT); |
17926a79 DH |
477 | _leave(" = -EPROTO"); |
478 | return -EPROTO; | |
479 | ||
480 | nomem: | |
481 | _leave(" = -ENOMEM"); | |
482 | return -ENOMEM; | |
483 | } | |
484 | ||
485 | /* | |
5a42976d DH |
486 | * Verify the security on a received packet or subpacket (if part of a |
487 | * jumbo packet). | |
17926a79 | 488 | */ |
5a42976d | 489 | static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb, |
248f219c | 490 | unsigned int offset, unsigned int len, |
5a42976d | 491 | rxrpc_seq_t seq, u16 expected_cksum) |
17926a79 | 492 | { |
1afe593b | 493 | SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher); |
17926a79 | 494 | struct rxrpc_crypt iv; |
a263629d | 495 | struct scatterlist sg; |
0d12f8a4 DH |
496 | u16 cksum; |
497 | u32 x, y; | |
17926a79 DH |
498 | |
499 | _enter("{%d{%x}},{#%u}", | |
5a42976d | 500 | call->debug_id, key_serial(call->conn->params.key), seq); |
17926a79 DH |
501 | |
502 | if (!call->conn->cipher) | |
503 | return 0; | |
504 | ||
17926a79 DH |
505 | /* continue encrypting from where we left off */ |
506 | memcpy(&iv, call->conn->csum_iv.x, sizeof(iv)); | |
17926a79 DH |
507 | |
508 | /* validate the security checksum */ | |
01a90a45 | 509 | x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT); |
5a42976d | 510 | x |= seq & 0x3fffffff; |
a263629d HX |
511 | call->crypto_buf[0] = htonl(call->call_id); |
512 | call->crypto_buf[1] = htonl(x); | |
1afe593b | 513 | |
a263629d | 514 | sg_init_one(&sg, call->crypto_buf, 8); |
1afe593b HX |
515 | skcipher_request_set_tfm(req, call->conn->cipher); |
516 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
a263629d | 517 | skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x); |
1afe593b HX |
518 | crypto_skcipher_encrypt(req); |
519 | skcipher_request_zero(req); | |
17926a79 | 520 | |
a263629d | 521 | y = ntohl(call->crypto_buf[1]); |
0d12f8a4 DH |
522 | cksum = (y >> 16) & 0xffff; |
523 | if (cksum == 0) | |
524 | cksum = 1; /* zero checksums are not permitted */ | |
17926a79 | 525 | |
5a42976d DH |
526 | if (cksum != expected_cksum) { |
527 | rxrpc_abort_call("VCK", call, seq, RXKADSEALEDINCON, EPROTO); | |
248f219c | 528 | rxrpc_send_call_packet(call, RXRPC_PACKET_TYPE_ABORT); |
17926a79 DH |
529 | _leave(" = -EPROTO [csum failed]"); |
530 | return -EPROTO; | |
531 | } | |
532 | ||
19ffa01c | 533 | switch (call->conn->params.security_level) { |
17926a79 | 534 | case RXRPC_SECURITY_PLAIN: |
5a42976d | 535 | return 0; |
17926a79 | 536 | case RXRPC_SECURITY_AUTH: |
248f219c | 537 | return rxkad_verify_packet_1(call, skb, offset, len, seq); |
17926a79 | 538 | case RXRPC_SECURITY_ENCRYPT: |
248f219c | 539 | return rxkad_verify_packet_2(call, skb, offset, len, seq); |
17926a79 | 540 | default: |
5a42976d | 541 | return -ENOANO; |
17926a79 | 542 | } |
17926a79 DH |
543 | } |
544 | ||
248f219c DH |
545 | /* |
546 | * Locate the data contained in a packet that was partially encrypted. | |
547 | */ | |
548 | static void rxkad_locate_data_1(struct rxrpc_call *call, struct sk_buff *skb, | |
549 | unsigned int *_offset, unsigned int *_len) | |
550 | { | |
551 | struct rxkad_level1_hdr sechdr; | |
552 | ||
553 | if (skb_copy_bits(skb, *_offset, &sechdr, sizeof(sechdr)) < 0) | |
554 | BUG(); | |
555 | *_offset += sizeof(sechdr); | |
556 | *_len = ntohl(sechdr.data_size) & 0xffff; | |
557 | } | |
558 | ||
559 | /* | |
560 | * Locate the data contained in a packet that was completely encrypted. | |
561 | */ | |
562 | static void rxkad_locate_data_2(struct rxrpc_call *call, struct sk_buff *skb, | |
563 | unsigned int *_offset, unsigned int *_len) | |
564 | { | |
565 | struct rxkad_level2_hdr sechdr; | |
566 | ||
567 | if (skb_copy_bits(skb, *_offset, &sechdr, sizeof(sechdr)) < 0) | |
568 | BUG(); | |
569 | *_offset += sizeof(sechdr); | |
570 | *_len = ntohl(sechdr.data_size) & 0xffff; | |
571 | } | |
572 | ||
573 | /* | |
574 | * Locate the data contained in an already decrypted packet. | |
575 | */ | |
576 | static void rxkad_locate_data(struct rxrpc_call *call, struct sk_buff *skb, | |
577 | unsigned int *_offset, unsigned int *_len) | |
578 | { | |
579 | switch (call->conn->params.security_level) { | |
580 | case RXRPC_SECURITY_AUTH: | |
581 | rxkad_locate_data_1(call, skb, _offset, _len); | |
582 | return; | |
583 | case RXRPC_SECURITY_ENCRYPT: | |
584 | rxkad_locate_data_2(call, skb, _offset, _len); | |
585 | return; | |
586 | default: | |
587 | return; | |
588 | } | |
589 | } | |
590 | ||
17926a79 DH |
591 | /* |
592 | * issue a challenge | |
593 | */ | |
594 | static int rxkad_issue_challenge(struct rxrpc_connection *conn) | |
595 | { | |
596 | struct rxkad_challenge challenge; | |
0d12f8a4 | 597 | struct rxrpc_wire_header whdr; |
17926a79 DH |
598 | struct msghdr msg; |
599 | struct kvec iov[2]; | |
600 | size_t len; | |
0d12f8a4 | 601 | u32 serial; |
17926a79 DH |
602 | int ret; |
603 | ||
19ffa01c | 604 | _enter("{%d,%x}", conn->debug_id, key_serial(conn->params.key)); |
17926a79 | 605 | |
19ffa01c | 606 | ret = key_validate(conn->params.key); |
17926a79 DH |
607 | if (ret < 0) |
608 | return ret; | |
609 | ||
610 | get_random_bytes(&conn->security_nonce, sizeof(conn->security_nonce)); | |
611 | ||
612 | challenge.version = htonl(2); | |
613 | challenge.nonce = htonl(conn->security_nonce); | |
614 | challenge.min_level = htonl(0); | |
615 | challenge.__padding = 0; | |
616 | ||
85f32278 DH |
617 | msg.msg_name = &conn->params.peer->srx.transport.sin; |
618 | msg.msg_namelen = sizeof(conn->params.peer->srx.transport.sin); | |
17926a79 DH |
619 | msg.msg_control = NULL; |
620 | msg.msg_controllen = 0; | |
621 | msg.msg_flags = 0; | |
622 | ||
19ffa01c DH |
623 | whdr.epoch = htonl(conn->proto.epoch); |
624 | whdr.cid = htonl(conn->proto.cid); | |
0d12f8a4 DH |
625 | whdr.callNumber = 0; |
626 | whdr.seq = 0; | |
627 | whdr.type = RXRPC_PACKET_TYPE_CHALLENGE; | |
628 | whdr.flags = conn->out_clientflag; | |
629 | whdr.userStatus = 0; | |
630 | whdr.securityIndex = conn->security_ix; | |
631 | whdr._rsvd = 0; | |
19ffa01c | 632 | whdr.serviceId = htons(conn->params.service_id); |
0d12f8a4 DH |
633 | |
634 | iov[0].iov_base = &whdr; | |
635 | iov[0].iov_len = sizeof(whdr); | |
17926a79 DH |
636 | iov[1].iov_base = &challenge; |
637 | iov[1].iov_len = sizeof(challenge); | |
638 | ||
639 | len = iov[0].iov_len + iov[1].iov_len; | |
640 | ||
0d12f8a4 DH |
641 | serial = atomic_inc_return(&conn->serial); |
642 | whdr.serial = htonl(serial); | |
643 | _proto("Tx CHALLENGE %%%u", serial); | |
17926a79 | 644 | |
85f32278 | 645 | ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len); |
17926a79 DH |
646 | if (ret < 0) { |
647 | _debug("sendmsg failed: %d", ret); | |
648 | return -EAGAIN; | |
649 | } | |
650 | ||
651 | _leave(" = 0"); | |
652 | return 0; | |
653 | } | |
654 | ||
655 | /* | |
656 | * send a Kerberos security response | |
657 | */ | |
658 | static int rxkad_send_response(struct rxrpc_connection *conn, | |
0d12f8a4 | 659 | struct rxrpc_host_header *hdr, |
17926a79 DH |
660 | struct rxkad_response *resp, |
661 | const struct rxkad_key *s2) | |
662 | { | |
0d12f8a4 | 663 | struct rxrpc_wire_header whdr; |
17926a79 DH |
664 | struct msghdr msg; |
665 | struct kvec iov[3]; | |
666 | size_t len; | |
0d12f8a4 | 667 | u32 serial; |
17926a79 DH |
668 | int ret; |
669 | ||
670 | _enter(""); | |
671 | ||
85f32278 DH |
672 | msg.msg_name = &conn->params.peer->srx.transport.sin; |
673 | msg.msg_namelen = sizeof(conn->params.peer->srx.transport.sin); | |
17926a79 DH |
674 | msg.msg_control = NULL; |
675 | msg.msg_controllen = 0; | |
676 | msg.msg_flags = 0; | |
677 | ||
0d12f8a4 DH |
678 | memset(&whdr, 0, sizeof(whdr)); |
679 | whdr.epoch = htonl(hdr->epoch); | |
680 | whdr.cid = htonl(hdr->cid); | |
681 | whdr.type = RXRPC_PACKET_TYPE_RESPONSE; | |
682 | whdr.flags = conn->out_clientflag; | |
683 | whdr.securityIndex = hdr->securityIndex; | |
684 | whdr.serviceId = htons(hdr->serviceId); | |
17926a79 | 685 | |
0d12f8a4 DH |
686 | iov[0].iov_base = &whdr; |
687 | iov[0].iov_len = sizeof(whdr); | |
17926a79 DH |
688 | iov[1].iov_base = resp; |
689 | iov[1].iov_len = sizeof(*resp); | |
0d12f8a4 | 690 | iov[2].iov_base = (void *)s2->ticket; |
17926a79 DH |
691 | iov[2].iov_len = s2->ticket_len; |
692 | ||
693 | len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len; | |
694 | ||
0d12f8a4 DH |
695 | serial = atomic_inc_return(&conn->serial); |
696 | whdr.serial = htonl(serial); | |
697 | _proto("Tx RESPONSE %%%u", serial); | |
17926a79 | 698 | |
85f32278 | 699 | ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 3, len); |
17926a79 DH |
700 | if (ret < 0) { |
701 | _debug("sendmsg failed: %d", ret); | |
702 | return -EAGAIN; | |
703 | } | |
704 | ||
705 | _leave(" = 0"); | |
706 | return 0; | |
707 | } | |
708 | ||
709 | /* | |
710 | * calculate the response checksum | |
711 | */ | |
712 | static void rxkad_calc_response_checksum(struct rxkad_response *response) | |
713 | { | |
714 | u32 csum = 1000003; | |
715 | int loop; | |
716 | u8 *p = (u8 *) response; | |
717 | ||
718 | for (loop = sizeof(*response); loop > 0; loop--) | |
719 | csum = csum * 0x10204081 + *p++; | |
720 | ||
721 | response->encrypted.checksum = htonl(csum); | |
722 | } | |
723 | ||
17926a79 DH |
724 | /* |
725 | * encrypt the response packet | |
726 | */ | |
727 | static void rxkad_encrypt_response(struct rxrpc_connection *conn, | |
728 | struct rxkad_response *resp, | |
729 | const struct rxkad_key *s2) | |
730 | { | |
1afe593b | 731 | SKCIPHER_REQUEST_ON_STACK(req, conn->cipher); |
17926a79 | 732 | struct rxrpc_crypt iv; |
a263629d | 733 | struct scatterlist sg[1]; |
17926a79 DH |
734 | |
735 | /* continue encrypting from where we left off */ | |
736 | memcpy(&iv, s2->session_key, sizeof(iv)); | |
17926a79 | 737 | |
a263629d HX |
738 | sg_init_table(sg, 1); |
739 | sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted)); | |
1afe593b HX |
740 | skcipher_request_set_tfm(req, conn->cipher); |
741 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
742 | skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x); | |
1afe593b HX |
743 | crypto_skcipher_encrypt(req); |
744 | skcipher_request_zero(req); | |
17926a79 DH |
745 | } |
746 | ||
747 | /* | |
748 | * respond to a challenge packet | |
749 | */ | |
750 | static int rxkad_respond_to_challenge(struct rxrpc_connection *conn, | |
751 | struct sk_buff *skb, | |
752 | u32 *_abort_code) | |
753 | { | |
33941284 | 754 | const struct rxrpc_key_token *token; |
17926a79 DH |
755 | struct rxkad_challenge challenge; |
756 | struct rxkad_response resp | |
757 | __attribute__((aligned(8))); /* must be aligned for crypto */ | |
248f219c | 758 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
17926a79 DH |
759 | u32 version, nonce, min_level, abort_code; |
760 | int ret; | |
761 | ||
19ffa01c | 762 | _enter("{%d,%x}", conn->debug_id, key_serial(conn->params.key)); |
17926a79 | 763 | |
19ffa01c | 764 | if (!conn->params.key) { |
17926a79 DH |
765 | _leave(" = -EPROTO [no key]"); |
766 | return -EPROTO; | |
767 | } | |
768 | ||
19ffa01c | 769 | ret = key_validate(conn->params.key); |
17926a79 DH |
770 | if (ret < 0) { |
771 | *_abort_code = RXKADEXPIRED; | |
772 | return ret; | |
773 | } | |
774 | ||
775 | abort_code = RXKADPACKETSHORT; | |
248f219c | 776 | if (skb_copy_bits(skb, sp->offset, &challenge, sizeof(challenge)) < 0) |
17926a79 DH |
777 | goto protocol_error; |
778 | ||
779 | version = ntohl(challenge.version); | |
780 | nonce = ntohl(challenge.nonce); | |
781 | min_level = ntohl(challenge.min_level); | |
782 | ||
783 | _proto("Rx CHALLENGE %%%u { v=%u n=%u ml=%u }", | |
0d12f8a4 | 784 | sp->hdr.serial, version, nonce, min_level); |
17926a79 DH |
785 | |
786 | abort_code = RXKADINCONSISTENCY; | |
787 | if (version != RXKAD_VERSION) | |
788 | goto protocol_error; | |
789 | ||
790 | abort_code = RXKADLEVELFAIL; | |
19ffa01c | 791 | if (conn->params.security_level < min_level) |
17926a79 DH |
792 | goto protocol_error; |
793 | ||
19ffa01c | 794 | token = conn->params.key->payload.data[0]; |
17926a79 DH |
795 | |
796 | /* build the response packet */ | |
797 | memset(&resp, 0, sizeof(resp)); | |
798 | ||
098a2099 | 799 | resp.version = htonl(RXKAD_VERSION); |
19ffa01c DH |
800 | resp.encrypted.epoch = htonl(conn->proto.epoch); |
801 | resp.encrypted.cid = htonl(conn->proto.cid); | |
098a2099 DH |
802 | resp.encrypted.securityIndex = htonl(conn->security_ix); |
803 | resp.encrypted.inc_nonce = htonl(nonce + 1); | |
19ffa01c | 804 | resp.encrypted.level = htonl(conn->params.security_level); |
098a2099 DH |
805 | resp.kvno = htonl(token->kad->kvno); |
806 | resp.ticket_len = htonl(token->kad->ticket_len); | |
807 | ||
a1399f8b DH |
808 | resp.encrypted.call_id[0] = htonl(conn->channels[0].call_counter); |
809 | resp.encrypted.call_id[1] = htonl(conn->channels[1].call_counter); | |
810 | resp.encrypted.call_id[2] = htonl(conn->channels[2].call_counter); | |
811 | resp.encrypted.call_id[3] = htonl(conn->channels[3].call_counter); | |
17926a79 DH |
812 | |
813 | /* calculate the response checksum and then do the encryption */ | |
814 | rxkad_calc_response_checksum(&resp); | |
33941284 DH |
815 | rxkad_encrypt_response(conn, &resp, token->kad); |
816 | return rxkad_send_response(conn, &sp->hdr, &resp, token->kad); | |
17926a79 DH |
817 | |
818 | protocol_error: | |
819 | *_abort_code = abort_code; | |
820 | _leave(" = -EPROTO [%d]", abort_code); | |
821 | return -EPROTO; | |
822 | } | |
823 | ||
824 | /* | |
825 | * decrypt the kerberos IV ticket in the response | |
826 | */ | |
827 | static int rxkad_decrypt_ticket(struct rxrpc_connection *conn, | |
828 | void *ticket, size_t ticket_len, | |
829 | struct rxrpc_crypt *_session_key, | |
830 | time_t *_expiry, | |
831 | u32 *_abort_code) | |
832 | { | |
1afe593b | 833 | struct skcipher_request *req; |
17926a79 | 834 | struct rxrpc_crypt iv, key; |
68e3f5dd | 835 | struct scatterlist sg[1]; |
17926a79 | 836 | struct in_addr addr; |
95c96174 | 837 | unsigned int life; |
17926a79 DH |
838 | time_t issue, now; |
839 | bool little_endian; | |
840 | int ret; | |
841 | u8 *p, *q, *name, *end; | |
842 | ||
843 | _enter("{%d},{%x}", conn->debug_id, key_serial(conn->server_key)); | |
844 | ||
845 | *_expiry = 0; | |
846 | ||
847 | ret = key_validate(conn->server_key); | |
848 | if (ret < 0) { | |
849 | switch (ret) { | |
850 | case -EKEYEXPIRED: | |
851 | *_abort_code = RXKADEXPIRED; | |
852 | goto error; | |
853 | default: | |
854 | *_abort_code = RXKADNOAUTH; | |
855 | goto error; | |
856 | } | |
857 | } | |
858 | ||
146aa8b1 | 859 | ASSERT(conn->server_key->payload.data[0] != NULL); |
17926a79 DH |
860 | ASSERTCMP((unsigned long) ticket & 7UL, ==, 0); |
861 | ||
146aa8b1 | 862 | memcpy(&iv, &conn->server_key->payload.data[2], sizeof(iv)); |
17926a79 | 863 | |
1afe593b HX |
864 | req = skcipher_request_alloc(conn->server_key->payload.data[0], |
865 | GFP_NOFS); | |
866 | if (!req) { | |
867 | *_abort_code = RXKADNOAUTH; | |
868 | ret = -ENOMEM; | |
869 | goto error; | |
870 | } | |
17926a79 | 871 | |
68e3f5dd | 872 | sg_init_one(&sg[0], ticket, ticket_len); |
1afe593b HX |
873 | skcipher_request_set_callback(req, 0, NULL, NULL); |
874 | skcipher_request_set_crypt(req, sg, sg, ticket_len, iv.x); | |
1afe593b HX |
875 | crypto_skcipher_decrypt(req); |
876 | skcipher_request_free(req); | |
17926a79 DH |
877 | |
878 | p = ticket; | |
879 | end = p + ticket_len; | |
880 | ||
881 | #define Z(size) \ | |
882 | ({ \ | |
883 | u8 *__str = p; \ | |
884 | q = memchr(p, 0, end - p); \ | |
885 | if (!q || q - p > (size)) \ | |
886 | goto bad_ticket; \ | |
887 | for (; p < q; p++) \ | |
888 | if (!isprint(*p)) \ | |
889 | goto bad_ticket; \ | |
890 | p++; \ | |
891 | __str; \ | |
892 | }) | |
893 | ||
894 | /* extract the ticket flags */ | |
895 | _debug("KIV FLAGS: %x", *p); | |
896 | little_endian = *p & 1; | |
897 | p++; | |
898 | ||
899 | /* extract the authentication name */ | |
900 | name = Z(ANAME_SZ); | |
901 | _debug("KIV ANAME: %s", name); | |
902 | ||
903 | /* extract the principal's instance */ | |
904 | name = Z(INST_SZ); | |
905 | _debug("KIV INST : %s", name); | |
906 | ||
907 | /* extract the principal's authentication domain */ | |
908 | name = Z(REALM_SZ); | |
909 | _debug("KIV REALM: %s", name); | |
910 | ||
911 | if (end - p < 4 + 8 + 4 + 2) | |
912 | goto bad_ticket; | |
913 | ||
914 | /* get the IPv4 address of the entity that requested the ticket */ | |
915 | memcpy(&addr, p, sizeof(addr)); | |
916 | p += 4; | |
21454aaa | 917 | _debug("KIV ADDR : %pI4", &addr); |
17926a79 DH |
918 | |
919 | /* get the session key from the ticket */ | |
920 | memcpy(&key, p, sizeof(key)); | |
921 | p += 8; | |
922 | _debug("KIV KEY : %08x %08x", ntohl(key.n[0]), ntohl(key.n[1])); | |
923 | memcpy(_session_key, &key, sizeof(key)); | |
924 | ||
925 | /* get the ticket's lifetime */ | |
926 | life = *p++ * 5 * 60; | |
927 | _debug("KIV LIFE : %u", life); | |
928 | ||
929 | /* get the issue time of the ticket */ | |
930 | if (little_endian) { | |
931 | __le32 stamp; | |
932 | memcpy(&stamp, p, 4); | |
933 | issue = le32_to_cpu(stamp); | |
934 | } else { | |
935 | __be32 stamp; | |
936 | memcpy(&stamp, p, 4); | |
937 | issue = be32_to_cpu(stamp); | |
938 | } | |
939 | p += 4; | |
2c6b47de | 940 | now = get_seconds(); |
17926a79 DH |
941 | _debug("KIV ISSUE: %lx [%lx]", issue, now); |
942 | ||
943 | /* check the ticket is in date */ | |
944 | if (issue > now) { | |
945 | *_abort_code = RXKADNOAUTH; | |
946 | ret = -EKEYREJECTED; | |
947 | goto error; | |
948 | } | |
949 | ||
950 | if (issue < now - life) { | |
951 | *_abort_code = RXKADEXPIRED; | |
952 | ret = -EKEYEXPIRED; | |
953 | goto error; | |
954 | } | |
955 | ||
956 | *_expiry = issue + life; | |
957 | ||
958 | /* get the service name */ | |
959 | name = Z(SNAME_SZ); | |
960 | _debug("KIV SNAME: %s", name); | |
961 | ||
962 | /* get the service instance name */ | |
963 | name = Z(INST_SZ); | |
964 | _debug("KIV SINST: %s", name); | |
965 | ||
966 | ret = 0; | |
967 | error: | |
968 | _leave(" = %d", ret); | |
969 | return ret; | |
970 | ||
971 | bad_ticket: | |
972 | *_abort_code = RXKADBADTICKET; | |
973 | ret = -EBADMSG; | |
974 | goto error; | |
975 | } | |
976 | ||
977 | /* | |
978 | * decrypt the response packet | |
979 | */ | |
980 | static void rxkad_decrypt_response(struct rxrpc_connection *conn, | |
981 | struct rxkad_response *resp, | |
982 | const struct rxrpc_crypt *session_key) | |
983 | { | |
1afe593b | 984 | SKCIPHER_REQUEST_ON_STACK(req, rxkad_ci); |
a263629d | 985 | struct scatterlist sg[1]; |
17926a79 DH |
986 | struct rxrpc_crypt iv; |
987 | ||
988 | _enter(",,%08x%08x", | |
989 | ntohl(session_key->n[0]), ntohl(session_key->n[1])); | |
990 | ||
991 | ASSERT(rxkad_ci != NULL); | |
992 | ||
993 | mutex_lock(&rxkad_ci_mutex); | |
1afe593b HX |
994 | if (crypto_skcipher_setkey(rxkad_ci, session_key->x, |
995 | sizeof(*session_key)) < 0) | |
17926a79 DH |
996 | BUG(); |
997 | ||
998 | memcpy(&iv, session_key, sizeof(iv)); | |
17926a79 | 999 | |
a263629d HX |
1000 | sg_init_table(sg, 1); |
1001 | sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted)); | |
1afe593b HX |
1002 | skcipher_request_set_tfm(req, rxkad_ci); |
1003 | skcipher_request_set_callback(req, 0, NULL, NULL); | |
1004 | skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x); | |
1afe593b HX |
1005 | crypto_skcipher_decrypt(req); |
1006 | skcipher_request_zero(req); | |
1007 | ||
17926a79 DH |
1008 | mutex_unlock(&rxkad_ci_mutex); |
1009 | ||
1010 | _leave(""); | |
1011 | } | |
1012 | ||
1013 | /* | |
1014 | * verify a response | |
1015 | */ | |
1016 | static int rxkad_verify_response(struct rxrpc_connection *conn, | |
1017 | struct sk_buff *skb, | |
1018 | u32 *_abort_code) | |
1019 | { | |
1020 | struct rxkad_response response | |
1021 | __attribute__((aligned(8))); /* must be aligned for crypto */ | |
248f219c | 1022 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
17926a79 DH |
1023 | struct rxrpc_crypt session_key; |
1024 | time_t expiry; | |
1025 | void *ticket; | |
91e916cf AV |
1026 | u32 abort_code, version, kvno, ticket_len, level; |
1027 | __be32 csum; | |
a1399f8b | 1028 | int ret, i; |
17926a79 DH |
1029 | |
1030 | _enter("{%d,%x}", conn->debug_id, key_serial(conn->server_key)); | |
1031 | ||
1032 | abort_code = RXKADPACKETSHORT; | |
248f219c | 1033 | if (skb_copy_bits(skb, sp->offset, &response, sizeof(response)) < 0) |
17926a79 DH |
1034 | goto protocol_error; |
1035 | if (!pskb_pull(skb, sizeof(response))) | |
1036 | BUG(); | |
1037 | ||
1038 | version = ntohl(response.version); | |
1039 | ticket_len = ntohl(response.ticket_len); | |
1040 | kvno = ntohl(response.kvno); | |
17926a79 | 1041 | _proto("Rx RESPONSE %%%u { v=%u kv=%u tl=%u }", |
0d12f8a4 | 1042 | sp->hdr.serial, version, kvno, ticket_len); |
17926a79 DH |
1043 | |
1044 | abort_code = RXKADINCONSISTENCY; | |
1045 | if (version != RXKAD_VERSION) | |
4aa9cb32 | 1046 | goto protocol_error; |
17926a79 DH |
1047 | |
1048 | abort_code = RXKADTICKETLEN; | |
1049 | if (ticket_len < 4 || ticket_len > MAXKRB5TICKETLEN) | |
1050 | goto protocol_error; | |
1051 | ||
1052 | abort_code = RXKADUNKNOWNKEY; | |
1053 | if (kvno >= RXKAD_TKT_TYPE_KERBEROS_V5) | |
1054 | goto protocol_error; | |
1055 | ||
1056 | /* extract the kerberos ticket and decrypt and decode it */ | |
1057 | ticket = kmalloc(ticket_len, GFP_NOFS); | |
1058 | if (!ticket) | |
1059 | return -ENOMEM; | |
1060 | ||
1061 | abort_code = RXKADPACKETSHORT; | |
248f219c | 1062 | if (skb_copy_bits(skb, sp->offset, ticket, ticket_len) < 0) |
17926a79 DH |
1063 | goto protocol_error_free; |
1064 | ||
1065 | ret = rxkad_decrypt_ticket(conn, ticket, ticket_len, &session_key, | |
1066 | &expiry, &abort_code); | |
1067 | if (ret < 0) { | |
1068 | *_abort_code = abort_code; | |
1069 | kfree(ticket); | |
1070 | return ret; | |
1071 | } | |
1072 | ||
1073 | /* use the session key from inside the ticket to decrypt the | |
1074 | * response */ | |
1075 | rxkad_decrypt_response(conn, &response, &session_key); | |
1076 | ||
1077 | abort_code = RXKADSEALEDINCON; | |
19ffa01c | 1078 | if (ntohl(response.encrypted.epoch) != conn->proto.epoch) |
17926a79 | 1079 | goto protocol_error_free; |
19ffa01c | 1080 | if (ntohl(response.encrypted.cid) != conn->proto.cid) |
17926a79 DH |
1081 | goto protocol_error_free; |
1082 | if (ntohl(response.encrypted.securityIndex) != conn->security_ix) | |
1083 | goto protocol_error_free; | |
1084 | csum = response.encrypted.checksum; | |
1085 | response.encrypted.checksum = 0; | |
1086 | rxkad_calc_response_checksum(&response); | |
1087 | if (response.encrypted.checksum != csum) | |
1088 | goto protocol_error_free; | |
1089 | ||
a1399f8b DH |
1090 | spin_lock(&conn->channel_lock); |
1091 | for (i = 0; i < RXRPC_MAXCALLS; i++) { | |
1092 | struct rxrpc_call *call; | |
1093 | u32 call_id = ntohl(response.encrypted.call_id[i]); | |
1094 | ||
1095 | if (call_id > INT_MAX) | |
1096 | goto protocol_error_unlock; | |
1097 | ||
1098 | if (call_id < conn->channels[i].call_counter) | |
1099 | goto protocol_error_unlock; | |
1100 | if (call_id > conn->channels[i].call_counter) { | |
1101 | call = rcu_dereference_protected( | |
1102 | conn->channels[i].call, | |
1103 | lockdep_is_held(&conn->channel_lock)); | |
1104 | if (call && call->state < RXRPC_CALL_COMPLETE) | |
1105 | goto protocol_error_unlock; | |
1106 | conn->channels[i].call_counter = call_id; | |
1107 | } | |
1108 | } | |
1109 | spin_unlock(&conn->channel_lock); | |
17926a79 DH |
1110 | |
1111 | abort_code = RXKADOUTOFSEQUENCE; | |
0d12f8a4 | 1112 | if (ntohl(response.encrypted.inc_nonce) != conn->security_nonce + 1) |
17926a79 DH |
1113 | goto protocol_error_free; |
1114 | ||
1115 | abort_code = RXKADLEVELFAIL; | |
1116 | level = ntohl(response.encrypted.level); | |
1117 | if (level > RXRPC_SECURITY_ENCRYPT) | |
1118 | goto protocol_error_free; | |
19ffa01c | 1119 | conn->params.security_level = level; |
17926a79 DH |
1120 | |
1121 | /* create a key to hold the security data and expiration time - after | |
1122 | * this the connection security can be handled in exactly the same way | |
1123 | * as for a client connection */ | |
1124 | ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno); | |
1125 | if (ret < 0) { | |
1126 | kfree(ticket); | |
1127 | return ret; | |
1128 | } | |
1129 | ||
1130 | kfree(ticket); | |
1131 | _leave(" = 0"); | |
1132 | return 0; | |
1133 | ||
a1399f8b DH |
1134 | protocol_error_unlock: |
1135 | spin_unlock(&conn->channel_lock); | |
17926a79 DH |
1136 | protocol_error_free: |
1137 | kfree(ticket); | |
1138 | protocol_error: | |
1139 | *_abort_code = abort_code; | |
1140 | _leave(" = -EPROTO [%d]", abort_code); | |
1141 | return -EPROTO; | |
1142 | } | |
1143 | ||
1144 | /* | |
1145 | * clear the connection security | |
1146 | */ | |
1147 | static void rxkad_clear(struct rxrpc_connection *conn) | |
1148 | { | |
1149 | _enter(""); | |
1150 | ||
1151 | if (conn->cipher) | |
1afe593b | 1152 | crypto_free_skcipher(conn->cipher); |
17926a79 DH |
1153 | } |
1154 | ||
648af7fc DH |
1155 | /* |
1156 | * Initialise the rxkad security service. | |
1157 | */ | |
1158 | static int rxkad_init(void) | |
1159 | { | |
1160 | /* pin the cipher we need so that the crypto layer doesn't invoke | |
1161 | * keventd to go get it */ | |
1162 | rxkad_ci = crypto_alloc_skcipher("pcbc(fcrypt)", 0, CRYPTO_ALG_ASYNC); | |
fa54cc70 | 1163 | return PTR_ERR_OR_ZERO(rxkad_ci); |
648af7fc DH |
1164 | } |
1165 | ||
1166 | /* | |
1167 | * Clean up the rxkad security service. | |
1168 | */ | |
1169 | static void rxkad_exit(void) | |
1170 | { | |
1171 | if (rxkad_ci) | |
1172 | crypto_free_skcipher(rxkad_ci); | |
1173 | } | |
1174 | ||
17926a79 DH |
1175 | /* |
1176 | * RxRPC Kerberos-based security | |
1177 | */ | |
648af7fc | 1178 | const struct rxrpc_security rxkad = { |
17926a79 | 1179 | .name = "rxkad", |
8b815477 | 1180 | .security_index = RXRPC_SECURITY_RXKAD, |
648af7fc DH |
1181 | .init = rxkad_init, |
1182 | .exit = rxkad_exit, | |
17926a79 DH |
1183 | .init_connection_security = rxkad_init_connection_security, |
1184 | .prime_packet_security = rxkad_prime_packet_security, | |
1185 | .secure_packet = rxkad_secure_packet, | |
1186 | .verify_packet = rxkad_verify_packet, | |
248f219c | 1187 | .locate_data = rxkad_locate_data, |
17926a79 DH |
1188 | .issue_challenge = rxkad_issue_challenge, |
1189 | .respond_to_challenge = rxkad_respond_to_challenge, | |
1190 | .verify_response = rxkad_verify_response, | |
1191 | .clear = rxkad_clear, | |
1192 | }; |