1 /* Kerberos-based RxRPC security
2 *
3 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13
14 #include <crypto/skcipher.h>
15 #include <linux/module.h>
16 #include <linux/net.h>
17 #include <linux/skbuff.h>
18 #include <linux/udp.h>
19 #include <linux/scatterlist.h>
20 #include <linux/ctype.h>
21 #include <linux/slab.h>
22 #include <net/sock.h>
23 #include <net/af_rxrpc.h>
24 #include <keys/rxrpc-type.h>
25 #include "ar-internal.h"
26
27 #define RXKAD_VERSION 2
28 #define MAXKRB5TICKETLEN 1024
29 #define RXKAD_TKT_TYPE_KERBEROS_V5 256
30 #define ANAME_SZ 40 /* size of authentication name */
31 #define INST_SZ 40 /* size of principal's instance */
32 #define REALM_SZ 40 /* size of principal's auth domain */
33 #define SNAME_SZ 40 /* size of service name */
34
35 struct rxkad_level1_hdr {
36 __be32 data_size; /* true data size (excluding padding) */
37 };
38
39 struct rxkad_level2_hdr {
40 __be32 data_size; /* true data size (excluding padding) */
41 __be32 checksum; /* decrypted data checksum */
42 };
43
44 /*
45 * this holds a pinned cipher so that keventd doesn't get called by the cipher
46 * alloc routine, but since we have it to hand, we use it to decrypt RESPONSE
47 * packets
48 */
49 static struct crypto_skcipher *rxkad_ci;
50 static DEFINE_MUTEX(rxkad_ci_mutex);
51
52 /*
53 * initialise connection security
54 */
rxkad_init_connection_security(struct rxrpc_connection * conn)55 static int rxkad_init_connection_security(struct rxrpc_connection *conn)
56 {
57 struct crypto_skcipher *ci;
58 struct rxrpc_key_token *token;
59 int ret;
60
61 _enter("{%d},{%x}", conn->debug_id, key_serial(conn->params.key));
62
63 token = conn->params.key->payload.data[0];
64 conn->security_ix = token->security_index;
65
66 ci = crypto_alloc_skcipher("pcbc(fcrypt)", 0, CRYPTO_ALG_ASYNC);
67 if (IS_ERR(ci)) {
68 _debug("no cipher");
69 ret = PTR_ERR(ci);
70 goto error;
71 }
72
73 if (crypto_skcipher_setkey(ci, token->kad->session_key,
74 sizeof(token->kad->session_key)) < 0)
75 BUG();
76
77 switch (conn->params.security_level) {
78 case RXRPC_SECURITY_PLAIN:
79 break;
80 case RXRPC_SECURITY_AUTH:
81 conn->size_align = 8;
82 conn->security_size = sizeof(struct rxkad_level1_hdr);
83 break;
84 case RXRPC_SECURITY_ENCRYPT:
85 conn->size_align = 8;
86 conn->security_size = sizeof(struct rxkad_level2_hdr);
87 break;
88 default:
89 ret = -EKEYREJECTED;
90 goto error;
91 }
92
93 conn->cipher = ci;
94 ret = 0;
95 error:
96 _leave(" = %d", ret);
97 return ret;
98 }
99
100 /*
101 * prime the encryption state with the invariant parts of a connection's
102 * description
103 */
rxkad_prime_packet_security(struct rxrpc_connection * conn)104 static int rxkad_prime_packet_security(struct rxrpc_connection *conn)
105 {
106 struct rxrpc_key_token *token;
107 SKCIPHER_REQUEST_ON_STACK(req, conn->cipher);
108 struct scatterlist sg;
109 struct rxrpc_crypt iv;
110 __be32 *tmpbuf;
111 size_t tmpsize = 4 * sizeof(__be32);
112
113 _enter("");
114
115 if (!conn->params.key)
116 return 0;
117
118 tmpbuf = kmalloc(tmpsize, GFP_KERNEL);
119 if (!tmpbuf)
120 return -ENOMEM;
121
122 token = conn->params.key->payload.data[0];
123 memcpy(&iv, token->kad->session_key, sizeof(iv));
124
125 tmpbuf[0] = htonl(conn->proto.epoch);
126 tmpbuf[1] = htonl(conn->proto.cid);
127 tmpbuf[2] = 0;
128 tmpbuf[3] = htonl(conn->security_ix);
129
130 sg_init_one(&sg, tmpbuf, tmpsize);
131 skcipher_request_set_tfm(req, conn->cipher);
132 skcipher_request_set_callback(req, 0, NULL, NULL);
133 skcipher_request_set_crypt(req, &sg, &sg, tmpsize, iv.x);
134 crypto_skcipher_encrypt(req);
135 skcipher_request_zero(req);
136
137 memcpy(&conn->csum_iv, tmpbuf + 2, sizeof(conn->csum_iv));
138 kfree(tmpbuf);
139 _leave(" = 0");
140 return 0;
141 }
142
143 /*
144 * partially encrypt a packet (level 1 security)
145 */
rxkad_secure_packet_auth(const struct rxrpc_call * call,struct sk_buff * skb,u32 data_size,void * sechdr)146 static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
147 struct sk_buff *skb,
148 u32 data_size,
149 void *sechdr)
150 {
151 struct rxrpc_skb_priv *sp;
152 SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
153 struct rxkad_level1_hdr hdr;
154 struct rxrpc_crypt iv;
155 struct scatterlist sg;
156 u16 check;
157
158 sp = rxrpc_skb(skb);
159
160 _enter("");
161
162 check = sp->hdr.seq ^ call->call_id;
163 data_size |= (u32)check << 16;
164
165 hdr.data_size = htonl(data_size);
166 memcpy(sechdr, &hdr, sizeof(hdr));
167
168 /* start the encryption afresh */
169 memset(&iv, 0, sizeof(iv));
170
171 sg_init_one(&sg, sechdr, 8);
172 skcipher_request_set_tfm(req, call->conn->cipher);
173 skcipher_request_set_callback(req, 0, NULL, NULL);
174 skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
175 crypto_skcipher_encrypt(req);
176 skcipher_request_zero(req);
177
178 _leave(" = 0");
179 return 0;
180 }
181
182 /*
183 * wholly encrypt a packet (level 2 security)
184 */
rxkad_secure_packet_encrypt(const struct rxrpc_call * call,struct sk_buff * skb,u32 data_size,void * sechdr)185 static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
186 struct sk_buff *skb,
187 u32 data_size,
188 void *sechdr)
189 {
190 const struct rxrpc_key_token *token;
191 struct rxkad_level2_hdr rxkhdr;
192 struct rxrpc_skb_priv *sp;
193 SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
194 struct rxrpc_crypt iv;
195 struct scatterlist sg[16];
196 struct sk_buff *trailer;
197 unsigned int len;
198 u16 check;
199 int nsg;
200 int err;
201
202 sp = rxrpc_skb(skb);
203
204 _enter("");
205
206 check = sp->hdr.seq ^ call->call_id;
207
208 rxkhdr.data_size = htonl(data_size | (u32)check << 16);
209 rxkhdr.checksum = 0;
210 memcpy(sechdr, &rxkhdr, sizeof(rxkhdr));
211
212 /* encrypt from the session key */
213 token = call->conn->params.key->payload.data[0];
214 memcpy(&iv, token->kad->session_key, sizeof(iv));
215
216 sg_init_one(&sg[0], sechdr, sizeof(rxkhdr));
217 skcipher_request_set_tfm(req, call->conn->cipher);
218 skcipher_request_set_callback(req, 0, NULL, NULL);
219 skcipher_request_set_crypt(req, &sg[0], &sg[0], sizeof(rxkhdr), iv.x);
220 crypto_skcipher_encrypt(req);
221
222 /* we want to encrypt the skbuff in-place */
223 nsg = skb_cow_data(skb, 0, &trailer);
224 err = -ENOMEM;
225 if (nsg < 0 || nsg > 16)
226 goto out;
227
228 len = data_size + call->conn->size_align - 1;
229 len &= ~(call->conn->size_align - 1);
230
231 sg_init_table(sg, nsg);
232 err = skb_to_sgvec(skb, sg, 0, len);
233 if (unlikely(err < 0))
234 goto out;
235 skcipher_request_set_crypt(req, sg, sg, len, iv.x);
236 crypto_skcipher_encrypt(req);
237
238 _leave(" = 0");
239 err = 0;
240
241 out:
242 skcipher_request_zero(req);
243 return err;
244 }
245
246 /*
247 * checksum an RxRPC packet header
248 */
rxkad_secure_packet(struct rxrpc_call * call,struct sk_buff * skb,size_t data_size,void * sechdr)249 static int rxkad_secure_packet(struct rxrpc_call *call,
250 struct sk_buff *skb,
251 size_t data_size,
252 void *sechdr)
253 {
254 struct rxrpc_skb_priv *sp;
255 SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
256 struct rxrpc_crypt iv;
257 struct scatterlist sg;
258 u32 x, y;
259 int ret;
260
261 sp = rxrpc_skb(skb);
262
263 _enter("{%d{%x}},{#%u},%zu,",
264 call->debug_id, key_serial(call->conn->params.key),
265 sp->hdr.seq, data_size);
266
267 if (!call->conn->cipher)
268 return 0;
269
270 ret = key_validate(call->conn->params.key);
271 if (ret < 0)
272 return ret;
273
274 /* continue encrypting from where we left off */
275 memcpy(&iv, call->conn->csum_iv.x, sizeof(iv));
276
277 /* calculate the security checksum */
278 x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
279 x |= sp->hdr.seq & 0x3fffffff;
280 call->crypto_buf[0] = htonl(call->call_id);
281 call->crypto_buf[1] = htonl(x);
282
283 sg_init_one(&sg, call->crypto_buf, 8);
284 skcipher_request_set_tfm(req, call->conn->cipher);
285 skcipher_request_set_callback(req, 0, NULL, NULL);
286 skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
287 crypto_skcipher_encrypt(req);
288 skcipher_request_zero(req);
289
290 y = ntohl(call->crypto_buf[1]);
291 y = (y >> 16) & 0xffff;
292 if (y == 0)
293 y = 1; /* zero checksums are not permitted */
294 sp->hdr.cksum = y;
295
296 switch (call->conn->params.security_level) {
297 case RXRPC_SECURITY_PLAIN:
298 ret = 0;
299 break;
300 case RXRPC_SECURITY_AUTH:
301 ret = rxkad_secure_packet_auth(call, skb, data_size, sechdr);
302 break;
303 case RXRPC_SECURITY_ENCRYPT:
304 ret = rxkad_secure_packet_encrypt(call, skb, data_size,
305 sechdr);
306 break;
307 default:
308 ret = -EPERM;
309 break;
310 }
311
312 _leave(" = %d [set %hx]", ret, y);
313 return ret;
314 }
315
316 /*
317 * decrypt partial encryption on a packet (level 1 security)
318 */
rxkad_verify_packet_1(struct rxrpc_call * call,struct sk_buff * skb,unsigned int offset,unsigned int len,rxrpc_seq_t seq)319 static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
320 unsigned int offset, unsigned int len,
321 rxrpc_seq_t seq)
322 {
323 struct rxkad_level1_hdr sechdr;
324 SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
325 struct rxrpc_crypt iv;
326 struct scatterlist sg[16];
327 struct sk_buff *trailer;
328 u32 data_size, buf;
329 u16 check;
330 int nsg, ret;
331
332 _enter("");
333
334 if (len < 8) {
335 rxrpc_abort_call("V1H", call, seq, RXKADSEALEDINCON, EPROTO);
336 goto protocol_error;
337 }
338
339 /* Decrypt the skbuff in-place. TODO: We really want to decrypt
340 * directly into the target buffer.
341 */
342 nsg = skb_cow_data(skb, 0, &trailer);
343 if (nsg < 0 || nsg > 16)
344 goto nomem;
345
346 sg_init_table(sg, nsg);
347 ret = skb_to_sgvec(skb, sg, offset, 8);
348 if (unlikely(ret < 0))
349 return ret;
350
351 /* start the decryption afresh */
352 memset(&iv, 0, sizeof(iv));
353
354 skcipher_request_set_tfm(req, call->conn->cipher);
355 skcipher_request_set_callback(req, 0, NULL, NULL);
356 skcipher_request_set_crypt(req, sg, sg, 8, iv.x);
357 crypto_skcipher_decrypt(req);
358 skcipher_request_zero(req);
359
360 /* Extract the decrypted packet length */
361 if (skb_copy_bits(skb, offset, &sechdr, sizeof(sechdr)) < 0) {
362 rxrpc_abort_call("XV1", call, seq, RXKADDATALEN, EPROTO);
363 goto protocol_error;
364 }
365 offset += sizeof(sechdr);
366 len -= sizeof(sechdr);
367
368 buf = ntohl(sechdr.data_size);
369 data_size = buf & 0xffff;
370
371 check = buf >> 16;
372 check ^= seq ^ call->call_id;
373 check &= 0xffff;
374 if (check != 0) {
375 rxrpc_abort_call("V1C", call, seq, RXKADSEALEDINCON, EPROTO);
376 goto protocol_error;
377 }
378
379 if (data_size > len) {
380 rxrpc_abort_call("V1L", call, seq, RXKADDATALEN, EPROTO);
381 goto protocol_error;
382 }
383
384 _leave(" = 0 [dlen=%x]", data_size);
385 return 0;
386
387 protocol_error:
388 rxrpc_send_abort_packet(call);
389 _leave(" = -EPROTO");
390 return -EPROTO;
391
392 nomem:
393 _leave(" = -ENOMEM");
394 return -ENOMEM;
395 }
396
397 /*
398 * wholly decrypt a packet (level 2 security)
399 */
rxkad_verify_packet_2(struct rxrpc_call * call,struct sk_buff * skb,unsigned int offset,unsigned int len,rxrpc_seq_t seq)400 static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
401 unsigned int offset, unsigned int len,
402 rxrpc_seq_t seq)
403 {
404 const struct rxrpc_key_token *token;
405 struct rxkad_level2_hdr sechdr;
406 SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
407 struct rxrpc_crypt iv;
408 struct scatterlist _sg[4], *sg;
409 struct sk_buff *trailer;
410 u32 data_size, buf;
411 u16 check;
412 int nsg, ret;
413
414 _enter(",{%d}", skb->len);
415
416 if (len < 8) {
417 rxrpc_abort_call("V2H", call, seq, RXKADSEALEDINCON, EPROTO);
418 goto protocol_error;
419 }
420
421 /* Decrypt the skbuff in-place. TODO: We really want to decrypt
422 * directly into the target buffer.
423 */
424 nsg = skb_cow_data(skb, 0, &trailer);
425 if (nsg < 0)
426 goto nomem;
427
428 sg = _sg;
429 if (unlikely(nsg > 4)) {
430 sg = kmalloc(sizeof(*sg) * nsg, GFP_NOIO);
431 if (!sg)
432 goto nomem;
433 }
434
435 sg_init_table(sg, nsg);
436 ret = skb_to_sgvec(skb, sg, offset, len);
437 if (unlikely(ret < 0)) {
438 if (sg != _sg)
439 kfree(sg);
440 return ret;
441 }
442
443 /* decrypt from the session key */
444 token = call->conn->params.key->payload.data[0];
445 memcpy(&iv, token->kad->session_key, sizeof(iv));
446
447 skcipher_request_set_tfm(req, call->conn->cipher);
448 skcipher_request_set_callback(req, 0, NULL, NULL);
449 skcipher_request_set_crypt(req, sg, sg, len, iv.x);
450 crypto_skcipher_decrypt(req);
451 skcipher_request_zero(req);
452 if (sg != _sg)
453 kfree(sg);
454
455 /* Extract the decrypted packet length */
456 if (skb_copy_bits(skb, offset, &sechdr, sizeof(sechdr)) < 0) {
457 rxrpc_abort_call("XV2", call, seq, RXKADDATALEN, EPROTO);
458 goto protocol_error;
459 }
460 offset += sizeof(sechdr);
461 len -= sizeof(sechdr);
462
463 buf = ntohl(sechdr.data_size);
464 data_size = buf & 0xffff;
465
466 check = buf >> 16;
467 check ^= seq ^ call->call_id;
468 check &= 0xffff;
469 if (check != 0) {
470 rxrpc_abort_call("V2C", call, seq, RXKADSEALEDINCON, EPROTO);
471 goto protocol_error;
472 }
473
474 if (data_size > len) {
475 rxrpc_abort_call("V2L", call, seq, RXKADDATALEN, EPROTO);
476 goto protocol_error;
477 }
478
479 _leave(" = 0 [dlen=%x]", data_size);
480 return 0;
481
482 protocol_error:
483 rxrpc_send_abort_packet(call);
484 _leave(" = -EPROTO");
485 return -EPROTO;
486
487 nomem:
488 _leave(" = -ENOMEM");
489 return -ENOMEM;
490 }
491
492 /*
493 * Verify the security on a received packet or subpacket (if part of a
494 * jumbo packet).
495 */
rxkad_verify_packet(struct rxrpc_call * call,struct sk_buff * skb,unsigned int offset,unsigned int len,rxrpc_seq_t seq,u16 expected_cksum)496 static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb,
497 unsigned int offset, unsigned int len,
498 rxrpc_seq_t seq, u16 expected_cksum)
499 {
500 SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
501 struct rxrpc_crypt iv;
502 struct scatterlist sg;
503 u16 cksum;
504 u32 x, y;
505
506 _enter("{%d{%x}},{#%u}",
507 call->debug_id, key_serial(call->conn->params.key), seq);
508
509 if (!call->conn->cipher)
510 return 0;
511
512 /* continue encrypting from where we left off */
513 memcpy(&iv, call->conn->csum_iv.x, sizeof(iv));
514
515 /* validate the security checksum */
516 x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
517 x |= seq & 0x3fffffff;
518 call->crypto_buf[0] = htonl(call->call_id);
519 call->crypto_buf[1] = htonl(x);
520
521 sg_init_one(&sg, call->crypto_buf, 8);
522 skcipher_request_set_tfm(req, call->conn->cipher);
523 skcipher_request_set_callback(req, 0, NULL, NULL);
524 skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
525 crypto_skcipher_encrypt(req);
526 skcipher_request_zero(req);
527
528 y = ntohl(call->crypto_buf[1]);
529 cksum = (y >> 16) & 0xffff;
530 if (cksum == 0)
531 cksum = 1; /* zero checksums are not permitted */
532
533 if (cksum != expected_cksum) {
534 rxrpc_abort_call("VCK", call, seq, RXKADSEALEDINCON, EPROTO);
535 rxrpc_send_abort_packet(call);
536 _leave(" = -EPROTO [csum failed]");
537 return -EPROTO;
538 }
539
540 switch (call->conn->params.security_level) {
541 case RXRPC_SECURITY_PLAIN:
542 return 0;
543 case RXRPC_SECURITY_AUTH:
544 return rxkad_verify_packet_1(call, skb, offset, len, seq);
545 case RXRPC_SECURITY_ENCRYPT:
546 return rxkad_verify_packet_2(call, skb, offset, len, seq);
547 default:
548 return -ENOANO;
549 }
550 }
551
552 /*
553 * Locate the data contained in a packet that was partially encrypted.
554 */
rxkad_locate_data_1(struct rxrpc_call * call,struct sk_buff * skb,unsigned int * _offset,unsigned int * _len)555 static void rxkad_locate_data_1(struct rxrpc_call *call, struct sk_buff *skb,
556 unsigned int *_offset, unsigned int *_len)
557 {
558 struct rxkad_level1_hdr sechdr;
559
560 if (skb_copy_bits(skb, *_offset, &sechdr, sizeof(sechdr)) < 0)
561 BUG();
562 *_offset += sizeof(sechdr);
563 *_len = ntohl(sechdr.data_size) & 0xffff;
564 }
565
566 /*
567 * Locate the data contained in a packet that was completely encrypted.
568 */
rxkad_locate_data_2(struct rxrpc_call * call,struct sk_buff * skb,unsigned int * _offset,unsigned int * _len)569 static void rxkad_locate_data_2(struct rxrpc_call *call, struct sk_buff *skb,
570 unsigned int *_offset, unsigned int *_len)
571 {
572 struct rxkad_level2_hdr sechdr;
573
574 if (skb_copy_bits(skb, *_offset, &sechdr, sizeof(sechdr)) < 0)
575 BUG();
576 *_offset += sizeof(sechdr);
577 *_len = ntohl(sechdr.data_size) & 0xffff;
578 }
579
580 /*
581 * Locate the data contained in an already decrypted packet.
582 */
rxkad_locate_data(struct rxrpc_call * call,struct sk_buff * skb,unsigned int * _offset,unsigned int * _len)583 static void rxkad_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
584 unsigned int *_offset, unsigned int *_len)
585 {
586 switch (call->conn->params.security_level) {
587 case RXRPC_SECURITY_AUTH:
588 rxkad_locate_data_1(call, skb, _offset, _len);
589 return;
590 case RXRPC_SECURITY_ENCRYPT:
591 rxkad_locate_data_2(call, skb, _offset, _len);
592 return;
593 default:
594 return;
595 }
596 }
597
598 /*
599 * issue a challenge
600 */
rxkad_issue_challenge(struct rxrpc_connection * conn)601 static int rxkad_issue_challenge(struct rxrpc_connection *conn)
602 {
603 struct rxkad_challenge challenge;
604 struct rxrpc_wire_header whdr;
605 struct msghdr msg;
606 struct kvec iov[2];
607 size_t len;
608 u32 serial;
609 int ret;
610
611 _enter("{%d,%x}", conn->debug_id, key_serial(conn->params.key));
612
613 ret = key_validate(conn->params.key);
614 if (ret < 0)
615 return ret;
616
617 get_random_bytes(&conn->security_nonce, sizeof(conn->security_nonce));
618
619 challenge.version = htonl(2);
620 challenge.nonce = htonl(conn->security_nonce);
621 challenge.min_level = htonl(0);
622 challenge.__padding = 0;
623
624 msg.msg_name = &conn->params.peer->srx.transport.sin;
625 msg.msg_namelen = sizeof(conn->params.peer->srx.transport.sin);
626 msg.msg_control = NULL;
627 msg.msg_controllen = 0;
628 msg.msg_flags = 0;
629
630 whdr.epoch = htonl(conn->proto.epoch);
631 whdr.cid = htonl(conn->proto.cid);
632 whdr.callNumber = 0;
633 whdr.seq = 0;
634 whdr.type = RXRPC_PACKET_TYPE_CHALLENGE;
635 whdr.flags = conn->out_clientflag;
636 whdr.userStatus = 0;
637 whdr.securityIndex = conn->security_ix;
638 whdr._rsvd = 0;
639 whdr.serviceId = htons(conn->params.service_id);
640
641 iov[0].iov_base = &whdr;
642 iov[0].iov_len = sizeof(whdr);
643 iov[1].iov_base = &challenge;
644 iov[1].iov_len = sizeof(challenge);
645
646 len = iov[0].iov_len + iov[1].iov_len;
647
648 serial = atomic_inc_return(&conn->serial);
649 whdr.serial = htonl(serial);
650 _proto("Tx CHALLENGE %%%u", serial);
651
652 ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len);
653 if (ret < 0) {
654 _debug("sendmsg failed: %d", ret);
655 return -EAGAIN;
656 }
657
658 _leave(" = 0");
659 return 0;
660 }
661
662 /*
663 * send a Kerberos security response
664 */
rxkad_send_response(struct rxrpc_connection * conn,struct rxrpc_host_header * hdr,struct rxkad_response * resp,const struct rxkad_key * s2)665 static int rxkad_send_response(struct rxrpc_connection *conn,
666 struct rxrpc_host_header *hdr,
667 struct rxkad_response *resp,
668 const struct rxkad_key *s2)
669 {
670 struct rxrpc_wire_header whdr;
671 struct msghdr msg;
672 struct kvec iov[3];
673 size_t len;
674 u32 serial;
675 int ret;
676
677 _enter("");
678
679 msg.msg_name = &conn->params.peer->srx.transport.sin;
680 msg.msg_namelen = sizeof(conn->params.peer->srx.transport.sin);
681 msg.msg_control = NULL;
682 msg.msg_controllen = 0;
683 msg.msg_flags = 0;
684
685 memset(&whdr, 0, sizeof(whdr));
686 whdr.epoch = htonl(hdr->epoch);
687 whdr.cid = htonl(hdr->cid);
688 whdr.type = RXRPC_PACKET_TYPE_RESPONSE;
689 whdr.flags = conn->out_clientflag;
690 whdr.securityIndex = hdr->securityIndex;
691 whdr.serviceId = htons(hdr->serviceId);
692
693 iov[0].iov_base = &whdr;
694 iov[0].iov_len = sizeof(whdr);
695 iov[1].iov_base = resp;
696 iov[1].iov_len = sizeof(*resp);
697 iov[2].iov_base = (void *)s2->ticket;
698 iov[2].iov_len = s2->ticket_len;
699
700 len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
701
702 serial = atomic_inc_return(&conn->serial);
703 whdr.serial = htonl(serial);
704 _proto("Tx RESPONSE %%%u", serial);
705
706 ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 3, len);
707 if (ret < 0) {
708 _debug("sendmsg failed: %d", ret);
709 return -EAGAIN;
710 }
711
712 _leave(" = 0");
713 return 0;
714 }
715
716 /*
717 * calculate the response checksum
718 */
rxkad_calc_response_checksum(struct rxkad_response * response)719 static void rxkad_calc_response_checksum(struct rxkad_response *response)
720 {
721 u32 csum = 1000003;
722 int loop;
723 u8 *p = (u8 *) response;
724
725 for (loop = sizeof(*response); loop > 0; loop--)
726 csum = csum * 0x10204081 + *p++;
727
728 response->encrypted.checksum = htonl(csum);
729 }
730
731 /*
732 * encrypt the response packet
733 */
rxkad_encrypt_response(struct rxrpc_connection * conn,struct rxkad_response * resp,const struct rxkad_key * s2)734 static void rxkad_encrypt_response(struct rxrpc_connection *conn,
735 struct rxkad_response *resp,
736 const struct rxkad_key *s2)
737 {
738 SKCIPHER_REQUEST_ON_STACK(req, conn->cipher);
739 struct rxrpc_crypt iv;
740 struct scatterlist sg[1];
741
742 /* continue encrypting from where we left off */
743 memcpy(&iv, s2->session_key, sizeof(iv));
744
745 sg_init_table(sg, 1);
746 sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted));
747 skcipher_request_set_tfm(req, conn->cipher);
748 skcipher_request_set_callback(req, 0, NULL, NULL);
749 skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x);
750 crypto_skcipher_encrypt(req);
751 skcipher_request_zero(req);
752 }
753
754 /*
755 * respond to a challenge packet
756 */
rxkad_respond_to_challenge(struct rxrpc_connection * conn,struct sk_buff * skb,u32 * _abort_code)757 static int rxkad_respond_to_challenge(struct rxrpc_connection *conn,
758 struct sk_buff *skb,
759 u32 *_abort_code)
760 {
761 const struct rxrpc_key_token *token;
762 struct rxkad_challenge challenge;
763 struct rxkad_response resp
764 __attribute__((aligned(8))); /* must be aligned for crypto */
765 struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
766 u32 version, nonce, min_level, abort_code;
767 int ret;
768
769 _enter("{%d,%x}", conn->debug_id, key_serial(conn->params.key));
770
771 if (!conn->params.key) {
772 _leave(" = -EPROTO [no key]");
773 return -EPROTO;
774 }
775
776 ret = key_validate(conn->params.key);
777 if (ret < 0) {
778 *_abort_code = RXKADEXPIRED;
779 return ret;
780 }
781
782 abort_code = RXKADPACKETSHORT;
783 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
784 &challenge, sizeof(challenge)) < 0)
785 goto protocol_error;
786
787 version = ntohl(challenge.version);
788 nonce = ntohl(challenge.nonce);
789 min_level = ntohl(challenge.min_level);
790
791 _proto("Rx CHALLENGE %%%u { v=%u n=%u ml=%u }",
792 sp->hdr.serial, version, nonce, min_level);
793
794 abort_code = RXKADINCONSISTENCY;
795 if (version != RXKAD_VERSION)
796 goto protocol_error;
797
798 abort_code = RXKADLEVELFAIL;
799 if (conn->params.security_level < min_level)
800 goto protocol_error;
801
802 token = conn->params.key->payload.data[0];
803
804 /* build the response packet */
805 memset(&resp, 0, sizeof(resp));
806
807 resp.version = htonl(RXKAD_VERSION);
808 resp.encrypted.epoch = htonl(conn->proto.epoch);
809 resp.encrypted.cid = htonl(conn->proto.cid);
810 resp.encrypted.securityIndex = htonl(conn->security_ix);
811 resp.encrypted.inc_nonce = htonl(nonce + 1);
812 resp.encrypted.level = htonl(conn->params.security_level);
813 resp.kvno = htonl(token->kad->kvno);
814 resp.ticket_len = htonl(token->kad->ticket_len);
815
816 resp.encrypted.call_id[0] = htonl(conn->channels[0].call_counter);
817 resp.encrypted.call_id[1] = htonl(conn->channels[1].call_counter);
818 resp.encrypted.call_id[2] = htonl(conn->channels[2].call_counter);
819 resp.encrypted.call_id[3] = htonl(conn->channels[3].call_counter);
820
821 /* calculate the response checksum and then do the encryption */
822 rxkad_calc_response_checksum(&resp);
823 rxkad_encrypt_response(conn, &resp, token->kad);
824 return rxkad_send_response(conn, &sp->hdr, &resp, token->kad);
825
826 protocol_error:
827 *_abort_code = abort_code;
828 _leave(" = -EPROTO [%d]", abort_code);
829 return -EPROTO;
830 }
831
832 /*
833 * decrypt the kerberos IV ticket in the response
834 */
rxkad_decrypt_ticket(struct rxrpc_connection * conn,void * ticket,size_t ticket_len,struct rxrpc_crypt * _session_key,time_t * _expiry,u32 * _abort_code)835 static int rxkad_decrypt_ticket(struct rxrpc_connection *conn,
836 void *ticket, size_t ticket_len,
837 struct rxrpc_crypt *_session_key,
838 time_t *_expiry,
839 u32 *_abort_code)
840 {
841 struct skcipher_request *req;
842 struct rxrpc_crypt iv, key;
843 struct scatterlist sg[1];
844 struct in_addr addr;
845 unsigned int life;
846 time_t issue, now;
847 bool little_endian;
848 int ret;
849 u8 *p, *q, *name, *end;
850
851 _enter("{%d},{%x}", conn->debug_id, key_serial(conn->server_key));
852
853 *_expiry = 0;
854
855 ret = key_validate(conn->server_key);
856 if (ret < 0) {
857 switch (ret) {
858 case -EKEYEXPIRED:
859 *_abort_code = RXKADEXPIRED;
860 goto error;
861 default:
862 *_abort_code = RXKADNOAUTH;
863 goto error;
864 }
865 }
866
867 ASSERT(conn->server_key->payload.data[0] != NULL);
868 ASSERTCMP((unsigned long) ticket & 7UL, ==, 0);
869
870 memcpy(&iv, &conn->server_key->payload.data[2], sizeof(iv));
871
872 req = skcipher_request_alloc(conn->server_key->payload.data[0],
873 GFP_NOFS);
874 if (!req) {
875 *_abort_code = RXKADNOAUTH;
876 ret = -ENOMEM;
877 goto error;
878 }
879
880 sg_init_one(&sg[0], ticket, ticket_len);
881 skcipher_request_set_callback(req, 0, NULL, NULL);
882 skcipher_request_set_crypt(req, sg, sg, ticket_len, iv.x);
883 crypto_skcipher_decrypt(req);
884 skcipher_request_free(req);
885
886 p = ticket;
887 end = p + ticket_len;
888
889 #define Z(size) \
890 ({ \
891 u8 *__str = p; \
892 q = memchr(p, 0, end - p); \
893 if (!q || q - p > (size)) \
894 goto bad_ticket; \
895 for (; p < q; p++) \
896 if (!isprint(*p)) \
897 goto bad_ticket; \
898 p++; \
899 __str; \
900 })
901
902 /* extract the ticket flags */
903 _debug("KIV FLAGS: %x", *p);
904 little_endian = *p & 1;
905 p++;
906
907 /* extract the authentication name */
908 name = Z(ANAME_SZ);
909 _debug("KIV ANAME: %s", name);
910
911 /* extract the principal's instance */
912 name = Z(INST_SZ);
913 _debug("KIV INST : %s", name);
914
915 /* extract the principal's authentication domain */
916 name = Z(REALM_SZ);
917 _debug("KIV REALM: %s", name);
918
919 if (end - p < 4 + 8 + 4 + 2)
920 goto bad_ticket;
921
922 /* get the IPv4 address of the entity that requested the ticket */
923 memcpy(&addr, p, sizeof(addr));
924 p += 4;
925 _debug("KIV ADDR : %pI4", &addr);
926
927 /* get the session key from the ticket */
928 memcpy(&key, p, sizeof(key));
929 p += 8;
930 _debug("KIV KEY : %08x %08x", ntohl(key.n[0]), ntohl(key.n[1]));
931 memcpy(_session_key, &key, sizeof(key));
932
933 /* get the ticket's lifetime */
934 life = *p++ * 5 * 60;
935 _debug("KIV LIFE : %u", life);
936
937 /* get the issue time of the ticket */
938 if (little_endian) {
939 __le32 stamp;
940 memcpy(&stamp, p, 4);
941 issue = le32_to_cpu(stamp);
942 } else {
943 __be32 stamp;
944 memcpy(&stamp, p, 4);
945 issue = be32_to_cpu(stamp);
946 }
947 p += 4;
948 now = get_seconds();
949 _debug("KIV ISSUE: %lx [%lx]", issue, now);
950
951 /* check the ticket is in date */
952 if (issue > now) {
953 *_abort_code = RXKADNOAUTH;
954 ret = -EKEYREJECTED;
955 goto error;
956 }
957
958 if (issue < now - life) {
959 *_abort_code = RXKADEXPIRED;
960 ret = -EKEYEXPIRED;
961 goto error;
962 }
963
964 *_expiry = issue + life;
965
966 /* get the service name */
967 name = Z(SNAME_SZ);
968 _debug("KIV SNAME: %s", name);
969
970 /* get the service instance name */
971 name = Z(INST_SZ);
972 _debug("KIV SINST: %s", name);
973
974 ret = 0;
975 error:
976 _leave(" = %d", ret);
977 return ret;
978
979 bad_ticket:
980 *_abort_code = RXKADBADTICKET;
981 ret = -EBADMSG;
982 goto error;
983 }
984
985 /*
986 * decrypt the response packet
987 */
rxkad_decrypt_response(struct rxrpc_connection * conn,struct rxkad_response * resp,const struct rxrpc_crypt * session_key)988 static void rxkad_decrypt_response(struct rxrpc_connection *conn,
989 struct rxkad_response *resp,
990 const struct rxrpc_crypt *session_key)
991 {
992 SKCIPHER_REQUEST_ON_STACK(req, rxkad_ci);
993 struct scatterlist sg[1];
994 struct rxrpc_crypt iv;
995
996 _enter(",,%08x%08x",
997 ntohl(session_key->n[0]), ntohl(session_key->n[1]));
998
999 ASSERT(rxkad_ci != NULL);
1000
1001 mutex_lock(&rxkad_ci_mutex);
1002 if (crypto_skcipher_setkey(rxkad_ci, session_key->x,
1003 sizeof(*session_key)) < 0)
1004 BUG();
1005
1006 memcpy(&iv, session_key, sizeof(iv));
1007
1008 sg_init_table(sg, 1);
1009 sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted));
1010 skcipher_request_set_tfm(req, rxkad_ci);
1011 skcipher_request_set_callback(req, 0, NULL, NULL);
1012 skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x);
1013 crypto_skcipher_decrypt(req);
1014 skcipher_request_zero(req);
1015
1016 mutex_unlock(&rxkad_ci_mutex);
1017
1018 _leave("");
1019 }
1020
1021 /*
1022 * verify a response
1023 */
rxkad_verify_response(struct rxrpc_connection * conn,struct sk_buff * skb,u32 * _abort_code)1024 static int rxkad_verify_response(struct rxrpc_connection *conn,
1025 struct sk_buff *skb,
1026 u32 *_abort_code)
1027 {
1028 struct rxkad_response response
1029 __attribute__((aligned(8))); /* must be aligned for crypto */
1030 struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
1031 struct rxrpc_crypt session_key;
1032 time_t expiry;
1033 void *ticket;
1034 u32 abort_code, version, kvno, ticket_len, level;
1035 __be32 csum;
1036 int ret, i;
1037
1038 _enter("{%d,%x}", conn->debug_id, key_serial(conn->server_key));
1039
1040 abort_code = RXKADPACKETSHORT;
1041 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
1042 &response, sizeof(response)) < 0)
1043 goto protocol_error;
1044 if (!pskb_pull(skb, sizeof(response)))
1045 BUG();
1046
1047 version = ntohl(response.version);
1048 ticket_len = ntohl(response.ticket_len);
1049 kvno = ntohl(response.kvno);
1050 _proto("Rx RESPONSE %%%u { v=%u kv=%u tl=%u }",
1051 sp->hdr.serial, version, kvno, ticket_len);
1052
1053 abort_code = RXKADINCONSISTENCY;
1054 if (version != RXKAD_VERSION)
1055 goto protocol_error;
1056
1057 abort_code = RXKADTICKETLEN;
1058 if (ticket_len < 4 || ticket_len > MAXKRB5TICKETLEN)
1059 goto protocol_error;
1060
1061 abort_code = RXKADUNKNOWNKEY;
1062 if (kvno >= RXKAD_TKT_TYPE_KERBEROS_V5)
1063 goto protocol_error;
1064
1065 /* extract the kerberos ticket and decrypt and decode it */
1066 ticket = kmalloc(ticket_len, GFP_NOFS);
1067 if (!ticket)
1068 return -ENOMEM;
1069
1070 abort_code = RXKADPACKETSHORT;
1071 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
1072 ticket, ticket_len) < 0)
1073 goto protocol_error_free;
1074
1075 ret = rxkad_decrypt_ticket(conn, ticket, ticket_len, &session_key,
1076 &expiry, &abort_code);
1077 if (ret < 0) {
1078 *_abort_code = abort_code;
1079 kfree(ticket);
1080 return ret;
1081 }
1082
1083 /* use the session key from inside the ticket to decrypt the
1084 * response */
1085 rxkad_decrypt_response(conn, &response, &session_key);
1086
1087 abort_code = RXKADSEALEDINCON;
1088 if (ntohl(response.encrypted.epoch) != conn->proto.epoch)
1089 goto protocol_error_free;
1090 if (ntohl(response.encrypted.cid) != conn->proto.cid)
1091 goto protocol_error_free;
1092 if (ntohl(response.encrypted.securityIndex) != conn->security_ix)
1093 goto protocol_error_free;
1094 csum = response.encrypted.checksum;
1095 response.encrypted.checksum = 0;
1096 rxkad_calc_response_checksum(&response);
1097 if (response.encrypted.checksum != csum)
1098 goto protocol_error_free;
1099
1100 spin_lock(&conn->channel_lock);
1101 for (i = 0; i < RXRPC_MAXCALLS; i++) {
1102 struct rxrpc_call *call;
1103 u32 call_id = ntohl(response.encrypted.call_id[i]);
1104
1105 if (call_id > INT_MAX)
1106 goto protocol_error_unlock;
1107
1108 if (call_id < conn->channels[i].call_counter)
1109 goto protocol_error_unlock;
1110 if (call_id > conn->channels[i].call_counter) {
1111 call = rcu_dereference_protected(
1112 conn->channels[i].call,
1113 lockdep_is_held(&conn->channel_lock));
1114 if (call && call->state < RXRPC_CALL_COMPLETE)
1115 goto protocol_error_unlock;
1116 conn->channels[i].call_counter = call_id;
1117 }
1118 }
1119 spin_unlock(&conn->channel_lock);
1120
1121 abort_code = RXKADOUTOFSEQUENCE;
1122 if (ntohl(response.encrypted.inc_nonce) != conn->security_nonce + 1)
1123 goto protocol_error_free;
1124
1125 abort_code = RXKADLEVELFAIL;
1126 level = ntohl(response.encrypted.level);
1127 if (level > RXRPC_SECURITY_ENCRYPT)
1128 goto protocol_error_free;
1129 conn->params.security_level = level;
1130
1131 /* create a key to hold the security data and expiration time - after
1132 * this the connection security can be handled in exactly the same way
1133 * as for a client connection */
1134 ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno);
1135 if (ret < 0) {
1136 kfree(ticket);
1137 return ret;
1138 }
1139
1140 kfree(ticket);
1141 _leave(" = 0");
1142 return 0;
1143
1144 protocol_error_unlock:
1145 spin_unlock(&conn->channel_lock);
1146 protocol_error_free:
1147 kfree(ticket);
1148 protocol_error:
1149 *_abort_code = abort_code;
1150 _leave(" = -EPROTO [%d]", abort_code);
1151 return -EPROTO;
1152 }
1153
1154 /*
1155 * clear the connection security
1156 */
rxkad_clear(struct rxrpc_connection * conn)1157 static void rxkad_clear(struct rxrpc_connection *conn)
1158 {
1159 _enter("");
1160
1161 if (conn->cipher)
1162 crypto_free_skcipher(conn->cipher);
1163 }
1164
1165 /*
1166 * Initialise the rxkad security service.
1167 */
rxkad_init(void)1168 static int rxkad_init(void)
1169 {
1170 /* pin the cipher we need so that the crypto layer doesn't invoke
1171 * keventd to go get it */
1172 rxkad_ci = crypto_alloc_skcipher("pcbc(fcrypt)", 0, CRYPTO_ALG_ASYNC);
1173 return PTR_ERR_OR_ZERO(rxkad_ci);
1174 }
1175
1176 /*
1177 * Clean up the rxkad security service.
1178 */
rxkad_exit(void)1179 static void rxkad_exit(void)
1180 {
1181 if (rxkad_ci)
1182 crypto_free_skcipher(rxkad_ci);
1183 }
1184
1185 /*
1186 * RxRPC Kerberos-based security
1187 */
1188 const struct rxrpc_security rxkad = {
1189 .name = "rxkad",
1190 .security_index = RXRPC_SECURITY_RXKAD,
1191 .init = rxkad_init,
1192 .exit = rxkad_exit,
1193 .init_connection_security = rxkad_init_connection_security,
1194 .prime_packet_security = rxkad_prime_packet_security,
1195 .secure_packet = rxkad_secure_packet,
1196 .verify_packet = rxkad_verify_packet,
1197 .locate_data = rxkad_locate_data,
1198 .issue_challenge = rxkad_issue_challenge,
1199 .respond_to_challenge = rxkad_respond_to_challenge,
1200 .verify_response = rxkad_verify_response,
1201 .clear = rxkad_clear,
1202 };
1203