Lines Matching +full:- +full:eproto
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* Kerberos-based RxRPC security
18 #include <linux/key-type.h>
21 #include <keys/rxrpc-type.h>
22 #include "ar-internal.h"
57 * The data should be the 8-byte secret key.
63 if (prep->datalen != 8) in rxkad_preparse_server_key()
64 return -EINVAL; in rxkad_preparse_server_key()
66 memcpy(&prep->payload.data[2], prep->data, 8); in rxkad_preparse_server_key()
74 if (crypto_skcipher_setkey(ci, prep->data, 8) < 0) in rxkad_preparse_server_key()
77 prep->payload.data[0] = ci; in rxkad_preparse_server_key()
85 if (prep->payload.data[0]) in rxkad_free_preparse_server_key()
86 crypto_free_skcipher(prep->payload.data[0]); in rxkad_free_preparse_server_key()
91 if (key->payload.data[0]) { in rxkad_destroy_server_key()
92 crypto_free_skcipher(key->payload.data[0]); in rxkad_destroy_server_key()
93 key->payload.data[0] = NULL; in rxkad_destroy_server_key()
106 _enter("{%d},{%x}", conn->debug_id, key_serial(conn->key)); in rxkad_init_connection_security()
108 conn->security_ix = token->security_index; in rxkad_init_connection_security()
117 if (crypto_sync_skcipher_setkey(ci, token->kad->session_key, in rxkad_init_connection_security()
118 sizeof(token->kad->session_key)) < 0) in rxkad_init_connection_security()
121 switch (conn->security_level) { in rxkad_init_connection_security()
127 ret = -EKEYREJECTED; in rxkad_init_connection_security()
135 conn->rxkad.cipher = ci; in rxkad_init_connection_security()
153 remain = umin(remain, 65535 - sizeof(struct rxrpc_wire_header)); in rxkad_alloc_txbuf()
155 switch (call->conn->security_level) { in rxkad_alloc_txbuf()
167 limit = round_down(RXRPC_JUMBO_DATALEN, RXKAD_ALIGN) - shdr; in rxkad_alloc_txbuf()
180 txb->offset += shdr; in rxkad_alloc_txbuf()
181 txb->space = part; in rxkad_alloc_txbuf()
201 if (!conn->key) in rxkad_prime_packet_security()
206 return -ENOMEM; in rxkad_prime_packet_security()
208 req = skcipher_request_alloc(&ci->base, GFP_NOFS); in rxkad_prime_packet_security()
211 return -ENOMEM; in rxkad_prime_packet_security()
214 token = conn->key->payload.data[0]; in rxkad_prime_packet_security()
215 memcpy(&iv, token->kad->session_key, sizeof(iv)); in rxkad_prime_packet_security()
217 tmpbuf[0] = htonl(conn->proto.epoch); in rxkad_prime_packet_security()
218 tmpbuf[1] = htonl(conn->proto.cid); in rxkad_prime_packet_security()
220 tmpbuf[3] = htonl(conn->security_ix); in rxkad_prime_packet_security()
229 memcpy(&conn->rxkad.csum_iv, tmpbuf + 2, sizeof(conn->rxkad.csum_iv)); in rxkad_prime_packet_security()
241 struct crypto_skcipher *tfm = &call->conn->rxkad.cipher->base; in rxkad_get_call_crypto()
260 struct rxkad_level1_hdr *hdr = txb->data; in rxkad_secure_packet_auth()
268 check = txb->seq ^ call->call_id; in rxkad_secure_packet_auth()
269 hdr->data_size = htonl((u32)check << 16 | txb->len); in rxkad_secure_packet_auth()
271 txb->pkt_len = sizeof(struct rxkad_level1_hdr) + txb->len; in rxkad_secure_packet_auth()
272 pad = txb->pkt_len; in rxkad_secure_packet_auth()
273 pad = RXKAD_ALIGN - pad; in rxkad_secure_packet_auth()
274 pad &= RXKAD_ALIGN - 1; in rxkad_secure_packet_auth()
276 memset(txb->data + txb->offset, 0, pad); in rxkad_secure_packet_auth()
277 txb->pkt_len += pad; in rxkad_secure_packet_auth()
284 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); in rxkad_secure_packet_auth()
302 struct rxkad_level2_hdr *rxkhdr = txb->data; in rxkad_secure_packet_encrypt()
311 check = txb->seq ^ call->call_id; in rxkad_secure_packet_encrypt()
313 rxkhdr->data_size = htonl(txb->len | (u32)check << 16); in rxkad_secure_packet_encrypt()
314 rxkhdr->checksum = 0; in rxkad_secure_packet_encrypt()
316 content = sizeof(struct rxkad_level2_hdr) + txb->len; in rxkad_secure_packet_encrypt()
317 txb->pkt_len = round_up(content, RXKAD_ALIGN); in rxkad_secure_packet_encrypt()
318 pad = txb->pkt_len - content; in rxkad_secure_packet_encrypt()
320 memset(txb->data + txb->offset, 0, pad); in rxkad_secure_packet_encrypt()
323 token = call->conn->key->payload.data[0]; in rxkad_secure_packet_encrypt()
324 memcpy(&iv, token->kad->session_key, sizeof(iv)); in rxkad_secure_packet_encrypt()
326 sg_init_one(&sg, rxkhdr, txb->pkt_len); in rxkad_secure_packet_encrypt()
327 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); in rxkad_secure_packet_encrypt()
329 skcipher_request_set_crypt(req, &sg, &sg, txb->pkt_len, iv.x); in rxkad_secure_packet_encrypt()
350 call->debug_id, key_serial(call->conn->key), in rxkad_secure_packet()
351 txb->seq, txb->len); in rxkad_secure_packet()
353 if (!call->conn->rxkad.cipher) in rxkad_secure_packet()
356 ret = key_validate(call->conn->key); in rxkad_secure_packet()
362 return -ENOMEM; in rxkad_secure_packet()
365 memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv)); in rxkad_secure_packet()
368 x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT); in rxkad_secure_packet()
369 x |= txb->seq & 0x3fffffff; in rxkad_secure_packet()
370 crypto.buf[0] = htonl(call->call_id); in rxkad_secure_packet()
374 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); in rxkad_secure_packet()
384 txb->cksum = htons(y); in rxkad_secure_packet()
386 switch (call->conn->security_level) { in rxkad_secure_packet()
388 txb->pkt_len = txb->len; in rxkad_secure_packet()
393 if (txb->alloc_size == RXRPC_JUMBO_DATALEN) in rxkad_secure_packet()
394 txb->jumboable = true; in rxkad_secure_packet()
398 if (txb->alloc_size == RXRPC_JUMBO_DATALEN) in rxkad_secure_packet()
399 txb->jumboable = true; in rxkad_secure_packet()
402 ret = -EPERM; in rxkad_secure_packet()
407 if (txb->pkt_len < txb->alloc_size) { in rxkad_secure_packet()
408 size_t gap = txb->alloc_size - txb->pkt_len; in rxkad_secure_packet()
409 void *p = txb->data; in rxkad_secure_packet()
411 memset(p + txb->pkt_len, 0, gap); in rxkad_secure_packet()
436 if (sp->len < 8) in rxkad_verify_packet_1()
440 /* Decrypt the skbuff in-place. TODO: We really want to decrypt in rxkad_verify_packet_1()
444 ret = skb_to_sgvec(skb, sg, sp->offset, 8); in rxkad_verify_packet_1()
451 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); in rxkad_verify_packet_1()
458 if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0) in rxkad_verify_packet_1()
461 sp->offset += sizeof(sechdr); in rxkad_verify_packet_1()
462 sp->len -= sizeof(sechdr); in rxkad_verify_packet_1()
468 check ^= seq ^ call->call_id; in rxkad_verify_packet_1()
473 if (data_size > sp->len) in rxkad_verify_packet_1()
476 sp->len = data_size; in rxkad_verify_packet_1()
498 _enter(",{%d}", sp->len); in rxkad_verify_packet_2()
500 if (sp->len < 8) in rxkad_verify_packet_2()
504 /* Decrypt the skbuff in-place. TODO: We really want to decrypt in rxkad_verify_packet_2()
508 nsg = skb_shinfo(skb)->nr_frags + 1; in rxkad_verify_packet_2()
514 return -ENOMEM; in rxkad_verify_packet_2()
518 ret = skb_to_sgvec(skb, sg, sp->offset, sp->len); in rxkad_verify_packet_2()
526 token = call->conn->key->payload.data[0]; in rxkad_verify_packet_2()
527 memcpy(&iv, token->kad->session_key, sizeof(iv)); in rxkad_verify_packet_2()
529 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); in rxkad_verify_packet_2()
531 skcipher_request_set_crypt(req, sg, sg, sp->len, iv.x); in rxkad_verify_packet_2()
538 if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0) in rxkad_verify_packet_2()
541 sp->offset += sizeof(sechdr); in rxkad_verify_packet_2()
542 sp->len -= sizeof(sechdr); in rxkad_verify_packet_2()
548 check ^= seq ^ call->call_id; in rxkad_verify_packet_2()
554 if (data_size > sp->len) in rxkad_verify_packet_2()
558 sp->len = data_size; in rxkad_verify_packet_2()
575 rxrpc_seq_t seq = sp->hdr.seq; in rxkad_verify_packet()
581 call->debug_id, key_serial(call->conn->key), seq); in rxkad_verify_packet()
583 if (!call->conn->rxkad.cipher) in rxkad_verify_packet()
588 return -ENOMEM; in rxkad_verify_packet()
591 memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv)); in rxkad_verify_packet()
594 x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT); in rxkad_verify_packet()
596 crypto.buf[0] = htonl(call->call_id); in rxkad_verify_packet()
600 skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); in rxkad_verify_packet()
611 if (cksum != sp->hdr.cksum) { in rxkad_verify_packet()
617 switch (call->conn->security_level) { in rxkad_verify_packet()
628 ret = -ENOANO; in rxkad_verify_packet()
650 _enter("{%d}", conn->debug_id); in rxkad_issue_challenge()
652 get_random_bytes(&conn->rxkad.nonce, sizeof(conn->rxkad.nonce)); in rxkad_issue_challenge()
655 challenge.nonce = htonl(conn->rxkad.nonce); in rxkad_issue_challenge()
659 msg.msg_name = &conn->peer->srx.transport; in rxkad_issue_challenge()
660 msg.msg_namelen = conn->peer->srx.transport_len; in rxkad_issue_challenge()
665 whdr.epoch = htonl(conn->proto.epoch); in rxkad_issue_challenge()
666 whdr.cid = htonl(conn->proto.cid); in rxkad_issue_challenge()
670 whdr.flags = conn->out_clientflag; in rxkad_issue_challenge()
672 whdr.securityIndex = conn->security_ix; in rxkad_issue_challenge()
674 whdr.serviceId = htons(conn->service_id); in rxkad_issue_challenge()
686 ret = kernel_sendmsg(conn->local->socket, &msg, iov, 2, len); in rxkad_issue_challenge()
688 trace_rxrpc_tx_fail(conn->debug_id, serial, ret, in rxkad_issue_challenge()
690 return -EAGAIN; in rxkad_issue_challenge()
693 conn->peer->last_tx_at = ktime_get_seconds(); in rxkad_issue_challenge()
694 trace_rxrpc_tx_packet(conn->debug_id, &whdr, in rxkad_issue_challenge()
717 msg.msg_name = &conn->peer->srx.transport; in rxkad_send_response()
718 msg.msg_namelen = conn->peer->srx.transport_len; in rxkad_send_response()
724 whdr.epoch = htonl(hdr->epoch); in rxkad_send_response()
725 whdr.cid = htonl(hdr->cid); in rxkad_send_response()
727 whdr.flags = conn->out_clientflag; in rxkad_send_response()
728 whdr.securityIndex = hdr->securityIndex; in rxkad_send_response()
729 whdr.serviceId = htons(hdr->serviceId); in rxkad_send_response()
735 iov[2].iov_base = (void *)s2->ticket; in rxkad_send_response()
736 iov[2].iov_len = s2->ticket_len; in rxkad_send_response()
743 rxrpc_local_dont_fragment(conn->local, false); in rxkad_send_response()
744 ret = kernel_sendmsg(conn->local->socket, &msg, iov, 3, len); in rxkad_send_response()
746 trace_rxrpc_tx_fail(conn->debug_id, serial, ret, in rxkad_send_response()
748 return -EAGAIN; in rxkad_send_response()
751 conn->peer->last_tx_at = ktime_get_seconds(); in rxkad_send_response()
765 for (loop = sizeof(*response); loop > 0; loop--) in rxkad_calc_response_checksum()
768 response->encrypted.checksum = htonl(csum); in rxkad_calc_response_checksum()
782 req = skcipher_request_alloc(&conn->rxkad.cipher->base, GFP_NOFS); in rxkad_encrypt_response()
784 return -ENOMEM; in rxkad_encrypt_response()
787 memcpy(&iv, s2->session_key, sizeof(iv)); in rxkad_encrypt_response()
790 sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted)); in rxkad_encrypt_response()
791 skcipher_request_set_sync_tfm(req, conn->rxkad.cipher); in rxkad_encrypt_response()
793 skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x); in rxkad_encrypt_response()
810 int ret = -EPROTO; in rxkad_respond_to_challenge()
812 _enter("{%d,%x}", conn->debug_id, key_serial(conn->key)); in rxkad_respond_to_challenge()
814 if (!conn->key) in rxkad_respond_to_challenge()
815 return rxrpc_abort_conn(conn, skb, RX_PROTOCOL_ERROR, -EPROTO, in rxkad_respond_to_challenge()
818 ret = key_validate(conn->key); in rxkad_respond_to_challenge()
825 return rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO, in rxkad_respond_to_challenge()
832 trace_rxrpc_rx_challenge(conn, sp->hdr.serial, version, nonce, min_level); in rxkad_respond_to_challenge()
835 return rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO, in rxkad_respond_to_challenge()
838 if (conn->security_level < min_level) in rxkad_respond_to_challenge()
839 return rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EACCES, in rxkad_respond_to_challenge()
842 token = conn->key->payload.data[0]; in rxkad_respond_to_challenge()
847 return -ENOMEM; in rxkad_respond_to_challenge()
849 resp->version = htonl(RXKAD_VERSION); in rxkad_respond_to_challenge()
850 resp->encrypted.epoch = htonl(conn->proto.epoch); in rxkad_respond_to_challenge()
851 resp->encrypted.cid = htonl(conn->proto.cid); in rxkad_respond_to_challenge()
852 resp->encrypted.securityIndex = htonl(conn->security_ix); in rxkad_respond_to_challenge()
853 resp->encrypted.inc_nonce = htonl(nonce + 1); in rxkad_respond_to_challenge()
854 resp->encrypted.level = htonl(conn->security_level); in rxkad_respond_to_challenge()
855 resp->kvno = htonl(token->kad->kvno); in rxkad_respond_to_challenge()
856 resp->ticket_len = htonl(token->kad->ticket_len); in rxkad_respond_to_challenge()
857 resp->encrypted.call_id[0] = htonl(conn->channels[0].call_counter); in rxkad_respond_to_challenge()
858 resp->encrypted.call_id[1] = htonl(conn->channels[1].call_counter); in rxkad_respond_to_challenge()
859 resp->encrypted.call_id[2] = htonl(conn->channels[2].call_counter); in rxkad_respond_to_challenge()
860 resp->encrypted.call_id[3] = htonl(conn->channels[3].call_counter); in rxkad_respond_to_challenge()
864 ret = rxkad_encrypt_response(conn, resp, token->kad); in rxkad_respond_to_challenge()
866 ret = rxkad_send_response(conn, &sp->hdr, resp, token->kad); in rxkad_respond_to_challenge()
890 _enter("{%d},{%x}", conn->debug_id, key_serial(server_key)); in rxkad_decrypt_ticket()
894 ASSERT(server_key->payload.data[0] != NULL); in rxkad_decrypt_ticket()
897 memcpy(&iv, &server_key->payload.data[2], sizeof(iv)); in rxkad_decrypt_ticket()
899 req = skcipher_request_alloc(server_key->payload.data[0], GFP_NOFS); in rxkad_decrypt_ticket()
901 return -ENOMEM; in rxkad_decrypt_ticket()
915 q = memchr(p, 0, end - p); \ in rxkad_decrypt_ticket()
916 if (!q || q - p > field##_SZ) \ in rxkad_decrypt_ticket()
918 conn, skb, RXKADBADTICKET, -EPROTO, \ in rxkad_decrypt_ticket()
923 conn, skb, RXKADBADTICKET, -EPROTO, \ in rxkad_decrypt_ticket()
946 if (end - p < 4 + 8 + 4 + 2) in rxkad_decrypt_ticket()
947 return rxrpc_abort_conn(conn, skb, RXKADBADTICKET, -EPROTO, in rxkad_decrypt_ticket()
981 return rxrpc_abort_conn(conn, skb, RXKADNOAUTH, -EKEYREJECTED, in rxkad_decrypt_ticket()
983 if (issue < now - life) in rxkad_decrypt_ticket()
984 return rxrpc_abort_conn(conn, skb, RXKADEXPIRED, -EKEYEXPIRED, in rxkad_decrypt_ticket()
1011 ntohl(session_key->n[0]), ntohl(session_key->n[1])); in rxkad_decrypt_response()
1014 if (crypto_sync_skcipher_setkey(rxkad_ci, session_key->x, in rxkad_decrypt_response()
1021 sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted)); in rxkad_decrypt_response()
1024 skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x); in rxkad_decrypt_response()
1049 _enter("{%d}", conn->debug_id); in rxkad_verify_response()
1055 case -ENOKEY: in rxkad_verify_response()
1058 case -EKEYEXPIRED: in rxkad_verify_response()
1067 ret = -ENOMEM; in rxkad_verify_response()
1074 rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO, in rxkad_verify_response()
1079 version = ntohl(response->version); in rxkad_verify_response()
1080 ticket_len = ntohl(response->ticket_len); in rxkad_verify_response()
1081 kvno = ntohl(response->kvno); in rxkad_verify_response()
1083 trace_rxrpc_rx_response(conn, sp->hdr.serial, version, kvno, ticket_len); in rxkad_verify_response()
1086 rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO, in rxkad_verify_response()
1092 rxrpc_abort_conn(conn, skb, RXKADTICKETLEN, -EPROTO, in rxkad_verify_response()
1098 rxrpc_abort_conn(conn, skb, RXKADUNKNOWNKEY, -EPROTO, in rxkad_verify_response()
1104 ret = -ENOMEM; in rxkad_verify_response()
1111 rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO, in rxkad_verify_response()
1125 if (ntohl(response->encrypted.epoch) != conn->proto.epoch || in rxkad_verify_response()
1126 ntohl(response->encrypted.cid) != conn->proto.cid || in rxkad_verify_response()
1127 ntohl(response->encrypted.securityIndex) != conn->security_ix) { in rxkad_verify_response()
1128 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO, in rxkad_verify_response()
1133 csum = response->encrypted.checksum; in rxkad_verify_response()
1134 response->encrypted.checksum = 0; in rxkad_verify_response()
1136 if (response->encrypted.checksum != csum) { in rxkad_verify_response()
1137 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO, in rxkad_verify_response()
1143 u32 call_id = ntohl(response->encrypted.call_id[i]); in rxkad_verify_response()
1144 u32 counter = READ_ONCE(conn->channels[i].call_counter); in rxkad_verify_response()
1147 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO, in rxkad_verify_response()
1153 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO, in rxkad_verify_response()
1159 if (conn->channels[i].call) { in rxkad_verify_response()
1160 rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO, in rxkad_verify_response()
1164 conn->channels[i].call_counter = call_id; in rxkad_verify_response()
1168 if (ntohl(response->encrypted.inc_nonce) != conn->rxkad.nonce + 1) { in rxkad_verify_response()
1169 rxrpc_abort_conn(conn, skb, RXKADOUTOFSEQUENCE, -EPROTO, in rxkad_verify_response()
1174 level = ntohl(response->encrypted.level); in rxkad_verify_response()
1176 rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EPROTO, in rxkad_verify_response()
1180 conn->security_level = level; in rxkad_verify_response()
1182 /* create a key to hold the security data and expiration time - after in rxkad_verify_response()
1199 return -EPROTO; in rxkad_verify_response()
1221 if (conn->rxkad.cipher) in rxkad_clear()
1222 crypto_free_sync_skcipher(conn->rxkad.cipher); in rxkad_clear()
1239 req = skcipher_request_alloc(&tfm->base, GFP_KERNEL); in rxkad_init()
1249 return -ENOMEM; in rxkad_init()
1262 * RxRPC Kerberos-based security