Commit 33941284 authored by David Howells's avatar David Howells Committed by David S. Miller

RxRPC: Allow key payloads to be passed in XDR form

Allow add_key() and KEYCTL_INSTANTIATE to accept key payloads in XDR form as
described by openafs-1.4.10/src/auth/afs_token.xg.  This provides a way of
passing kaserver, Kerberos 4, Kerberos 5 and GSSAPI keys from userspace, and
allows for future expansion.
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8b815477
......@@ -21,4 +21,59 @@ extern struct key_type key_type_rxrpc;
extern struct key *rxrpc_get_null_key(const char *);
/*
* RxRPC key for Kerberos IV (type-2 security)
*/
struct rxkad_key {
u32 vice_id;
u32 start; /* time at which ticket starts */
u32 expiry; /* time at which ticket expires */
u32 kvno; /* key version number */
u8 primary_flag; /* T if key for primary cell for this user */
u16 ticket_len; /* length of ticket[] */
u8 session_key[8]; /* DES session key */
u8 ticket[0]; /* the encrypted ticket */
};
/*
* list of tokens attached to an rxrpc key
*/
struct rxrpc_key_token {
u16 security_index; /* RxRPC header security index */
struct rxrpc_key_token *next; /* the next token in the list */
union {
struct rxkad_key *kad;
};
};
/*
* structure of raw payloads passed to add_key() or instantiate key
*/
struct rxrpc_key_data_v1 {
u32 kif_version; /* 1 */
u16 security_index;
u16 ticket_length;
u32 expiry; /* time_t */
u32 kvno;
u8 session_key[8];
u8 ticket[0];
};
/*
* AF_RXRPC key payload derived from XDR format
* - based on openafs-1.4.10/src/auth/afs_token.xg
*/
#define AFSTOKEN_LENGTH_MAX 16384 /* max payload size */
#define AFSTOKEN_CELL_MAX 64 /* max cellname length */
#define AFSTOKEN_MAX 8 /* max tokens per payload */
#define AFSTOKEN_RK_TIX_MAX 12000 /* max RxKAD ticket size */
#define AFSTOKEN_GK_KEY_MAX 64 /* max GSSAPI key size */
#define AFSTOKEN_GK_TOKEN_MAX 16384 /* max GSSAPI token size */
#define AFSTOKEN_K5_COMPONENTS_MAX 16 /* max K5 components */
#define AFSTOKEN_K5_NAME_MAX 128 /* max K5 name length */
#define AFSTOKEN_K5_REALM_MAX 64 /* max K5 realm name length */
#define AFSTOKEN_K5_TIX_MAX 16384 /* max K5 ticket size */
#define AFSTOKEN_K5_ADDRESSES_MAX 16 /* max K5 addresses */
#define AFSTOKEN_K5_AUTHDATA_MAX 16 /* max K5 pieces of auth data */
#endif /* _KEYS_RXRPC_TYPE_H */
......@@ -401,22 +401,6 @@ struct rxrpc_call {
__be32 call_id; /* call ID on connection */
};
/*
* RxRPC key for Kerberos (type-2 security)
*/
struct rxkad_key {
u16 security_index; /* RxRPC header security index */
u16 ticket_len; /* length of ticket[] */
u32 expiry; /* time at which expires */
u32 kvno; /* key version number */
u8 session_key[8]; /* DES session key */
u8 ticket[0]; /* the encrypted ticket */
};
struct rxrpc_key_payload {
struct rxkad_key k;
};
/*
* locally abort an RxRPC call
*/
......
This diff is collapsed.
......@@ -16,6 +16,7 @@
#include <linux/crypto.h>
#include <net/sock.h>
#include <net/af_rxrpc.h>
#include <keys/rxrpc-type.h>
#include "ar-internal.h"
static LIST_HEAD(rxrpc_security_methods);
......@@ -122,6 +123,7 @@ EXPORT_SYMBOL_GPL(rxrpc_unregister_security);
*/
int rxrpc_init_client_conn_security(struct rxrpc_connection *conn)
{
struct rxrpc_key_token *token;
struct rxrpc_security *sec;
struct key *key = conn->key;
int ret;
......@@ -135,7 +137,11 @@ int rxrpc_init_client_conn_security(struct rxrpc_connection *conn)
if (ret < 0)
return ret;
sec = rxrpc_security_lookup(key->type_data.x[0]);
if (!key->payload.data)
return -EKEYREJECTED;
token = key->payload.data;
sec = rxrpc_security_lookup(token->security_index);
if (!sec)
return -EKEYREJECTED;
conn->security = sec;
......
......@@ -18,6 +18,7 @@
#include <linux/ctype.h>
#include <net/sock.h>
#include <net/af_rxrpc.h>
#include <keys/rxrpc-type.h>
#define rxrpc_debug rxkad_debug
#include "ar-internal.h"
......@@ -59,14 +60,14 @@ static DEFINE_MUTEX(rxkad_ci_mutex);
*/
static int rxkad_init_connection_security(struct rxrpc_connection *conn)
{
struct rxrpc_key_payload *payload;
struct crypto_blkcipher *ci;
struct rxrpc_key_token *token;
int ret;
_enter("{%d},{%x}", conn->debug_id, key_serial(conn->key));
payload = conn->key->payload.data;
conn->security_ix = payload->k.security_index;
token = conn->key->payload.data;
conn->security_ix = token->security_index;
ci = crypto_alloc_blkcipher("pcbc(fcrypt)", 0, CRYPTO_ALG_ASYNC);
if (IS_ERR(ci)) {
......@@ -75,8 +76,8 @@ static int rxkad_init_connection_security(struct rxrpc_connection *conn)
goto error;
}
if (crypto_blkcipher_setkey(ci, payload->k.session_key,
sizeof(payload->k.session_key)) < 0)
if (crypto_blkcipher_setkey(ci, token->kad->session_key,
sizeof(token->kad->session_key)) < 0)
BUG();
switch (conn->security_level) {
......@@ -110,7 +111,7 @@ static int rxkad_init_connection_security(struct rxrpc_connection *conn)
*/
static void rxkad_prime_packet_security(struct rxrpc_connection *conn)
{
struct rxrpc_key_payload *payload;
struct rxrpc_key_token *token;
struct blkcipher_desc desc;
struct scatterlist sg[2];
struct rxrpc_crypt iv;
......@@ -123,8 +124,8 @@ static void rxkad_prime_packet_security(struct rxrpc_connection *conn)
if (!conn->key)
return;
payload = conn->key->payload.data;
memcpy(&iv, payload->k.session_key, sizeof(iv));
token = conn->key->payload.data;
memcpy(&iv, token->kad->session_key, sizeof(iv));
desc.tfm = conn->cipher;
desc.info = iv.x;
......@@ -197,7 +198,7 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
u32 data_size,
void *sechdr)
{
const struct rxrpc_key_payload *payload;
const struct rxrpc_key_token *token;
struct rxkad_level2_hdr rxkhdr
__attribute__((aligned(8))); /* must be all on one page */
struct rxrpc_skb_priv *sp;
......@@ -219,8 +220,8 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
rxkhdr.checksum = 0;
/* encrypt from the session key */
payload = call->conn->key->payload.data;
memcpy(&iv, payload->k.session_key, sizeof(iv));
token = call->conn->key->payload.data;
memcpy(&iv, token->kad->session_key, sizeof(iv));
desc.tfm = call->conn->cipher;
desc.info = iv.x;
desc.flags = 0;
......@@ -400,7 +401,7 @@ static int rxkad_verify_packet_encrypt(const struct rxrpc_call *call,
struct sk_buff *skb,
u32 *_abort_code)
{
const struct rxrpc_key_payload *payload;
const struct rxrpc_key_token *token;
struct rxkad_level2_hdr sechdr;
struct rxrpc_skb_priv *sp;
struct blkcipher_desc desc;
......@@ -431,8 +432,8 @@ static int rxkad_verify_packet_encrypt(const struct rxrpc_call *call,
skb_to_sgvec(skb, sg, 0, skb->len);
/* decrypt from the session key */
payload = call->conn->key->payload.data;
memcpy(&iv, payload->k.session_key, sizeof(iv));
token = call->conn->key->payload.data;
memcpy(&iv, token->kad->session_key, sizeof(iv));
desc.tfm = call->conn->cipher;
desc.info = iv.x;
desc.flags = 0;
......@@ -737,7 +738,7 @@ static int rxkad_respond_to_challenge(struct rxrpc_connection *conn,
struct sk_buff *skb,
u32 *_abort_code)
{
const struct rxrpc_key_payload *payload;
const struct rxrpc_key_token *token;
struct rxkad_challenge challenge;
struct rxkad_response resp
__attribute__((aligned(8))); /* must be aligned for crypto */
......@@ -778,7 +779,7 @@ static int rxkad_respond_to_challenge(struct rxrpc_connection *conn,
if (conn->security_level < min_level)
goto protocol_error;
payload = conn->key->payload.data;
token = conn->key->payload.data;
/* build the response packet */
memset(&resp, 0, sizeof(resp));
......@@ -797,13 +798,13 @@ static int rxkad_respond_to_challenge(struct rxrpc_connection *conn,
(conn->channels[3] ? conn->channels[3]->call_id : 0);
resp.encrypted.inc_nonce = htonl(nonce + 1);
resp.encrypted.level = htonl(conn->security_level);
resp.kvno = htonl(payload->k.kvno);
resp.ticket_len = htonl(payload->k.ticket_len);
resp.kvno = htonl(token->kad->kvno);
resp.ticket_len = htonl(token->kad->ticket_len);
/* calculate the response checksum and then do the encryption */
rxkad_calc_response_checksum(&resp);
rxkad_encrypt_response(conn, &resp, &payload->k);
return rxkad_send_response(conn, &sp->hdr, &resp, &payload->k);
rxkad_encrypt_response(conn, &resp, token->kad);
return rxkad_send_response(conn, &sp->hdr, &resp, token->kad);
protocol_error:
*_abort_code = abort_code;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment