Commit 0a93ea2e897bd793cc0aaaddc397eff32ac8d6fe
Committed by
Linus Torvalds
1 parent
f129ccc923
RxRPC: Allocate tokens with kzalloc to avoid oops in rxrpc_destroy
With slab poisoning enabled, I see the following oops: Unable to handle kernel paging request for data at address 0x6b6b6b6b6b6b6b73 ... NIP [c0000000006bc61c] .rxrpc_destroy+0x44/0x104 LR [c0000000006bc618] .rxrpc_destroy+0x40/0x104 Call Trace: [c0000000feb2bc00] [c0000000006bc618] .rxrpc_destroy+0x40/0x104 (unreliable) [c0000000feb2bc90] [c000000000349b2c] .key_cleanup+0x1a8/0x20c [c0000000feb2bd40] [c0000000000a2920] .process_one_work+0x2f4/0x4d0 [c0000000feb2be00] [c0000000000a2d50] .worker_thread+0x254/0x468 [c0000000feb2bec0] [c0000000000a868c] .kthread+0xbc/0xc8 [c0000000feb2bf90] [c000000000020e00] .kernel_thread+0x54/0x70 We aren't initialising token->next, but the code in destroy_context relies on the list being NULL terminated. Use kzalloc to zero out all the fields. Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Showing 1 changed file with 4 additions and 4 deletions Inline Diff
net/rxrpc/ar-key.c
1 | /* RxRPC key management | 1 | /* RxRPC key management |
2 | * | 2 | * |
3 | * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved. | 3 | * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved. |
4 | * Written by David Howells (dhowells@redhat.com) | 4 | * Written by David Howells (dhowells@redhat.com) |
5 | * | 5 | * |
6 | * This program is free software; you can redistribute it and/or | 6 | * This program is free software; you can redistribute it and/or |
7 | * modify it under the terms of the GNU General Public License | 7 | * modify it under the terms of the GNU General Public License |
8 | * as published by the Free Software Foundation; either version | 8 | * as published by the Free Software Foundation; either version |
9 | * 2 of the License, or (at your option) any later version. | 9 | * 2 of the License, or (at your option) any later version. |
10 | * | 10 | * |
11 | * RxRPC keys should have a description of describing their purpose: | 11 | * RxRPC keys should have a description of describing their purpose: |
12 | * "afs@CAMBRIDGE.REDHAT.COM> | 12 | * "afs@CAMBRIDGE.REDHAT.COM> |
13 | */ | 13 | */ |
14 | 14 | ||
15 | #include <linux/module.h> | 15 | #include <linux/module.h> |
16 | #include <linux/net.h> | 16 | #include <linux/net.h> |
17 | #include <linux/skbuff.h> | 17 | #include <linux/skbuff.h> |
18 | #include <linux/key-type.h> | 18 | #include <linux/key-type.h> |
19 | #include <linux/crypto.h> | 19 | #include <linux/crypto.h> |
20 | #include <linux/ctype.h> | 20 | #include <linux/ctype.h> |
21 | #include <linux/slab.h> | 21 | #include <linux/slab.h> |
22 | #include <net/sock.h> | 22 | #include <net/sock.h> |
23 | #include <net/af_rxrpc.h> | 23 | #include <net/af_rxrpc.h> |
24 | #include <keys/rxrpc-type.h> | 24 | #include <keys/rxrpc-type.h> |
25 | #include <keys/user-type.h> | 25 | #include <keys/user-type.h> |
26 | #include "ar-internal.h" | 26 | #include "ar-internal.h" |
27 | 27 | ||
28 | static int rxrpc_instantiate(struct key *, const void *, size_t); | 28 | static int rxrpc_instantiate(struct key *, const void *, size_t); |
29 | static int rxrpc_instantiate_s(struct key *, const void *, size_t); | 29 | static int rxrpc_instantiate_s(struct key *, const void *, size_t); |
30 | static void rxrpc_destroy(struct key *); | 30 | static void rxrpc_destroy(struct key *); |
31 | static void rxrpc_destroy_s(struct key *); | 31 | static void rxrpc_destroy_s(struct key *); |
32 | static void rxrpc_describe(const struct key *, struct seq_file *); | 32 | static void rxrpc_describe(const struct key *, struct seq_file *); |
33 | static long rxrpc_read(const struct key *, char __user *, size_t); | 33 | static long rxrpc_read(const struct key *, char __user *, size_t); |
34 | 34 | ||
35 | /* | 35 | /* |
36 | * rxrpc defined keys take an arbitrary string as the description and an | 36 | * rxrpc defined keys take an arbitrary string as the description and an |
37 | * arbitrary blob of data as the payload | 37 | * arbitrary blob of data as the payload |
38 | */ | 38 | */ |
39 | struct key_type key_type_rxrpc = { | 39 | struct key_type key_type_rxrpc = { |
40 | .name = "rxrpc", | 40 | .name = "rxrpc", |
41 | .instantiate = rxrpc_instantiate, | 41 | .instantiate = rxrpc_instantiate, |
42 | .match = user_match, | 42 | .match = user_match, |
43 | .destroy = rxrpc_destroy, | 43 | .destroy = rxrpc_destroy, |
44 | .describe = rxrpc_describe, | 44 | .describe = rxrpc_describe, |
45 | .read = rxrpc_read, | 45 | .read = rxrpc_read, |
46 | }; | 46 | }; |
47 | EXPORT_SYMBOL(key_type_rxrpc); | 47 | EXPORT_SYMBOL(key_type_rxrpc); |
48 | 48 | ||
49 | /* | 49 | /* |
50 | * rxrpc server defined keys take "<serviceId>:<securityIndex>" as the | 50 | * rxrpc server defined keys take "<serviceId>:<securityIndex>" as the |
51 | * description and an 8-byte decryption key as the payload | 51 | * description and an 8-byte decryption key as the payload |
52 | */ | 52 | */ |
53 | struct key_type key_type_rxrpc_s = { | 53 | struct key_type key_type_rxrpc_s = { |
54 | .name = "rxrpc_s", | 54 | .name = "rxrpc_s", |
55 | .instantiate = rxrpc_instantiate_s, | 55 | .instantiate = rxrpc_instantiate_s, |
56 | .match = user_match, | 56 | .match = user_match, |
57 | .destroy = rxrpc_destroy_s, | 57 | .destroy = rxrpc_destroy_s, |
58 | .describe = rxrpc_describe, | 58 | .describe = rxrpc_describe, |
59 | }; | 59 | }; |
60 | 60 | ||
61 | /* | 61 | /* |
62 | * parse an RxKAD type XDR format token | 62 | * parse an RxKAD type XDR format token |
63 | * - the caller guarantees we have at least 4 words | 63 | * - the caller guarantees we have at least 4 words |
64 | */ | 64 | */ |
65 | static int rxrpc_instantiate_xdr_rxkad(struct key *key, const __be32 *xdr, | 65 | static int rxrpc_instantiate_xdr_rxkad(struct key *key, const __be32 *xdr, |
66 | unsigned toklen) | 66 | unsigned toklen) |
67 | { | 67 | { |
68 | struct rxrpc_key_token *token, **pptoken; | 68 | struct rxrpc_key_token *token, **pptoken; |
69 | size_t plen; | 69 | size_t plen; |
70 | u32 tktlen; | 70 | u32 tktlen; |
71 | int ret; | 71 | int ret; |
72 | 72 | ||
73 | _enter(",{%x,%x,%x,%x},%u", | 73 | _enter(",{%x,%x,%x,%x},%u", |
74 | ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), ntohl(xdr[3]), | 74 | ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), ntohl(xdr[3]), |
75 | toklen); | 75 | toklen); |
76 | 76 | ||
77 | if (toklen <= 8 * 4) | 77 | if (toklen <= 8 * 4) |
78 | return -EKEYREJECTED; | 78 | return -EKEYREJECTED; |
79 | tktlen = ntohl(xdr[7]); | 79 | tktlen = ntohl(xdr[7]); |
80 | _debug("tktlen: %x", tktlen); | 80 | _debug("tktlen: %x", tktlen); |
81 | if (tktlen > AFSTOKEN_RK_TIX_MAX) | 81 | if (tktlen > AFSTOKEN_RK_TIX_MAX) |
82 | return -EKEYREJECTED; | 82 | return -EKEYREJECTED; |
83 | if (8 * 4 + tktlen != toklen) | 83 | if (8 * 4 + tktlen != toklen) |
84 | return -EKEYREJECTED; | 84 | return -EKEYREJECTED; |
85 | 85 | ||
86 | plen = sizeof(*token) + sizeof(*token->kad) + tktlen; | 86 | plen = sizeof(*token) + sizeof(*token->kad) + tktlen; |
87 | ret = key_payload_reserve(key, key->datalen + plen); | 87 | ret = key_payload_reserve(key, key->datalen + plen); |
88 | if (ret < 0) | 88 | if (ret < 0) |
89 | return ret; | 89 | return ret; |
90 | 90 | ||
91 | plen -= sizeof(*token); | 91 | plen -= sizeof(*token); |
92 | token = kmalloc(sizeof(*token), GFP_KERNEL); | 92 | token = kzalloc(sizeof(*token), GFP_KERNEL); |
93 | if (!token) | 93 | if (!token) |
94 | return -ENOMEM; | 94 | return -ENOMEM; |
95 | 95 | ||
96 | token->kad = kmalloc(plen, GFP_KERNEL); | 96 | token->kad = kzalloc(plen, GFP_KERNEL); |
97 | if (!token->kad) { | 97 | if (!token->kad) { |
98 | kfree(token); | 98 | kfree(token); |
99 | return -ENOMEM; | 99 | return -ENOMEM; |
100 | } | 100 | } |
101 | 101 | ||
102 | token->security_index = RXRPC_SECURITY_RXKAD; | 102 | token->security_index = RXRPC_SECURITY_RXKAD; |
103 | token->kad->ticket_len = tktlen; | 103 | token->kad->ticket_len = tktlen; |
104 | token->kad->vice_id = ntohl(xdr[0]); | 104 | token->kad->vice_id = ntohl(xdr[0]); |
105 | token->kad->kvno = ntohl(xdr[1]); | 105 | token->kad->kvno = ntohl(xdr[1]); |
106 | token->kad->start = ntohl(xdr[4]); | 106 | token->kad->start = ntohl(xdr[4]); |
107 | token->kad->expiry = ntohl(xdr[5]); | 107 | token->kad->expiry = ntohl(xdr[5]); |
108 | token->kad->primary_flag = ntohl(xdr[6]); | 108 | token->kad->primary_flag = ntohl(xdr[6]); |
109 | memcpy(&token->kad->session_key, &xdr[2], 8); | 109 | memcpy(&token->kad->session_key, &xdr[2], 8); |
110 | memcpy(&token->kad->ticket, &xdr[8], tktlen); | 110 | memcpy(&token->kad->ticket, &xdr[8], tktlen); |
111 | 111 | ||
112 | _debug("SCIX: %u", token->security_index); | 112 | _debug("SCIX: %u", token->security_index); |
113 | _debug("TLEN: %u", token->kad->ticket_len); | 113 | _debug("TLEN: %u", token->kad->ticket_len); |
114 | _debug("EXPY: %x", token->kad->expiry); | 114 | _debug("EXPY: %x", token->kad->expiry); |
115 | _debug("KVNO: %u", token->kad->kvno); | 115 | _debug("KVNO: %u", token->kad->kvno); |
116 | _debug("PRIM: %u", token->kad->primary_flag); | 116 | _debug("PRIM: %u", token->kad->primary_flag); |
117 | _debug("SKEY: %02x%02x%02x%02x%02x%02x%02x%02x", | 117 | _debug("SKEY: %02x%02x%02x%02x%02x%02x%02x%02x", |
118 | token->kad->session_key[0], token->kad->session_key[1], | 118 | token->kad->session_key[0], token->kad->session_key[1], |
119 | token->kad->session_key[2], token->kad->session_key[3], | 119 | token->kad->session_key[2], token->kad->session_key[3], |
120 | token->kad->session_key[4], token->kad->session_key[5], | 120 | token->kad->session_key[4], token->kad->session_key[5], |
121 | token->kad->session_key[6], token->kad->session_key[7]); | 121 | token->kad->session_key[6], token->kad->session_key[7]); |
122 | if (token->kad->ticket_len >= 8) | 122 | if (token->kad->ticket_len >= 8) |
123 | _debug("TCKT: %02x%02x%02x%02x%02x%02x%02x%02x", | 123 | _debug("TCKT: %02x%02x%02x%02x%02x%02x%02x%02x", |
124 | token->kad->ticket[0], token->kad->ticket[1], | 124 | token->kad->ticket[0], token->kad->ticket[1], |
125 | token->kad->ticket[2], token->kad->ticket[3], | 125 | token->kad->ticket[2], token->kad->ticket[3], |
126 | token->kad->ticket[4], token->kad->ticket[5], | 126 | token->kad->ticket[4], token->kad->ticket[5], |
127 | token->kad->ticket[6], token->kad->ticket[7]); | 127 | token->kad->ticket[6], token->kad->ticket[7]); |
128 | 128 | ||
129 | /* count the number of tokens attached */ | 129 | /* count the number of tokens attached */ |
130 | key->type_data.x[0]++; | 130 | key->type_data.x[0]++; |
131 | 131 | ||
132 | /* attach the data */ | 132 | /* attach the data */ |
133 | for (pptoken = (struct rxrpc_key_token **)&key->payload.data; | 133 | for (pptoken = (struct rxrpc_key_token **)&key->payload.data; |
134 | *pptoken; | 134 | *pptoken; |
135 | pptoken = &(*pptoken)->next) | 135 | pptoken = &(*pptoken)->next) |
136 | continue; | 136 | continue; |
137 | *pptoken = token; | 137 | *pptoken = token; |
138 | if (token->kad->expiry < key->expiry) | 138 | if (token->kad->expiry < key->expiry) |
139 | key->expiry = token->kad->expiry; | 139 | key->expiry = token->kad->expiry; |
140 | 140 | ||
141 | _leave(" = 0"); | 141 | _leave(" = 0"); |
142 | return 0; | 142 | return 0; |
143 | } | 143 | } |
144 | 144 | ||
145 | static void rxrpc_free_krb5_principal(struct krb5_principal *princ) | 145 | static void rxrpc_free_krb5_principal(struct krb5_principal *princ) |
146 | { | 146 | { |
147 | int loop; | 147 | int loop; |
148 | 148 | ||
149 | if (princ->name_parts) { | 149 | if (princ->name_parts) { |
150 | for (loop = princ->n_name_parts - 1; loop >= 0; loop--) | 150 | for (loop = princ->n_name_parts - 1; loop >= 0; loop--) |
151 | kfree(princ->name_parts[loop]); | 151 | kfree(princ->name_parts[loop]); |
152 | kfree(princ->name_parts); | 152 | kfree(princ->name_parts); |
153 | } | 153 | } |
154 | kfree(princ->realm); | 154 | kfree(princ->realm); |
155 | } | 155 | } |
156 | 156 | ||
157 | static void rxrpc_free_krb5_tagged(struct krb5_tagged_data *td) | 157 | static void rxrpc_free_krb5_tagged(struct krb5_tagged_data *td) |
158 | { | 158 | { |
159 | kfree(td->data); | 159 | kfree(td->data); |
160 | } | 160 | } |
161 | 161 | ||
162 | /* | 162 | /* |
163 | * free up an RxK5 token | 163 | * free up an RxK5 token |
164 | */ | 164 | */ |
165 | static void rxrpc_rxk5_free(struct rxk5_key *rxk5) | 165 | static void rxrpc_rxk5_free(struct rxk5_key *rxk5) |
166 | { | 166 | { |
167 | int loop; | 167 | int loop; |
168 | 168 | ||
169 | rxrpc_free_krb5_principal(&rxk5->client); | 169 | rxrpc_free_krb5_principal(&rxk5->client); |
170 | rxrpc_free_krb5_principal(&rxk5->server); | 170 | rxrpc_free_krb5_principal(&rxk5->server); |
171 | rxrpc_free_krb5_tagged(&rxk5->session); | 171 | rxrpc_free_krb5_tagged(&rxk5->session); |
172 | 172 | ||
173 | if (rxk5->addresses) { | 173 | if (rxk5->addresses) { |
174 | for (loop = rxk5->n_addresses - 1; loop >= 0; loop--) | 174 | for (loop = rxk5->n_addresses - 1; loop >= 0; loop--) |
175 | rxrpc_free_krb5_tagged(&rxk5->addresses[loop]); | 175 | rxrpc_free_krb5_tagged(&rxk5->addresses[loop]); |
176 | kfree(rxk5->addresses); | 176 | kfree(rxk5->addresses); |
177 | } | 177 | } |
178 | if (rxk5->authdata) { | 178 | if (rxk5->authdata) { |
179 | for (loop = rxk5->n_authdata - 1; loop >= 0; loop--) | 179 | for (loop = rxk5->n_authdata - 1; loop >= 0; loop--) |
180 | rxrpc_free_krb5_tagged(&rxk5->authdata[loop]); | 180 | rxrpc_free_krb5_tagged(&rxk5->authdata[loop]); |
181 | kfree(rxk5->authdata); | 181 | kfree(rxk5->authdata); |
182 | } | 182 | } |
183 | 183 | ||
184 | kfree(rxk5->ticket); | 184 | kfree(rxk5->ticket); |
185 | kfree(rxk5->ticket2); | 185 | kfree(rxk5->ticket2); |
186 | kfree(rxk5); | 186 | kfree(rxk5); |
187 | } | 187 | } |
188 | 188 | ||
189 | /* | 189 | /* |
190 | * extract a krb5 principal | 190 | * extract a krb5 principal |
191 | */ | 191 | */ |
192 | static int rxrpc_krb5_decode_principal(struct krb5_principal *princ, | 192 | static int rxrpc_krb5_decode_principal(struct krb5_principal *princ, |
193 | const __be32 **_xdr, | 193 | const __be32 **_xdr, |
194 | unsigned *_toklen) | 194 | unsigned *_toklen) |
195 | { | 195 | { |
196 | const __be32 *xdr = *_xdr; | 196 | const __be32 *xdr = *_xdr; |
197 | unsigned toklen = *_toklen, n_parts, loop, tmp; | 197 | unsigned toklen = *_toklen, n_parts, loop, tmp; |
198 | 198 | ||
199 | /* there must be at least one name, and at least #names+1 length | 199 | /* there must be at least one name, and at least #names+1 length |
200 | * words */ | 200 | * words */ |
201 | if (toklen <= 12) | 201 | if (toklen <= 12) |
202 | return -EINVAL; | 202 | return -EINVAL; |
203 | 203 | ||
204 | _enter(",{%x,%x,%x},%u", | 204 | _enter(",{%x,%x,%x},%u", |
205 | ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), toklen); | 205 | ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), toklen); |
206 | 206 | ||
207 | n_parts = ntohl(*xdr++); | 207 | n_parts = ntohl(*xdr++); |
208 | toklen -= 4; | 208 | toklen -= 4; |
209 | if (n_parts <= 0 || n_parts > AFSTOKEN_K5_COMPONENTS_MAX) | 209 | if (n_parts <= 0 || n_parts > AFSTOKEN_K5_COMPONENTS_MAX) |
210 | return -EINVAL; | 210 | return -EINVAL; |
211 | princ->n_name_parts = n_parts; | 211 | princ->n_name_parts = n_parts; |
212 | 212 | ||
213 | if (toklen <= (n_parts + 1) * 4) | 213 | if (toklen <= (n_parts + 1) * 4) |
214 | return -EINVAL; | 214 | return -EINVAL; |
215 | 215 | ||
216 | princ->name_parts = kcalloc(sizeof(char *), n_parts, GFP_KERNEL); | 216 | princ->name_parts = kcalloc(sizeof(char *), n_parts, GFP_KERNEL); |
217 | if (!princ->name_parts) | 217 | if (!princ->name_parts) |
218 | return -ENOMEM; | 218 | return -ENOMEM; |
219 | 219 | ||
220 | for (loop = 0; loop < n_parts; loop++) { | 220 | for (loop = 0; loop < n_parts; loop++) { |
221 | if (toklen < 4) | 221 | if (toklen < 4) |
222 | return -EINVAL; | 222 | return -EINVAL; |
223 | tmp = ntohl(*xdr++); | 223 | tmp = ntohl(*xdr++); |
224 | toklen -= 4; | 224 | toklen -= 4; |
225 | if (tmp <= 0 || tmp > AFSTOKEN_STRING_MAX) | 225 | if (tmp <= 0 || tmp > AFSTOKEN_STRING_MAX) |
226 | return -EINVAL; | 226 | return -EINVAL; |
227 | if (tmp > toklen) | 227 | if (tmp > toklen) |
228 | return -EINVAL; | 228 | return -EINVAL; |
229 | princ->name_parts[loop] = kmalloc(tmp + 1, GFP_KERNEL); | 229 | princ->name_parts[loop] = kmalloc(tmp + 1, GFP_KERNEL); |
230 | if (!princ->name_parts[loop]) | 230 | if (!princ->name_parts[loop]) |
231 | return -ENOMEM; | 231 | return -ENOMEM; |
232 | memcpy(princ->name_parts[loop], xdr, tmp); | 232 | memcpy(princ->name_parts[loop], xdr, tmp); |
233 | princ->name_parts[loop][tmp] = 0; | 233 | princ->name_parts[loop][tmp] = 0; |
234 | tmp = (tmp + 3) & ~3; | 234 | tmp = (tmp + 3) & ~3; |
235 | toklen -= tmp; | 235 | toklen -= tmp; |
236 | xdr += tmp >> 2; | 236 | xdr += tmp >> 2; |
237 | } | 237 | } |
238 | 238 | ||
239 | if (toklen < 4) | 239 | if (toklen < 4) |
240 | return -EINVAL; | 240 | return -EINVAL; |
241 | tmp = ntohl(*xdr++); | 241 | tmp = ntohl(*xdr++); |
242 | toklen -= 4; | 242 | toklen -= 4; |
243 | if (tmp <= 0 || tmp > AFSTOKEN_K5_REALM_MAX) | 243 | if (tmp <= 0 || tmp > AFSTOKEN_K5_REALM_MAX) |
244 | return -EINVAL; | 244 | return -EINVAL; |
245 | if (tmp > toklen) | 245 | if (tmp > toklen) |
246 | return -EINVAL; | 246 | return -EINVAL; |
247 | princ->realm = kmalloc(tmp + 1, GFP_KERNEL); | 247 | princ->realm = kmalloc(tmp + 1, GFP_KERNEL); |
248 | if (!princ->realm) | 248 | if (!princ->realm) |
249 | return -ENOMEM; | 249 | return -ENOMEM; |
250 | memcpy(princ->realm, xdr, tmp); | 250 | memcpy(princ->realm, xdr, tmp); |
251 | princ->realm[tmp] = 0; | 251 | princ->realm[tmp] = 0; |
252 | tmp = (tmp + 3) & ~3; | 252 | tmp = (tmp + 3) & ~3; |
253 | toklen -= tmp; | 253 | toklen -= tmp; |
254 | xdr += tmp >> 2; | 254 | xdr += tmp >> 2; |
255 | 255 | ||
256 | _debug("%s/...@%s", princ->name_parts[0], princ->realm); | 256 | _debug("%s/...@%s", princ->name_parts[0], princ->realm); |
257 | 257 | ||
258 | *_xdr = xdr; | 258 | *_xdr = xdr; |
259 | *_toklen = toklen; | 259 | *_toklen = toklen; |
260 | _leave(" = 0 [toklen=%u]", toklen); | 260 | _leave(" = 0 [toklen=%u]", toklen); |
261 | return 0; | 261 | return 0; |
262 | } | 262 | } |
263 | 263 | ||
264 | /* | 264 | /* |
265 | * extract a piece of krb5 tagged data | 265 | * extract a piece of krb5 tagged data |
266 | */ | 266 | */ |
267 | static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td, | 267 | static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td, |
268 | size_t max_data_size, | 268 | size_t max_data_size, |
269 | const __be32 **_xdr, | 269 | const __be32 **_xdr, |
270 | unsigned *_toklen) | 270 | unsigned *_toklen) |
271 | { | 271 | { |
272 | const __be32 *xdr = *_xdr; | 272 | const __be32 *xdr = *_xdr; |
273 | unsigned toklen = *_toklen, len; | 273 | unsigned toklen = *_toklen, len; |
274 | 274 | ||
275 | /* there must be at least one tag and one length word */ | 275 | /* there must be at least one tag and one length word */ |
276 | if (toklen <= 8) | 276 | if (toklen <= 8) |
277 | return -EINVAL; | 277 | return -EINVAL; |
278 | 278 | ||
279 | _enter(",%zu,{%x,%x},%u", | 279 | _enter(",%zu,{%x,%x},%u", |
280 | max_data_size, ntohl(xdr[0]), ntohl(xdr[1]), toklen); | 280 | max_data_size, ntohl(xdr[0]), ntohl(xdr[1]), toklen); |
281 | 281 | ||
282 | td->tag = ntohl(*xdr++); | 282 | td->tag = ntohl(*xdr++); |
283 | len = ntohl(*xdr++); | 283 | len = ntohl(*xdr++); |
284 | toklen -= 8; | 284 | toklen -= 8; |
285 | if (len > max_data_size) | 285 | if (len > max_data_size) |
286 | return -EINVAL; | 286 | return -EINVAL; |
287 | td->data_len = len; | 287 | td->data_len = len; |
288 | 288 | ||
289 | if (len > 0) { | 289 | if (len > 0) { |
290 | td->data = kmalloc(len, GFP_KERNEL); | 290 | td->data = kmalloc(len, GFP_KERNEL); |
291 | if (!td->data) | 291 | if (!td->data) |
292 | return -ENOMEM; | 292 | return -ENOMEM; |
293 | memcpy(td->data, xdr, len); | 293 | memcpy(td->data, xdr, len); |
294 | len = (len + 3) & ~3; | 294 | len = (len + 3) & ~3; |
295 | toklen -= len; | 295 | toklen -= len; |
296 | xdr += len >> 2; | 296 | xdr += len >> 2; |
297 | } | 297 | } |
298 | 298 | ||
299 | _debug("tag %x len %x", td->tag, td->data_len); | 299 | _debug("tag %x len %x", td->tag, td->data_len); |
300 | 300 | ||
301 | *_xdr = xdr; | 301 | *_xdr = xdr; |
302 | *_toklen = toklen; | 302 | *_toklen = toklen; |
303 | _leave(" = 0 [toklen=%u]", toklen); | 303 | _leave(" = 0 [toklen=%u]", toklen); |
304 | return 0; | 304 | return 0; |
305 | } | 305 | } |
306 | 306 | ||
307 | /* | 307 | /* |
308 | * extract an array of tagged data | 308 | * extract an array of tagged data |
309 | */ | 309 | */ |
310 | static int rxrpc_krb5_decode_tagged_array(struct krb5_tagged_data **_td, | 310 | static int rxrpc_krb5_decode_tagged_array(struct krb5_tagged_data **_td, |
311 | u8 *_n_elem, | 311 | u8 *_n_elem, |
312 | u8 max_n_elem, | 312 | u8 max_n_elem, |
313 | size_t max_elem_size, | 313 | size_t max_elem_size, |
314 | const __be32 **_xdr, | 314 | const __be32 **_xdr, |
315 | unsigned *_toklen) | 315 | unsigned *_toklen) |
316 | { | 316 | { |
317 | struct krb5_tagged_data *td; | 317 | struct krb5_tagged_data *td; |
318 | const __be32 *xdr = *_xdr; | 318 | const __be32 *xdr = *_xdr; |
319 | unsigned toklen = *_toklen, n_elem, loop; | 319 | unsigned toklen = *_toklen, n_elem, loop; |
320 | int ret; | 320 | int ret; |
321 | 321 | ||
322 | /* there must be at least one count */ | 322 | /* there must be at least one count */ |
323 | if (toklen < 4) | 323 | if (toklen < 4) |
324 | return -EINVAL; | 324 | return -EINVAL; |
325 | 325 | ||
326 | _enter(",,%u,%zu,{%x},%u", | 326 | _enter(",,%u,%zu,{%x},%u", |
327 | max_n_elem, max_elem_size, ntohl(xdr[0]), toklen); | 327 | max_n_elem, max_elem_size, ntohl(xdr[0]), toklen); |
328 | 328 | ||
329 | n_elem = ntohl(*xdr++); | 329 | n_elem = ntohl(*xdr++); |
330 | toklen -= 4; | 330 | toklen -= 4; |
331 | if (n_elem < 0 || n_elem > max_n_elem) | 331 | if (n_elem < 0 || n_elem > max_n_elem) |
332 | return -EINVAL; | 332 | return -EINVAL; |
333 | *_n_elem = n_elem; | 333 | *_n_elem = n_elem; |
334 | if (n_elem > 0) { | 334 | if (n_elem > 0) { |
335 | if (toklen <= (n_elem + 1) * 4) | 335 | if (toklen <= (n_elem + 1) * 4) |
336 | return -EINVAL; | 336 | return -EINVAL; |
337 | 337 | ||
338 | _debug("n_elem %d", n_elem); | 338 | _debug("n_elem %d", n_elem); |
339 | 339 | ||
340 | td = kcalloc(sizeof(struct krb5_tagged_data), n_elem, | 340 | td = kcalloc(sizeof(struct krb5_tagged_data), n_elem, |
341 | GFP_KERNEL); | 341 | GFP_KERNEL); |
342 | if (!td) | 342 | if (!td) |
343 | return -ENOMEM; | 343 | return -ENOMEM; |
344 | *_td = td; | 344 | *_td = td; |
345 | 345 | ||
346 | for (loop = 0; loop < n_elem; loop++) { | 346 | for (loop = 0; loop < n_elem; loop++) { |
347 | ret = rxrpc_krb5_decode_tagged_data(&td[loop], | 347 | ret = rxrpc_krb5_decode_tagged_data(&td[loop], |
348 | max_elem_size, | 348 | max_elem_size, |
349 | &xdr, &toklen); | 349 | &xdr, &toklen); |
350 | if (ret < 0) | 350 | if (ret < 0) |
351 | return ret; | 351 | return ret; |
352 | } | 352 | } |
353 | } | 353 | } |
354 | 354 | ||
355 | *_xdr = xdr; | 355 | *_xdr = xdr; |
356 | *_toklen = toklen; | 356 | *_toklen = toklen; |
357 | _leave(" = 0 [toklen=%u]", toklen); | 357 | _leave(" = 0 [toklen=%u]", toklen); |
358 | return 0; | 358 | return 0; |
359 | } | 359 | } |
360 | 360 | ||
361 | /* | 361 | /* |
362 | * extract a krb5 ticket | 362 | * extract a krb5 ticket |
363 | */ | 363 | */ |
364 | static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen, | 364 | static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen, |
365 | const __be32 **_xdr, unsigned *_toklen) | 365 | const __be32 **_xdr, unsigned *_toklen) |
366 | { | 366 | { |
367 | const __be32 *xdr = *_xdr; | 367 | const __be32 *xdr = *_xdr; |
368 | unsigned toklen = *_toklen, len; | 368 | unsigned toklen = *_toklen, len; |
369 | 369 | ||
370 | /* there must be at least one length word */ | 370 | /* there must be at least one length word */ |
371 | if (toklen <= 4) | 371 | if (toklen <= 4) |
372 | return -EINVAL; | 372 | return -EINVAL; |
373 | 373 | ||
374 | _enter(",{%x},%u", ntohl(xdr[0]), toklen); | 374 | _enter(",{%x},%u", ntohl(xdr[0]), toklen); |
375 | 375 | ||
376 | len = ntohl(*xdr++); | 376 | len = ntohl(*xdr++); |
377 | toklen -= 4; | 377 | toklen -= 4; |
378 | if (len > AFSTOKEN_K5_TIX_MAX) | 378 | if (len > AFSTOKEN_K5_TIX_MAX) |
379 | return -EINVAL; | 379 | return -EINVAL; |
380 | *_tktlen = len; | 380 | *_tktlen = len; |
381 | 381 | ||
382 | _debug("ticket len %u", len); | 382 | _debug("ticket len %u", len); |
383 | 383 | ||
384 | if (len > 0) { | 384 | if (len > 0) { |
385 | *_ticket = kmalloc(len, GFP_KERNEL); | 385 | *_ticket = kmalloc(len, GFP_KERNEL); |
386 | if (!*_ticket) | 386 | if (!*_ticket) |
387 | return -ENOMEM; | 387 | return -ENOMEM; |
388 | memcpy(*_ticket, xdr, len); | 388 | memcpy(*_ticket, xdr, len); |
389 | len = (len + 3) & ~3; | 389 | len = (len + 3) & ~3; |
390 | toklen -= len; | 390 | toklen -= len; |
391 | xdr += len >> 2; | 391 | xdr += len >> 2; |
392 | } | 392 | } |
393 | 393 | ||
394 | *_xdr = xdr; | 394 | *_xdr = xdr; |
395 | *_toklen = toklen; | 395 | *_toklen = toklen; |
396 | _leave(" = 0 [toklen=%u]", toklen); | 396 | _leave(" = 0 [toklen=%u]", toklen); |
397 | return 0; | 397 | return 0; |
398 | } | 398 | } |
399 | 399 | ||
400 | /* | 400 | /* |
401 | * parse an RxK5 type XDR format token | 401 | * parse an RxK5 type XDR format token |
402 | * - the caller guarantees we have at least 4 words | 402 | * - the caller guarantees we have at least 4 words |
403 | */ | 403 | */ |
404 | static int rxrpc_instantiate_xdr_rxk5(struct key *key, const __be32 *xdr, | 404 | static int rxrpc_instantiate_xdr_rxk5(struct key *key, const __be32 *xdr, |
405 | unsigned toklen) | 405 | unsigned toklen) |
406 | { | 406 | { |
407 | struct rxrpc_key_token *token, **pptoken; | 407 | struct rxrpc_key_token *token, **pptoken; |
408 | struct rxk5_key *rxk5; | 408 | struct rxk5_key *rxk5; |
409 | const __be32 *end_xdr = xdr + (toklen >> 2); | 409 | const __be32 *end_xdr = xdr + (toklen >> 2); |
410 | int ret; | 410 | int ret; |
411 | 411 | ||
412 | _enter(",{%x,%x,%x,%x},%u", | 412 | _enter(",{%x,%x,%x,%x},%u", |
413 | ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), ntohl(xdr[3]), | 413 | ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), ntohl(xdr[3]), |
414 | toklen); | 414 | toklen); |
415 | 415 | ||
416 | /* reserve some payload space for this subkey - the length of the token | 416 | /* reserve some payload space for this subkey - the length of the token |
417 | * is a reasonable approximation */ | 417 | * is a reasonable approximation */ |
418 | ret = key_payload_reserve(key, key->datalen + toklen); | 418 | ret = key_payload_reserve(key, key->datalen + toklen); |
419 | if (ret < 0) | 419 | if (ret < 0) |
420 | return ret; | 420 | return ret; |
421 | 421 | ||
422 | token = kzalloc(sizeof(*token), GFP_KERNEL); | 422 | token = kzalloc(sizeof(*token), GFP_KERNEL); |
423 | if (!token) | 423 | if (!token) |
424 | return -ENOMEM; | 424 | return -ENOMEM; |
425 | 425 | ||
426 | rxk5 = kzalloc(sizeof(*rxk5), GFP_KERNEL); | 426 | rxk5 = kzalloc(sizeof(*rxk5), GFP_KERNEL); |
427 | if (!rxk5) { | 427 | if (!rxk5) { |
428 | kfree(token); | 428 | kfree(token); |
429 | return -ENOMEM; | 429 | return -ENOMEM; |
430 | } | 430 | } |
431 | 431 | ||
432 | token->security_index = RXRPC_SECURITY_RXK5; | 432 | token->security_index = RXRPC_SECURITY_RXK5; |
433 | token->k5 = rxk5; | 433 | token->k5 = rxk5; |
434 | 434 | ||
435 | /* extract the principals */ | 435 | /* extract the principals */ |
436 | ret = rxrpc_krb5_decode_principal(&rxk5->client, &xdr, &toklen); | 436 | ret = rxrpc_krb5_decode_principal(&rxk5->client, &xdr, &toklen); |
437 | if (ret < 0) | 437 | if (ret < 0) |
438 | goto error; | 438 | goto error; |
439 | ret = rxrpc_krb5_decode_principal(&rxk5->server, &xdr, &toklen); | 439 | ret = rxrpc_krb5_decode_principal(&rxk5->server, &xdr, &toklen); |
440 | if (ret < 0) | 440 | if (ret < 0) |
441 | goto error; | 441 | goto error; |
442 | 442 | ||
443 | /* extract the session key and the encoding type (the tag field -> | 443 | /* extract the session key and the encoding type (the tag field -> |
444 | * ENCTYPE_xxx) */ | 444 | * ENCTYPE_xxx) */ |
445 | ret = rxrpc_krb5_decode_tagged_data(&rxk5->session, AFSTOKEN_DATA_MAX, | 445 | ret = rxrpc_krb5_decode_tagged_data(&rxk5->session, AFSTOKEN_DATA_MAX, |
446 | &xdr, &toklen); | 446 | &xdr, &toklen); |
447 | if (ret < 0) | 447 | if (ret < 0) |
448 | goto error; | 448 | goto error; |
449 | 449 | ||
450 | if (toklen < 4 * 8 + 2 * 4) | 450 | if (toklen < 4 * 8 + 2 * 4) |
451 | goto inval; | 451 | goto inval; |
452 | rxk5->authtime = be64_to_cpup((const __be64 *) xdr); | 452 | rxk5->authtime = be64_to_cpup((const __be64 *) xdr); |
453 | xdr += 2; | 453 | xdr += 2; |
454 | rxk5->starttime = be64_to_cpup((const __be64 *) xdr); | 454 | rxk5->starttime = be64_to_cpup((const __be64 *) xdr); |
455 | xdr += 2; | 455 | xdr += 2; |
456 | rxk5->endtime = be64_to_cpup((const __be64 *) xdr); | 456 | rxk5->endtime = be64_to_cpup((const __be64 *) xdr); |
457 | xdr += 2; | 457 | xdr += 2; |
458 | rxk5->renew_till = be64_to_cpup((const __be64 *) xdr); | 458 | rxk5->renew_till = be64_to_cpup((const __be64 *) xdr); |
459 | xdr += 2; | 459 | xdr += 2; |
460 | rxk5->is_skey = ntohl(*xdr++); | 460 | rxk5->is_skey = ntohl(*xdr++); |
461 | rxk5->flags = ntohl(*xdr++); | 461 | rxk5->flags = ntohl(*xdr++); |
462 | toklen -= 4 * 8 + 2 * 4; | 462 | toklen -= 4 * 8 + 2 * 4; |
463 | 463 | ||
464 | _debug("times: a=%llx s=%llx e=%llx rt=%llx", | 464 | _debug("times: a=%llx s=%llx e=%llx rt=%llx", |
465 | rxk5->authtime, rxk5->starttime, rxk5->endtime, | 465 | rxk5->authtime, rxk5->starttime, rxk5->endtime, |
466 | rxk5->renew_till); | 466 | rxk5->renew_till); |
467 | _debug("is_skey=%x flags=%x", rxk5->is_skey, rxk5->flags); | 467 | _debug("is_skey=%x flags=%x", rxk5->is_skey, rxk5->flags); |
468 | 468 | ||
469 | /* extract the permitted client addresses */ | 469 | /* extract the permitted client addresses */ |
470 | ret = rxrpc_krb5_decode_tagged_array(&rxk5->addresses, | 470 | ret = rxrpc_krb5_decode_tagged_array(&rxk5->addresses, |
471 | &rxk5->n_addresses, | 471 | &rxk5->n_addresses, |
472 | AFSTOKEN_K5_ADDRESSES_MAX, | 472 | AFSTOKEN_K5_ADDRESSES_MAX, |
473 | AFSTOKEN_DATA_MAX, | 473 | AFSTOKEN_DATA_MAX, |
474 | &xdr, &toklen); | 474 | &xdr, &toklen); |
475 | if (ret < 0) | 475 | if (ret < 0) |
476 | goto error; | 476 | goto error; |
477 | 477 | ||
478 | ASSERTCMP((end_xdr - xdr) << 2, ==, toklen); | 478 | ASSERTCMP((end_xdr - xdr) << 2, ==, toklen); |
479 | 479 | ||
480 | /* extract the tickets */ | 480 | /* extract the tickets */ |
481 | ret = rxrpc_krb5_decode_ticket(&rxk5->ticket, &rxk5->ticket_len, | 481 | ret = rxrpc_krb5_decode_ticket(&rxk5->ticket, &rxk5->ticket_len, |
482 | &xdr, &toklen); | 482 | &xdr, &toklen); |
483 | if (ret < 0) | 483 | if (ret < 0) |
484 | goto error; | 484 | goto error; |
485 | ret = rxrpc_krb5_decode_ticket(&rxk5->ticket2, &rxk5->ticket2_len, | 485 | ret = rxrpc_krb5_decode_ticket(&rxk5->ticket2, &rxk5->ticket2_len, |
486 | &xdr, &toklen); | 486 | &xdr, &toklen); |
487 | if (ret < 0) | 487 | if (ret < 0) |
488 | goto error; | 488 | goto error; |
489 | 489 | ||
490 | ASSERTCMP((end_xdr - xdr) << 2, ==, toklen); | 490 | ASSERTCMP((end_xdr - xdr) << 2, ==, toklen); |
491 | 491 | ||
492 | /* extract the typed auth data */ | 492 | /* extract the typed auth data */ |
493 | ret = rxrpc_krb5_decode_tagged_array(&rxk5->authdata, | 493 | ret = rxrpc_krb5_decode_tagged_array(&rxk5->authdata, |
494 | &rxk5->n_authdata, | 494 | &rxk5->n_authdata, |
495 | AFSTOKEN_K5_AUTHDATA_MAX, | 495 | AFSTOKEN_K5_AUTHDATA_MAX, |
496 | AFSTOKEN_BDATALN_MAX, | 496 | AFSTOKEN_BDATALN_MAX, |
497 | &xdr, &toklen); | 497 | &xdr, &toklen); |
498 | if (ret < 0) | 498 | if (ret < 0) |
499 | goto error; | 499 | goto error; |
500 | 500 | ||
501 | ASSERTCMP((end_xdr - xdr) << 2, ==, toklen); | 501 | ASSERTCMP((end_xdr - xdr) << 2, ==, toklen); |
502 | 502 | ||
503 | if (toklen != 0) | 503 | if (toklen != 0) |
504 | goto inval; | 504 | goto inval; |
505 | 505 | ||
506 | /* attach the payload to the key */ | 506 | /* attach the payload to the key */ |
507 | for (pptoken = (struct rxrpc_key_token **)&key->payload.data; | 507 | for (pptoken = (struct rxrpc_key_token **)&key->payload.data; |
508 | *pptoken; | 508 | *pptoken; |
509 | pptoken = &(*pptoken)->next) | 509 | pptoken = &(*pptoken)->next) |
510 | continue; | 510 | continue; |
511 | *pptoken = token; | 511 | *pptoken = token; |
512 | if (token->kad->expiry < key->expiry) | 512 | if (token->kad->expiry < key->expiry) |
513 | key->expiry = token->kad->expiry; | 513 | key->expiry = token->kad->expiry; |
514 | 514 | ||
515 | _leave(" = 0"); | 515 | _leave(" = 0"); |
516 | return 0; | 516 | return 0; |
517 | 517 | ||
518 | inval: | 518 | inval: |
519 | ret = -EINVAL; | 519 | ret = -EINVAL; |
520 | error: | 520 | error: |
521 | rxrpc_rxk5_free(rxk5); | 521 | rxrpc_rxk5_free(rxk5); |
522 | kfree(token); | 522 | kfree(token); |
523 | _leave(" = %d", ret); | 523 | _leave(" = %d", ret); |
524 | return ret; | 524 | return ret; |
525 | } | 525 | } |
526 | 526 | ||
527 | /* | 527 | /* |
528 | * attempt to parse the data as the XDR format | 528 | * attempt to parse the data as the XDR format |
529 | * - the caller guarantees we have more than 7 words | 529 | * - the caller guarantees we have more than 7 words |
530 | */ | 530 | */ |
531 | static int rxrpc_instantiate_xdr(struct key *key, const void *data, size_t datalen) | 531 | static int rxrpc_instantiate_xdr(struct key *key, const void *data, size_t datalen) |
532 | { | 532 | { |
533 | const __be32 *xdr = data, *token; | 533 | const __be32 *xdr = data, *token; |
534 | const char *cp; | 534 | const char *cp; |
535 | unsigned len, tmp, loop, ntoken, toklen, sec_ix; | 535 | unsigned len, tmp, loop, ntoken, toklen, sec_ix; |
536 | int ret; | 536 | int ret; |
537 | 537 | ||
538 | _enter(",{%x,%x,%x,%x},%zu", | 538 | _enter(",{%x,%x,%x,%x},%zu", |
539 | ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), ntohl(xdr[3]), | 539 | ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), ntohl(xdr[3]), |
540 | datalen); | 540 | datalen); |
541 | 541 | ||
542 | if (datalen > AFSTOKEN_LENGTH_MAX) | 542 | if (datalen > AFSTOKEN_LENGTH_MAX) |
543 | goto not_xdr; | 543 | goto not_xdr; |
544 | 544 | ||
545 | /* XDR is an array of __be32's */ | 545 | /* XDR is an array of __be32's */ |
546 | if (datalen & 3) | 546 | if (datalen & 3) |
547 | goto not_xdr; | 547 | goto not_xdr; |
548 | 548 | ||
549 | /* the flags should be 0 (the setpag bit must be handled by | 549 | /* the flags should be 0 (the setpag bit must be handled by |
550 | * userspace) */ | 550 | * userspace) */ |
551 | if (ntohl(*xdr++) != 0) | 551 | if (ntohl(*xdr++) != 0) |
552 | goto not_xdr; | 552 | goto not_xdr; |
553 | datalen -= 4; | 553 | datalen -= 4; |
554 | 554 | ||
555 | /* check the cell name */ | 555 | /* check the cell name */ |
556 | len = ntohl(*xdr++); | 556 | len = ntohl(*xdr++); |
557 | if (len < 1 || len > AFSTOKEN_CELL_MAX) | 557 | if (len < 1 || len > AFSTOKEN_CELL_MAX) |
558 | goto not_xdr; | 558 | goto not_xdr; |
559 | datalen -= 4; | 559 | datalen -= 4; |
560 | tmp = (len + 3) & ~3; | 560 | tmp = (len + 3) & ~3; |
561 | if (tmp > datalen) | 561 | if (tmp > datalen) |
562 | goto not_xdr; | 562 | goto not_xdr; |
563 | 563 | ||
564 | cp = (const char *) xdr; | 564 | cp = (const char *) xdr; |
565 | for (loop = 0; loop < len; loop++) | 565 | for (loop = 0; loop < len; loop++) |
566 | if (!isprint(cp[loop])) | 566 | if (!isprint(cp[loop])) |
567 | goto not_xdr; | 567 | goto not_xdr; |
568 | if (len < tmp) | 568 | if (len < tmp) |
569 | for (; loop < tmp; loop++) | 569 | for (; loop < tmp; loop++) |
570 | if (cp[loop]) | 570 | if (cp[loop]) |
571 | goto not_xdr; | 571 | goto not_xdr; |
572 | _debug("cellname: [%u/%u] '%*.*s'", | 572 | _debug("cellname: [%u/%u] '%*.*s'", |
573 | len, tmp, len, len, (const char *) xdr); | 573 | len, tmp, len, len, (const char *) xdr); |
574 | datalen -= tmp; | 574 | datalen -= tmp; |
575 | xdr += tmp >> 2; | 575 | xdr += tmp >> 2; |
576 | 576 | ||
577 | /* get the token count */ | 577 | /* get the token count */ |
578 | if (datalen < 12) | 578 | if (datalen < 12) |
579 | goto not_xdr; | 579 | goto not_xdr; |
580 | ntoken = ntohl(*xdr++); | 580 | ntoken = ntohl(*xdr++); |
581 | datalen -= 4; | 581 | datalen -= 4; |
582 | _debug("ntoken: %x", ntoken); | 582 | _debug("ntoken: %x", ntoken); |
583 | if (ntoken < 1 || ntoken > AFSTOKEN_MAX) | 583 | if (ntoken < 1 || ntoken > AFSTOKEN_MAX) |
584 | goto not_xdr; | 584 | goto not_xdr; |
585 | 585 | ||
586 | /* check each token wrapper */ | 586 | /* check each token wrapper */ |
587 | token = xdr; | 587 | token = xdr; |
588 | loop = ntoken; | 588 | loop = ntoken; |
589 | do { | 589 | do { |
590 | if (datalen < 8) | 590 | if (datalen < 8) |
591 | goto not_xdr; | 591 | goto not_xdr; |
592 | toklen = ntohl(*xdr++); | 592 | toklen = ntohl(*xdr++); |
593 | sec_ix = ntohl(*xdr); | 593 | sec_ix = ntohl(*xdr); |
594 | datalen -= 4; | 594 | datalen -= 4; |
595 | _debug("token: [%x/%zx] %x", toklen, datalen, sec_ix); | 595 | _debug("token: [%x/%zx] %x", toklen, datalen, sec_ix); |
596 | if (toklen < 20 || toklen > datalen) | 596 | if (toklen < 20 || toklen > datalen) |
597 | goto not_xdr; | 597 | goto not_xdr; |
598 | datalen -= (toklen + 3) & ~3; | 598 | datalen -= (toklen + 3) & ~3; |
599 | xdr += (toklen + 3) >> 2; | 599 | xdr += (toklen + 3) >> 2; |
600 | 600 | ||
601 | } while (--loop > 0); | 601 | } while (--loop > 0); |
602 | 602 | ||
603 | _debug("remainder: %zu", datalen); | 603 | _debug("remainder: %zu", datalen); |
604 | if (datalen != 0) | 604 | if (datalen != 0) |
605 | goto not_xdr; | 605 | goto not_xdr; |
606 | 606 | ||
607 | /* okay: we're going to assume it's valid XDR format | 607 | /* okay: we're going to assume it's valid XDR format |
608 | * - we ignore the cellname, relying on the key to be correctly named | 608 | * - we ignore the cellname, relying on the key to be correctly named |
609 | */ | 609 | */ |
610 | do { | 610 | do { |
611 | xdr = token; | 611 | xdr = token; |
612 | toklen = ntohl(*xdr++); | 612 | toklen = ntohl(*xdr++); |
613 | token = xdr + ((toklen + 3) >> 2); | 613 | token = xdr + ((toklen + 3) >> 2); |
614 | sec_ix = ntohl(*xdr++); | 614 | sec_ix = ntohl(*xdr++); |
615 | toklen -= 4; | 615 | toklen -= 4; |
616 | 616 | ||
617 | _debug("TOKEN type=%u [%p-%p]", sec_ix, xdr, token); | 617 | _debug("TOKEN type=%u [%p-%p]", sec_ix, xdr, token); |
618 | 618 | ||
619 | switch (sec_ix) { | 619 | switch (sec_ix) { |
620 | case RXRPC_SECURITY_RXKAD: | 620 | case RXRPC_SECURITY_RXKAD: |
621 | ret = rxrpc_instantiate_xdr_rxkad(key, xdr, toklen); | 621 | ret = rxrpc_instantiate_xdr_rxkad(key, xdr, toklen); |
622 | if (ret != 0) | 622 | if (ret != 0) |
623 | goto error; | 623 | goto error; |
624 | break; | 624 | break; |
625 | 625 | ||
626 | case RXRPC_SECURITY_RXK5: | 626 | case RXRPC_SECURITY_RXK5: |
627 | ret = rxrpc_instantiate_xdr_rxk5(key, xdr, toklen); | 627 | ret = rxrpc_instantiate_xdr_rxk5(key, xdr, toklen); |
628 | if (ret != 0) | 628 | if (ret != 0) |
629 | goto error; | 629 | goto error; |
630 | break; | 630 | break; |
631 | 631 | ||
632 | default: | 632 | default: |
633 | ret = -EPROTONOSUPPORT; | 633 | ret = -EPROTONOSUPPORT; |
634 | goto error; | 634 | goto error; |
635 | } | 635 | } |
636 | 636 | ||
637 | } while (--ntoken > 0); | 637 | } while (--ntoken > 0); |
638 | 638 | ||
639 | _leave(" = 0"); | 639 | _leave(" = 0"); |
640 | return 0; | 640 | return 0; |
641 | 641 | ||
642 | not_xdr: | 642 | not_xdr: |
643 | _leave(" = -EPROTO"); | 643 | _leave(" = -EPROTO"); |
644 | return -EPROTO; | 644 | return -EPROTO; |
645 | error: | 645 | error: |
646 | _leave(" = %d", ret); | 646 | _leave(" = %d", ret); |
647 | return ret; | 647 | return ret; |
648 | } | 648 | } |
649 | 649 | ||
650 | /* | 650 | /* |
651 | * instantiate an rxrpc defined key | 651 | * instantiate an rxrpc defined key |
652 | * data should be of the form: | 652 | * data should be of the form: |
653 | * OFFSET LEN CONTENT | 653 | * OFFSET LEN CONTENT |
654 | * 0 4 key interface version number | 654 | * 0 4 key interface version number |
655 | * 4 2 security index (type) | 655 | * 4 2 security index (type) |
656 | * 6 2 ticket length | 656 | * 6 2 ticket length |
657 | * 8 4 key expiry time (time_t) | 657 | * 8 4 key expiry time (time_t) |
658 | * 12 4 kvno | 658 | * 12 4 kvno |
659 | * 16 8 session key | 659 | * 16 8 session key |
660 | * 24 [len] ticket | 660 | * 24 [len] ticket |
661 | * | 661 | * |
662 | * if no data is provided, then a no-security key is made | 662 | * if no data is provided, then a no-security key is made |
663 | */ | 663 | */ |
664 | static int rxrpc_instantiate(struct key *key, const void *data, size_t datalen) | 664 | static int rxrpc_instantiate(struct key *key, const void *data, size_t datalen) |
665 | { | 665 | { |
666 | const struct rxrpc_key_data_v1 *v1; | 666 | const struct rxrpc_key_data_v1 *v1; |
667 | struct rxrpc_key_token *token, **pp; | 667 | struct rxrpc_key_token *token, **pp; |
668 | size_t plen; | 668 | size_t plen; |
669 | u32 kver; | 669 | u32 kver; |
670 | int ret; | 670 | int ret; |
671 | 671 | ||
672 | _enter("{%x},,%zu", key_serial(key), datalen); | 672 | _enter("{%x},,%zu", key_serial(key), datalen); |
673 | 673 | ||
674 | /* handle a no-security key */ | 674 | /* handle a no-security key */ |
675 | if (!data && datalen == 0) | 675 | if (!data && datalen == 0) |
676 | return 0; | 676 | return 0; |
677 | 677 | ||
678 | /* determine if the XDR payload format is being used */ | 678 | /* determine if the XDR payload format is being used */ |
679 | if (datalen > 7 * 4) { | 679 | if (datalen > 7 * 4) { |
680 | ret = rxrpc_instantiate_xdr(key, data, datalen); | 680 | ret = rxrpc_instantiate_xdr(key, data, datalen); |
681 | if (ret != -EPROTO) | 681 | if (ret != -EPROTO) |
682 | return ret; | 682 | return ret; |
683 | } | 683 | } |
684 | 684 | ||
685 | /* get the key interface version number */ | 685 | /* get the key interface version number */ |
686 | ret = -EINVAL; | 686 | ret = -EINVAL; |
687 | if (datalen <= 4 || !data) | 687 | if (datalen <= 4 || !data) |
688 | goto error; | 688 | goto error; |
689 | memcpy(&kver, data, sizeof(kver)); | 689 | memcpy(&kver, data, sizeof(kver)); |
690 | data += sizeof(kver); | 690 | data += sizeof(kver); |
691 | datalen -= sizeof(kver); | 691 | datalen -= sizeof(kver); |
692 | 692 | ||
693 | _debug("KEY I/F VERSION: %u", kver); | 693 | _debug("KEY I/F VERSION: %u", kver); |
694 | 694 | ||
695 | ret = -EKEYREJECTED; | 695 | ret = -EKEYREJECTED; |
696 | if (kver != 1) | 696 | if (kver != 1) |
697 | goto error; | 697 | goto error; |
698 | 698 | ||
699 | /* deal with a version 1 key */ | 699 | /* deal with a version 1 key */ |
700 | ret = -EINVAL; | 700 | ret = -EINVAL; |
701 | if (datalen < sizeof(*v1)) | 701 | if (datalen < sizeof(*v1)) |
702 | goto error; | 702 | goto error; |
703 | 703 | ||
704 | v1 = data; | 704 | v1 = data; |
705 | if (datalen != sizeof(*v1) + v1->ticket_length) | 705 | if (datalen != sizeof(*v1) + v1->ticket_length) |
706 | goto error; | 706 | goto error; |
707 | 707 | ||
708 | _debug("SCIX: %u", v1->security_index); | 708 | _debug("SCIX: %u", v1->security_index); |
709 | _debug("TLEN: %u", v1->ticket_length); | 709 | _debug("TLEN: %u", v1->ticket_length); |
710 | _debug("EXPY: %x", v1->expiry); | 710 | _debug("EXPY: %x", v1->expiry); |
711 | _debug("KVNO: %u", v1->kvno); | 711 | _debug("KVNO: %u", v1->kvno); |
712 | _debug("SKEY: %02x%02x%02x%02x%02x%02x%02x%02x", | 712 | _debug("SKEY: %02x%02x%02x%02x%02x%02x%02x%02x", |
713 | v1->session_key[0], v1->session_key[1], | 713 | v1->session_key[0], v1->session_key[1], |
714 | v1->session_key[2], v1->session_key[3], | 714 | v1->session_key[2], v1->session_key[3], |
715 | v1->session_key[4], v1->session_key[5], | 715 | v1->session_key[4], v1->session_key[5], |
716 | v1->session_key[6], v1->session_key[7]); | 716 | v1->session_key[6], v1->session_key[7]); |
717 | if (v1->ticket_length >= 8) | 717 | if (v1->ticket_length >= 8) |
718 | _debug("TCKT: %02x%02x%02x%02x%02x%02x%02x%02x", | 718 | _debug("TCKT: %02x%02x%02x%02x%02x%02x%02x%02x", |
719 | v1->ticket[0], v1->ticket[1], | 719 | v1->ticket[0], v1->ticket[1], |
720 | v1->ticket[2], v1->ticket[3], | 720 | v1->ticket[2], v1->ticket[3], |
721 | v1->ticket[4], v1->ticket[5], | 721 | v1->ticket[4], v1->ticket[5], |
722 | v1->ticket[6], v1->ticket[7]); | 722 | v1->ticket[6], v1->ticket[7]); |
723 | 723 | ||
724 | ret = -EPROTONOSUPPORT; | 724 | ret = -EPROTONOSUPPORT; |
725 | if (v1->security_index != RXRPC_SECURITY_RXKAD) | 725 | if (v1->security_index != RXRPC_SECURITY_RXKAD) |
726 | goto error; | 726 | goto error; |
727 | 727 | ||
728 | plen = sizeof(*token->kad) + v1->ticket_length; | 728 | plen = sizeof(*token->kad) + v1->ticket_length; |
729 | ret = key_payload_reserve(key, plen + sizeof(*token)); | 729 | ret = key_payload_reserve(key, plen + sizeof(*token)); |
730 | if (ret < 0) | 730 | if (ret < 0) |
731 | goto error; | 731 | goto error; |
732 | 732 | ||
733 | ret = -ENOMEM; | 733 | ret = -ENOMEM; |
734 | token = kmalloc(sizeof(*token), GFP_KERNEL); | 734 | token = kzalloc(sizeof(*token), GFP_KERNEL); |
735 | if (!token) | 735 | if (!token) |
736 | goto error; | 736 | goto error; |
737 | token->kad = kmalloc(plen, GFP_KERNEL); | 737 | token->kad = kzalloc(plen, GFP_KERNEL); |
738 | if (!token->kad) | 738 | if (!token->kad) |
739 | goto error_free; | 739 | goto error_free; |
740 | 740 | ||
741 | token->security_index = RXRPC_SECURITY_RXKAD; | 741 | token->security_index = RXRPC_SECURITY_RXKAD; |
742 | token->kad->ticket_len = v1->ticket_length; | 742 | token->kad->ticket_len = v1->ticket_length; |
743 | token->kad->expiry = v1->expiry; | 743 | token->kad->expiry = v1->expiry; |
744 | token->kad->kvno = v1->kvno; | 744 | token->kad->kvno = v1->kvno; |
745 | memcpy(&token->kad->session_key, &v1->session_key, 8); | 745 | memcpy(&token->kad->session_key, &v1->session_key, 8); |
746 | memcpy(&token->kad->ticket, v1->ticket, v1->ticket_length); | 746 | memcpy(&token->kad->ticket, v1->ticket, v1->ticket_length); |
747 | 747 | ||
748 | /* attach the data */ | 748 | /* attach the data */ |
749 | key->type_data.x[0]++; | 749 | key->type_data.x[0]++; |
750 | 750 | ||
751 | pp = (struct rxrpc_key_token **)&key->payload.data; | 751 | pp = (struct rxrpc_key_token **)&key->payload.data; |
752 | while (*pp) | 752 | while (*pp) |
753 | pp = &(*pp)->next; | 753 | pp = &(*pp)->next; |
754 | *pp = token; | 754 | *pp = token; |
755 | if (token->kad->expiry < key->expiry) | 755 | if (token->kad->expiry < key->expiry) |
756 | key->expiry = token->kad->expiry; | 756 | key->expiry = token->kad->expiry; |
757 | token = NULL; | 757 | token = NULL; |
758 | ret = 0; | 758 | ret = 0; |
759 | 759 | ||
760 | error_free: | 760 | error_free: |
761 | kfree(token); | 761 | kfree(token); |
762 | error: | 762 | error: |
763 | return ret; | 763 | return ret; |
764 | } | 764 | } |
765 | 765 | ||
766 | /* | 766 | /* |
767 | * instantiate a server secret key | 767 | * instantiate a server secret key |
768 | * data should be a pointer to the 8-byte secret key | 768 | * data should be a pointer to the 8-byte secret key |
769 | */ | 769 | */ |
770 | static int rxrpc_instantiate_s(struct key *key, const void *data, | 770 | static int rxrpc_instantiate_s(struct key *key, const void *data, |
771 | size_t datalen) | 771 | size_t datalen) |
772 | { | 772 | { |
773 | struct crypto_blkcipher *ci; | 773 | struct crypto_blkcipher *ci; |
774 | 774 | ||
775 | _enter("{%x},,%zu", key_serial(key), datalen); | 775 | _enter("{%x},,%zu", key_serial(key), datalen); |
776 | 776 | ||
777 | if (datalen != 8) | 777 | if (datalen != 8) |
778 | return -EINVAL; | 778 | return -EINVAL; |
779 | 779 | ||
780 | memcpy(&key->type_data, data, 8); | 780 | memcpy(&key->type_data, data, 8); |
781 | 781 | ||
782 | ci = crypto_alloc_blkcipher("pcbc(des)", 0, CRYPTO_ALG_ASYNC); | 782 | ci = crypto_alloc_blkcipher("pcbc(des)", 0, CRYPTO_ALG_ASYNC); |
783 | if (IS_ERR(ci)) { | 783 | if (IS_ERR(ci)) { |
784 | _leave(" = %ld", PTR_ERR(ci)); | 784 | _leave(" = %ld", PTR_ERR(ci)); |
785 | return PTR_ERR(ci); | 785 | return PTR_ERR(ci); |
786 | } | 786 | } |
787 | 787 | ||
788 | if (crypto_blkcipher_setkey(ci, data, 8) < 0) | 788 | if (crypto_blkcipher_setkey(ci, data, 8) < 0) |
789 | BUG(); | 789 | BUG(); |
790 | 790 | ||
791 | key->payload.data = ci; | 791 | key->payload.data = ci; |
792 | _leave(" = 0"); | 792 | _leave(" = 0"); |
793 | return 0; | 793 | return 0; |
794 | } | 794 | } |
795 | 795 | ||
796 | /* | 796 | /* |
797 | * dispose of the data dangling from the corpse of a rxrpc key | 797 | * dispose of the data dangling from the corpse of a rxrpc key |
798 | */ | 798 | */ |
799 | static void rxrpc_destroy(struct key *key) | 799 | static void rxrpc_destroy(struct key *key) |
800 | { | 800 | { |
801 | struct rxrpc_key_token *token; | 801 | struct rxrpc_key_token *token; |
802 | 802 | ||
803 | while ((token = key->payload.data)) { | 803 | while ((token = key->payload.data)) { |
804 | key->payload.data = token->next; | 804 | key->payload.data = token->next; |
805 | switch (token->security_index) { | 805 | switch (token->security_index) { |
806 | case RXRPC_SECURITY_RXKAD: | 806 | case RXRPC_SECURITY_RXKAD: |
807 | kfree(token->kad); | 807 | kfree(token->kad); |
808 | break; | 808 | break; |
809 | case RXRPC_SECURITY_RXK5: | 809 | case RXRPC_SECURITY_RXK5: |
810 | if (token->k5) | 810 | if (token->k5) |
811 | rxrpc_rxk5_free(token->k5); | 811 | rxrpc_rxk5_free(token->k5); |
812 | break; | 812 | break; |
813 | default: | 813 | default: |
814 | printk(KERN_ERR "Unknown token type %x on rxrpc key\n", | 814 | printk(KERN_ERR "Unknown token type %x on rxrpc key\n", |
815 | token->security_index); | 815 | token->security_index); |
816 | BUG(); | 816 | BUG(); |
817 | } | 817 | } |
818 | 818 | ||
819 | kfree(token); | 819 | kfree(token); |
820 | } | 820 | } |
821 | } | 821 | } |
822 | 822 | ||
823 | /* | 823 | /* |
824 | * dispose of the data dangling from the corpse of a rxrpc key | 824 | * dispose of the data dangling from the corpse of a rxrpc key |
825 | */ | 825 | */ |
826 | static void rxrpc_destroy_s(struct key *key) | 826 | static void rxrpc_destroy_s(struct key *key) |
827 | { | 827 | { |
828 | if (key->payload.data) { | 828 | if (key->payload.data) { |
829 | crypto_free_blkcipher(key->payload.data); | 829 | crypto_free_blkcipher(key->payload.data); |
830 | key->payload.data = NULL; | 830 | key->payload.data = NULL; |
831 | } | 831 | } |
832 | } | 832 | } |
833 | 833 | ||
834 | /* | 834 | /* |
835 | * describe the rxrpc key | 835 | * describe the rxrpc key |
836 | */ | 836 | */ |
837 | static void rxrpc_describe(const struct key *key, struct seq_file *m) | 837 | static void rxrpc_describe(const struct key *key, struct seq_file *m) |
838 | { | 838 | { |
839 | seq_puts(m, key->description); | 839 | seq_puts(m, key->description); |
840 | } | 840 | } |
841 | 841 | ||
842 | /* | 842 | /* |
843 | * grab the security key for a socket | 843 | * grab the security key for a socket |
844 | */ | 844 | */ |
845 | int rxrpc_request_key(struct rxrpc_sock *rx, char __user *optval, int optlen) | 845 | int rxrpc_request_key(struct rxrpc_sock *rx, char __user *optval, int optlen) |
846 | { | 846 | { |
847 | struct key *key; | 847 | struct key *key; |
848 | char *description; | 848 | char *description; |
849 | 849 | ||
850 | _enter(""); | 850 | _enter(""); |
851 | 851 | ||
852 | if (optlen <= 0 || optlen > PAGE_SIZE - 1) | 852 | if (optlen <= 0 || optlen > PAGE_SIZE - 1) |
853 | return -EINVAL; | 853 | return -EINVAL; |
854 | 854 | ||
855 | description = kmalloc(optlen + 1, GFP_KERNEL); | 855 | description = kmalloc(optlen + 1, GFP_KERNEL); |
856 | if (!description) | 856 | if (!description) |
857 | return -ENOMEM; | 857 | return -ENOMEM; |
858 | 858 | ||
859 | if (copy_from_user(description, optval, optlen)) { | 859 | if (copy_from_user(description, optval, optlen)) { |
860 | kfree(description); | 860 | kfree(description); |
861 | return -EFAULT; | 861 | return -EFAULT; |
862 | } | 862 | } |
863 | description[optlen] = 0; | 863 | description[optlen] = 0; |
864 | 864 | ||
865 | key = request_key(&key_type_rxrpc, description, NULL); | 865 | key = request_key(&key_type_rxrpc, description, NULL); |
866 | if (IS_ERR(key)) { | 866 | if (IS_ERR(key)) { |
867 | kfree(description); | 867 | kfree(description); |
868 | _leave(" = %ld", PTR_ERR(key)); | 868 | _leave(" = %ld", PTR_ERR(key)); |
869 | return PTR_ERR(key); | 869 | return PTR_ERR(key); |
870 | } | 870 | } |
871 | 871 | ||
872 | rx->key = key; | 872 | rx->key = key; |
873 | kfree(description); | 873 | kfree(description); |
874 | _leave(" = 0 [key %x]", key->serial); | 874 | _leave(" = 0 [key %x]", key->serial); |
875 | return 0; | 875 | return 0; |
876 | } | 876 | } |
877 | 877 | ||
878 | /* | 878 | /* |
879 | * grab the security keyring for a server socket | 879 | * grab the security keyring for a server socket |
880 | */ | 880 | */ |
881 | int rxrpc_server_keyring(struct rxrpc_sock *rx, char __user *optval, | 881 | int rxrpc_server_keyring(struct rxrpc_sock *rx, char __user *optval, |
882 | int optlen) | 882 | int optlen) |
883 | { | 883 | { |
884 | struct key *key; | 884 | struct key *key; |
885 | char *description; | 885 | char *description; |
886 | 886 | ||
887 | _enter(""); | 887 | _enter(""); |
888 | 888 | ||
889 | if (optlen <= 0 || optlen > PAGE_SIZE - 1) | 889 | if (optlen <= 0 || optlen > PAGE_SIZE - 1) |
890 | return -EINVAL; | 890 | return -EINVAL; |
891 | 891 | ||
892 | description = kmalloc(optlen + 1, GFP_KERNEL); | 892 | description = kmalloc(optlen + 1, GFP_KERNEL); |
893 | if (!description) | 893 | if (!description) |
894 | return -ENOMEM; | 894 | return -ENOMEM; |
895 | 895 | ||
896 | if (copy_from_user(description, optval, optlen)) { | 896 | if (copy_from_user(description, optval, optlen)) { |
897 | kfree(description); | 897 | kfree(description); |
898 | return -EFAULT; | 898 | return -EFAULT; |
899 | } | 899 | } |
900 | description[optlen] = 0; | 900 | description[optlen] = 0; |
901 | 901 | ||
902 | key = request_key(&key_type_keyring, description, NULL); | 902 | key = request_key(&key_type_keyring, description, NULL); |
903 | if (IS_ERR(key)) { | 903 | if (IS_ERR(key)) { |
904 | kfree(description); | 904 | kfree(description); |
905 | _leave(" = %ld", PTR_ERR(key)); | 905 | _leave(" = %ld", PTR_ERR(key)); |
906 | return PTR_ERR(key); | 906 | return PTR_ERR(key); |
907 | } | 907 | } |
908 | 908 | ||
909 | rx->securities = key; | 909 | rx->securities = key; |
910 | kfree(description); | 910 | kfree(description); |
911 | _leave(" = 0 [key %x]", key->serial); | 911 | _leave(" = 0 [key %x]", key->serial); |
912 | return 0; | 912 | return 0; |
913 | } | 913 | } |
914 | 914 | ||
915 | /* | 915 | /* |
916 | * generate a server data key | 916 | * generate a server data key |
917 | */ | 917 | */ |
918 | int rxrpc_get_server_data_key(struct rxrpc_connection *conn, | 918 | int rxrpc_get_server_data_key(struct rxrpc_connection *conn, |
919 | const void *session_key, | 919 | const void *session_key, |
920 | time_t expiry, | 920 | time_t expiry, |
921 | u32 kvno) | 921 | u32 kvno) |
922 | { | 922 | { |
923 | const struct cred *cred = current_cred(); | 923 | const struct cred *cred = current_cred(); |
924 | struct key *key; | 924 | struct key *key; |
925 | int ret; | 925 | int ret; |
926 | 926 | ||
927 | struct { | 927 | struct { |
928 | u32 kver; | 928 | u32 kver; |
929 | struct rxrpc_key_data_v1 v1; | 929 | struct rxrpc_key_data_v1 v1; |
930 | } data; | 930 | } data; |
931 | 931 | ||
932 | _enter(""); | 932 | _enter(""); |
933 | 933 | ||
934 | key = key_alloc(&key_type_rxrpc, "x", 0, 0, cred, 0, | 934 | key = key_alloc(&key_type_rxrpc, "x", 0, 0, cred, 0, |
935 | KEY_ALLOC_NOT_IN_QUOTA); | 935 | KEY_ALLOC_NOT_IN_QUOTA); |
936 | if (IS_ERR(key)) { | 936 | if (IS_ERR(key)) { |
937 | _leave(" = -ENOMEM [alloc %ld]", PTR_ERR(key)); | 937 | _leave(" = -ENOMEM [alloc %ld]", PTR_ERR(key)); |
938 | return -ENOMEM; | 938 | return -ENOMEM; |
939 | } | 939 | } |
940 | 940 | ||
941 | _debug("key %d", key_serial(key)); | 941 | _debug("key %d", key_serial(key)); |
942 | 942 | ||
943 | data.kver = 1; | 943 | data.kver = 1; |
944 | data.v1.security_index = RXRPC_SECURITY_RXKAD; | 944 | data.v1.security_index = RXRPC_SECURITY_RXKAD; |
945 | data.v1.ticket_length = 0; | 945 | data.v1.ticket_length = 0; |
946 | data.v1.expiry = expiry; | 946 | data.v1.expiry = expiry; |
947 | data.v1.kvno = 0; | 947 | data.v1.kvno = 0; |
948 | 948 | ||
949 | memcpy(&data.v1.session_key, session_key, sizeof(data.v1.session_key)); | 949 | memcpy(&data.v1.session_key, session_key, sizeof(data.v1.session_key)); |
950 | 950 | ||
951 | ret = key_instantiate_and_link(key, &data, sizeof(data), NULL, NULL); | 951 | ret = key_instantiate_and_link(key, &data, sizeof(data), NULL, NULL); |
952 | if (ret < 0) | 952 | if (ret < 0) |
953 | goto error; | 953 | goto error; |
954 | 954 | ||
955 | conn->key = key; | 955 | conn->key = key; |
956 | _leave(" = 0 [%d]", key_serial(key)); | 956 | _leave(" = 0 [%d]", key_serial(key)); |
957 | return 0; | 957 | return 0; |
958 | 958 | ||
959 | error: | 959 | error: |
960 | key_revoke(key); | 960 | key_revoke(key); |
961 | key_put(key); | 961 | key_put(key); |
962 | _leave(" = -ENOMEM [ins %d]", ret); | 962 | _leave(" = -ENOMEM [ins %d]", ret); |
963 | return -ENOMEM; | 963 | return -ENOMEM; |
964 | } | 964 | } |
965 | EXPORT_SYMBOL(rxrpc_get_server_data_key); | 965 | EXPORT_SYMBOL(rxrpc_get_server_data_key); |
966 | 966 | ||
967 | /** | 967 | /** |
968 | * rxrpc_get_null_key - Generate a null RxRPC key | 968 | * rxrpc_get_null_key - Generate a null RxRPC key |
969 | * @keyname: The name to give the key. | 969 | * @keyname: The name to give the key. |
970 | * | 970 | * |
971 | * Generate a null RxRPC key that can be used to indicate anonymous security is | 971 | * Generate a null RxRPC key that can be used to indicate anonymous security is |
972 | * required for a particular domain. | 972 | * required for a particular domain. |
973 | */ | 973 | */ |
974 | struct key *rxrpc_get_null_key(const char *keyname) | 974 | struct key *rxrpc_get_null_key(const char *keyname) |
975 | { | 975 | { |
976 | const struct cred *cred = current_cred(); | 976 | const struct cred *cred = current_cred(); |
977 | struct key *key; | 977 | struct key *key; |
978 | int ret; | 978 | int ret; |
979 | 979 | ||
980 | key = key_alloc(&key_type_rxrpc, keyname, 0, 0, cred, | 980 | key = key_alloc(&key_type_rxrpc, keyname, 0, 0, cred, |
981 | KEY_POS_SEARCH, KEY_ALLOC_NOT_IN_QUOTA); | 981 | KEY_POS_SEARCH, KEY_ALLOC_NOT_IN_QUOTA); |
982 | if (IS_ERR(key)) | 982 | if (IS_ERR(key)) |
983 | return key; | 983 | return key; |
984 | 984 | ||
985 | ret = key_instantiate_and_link(key, NULL, 0, NULL, NULL); | 985 | ret = key_instantiate_and_link(key, NULL, 0, NULL, NULL); |
986 | if (ret < 0) { | 986 | if (ret < 0) { |
987 | key_revoke(key); | 987 | key_revoke(key); |
988 | key_put(key); | 988 | key_put(key); |
989 | return ERR_PTR(ret); | 989 | return ERR_PTR(ret); |
990 | } | 990 | } |
991 | 991 | ||
992 | return key; | 992 | return key; |
993 | } | 993 | } |
994 | EXPORT_SYMBOL(rxrpc_get_null_key); | 994 | EXPORT_SYMBOL(rxrpc_get_null_key); |
995 | 995 | ||
996 | /* | 996 | /* |
997 | * read the contents of an rxrpc key | 997 | * read the contents of an rxrpc key |
998 | * - this returns the result in XDR form | 998 | * - this returns the result in XDR form |
999 | */ | 999 | */ |
1000 | static long rxrpc_read(const struct key *key, | 1000 | static long rxrpc_read(const struct key *key, |
1001 | char __user *buffer, size_t buflen) | 1001 | char __user *buffer, size_t buflen) |
1002 | { | 1002 | { |
1003 | const struct rxrpc_key_token *token; | 1003 | const struct rxrpc_key_token *token; |
1004 | const struct krb5_principal *princ; | 1004 | const struct krb5_principal *princ; |
1005 | size_t size; | 1005 | size_t size; |
1006 | __be32 __user *xdr, *oldxdr; | 1006 | __be32 __user *xdr, *oldxdr; |
1007 | u32 cnlen, toksize, ntoks, tok, zero; | 1007 | u32 cnlen, toksize, ntoks, tok, zero; |
1008 | u16 toksizes[AFSTOKEN_MAX]; | 1008 | u16 toksizes[AFSTOKEN_MAX]; |
1009 | int loop; | 1009 | int loop; |
1010 | 1010 | ||
1011 | _enter(""); | 1011 | _enter(""); |
1012 | 1012 | ||
1013 | /* we don't know what form we should return non-AFS keys in */ | 1013 | /* we don't know what form we should return non-AFS keys in */ |
1014 | if (memcmp(key->description, "afs@", 4) != 0) | 1014 | if (memcmp(key->description, "afs@", 4) != 0) |
1015 | return -EOPNOTSUPP; | 1015 | return -EOPNOTSUPP; |
1016 | cnlen = strlen(key->description + 4); | 1016 | cnlen = strlen(key->description + 4); |
1017 | 1017 | ||
1018 | #define RND(X) (((X) + 3) & ~3) | 1018 | #define RND(X) (((X) + 3) & ~3) |
1019 | 1019 | ||
1020 | /* AFS keys we return in XDR form, so we need to work out the size of | 1020 | /* AFS keys we return in XDR form, so we need to work out the size of |
1021 | * the XDR */ | 1021 | * the XDR */ |
1022 | size = 2 * 4; /* flags, cellname len */ | 1022 | size = 2 * 4; /* flags, cellname len */ |
1023 | size += RND(cnlen); /* cellname */ | 1023 | size += RND(cnlen); /* cellname */ |
1024 | size += 1 * 4; /* token count */ | 1024 | size += 1 * 4; /* token count */ |
1025 | 1025 | ||
1026 | ntoks = 0; | 1026 | ntoks = 0; |
1027 | for (token = key->payload.data; token; token = token->next) { | 1027 | for (token = key->payload.data; token; token = token->next) { |
1028 | toksize = 4; /* sec index */ | 1028 | toksize = 4; /* sec index */ |
1029 | 1029 | ||
1030 | switch (token->security_index) { | 1030 | switch (token->security_index) { |
1031 | case RXRPC_SECURITY_RXKAD: | 1031 | case RXRPC_SECURITY_RXKAD: |
1032 | toksize += 8 * 4; /* viceid, kvno, key*2, begin, | 1032 | toksize += 8 * 4; /* viceid, kvno, key*2, begin, |
1033 | * end, primary, tktlen */ | 1033 | * end, primary, tktlen */ |
1034 | toksize += RND(token->kad->ticket_len); | 1034 | toksize += RND(token->kad->ticket_len); |
1035 | break; | 1035 | break; |
1036 | 1036 | ||
1037 | case RXRPC_SECURITY_RXK5: | 1037 | case RXRPC_SECURITY_RXK5: |
1038 | princ = &token->k5->client; | 1038 | princ = &token->k5->client; |
1039 | toksize += 4 + princ->n_name_parts * 4; | 1039 | toksize += 4 + princ->n_name_parts * 4; |
1040 | for (loop = 0; loop < princ->n_name_parts; loop++) | 1040 | for (loop = 0; loop < princ->n_name_parts; loop++) |
1041 | toksize += RND(strlen(princ->name_parts[loop])); | 1041 | toksize += RND(strlen(princ->name_parts[loop])); |
1042 | toksize += 4 + RND(strlen(princ->realm)); | 1042 | toksize += 4 + RND(strlen(princ->realm)); |
1043 | 1043 | ||
1044 | princ = &token->k5->server; | 1044 | princ = &token->k5->server; |
1045 | toksize += 4 + princ->n_name_parts * 4; | 1045 | toksize += 4 + princ->n_name_parts * 4; |
1046 | for (loop = 0; loop < princ->n_name_parts; loop++) | 1046 | for (loop = 0; loop < princ->n_name_parts; loop++) |
1047 | toksize += RND(strlen(princ->name_parts[loop])); | 1047 | toksize += RND(strlen(princ->name_parts[loop])); |
1048 | toksize += 4 + RND(strlen(princ->realm)); | 1048 | toksize += 4 + RND(strlen(princ->realm)); |
1049 | 1049 | ||
1050 | toksize += 8 + RND(token->k5->session.data_len); | 1050 | toksize += 8 + RND(token->k5->session.data_len); |
1051 | 1051 | ||
1052 | toksize += 4 * 8 + 2 * 4; | 1052 | toksize += 4 * 8 + 2 * 4; |
1053 | 1053 | ||
1054 | toksize += 4 + token->k5->n_addresses * 8; | 1054 | toksize += 4 + token->k5->n_addresses * 8; |
1055 | for (loop = 0; loop < token->k5->n_addresses; loop++) | 1055 | for (loop = 0; loop < token->k5->n_addresses; loop++) |
1056 | toksize += RND(token->k5->addresses[loop].data_len); | 1056 | toksize += RND(token->k5->addresses[loop].data_len); |
1057 | 1057 | ||
1058 | toksize += 4 + RND(token->k5->ticket_len); | 1058 | toksize += 4 + RND(token->k5->ticket_len); |
1059 | toksize += 4 + RND(token->k5->ticket2_len); | 1059 | toksize += 4 + RND(token->k5->ticket2_len); |
1060 | 1060 | ||
1061 | toksize += 4 + token->k5->n_authdata * 8; | 1061 | toksize += 4 + token->k5->n_authdata * 8; |
1062 | for (loop = 0; loop < token->k5->n_authdata; loop++) | 1062 | for (loop = 0; loop < token->k5->n_authdata; loop++) |
1063 | toksize += RND(token->k5->authdata[loop].data_len); | 1063 | toksize += RND(token->k5->authdata[loop].data_len); |
1064 | break; | 1064 | break; |
1065 | 1065 | ||
1066 | default: /* we have a ticket we can't encode */ | 1066 | default: /* we have a ticket we can't encode */ |
1067 | BUG(); | 1067 | BUG(); |
1068 | continue; | 1068 | continue; |
1069 | } | 1069 | } |
1070 | 1070 | ||
1071 | _debug("token[%u]: toksize=%u", ntoks, toksize); | 1071 | _debug("token[%u]: toksize=%u", ntoks, toksize); |
1072 | ASSERTCMP(toksize, <=, AFSTOKEN_LENGTH_MAX); | 1072 | ASSERTCMP(toksize, <=, AFSTOKEN_LENGTH_MAX); |
1073 | 1073 | ||
1074 | toksizes[ntoks++] = toksize; | 1074 | toksizes[ntoks++] = toksize; |
1075 | size += toksize + 4; /* each token has a length word */ | 1075 | size += toksize + 4; /* each token has a length word */ |
1076 | } | 1076 | } |
1077 | 1077 | ||
1078 | #undef RND | 1078 | #undef RND |
1079 | 1079 | ||
1080 | if (!buffer || buflen < size) | 1080 | if (!buffer || buflen < size) |
1081 | return size; | 1081 | return size; |
1082 | 1082 | ||
1083 | xdr = (__be32 __user *) buffer; | 1083 | xdr = (__be32 __user *) buffer; |
1084 | zero = 0; | 1084 | zero = 0; |
1085 | #define ENCODE(x) \ | 1085 | #define ENCODE(x) \ |
1086 | do { \ | 1086 | do { \ |
1087 | __be32 y = htonl(x); \ | 1087 | __be32 y = htonl(x); \ |
1088 | if (put_user(y, xdr++) < 0) \ | 1088 | if (put_user(y, xdr++) < 0) \ |
1089 | goto fault; \ | 1089 | goto fault; \ |
1090 | } while(0) | 1090 | } while(0) |
1091 | #define ENCODE_DATA(l, s) \ | 1091 | #define ENCODE_DATA(l, s) \ |
1092 | do { \ | 1092 | do { \ |
1093 | u32 _l = (l); \ | 1093 | u32 _l = (l); \ |
1094 | ENCODE(l); \ | 1094 | ENCODE(l); \ |
1095 | if (copy_to_user(xdr, (s), _l) != 0) \ | 1095 | if (copy_to_user(xdr, (s), _l) != 0) \ |
1096 | goto fault; \ | 1096 | goto fault; \ |
1097 | if (_l & 3 && \ | 1097 | if (_l & 3 && \ |
1098 | copy_to_user((u8 *)xdr + _l, &zero, 4 - (_l & 3)) != 0) \ | 1098 | copy_to_user((u8 *)xdr + _l, &zero, 4 - (_l & 3)) != 0) \ |
1099 | goto fault; \ | 1099 | goto fault; \ |
1100 | xdr += (_l + 3) >> 2; \ | 1100 | xdr += (_l + 3) >> 2; \ |
1101 | } while(0) | 1101 | } while(0) |
1102 | #define ENCODE64(x) \ | 1102 | #define ENCODE64(x) \ |
1103 | do { \ | 1103 | do { \ |
1104 | __be64 y = cpu_to_be64(x); \ | 1104 | __be64 y = cpu_to_be64(x); \ |
1105 | if (copy_to_user(xdr, &y, 8) != 0) \ | 1105 | if (copy_to_user(xdr, &y, 8) != 0) \ |
1106 | goto fault; \ | 1106 | goto fault; \ |
1107 | xdr += 8 >> 2; \ | 1107 | xdr += 8 >> 2; \ |
1108 | } while(0) | 1108 | } while(0) |
1109 | #define ENCODE_STR(s) \ | 1109 | #define ENCODE_STR(s) \ |
1110 | do { \ | 1110 | do { \ |
1111 | const char *_s = (s); \ | 1111 | const char *_s = (s); \ |
1112 | ENCODE_DATA(strlen(_s), _s); \ | 1112 | ENCODE_DATA(strlen(_s), _s); \ |
1113 | } while(0) | 1113 | } while(0) |
1114 | 1114 | ||
1115 | ENCODE(0); /* flags */ | 1115 | ENCODE(0); /* flags */ |
1116 | ENCODE_DATA(cnlen, key->description + 4); /* cellname */ | 1116 | ENCODE_DATA(cnlen, key->description + 4); /* cellname */ |
1117 | ENCODE(ntoks); | 1117 | ENCODE(ntoks); |
1118 | 1118 | ||
1119 | tok = 0; | 1119 | tok = 0; |
1120 | for (token = key->payload.data; token; token = token->next) { | 1120 | for (token = key->payload.data; token; token = token->next) { |
1121 | toksize = toksizes[tok++]; | 1121 | toksize = toksizes[tok++]; |
1122 | ENCODE(toksize); | 1122 | ENCODE(toksize); |
1123 | oldxdr = xdr; | 1123 | oldxdr = xdr; |
1124 | ENCODE(token->security_index); | 1124 | ENCODE(token->security_index); |
1125 | 1125 | ||
1126 | switch (token->security_index) { | 1126 | switch (token->security_index) { |
1127 | case RXRPC_SECURITY_RXKAD: | 1127 | case RXRPC_SECURITY_RXKAD: |
1128 | ENCODE(token->kad->vice_id); | 1128 | ENCODE(token->kad->vice_id); |
1129 | ENCODE(token->kad->kvno); | 1129 | ENCODE(token->kad->kvno); |
1130 | ENCODE_DATA(8, token->kad->session_key); | 1130 | ENCODE_DATA(8, token->kad->session_key); |
1131 | ENCODE(token->kad->start); | 1131 | ENCODE(token->kad->start); |
1132 | ENCODE(token->kad->expiry); | 1132 | ENCODE(token->kad->expiry); |
1133 | ENCODE(token->kad->primary_flag); | 1133 | ENCODE(token->kad->primary_flag); |
1134 | ENCODE_DATA(token->kad->ticket_len, token->kad->ticket); | 1134 | ENCODE_DATA(token->kad->ticket_len, token->kad->ticket); |
1135 | break; | 1135 | break; |
1136 | 1136 | ||
1137 | case RXRPC_SECURITY_RXK5: | 1137 | case RXRPC_SECURITY_RXK5: |
1138 | princ = &token->k5->client; | 1138 | princ = &token->k5->client; |
1139 | ENCODE(princ->n_name_parts); | 1139 | ENCODE(princ->n_name_parts); |
1140 | for (loop = 0; loop < princ->n_name_parts; loop++) | 1140 | for (loop = 0; loop < princ->n_name_parts; loop++) |
1141 | ENCODE_STR(princ->name_parts[loop]); | 1141 | ENCODE_STR(princ->name_parts[loop]); |
1142 | ENCODE_STR(princ->realm); | 1142 | ENCODE_STR(princ->realm); |
1143 | 1143 | ||
1144 | princ = &token->k5->server; | 1144 | princ = &token->k5->server; |
1145 | ENCODE(princ->n_name_parts); | 1145 | ENCODE(princ->n_name_parts); |
1146 | for (loop = 0; loop < princ->n_name_parts; loop++) | 1146 | for (loop = 0; loop < princ->n_name_parts; loop++) |
1147 | ENCODE_STR(princ->name_parts[loop]); | 1147 | ENCODE_STR(princ->name_parts[loop]); |
1148 | ENCODE_STR(princ->realm); | 1148 | ENCODE_STR(princ->realm); |
1149 | 1149 | ||
1150 | ENCODE(token->k5->session.tag); | 1150 | ENCODE(token->k5->session.tag); |
1151 | ENCODE_DATA(token->k5->session.data_len, | 1151 | ENCODE_DATA(token->k5->session.data_len, |
1152 | token->k5->session.data); | 1152 | token->k5->session.data); |
1153 | 1153 | ||
1154 | ENCODE64(token->k5->authtime); | 1154 | ENCODE64(token->k5->authtime); |
1155 | ENCODE64(token->k5->starttime); | 1155 | ENCODE64(token->k5->starttime); |
1156 | ENCODE64(token->k5->endtime); | 1156 | ENCODE64(token->k5->endtime); |
1157 | ENCODE64(token->k5->renew_till); | 1157 | ENCODE64(token->k5->renew_till); |
1158 | ENCODE(token->k5->is_skey); | 1158 | ENCODE(token->k5->is_skey); |
1159 | ENCODE(token->k5->flags); | 1159 | ENCODE(token->k5->flags); |
1160 | 1160 | ||
1161 | ENCODE(token->k5->n_addresses); | 1161 | ENCODE(token->k5->n_addresses); |
1162 | for (loop = 0; loop < token->k5->n_addresses; loop++) { | 1162 | for (loop = 0; loop < token->k5->n_addresses; loop++) { |
1163 | ENCODE(token->k5->addresses[loop].tag); | 1163 | ENCODE(token->k5->addresses[loop].tag); |
1164 | ENCODE_DATA(token->k5->addresses[loop].data_len, | 1164 | ENCODE_DATA(token->k5->addresses[loop].data_len, |
1165 | token->k5->addresses[loop].data); | 1165 | token->k5->addresses[loop].data); |
1166 | } | 1166 | } |
1167 | 1167 | ||
1168 | ENCODE_DATA(token->k5->ticket_len, token->k5->ticket); | 1168 | ENCODE_DATA(token->k5->ticket_len, token->k5->ticket); |
1169 | ENCODE_DATA(token->k5->ticket2_len, token->k5->ticket2); | 1169 | ENCODE_DATA(token->k5->ticket2_len, token->k5->ticket2); |
1170 | 1170 | ||
1171 | ENCODE(token->k5->n_authdata); | 1171 | ENCODE(token->k5->n_authdata); |
1172 | for (loop = 0; loop < token->k5->n_authdata; loop++) { | 1172 | for (loop = 0; loop < token->k5->n_authdata; loop++) { |
1173 | ENCODE(token->k5->authdata[loop].tag); | 1173 | ENCODE(token->k5->authdata[loop].tag); |
1174 | ENCODE_DATA(token->k5->authdata[loop].data_len, | 1174 | ENCODE_DATA(token->k5->authdata[loop].data_len, |
1175 | token->k5->authdata[loop].data); | 1175 | token->k5->authdata[loop].data); |
1176 | } | 1176 | } |
1177 | break; | 1177 | break; |
1178 | 1178 | ||
1179 | default: | 1179 | default: |
1180 | BUG(); | 1180 | BUG(); |
1181 | break; | 1181 | break; |
1182 | } | 1182 | } |
1183 | 1183 | ||
1184 | ASSERTCMP((unsigned long)xdr - (unsigned long)oldxdr, ==, | 1184 | ASSERTCMP((unsigned long)xdr - (unsigned long)oldxdr, ==, |
1185 | toksize); | 1185 | toksize); |
1186 | } | 1186 | } |
1187 | 1187 | ||
1188 | #undef ENCODE_STR | 1188 | #undef ENCODE_STR |
1189 | #undef ENCODE_DATA | 1189 | #undef ENCODE_DATA |
1190 | #undef ENCODE64 | 1190 | #undef ENCODE64 |
1191 | #undef ENCODE | 1191 | #undef ENCODE |
1192 | 1192 | ||
1193 | ASSERTCMP(tok, ==, ntoks); | 1193 | ASSERTCMP(tok, ==, ntoks); |
1194 | ASSERTCMP((char __user *) xdr - buffer, ==, size); | 1194 | ASSERTCMP((char __user *) xdr - buffer, ==, size); |
1195 | _leave(" = %zu", size); | 1195 | _leave(" = %zu", size); |
1196 | return size; | 1196 | return size; |
1197 | 1197 | ||
1198 | fault: | 1198 | fault: |
1199 | _leave(" = -EFAULT"); | 1199 | _leave(" = -EFAULT"); |
1200 | return -EFAULT; | 1200 | return -EFAULT; |
1201 | } | 1201 | } |
1202 | 1202 |