/* * linux/net/sunrpc/gss_krb5_crypto.c * * Copyright (c) 2000-2008 The Regents of the University of Michigan. * All rights reserved. * * Andy Adamson <andros@umich.edu> * Bruce Fields <bfields@umich.edu> */ /* * Copyright (C) 1998 by the FundsXpress, INC. * * All rights reserved. * * Export of this software from the United States of America may require * a specific license from the United States Government. It is the * responsibility of any person or organization contemplating export to * obtain such a license before exporting. * * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and * distribute this software and its documentation for any purpose and * without fee is hereby granted, provided that the above copyright * notice appear in all copies and that both that copyright notice and * this permission notice appear in supporting documentation, and that * the name of FundsXpress. not be used in advertising or publicity pertaining * to distribution of the software without specific, written prior * permission. FundsXpress makes no representations about the suitability of * this software for any purpose. It is provided "as is" without express * or implied warranty. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ #include <linux/err.h> #include <linux/types.h> #include <linux/mm.h> #include <linux/scatterlist.h> #include <linux/highmem.h> #include <linux/pagemap.h> #include <linux/sunrpc/gss_krb5.h> #include <linux/sunrpc/xdr.h> #include "gss_krb5_internal.h" #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) # define RPCDBG_FACILITY RPCDBG_AUTH #endif /* * This function makes the assumption that it was ultimately called * from gss_wrap(). * * The client auth_gss code moves any existing tail data into a * separate page before calling gss_wrap. * The server svcauth_gss code ensures that both the head and the * tail have slack space of RPC_MAX_AUTH_SIZE before calling gss_wrap. * * Even with that guarantee, this function may be called more than * once in the processing of gss_wrap(). The best we can do is * verify at compile-time (see GSS_KRB5_MAX_SLACK_NEEDED) that the * largest expected shift will fit within RPC_MAX_AUTH_SIZE. * At run-time we can verify that a single invocation of this * function doesn't attempt to use more the RPC_MAX_AUTH_SIZE. */ int xdr_extend_head(struct xdr_buf *buf, unsigned int base, unsigned int shiftlen) { u8 *p; if (shiftlen == 0) return 0; BUG_ON(shiftlen > RPC_MAX_AUTH_SIZE); p = buf->head[0].iov_base + base; memmove(p + shiftlen, p, buf->head[0].iov_len - base); buf->head[0].iov_len += shiftlen; buf->len += shiftlen; return 0; } /** * gss_krb5_aead_encrypt - Encrypt a wrap token using crypto/krb5 * @kctx: Kerberos context * @offset: byte offset of the GSS token header in @buf * @buf: OUT: send buffer * @pages: plaintext payload pages (page cache data) * * The xdr_buf setup mirrors the original per-enctype encrypt * functions, but the CBC-CTS encryption and HMAC are replaced * by a single AEAD operation through the crypto/krb5 library. * * Return values: * %GSS_S_COMPLETE: Encryption successful * %GSS_S_FAILURE: Encryption failed */ u32 gss_krb5_aead_encrypt(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf, struct page **pages) { const struct krb5_enctype *krb5 = kctx->krb5e; struct crypto_aead *aead = kctx->initiate ? kctx->initiator_enc_aead : kctx->acceptor_enc_aead; unsigned int conflen = krb5->conf_len; unsigned int cksum_len = krb5->cksum_len; unsigned int sec_offset, sec_len, data_len; struct scatterlist sg[XDR_BUF_TO_SG_NENTS]; struct scatterlist *sg_overflow = NULL; ssize_t ret; int nsg; /* Insert space for the confounder */ if (xdr_extend_head(buf, offset + GSS_KRB5_TOK_HDR_LEN, conflen)) return GSS_S_FAILURE; /* Ensure a tail segment exists */ if (buf->tail[0].iov_base == NULL) { buf->tail[0].iov_base = buf->head[0].iov_base + buf->head[0].iov_len; buf->tail[0].iov_len = 0; } /* Append a copy of the plaintext GSS token header (RFC 4121 Sec 4.2.4) */ memcpy(buf->tail[0].iov_base + buf->tail[0].iov_len, buf->head[0].iov_base + offset, GSS_KRB5_TOK_HDR_LEN); buf->tail[0].iov_len += GSS_KRB5_TOK_HDR_LEN; buf->len += GSS_KRB5_TOK_HDR_LEN; /* Reserve space for the integrity checksum */ buf->tail[0].iov_len += cksum_len; buf->len += cksum_len; /* * The AEAD operates in-place, but on the client send path the * plaintext payload lives in page cache pages that must not be * modified. Copy the payload into the scratch output pages * first. On the server send path @pages and buf->pages are * the same array, and no copy is needed. * * Both arrays share buf->page_base, so the same index and * intra-page offset address corresponding data in each. */ if (pages != buf->pages) { unsigned int poff = buf->page_base; unsigned int plen = buf->page_len; unsigned int i = poff >> PAGE_SHIFT; unsigned int off = offset_in_page(poff); while (plen) { unsigned int n = min_t(unsigned int, plen, PAGE_SIZE - off); memcpy_page(buf->pages[i], off, pages[i], off, n); plen -= n; i++; off = 0; } } /* Build scatterlist covering the secured region */ sec_offset = offset + GSS_KRB5_TOK_HDR_LEN; sec_len = buf->len - sec_offset; data_len = sec_len - conflen - cksum_len; nsg = xdr_buf_to_sg_alloc(buf, sec_offset, sec_len, sg, ARRAY_SIZE(sg), &sg_overflow, GFP_NOFS); if (nsg < 0) return GSS_S_FAILURE; ret = crypto_krb5_encrypt(krb5, aead, sg, nsg, sec_len, conflen, data_len, false); kfree(sg_overflow); if (ret < 0) return GSS_S_FAILURE; return GSS_S_COMPLETE; } /** * gss_krb5_aead_decrypt - Decrypt a wrap token using crypto/krb5 * @kctx: Kerberos context * @offset: byte offset of the GSS token header in @buf * @len: total length of the GSS token * @buf: ciphertext buffer, decrypted in-place * @headskip: OUT: confounder length, in octets * @tailskip: OUT: checksum length, in octets * * Return values: * %GSS_S_COMPLETE: Decryption and integrity verification succeeded * %GSS_S_BAD_SIG: Integrity checksum did not match * %GSS_S_DEFECTIVE_TOKEN: Token is malformed or truncated * %GSS_S_FAILURE: Decryption failed */ u32 gss_krb5_aead_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len, struct xdr_buf *buf, u32 *headskip, u32 *tailskip) { const struct krb5_enctype *krb5 = kctx->krb5e; struct crypto_aead *aead = kctx->initiate ? kctx->acceptor_enc_aead : kctx->initiator_enc_aead; unsigned int sec_offset, sec_len; size_t data_offset, data_len; struct scatterlist sg[XDR_BUF_TO_SG_NENTS]; struct scatterlist *sg_overflow = NULL; int nsg, ret; /* Secured region starts after the GSS token header */ sec_offset = offset + GSS_KRB5_TOK_HDR_LEN; if (len < sec_offset) return GSS_S_DEFECTIVE_TOKEN; sec_len = len - sec_offset; nsg = xdr_buf_to_sg_alloc(buf, sec_offset, sec_len, sg, ARRAY_SIZE(sg), &sg_overflow, GFP_NOFS); if (nsg < 0) return GSS_S_FAILURE; data_offset = 0; data_len = sec_len; ret = crypto_krb5_decrypt(krb5, aead, sg, nsg, &data_offset, &data_len); kfree(sg_overflow); if (ret < 0) return gss_krb5_errno_to_status(ret); *headskip = data_offset; *tailskip = sec_len - data_offset - data_len; return GSS_S_COMPLETE; } /** * gss_krb5_mic_build_sg - Build scatterlist for MIC token operations * @body: xdr_buf containing the message body * @cksum: pointer to checksum area in the token buffer * @cksum_len: length of checksum area * @hdr: pointer to GSS token header * @sg_head: caller-provided scatterlist array; if more than * XDR_BUF_TO_SG_NENTS entries are needed, an overflow * scatterlist is allocated and chained automatically * @sg_overflow: OUT: overflow scatterlist, caller must kfree * * Per RFC 4121 Section 4.2.4, MIC token checksums cover the * message body followed by the token header. The checksum * output or received checksum occupies the first scatterlist * entry. This layout cannot be constructed by * xdr_buf_to_sg_alloc() because the checksum area and the GSS * header lie outside the xdr_buf. * * Returns the number of scatterlist entries on success, or a * negative errno on failure. */ int gss_krb5_mic_build_sg(const struct xdr_buf *body, void *cksum, unsigned int cksum_len, void *hdr, struct scatterlist *sg_head, struct scatterlist **sg_overflow) { struct scatterlist *entry; int body_max, body_nsg, nsg; *sg_overflow = NULL; body_max = 2; if (body->page_len) body_max += DIV_ROUND_UP(body->page_len + offset_in_page(body->page_base), PAGE_SIZE); nsg = 1 + body_max + 1; if (nsg <= XDR_BUF_TO_SG_NENTS) { sg_init_table(sg_head, nsg); } else { unsigned int overflow_nents = nsg - XDR_BUF_TO_SG_NENTS + 1; *sg_overflow = kmalloc_array(overflow_nents, sizeof(**sg_overflow), GFP_NOFS); if (!*sg_overflow) return -ENOMEM; sg_init_table(sg_head, XDR_BUF_TO_SG_NENTS); sg_init_table(*sg_overflow, overflow_nents); sg_chain(sg_head, XDR_BUF_TO_SG_NENTS, *sg_overflow); } sg_set_buf(&sg_head[0], cksum, cksum_len); body_nsg = xdr_buf_to_sg(body, 0, body->len, sg_next(&sg_head[0]), body_max); if (body_nsg < 0) goto out_err; /* * xdr_buf_to_sg marks the last body entry as end-of-list; * clear it so the trailing header entry is reachable. */ if (body_nsg > 0) { entry = sg_last(sg_next(&sg_head[0]), body_nsg); sg_unmark_end(entry); entry = sg_next(entry); } else { entry = sg_next(&sg_head[0]); } sg_set_buf(entry, hdr, GSS_KRB5_TOK_HDR_LEN); sg_mark_end(entry); return 1 + body_nsg + 1; out_err: kfree(*sg_overflow); *sg_overflow = NULL; return body_nsg; }
