1 // SPDX-License-Identifier: GPL-2.0-or-later 1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* RxRPC key management 2 /* RxRPC key management
3 * 3 *
4 * Copyright (C) 2007 Red Hat, Inc. All Rights 4 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.c 5 * Written by David Howells (dhowells@redhat.com)
6 * 6 *
7 * RxRPC keys should have a description of des 7 * RxRPC keys should have a description of describing their purpose:
8 * "afs@CAMBRIDGE.REDHAT.COM> 8 * "afs@CAMBRIDGE.REDHAT.COM>
9 */ 9 */
10 10
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12 12
13 #include <crypto/skcipher.h> 13 #include <crypto/skcipher.h>
14 #include <linux/module.h> 14 #include <linux/module.h>
15 #include <linux/net.h> 15 #include <linux/net.h>
16 #include <linux/skbuff.h> 16 #include <linux/skbuff.h>
17 #include <linux/key-type.h> 17 #include <linux/key-type.h>
18 #include <linux/ctype.h> 18 #include <linux/ctype.h>
19 #include <linux/slab.h> 19 #include <linux/slab.h>
20 #include <net/sock.h> 20 #include <net/sock.h>
21 #include <net/af_rxrpc.h> 21 #include <net/af_rxrpc.h>
22 #include <keys/rxrpc-type.h> 22 #include <keys/rxrpc-type.h>
23 #include <keys/user-type.h> 23 #include <keys/user-type.h>
24 #include "ar-internal.h" 24 #include "ar-internal.h"
25 25
26 static int rxrpc_vet_description_s(const char 26 static int rxrpc_vet_description_s(const char *);
27 static int rxrpc_preparse_s(struct key_prepars 27 static int rxrpc_preparse_s(struct key_preparsed_payload *);
28 static void rxrpc_free_preparse_s(struct key_p 28 static void rxrpc_free_preparse_s(struct key_preparsed_payload *);
29 static void rxrpc_destroy_s(struct key *); 29 static void rxrpc_destroy_s(struct key *);
30 static void rxrpc_describe_s(const struct key 30 static void rxrpc_describe_s(const struct key *, struct seq_file *);
31 31
32 /* 32 /*
33 * rxrpc server keys take "<serviceId>:<securi 33 * rxrpc server keys take "<serviceId>:<securityIndex>[:<sec-specific>]" as the
34 * description and the key material as the pay 34 * description and the key material as the payload.
35 */ 35 */
36 struct key_type key_type_rxrpc_s = { 36 struct key_type key_type_rxrpc_s = {
37 .name = "rxrpc_s", 37 .name = "rxrpc_s",
38 .flags = KEY_TYPE_NET_DOMAIN, 38 .flags = KEY_TYPE_NET_DOMAIN,
39 .vet_description = rxrpc_vet_descripti 39 .vet_description = rxrpc_vet_description_s,
40 .preparse = rxrpc_preparse_s, 40 .preparse = rxrpc_preparse_s,
41 .free_preparse = rxrpc_free_preparse_ 41 .free_preparse = rxrpc_free_preparse_s,
42 .instantiate = generic_key_instanti 42 .instantiate = generic_key_instantiate,
43 .destroy = rxrpc_destroy_s, 43 .destroy = rxrpc_destroy_s,
44 .describe = rxrpc_describe_s, 44 .describe = rxrpc_describe_s,
45 }; 45 };
46 46
47 /* 47 /*
48 * Vet the description for an RxRPC server key 48 * Vet the description for an RxRPC server key.
49 */ 49 */
50 static int rxrpc_vet_description_s(const char 50 static int rxrpc_vet_description_s(const char *desc)
51 { 51 {
52 unsigned long service, sec_class; 52 unsigned long service, sec_class;
53 char *p; 53 char *p;
54 54
55 service = simple_strtoul(desc, &p, 10) 55 service = simple_strtoul(desc, &p, 10);
56 if (*p != ':' || service > 65535) 56 if (*p != ':' || service > 65535)
57 return -EINVAL; 57 return -EINVAL;
58 sec_class = simple_strtoul(p + 1, &p, 58 sec_class = simple_strtoul(p + 1, &p, 10);
59 if ((*p && *p != ':') || sec_class < 1 59 if ((*p && *p != ':') || sec_class < 1 || sec_class > 255)
60 return -EINVAL; 60 return -EINVAL;
61 return 0; 61 return 0;
62 } 62 }
63 63
64 /* 64 /*
65 * Preparse a server secret key. 65 * Preparse a server secret key.
66 */ 66 */
67 static int rxrpc_preparse_s(struct key_prepars 67 static int rxrpc_preparse_s(struct key_preparsed_payload *prep)
68 { 68 {
69 const struct rxrpc_security *sec; 69 const struct rxrpc_security *sec;
70 unsigned int service, sec_class; 70 unsigned int service, sec_class;
71 int n; 71 int n;
72 72
73 _enter("%zu", prep->datalen); 73 _enter("%zu", prep->datalen);
74 74
75 if (!prep->orig_description) 75 if (!prep->orig_description)
76 return -EINVAL; 76 return -EINVAL;
77 77
78 if (sscanf(prep->orig_description, "%u 78 if (sscanf(prep->orig_description, "%u:%u%n", &service, &sec_class, &n) != 2)
79 return -EINVAL; 79 return -EINVAL;
80 80
81 sec = rxrpc_security_lookup(sec_class) 81 sec = rxrpc_security_lookup(sec_class);
82 if (!sec) 82 if (!sec)
83 return -ENOPKG; 83 return -ENOPKG;
84 84
85 prep->payload.data[1] = (struct rxrpc_ 85 prep->payload.data[1] = (struct rxrpc_security *)sec;
86 86
87 if (!sec->preparse_server_key) 87 if (!sec->preparse_server_key)
88 return -EINVAL; 88 return -EINVAL;
89 89
90 return sec->preparse_server_key(prep); 90 return sec->preparse_server_key(prep);
91 } 91 }
92 92
93 static void rxrpc_free_preparse_s(struct key_p 93 static void rxrpc_free_preparse_s(struct key_preparsed_payload *prep)
94 { 94 {
95 const struct rxrpc_security *sec = pre 95 const struct rxrpc_security *sec = prep->payload.data[1];
96 96
97 if (sec && sec->free_preparse_server_k 97 if (sec && sec->free_preparse_server_key)
98 sec->free_preparse_server_key( 98 sec->free_preparse_server_key(prep);
99 } 99 }
100 100
101 static void rxrpc_destroy_s(struct key *key) 101 static void rxrpc_destroy_s(struct key *key)
102 { 102 {
103 const struct rxrpc_security *sec = key 103 const struct rxrpc_security *sec = key->payload.data[1];
104 104
105 if (sec && sec->destroy_server_key) 105 if (sec && sec->destroy_server_key)
106 sec->destroy_server_key(key); 106 sec->destroy_server_key(key);
107 } 107 }
108 108
109 static void rxrpc_describe_s(const struct key 109 static void rxrpc_describe_s(const struct key *key, struct seq_file *m)
110 { 110 {
111 const struct rxrpc_security *sec = key 111 const struct rxrpc_security *sec = key->payload.data[1];
112 112
113 seq_puts(m, key->description); 113 seq_puts(m, key->description);
114 if (sec && sec->describe_server_key) 114 if (sec && sec->describe_server_key)
115 sec->describe_server_key(key, 115 sec->describe_server_key(key, m);
116 } 116 }
117 117
118 /* 118 /*
119 * grab the security keyring for a server sock 119 * grab the security keyring for a server socket
120 */ 120 */
121 int rxrpc_server_keyring(struct rxrpc_sock *rx 121 int rxrpc_server_keyring(struct rxrpc_sock *rx, sockptr_t optval, int optlen)
122 { 122 {
123 struct key *key; 123 struct key *key;
124 char *description; 124 char *description;
125 125
126 _enter(""); 126 _enter("");
127 127
128 if (optlen <= 0 || optlen > PAGE_SIZE 128 if (optlen <= 0 || optlen > PAGE_SIZE - 1)
129 return -EINVAL; 129 return -EINVAL;
130 130
131 description = memdup_sockptr_nul(optva 131 description = memdup_sockptr_nul(optval, optlen);
132 if (IS_ERR(description)) 132 if (IS_ERR(description))
133 return PTR_ERR(description); 133 return PTR_ERR(description);
134 134
135 key = request_key(&key_type_keyring, d 135 key = request_key(&key_type_keyring, description, NULL);
136 if (IS_ERR(key)) { 136 if (IS_ERR(key)) {
137 kfree(description); 137 kfree(description);
138 _leave(" = %ld", PTR_ERR(key)) 138 _leave(" = %ld", PTR_ERR(key));
139 return PTR_ERR(key); 139 return PTR_ERR(key);
140 } 140 }
141 141
142 rx->securities = key; 142 rx->securities = key;
143 kfree(description); 143 kfree(description);
144 _leave(" = 0 [key %x]", key->serial); 144 _leave(" = 0 [key %x]", key->serial);
145 return 0; 145 return 0;
146 } 146 }
147 147
148 /** 148 /**
149 * rxrpc_sock_set_security_keyring - Set the s 149 * rxrpc_sock_set_security_keyring - Set the security keyring for a kernel service
150 * @sk: The socket to set the keyring on 150 * @sk: The socket to set the keyring on
151 * @keyring: The keyring to set 151 * @keyring: The keyring to set
152 * 152 *
153 * Set the server security keyring on an rxrpc 153 * Set the server security keyring on an rxrpc socket. This is used to provide
154 * the encryption keys for a kernel service. 154 * the encryption keys for a kernel service.
155 */ 155 */
156 int rxrpc_sock_set_security_keyring(struct soc 156 int rxrpc_sock_set_security_keyring(struct sock *sk, struct key *keyring)
157 { 157 {
158 struct rxrpc_sock *rx = rxrpc_sk(sk); 158 struct rxrpc_sock *rx = rxrpc_sk(sk);
159 int ret = 0; 159 int ret = 0;
160 160
161 lock_sock(sk); 161 lock_sock(sk);
162 if (rx->securities) 162 if (rx->securities)
163 ret = -EINVAL; 163 ret = -EINVAL;
164 else if (rx->sk.sk_state != RXRPC_UNBO 164 else if (rx->sk.sk_state != RXRPC_UNBOUND)
165 ret = -EISCONN; 165 ret = -EISCONN;
166 else 166 else
167 rx->securities = key_get(keyri 167 rx->securities = key_get(keyring);
168 release_sock(sk); 168 release_sock(sk);
169 return ret; 169 return ret;
170 } 170 }
171 EXPORT_SYMBOL(rxrpc_sock_set_security_keyring) 171 EXPORT_SYMBOL(rxrpc_sock_set_security_keyring);
172 172
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.