rxkad.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/* Kerberos-based RxRPC security
   3 *
   4 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
   5 * Written by David Howells (dhowells@redhat.com)
   6 */
   7
   8#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   9
  10#include <crypto/skcipher.h>
  11#include <linux/module.h>
  12#include <linux/net.h>
  13#include <linux/skbuff.h>
  14#include <linux/udp.h>
  15#include <linux/scatterlist.h>
  16#include <linux/ctype.h>
  17#include <linux/slab.h>
  18#include <linux/key-type.h>
  19#include <net/sock.h>
  20#include <net/af_rxrpc.h>
  21#include <keys/rxrpc-type.h>
  22#include "ar-internal.h"
  23
  24#define RXKAD_VERSION			2
  25#define MAXKRB5TICKETLEN		1024
  26#define RXKAD_TKT_TYPE_KERBEROS_V5	256
  27#define ANAME_SZ			40	/* size of authentication name */
  28#define INST_SZ				40	/* size of principal's instance */
  29#define REALM_SZ			40	/* size of principal's auth domain */
  30#define SNAME_SZ			40	/* size of service name */
  31#define RXKAD_ALIGN			8
  32
  33struct rxkad_level1_hdr {
  34	__be32	data_size;	/* true data size (excluding padding) */
  35};
  36
  37struct rxkad_level2_hdr {
  38	__be32	data_size;	/* true data size (excluding padding) */
  39	__be32	checksum;	/* decrypted data checksum */
  40};
  41
  42static int rxkad_prime_packet_security(struct rxrpc_connection *conn,
  43				       struct crypto_sync_skcipher *ci);
  44
  45/*
  46 * this holds a pinned cipher so that keventd doesn't get called by the cipher
  47 * alloc routine, but since we have it to hand, we use it to decrypt RESPONSE
  48 * packets
  49 */
  50static struct crypto_sync_skcipher *rxkad_ci;
  51static struct skcipher_request *rxkad_ci_req;
  52static DEFINE_MUTEX(rxkad_ci_mutex);
  53
  54/*
  55 * Parse the information from a server key
  56 *
  57 * The data should be the 8-byte secret key.
  58 */
  59static int rxkad_preparse_server_key(struct key_preparsed_payload *prep)
  60{
  61	struct crypto_skcipher *ci;
  62
  63	if (prep->datalen != 8)
  64		return -EINVAL;
  65
  66	memcpy(&prep->payload.data[2], prep->data, 8);
  67
  68	ci = crypto_alloc_skcipher("pcbc(des)", 0, CRYPTO_ALG_ASYNC);
  69	if (IS_ERR(ci)) {
  70		_leave(" = %ld", PTR_ERR(ci));
  71		return PTR_ERR(ci);
  72	}
  73
  74	if (crypto_skcipher_setkey(ci, prep->data, 8) < 0)
  75		BUG();
  76
  77	prep->payload.data[0] = ci;
  78	_leave(" = 0");
  79	return 0;
  80}
  81
  82static void rxkad_free_preparse_server_key(struct key_preparsed_payload *prep)
  83{
  84
  85	if (prep->payload.data[0])
  86		crypto_free_skcipher(prep->payload.data[0]);
  87}
  88
  89static void rxkad_destroy_server_key(struct key *key)
  90{
  91	if (key->payload.data[0]) {
  92		crypto_free_skcipher(key->payload.data[0]);
  93		key->payload.data[0] = NULL;
  94	}
  95}
  96
  97/*
  98 * initialise connection security
  99 */
 100static int rxkad_init_connection_security(struct rxrpc_connection *conn,
 101					  struct rxrpc_key_token *token)
 102{
 103	struct crypto_sync_skcipher *ci;
 104	int ret;
 105
 106	_enter("{%d},{%x}", conn->debug_id, key_serial(conn->key));
 107
 108	conn->security_ix = token->security_index;
 109
 110	ci = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);
 111	if (IS_ERR(ci)) {
 112		_debug("no cipher");
 113		ret = PTR_ERR(ci);
 114		goto error;
 115	}
 116
 117	if (crypto_sync_skcipher_setkey(ci, token->kad->session_key,
 118				   sizeof(token->kad->session_key)) < 0)
 119		BUG();
 120
 121	switch (conn->security_level) {
 122	case RXRPC_SECURITY_PLAIN:
 123	case RXRPC_SECURITY_AUTH:
 124	case RXRPC_SECURITY_ENCRYPT:
 125		break;
 126	default:
 127		ret = -EKEYREJECTED;
 128		goto error;
 129	}
 130
 131	ret = rxkad_prime_packet_security(conn, ci);
 132	if (ret < 0)
 133		goto error_ci;
 134
 135	conn->rxkad.cipher = ci;
 136	return 0;
 137
 138error_ci:
 139	crypto_free_sync_skcipher(ci);
 140error:
 141	_leave(" = %d", ret);
 142	return ret;
 143}
 144
 145/*
 146 * Work out how much data we can put in a packet.
 147 */
 148static struct rxrpc_txbuf *rxkad_alloc_txbuf(struct rxrpc_call *call, size_t remain, gfp_t gfp)
 149{
 150	struct rxrpc_txbuf *txb;
 151	size_t shdr, alloc, limit, part;
 152
 153	remain = umin(remain, 65535 - sizeof(struct rxrpc_wire_header));
 154
 155	switch (call->conn->security_level) {
 156	default:
 157		alloc = umin(remain, RXRPC_JUMBO_DATALEN);
 158		return rxrpc_alloc_data_txbuf(call, alloc, 1, gfp);
 159	case RXRPC_SECURITY_AUTH:
 160		shdr = sizeof(struct rxkad_level1_hdr);
 161		break;
 162	case RXRPC_SECURITY_ENCRYPT:
 163		shdr = sizeof(struct rxkad_level2_hdr);
 164		break;
 165	}
 166
 167	limit = round_down(RXRPC_JUMBO_DATALEN, RXKAD_ALIGN) - shdr;
 168	if (remain < limit) {
 169		part = remain;
 170		alloc = round_up(shdr + part, RXKAD_ALIGN);
 171	} else {
 172		part = limit;
 173		alloc = RXRPC_JUMBO_DATALEN;
 174	}
 175
 176	txb = rxrpc_alloc_data_txbuf(call, alloc, RXKAD_ALIGN, gfp);
 177	if (!txb)
 178		return NULL;
 179
 180	txb->crypto_header	= 0;
 181	txb->sec_header		= shdr;
 182	txb->offset		+= shdr;
 183	txb->space		= part;
 184	return txb;
 185}
 186
 187/*
 188 * prime the encryption state with the invariant parts of a connection's
 189 * description
 190 */
 191static int rxkad_prime_packet_security(struct rxrpc_connection *conn,
 192				       struct crypto_sync_skcipher *ci)
 193{
 194	struct skcipher_request *req;
 195	struct rxrpc_key_token *token;
 196	struct scatterlist sg;
 197	struct rxrpc_crypt iv;
 198	__be32 *tmpbuf;
 199	size_t tmpsize = 4 * sizeof(__be32);
 200	int ret;
 201
 202	_enter("");
 203
 204	if (!conn->key)
 205		return 0;
 206
 207	tmpbuf = kmalloc(tmpsize, GFP_KERNEL);
 208	if (!tmpbuf)
 209		return -ENOMEM;
 210
 211	req = skcipher_request_alloc(&ci->base, GFP_NOFS);
 212	if (!req) {
 213		kfree(tmpbuf);
 214		return -ENOMEM;
 215	}
 216
 217	token = conn->key->payload.data[0];
 218	memcpy(&iv, token->kad->session_key, sizeof(iv));
 219
 220	tmpbuf[0] = htonl(conn->proto.epoch);
 221	tmpbuf[1] = htonl(conn->proto.cid);
 222	tmpbuf[2] = 0;
 223	tmpbuf[3] = htonl(conn->security_ix);
 224
 225	sg_init_one(&sg, tmpbuf, tmpsize);
 226	skcipher_request_set_sync_tfm(req, ci);
 227	skcipher_request_set_callback(req, 0, NULL, NULL);
 228	skcipher_request_set_crypt(req, &sg, &sg, tmpsize, iv.x);
 229	ret = crypto_skcipher_encrypt(req);
 230	skcipher_request_free(req);
 231
 232	memcpy(&conn->rxkad.csum_iv, tmpbuf + 2, sizeof(conn->rxkad.csum_iv));
 233	kfree(tmpbuf);
 234	_leave(" = %d", ret);
 235	return ret;
 236}
 237
 238/*
 239 * Allocate and prepare the crypto request on a call.  For any particular call,
 240 * this is called serially for the packets, so no lock should be necessary.
 241 */
 242static struct skcipher_request *rxkad_get_call_crypto(struct rxrpc_call *call)
 243{
 244	struct crypto_skcipher *tfm = &call->conn->rxkad.cipher->base;
 245
 246	return skcipher_request_alloc(tfm, GFP_NOFS);
 247}
 248
 249/*
 250 * Clean up the crypto on a call.
 251 */
 252static void rxkad_free_call_crypto(struct rxrpc_call *call)
 253{
 254}
 255
 256/*
 257 * partially encrypt a packet (level 1 security)
 258 */
 259static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
 260				    struct rxrpc_txbuf *txb,
 261				    struct skcipher_request *req)
 262{
 263	struct rxkad_level1_hdr *hdr = txb->data;
 264	struct rxrpc_crypt iv;
 265	struct scatterlist sg;
 266	size_t pad;
 267	u16 check;
 268	int ret;
 269
 270	_enter("");
 271
 272	check = txb->seq ^ call->call_id;
 273	hdr->data_size = htonl((u32)check << 16 | txb->len);
 274
 275	txb->pkt_len = sizeof(struct rxkad_level1_hdr) + txb->len;
 276	pad = txb->pkt_len;
 277	pad = RXKAD_ALIGN - pad;
 278	pad &= RXKAD_ALIGN - 1;
 279	if (pad) {
 280		memset(txb->data + txb->offset, 0, pad);
 281		txb->pkt_len += pad;
 282	}
 283
 284	/* start the encryption afresh */
 285	memset(&iv, 0, sizeof(iv));
 286
 287	sg_init_one(&sg, hdr, 8);
 288	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
 289	skcipher_request_set_callback(req, 0, NULL, NULL);
 290	skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
 291	ret = crypto_skcipher_encrypt(req);
 292	skcipher_request_zero(req);
 293
 294	_leave(" = %d", ret);
 295	return ret;
 296}
 297
 298/*
 299 * wholly encrypt a packet (level 2 security)
 300 */
 301static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
 302				       struct rxrpc_txbuf *txb,
 303				       struct skcipher_request *req)
 304{
 305	const struct rxrpc_key_token *token;
 306	struct rxkad_level2_hdr *rxkhdr = txb->data;
 307	struct rxrpc_crypt iv;
 308	struct scatterlist sg;
 309	size_t content, pad;
 310	u16 check;
 311	int ret;
 312
 313	_enter("");
 314
 315	check = txb->seq ^ call->call_id;
 316
 317	rxkhdr->data_size = htonl(txb->len | (u32)check << 16);
 318	rxkhdr->checksum = 0;
 319
 320	content = sizeof(struct rxkad_level2_hdr) + txb->len;
 321	txb->pkt_len = round_up(content, RXKAD_ALIGN);
 322	pad = txb->pkt_len - content;
 323	if (pad)
 324		memset(txb->data + txb->offset, 0, pad);
 325
 326	/* encrypt from the session key */
 327	token = call->conn->key->payload.data[0];
 328	memcpy(&iv, token->kad->session_key, sizeof(iv));
 329
 330	sg_init_one(&sg, rxkhdr, txb->pkt_len);
 331	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
 332	skcipher_request_set_callback(req, 0, NULL, NULL);
 333	skcipher_request_set_crypt(req, &sg, &sg, txb->pkt_len, iv.x);
 334	ret = crypto_skcipher_encrypt(req);
 335	skcipher_request_zero(req);
 336	return ret;
 337}
 338
 339/*
 340 * checksum an RxRPC packet header
 341 */
 342static int rxkad_secure_packet(struct rxrpc_call *call, struct rxrpc_txbuf *txb)
 343{
 344	struct skcipher_request	*req;
 345	struct rxrpc_crypt iv;
 346	struct scatterlist sg;
 347	union {
 348		__be32 buf[2];
 349	} crypto __aligned(8);
 350	u32 x, y = 0;
 351	int ret;
 352
 353	_enter("{%d{%x}},{#%u},%u,",
 354	       call->debug_id, key_serial(call->conn->key),
 355	       txb->seq, txb->len);
 356
 357	if (!call->conn->rxkad.cipher)
 358		return 0;
 359
 360	ret = key_validate(call->conn->key);
 361	if (ret < 0)
 362		return ret;
 363
 364	req = rxkad_get_call_crypto(call);
 365	if (!req)
 366		return -ENOMEM;
 367
 368	/* continue encrypting from where we left off */
 369	memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv));
 370
 371	/* calculate the security checksum */
 372	x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
 373	x |= txb->seq & 0x3fffffff;
 374	crypto.buf[0] = htonl(call->call_id);
 375	crypto.buf[1] = htonl(x);
 376
 377	sg_init_one(&sg, crypto.buf, 8);
 378	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
 379	skcipher_request_set_callback(req, 0, NULL, NULL);
 380	skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
 381	ret = crypto_skcipher_encrypt(req);
 382	skcipher_request_zero(req);
 383	if (ret < 0)
 384		goto out;
 385
 386	y = ntohl(crypto.buf[1]);
 387	y = (y >> 16) & 0xffff;
 388	if (y == 0)
 389		y = 1; /* zero checksums are not permitted */
 390	txb->cksum = htons(y);
 391
 392	switch (call->conn->security_level) {
 393	case RXRPC_SECURITY_PLAIN:
 394		txb->pkt_len = txb->len;
 395		ret = 0;
 396		break;
 397	case RXRPC_SECURITY_AUTH:
 398		ret = rxkad_secure_packet_auth(call, txb, req);
 399		if (txb->alloc_size == RXRPC_JUMBO_DATALEN)
 400			txb->jumboable = true;
 401		break;
 402	case RXRPC_SECURITY_ENCRYPT:
 403		ret = rxkad_secure_packet_encrypt(call, txb, req);
 404		if (txb->alloc_size == RXRPC_JUMBO_DATALEN)
 405			txb->jumboable = true;
 406		break;
 407	default:
 408		ret = -EPERM;
 409		break;
 410	}
 411
 412	/* Clear excess space in the packet */
 413	if (txb->pkt_len < txb->alloc_size) {
 414		size_t gap = txb->alloc_size - txb->pkt_len;
 415		void *p = txb->data;
 416
 417		memset(p + txb->pkt_len, 0, gap);
 418	}
 419
 420out:
 421	skcipher_request_free(req);
 422	_leave(" = %d [set %x]", ret, y);
 423	return ret;
 424}
 425
 426/*
 427 * decrypt partial encryption on a packet (level 1 security)
 428 */
 429static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
 430				 rxrpc_seq_t seq,
 431				 struct skcipher_request *req)
 432{
 433	struct rxkad_level1_hdr sechdr;
 434	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 435	struct rxrpc_crypt iv;
 436	struct scatterlist sg[16];
 437	u32 data_size, buf;
 438	u16 check;
 439	int ret;
 440
 441	_enter("");
 442
 443	if (sp->len < 8)
 444		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
 445					  rxkad_abort_1_short_header);
 446
 447	/* Decrypt the skbuff in-place.  TODO: We really want to decrypt
 448	 * directly into the target buffer.
 449	 */
 450	sg_init_table(sg, ARRAY_SIZE(sg));
 451	ret = skb_to_sgvec(skb, sg, sp->offset, 8);
 452	if (unlikely(ret < 0))
 453		return ret;
 454
 455	/* start the decryption afresh */
 456	memset(&iv, 0, sizeof(iv));
 457
 458	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
 459	skcipher_request_set_callback(req, 0, NULL, NULL);
 460	skcipher_request_set_crypt(req, sg, sg, 8, iv.x);
 461	ret = crypto_skcipher_decrypt(req);
 462	skcipher_request_zero(req);
 463	if (ret < 0)
 464		return ret;
 465
 466	/* Extract the decrypted packet length */
 467	if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0)
 468		return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
 469					  rxkad_abort_1_short_encdata);
 470	sp->offset += sizeof(sechdr);
 471	sp->len    -= sizeof(sechdr);
 472
 473	buf = ntohl(sechdr.data_size);
 474	data_size = buf & 0xffff;
 475
 476	check = buf >> 16;
 477	check ^= seq ^ call->call_id;
 478	check &= 0xffff;
 479	if (check != 0)
 480		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
 481					  rxkad_abort_1_short_check);
 482	if (data_size > sp->len)
 483		return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
 484					  rxkad_abort_1_short_data);
 485	sp->len = data_size;
 486
 487	_leave(" = 0 [dlen=%x]", data_size);
 488	return 0;
 489}
 490
 491/*
 492 * wholly decrypt a packet (level 2 security)
 493 */
 494static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
 495				 rxrpc_seq_t seq,
 496				 struct skcipher_request *req)
 497{
 498	const struct rxrpc_key_token *token;
 499	struct rxkad_level2_hdr sechdr;
 500	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 501	struct rxrpc_crypt iv;
 502	struct scatterlist _sg[4], *sg;
 503	u32 data_size, buf;
 504	u16 check;
 505	int nsg, ret;
 506
 507	_enter(",{%d}", sp->len);
 508
 509	if (sp->len < 8)
 510		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
 511					  rxkad_abort_2_short_header);
 512
 513	/* Decrypt the skbuff in-place.  TODO: We really want to decrypt
 514	 * directly into the target buffer.
 515	 */
 516	sg = _sg;
 517	nsg = skb_shinfo(skb)->nr_frags + 1;
 518	if (nsg <= 4) {
 519		nsg = 4;
 520	} else {
 521		sg = kmalloc_array(nsg, sizeof(*sg), GFP_NOIO);
 522		if (!sg)
 523			return -ENOMEM;
 524	}
 525
 526	sg_init_table(sg, nsg);
 527	ret = skb_to_sgvec(skb, sg, sp->offset, sp->len);
 528	if (unlikely(ret < 0)) {
 529		if (sg != _sg)
 530			kfree(sg);
 531		return ret;
 532	}
 533
 534	/* decrypt from the session key */
 535	token = call->conn->key->payload.data[0];
 536	memcpy(&iv, token->kad->session_key, sizeof(iv));
 537
 538	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
 539	skcipher_request_set_callback(req, 0, NULL, NULL);
 540	skcipher_request_set_crypt(req, sg, sg, sp->len, iv.x);
 541	ret = crypto_skcipher_decrypt(req);
 542	skcipher_request_zero(req);
 543	if (sg != _sg)
 544		kfree(sg);
 545	if (ret < 0) {
 546		WARN_ON_ONCE(ret != -ENOMEM);
 547		return ret;
 548	}
 549
 550	/* Extract the decrypted packet length */
 551	if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0)
 552		return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
 553					  rxkad_abort_2_short_len);
 554	sp->offset += sizeof(sechdr);
 555	sp->len    -= sizeof(sechdr);
 556
 557	buf = ntohl(sechdr.data_size);
 558	data_size = buf & 0xffff;
 559
 560	check = buf >> 16;
 561	check ^= seq ^ call->call_id;
 562	check &= 0xffff;
 563	if (check != 0)
 564		return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
 565					  rxkad_abort_2_short_check);
 566
 567	if (data_size > sp->len)
 568		return rxrpc_abort_eproto(call, skb, RXKADDATALEN,
 569					  rxkad_abort_2_short_data);
 570
 571	sp->len = data_size;
 572	_leave(" = 0 [dlen=%x]", data_size);
 573	return 0;
 574}
 575
 576/*
 577 * Verify the security on a received packet and the subpackets therein.
 578 */
 579static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb)
 580{
 581	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 582	struct skcipher_request	*req;
 583	struct rxrpc_crypt iv;
 584	struct scatterlist sg;
 585	union {
 586		__be32 buf[2];
 587	} crypto __aligned(8);
 588	rxrpc_seq_t seq = sp->hdr.seq;
 589	int ret;
 590	u16 cksum;
 591	u32 x, y;
 592
 593	_enter("{%d{%x}},{#%u}",
 594	       call->debug_id, key_serial(call->conn->key), seq);
 595
 596	if (!call->conn->rxkad.cipher)
 597		return 0;
 598
 599	req = rxkad_get_call_crypto(call);
 600	if (!req)
 601		return -ENOMEM;
 602
 603	/* continue encrypting from where we left off */
 604	memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv));
 605
 606	/* validate the security checksum */
 607	x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
 608	x |= seq & 0x3fffffff;
 609	crypto.buf[0] = htonl(call->call_id);
 610	crypto.buf[1] = htonl(x);
 611
 612	sg_init_one(&sg, crypto.buf, 8);
 613	skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher);
 614	skcipher_request_set_callback(req, 0, NULL, NULL);
 615	skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
 616	ret = crypto_skcipher_encrypt(req);
 617	skcipher_request_zero(req);
 618	if (ret < 0)
 619		goto out;
 620
 621	y = ntohl(crypto.buf[1]);
 622	cksum = (y >> 16) & 0xffff;
 623	if (cksum == 0)
 624		cksum = 1; /* zero checksums are not permitted */
 625
 626	if (cksum != sp->hdr.cksum) {
 627		ret = rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON,
 628					 rxkad_abort_bad_checksum);
 629		goto out;
 630	}
 631
 632	switch (call->conn->security_level) {
 633	case RXRPC_SECURITY_PLAIN:
 634		ret = 0;
 635		break;
 636	case RXRPC_SECURITY_AUTH:
 637		ret = rxkad_verify_packet_1(call, skb, seq, req);
 638		break;
 639	case RXRPC_SECURITY_ENCRYPT:
 640		ret = rxkad_verify_packet_2(call, skb, seq, req);
 641		break;
 642	default:
 643		ret = -ENOANO;
 644		break;
 645	}
 646
 647out:
 648	skcipher_request_free(req);
 649	return ret;
 650}
 651
 652/*
 653 * issue a challenge
 654 */
 655static int rxkad_issue_challenge(struct rxrpc_connection *conn)
 656{
 657	struct rxkad_challenge challenge;
 658	struct rxrpc_wire_header whdr;
 659	struct msghdr msg;
 660	struct kvec iov[2];
 661	size_t len;
 662	u32 serial;
 663	int ret;
 664
 665	_enter("{%d}", conn->debug_id);
 666
 667	get_random_bytes(&conn->rxkad.nonce, sizeof(conn->rxkad.nonce));
 668
 669	challenge.version	= htonl(2);
 670	challenge.nonce		= htonl(conn->rxkad.nonce);
 671	challenge.min_level	= htonl(0);
 672	challenge.__padding	= 0;
 673
 674	msg.msg_name	= &conn->peer->srx.transport;
 675	msg.msg_namelen	= conn->peer->srx.transport_len;
 676	msg.msg_control	= NULL;
 677	msg.msg_controllen = 0;
 678	msg.msg_flags	= 0;
 679
 680	whdr.epoch	= htonl(conn->proto.epoch);
 681	whdr.cid	= htonl(conn->proto.cid);
 682	whdr.callNumber	= 0;
 683	whdr.seq	= 0;
 684	whdr.type	= RXRPC_PACKET_TYPE_CHALLENGE;
 685	whdr.flags	= conn->out_clientflag;
 686	whdr.userStatus	= 0;
 687	whdr.securityIndex = conn->security_ix;
 688	whdr._rsvd	= 0;
 689	whdr.serviceId	= htons(conn->service_id);
 690
 691	iov[0].iov_base	= &whdr;
 692	iov[0].iov_len	= sizeof(whdr);
 693	iov[1].iov_base	= &challenge;
 694	iov[1].iov_len	= sizeof(challenge);
 695
 696	len = iov[0].iov_len + iov[1].iov_len;
 697
 698	serial = rxrpc_get_next_serial(conn);
 699	whdr.serial = htonl(serial);
 700
 701	trace_rxrpc_tx_challenge(conn, serial, 0, conn->rxkad.nonce);
 702
 703	ret = kernel_sendmsg(conn->local->socket, &msg, iov, 2, len);
 704	if (ret < 0) {
 705		trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
 706				    rxrpc_tx_point_rxkad_challenge);
 707		return -EAGAIN;
 708	}
 709
 710	rxrpc_peer_mark_tx(conn->peer);
 711	trace_rxrpc_tx_packet(conn->debug_id, &whdr,
 712			      rxrpc_tx_point_rxkad_challenge);
 713	_leave(" = 0");
 714	return 0;
 715}
 716
 717/*
 718 * calculate the response checksum
 719 */
 720static void rxkad_calc_response_checksum(struct rxkad_response *response)
 721{
 722	u32 csum = 1000003;
 723	int loop;
 724	u8 *p = (u8 *) response;
 725
 726	for (loop = sizeof(*response); loop > 0; loop--)
 727		csum = csum * 0x10204081 + *p++;
 728
 729	response->encrypted.checksum = htonl(csum);
 730}
 731
 732/*
 733 * encrypt the response packet
 734 */
 735static int rxkad_encrypt_response(struct rxrpc_connection *conn,
 736				  struct sk_buff *response,
 737				  const struct rxkad_key *s2)
 738{
 739	struct skcipher_request *req;
 740	struct rxrpc_crypt iv;
 741	struct scatterlist sg[1];
 742	size_t encsize = sizeof(((struct rxkad_response *)0)->encrypted);
 743	int ret;
 744
 745	sg_init_table(sg, ARRAY_SIZE(sg));
 746	ret = skb_to_sgvec(response, sg,
 747			   sizeof(struct rxrpc_wire_header) +
 748			   offsetof(struct rxkad_response, encrypted), encsize);
 749	if (ret < 0)
 750		return ret;
 751
 752	req = skcipher_request_alloc(&conn->rxkad.cipher->base, GFP_NOFS);
 753	if (!req)
 754		return -ENOMEM;
 755
 756	/* continue encrypting from where we left off */
 757	memcpy(&iv, s2->session_key, sizeof(iv));
 758
 759	skcipher_request_set_sync_tfm(req, conn->rxkad.cipher);
 760	skcipher_request_set_callback(req, 0, NULL, NULL);
 761	skcipher_request_set_crypt(req, sg, sg, encsize, iv.x);
 762	ret = crypto_skcipher_encrypt(req);
 763	skcipher_request_free(req);
 764	return ret;
 765}
 766
 767/*
 768 * Validate a challenge packet.
 769 */
 770static bool rxkad_validate_challenge(struct rxrpc_connection *conn,
 771				     struct sk_buff *skb)
 772{
 773	struct rxkad_challenge challenge;
 774	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 775	u32 version, min_level;
 776	int ret;
 777
 778	_enter("{%d,%x}", conn->debug_id, key_serial(conn->key));
 779
 780	if (!conn->key) {
 781		rxrpc_abort_conn(conn, skb, RX_PROTOCOL_ERROR, -EPROTO,
 782				 rxkad_abort_chall_no_key);
 783		return false;
 784	}
 785
 786	ret = key_validate(conn->key);
 787	if (ret < 0) {
 788		rxrpc_abort_conn(conn, skb, RXKADEXPIRED, ret,
 789				 rxkad_abort_chall_key_expired);
 790		return false;
 791	}
 792
 793	if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
 794			  &challenge, sizeof(challenge)) < 0) {
 795		rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
 796				 rxkad_abort_chall_short);
 797		return false;
 798	}
 799
 800	version = ntohl(challenge.version);
 801	sp->chall.rxkad_nonce = ntohl(challenge.nonce);
 802	min_level = ntohl(challenge.min_level);
 803
 804	trace_rxrpc_rx_challenge(conn, sp->hdr.serial, version,
 805				 sp->chall.rxkad_nonce, min_level);
 806
 807	if (version != RXKAD_VERSION) {
 808		rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO,
 809				 rxkad_abort_chall_version);
 810		return false;
 811	}
 812
 813	if (conn->security_level < min_level) {
 814		rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EACCES,
 815				 rxkad_abort_chall_level);
 816		return false;
 817	}
 818	return true;
 819}
 820
 821/*
 822 * Insert the header into the response.
 823 */
 824static noinline
 825int rxkad_insert_response_header(struct rxrpc_connection *conn,
 826				 const struct rxrpc_key_token *token,
 827				 struct sk_buff *challenge,
 828				 struct sk_buff *response,
 829				 size_t *offset)
 830{
 831	struct rxrpc_skb_priv *csp = rxrpc_skb(challenge);
 832	struct {
 833		struct rxrpc_wire_header whdr;
 834		struct rxkad_response	resp;
 835	} h;
 836	int ret;
 837
 838	h.whdr.epoch			= htonl(conn->proto.epoch);
 839	h.whdr.cid			= htonl(conn->proto.cid);
 840	h.whdr.callNumber		= 0;
 841	h.whdr.serial			= 0;
 842	h.whdr.seq			= 0;
 843	h.whdr.type			= RXRPC_PACKET_TYPE_RESPONSE;
 844	h.whdr.flags			= conn->out_clientflag;
 845	h.whdr.userStatus		= 0;
 846	h.whdr.securityIndex		= conn->security_ix;
 847	h.whdr.cksum			= 0;
 848	h.whdr.serviceId		= htons(conn->service_id);
 849	h.resp.version			= htonl(RXKAD_VERSION);
 850	h.resp.__pad			= 0;
 851	h.resp.encrypted.epoch		= htonl(conn->proto.epoch);
 852	h.resp.encrypted.cid		= htonl(conn->proto.cid);
 853	h.resp.encrypted.checksum	= 0;
 854	h.resp.encrypted.securityIndex	= htonl(conn->security_ix);
 855	h.resp.encrypted.call_id[0]	= htonl(conn->channels[0].call_counter);
 856	h.resp.encrypted.call_id[1]	= htonl(conn->channels[1].call_counter);
 857	h.resp.encrypted.call_id[2]	= htonl(conn->channels[2].call_counter);
 858	h.resp.encrypted.call_id[3]	= htonl(conn->channels[3].call_counter);
 859	h.resp.encrypted.inc_nonce	= htonl(csp->chall.rxkad_nonce + 1);
 860	h.resp.encrypted.level		= htonl(conn->security_level);
 861	h.resp.kvno			= htonl(token->kad->kvno);
 862	h.resp.ticket_len		= htonl(token->kad->ticket_len);
 863
 864	rxkad_calc_response_checksum(&h.resp);
 865
 866	ret = skb_store_bits(response, *offset, &h, sizeof(h));
 867	*offset += sizeof(h);
 868	return ret;
 869}
 870
 871/*
 872 * respond to a challenge packet
 873 */
 874static int rxkad_respond_to_challenge(struct rxrpc_connection *conn,
 875				      struct sk_buff *challenge)
 876{
 877	const struct rxrpc_key_token *token;
 878	struct rxrpc_skb_priv *csp, *rsp;
 879	struct sk_buff *response;
 880	size_t len, offset = 0;
 881	int ret = -EPROTO;
 882
 883	_enter("{%d,%x}", conn->debug_id, key_serial(conn->key));
 884
 885	ret = key_validate(conn->key);
 886	if (ret < 0)
 887		return rxrpc_abort_conn(conn, challenge, RXKADEXPIRED, ret,
 888					rxkad_abort_chall_key_expired);
 889
 890	token = conn->key->payload.data[0];
 891
 892	/* build the response packet */
 893	len = sizeof(struct rxrpc_wire_header) +
 894		sizeof(struct rxkad_response) +
 895		token->kad->ticket_len;
 896
 897	response = alloc_skb_with_frags(0, len, 0, &ret, GFP_NOFS);
 898	if (!response)
 899		goto error;
 900	rxrpc_new_skb(response, rxrpc_skb_new_response_rxkad);
 901	response->len = len;
 902	response->data_len = len;
 903
 904	offset = 0;
 905	ret = rxkad_insert_response_header(conn, token, challenge, response,
 906					   &offset);
 907	if (ret < 0)
 908		goto error;
 909
 910	ret = rxkad_encrypt_response(conn, response, token->kad);
 911	if (ret < 0)
 912		goto error;
 913
 914	ret = skb_store_bits(response, offset, token->kad->ticket,
 915			     token->kad->ticket_len);
 916	if (ret < 0)
 917		goto error;
 918
 919	csp = rxrpc_skb(challenge);
 920	rsp = rxrpc_skb(response);
 921	rsp->resp.len = len;
 922	rsp->resp.challenge_serial = csp->hdr.serial;
 923	rxrpc_post_response(conn, response);
 924	response = NULL;
 925	ret = 0;
 926
 927error:
 928	rxrpc_free_skb(response, rxrpc_skb_put_response);
 929	return ret;
 930}
 931
 932/*
 933 * RxKAD does automatic response only as there's nothing to manage that isn't
 934 * already in the key.
 935 */
 936static int rxkad_sendmsg_respond_to_challenge(struct sk_buff *challenge,
 937					      struct msghdr *msg)
 938{
 939	return -EINVAL;
 940}
 941
 942/**
 943 * rxkad_kernel_respond_to_challenge - Respond to a challenge with appdata
 944 * @challenge: The challenge to respond to
 945 *
 946 * Allow a kernel application to respond to a CHALLENGE.
 947 *
 948 * Return: %0 if successful and a negative error code otherwise.
 949 */
 950int rxkad_kernel_respond_to_challenge(struct sk_buff *challenge)
 951{
 952	struct rxrpc_skb_priv *csp = rxrpc_skb(challenge);
 953
 954	return rxkad_respond_to_challenge(csp->chall.conn, challenge);
 955}
 956EXPORT_SYMBOL(rxkad_kernel_respond_to_challenge);
 957
 958/*
 959 * decrypt the kerberos IV ticket in the response
 960 */
 961static int rxkad_decrypt_ticket(struct rxrpc_connection *conn,
 962				struct key *server_key,
 963				struct sk_buff *skb,
 964				void *ticket, size_t ticket_len,
 965				struct rxrpc_crypt *_session_key,
 966				time64_t *_expiry)
 967{
 968	struct skcipher_request *req;
 969	struct rxrpc_crypt iv, key;
 970	struct scatterlist sg[1];
 971	struct in_addr addr;
 972	unsigned int life;
 973	time64_t issue, now;
 974	int ret;
 975	bool little_endian;
 976	u8 *p, *q, *name, *end;
 977
 978	_enter("{%d},{%x}", conn->debug_id, key_serial(server_key));
 979
 980	*_expiry = 0;
 981
 982	ASSERT(server_key->payload.data[0] != NULL);
 983	ASSERTCMP((unsigned long) ticket & 7UL, ==, 0);
 984
 985	memcpy(&iv, &server_key->payload.data[2], sizeof(iv));
 986
 987	req = skcipher_request_alloc(server_key->payload.data[0], GFP_NOFS);
 988	if (!req)
 989		return -ENOMEM;
 990
 991	sg_init_one(&sg[0], ticket, ticket_len);
 992	skcipher_request_set_callback(req, 0, NULL, NULL);
 993	skcipher_request_set_crypt(req, sg, sg, ticket_len, iv.x);
 994	ret = crypto_skcipher_decrypt(req);
 995	skcipher_request_free(req);
 996	if (ret < 0)
 997		return rxrpc_abort_conn(conn, skb, RXKADBADTICKET, -EPROTO,
 998					rxkad_abort_resp_tkt_short);
 999
1000	p = ticket;
1001	end = p + ticket_len;
1002
1003#define Z(field, fieldl)						\
1004	({								\
1005		u8 *__str = p;						\
1006		q = memchr(p, 0, end - p);				\
1007		if (!q || q - p > field##_SZ)				\
1008			return rxrpc_abort_conn(			\
1009				conn, skb, RXKADBADTICKET, -EPROTO,	\
1010				rxkad_abort_resp_tkt_##fieldl);		\
1011		for (; p < q; p++)					\
1012			if (!isprint(*p))				\
1013				return rxrpc_abort_conn(		\
1014					conn, skb, RXKADBADTICKET, -EPROTO, \
1015					rxkad_abort_resp_tkt_##fieldl);	\
1016		p++;							\
1017		__str;							\
1018	})
1019
1020	/* extract the ticket flags */
1021	_debug("KIV FLAGS: %x", *p);
1022	little_endian = *p & 1;
1023	p++;
1024
1025	/* extract the authentication name */
1026	name = Z(ANAME, aname);
1027	_debug("KIV ANAME: %s", name);
1028
1029	/* extract the principal's instance */
1030	name = Z(INST, inst);
1031	_debug("KIV INST : %s", name);
1032
1033	/* extract the principal's authentication domain */
1034	name = Z(REALM, realm);
1035	_debug("KIV REALM: %s", name);
1036
1037	if (end - p < 4 + 8 + 4 + 2)
1038		return rxrpc_abort_conn(conn, skb, RXKADBADTICKET, -EPROTO,
1039					rxkad_abort_resp_tkt_short);
1040
1041	/* get the IPv4 address of the entity that requested the ticket */
1042	memcpy(&addr, p, sizeof(addr));
1043	p += 4;
1044	_debug("KIV ADDR : %pI4", &addr);
1045
1046	/* get the session key from the ticket */
1047	memcpy(&key, p, sizeof(key));
1048	p += 8;
1049	_debug("KIV KEY  : %08x %08x", ntohl(key.n[0]), ntohl(key.n[1]));
1050	memcpy(_session_key, &key, sizeof(key));
1051
1052	/* get the ticket's lifetime */
1053	life = *p++ * 5 * 60;
1054	_debug("KIV LIFE : %u", life);
1055
1056	/* get the issue time of the ticket */
1057	if (little_endian) {
1058		__le32 stamp;
1059		memcpy(&stamp, p, 4);
1060		issue = rxrpc_u32_to_time64(le32_to_cpu(stamp));
1061	} else {
1062		__be32 stamp;
1063		memcpy(&stamp, p, 4);
1064		issue = rxrpc_u32_to_time64(be32_to_cpu(stamp));
1065	}
1066	p += 4;
1067	now = ktime_get_real_seconds();
1068	_debug("KIV ISSUE: %llx [%llx]", issue, now);
1069
1070	/* check the ticket is in date */
1071	if (issue > now)
1072		return rxrpc_abort_conn(conn, skb, RXKADNOAUTH, -EKEYREJECTED,
1073					rxkad_abort_resp_tkt_future);
1074	if (issue < now - life)
1075		return rxrpc_abort_conn(conn, skb, RXKADEXPIRED, -EKEYEXPIRED,
1076					rxkad_abort_resp_tkt_expired);
1077
1078	*_expiry = issue + life;
1079
1080	/* get the service name */
1081	name = Z(SNAME, sname);
1082	_debug("KIV SNAME: %s", name);
1083
1084	/* get the service instance name */
1085	name = Z(INST, sinst);
1086	_debug("KIV SINST: %s", name);
1087	return 0;
1088}
1089
1090/*
1091 * decrypt the response packet
1092 */
1093static int rxkad_decrypt_response(struct rxrpc_connection *conn,
1094				  struct rxkad_response *resp,
1095				  const struct rxrpc_crypt *session_key)
1096{
1097	struct skcipher_request *req = rxkad_ci_req;
1098	struct scatterlist sg[1];
1099	struct rxrpc_crypt iv;
1100	int ret;
1101
1102	_enter(",,%08x%08x",
1103	       ntohl(session_key->n[0]), ntohl(session_key->n[1]));
1104
1105	mutex_lock(&rxkad_ci_mutex);
1106	ret = crypto_sync_skcipher_setkey(rxkad_ci, session_key->x,
1107					  sizeof(*session_key));
1108	if (ret < 0)
1109		goto unlock;
1110
1111	memcpy(&iv, session_key, sizeof(iv));
1112
1113	sg_init_table(sg, 1);
1114	sg_set_buf(sg, &resp->encrypted, sizeof(resp->encrypted));
1115	skcipher_request_set_sync_tfm(req, rxkad_ci);
1116	skcipher_request_set_callback(req, 0, NULL, NULL);
1117	skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x);
1118	ret = crypto_skcipher_decrypt(req);
1119	skcipher_request_zero(req);
1120
1121unlock:
1122	mutex_unlock(&rxkad_ci_mutex);
1123
1124	_leave("");
1125	return ret;
1126}
1127
1128/*
1129 * verify a response
1130 */
1131static int rxkad_verify_response(struct rxrpc_connection *conn,
1132				 struct sk_buff *skb)
1133{
1134	struct rxkad_response *response;
1135	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
1136	struct rxrpc_crypt session_key;
1137	struct key *server_key;
1138	time64_t expiry;
1139	void *ticket;
1140	u32 version, kvno, ticket_len, level;
1141	__be32 csum;
1142	int ret, i;
1143
1144	_enter("{%d}", conn->debug_id);
1145
1146	server_key = rxrpc_look_up_server_security(conn, skb, 0, 0);
1147	if (IS_ERR(server_key)) {
1148		ret = PTR_ERR(server_key);
1149		switch (ret) {
1150		case -ENOKEY:
1151			return rxrpc_abort_conn(conn, skb, RXKADUNKNOWNKEY, ret,
1152						rxkad_abort_resp_nokey);
1153		case -EKEYEXPIRED:
1154			return rxrpc_abort_conn(conn, skb, RXKADEXPIRED, ret,
1155						rxkad_abort_resp_key_expired);
1156		default:
1157			return rxrpc_abort_conn(conn, skb, RXKADNOAUTH, ret,
1158						rxkad_abort_resp_key_rejected);
1159		}
1160	}
1161
1162	ret = -ENOMEM;
1163	response = kzalloc(sizeof(struct rxkad_response), GFP_NOFS);
1164	if (!response)
1165		goto temporary_error;
1166
1167	if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
1168			  response, sizeof(*response)) < 0) {
1169		rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
1170				 rxkad_abort_resp_short);
1171		goto protocol_error;
1172	}
1173
1174	version = ntohl(response->version);
1175	ticket_len = ntohl(response->ticket_len);
1176	kvno = ntohl(response->kvno);
1177
1178	trace_rxrpc_rx_response(conn, sp->hdr.serial, version, kvno, ticket_len);
1179
1180	if (version != RXKAD_VERSION) {
1181		rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO,
1182				 rxkad_abort_resp_version);
1183		goto protocol_error;
1184	}
1185
1186	if (ticket_len < 4 || ticket_len > MAXKRB5TICKETLEN) {
1187		rxrpc_abort_conn(conn, skb, RXKADTICKETLEN, -EPROTO,
1188				 rxkad_abort_resp_tkt_len);
1189		goto protocol_error;
1190	}
1191
1192	if (kvno >= RXKAD_TKT_TYPE_KERBEROS_V5) {
1193		rxrpc_abort_conn(conn, skb, RXKADUNKNOWNKEY, -EPROTO,
1194				 rxkad_abort_resp_unknown_tkt);
1195		goto protocol_error;
1196	}
1197
1198	/* extract the kerberos ticket and decrypt and decode it */
1199	ret = -ENOMEM;
1200	ticket = kmalloc(ticket_len, GFP_NOFS);
1201	if (!ticket)
1202		goto temporary_error_free_resp;
1203
1204	if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header) + sizeof(*response),
1205			  ticket, ticket_len) < 0) {
1206		rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
1207				 rxkad_abort_resp_short_tkt);
1208		goto protocol_error;
1209	}
1210
1211	ret = rxkad_decrypt_ticket(conn, server_key, skb, ticket, ticket_len,
1212				   &session_key, &expiry);
1213	if (ret < 0)
1214		goto temporary_error_free_ticket;
1215
1216	/* use the session key from inside the ticket to decrypt the
1217	 * response */
1218	ret = rxkad_decrypt_response(conn, response, &session_key);
1219	if (ret < 0)
1220		goto temporary_error_free_ticket;
1221
1222	if (ntohl(response->encrypted.epoch) != conn->proto.epoch ||
1223	    ntohl(response->encrypted.cid) != conn->proto.cid ||
1224	    ntohl(response->encrypted.securityIndex) != conn->security_ix) {
1225		rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1226				 rxkad_abort_resp_bad_param);
1227		goto protocol_error_free;
1228	}
1229
1230	csum = response->encrypted.checksum;
1231	response->encrypted.checksum = 0;
1232	rxkad_calc_response_checksum(response);
1233	if (response->encrypted.checksum != csum) {
1234		rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1235				 rxkad_abort_resp_bad_checksum);
1236		goto protocol_error_free;
1237	}
1238
1239	for (i = 0; i < RXRPC_MAXCALLS; i++) {
1240		u32 call_id = ntohl(response->encrypted.call_id[i]);
1241		u32 counter = READ_ONCE(conn->channels[i].call_counter);
1242
1243		if (call_id > INT_MAX) {
1244			rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1245					 rxkad_abort_resp_bad_callid);
1246			goto protocol_error_free;
1247		}
1248
1249		if (call_id < counter) {
1250			rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1251					 rxkad_abort_resp_call_ctr);
1252			goto protocol_error_free;
1253		}
1254
1255		if (call_id > counter) {
1256			if (conn->channels[i].call) {
1257				rxrpc_abort_conn(conn, skb, RXKADSEALEDINCON, -EPROTO,
1258						 rxkad_abort_resp_call_state);
1259				goto protocol_error_free;
1260			}
1261			conn->channels[i].call_counter = call_id;
1262		}
1263	}
1264
1265	if (ntohl(response->encrypted.inc_nonce) != conn->rxkad.nonce + 1) {
1266		rxrpc_abort_conn(conn, skb, RXKADOUTOFSEQUENCE, -EPROTO,
1267				 rxkad_abort_resp_ooseq);
1268		goto protocol_error_free;
1269	}
1270
1271	level = ntohl(response->encrypted.level);
1272	if (level > RXRPC_SECURITY_ENCRYPT) {
1273		rxrpc_abort_conn(conn, skb, RXKADLEVELFAIL, -EPROTO,
1274				 rxkad_abort_resp_level);
1275		goto protocol_error_free;
1276	}
1277	conn->security_level = level;
1278
1279	/* create a key to hold the security data and expiration time - after
1280	 * this the connection security can be handled in exactly the same way
1281	 * as for a client connection */
1282	ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno);
1283	if (ret < 0)
1284		goto temporary_error_free_ticket;
1285
1286	kfree(ticket);
1287	kfree(response);
1288	_leave(" = 0");
1289	return 0;
1290
1291protocol_error_free:
1292	kfree(ticket);
1293protocol_error:
1294	kfree(response);
1295	key_put(server_key);
1296	return -EPROTO;
1297
1298temporary_error_free_ticket:
1299	kfree(ticket);
1300temporary_error_free_resp:
1301	kfree(response);
1302temporary_error:
1303	/* Ignore the response packet if we got a temporary error such as
1304	 * ENOMEM.  We just want to send the challenge again.  Note that we
1305	 * also come out this way if the ticket decryption fails.
1306	 */
1307	key_put(server_key);
1308	return ret;
1309}
1310
1311/*
1312 * clear the connection security
1313 */
1314static void rxkad_clear(struct rxrpc_connection *conn)
1315{
1316	_enter("");
1317
1318	if (conn->rxkad.cipher)
1319		crypto_free_sync_skcipher(conn->rxkad.cipher);
1320}
1321
1322/*
1323 * Initialise the rxkad security service.
1324 */
1325static int rxkad_init(void)
1326{
1327	struct crypto_sync_skcipher *tfm;
1328	struct skcipher_request *req;
1329
1330	/* pin the cipher we need so that the crypto layer doesn't invoke
1331	 * keventd to go get it */
1332	tfm = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);
1333	if (IS_ERR(tfm))
1334		return PTR_ERR(tfm);
1335
1336	req = skcipher_request_alloc(&tfm->base, GFP_KERNEL);
1337	if (!req)
1338		goto nomem_tfm;
1339
1340	rxkad_ci_req = req;
1341	rxkad_ci = tfm;
1342	return 0;
1343
1344nomem_tfm:
1345	crypto_free_sync_skcipher(tfm);
1346	return -ENOMEM;
1347}
1348
1349/*
1350 * Clean up the rxkad security service.
1351 */
1352static void rxkad_exit(void)
1353{
1354	crypto_free_sync_skcipher(rxkad_ci);
1355	skcipher_request_free(rxkad_ci_req);
1356}
1357
1358/*
1359 * RxRPC Kerberos-based security
1360 */
1361const struct rxrpc_security rxkad = {
1362	.name				= "rxkad",
1363	.security_index			= RXRPC_SECURITY_RXKAD,
1364	.no_key_abort			= RXKADUNKNOWNKEY,
1365	.init				= rxkad_init,
1366	.exit				= rxkad_exit,
1367	.preparse_server_key		= rxkad_preparse_server_key,
1368	.free_preparse_server_key	= rxkad_free_preparse_server_key,
1369	.destroy_server_key		= rxkad_destroy_server_key,
1370	.init_connection_security	= rxkad_init_connection_security,
1371	.alloc_txbuf			= rxkad_alloc_txbuf,
1372	.secure_packet			= rxkad_secure_packet,
1373	.verify_packet			= rxkad_verify_packet,
1374	.free_call_crypto		= rxkad_free_call_crypto,
1375	.issue_challenge		= rxkad_issue_challenge,
1376	.validate_challenge		= rxkad_validate_challenge,
1377	.sendmsg_respond_to_challenge	= rxkad_sendmsg_respond_to_challenge,
1378	.respond_to_challenge		= rxkad_respond_to_challenge,
1379	.verify_response		= rxkad_verify_response,
1380	.clear				= rxkad_clear,
1381};