1ca7fb100SDavid Howells // SPDX-License-Identifier: GPL-2.0-or-later
2ca7fb100SDavid Howells /* RxRPC key management
3ca7fb100SDavid Howells *
4ca7fb100SDavid Howells * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
5ca7fb100SDavid Howells * Written by David Howells (dhowells@redhat.com)
6ca7fb100SDavid Howells *
7ca7fb100SDavid Howells * RxRPC keys should have a description of describing their purpose:
8ca7fb100SDavid Howells * "afs@CAMBRIDGE.REDHAT.COM>
9ca7fb100SDavid Howells */
10ca7fb100SDavid Howells
11ca7fb100SDavid Howells #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12ca7fb100SDavid Howells
13ca7fb100SDavid Howells #include <crypto/skcipher.h>
14ca7fb100SDavid Howells #include <linux/module.h>
15ca7fb100SDavid Howells #include <linux/net.h>
16ca7fb100SDavid Howells #include <linux/skbuff.h>
17ca7fb100SDavid Howells #include <linux/key-type.h>
18ca7fb100SDavid Howells #include <linux/ctype.h>
19ca7fb100SDavid Howells #include <linux/slab.h>
20ca7fb100SDavid Howells #include <net/sock.h>
21ca7fb100SDavid Howells #include <net/af_rxrpc.h>
22ca7fb100SDavid Howells #include <keys/rxrpc-type.h>
23ca7fb100SDavid Howells #include <keys/user-type.h>
24ca7fb100SDavid Howells #include "ar-internal.h"
25ca7fb100SDavid Howells
26ca7fb100SDavid Howells static int rxrpc_vet_description_s(const char *);
27ca7fb100SDavid Howells static int rxrpc_preparse_s(struct key_preparsed_payload *);
28ca7fb100SDavid Howells static void rxrpc_free_preparse_s(struct key_preparsed_payload *);
29ca7fb100SDavid Howells static void rxrpc_destroy_s(struct key *);
30ca7fb100SDavid Howells static void rxrpc_describe_s(const struct key *, struct seq_file *);
31ca7fb100SDavid Howells
32ca7fb100SDavid Howells /*
3312da59fcSDavid Howells * rxrpc server keys take "<serviceId>:<securityIndex>[:<sec-specific>]" as the
3412da59fcSDavid Howells * description and the key material as the payload.
35ca7fb100SDavid Howells */
36ca7fb100SDavid Howells struct key_type key_type_rxrpc_s = {
37ca7fb100SDavid Howells .name = "rxrpc_s",
38ca7fb100SDavid Howells .flags = KEY_TYPE_NET_DOMAIN,
39ca7fb100SDavid Howells .vet_description = rxrpc_vet_description_s,
40ca7fb100SDavid Howells .preparse = rxrpc_preparse_s,
41ca7fb100SDavid Howells .free_preparse = rxrpc_free_preparse_s,
42ca7fb100SDavid Howells .instantiate = generic_key_instantiate,
43ca7fb100SDavid Howells .destroy = rxrpc_destroy_s,
44ca7fb100SDavid Howells .describe = rxrpc_describe_s,
45ca7fb100SDavid Howells };
46ca7fb100SDavid Howells
47ca7fb100SDavid Howells /*
4812da59fcSDavid Howells * Vet the description for an RxRPC server key.
49ca7fb100SDavid Howells */
rxrpc_vet_description_s(const char * desc)50ca7fb100SDavid Howells static int rxrpc_vet_description_s(const char *desc)
51ca7fb100SDavid Howells {
5212da59fcSDavid Howells unsigned long service, sec_class;
53ca7fb100SDavid Howells char *p;
54ca7fb100SDavid Howells
5512da59fcSDavid Howells service = simple_strtoul(desc, &p, 10);
5612da59fcSDavid Howells if (*p != ':' || service > 65535)
57ca7fb100SDavid Howells return -EINVAL;
5812da59fcSDavid Howells sec_class = simple_strtoul(p + 1, &p, 10);
5912da59fcSDavid Howells if ((*p && *p != ':') || sec_class < 1 || sec_class > 255)
60ca7fb100SDavid Howells return -EINVAL;
61ca7fb100SDavid Howells return 0;
62ca7fb100SDavid Howells }
63ca7fb100SDavid Howells
64ca7fb100SDavid Howells /*
65ca7fb100SDavid Howells * Preparse a server secret key.
66ca7fb100SDavid Howells */
rxrpc_preparse_s(struct key_preparsed_payload * prep)67ca7fb100SDavid Howells static int rxrpc_preparse_s(struct key_preparsed_payload *prep)
68ca7fb100SDavid Howells {
6912da59fcSDavid Howells const struct rxrpc_security *sec;
7012da59fcSDavid Howells unsigned int service, sec_class;
7112da59fcSDavid Howells int n;
72ca7fb100SDavid Howells
73ca7fb100SDavid Howells _enter("%zu", prep->datalen);
74ca7fb100SDavid Howells
7512da59fcSDavid Howells if (!prep->orig_description)
76ca7fb100SDavid Howells return -EINVAL;
77ca7fb100SDavid Howells
7812da59fcSDavid Howells if (sscanf(prep->orig_description, "%u:%u%n", &service, &sec_class, &n) != 2)
7912da59fcSDavid Howells return -EINVAL;
80ca7fb100SDavid Howells
8112da59fcSDavid Howells sec = rxrpc_security_lookup(sec_class);
8212da59fcSDavid Howells if (!sec)
8312da59fcSDavid Howells return -ENOPKG;
84ca7fb100SDavid Howells
8512da59fcSDavid Howells prep->payload.data[1] = (struct rxrpc_security *)sec;
86ca7fb100SDavid Howells
87ff8376adSXiaolong Huang if (!sec->preparse_server_key)
88ff8376adSXiaolong Huang return -EINVAL;
89ff8376adSXiaolong Huang
9012da59fcSDavid Howells return sec->preparse_server_key(prep);
91ca7fb100SDavid Howells }
92ca7fb100SDavid Howells
rxrpc_free_preparse_s(struct key_preparsed_payload * prep)93ca7fb100SDavid Howells static void rxrpc_free_preparse_s(struct key_preparsed_payload *prep)
94ca7fb100SDavid Howells {
9512da59fcSDavid Howells const struct rxrpc_security *sec = prep->payload.data[1];
9612da59fcSDavid Howells
97ff8376adSXiaolong Huang if (sec && sec->free_preparse_server_key)
9812da59fcSDavid Howells sec->free_preparse_server_key(prep);
99ca7fb100SDavid Howells }
100ca7fb100SDavid Howells
rxrpc_destroy_s(struct key * key)101ca7fb100SDavid Howells static void rxrpc_destroy_s(struct key *key)
102ca7fb100SDavid Howells {
10312da59fcSDavid Howells const struct rxrpc_security *sec = key->payload.data[1];
10412da59fcSDavid Howells
105ff8376adSXiaolong Huang if (sec && sec->destroy_server_key)
10612da59fcSDavid Howells sec->destroy_server_key(key);
107ca7fb100SDavid Howells }
108ca7fb100SDavid Howells
rxrpc_describe_s(const struct key * key,struct seq_file * m)109ca7fb100SDavid Howells static void rxrpc_describe_s(const struct key *key, struct seq_file *m)
110ca7fb100SDavid Howells {
111d5953f65SDavid Howells const struct rxrpc_security *sec = key->payload.data[1];
112d5953f65SDavid Howells
113ca7fb100SDavid Howells seq_puts(m, key->description);
114d5953f65SDavid Howells if (sec && sec->describe_server_key)
115d5953f65SDavid Howells sec->describe_server_key(key, m);
116ca7fb100SDavid Howells }
117ca7fb100SDavid Howells
118ca7fb100SDavid Howells /*
119ca7fb100SDavid Howells * grab the security keyring for a server socket
120ca7fb100SDavid Howells */
rxrpc_server_keyring(struct rxrpc_sock * rx,sockptr_t optval,int optlen)121ca7fb100SDavid Howells int rxrpc_server_keyring(struct rxrpc_sock *rx, sockptr_t optval, int optlen)
122ca7fb100SDavid Howells {
123ca7fb100SDavid Howells struct key *key;
124ca7fb100SDavid Howells char *description;
125ca7fb100SDavid Howells
126ca7fb100SDavid Howells _enter("");
127ca7fb100SDavid Howells
128ca7fb100SDavid Howells if (optlen <= 0 || optlen > PAGE_SIZE - 1)
129ca7fb100SDavid Howells return -EINVAL;
130ca7fb100SDavid Howells
131ca7fb100SDavid Howells description = memdup_sockptr_nul(optval, optlen);
132ca7fb100SDavid Howells if (IS_ERR(description))
133ca7fb100SDavid Howells return PTR_ERR(description);
134ca7fb100SDavid Howells
135ca7fb100SDavid Howells key = request_key(&key_type_keyring, description, NULL);
136ca7fb100SDavid Howells if (IS_ERR(key)) {
137ca7fb100SDavid Howells kfree(description);
138ca7fb100SDavid Howells _leave(" = %ld", PTR_ERR(key));
139ca7fb100SDavid Howells return PTR_ERR(key);
140ca7fb100SDavid Howells }
141ca7fb100SDavid Howells
142ca7fb100SDavid Howells rx->securities = key;
143ca7fb100SDavid Howells kfree(description);
144ca7fb100SDavid Howells _leave(" = 0 [key %x]", key->serial);
145ca7fb100SDavid Howells return 0;
146ca7fb100SDavid Howells }
147*75bfdbf2SDavid Howells
148*75bfdbf2SDavid Howells /**
149*75bfdbf2SDavid Howells * rxrpc_sock_set_security_keyring - Set the security keyring for a kernel service
150*75bfdbf2SDavid Howells * @sk: The socket to set the keyring on
151*75bfdbf2SDavid Howells * @keyring: The keyring to set
152*75bfdbf2SDavid Howells *
153*75bfdbf2SDavid Howells * Set the server security keyring on an rxrpc socket. This is used to provide
154*75bfdbf2SDavid Howells * the encryption keys for a kernel service.
155*75bfdbf2SDavid Howells */
rxrpc_sock_set_security_keyring(struct sock * sk,struct key * keyring)156*75bfdbf2SDavid Howells int rxrpc_sock_set_security_keyring(struct sock *sk, struct key *keyring)
157*75bfdbf2SDavid Howells {
158*75bfdbf2SDavid Howells struct rxrpc_sock *rx = rxrpc_sk(sk);
159*75bfdbf2SDavid Howells int ret = 0;
160*75bfdbf2SDavid Howells
161*75bfdbf2SDavid Howells lock_sock(sk);
162*75bfdbf2SDavid Howells if (rx->securities)
163*75bfdbf2SDavid Howells ret = -EINVAL;
164*75bfdbf2SDavid Howells else if (rx->sk.sk_state != RXRPC_UNBOUND)
165*75bfdbf2SDavid Howells ret = -EISCONN;
166*75bfdbf2SDavid Howells else
167*75bfdbf2SDavid Howells rx->securities = key_get(keyring);
168*75bfdbf2SDavid Howells release_sock(sk);
169*75bfdbf2SDavid Howells return ret;
170*75bfdbf2SDavid Howells }
171*75bfdbf2SDavid Howells EXPORT_SYMBOL(rxrpc_sock_set_security_keyring);
172