Commit ec832bd0 authored by David Howells's avatar David Howells
Browse files

rxrpc: Don't retain the server key in the connection 



Don't retain a pointer to the server key in the connection, but rather get
it on demand when the server has to deal with a response packet.

This is necessary to implement RxGK (GSSAPI-mediated transport class),
where we can't know which key we'll need until we've challenged the client
and got back the response.

This also means that we don't need to do a key search in the accept path in
softirq mode.

Also, whilst we're at it, allow the security class to ask for a kvno and
encoding-type variant of a server key as RxGK needs different keys for
different encoding types.  Keys of this type have an extra bit in the
description:

	"<service-id>:<security-index>:<kvno>:<enctype>"

Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
parent 41057ebd

net/rxrpc/ar-internal.h

+5 −6
Original line number Diff line number Diff line
@@ -441,7 +441,6 @@ struct rxrpc_connection { 
	struct list_head	link;		/* link in master connection list */

	struct sk_buff_head	rx_queue;	/* received conn-level packets */

	const struct rxrpc_security *security;	/* applied security module */

	struct key		*server_key;	/* security for this service */

	struct crypto_sync_skcipher *cipher;	/* encryption handle */

	struct rxrpc_crypt	csum_iv;	/* packet checksum base */

	unsigned long		flags;
@@ -890,8 +889,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *, 
						     struct sk_buff *);

struct rxrpc_connection *rxrpc_prealloc_service_connection(struct rxrpc_net *, gfp_t);

void rxrpc_new_incoming_connection(struct rxrpc_sock *, struct rxrpc_connection *,

				   const struct rxrpc_security *, struct key *,

				   struct sk_buff *);

				   const struct rxrpc_security *, struct sk_buff *);

void rxrpc_unpublish_service_conn(struct rxrpc_connection *);



/*
@@ -1056,9 +1054,10 @@ extern const struct rxrpc_security rxkad; 
int __init rxrpc_init_security(void);

void rxrpc_exit_security(void);

int rxrpc_init_client_conn_security(struct rxrpc_connection *);

bool rxrpc_look_up_server_security(struct rxrpc_local *, struct rxrpc_sock *,

				   const struct rxrpc_security **, struct key **,

const struct rxrpc_security *rxrpc_get_incoming_security(struct rxrpc_sock *,

							 struct sk_buff *);

struct key *rxrpc_look_up_server_security(struct rxrpc_connection *,

					  struct sk_buff *, u32, u32);



/*

 * sendmsg.c

net/rxrpc/call_accept.c

+7 −7
Original line number Diff line number Diff line
@@ -261,7 +261,6 @@ static struct rxrpc_call *rxrpc_alloc_incoming_call(struct rxrpc_sock *rx, 
						    struct rxrpc_peer *peer,

						    struct rxrpc_connection *conn,

						    const struct rxrpc_security *sec,

						    struct key *key,

						    struct sk_buff *skb)

{

	struct rxrpc_backlog *b = rx->backlog;
@@ -309,7 +308,7 @@ static struct rxrpc_call *rxrpc_alloc_incoming_call(struct rxrpc_sock *rx, 
		conn->params.local = rxrpc_get_local(local);

		conn->params.peer = peer;

		rxrpc_see_connection(conn);

		rxrpc_new_incoming_connection(rx, conn, sec, key, skb);

		rxrpc_new_incoming_connection(rx, conn, sec, skb);

	} else {

		rxrpc_get_connection(conn);

	}
@@ -353,7 +352,6 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local, 
	struct rxrpc_connection *conn;

	struct rxrpc_peer *peer = NULL;

	struct rxrpc_call *call = NULL;

	struct key *key = NULL;



	_enter("");
@@ -374,11 +372,13 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local, 
	 */

	conn = rxrpc_find_connection_rcu(local, skb, &peer);



	if (!conn && !rxrpc_look_up_server_security(local, rx, &sec, &key, skb))

	if (!conn) {

		sec = rxrpc_get_incoming_security(rx, skb);

		if (!sec)

			goto no_call;

	}



	call = rxrpc_alloc_incoming_call(rx, local, peer, conn, sec, key, skb);

	key_put(key);

	call = rxrpc_alloc_incoming_call(rx, local, peer, conn, sec, skb);

	if (!call) {

		skb->mark = RXRPC_SKB_MARK_REJECT_BUSY;

		goto no_call;

net/rxrpc/conn_event.c

+0 −1
Original line number Diff line number Diff line
@@ -378,7 +378,6 @@ static void rxrpc_secure_connection(struct rxrpc_connection *conn) 
	_enter("{%d}", conn->debug_id);



	ASSERT(conn->security_ix != 0);

	ASSERT(conn->server_key);



	if (conn->security->issue_challenge(conn) < 0) {

		abort_code = RX_CALL_DEAD;

net/rxrpc/conn_object.c

+0 −1
Original line number Diff line number Diff line
@@ -363,7 +363,6 @@ static void rxrpc_destroy_connection(struct rcu_head *rcu) 


	conn->security->clear(conn);

	key_put(conn->params.key);

	key_put(conn->server_key);

	rxrpc_put_bundle(conn->bundle);

	rxrpc_put_peer(conn->params.peer);

net/rxrpc/conn_service.c

+0 −2
Original line number Diff line number Diff line
@@ -156,7 +156,6 @@ struct rxrpc_connection *rxrpc_prealloc_service_connection(struct rxrpc_net *rxn 
void rxrpc_new_incoming_connection(struct rxrpc_sock *rx,

				   struct rxrpc_connection *conn,

				   const struct rxrpc_security *sec,

				   struct key *key,

				   struct sk_buff *skb)

{

	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
@@ -170,7 +169,6 @@ void rxrpc_new_incoming_connection(struct rxrpc_sock *rx, 
	conn->security_ix	= sp->hdr.securityIndex;

	conn->out_clientflag	= 0;

	conn->security		= sec;

	conn->server_key	= key_get(key);

	if (conn->security_ix)

		conn->state	= RXRPC_CONN_SERVICE_UNSECURED;

	else