1// SPDX-License-Identifier: GPL-2.0 2/** 3 * net/tipc/crypto.c: TIPC crypto for key handling & packet en/decryption 4 * 5 * Copyright (c) 2019, Ericsson AB 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the names of the copyright holders nor the names of its 17 * contributors may be used to endorse or promote products derived from 18 * this software without specific prior written permission. 19 * 20 * Alternatively, this software may be distributed under the terms of the 21 * GNU General Public License ("GPL") version 2 as published by the Free 22 * Software Foundation. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 25 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 */ 36 37#include <crypto/aead.h> 38#include <crypto/aes.h> 39#include <crypto/rng.h> 40#include "crypto.h" 41#include "msg.h" 42#include "bcast.h" 43 44#define TIPC_TX_GRACE_PERIOD msecs_to_jiffies(5000) /* 5s */ 45#define TIPC_TX_LASTING_TIME msecs_to_jiffies(10000) /* 10s */ 46#define TIPC_RX_ACTIVE_LIM msecs_to_jiffies(3000) /* 3s */ 47#define TIPC_RX_PASSIVE_LIM msecs_to_jiffies(15000) /* 15s */ 48 49#define TIPC_MAX_TFMS_DEF 10 50#define TIPC_MAX_TFMS_LIM 1000 51 52#define TIPC_REKEYING_INTV_DEF (60 * 24) /* default: 1 day */ 53 54/** 55 * TIPC Key ids 56 */ 57enum { 58 KEY_MASTER = 0, 59 KEY_MIN = KEY_MASTER, 60 KEY_1 = 1, 61 KEY_2, 62 KEY_3, 63 KEY_MAX = KEY_3, 64}; 65 66/** 67 * TIPC Crypto statistics 68 */ 69enum { 70 STAT_OK, 71 STAT_NOK, 72 STAT_ASYNC, 73 STAT_ASYNC_OK, 74 STAT_ASYNC_NOK, 75 STAT_BADKEYS, /* tx only */ 76 STAT_BADMSGS = STAT_BADKEYS, /* rx only */ 77 STAT_NOKEYS, 78 STAT_SWITCHES, 79 80 MAX_STATS, 81}; 82 83/* TIPC crypto statistics' header */ 84static const char *hstats[MAX_STATS] = {"ok", "nok", "async", "async_ok", 85 "async_nok", "badmsgs", "nokeys", 86 "switches"}; 87 88/* Max TFMs number per key */ 89int sysctl_tipc_max_tfms __read_mostly = TIPC_MAX_TFMS_DEF; 90/* Key exchange switch, default: on */ 91int sysctl_tipc_key_exchange_enabled __read_mostly = 1; 92 93/** 94 * struct tipc_key - TIPC keys' status indicator 95 * 96 * 7 6 5 4 3 2 1 0 97 * +-----+-----+-----+-----+-----+-----+-----+-----+ 98 * key: | (reserved)|passive idx| active idx|pending idx| 99 * +-----+-----+-----+-----+-----+-----+-----+-----+ 100 */ 101struct tipc_key { 102#define KEY_BITS (2) 103#define KEY_MASK ((1 << KEY_BITS) - 1) 104 union { 105 struct { 106#if defined(__LITTLE_ENDIAN_BITFIELD) 107 u8 pending:2, 108 active:2, 109 passive:2, /* rx only */ 110 reserved:2; 111#elif defined(__BIG_ENDIAN_BITFIELD) 112 u8 reserved:2, 113 passive:2, /* rx only */ 114 active:2, 115 pending:2; 116#else 117#error "Please fix <asm/byteorder.h>" 118#endif 119 } __packed; 120 u8 keys; 121 }; 122}; 123 124/** 125 * struct tipc_tfm - TIPC TFM structure to form a list of TFMs 126 */ 127struct tipc_tfm { 128 struct crypto_aead *tfm; 129 struct list_head list; 130}; 131 132/** 133 * struct tipc_aead - TIPC AEAD key structure 134 * @tfm_entry: per-cpu pointer to one entry in TFM list 135 * @crypto: TIPC crypto owns this key 136 * @cloned: reference to the source key in case cloning 137 * @users: the number of the key users (TX/RX) 138 * @salt: the key's SALT value 139 * @authsize: authentication tag size (max = 16) 140 * @mode: crypto mode is applied to the key 141 * @hint[]: a hint for user key 142 * @rcu: struct rcu_head 143 * @key: the aead key 144 * @gen: the key's generation 145 * @seqno: the key seqno (cluster scope) 146 * @refcnt: the key reference counter 147 */ 148struct tipc_aead { 149#define TIPC_AEAD_HINT_LEN (5) 150 struct tipc_tfm * __percpu *tfm_entry; 151 struct tipc_crypto *crypto; 152 struct tipc_aead *cloned; 153 atomic_t users; 154 u32 salt; 155 u8 authsize; 156 u8 mode; 157 char hint[2 * TIPC_AEAD_HINT_LEN + 1]; 158 struct rcu_head rcu; 159 struct tipc_aead_key *key; 160 u16 gen; 161 162 atomic64_t seqno ____cacheline_aligned; 163 refcount_t refcnt ____cacheline_aligned; 164 165} ____cacheline_aligned; 166 167/** 168 * struct tipc_crypto_stats - TIPC Crypto statistics 169 */ 170struct tipc_crypto_stats { 171 unsigned int stat[MAX_STATS]; 172}; 173 174/** 175 * struct tipc_crypto - TIPC TX/RX crypto structure 176 * @net: struct net 177 * @node: TIPC node (RX) 178 * @aead: array of pointers to AEAD keys for encryption/decryption 179 * @peer_rx_active: replicated peer RX active key index 180 * @key_gen: TX/RX key generation 181 * @key: the key states 182 * @skey_mode: session key's mode 183 * @skey: received session key 184 * @wq: common workqueue on TX crypto 185 * @work: delayed work sched for TX/RX 186 * @key_distr: key distributing state 187 * @rekeying_intv: rekeying interval (in minutes) 188 * @stats: the crypto statistics 189 * @name: the crypto name 190 * @sndnxt: the per-peer sndnxt (TX) 191 * @timer1: general timer 1 (jiffies) 192 * @timer2: general timer 2 (jiffies) 193 * @working: the crypto is working or not 194 * @key_master: flag indicates if master key exists 195 * @legacy_user: flag indicates if a peer joins w/o master key (for bwd comp.) 196 * @nokey: no key indication 197 * @lock: tipc_key lock 198 */ 199struct tipc_crypto { 200 struct net *net; 201 struct tipc_node *node; 202 struct tipc_aead __rcu *aead[KEY_MAX + 1]; 203 atomic_t peer_rx_active; 204 u16 key_gen; 205 struct tipc_key key; 206 u8 skey_mode; 207 struct tipc_aead_key *skey; 208 struct workqueue_struct *wq; 209 struct delayed_work work; 210#define KEY_DISTR_SCHED 1 211#define KEY_DISTR_COMPL 2 212 atomic_t key_distr; 213 u32 rekeying_intv; 214 215 struct tipc_crypto_stats __percpu *stats; 216 char name[48]; 217 218 atomic64_t sndnxt ____cacheline_aligned; 219 unsigned long timer1; 220 unsigned long timer2; 221 union { 222 struct { 223 u8 working:1; 224 u8 key_master:1; 225 u8 legacy_user:1; 226 u8 nokey: 1; 227 }; 228 u8 flags; 229 }; 230 spinlock_t lock; /* crypto lock */ 231 232} ____cacheline_aligned; 233 234/* struct tipc_crypto_tx_ctx - TX context for callbacks */ 235struct tipc_crypto_tx_ctx { 236 struct tipc_aead *aead; 237 struct tipc_bearer *bearer; 238 struct tipc_media_addr dst; 239}; 240 241/* struct tipc_crypto_rx_ctx - RX context for callbacks */ 242struct tipc_crypto_rx_ctx { 243 struct tipc_aead *aead; 244 struct tipc_bearer *bearer; 245}; 246 247static struct tipc_aead *tipc_aead_get(struct tipc_aead __rcu *aead); 248static inline void tipc_aead_put(struct tipc_aead *aead); 249static void tipc_aead_free(struct rcu_head *rp); 250static int tipc_aead_users(struct tipc_aead __rcu *aead); 251static void tipc_aead_users_inc(struct tipc_aead __rcu *aead, int lim); 252static void tipc_aead_users_dec(struct tipc_aead __rcu *aead, int lim); 253static void tipc_aead_users_set(struct tipc_aead __rcu *aead, int val); 254static struct crypto_aead *tipc_aead_tfm_next(struct tipc_aead *aead); 255static int tipc_aead_init(struct tipc_aead **aead, struct tipc_aead_key *ukey, 256 u8 mode); 257static int tipc_aead_clone(struct tipc_aead **dst, struct tipc_aead *src); 258static void *tipc_aead_mem_alloc(struct crypto_aead *tfm, 259 unsigned int crypto_ctx_size, 260 u8 **iv, struct aead_request **req, 261 struct scatterlist **sg, int nsg); 262static int tipc_aead_encrypt(struct tipc_aead *aead, struct sk_buff *skb, 263 struct tipc_bearer *b, 264 struct tipc_media_addr *dst, 265 struct tipc_node *__dnode); 266static void tipc_aead_encrypt_done(struct crypto_async_request *base, int err); 267static int tipc_aead_decrypt(struct net *net, struct tipc_aead *aead, 268 struct sk_buff *skb, struct tipc_bearer *b); 269static void tipc_aead_decrypt_done(struct crypto_async_request *base, int err); 270static inline int tipc_ehdr_size(struct tipc_ehdr *ehdr); 271static int tipc_ehdr_build(struct net *net, struct tipc_aead *aead, 272 u8 tx_key, struct sk_buff *skb, 273 struct tipc_crypto *__rx); 274static inline void tipc_crypto_key_set_state(struct tipc_crypto *c, 275 u8 new_passive, 276 u8 new_active, 277 u8 new_pending); 278static int tipc_crypto_key_attach(struct tipc_crypto *c, 279 struct tipc_aead *aead, u8 pos, 280 bool master_key); 281static bool tipc_crypto_key_try_align(struct tipc_crypto *rx, u8 new_pending); 282static struct tipc_aead *tipc_crypto_key_pick_tx(struct tipc_crypto *tx, 283 struct tipc_crypto *rx, 284 struct sk_buff *skb, 285 u8 tx_key); 286static void tipc_crypto_key_synch(struct tipc_crypto *rx, struct sk_buff *skb); 287static int tipc_crypto_key_revoke(struct net *net, u8 tx_key); 288static inline void tipc_crypto_clone_msg(struct net *net, struct sk_buff *_skb, 289 struct tipc_bearer *b, 290 struct tipc_media_addr *dst, 291 struct tipc_node *__dnode, u8 type); 292static void tipc_crypto_rcv_complete(struct net *net, struct tipc_aead *aead, 293 struct tipc_bearer *b, 294 struct sk_buff **skb, int err); 295static void tipc_crypto_do_cmd(struct net *net, int cmd); 296static char *tipc_crypto_key_dump(struct tipc_crypto *c, char *buf); 297static char *tipc_key_change_dump(struct tipc_key old, struct tipc_key new, 298 char *buf); 299static int tipc_crypto_key_xmit(struct net *net, struct tipc_aead_key *skey, 300 u16 gen, u8 mode, u32 dnode); 301static bool tipc_crypto_key_rcv(struct tipc_crypto *rx, struct tipc_msg *hdr); 302static void tipc_crypto_work_tx(struct work_struct *work); 303static void tipc_crypto_work_rx(struct work_struct *work); 304static int tipc_aead_key_generate(struct tipc_aead_key *skey); 305 306#define is_tx(crypto) (!(crypto)->node) 307#define is_rx(crypto) (!is_tx(crypto)) 308 309#define key_next(cur) ((cur) % KEY_MAX + 1) 310 311#define tipc_aead_rcu_ptr(rcu_ptr, lock) \ 312 rcu_dereference_protected((rcu_ptr), lockdep_is_held(lock)) 313 314#define tipc_aead_rcu_replace(rcu_ptr, ptr, lock) \ 315do { \ 316 typeof(rcu_ptr) __tmp = rcu_dereference_protected((rcu_ptr), \ 317 lockdep_is_held(lock)); \ 318 rcu_assign_pointer((rcu_ptr), (ptr)); \ 319 tipc_aead_put(__tmp); \ 320} while (0) 321 322#define tipc_crypto_key_detach(rcu_ptr, lock) \ 323 tipc_aead_rcu_replace((rcu_ptr), NULL, lock) 324 325/** 326 * tipc_aead_key_validate - Validate a AEAD user key 327 */ 328int tipc_aead_key_validate(struct tipc_aead_key *ukey, struct genl_info *info) 329{ 330 int keylen; 331 332 /* Check if algorithm exists */ 333 if (unlikely(!crypto_has_alg(ukey->alg_name, 0, 0))) { 334 GENL_SET_ERR_MSG(info, "unable to load the algorithm (module existed?)"); 335 return -ENODEV; 336 } 337 338 /* Currently, we only support the "gcm(aes)" cipher algorithm */ 339 if (strcmp(ukey->alg_name, "gcm(aes)")) { 340 GENL_SET_ERR_MSG(info, "not supported yet the algorithm"); 341 return -ENOTSUPP; 342 } 343 344 /* Check if key size is correct */ 345 keylen = ukey->keylen - TIPC_AES_GCM_SALT_SIZE; 346 if (unlikely(keylen != TIPC_AES_GCM_KEY_SIZE_128 && 347 keylen != TIPC_AES_GCM_KEY_SIZE_192 && 348 keylen != TIPC_AES_GCM_KEY_SIZE_256)) { 349 GENL_SET_ERR_MSG(info, "incorrect key length (20, 28 or 36 octets?)"); 350 return -EKEYREJECTED; 351 } 352 353 return 0; 354} 355 356/** 357 * tipc_aead_key_generate - Generate new session key 358 * @skey: input/output key with new content 359 * 360 * Return: 0 in case of success, otherwise < 0 361 */ 362static int tipc_aead_key_generate(struct tipc_aead_key *skey) 363{ 364 int rc = 0; 365 366 /* Fill the key's content with a random value via RNG cipher */ 367 rc = crypto_get_default_rng(); 368 if (likely(!rc)) { 369 rc = crypto_rng_get_bytes(crypto_default_rng, skey->key, 370 skey->keylen); 371 crypto_put_default_rng(); 372 } 373 374 return rc; 375} 376 377static struct tipc_aead *tipc_aead_get(struct tipc_aead __rcu *aead) 378{ 379 struct tipc_aead *tmp; 380 381 rcu_read_lock(); 382 tmp = rcu_dereference(aead); 383 if (unlikely(!tmp || !refcount_inc_not_zero(&tmp->refcnt))) 384 tmp = NULL; 385 rcu_read_unlock(); 386 387 return tmp; 388} 389 390static inline void tipc_aead_put(struct tipc_aead *aead) 391{ 392 if (aead && refcount_dec_and_test(&aead->refcnt)) 393 call_rcu(&aead->rcu, tipc_aead_free); 394} 395 396/** 397 * tipc_aead_free - Release AEAD key incl. all the TFMs in the list 398 * @rp: rcu head pointer 399 */ 400static void tipc_aead_free(struct rcu_head *rp) 401{ 402 struct tipc_aead *aead = container_of(rp, struct tipc_aead, rcu); 403 struct tipc_tfm *tfm_entry, *head, *tmp; 404 405 if (aead->cloned) { 406 tipc_aead_put(aead->cloned); 407 } else { 408 head = *get_cpu_ptr(aead->tfm_entry); 409 put_cpu_ptr(aead->tfm_entry); 410 list_for_each_entry_safe(tfm_entry, tmp, &head->list, list) { 411 crypto_free_aead(tfm_entry->tfm); 412 list_del(&tfm_entry->list); 413 kfree(tfm_entry); 414 } 415 /* Free the head */ 416 crypto_free_aead(head->tfm); 417 list_del(&head->list); 418 kfree(head); 419 } 420 free_percpu(aead->tfm_entry); 421 kfree_sensitive(aead->key); 422 kfree(aead); 423} 424 425static int tipc_aead_users(struct tipc_aead __rcu *aead) 426{ 427 struct tipc_aead *tmp; 428 int users = 0; 429 430 rcu_read_lock(); 431 tmp = rcu_dereference(aead); 432 if (tmp) 433 users = atomic_read(&tmp->users); 434 rcu_read_unlock(); 435 436 return users; 437} 438 439static void tipc_aead_users_inc(struct tipc_aead __rcu *aead, int lim) 440{ 441 struct tipc_aead *tmp; 442 443 rcu_read_lock(); 444 tmp = rcu_dereference(aead); 445 if (tmp) 446 atomic_add_unless(&tmp->users, 1, lim); 447 rcu_read_unlock(); 448} 449 450static void tipc_aead_users_dec(struct tipc_aead __rcu *aead, int lim) 451{ 452 struct tipc_aead *tmp; 453 454 rcu_read_lock(); 455 tmp = rcu_dereference(aead); 456 if (tmp) 457 atomic_add_unless(&rcu_dereference(aead)->users, -1, lim); 458 rcu_read_unlock(); 459} 460 461static void tipc_aead_users_set(struct tipc_aead __rcu *aead, int val) 462{ 463 struct tipc_aead *tmp; 464 int cur; 465 466 rcu_read_lock(); 467 tmp = rcu_dereference(aead); 468 if (tmp) { 469 do { 470 cur = atomic_read(&tmp->users); 471 if (cur == val) 472 break; 473 } while (atomic_cmpxchg(&tmp->users, cur, val) != cur); 474 } 475 rcu_read_unlock(); 476} 477 478/** 479 * tipc_aead_tfm_next - Move TFM entry to the next one in list and return it 480 */ 481static struct crypto_aead *tipc_aead_tfm_next(struct tipc_aead *aead) 482{ 483 struct tipc_tfm **tfm_entry; 484 struct crypto_aead *tfm; 485 486 tfm_entry = get_cpu_ptr(aead->tfm_entry); 487 *tfm_entry = list_next_entry(*tfm_entry, list); 488 tfm = (*tfm_entry)->tfm; 489 put_cpu_ptr(tfm_entry); 490 491 return tfm; 492} 493 494/** 495 * tipc_aead_init - Initiate TIPC AEAD 496 * @aead: returned new TIPC AEAD key handle pointer 497 * @ukey: pointer to user key data 498 * @mode: the key mode 499 * 500 * Allocate a (list of) new cipher transformation (TFM) with the specific user 501 * key data if valid. The number of the allocated TFMs can be set via the sysfs 502 * "net/tipc/max_tfms" first. 503 * Also, all the other AEAD data are also initialized. 504 * 505 * Return: 0 if the initiation is successful, otherwise: < 0 506 */ 507static int tipc_aead_init(struct tipc_aead **aead, struct tipc_aead_key *ukey, 508 u8 mode) 509{ 510 struct tipc_tfm *tfm_entry, *head; 511 struct crypto_aead *tfm; 512 struct tipc_aead *tmp; 513 int keylen, err, cpu; 514 int tfm_cnt = 0; 515 516 if (unlikely(*aead)) 517 return -EEXIST; 518 519 /* Allocate a new AEAD */ 520 tmp = kzalloc(sizeof(*tmp), GFP_ATOMIC); 521 if (unlikely(!tmp)) 522 return -ENOMEM; 523 524 /* The key consists of two parts: [AES-KEY][SALT] */ 525 keylen = ukey->keylen - TIPC_AES_GCM_SALT_SIZE; 526 527 /* Allocate per-cpu TFM entry pointer */ 528 tmp->tfm_entry = alloc_percpu(struct tipc_tfm *); 529 if (!tmp->tfm_entry) { 530 kfree_sensitive(tmp); 531 return -ENOMEM; 532 } 533 534 /* Make a list of TFMs with the user key data */ 535 do { 536 tfm = crypto_alloc_aead(ukey->alg_name, 0, 0); 537 if (IS_ERR(tfm)) { 538 err = PTR_ERR(tfm); 539 break; 540 } 541 542 if (unlikely(!tfm_cnt && 543 crypto_aead_ivsize(tfm) != TIPC_AES_GCM_IV_SIZE)) { 544 crypto_free_aead(tfm); 545 err = -ENOTSUPP; 546 break; 547 } 548 549 err = crypto_aead_setauthsize(tfm, TIPC_AES_GCM_TAG_SIZE); 550 err |= crypto_aead_setkey(tfm, ukey->key, keylen); 551 if (unlikely(err)) { 552 crypto_free_aead(tfm); 553 break; 554 } 555 556 tfm_entry = kmalloc(sizeof(*tfm_entry), GFP_KERNEL); 557 if (unlikely(!tfm_entry)) { 558 crypto_free_aead(tfm); 559 err = -ENOMEM; 560 break; 561 } 562 INIT_LIST_HEAD(&tfm_entry->list); 563 tfm_entry->tfm = tfm; 564 565 /* First entry? */ 566 if (!tfm_cnt) { 567 head = tfm_entry; 568 for_each_possible_cpu(cpu) { 569 *per_cpu_ptr(tmp->tfm_entry, cpu) = head; 570 } 571 } else { 572 list_add_tail(&tfm_entry->list, &head->list); 573 } 574 575 } while (++tfm_cnt < sysctl_tipc_max_tfms); 576 577 /* Not any TFM is allocated? */ 578 if (!tfm_cnt) { 579 free_percpu(tmp->tfm_entry); 580 kfree_sensitive(tmp); 581 return err; 582 } 583 584 /* Form a hex string of some last bytes as the key's hint */ 585 bin2hex(tmp->hint, ukey->key + keylen - TIPC_AEAD_HINT_LEN, 586 TIPC_AEAD_HINT_LEN); 587 588 /* Initialize the other data */ 589 tmp->mode = mode; 590 tmp->cloned = NULL; 591 tmp->authsize = TIPC_AES_GCM_TAG_SIZE; 592 tmp->key = kmemdup(ukey, tipc_aead_key_size(ukey), GFP_KERNEL); 593 if (!tmp->key) { 594 tipc_aead_free(&tmp->rcu); 595 return -ENOMEM; 596 } 597 memcpy(&tmp->salt, ukey->key + keylen, TIPC_AES_GCM_SALT_SIZE); 598 atomic_set(&tmp->users, 0); 599 atomic64_set(&tmp->seqno, 0); 600 refcount_set(&tmp->refcnt, 1); 601 602 *aead = tmp; 603 return 0; 604} 605 606/** 607 * tipc_aead_clone - Clone a TIPC AEAD key 608 * @dst: dest key for the cloning 609 * @src: source key to clone from 610 * 611 * Make a "copy" of the source AEAD key data to the dest, the TFMs list is 612 * common for the keys. 613 * A reference to the source is hold in the "cloned" pointer for the later 614 * freeing purposes. 615 * 616 * Note: this must be done in cluster-key mode only! 617 * Return: 0 in case of success, otherwise < 0 618 */ 619static int tipc_aead_clone(struct tipc_aead **dst, struct tipc_aead *src) 620{ 621 struct tipc_aead *aead; 622 int cpu; 623 624 if (!src) 625 return -ENOKEY; 626 627 if (src->mode != CLUSTER_KEY) 628 return -EINVAL; 629 630 if (unlikely(*dst)) 631 return -EEXIST; 632 633 aead = kzalloc(sizeof(*aead), GFP_ATOMIC); 634 if (unlikely(!aead)) 635 return -ENOMEM; 636 637 aead->tfm_entry = alloc_percpu_gfp(struct tipc_tfm *, GFP_ATOMIC); 638 if (unlikely(!aead->tfm_entry)) { 639 kfree_sensitive(aead); 640 return -ENOMEM; 641 } 642 643 for_each_possible_cpu(cpu) { 644 *per_cpu_ptr(aead->tfm_entry, cpu) = 645 *per_cpu_ptr(src->tfm_entry, cpu); 646 } 647 648 memcpy(aead->hint, src->hint, sizeof(src->hint)); 649 aead->mode = src->mode; 650 aead->salt = src->salt; 651 aead->authsize = src->authsize; 652 atomic_set(&aead->users, 0); 653 atomic64_set(&aead->seqno, 0); 654 refcount_set(&aead->refcnt, 1); 655 656 WARN_ON(!refcount_inc_not_zero(&src->refcnt)); 657 aead->cloned = src; 658 659 *dst = aead; 660 return 0; 661} 662 663/** 664 * tipc_aead_mem_alloc - Allocate memory for AEAD request operations 665 * @tfm: cipher handle to be registered with the request 666 * @crypto_ctx_size: size of crypto context for callback 667 * @iv: returned pointer to IV data 668 * @req: returned pointer to AEAD request data 669 * @sg: returned pointer to SG lists 670 * @nsg: number of SG lists to be allocated 671 * 672 * Allocate memory to store the crypto context data, AEAD request, IV and SG 673 * lists, the memory layout is as follows: 674 * crypto_ctx || iv || aead_req || sg[] 675 * 676 * Return: the pointer to the memory areas in case of success, otherwise NULL 677 */ 678static void *tipc_aead_mem_alloc(struct crypto_aead *tfm, 679 unsigned int crypto_ctx_size, 680 u8 **iv, struct aead_request **req, 681 struct scatterlist **sg, int nsg) 682{ 683 unsigned int iv_size, req_size; 684 unsigned int len; 685 u8 *mem; 686 687 iv_size = crypto_aead_ivsize(tfm); 688 req_size = sizeof(**req) + crypto_aead_reqsize(tfm); 689 690 len = crypto_ctx_size; 691 len += iv_size; 692 len += crypto_aead_alignmask(tfm) & ~(crypto_tfm_ctx_alignment() - 1); 693 len = ALIGN(len, crypto_tfm_ctx_alignment()); 694 len += req_size; 695 len = ALIGN(len, __alignof__(struct scatterlist)); 696 len += nsg * sizeof(**sg); 697 698 mem = kmalloc(len, GFP_ATOMIC); 699 if (!mem) 700 return NULL; 701 702 *iv = (u8 *)PTR_ALIGN(mem + crypto_ctx_size, 703 crypto_aead_alignmask(tfm) + 1); 704 *req = (struct aead_request *)PTR_ALIGN(*iv + iv_size, 705 crypto_tfm_ctx_alignment()); 706 *sg = (struct scatterlist *)PTR_ALIGN((u8 *)*req + req_size, 707 __alignof__(struct scatterlist)); 708 709 return (void *)mem; 710} 711 712/** 713 * tipc_aead_encrypt - Encrypt a message 714 * @aead: TIPC AEAD key for the message encryption 715 * @skb: the input/output skb 716 * @b: TIPC bearer where the message will be delivered after the encryption 717 * @dst: the destination media address 718 * @__dnode: TIPC dest node if "known" 719 * 720 * Return: 721 * 0 : if the encryption has completed 722 * -EINPROGRESS/-EBUSY : if a callback will be performed 723 * < 0 : the encryption has failed 724 */ 725static int tipc_aead_encrypt(struct tipc_aead *aead, struct sk_buff *skb, 726 struct tipc_bearer *b, 727 struct tipc_media_addr *dst, 728 struct tipc_node *__dnode) 729{ 730 struct crypto_aead *tfm = tipc_aead_tfm_next(aead); 731 struct tipc_crypto_tx_ctx *tx_ctx; 732 struct aead_request *req; 733 struct sk_buff *trailer; 734 struct scatterlist *sg; 735 struct tipc_ehdr *ehdr; 736 int ehsz, len, tailen, nsg, rc; 737 void *ctx; 738 u32 salt; 739 u8 *iv; 740 741 /* Make sure message len at least 4-byte aligned */ 742 len = ALIGN(skb->len, 4); 743 tailen = len - skb->len + aead->authsize; 744 745 /* Expand skb tail for authentication tag: 746 * As for simplicity, we'd have made sure skb having enough tailroom 747 * for authentication tag @skb allocation. Even when skb is nonlinear 748 * but there is no frag_list, it should be still fine! 749 * Otherwise, we must cow it to be a writable buffer with the tailroom. 750 */ 751 SKB_LINEAR_ASSERT(skb); 752 if (tailen > skb_tailroom(skb)) { 753 pr_debug("TX(): skb tailroom is not enough: %d, requires: %d\n", 754 skb_tailroom(skb), tailen); 755 } 756 757 if (unlikely(!skb_cloned(skb) && tailen <= skb_tailroom(skb))) { 758 nsg = 1; 759 trailer = skb; 760 } else { 761 /* TODO: We could avoid skb_cow_data() if skb has no frag_list 762 * e.g. by skb_fill_page_desc() to add another page to the skb 763 * with the wanted tailen... However, page skbs look not often, 764 * so take it easy now! 765 * Cloned skbs e.g. from link_xmit() seems no choice though :( 766 */ 767 nsg = skb_cow_data(skb, tailen, &trailer); 768 if (unlikely(nsg < 0)) { 769 pr_err("TX: skb_cow_data() returned %d\n", nsg); 770 return nsg; 771 } 772 } 773 774 pskb_put(skb, trailer, tailen); 775 776 /* Allocate memory for the AEAD operation */ 777 ctx = tipc_aead_mem_alloc(tfm, sizeof(*tx_ctx), &iv, &req, &sg, nsg); 778 if (unlikely(!ctx)) 779 return -ENOMEM; 780 TIPC_SKB_CB(skb)->crypto_ctx = ctx; 781 782 /* Map skb to the sg lists */ 783 sg_init_table(sg, nsg); 784 rc = skb_to_sgvec(skb, sg, 0, skb->len); 785 if (unlikely(rc < 0)) { 786 pr_err("TX: skb_to_sgvec() returned %d, nsg %d!\n", rc, nsg); 787 goto exit; 788 } 789 790 /* Prepare IV: [SALT (4 octets)][SEQNO (8 octets)] 791 * In case we're in cluster-key mode, SALT is varied by xor-ing with 792 * the source address (or w0 of id), otherwise with the dest address 793 * if dest is known. 794 */ 795 ehdr = (struct tipc_ehdr *)skb->data; 796 salt = aead->salt; 797 if (aead->mode == CLUSTER_KEY) 798 salt ^= ehdr->addr; /* __be32 */ 799 else if (__dnode) 800 salt ^= tipc_node_get_addr(__dnode); 801 memcpy(iv, &salt, 4); 802 memcpy(iv + 4, (u8 *)&ehdr->seqno, 8); 803 804 /* Prepare request */ 805 ehsz = tipc_ehdr_size(ehdr); 806 aead_request_set_tfm(req, tfm); 807 aead_request_set_ad(req, ehsz); 808 aead_request_set_crypt(req, sg, sg, len - ehsz, iv); 809 810 /* Set callback function & data */ 811 aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 812 tipc_aead_encrypt_done, skb); 813 tx_ctx = (struct tipc_crypto_tx_ctx *)ctx; 814 tx_ctx->aead = aead; 815 tx_ctx->bearer = b; 816 memcpy(&tx_ctx->dst, dst, sizeof(*dst)); 817 818 /* Hold bearer */ 819 if (unlikely(!tipc_bearer_hold(b))) { 820 rc = -ENODEV; 821 goto exit; 822 } 823 824 /* Now, do encrypt */ 825 rc = crypto_aead_encrypt(req); 826 if (rc == -EINPROGRESS || rc == -EBUSY) 827 return rc; 828 829 tipc_bearer_put(b); 830 831exit: 832 kfree(ctx); 833 TIPC_SKB_CB(skb)->crypto_ctx = NULL; 834 return rc; 835} 836 837static void tipc_aead_encrypt_done(struct crypto_async_request *base, int err) 838{ 839 struct sk_buff *skb = base->data; 840 struct tipc_crypto_tx_ctx *tx_ctx = TIPC_SKB_CB(skb)->crypto_ctx; 841 struct tipc_bearer *b = tx_ctx->bearer; 842 struct tipc_aead *aead = tx_ctx->aead; 843 struct tipc_crypto *tx = aead->crypto; 844 struct net *net = tx->net; 845 846 switch (err) { 847 case 0: 848 this_cpu_inc(tx->stats->stat[STAT_ASYNC_OK]); 849 rcu_read_lock(); 850 if (likely(test_bit(0, &b->up))) 851 b->media->send_msg(net, skb, b, &tx_ctx->dst); 852 else 853 kfree_skb(skb); 854 rcu_read_unlock(); 855 break; 856 case -EINPROGRESS: 857 return; 858 default: 859 this_cpu_inc(tx->stats->stat[STAT_ASYNC_NOK]); 860 kfree_skb(skb); 861 break; 862 } 863 864 kfree(tx_ctx); 865 tipc_bearer_put(b); 866 tipc_aead_put(aead); 867} 868 869/** 870 * tipc_aead_decrypt - Decrypt an encrypted message 871 * @net: struct net 872 * @aead: TIPC AEAD for the message decryption 873 * @skb: the input/output skb 874 * @b: TIPC bearer where the message has been received 875 * 876 * Return: 877 * 0 : if the decryption has completed 878 * -EINPROGRESS/-EBUSY : if a callback will be performed 879 * < 0 : the decryption has failed 880 */ 881static int tipc_aead_decrypt(struct net *net, struct tipc_aead *aead, 882 struct sk_buff *skb, struct tipc_bearer *b) 883{ 884 struct tipc_crypto_rx_ctx *rx_ctx; 885 struct aead_request *req; 886 struct crypto_aead *tfm; 887 struct sk_buff *unused; 888 struct scatterlist *sg; 889 struct tipc_ehdr *ehdr; 890 int ehsz, nsg, rc; 891 void *ctx; 892 u32 salt; 893 u8 *iv; 894 895 if (unlikely(!aead)) 896 return -ENOKEY; 897 898 nsg = skb_cow_data(skb, 0, &unused); 899 if (unlikely(nsg < 0)) { 900 pr_err("RX: skb_cow_data() returned %d\n", nsg); 901 return nsg; 902 } 903 904 /* Allocate memory for the AEAD operation */ 905 tfm = tipc_aead_tfm_next(aead); 906 ctx = tipc_aead_mem_alloc(tfm, sizeof(*rx_ctx), &iv, &req, &sg, nsg); 907 if (unlikely(!ctx)) 908 return -ENOMEM; 909 TIPC_SKB_CB(skb)->crypto_ctx = ctx; 910 911 /* Map skb to the sg lists */ 912 sg_init_table(sg, nsg); 913 rc = skb_to_sgvec(skb, sg, 0, skb->len); 914 if (unlikely(rc < 0)) { 915 pr_err("RX: skb_to_sgvec() returned %d, nsg %d\n", rc, nsg); 916 goto exit; 917 } 918 919 /* Reconstruct IV: */ 920 ehdr = (struct tipc_ehdr *)skb->data; 921 salt = aead->salt; 922 if (aead->mode == CLUSTER_KEY) 923 salt ^= ehdr->addr; /* __be32 */ 924 else if (ehdr->destined) 925 salt ^= tipc_own_addr(net); 926 memcpy(iv, &salt, 4); 927 memcpy(iv + 4, (u8 *)&ehdr->seqno, 8); 928 929 /* Prepare request */ 930 ehsz = tipc_ehdr_size(ehdr); 931 aead_request_set_tfm(req, tfm); 932 aead_request_set_ad(req, ehsz); 933 aead_request_set_crypt(req, sg, sg, skb->len - ehsz, iv); 934 935 /* Set callback function & data */ 936 aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 937 tipc_aead_decrypt_done, skb); 938 rx_ctx = (struct tipc_crypto_rx_ctx *)ctx; 939 rx_ctx->aead = aead; 940 rx_ctx->bearer = b; 941 942 /* Hold bearer */ 943 if (unlikely(!tipc_bearer_hold(b))) { 944 rc = -ENODEV; 945 goto exit; 946 } 947 948 /* Now, do decrypt */ 949 rc = crypto_aead_decrypt(req); 950 if (rc == -EINPROGRESS || rc == -EBUSY) 951 return rc; 952 953 tipc_bearer_put(b); 954 955exit: 956 kfree(ctx); 957 TIPC_SKB_CB(skb)->crypto_ctx = NULL; 958 return rc; 959} 960 961static void tipc_aead_decrypt_done(struct crypto_async_request *base, int err) 962{ 963 struct sk_buff *skb = base->data; 964 struct tipc_crypto_rx_ctx *rx_ctx = TIPC_SKB_CB(skb)->crypto_ctx; 965 struct tipc_bearer *b = rx_ctx->bearer; 966 struct tipc_aead *aead = rx_ctx->aead; 967 struct tipc_crypto_stats __percpu *stats = aead->crypto->stats; 968 struct net *net = aead->crypto->net; 969 970 switch (err) { 971 case 0: 972 this_cpu_inc(stats->stat[STAT_ASYNC_OK]); 973 break; 974 case -EINPROGRESS: 975 return; 976 default: 977 this_cpu_inc(stats->stat[STAT_ASYNC_NOK]); 978 break; 979 } 980 981 kfree(rx_ctx); 982 tipc_crypto_rcv_complete(net, aead, b, &skb, err); 983 if (likely(skb)) { 984 if (likely(test_bit(0, &b->up))) 985 tipc_rcv(net, skb, b); 986 else 987 kfree_skb(skb); 988 } 989 990 tipc_bearer_put(b); 991} 992 993static inline int tipc_ehdr_size(struct tipc_ehdr *ehdr) 994{ 995 return (ehdr->user != LINK_CONFIG) ? EHDR_SIZE : EHDR_CFG_SIZE; 996} 997 998/** 999 * tipc_ehdr_validate - Validate an encryption message 1000 * @skb: the message buffer 1001 * 1002 * Returns "true" if this is a valid encryption message, otherwise "false" 1003 */ 1004bool tipc_ehdr_validate(struct sk_buff *skb) 1005{ 1006 struct tipc_ehdr *ehdr; 1007 int ehsz; 1008 1009 if (unlikely(!pskb_may_pull(skb, EHDR_MIN_SIZE))) 1010 return false; 1011 1012 ehdr = (struct tipc_ehdr *)skb->data; 1013 if (unlikely(ehdr->version != TIPC_EVERSION)) 1014 return false; 1015 ehsz = tipc_ehdr_size(ehdr); 1016 if (unlikely(!pskb_may_pull(skb, ehsz))) 1017 return false; 1018 if (unlikely(skb->len <= ehsz + TIPC_AES_GCM_TAG_SIZE)) 1019 return false; 1020 1021 return true; 1022} 1023 1024/** 1025 * tipc_ehdr_build - Build TIPC encryption message header 1026 * @net: struct net 1027 * @aead: TX AEAD key to be used for the message encryption 1028 * @tx_key: key id used for the message encryption 1029 * @skb: input/output message skb 1030 * @__rx: RX crypto handle if dest is "known" 1031 * 1032 * Return: the header size if the building is successful, otherwise < 0 1033 */ 1034static int tipc_ehdr_build(struct net *net, struct tipc_aead *aead, 1035 u8 tx_key, struct sk_buff *skb, 1036 struct tipc_crypto *__rx) 1037{ 1038 struct tipc_msg *hdr = buf_msg(skb); 1039 struct tipc_ehdr *ehdr; 1040 u32 user = msg_user(hdr); 1041 u64 seqno; 1042 int ehsz; 1043 1044 /* Make room for encryption header */ 1045 ehsz = (user != LINK_CONFIG) ? EHDR_SIZE : EHDR_CFG_SIZE; 1046 WARN_ON(skb_headroom(skb) < ehsz); 1047 ehdr = (struct tipc_ehdr *)skb_push(skb, ehsz); 1048 1049 /* Obtain a seqno first: 1050 * Use the key seqno (= cluster wise) if dest is unknown or we're in 1051 * cluster key mode, otherwise it's better for a per-peer seqno! 1052 */ 1053 if (!__rx || aead->mode == CLUSTER_KEY) 1054 seqno = atomic64_inc_return(&aead->seqno); 1055 else 1056 seqno = atomic64_inc_return(&__rx->sndnxt); 1057 1058 /* Revoke the key if seqno is wrapped around */ 1059 if (unlikely(!seqno)) 1060 return tipc_crypto_key_revoke(net, tx_key); 1061 1062 /* Word 1-2 */ 1063 ehdr->seqno = cpu_to_be64(seqno); 1064 1065 /* Words 0, 3- */ 1066 ehdr->version = TIPC_EVERSION; 1067 ehdr->user = 0; 1068 ehdr->keepalive = 0; 1069 ehdr->tx_key = tx_key; 1070 ehdr->destined = (__rx) ? 1 : 0; 1071 ehdr->rx_key_active = (__rx) ? __rx->key.active : 0; 1072 ehdr->rx_nokey = (__rx) ? __rx->nokey : 0; 1073 ehdr->master_key = aead->crypto->key_master; 1074 ehdr->reserved_1 = 0; 1075 ehdr->reserved_2 = 0; 1076 1077 switch (user) { 1078 case LINK_CONFIG: 1079 ehdr->user = LINK_CONFIG; 1080 memcpy(ehdr->id, tipc_own_id(net), NODE_ID_LEN); 1081 break; 1082 default: 1083 if (user == LINK_PROTOCOL && msg_type(hdr) == STATE_MSG) { 1084 ehdr->user = LINK_PROTOCOL; 1085 ehdr->keepalive = msg_is_keepalive(hdr); 1086 } 1087 ehdr->addr = hdr->hdr[3]; 1088 break; 1089 } 1090 1091 return ehsz; 1092} 1093 1094static inline void tipc_crypto_key_set_state(struct tipc_crypto *c, 1095 u8 new_passive, 1096 u8 new_active, 1097 u8 new_pending) 1098{ 1099 struct tipc_key old = c->key; 1100 char buf[32]; 1101 1102 c->key.keys = ((new_passive & KEY_MASK) << (KEY_BITS * 2)) | 1103 ((new_active & KEY_MASK) << (KEY_BITS)) | 1104 ((new_pending & KEY_MASK)); 1105 1106 pr_debug("%s: key changing %s ::%pS\n", c->name, 1107 tipc_key_change_dump(old, c->key, buf), 1108 __builtin_return_address(0)); 1109} 1110 1111/** 1112 * tipc_crypto_key_init - Initiate a new user / AEAD key 1113 * @c: TIPC crypto to which new key is attached 1114 * @ukey: the user key 1115 * @mode: the key mode (CLUSTER_KEY or PER_NODE_KEY) 1116 * @master_key: specify this is a cluster master key 1117 * 1118 * A new TIPC AEAD key will be allocated and initiated with the specified user 1119 * key, then attached to the TIPC crypto. 1120 * 1121 * Return: new key id in case of success, otherwise: < 0 1122 */ 1123int tipc_crypto_key_init(struct tipc_crypto *c, struct tipc_aead_key *ukey, 1124 u8 mode, bool master_key) 1125{ 1126 struct tipc_aead *aead = NULL; 1127 int rc = 0; 1128 1129 /* Initiate with the new user key */ 1130 rc = tipc_aead_init(&aead, ukey, mode); 1131 1132 /* Attach it to the crypto */ 1133 if (likely(!rc)) { 1134 rc = tipc_crypto_key_attach(c, aead, 0, master_key); 1135 if (rc < 0) 1136 tipc_aead_free(&aead->rcu); 1137 } 1138 1139 return rc; 1140} 1141 1142/** 1143 * tipc_crypto_key_attach - Attach a new AEAD key to TIPC crypto 1144 * @c: TIPC crypto to which the new AEAD key is attached 1145 * @aead: the new AEAD key pointer 1146 * @pos: desired slot in the crypto key array, = 0 if any! 1147 * @master_key: specify this is a cluster master key 1148 * 1149 * Return: new key id in case of success, otherwise: -EBUSY 1150 */ 1151static int tipc_crypto_key_attach(struct tipc_crypto *c, 1152 struct tipc_aead *aead, u8 pos, 1153 bool master_key) 1154{ 1155 struct tipc_key key; 1156 int rc = -EBUSY; 1157 u8 new_key; 1158 1159 spin_lock_bh(&c->lock); 1160 key = c->key; 1161 if (master_key) { 1162 new_key = KEY_MASTER; 1163 goto attach; 1164 } 1165 if (key.active && key.passive) 1166 goto exit; 1167 if (key.pending) { 1168 if (tipc_aead_users(c->aead[key.pending]) > 0) 1169 goto exit; 1170 /* if (pos): ok with replacing, will be aligned when needed */ 1171 /* Replace it */ 1172 new_key = key.pending; 1173 } else { 1174 if (pos) { 1175 if (key.active && pos != key_next(key.active)) { 1176 key.passive = pos; 1177 new_key = pos; 1178 goto attach; 1179 } else if (!key.active && !key.passive) { 1180 key.pending = pos; 1181 new_key = pos; 1182 goto attach; 1183 } 1184 } 1185 key.pending = key_next(key.active ?: key.passive); 1186 new_key = key.pending; 1187 } 1188 1189attach: 1190 aead->crypto = c; 1191 aead->gen = (is_tx(c)) ? ++c->key_gen : c->key_gen; 1192 tipc_aead_rcu_replace(c->aead[new_key], aead, &c->lock); 1193 if (likely(c->key.keys != key.keys)) 1194 tipc_crypto_key_set_state(c, key.passive, key.active, 1195 key.pending); 1196 c->working = 1; 1197 c->nokey = 0; 1198 c->key_master |= master_key; 1199 rc = new_key; 1200 1201exit: 1202 spin_unlock_bh(&c->lock); 1203 return rc; 1204} 1205 1206void tipc_crypto_key_flush(struct tipc_crypto *c) 1207{ 1208 struct tipc_crypto *tx, *rx; 1209 int k; 1210 1211 spin_lock_bh(&c->lock); 1212 if (is_rx(c)) { 1213 /* Try to cancel pending work */ 1214 rx = c; 1215 tx = tipc_net(rx->net)->crypto_tx; 1216 if (cancel_delayed_work(&rx->work)) { 1217 kfree(rx->skey); 1218 rx->skey = NULL; 1219 atomic_xchg(&rx->key_distr, 0); 1220 tipc_node_put(rx->node); 1221 } 1222 /* RX stopping => decrease TX key users if any */ 1223 k = atomic_xchg(&rx->peer_rx_active, 0); 1224 if (k) { 1225 tipc_aead_users_dec(tx->aead[k], 0); 1226 /* Mark the point TX key users changed */ 1227 tx->timer1 = jiffies; 1228 } 1229 } 1230 1231 c->flags = 0; 1232 tipc_crypto_key_set_state(c, 0, 0, 0); 1233 for (k = KEY_MIN; k <= KEY_MAX; k++) 1234 tipc_crypto_key_detach(c->aead[k], &c->lock); 1235 atomic64_set(&c->sndnxt, 0); 1236 spin_unlock_bh(&c->lock); 1237} 1238 1239/** 1240 * tipc_crypto_key_try_align - Align RX keys if possible 1241 * @rx: RX crypto handle 1242 * @new_pending: new pending slot if aligned (= TX key from peer) 1243 * 1244 * Peer has used an unknown key slot, this only happens when peer has left and 1245 * rejoned, or we are newcomer. 1246 * That means, there must be no active key but a pending key at unaligned slot. 1247 * If so, we try to move the pending key to the new slot. 1248 * Note: A potential passive key can exist, it will be shifted correspondingly! 1249 * 1250 * Return: "true" if key is successfully aligned, otherwise "false" 1251 */ 1252static bool tipc_crypto_key_try_align(struct tipc_crypto *rx, u8 new_pending) 1253{ 1254 struct tipc_aead *tmp1, *tmp2 = NULL; 1255 struct tipc_key key; 1256 bool aligned = false; 1257 u8 new_passive = 0; 1258 int x; 1259 1260 spin_lock(&rx->lock); 1261 key = rx->key; 1262 if (key.pending == new_pending) { 1263 aligned = true; 1264 goto exit; 1265 } 1266 if (key.active) 1267 goto exit; 1268 if (!key.pending) 1269 goto exit; 1270 if (tipc_aead_users(rx->aead[key.pending]) > 0) 1271 goto exit; 1272 1273 /* Try to "isolate" this pending key first */ 1274 tmp1 = tipc_aead_rcu_ptr(rx->aead[key.pending], &rx->lock); 1275 if (!refcount_dec_if_one(&tmp1->refcnt)) 1276 goto exit; 1277 rcu_assign_pointer(rx->aead[key.pending], NULL); 1278 1279 /* Move passive key if any */ 1280 if (key.passive) { 1281 tmp2 = rcu_replace_pointer(rx->aead[key.passive], tmp2, lockdep_is_held(&rx->lock)); 1282 x = (key.passive - key.pending + new_pending) % KEY_MAX; 1283 new_passive = (x <= 0) ? x + KEY_MAX : x; 1284 } 1285 1286 /* Re-allocate the key(s) */ 1287 tipc_crypto_key_set_state(rx, new_passive, 0, new_pending); 1288 rcu_assign_pointer(rx->aead[new_pending], tmp1); 1289 if (new_passive) 1290 rcu_assign_pointer(rx->aead[new_passive], tmp2); 1291 refcount_set(&tmp1->refcnt, 1); 1292 aligned = true; 1293 pr_info_ratelimited("%s: key[%d] -> key[%d]\n", rx->name, key.pending, 1294 new_pending); 1295 1296exit: 1297 spin_unlock(&rx->lock); 1298 return aligned; 1299} 1300 1301/** 1302 * tipc_crypto_key_pick_tx - Pick one TX key for message decryption 1303 * @tx: TX crypto handle 1304 * @rx: RX crypto handle (can be NULL) 1305 * @skb: the message skb which will be decrypted later 1306 * @tx_key: peer TX key id 1307 * 1308 * This function looks up the existing TX keys and pick one which is suitable 1309 * for the message decryption, that must be a cluster key and not used before 1310 * on the same message (i.e. recursive). 1311 * 1312 * Return: the TX AEAD key handle in case of success, otherwise NULL 1313 */ 1314static struct tipc_aead *tipc_crypto_key_pick_tx(struct tipc_crypto *tx, 1315 struct tipc_crypto *rx, 1316 struct sk_buff *skb, 1317 u8 tx_key) 1318{ 1319 struct tipc_skb_cb *skb_cb = TIPC_SKB_CB(skb); 1320 struct tipc_aead *aead = NULL; 1321 struct tipc_key key = tx->key; 1322 u8 k, i = 0; 1323 1324 /* Initialize data if not yet */ 1325 if (!skb_cb->tx_clone_deferred) { 1326 skb_cb->tx_clone_deferred = 1; 1327 memset(&skb_cb->tx_clone_ctx, 0, sizeof(skb_cb->tx_clone_ctx)); 1328 } 1329 1330 skb_cb->tx_clone_ctx.rx = rx; 1331 if (++skb_cb->tx_clone_ctx.recurs > 2) 1332 return NULL; 1333 1334 /* Pick one TX key */ 1335 spin_lock(&tx->lock); 1336 if (tx_key == KEY_MASTER) { 1337 aead = tipc_aead_rcu_ptr(tx->aead[KEY_MASTER], &tx->lock); 1338 goto done; 1339 } 1340 do { 1341 k = (i == 0) ? key.pending : 1342 ((i == 1) ? key.active : key.passive); 1343 if (!k) 1344 continue; 1345 aead = tipc_aead_rcu_ptr(tx->aead[k], &tx->lock); 1346 if (!aead) 1347 continue; 1348 if (aead->mode != CLUSTER_KEY || 1349 aead == skb_cb->tx_clone_ctx.last) { 1350 aead = NULL; 1351 continue; 1352 } 1353 /* Ok, found one cluster key */ 1354 skb_cb->tx_clone_ctx.last = aead; 1355 WARN_ON(skb->next); 1356 skb->next = skb_clone(skb, GFP_ATOMIC); 1357 if (unlikely(!skb->next)) 1358 pr_warn("Failed to clone skb for next round if any\n"); 1359 break; 1360 } while (++i < 3); 1361 1362done: 1363 if (likely(aead)) 1364 WARN_ON(!refcount_inc_not_zero(&aead->refcnt)); 1365 spin_unlock(&tx->lock); 1366 1367 return aead; 1368} 1369 1370/** 1371 * tipc_crypto_key_synch: Synch own key data according to peer key status 1372 * @rx: RX crypto handle 1373 * @skb: TIPCv2 message buffer (incl. the ehdr from peer) 1374 * 1375 * This function updates the peer node related data as the peer RX active key 1376 * has changed, so the number of TX keys' users on this node are increased and 1377 * decreased correspondingly. 1378 * 1379 * It also considers if peer has no key, then we need to make own master key 1380 * (if any) taking over i.e. starting grace period and also trigger key 1381 * distributing process. 1382 * 1383 * The "per-peer" sndnxt is also reset when the peer key has switched. 1384 */ 1385static void tipc_crypto_key_synch(struct tipc_crypto *rx, struct sk_buff *skb) 1386{ 1387 struct tipc_ehdr *ehdr = (struct tipc_ehdr *)skb_network_header(skb); 1388 struct tipc_crypto *tx = tipc_net(rx->net)->crypto_tx; 1389 struct tipc_msg *hdr = buf_msg(skb); 1390 u32 self = tipc_own_addr(rx->net); 1391 u8 cur, new; 1392 unsigned long delay; 1393 1394 /* Update RX 'key_master' flag according to peer, also mark "legacy" if 1395 * a peer has no master key. 1396 */ 1397 rx->key_master = ehdr->master_key; 1398 if (!rx->key_master) 1399 tx->legacy_user = 1; 1400 1401 /* For later cases, apply only if message is destined to this node */ 1402 if (!ehdr->destined || msg_short(hdr) || msg_destnode(hdr) != self) 1403 return; 1404 1405 /* Case 1: Peer has no keys, let's make master key take over */ 1406 if (ehdr->rx_nokey) { 1407 /* Set or extend grace period */ 1408 tx->timer2 = jiffies; 1409 /* Schedule key distributing for the peer if not yet */ 1410 if (tx->key.keys && 1411 !atomic_cmpxchg(&rx->key_distr, 0, KEY_DISTR_SCHED)) { 1412 get_random_bytes(&delay, 2); 1413 delay %= 5; 1414 delay = msecs_to_jiffies(500 * ++delay); 1415 if (queue_delayed_work(tx->wq, &rx->work, delay)) 1416 tipc_node_get(rx->node); 1417 } 1418 } else { 1419 /* Cancel a pending key distributing if any */ 1420 atomic_xchg(&rx->key_distr, 0); 1421 } 1422 1423 /* Case 2: Peer RX active key has changed, let's update own TX users */ 1424 cur = atomic_read(&rx->peer_rx_active); 1425 new = ehdr->rx_key_active; 1426 if (tx->key.keys && 1427 cur != new && 1428 atomic_cmpxchg(&rx->peer_rx_active, cur, new) == cur) { 1429 if (new) 1430 tipc_aead_users_inc(tx->aead[new], INT_MAX); 1431 if (cur) 1432 tipc_aead_users_dec(tx->aead[cur], 0); 1433 1434 atomic64_set(&rx->sndnxt, 0); 1435 /* Mark the point TX key users changed */ 1436 tx->timer1 = jiffies; 1437 1438 pr_debug("%s: key users changed %d-- %d++, peer %s\n", 1439 tx->name, cur, new, rx->name); 1440 } 1441} 1442 1443static int tipc_crypto_key_revoke(struct net *net, u8 tx_key) 1444{ 1445 struct tipc_crypto *tx = tipc_net(net)->crypto_tx; 1446 struct tipc_key key; 1447 1448 spin_lock_bh(&tx->lock); 1449 key = tx->key; 1450 WARN_ON(!key.active || tx_key != key.active); 1451 1452 /* Free the active key */ 1453 tipc_crypto_key_set_state(tx, key.passive, 0, key.pending); 1454 tipc_crypto_key_detach(tx->aead[key.active], &tx->lock); 1455 spin_unlock_bh(&tx->lock); 1456 1457 pr_warn("%s: key is revoked\n", tx->name); 1458 return -EKEYREVOKED; 1459} 1460 1461int tipc_crypto_start(struct tipc_crypto **crypto, struct net *net, 1462 struct tipc_node *node) 1463{ 1464 struct tipc_crypto *c; 1465 1466 if (*crypto) 1467 return -EEXIST; 1468 1469 /* Allocate crypto */ 1470 c = kzalloc(sizeof(*c), GFP_ATOMIC); 1471 if (!c) 1472 return -ENOMEM; 1473 1474 /* Allocate workqueue on TX */ 1475 if (!node) { 1476 c->wq = alloc_ordered_workqueue("tipc_crypto", 0); 1477 if (!c->wq) { 1478 kfree(c); 1479 return -ENOMEM; 1480 } 1481 } 1482 1483 /* Allocate statistic structure */ 1484 c->stats = alloc_percpu_gfp(struct tipc_crypto_stats, GFP_ATOMIC); 1485 if (!c->stats) { 1486 if (c->wq) 1487 destroy_workqueue(c->wq); 1488 kfree_sensitive(c); 1489 return -ENOMEM; 1490 } 1491 1492 c->flags = 0; 1493 c->net = net; 1494 c->node = node; 1495 get_random_bytes(&c->key_gen, 2); 1496 tipc_crypto_key_set_state(c, 0, 0, 0); 1497 atomic_set(&c->key_distr, 0); 1498 atomic_set(&c->peer_rx_active, 0); 1499 atomic64_set(&c->sndnxt, 0); 1500 c->timer1 = jiffies; 1501 c->timer2 = jiffies; 1502 c->rekeying_intv = TIPC_REKEYING_INTV_DEF; 1503 spin_lock_init(&c->lock); 1504 scnprintf(c->name, 48, "%s(%s)", (is_rx(c)) ? "RX" : "TX", 1505 (is_rx(c)) ? tipc_node_get_id_str(c->node) : 1506 tipc_own_id_string(c->net)); 1507 1508 if (is_rx(c)) 1509 INIT_DELAYED_WORK(&c->work, tipc_crypto_work_rx); 1510 else 1511 INIT_DELAYED_WORK(&c->work, tipc_crypto_work_tx); 1512 1513 *crypto = c; 1514 return 0; 1515} 1516 1517void tipc_crypto_stop(struct tipc_crypto **crypto) 1518{ 1519 struct tipc_crypto *c = *crypto; 1520 u8 k; 1521 1522 if (!c) 1523 return; 1524 1525 /* Flush any queued works & destroy wq */ 1526 if (is_tx(c)) { 1527 c->rekeying_intv = 0; 1528 cancel_delayed_work_sync(&c->work); 1529 destroy_workqueue(c->wq); 1530 } 1531 1532 /* Release AEAD keys */ 1533 rcu_read_lock(); 1534 for (k = KEY_MIN; k <= KEY_MAX; k++) 1535 tipc_aead_put(rcu_dereference(c->aead[k])); 1536 rcu_read_unlock(); 1537 pr_debug("%s: has been stopped\n", c->name); 1538 1539 /* Free this crypto statistics */ 1540 free_percpu(c->stats); 1541 1542 *crypto = NULL; 1543 kfree_sensitive(c); 1544} 1545 1546void tipc_crypto_timeout(struct tipc_crypto *rx) 1547{ 1548 struct tipc_net *tn = tipc_net(rx->net); 1549 struct tipc_crypto *tx = tn->crypto_tx; 1550 struct tipc_key key; 1551 int cmd; 1552 1553 /* TX pending: taking all users & stable -> active */ 1554 spin_lock(&tx->lock); 1555 key = tx->key; 1556 if (key.active && tipc_aead_users(tx->aead[key.active]) > 0) 1557 goto s1; 1558 if (!key.pending || tipc_aead_users(tx->aead[key.pending]) <= 0) 1559 goto s1; 1560 if (time_before(jiffies, tx->timer1 + TIPC_TX_LASTING_TIME)) 1561 goto s1; 1562 1563 tipc_crypto_key_set_state(tx, key.passive, key.pending, 0); 1564 if (key.active) 1565 tipc_crypto_key_detach(tx->aead[key.active], &tx->lock); 1566 this_cpu_inc(tx->stats->stat[STAT_SWITCHES]); 1567 pr_info("%s: key[%d] is activated\n", tx->name, key.pending); 1568 1569s1: 1570 spin_unlock(&tx->lock); 1571 1572 /* RX pending: having user -> active */ 1573 spin_lock(&rx->lock); 1574 key = rx->key; 1575 if (!key.pending || tipc_aead_users(rx->aead[key.pending]) <= 0) 1576 goto s2; 1577 1578 if (key.active) 1579 key.passive = key.active; 1580 key.active = key.pending; 1581 rx->timer2 = jiffies; 1582 tipc_crypto_key_set_state(rx, key.passive, key.active, 0); 1583 this_cpu_inc(rx->stats->stat[STAT_SWITCHES]); 1584 pr_info("%s: key[%d] is activated\n", rx->name, key.pending); 1585 goto s5; 1586 1587s2: 1588 /* RX pending: not working -> remove */ 1589 if (!key.pending || tipc_aead_users(rx->aead[key.pending]) > -10) 1590 goto s3; 1591 1592 tipc_crypto_key_set_state(rx, key.passive, key.active, 0); 1593 tipc_crypto_key_detach(rx->aead[key.pending], &rx->lock); 1594 pr_debug("%s: key[%d] is removed\n", rx->name, key.pending); 1595 goto s5; 1596 1597s3: 1598 /* RX active: timed out or no user -> pending */ 1599 if (!key.active) 1600 goto s4; 1601 if (time_before(jiffies, rx->timer1 + TIPC_RX_ACTIVE_LIM) && 1602 tipc_aead_users(rx->aead[key.active]) > 0) 1603 goto s4; 1604 1605 if (key.pending) 1606 key.passive = key.active; 1607 else 1608 key.pending = key.active; 1609 rx->timer2 = jiffies; 1610 tipc_crypto_key_set_state(rx, key.passive, 0, key.pending); 1611 tipc_aead_users_set(rx->aead[key.pending], 0); 1612 pr_debug("%s: key[%d] is deactivated\n", rx->name, key.active); 1613 goto s5; 1614 1615s4: 1616 /* RX passive: outdated or not working -> free */ 1617 if (!key.passive) 1618 goto s5; 1619 if (time_before(jiffies, rx->timer2 + TIPC_RX_PASSIVE_LIM) && 1620 tipc_aead_users(rx->aead[key.passive]) > -10) 1621 goto s5; 1622 1623 tipc_crypto_key_set_state(rx, 0, key.active, key.pending); 1624 tipc_crypto_key_detach(rx->aead[key.passive], &rx->lock); 1625 pr_debug("%s: key[%d] is freed\n", rx->name, key.passive); 1626 1627s5: 1628 spin_unlock(&rx->lock); 1629 1630 /* Relax it here, the flag will be set again if it really is, but only 1631 * when we are not in grace period for safety! 1632 */ 1633 if (time_after(jiffies, tx->timer2 + TIPC_TX_GRACE_PERIOD)) 1634 tx->legacy_user = 0; 1635 1636 /* Limit max_tfms & do debug commands if needed */ 1637 if (likely(sysctl_tipc_max_tfms <= TIPC_MAX_TFMS_LIM)) 1638 return; 1639 1640 cmd = sysctl_tipc_max_tfms; 1641 sysctl_tipc_max_tfms = TIPC_MAX_TFMS_DEF; 1642 tipc_crypto_do_cmd(rx->net, cmd); 1643} 1644 1645static inline void tipc_crypto_clone_msg(struct net *net, struct sk_buff *_skb, 1646 struct tipc_bearer *b, 1647 struct tipc_media_addr *dst, 1648 struct tipc_node *__dnode, u8 type) 1649{ 1650 struct sk_buff *skb; 1651 1652 skb = skb_clone(_skb, GFP_ATOMIC); 1653 if (skb) { 1654 TIPC_SKB_CB(skb)->xmit_type = type; 1655 tipc_crypto_xmit(net, &skb, b, dst, __dnode); 1656 if (skb) 1657 b->media->send_msg(net, skb, b, dst); 1658 } 1659} 1660 1661/** 1662 * tipc_crypto_xmit - Build & encrypt TIPC message for xmit 1663 * @net: struct net 1664 * @skb: input/output message skb pointer 1665 * @b: bearer used for xmit later 1666 * @dst: destination media address 1667 * @__dnode: destination node for reference if any 1668 * 1669 * First, build an encryption message header on the top of the message, then 1670 * encrypt the original TIPC message by using the pending, master or active 1671 * key with this preference order. 1672 * If the encryption is successful, the encrypted skb is returned directly or 1673 * via the callback. 1674 * Otherwise, the skb is freed! 1675 * 1676 * Return: 1677 * 0 : the encryption has succeeded (or no encryption) 1678 * -EINPROGRESS/-EBUSY : the encryption is ongoing, a callback will be made 1679 * -ENOKEK : the encryption has failed due to no key 1680 * -EKEYREVOKED : the encryption has failed due to key revoked 1681 * -ENOMEM : the encryption has failed due to no memory 1682 * < 0 : the encryption has failed due to other reasons 1683 */ 1684int tipc_crypto_xmit(struct net *net, struct sk_buff **skb, 1685 struct tipc_bearer *b, struct tipc_media_addr *dst, 1686 struct tipc_node *__dnode) 1687{ 1688 struct tipc_crypto *__rx = tipc_node_crypto_rx(__dnode); 1689 struct tipc_crypto *tx = tipc_net(net)->crypto_tx; 1690 struct tipc_crypto_stats __percpu *stats = tx->stats; 1691 struct tipc_msg *hdr = buf_msg(*skb); 1692 struct tipc_key key = tx->key; 1693 struct tipc_aead *aead = NULL; 1694 u32 user = msg_user(hdr); 1695 u32 type = msg_type(hdr); 1696 int rc = -ENOKEY; 1697 u8 tx_key = 0; 1698 1699 /* No encryption? */ 1700 if (!tx->working) 1701 return 0; 1702 1703 /* Pending key if peer has active on it or probing time */ 1704 if (unlikely(key.pending)) { 1705 tx_key = key.pending; 1706 if (!tx->key_master && !key.active) 1707 goto encrypt; 1708 if (__rx && atomic_read(&__rx->peer_rx_active) == tx_key) 1709 goto encrypt; 1710 if (TIPC_SKB_CB(*skb)->xmit_type == SKB_PROBING) { 1711 pr_debug("%s: probing for key[%d]\n", tx->name, 1712 key.pending); 1713 goto encrypt; 1714 } 1715 if (user == LINK_CONFIG || user == LINK_PROTOCOL) 1716 tipc_crypto_clone_msg(net, *skb, b, dst, __dnode, 1717 SKB_PROBING); 1718 } 1719 1720 /* Master key if this is a *vital* message or in grace period */ 1721 if (tx->key_master) { 1722 tx_key = KEY_MASTER; 1723 if (!key.active) 1724 goto encrypt; 1725 if (TIPC_SKB_CB(*skb)->xmit_type == SKB_GRACING) { 1726 pr_debug("%s: gracing for msg (%d %d)\n", tx->name, 1727 user, type); 1728 goto encrypt; 1729 } 1730 if (user == LINK_CONFIG || 1731 (user == LINK_PROTOCOL && type == RESET_MSG) || 1732 (user == MSG_CRYPTO && type == KEY_DISTR_MSG) || 1733 time_before(jiffies, tx->timer2 + TIPC_TX_GRACE_PERIOD)) { 1734 if (__rx && __rx->key_master && 1735 !atomic_read(&__rx->peer_rx_active)) 1736 goto encrypt; 1737 if (!__rx) { 1738 if (likely(!tx->legacy_user)) 1739 goto encrypt; 1740 tipc_crypto_clone_msg(net, *skb, b, dst, 1741 __dnode, SKB_GRACING); 1742 } 1743 } 1744 } 1745 1746 /* Else, use the active key if any */ 1747 if (likely(key.active)) { 1748 tx_key = key.active; 1749 goto encrypt; 1750 } 1751 1752 goto exit; 1753 1754encrypt: 1755 aead = tipc_aead_get(tx->aead[tx_key]); 1756 if (unlikely(!aead)) 1757 goto exit; 1758 rc = tipc_ehdr_build(net, aead, tx_key, *skb, __rx); 1759 if (likely(rc > 0)) 1760 rc = tipc_aead_encrypt(aead, *skb, b, dst, __dnode); 1761 1762exit: 1763 switch (rc) { 1764 case 0: 1765 this_cpu_inc(stats->stat[STAT_OK]); 1766 break; 1767 case -EINPROGRESS: 1768 case -EBUSY: 1769 this_cpu_inc(stats->stat[STAT_ASYNC]); 1770 *skb = NULL; 1771 return rc; 1772 default: 1773 this_cpu_inc(stats->stat[STAT_NOK]); 1774 if (rc == -ENOKEY) 1775 this_cpu_inc(stats->stat[STAT_NOKEYS]); 1776 else if (rc == -EKEYREVOKED) 1777 this_cpu_inc(stats->stat[STAT_BADKEYS]); 1778 kfree_skb(*skb); 1779 *skb = NULL; 1780 break; 1781 } 1782 1783 tipc_aead_put(aead); 1784 return rc; 1785} 1786 1787/** 1788 * tipc_crypto_rcv - Decrypt an encrypted TIPC message from peer 1789 * @net: struct net 1790 * @rx: RX crypto handle 1791 * @skb: input/output message skb pointer 1792 * @b: bearer where the message has been received 1793 * 1794 * If the decryption is successful, the decrypted skb is returned directly or 1795 * as the callback, the encryption header and auth tag will be trimed out 1796 * before forwarding to tipc_rcv() via the tipc_crypto_rcv_complete(). 1797 * Otherwise, the skb will be freed! 1798 * Note: RX key(s) can be re-aligned, or in case of no key suitable, TX 1799 * cluster key(s) can be taken for decryption (- recursive). 1800 * 1801 * Return: 1802 * 0 : the decryption has successfully completed 1803 * -EINPROGRESS/-EBUSY : the decryption is ongoing, a callback will be made 1804 * -ENOKEY : the decryption has failed due to no key 1805 * -EBADMSG : the decryption has failed due to bad message 1806 * -ENOMEM : the decryption has failed due to no memory 1807 * < 0 : the decryption has failed due to other reasons 1808 */ 1809int tipc_crypto_rcv(struct net *net, struct tipc_crypto *rx, 1810 struct sk_buff **skb, struct tipc_bearer *b) 1811{ 1812 struct tipc_crypto *tx = tipc_net(net)->crypto_tx; 1813 struct tipc_crypto_stats __percpu *stats; 1814 struct tipc_aead *aead = NULL; 1815 struct tipc_key key; 1816 int rc = -ENOKEY; 1817 u8 tx_key, n; 1818 1819 tx_key = ((struct tipc_ehdr *)(*skb)->data)->tx_key; 1820 1821 /* New peer? 1822 * Let's try with TX key (i.e. cluster mode) & verify the skb first! 1823 */ 1824 if (unlikely(!rx || tx_key == KEY_MASTER)) 1825 goto pick_tx; 1826 1827 /* Pick RX key according to TX key if any */ 1828 key = rx->key; 1829 if (tx_key == key.active || tx_key == key.pending || 1830 tx_key == key.passive) 1831 goto decrypt; 1832 1833 /* Unknown key, let's try to align RX key(s) */ 1834 if (tipc_crypto_key_try_align(rx, tx_key)) 1835 goto decrypt; 1836 1837pick_tx: 1838 /* No key suitable? Try to pick one from TX... */ 1839 aead = tipc_crypto_key_pick_tx(tx, rx, *skb, tx_key); 1840 if (aead) 1841 goto decrypt; 1842 goto exit; 1843 1844decrypt: 1845 rcu_read_lock(); 1846 if (!aead) 1847 aead = tipc_aead_get(rx->aead[tx_key]); 1848 rc = tipc_aead_decrypt(net, aead, *skb, b); 1849 rcu_read_unlock(); 1850 1851exit: 1852 stats = ((rx) ?: tx)->stats; 1853 switch (rc) { 1854 case 0: 1855 this_cpu_inc(stats->stat[STAT_OK]); 1856 break; 1857 case -EINPROGRESS: 1858 case -EBUSY: 1859 this_cpu_inc(stats->stat[STAT_ASYNC]); 1860 *skb = NULL; 1861 return rc; 1862 default: 1863 this_cpu_inc(stats->stat[STAT_NOK]); 1864 if (rc == -ENOKEY) { 1865 kfree_skb(*skb); 1866 *skb = NULL; 1867 if (rx) { 1868 /* Mark rx->nokey only if we dont have a 1869 * pending received session key, nor a newer 1870 * one i.e. in the next slot. 1871 */ 1872 n = key_next(tx_key); 1873 rx->nokey = !(rx->skey || 1874 rcu_access_pointer(rx->aead[n])); 1875 pr_debug_ratelimited("%s: nokey %d, key %d/%x\n", 1876 rx->name, rx->nokey, 1877 tx_key, rx->key.keys); 1878 tipc_node_put(rx->node); 1879 } 1880 this_cpu_inc(stats->stat[STAT_NOKEYS]); 1881 return rc; 1882 } else if (rc == -EBADMSG) { 1883 this_cpu_inc(stats->stat[STAT_BADMSGS]); 1884 } 1885 break; 1886 } 1887 1888 tipc_crypto_rcv_complete(net, aead, b, skb, rc); 1889 return rc; 1890} 1891 1892static void tipc_crypto_rcv_complete(struct net *net, struct tipc_aead *aead, 1893 struct tipc_bearer *b, 1894 struct sk_buff **skb, int err) 1895{ 1896 struct tipc_skb_cb *skb_cb = TIPC_SKB_CB(*skb); 1897 struct tipc_crypto *rx = aead->crypto; 1898 struct tipc_aead *tmp = NULL; 1899 struct tipc_ehdr *ehdr; 1900 struct tipc_node *n; 1901 1902 /* Is this completed by TX? */ 1903 if (unlikely(is_tx(aead->crypto))) { 1904 rx = skb_cb->tx_clone_ctx.rx; 1905 pr_debug("TX->RX(%s): err %d, aead %p, skb->next %p, flags %x\n", 1906 (rx) ? tipc_node_get_id_str(rx->node) : "-", err, aead, 1907 (*skb)->next, skb_cb->flags); 1908 pr_debug("skb_cb [recurs %d, last %p], tx->aead [%p %p %p]\n", 1909 skb_cb->tx_clone_ctx.recurs, skb_cb->tx_clone_ctx.last, 1910 aead->crypto->aead[1], aead->crypto->aead[2], 1911 aead->crypto->aead[3]); 1912 if (unlikely(err)) { 1913 if (err == -EBADMSG && (*skb)->next) 1914 tipc_rcv(net, (*skb)->next, b); 1915 goto free_skb; 1916 } 1917 1918 if (likely((*skb)->next)) { 1919 kfree_skb((*skb)->next); 1920 (*skb)->next = NULL; 1921 } 1922 ehdr = (struct tipc_ehdr *)(*skb)->data; 1923 if (!rx) { 1924 WARN_ON(ehdr->user != LINK_CONFIG); 1925 n = tipc_node_create(net, 0, ehdr->id, 0xffffu, 0, 1926 true); 1927 rx = tipc_node_crypto_rx(n); 1928 if (unlikely(!rx)) 1929 goto free_skb; 1930 } 1931 1932 /* Ignore cloning if it was TX master key */ 1933 if (ehdr->tx_key == KEY_MASTER) 1934 goto rcv; 1935 if (tipc_aead_clone(&tmp, aead) < 0) 1936 goto rcv; 1937 WARN_ON(!refcount_inc_not_zero(&tmp->refcnt)); 1938 if (tipc_crypto_key_attach(rx, tmp, ehdr->tx_key, false) < 0) { 1939 tipc_aead_free(&tmp->rcu); 1940 goto rcv; 1941 } 1942 tipc_aead_put(aead); 1943 aead = tmp; 1944 } 1945 1946 if (unlikely(err)) { 1947 tipc_aead_users_dec(aead, INT_MIN); 1948 goto free_skb; 1949 } 1950 1951 /* Set the RX key's user */ 1952 tipc_aead_users_set(aead, 1); 1953 1954 /* Mark this point, RX works */ 1955 rx->timer1 = jiffies; 1956 1957rcv: 1958 /* Remove ehdr & auth. tag prior to tipc_rcv() */ 1959 ehdr = (struct tipc_ehdr *)(*skb)->data; 1960 1961 /* Mark this point, RX passive still works */ 1962 if (rx->key.passive && ehdr->tx_key == rx->key.passive) 1963 rx->timer2 = jiffies; 1964 1965 skb_reset_network_header(*skb); 1966 skb_pull(*skb, tipc_ehdr_size(ehdr)); 1967 if (pskb_trim(*skb, (*skb)->len - aead->authsize)) 1968 goto free_skb; 1969 1970 /* Validate TIPCv2 message */ 1971 if (unlikely(!tipc_msg_validate(skb))) { 1972 pr_err_ratelimited("Packet dropped after decryption!\n"); 1973 goto free_skb; 1974 } 1975 1976 /* Ok, everything's fine, try to synch own keys according to peers' */ 1977 tipc_crypto_key_synch(rx, *skb); 1978 1979 /* Re-fetch skb cb as skb might be changed in tipc_msg_validate */ 1980 skb_cb = TIPC_SKB_CB(*skb); 1981 1982 /* Mark skb decrypted */ 1983 skb_cb->decrypted = 1; 1984 1985 /* Clear clone cxt if any */ 1986 if (likely(!skb_cb->tx_clone_deferred)) 1987 goto exit; 1988 skb_cb->tx_clone_deferred = 0; 1989 memset(&skb_cb->tx_clone_ctx, 0, sizeof(skb_cb->tx_clone_ctx)); 1990 goto exit; 1991 1992free_skb: 1993 kfree_skb(*skb); 1994 *skb = NULL; 1995 1996exit: 1997 tipc_aead_put(aead); 1998 if (rx) 1999 tipc_node_put(rx->node); 2000} 2001 2002static void tipc_crypto_do_cmd(struct net *net, int cmd) 2003{ 2004 struct tipc_net *tn = tipc_net(net); 2005 struct tipc_crypto *tx = tn->crypto_tx, *rx; 2006 struct list_head *p; 2007 unsigned int stat; 2008 int i, j, cpu; 2009 char buf[200]; 2010 2011 /* Currently only one command is supported */ 2012 switch (cmd) { 2013 case 0xfff1: 2014 goto print_stats; 2015 default: 2016 return; 2017 } 2018 2019print_stats: 2020 /* Print a header */ 2021 pr_info("\n=============== TIPC Crypto Statistics ===============\n\n"); 2022 2023 /* Print key status */ 2024 pr_info("Key status:\n"); 2025 pr_info("TX(%7.7s)\n%s", tipc_own_id_string(net), 2026 tipc_crypto_key_dump(tx, buf)); 2027 2028 rcu_read_lock(); 2029 for (p = tn->node_list.next; p != &tn->node_list; p = p->next) { 2030 rx = tipc_node_crypto_rx_by_list(p); 2031 pr_info("RX(%7.7s)\n%s", tipc_node_get_id_str(rx->node), 2032 tipc_crypto_key_dump(rx, buf)); 2033 } 2034 rcu_read_unlock(); 2035 2036 /* Print crypto statistics */ 2037 for (i = 0, j = 0; i < MAX_STATS; i++) 2038 j += scnprintf(buf + j, 200 - j, "|%11s ", hstats[i]); 2039 pr_info("Counter %s", buf); 2040 2041 memset(buf, '-', 115); 2042 buf[115] = '\0'; 2043 pr_info("%s\n", buf); 2044 2045 j = scnprintf(buf, 200, "TX(%7.7s) ", tipc_own_id_string(net)); 2046 for_each_possible_cpu(cpu) { 2047 for (i = 0; i < MAX_STATS; i++) { 2048 stat = per_cpu_ptr(tx->stats, cpu)->stat[i]; 2049 j += scnprintf(buf + j, 200 - j, "|%11d ", stat); 2050 } 2051 pr_info("%s", buf); 2052 j = scnprintf(buf, 200, "%12s", " "); 2053 } 2054 2055 rcu_read_lock(); 2056 for (p = tn->node_list.next; p != &tn->node_list; p = p->next) { 2057 rx = tipc_node_crypto_rx_by_list(p); 2058 j = scnprintf(buf, 200, "RX(%7.7s) ", 2059 tipc_node_get_id_str(rx->node)); 2060 for_each_possible_cpu(cpu) { 2061 for (i = 0; i < MAX_STATS; i++) { 2062 stat = per_cpu_ptr(rx->stats, cpu)->stat[i]; 2063 j += scnprintf(buf + j, 200 - j, "|%11d ", 2064 stat); 2065 } 2066 pr_info("%s", buf); 2067 j = scnprintf(buf, 200, "%12s", " "); 2068 } 2069 } 2070 rcu_read_unlock(); 2071 2072 pr_info("\n======================== Done ========================\n"); 2073} 2074 2075static char *tipc_crypto_key_dump(struct tipc_crypto *c, char *buf) 2076{ 2077 struct tipc_key key = c->key; 2078 struct tipc_aead *aead; 2079 int k, i = 0; 2080 char *s; 2081 2082 for (k = KEY_MIN; k <= KEY_MAX; k++) { 2083 if (k == KEY_MASTER) { 2084 if (is_rx(c)) 2085 continue; 2086 if (time_before(jiffies, 2087 c->timer2 + TIPC_TX_GRACE_PERIOD)) 2088 s = "ACT"; 2089 else 2090 s = "PAS"; 2091 } else { 2092 if (k == key.passive) 2093 s = "PAS"; 2094 else if (k == key.active) 2095 s = "ACT"; 2096 else if (k == key.pending) 2097 s = "PEN"; 2098 else 2099 s = "-"; 2100 } 2101 i += scnprintf(buf + i, 200 - i, "\tKey%d: %s", k, s); 2102 2103 rcu_read_lock(); 2104 aead = rcu_dereference(c->aead[k]); 2105 if (aead) 2106 i += scnprintf(buf + i, 200 - i, 2107 "{\"0x...%s\", \"%s\"}/%d:%d", 2108 aead->hint, 2109 (aead->mode == CLUSTER_KEY) ? "c" : "p", 2110 atomic_read(&aead->users), 2111 refcount_read(&aead->refcnt)); 2112 rcu_read_unlock(); 2113 i += scnprintf(buf + i, 200 - i, "\n"); 2114 } 2115 2116 if (is_rx(c)) 2117 i += scnprintf(buf + i, 200 - i, "\tPeer RX active: %d\n", 2118 atomic_read(&c->peer_rx_active)); 2119 2120 return buf; 2121} 2122 2123static char *tipc_key_change_dump(struct tipc_key old, struct tipc_key new, 2124 char *buf) 2125{ 2126 struct tipc_key *key = &old; 2127 int k, i = 0; 2128 char *s; 2129 2130 /* Output format: "[%s %s %s] -> [%s %s %s]", max len = 32 */ 2131again: 2132 i += scnprintf(buf + i, 32 - i, "["); 2133 for (k = KEY_1; k <= KEY_3; k++) { 2134 if (k == key->passive) 2135 s = "pas"; 2136 else if (k == key->active) 2137 s = "act"; 2138 else if (k == key->pending) 2139 s = "pen"; 2140 else 2141 s = "-"; 2142 i += scnprintf(buf + i, 32 - i, 2143 (k != KEY_3) ? "%s " : "%s", s); 2144 } 2145 if (key != &new) { 2146 i += scnprintf(buf + i, 32 - i, "] -> "); 2147 key = &new; 2148 goto again; 2149 } 2150 i += scnprintf(buf + i, 32 - i, "]"); 2151 return buf; 2152} 2153 2154/** 2155 * tipc_crypto_msg_rcv - Common 'MSG_CRYPTO' processing point 2156 * @net: the struct net 2157 * @skb: the receiving message buffer 2158 */ 2159void tipc_crypto_msg_rcv(struct net *net, struct sk_buff *skb) 2160{ 2161 struct tipc_crypto *rx; 2162 struct tipc_msg *hdr; 2163 2164 if (unlikely(skb_linearize(skb))) 2165 goto exit; 2166 2167 hdr = buf_msg(skb); 2168 rx = tipc_node_crypto_rx_by_addr(net, msg_prevnode(hdr)); 2169 if (unlikely(!rx)) 2170 goto exit; 2171 2172 switch (msg_type(hdr)) { 2173 case KEY_DISTR_MSG: 2174 if (tipc_crypto_key_rcv(rx, hdr)) 2175 goto exit; 2176 break; 2177 default: 2178 break; 2179 } 2180 2181 tipc_node_put(rx->node); 2182 2183exit: 2184 kfree_skb(skb); 2185} 2186 2187/** 2188 * tipc_crypto_key_distr - Distribute a TX key 2189 * @tx: the TX crypto 2190 * @key: the key's index 2191 * @dest: the destination tipc node, = NULL if distributing to all nodes 2192 * 2193 * Return: 0 in case of success, otherwise < 0 2194 */ 2195int tipc_crypto_key_distr(struct tipc_crypto *tx, u8 key, 2196 struct tipc_node *dest) 2197{ 2198 struct tipc_aead *aead; 2199 u32 dnode = tipc_node_get_addr(dest); 2200 int rc = -ENOKEY; 2201 2202 if (!sysctl_tipc_key_exchange_enabled) 2203 return 0; 2204 2205 if (key) { 2206 rcu_read_lock(); 2207 aead = tipc_aead_get(tx->aead[key]); 2208 if (likely(aead)) { 2209 rc = tipc_crypto_key_xmit(tx->net, aead->key, 2210 aead->gen, aead->mode, 2211 dnode); 2212 tipc_aead_put(aead); 2213 } 2214 rcu_read_unlock(); 2215 } 2216 2217 return rc; 2218} 2219 2220/** 2221 * tipc_crypto_key_xmit - Send a session key 2222 * @net: the struct net 2223 * @skey: the session key to be sent 2224 * @gen: the key's generation 2225 * @mode: the key's mode 2226 * @dnode: the destination node address, = 0 if broadcasting to all nodes 2227 * 2228 * The session key 'skey' is packed in a TIPC v2 'MSG_CRYPTO/KEY_DISTR_MSG' 2229 * as its data section, then xmit-ed through the uc/bc link. 2230 * 2231 * Return: 0 in case of success, otherwise < 0 2232 */ 2233static int tipc_crypto_key_xmit(struct net *net, struct tipc_aead_key *skey, 2234 u16 gen, u8 mode, u32 dnode) 2235{ 2236 struct sk_buff_head pkts; 2237 struct tipc_msg *hdr; 2238 struct sk_buff *skb; 2239 u16 size, cong_link_cnt; 2240 u8 *data; 2241 int rc; 2242 2243 size = tipc_aead_key_size(skey); 2244 skb = tipc_buf_acquire(INT_H_SIZE + size, GFP_ATOMIC); 2245 if (!skb) 2246 return -ENOMEM; 2247 2248 hdr = buf_msg(skb); 2249 tipc_msg_init(tipc_own_addr(net), hdr, MSG_CRYPTO, KEY_DISTR_MSG, 2250 INT_H_SIZE, dnode); 2251 msg_set_size(hdr, INT_H_SIZE + size); 2252 msg_set_key_gen(hdr, gen); 2253 msg_set_key_mode(hdr, mode); 2254 2255 data = msg_data(hdr); 2256 *((__be32 *)(data + TIPC_AEAD_ALG_NAME)) = htonl(skey->keylen); 2257 memcpy(data, skey->alg_name, TIPC_AEAD_ALG_NAME); 2258 memcpy(data + TIPC_AEAD_ALG_NAME + sizeof(__be32), skey->key, 2259 skey->keylen); 2260 2261 __skb_queue_head_init(&pkts); 2262 __skb_queue_tail(&pkts, skb); 2263 if (dnode) 2264 rc = tipc_node_xmit(net, &pkts, dnode, 0); 2265 else 2266 rc = tipc_bcast_xmit(net, &pkts, &cong_link_cnt); 2267 2268 return rc; 2269} 2270 2271/** 2272 * tipc_crypto_key_rcv - Receive a session key 2273 * @rx: the RX crypto 2274 * @hdr: the TIPC v2 message incl. the receiving session key in its data 2275 * 2276 * This function retrieves the session key in the message from peer, then 2277 * schedules a RX work to attach the key to the corresponding RX crypto. 2278 * 2279 * Return: "true" if the key has been scheduled for attaching, otherwise 2280 * "false". 2281 */ 2282static bool tipc_crypto_key_rcv(struct tipc_crypto *rx, struct tipc_msg *hdr) 2283{ 2284 struct tipc_crypto *tx = tipc_net(rx->net)->crypto_tx; 2285 struct tipc_aead_key *skey = NULL; 2286 u16 key_gen = msg_key_gen(hdr); 2287 u32 size = msg_data_sz(hdr); 2288 u8 *data = msg_data(hdr); 2289 unsigned int keylen; 2290 2291 /* Verify whether the size can exist in the packet */ 2292 if (unlikely(size < sizeof(struct tipc_aead_key) + TIPC_AEAD_KEYLEN_MIN)) { 2293 pr_debug("%s: message data size is too small\n", rx->name); 2294 goto exit; 2295 } 2296 2297 keylen = ntohl(*((__be32 *)(data + TIPC_AEAD_ALG_NAME))); 2298 2299 /* Verify the supplied size values */ 2300 if (unlikely(size != keylen + sizeof(struct tipc_aead_key) || 2301 keylen > TIPC_AEAD_KEY_SIZE_MAX)) { 2302 pr_debug("%s: invalid MSG_CRYPTO key size\n", rx->name); 2303 goto exit; 2304 } 2305 2306 spin_lock(&rx->lock); 2307 if (unlikely(rx->skey || (key_gen == rx->key_gen && rx->key.keys))) { 2308 pr_err("%s: key existed <%p>, gen %d vs %d\n", rx->name, 2309 rx->skey, key_gen, rx->key_gen); 2310 goto exit_unlock; 2311 } 2312 2313 /* Allocate memory for the key */ 2314 skey = kmalloc(size, GFP_ATOMIC); 2315 if (unlikely(!skey)) { 2316 pr_err("%s: unable to allocate memory for skey\n", rx->name); 2317 goto exit_unlock; 2318 } 2319 2320 /* Copy key from msg data */ 2321 skey->keylen = keylen; 2322 memcpy(skey->alg_name, data, TIPC_AEAD_ALG_NAME); 2323 memcpy(skey->key, data + TIPC_AEAD_ALG_NAME + sizeof(__be32), 2324 skey->keylen); 2325 2326 rx->key_gen = key_gen; 2327 rx->skey_mode = msg_key_mode(hdr); 2328 rx->skey = skey; 2329 rx->nokey = 0; 2330 mb(); /* for nokey flag */ 2331 2332exit_unlock: 2333 spin_unlock(&rx->lock); 2334 2335exit: 2336 /* Schedule the key attaching on this crypto */ 2337 if (likely(skey && queue_delayed_work(tx->wq, &rx->work, 0))) 2338 return true; 2339 2340 return false; 2341} 2342 2343/** 2344 * tipc_crypto_work_rx - Scheduled RX works handler 2345 * @work: the struct RX work 2346 * 2347 * The function processes the previous scheduled works i.e. distributing TX key 2348 * or attaching a received session key on RX crypto. 2349 */ 2350static void tipc_crypto_work_rx(struct work_struct *work) 2351{ 2352 struct delayed_work *dwork = to_delayed_work(work); 2353 struct tipc_crypto *rx = container_of(dwork, struct tipc_crypto, work); 2354 struct tipc_crypto *tx = tipc_net(rx->net)->crypto_tx; 2355 unsigned long delay = msecs_to_jiffies(5000); 2356 bool resched = false; 2357 u8 key; 2358 int rc; 2359 2360 /* Case 1: Distribute TX key to peer if scheduled */ 2361 if (atomic_cmpxchg(&rx->key_distr, 2362 KEY_DISTR_SCHED, 2363 KEY_DISTR_COMPL) == KEY_DISTR_SCHED) { 2364 /* Always pick the newest one for distributing */ 2365 key = tx->key.pending ?: tx->key.active; 2366 rc = tipc_crypto_key_distr(tx, key, rx->node); 2367 if (unlikely(rc)) 2368 pr_warn("%s: unable to distr key[%d] to %s, err %d\n", 2369 tx->name, key, tipc_node_get_id_str(rx->node), 2370 rc); 2371 2372 /* Sched for key_distr releasing */ 2373 resched = true; 2374 } else { 2375 atomic_cmpxchg(&rx->key_distr, KEY_DISTR_COMPL, 0); 2376 } 2377 2378 /* Case 2: Attach a pending received session key from peer if any */ 2379 if (rx->skey) { 2380 rc = tipc_crypto_key_init(rx, rx->skey, rx->skey_mode, false); 2381 if (unlikely(rc < 0)) 2382 pr_warn("%s: unable to attach received skey, err %d\n", 2383 rx->name, rc); 2384 switch (rc) { 2385 case -EBUSY: 2386 case -ENOMEM: 2387 /* Resched the key attaching */ 2388 resched = true; 2389 break; 2390 default: 2391 synchronize_rcu(); 2392 kfree(rx->skey); 2393 rx->skey = NULL; 2394 break; 2395 } 2396 } 2397 2398 if (resched && queue_delayed_work(tx->wq, &rx->work, delay)) 2399 return; 2400 2401 tipc_node_put(rx->node); 2402} 2403 2404/** 2405 * tipc_crypto_rekeying_sched - (Re)schedule rekeying w/o new interval 2406 * @tx: TX crypto 2407 * @changed: if the rekeying needs to be rescheduled with new interval 2408 * @new_intv: new rekeying interval (when "changed" = true) 2409 */ 2410void tipc_crypto_rekeying_sched(struct tipc_crypto *tx, bool changed, 2411 u32 new_intv) 2412{ 2413 unsigned long delay; 2414 bool now = false; 2415 2416 if (changed) { 2417 if (new_intv == TIPC_REKEYING_NOW) 2418 now = true; 2419 else 2420 tx->rekeying_intv = new_intv; 2421 cancel_delayed_work_sync(&tx->work); 2422 } 2423 2424 if (tx->rekeying_intv || now) { 2425 delay = (now) ? 0 : tx->rekeying_intv * 60 * 1000; 2426 queue_delayed_work(tx->wq, &tx->work, msecs_to_jiffies(delay)); 2427 } 2428} 2429 2430/** 2431 * tipc_crypto_work_tx - Scheduled TX works handler 2432 * @work: the struct TX work 2433 * 2434 * The function processes the previous scheduled work, i.e. key rekeying, by 2435 * generating a new session key based on current one, then attaching it to the 2436 * TX crypto and finally distributing it to peers. It also re-schedules the 2437 * rekeying if needed. 2438 */ 2439static void tipc_crypto_work_tx(struct work_struct *work) 2440{ 2441 struct delayed_work *dwork = to_delayed_work(work); 2442 struct tipc_crypto *tx = container_of(dwork, struct tipc_crypto, work); 2443 struct tipc_aead_key *skey = NULL; 2444 struct tipc_key key = tx->key; 2445 struct tipc_aead *aead; 2446 int rc = -ENOMEM; 2447 2448 if (unlikely(key.pending)) 2449 goto resched; 2450 2451 /* Take current key as a template */ 2452 rcu_read_lock(); 2453 aead = rcu_dereference(tx->aead[key.active ?: KEY_MASTER]); 2454 if (unlikely(!aead)) { 2455 rcu_read_unlock(); 2456 /* At least one key should exist for securing */ 2457 return; 2458 } 2459 2460 /* Lets duplicate it first */ 2461 skey = kmemdup(aead->key, tipc_aead_key_size(aead->key), GFP_ATOMIC); 2462 rcu_read_unlock(); 2463 2464 /* Now, generate new key, initiate & distribute it */ 2465 if (likely(skey)) { 2466 rc = tipc_aead_key_generate(skey) ?: 2467 tipc_crypto_key_init(tx, skey, PER_NODE_KEY, false); 2468 if (likely(rc > 0)) 2469 rc = tipc_crypto_key_distr(tx, rc, NULL); 2470 kfree_sensitive(skey); 2471 } 2472 2473 if (unlikely(rc)) 2474 pr_warn_ratelimited("%s: rekeying returns %d\n", tx->name, rc); 2475 2476resched: 2477 /* Re-schedule rekeying if any */ 2478 tipc_crypto_rekeying_sched(tx, false, 0); 2479} 2480