projects/linux·blob master · refs

2474 lines · 65.5 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 * net/tipc/crypto.c: TIPC crypto for key handling & packet en/decryption
4 *
5 * Copyright (c) 2019, Ericsson AB
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions are met:
10 *
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the names of the copyright holders nor the names of its
17 * contributors may be used to endorse or promote products derived from
18 * this software without specific prior written permission.
19 *
20 * Alternatively, this software may be distributed under the terms of the
21 * GNU General Public License ("GPL") version 2 as published by the Free
22 * Software Foundation.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
25 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34 * POSSIBILITY OF SUCH DAMAGE.
35 */
36
37#include <crypto/aead.h>
38#include <crypto/aes.h>
39#include <crypto/rng.h>
40#include "crypto.h"
41#include "msg.h"
42#include "bcast.h"
43
44#define TIPC_TX_GRACE_PERIOD msecs_to_jiffies(5000) /* 5s */
45#define TIPC_TX_LASTING_TIME msecs_to_jiffies(10000) /* 10s */
46#define TIPC_RX_ACTIVE_LIM msecs_to_jiffies(3000) /* 3s */
47#define TIPC_RX_PASSIVE_LIM msecs_to_jiffies(15000) /* 15s */
48
49#define TIPC_MAX_TFMS_DEF 10
50#define TIPC_MAX_TFMS_LIM 1000
51
52#define TIPC_REKEYING_INTV_DEF (60 * 24) /* default: 1 day */
53
54/*
55 * TIPC Key ids
56 */
57enum {
58 KEY_MASTER = 0,
59 KEY_MIN = KEY_MASTER,
60 KEY_1 = 1,
61 KEY_2,
62 KEY_3,
63 KEY_MAX = KEY_3,
64};
65
66/*
67 * TIPC Crypto statistics
68 */
69enum {
70 STAT_OK,
71 STAT_NOK,
72 STAT_ASYNC,
73 STAT_ASYNC_OK,
74 STAT_ASYNC_NOK,
75 STAT_BADKEYS, /* tx only */
76 STAT_BADMSGS = STAT_BADKEYS, /* rx only */
77 STAT_NOKEYS,
78 STAT_SWITCHES,
79
80 MAX_STATS,
81};
82
83/* TIPC crypto statistics' header */
84static const char *hstats[MAX_STATS] = {"ok", "nok", "async", "async_ok",
85 "async_nok", "badmsgs", "nokeys",
86 "switches"};
87
88/* Max TFMs number per key */
89int sysctl_tipc_max_tfms __read_mostly = TIPC_MAX_TFMS_DEF;
90/* Key exchange switch, default: on */
91int sysctl_tipc_key_exchange_enabled __read_mostly = 1;
92
93/*
94 * struct tipc_key - TIPC keys' status indicator
95 *
96 * 7 6 5 4 3 2 1 0
97 * +-----+-----+-----+-----+-----+-----+-----+-----+
98 * key: | (reserved)|passive idx| active idx|pending idx|
99 * +-----+-----+-----+-----+-----+-----+-----+-----+
100 */
101struct tipc_key {
102#define KEY_BITS (2)
103#define KEY_MASK ((1 << KEY_BITS) - 1)
104 union {
105 struct {
106#if defined(__LITTLE_ENDIAN_BITFIELD)
107 u8 pending:2,
108 active:2,
109 passive:2, /* rx only */
110 reserved:2;
111#elif defined(__BIG_ENDIAN_BITFIELD)
112 u8 reserved:2,
113 passive:2, /* rx only */
114 active:2,
115 pending:2;
116#else
117#error "Please fix <asm/byteorder.h>"
118#endif
119 } __packed;
120 u8 keys;
121 };
122};
123
124/**
125 * struct tipc_tfm - TIPC TFM structure to form a list of TFMs
126 * @tfm: cipher handle/key
127 * @list: linked list of TFMs
128 */
129struct tipc_tfm {
130 struct crypto_aead *tfm;
131 struct list_head list;
132};
133
134/**
135 * struct tipc_aead - TIPC AEAD key structure
136 * @tfm_entry: per-cpu pointer to one entry in TFM list
137 * @crypto: TIPC crypto owns this key
138 * @cloned: reference to the source key in case cloning
139 * @users: the number of the key users (TX/RX)
140 * @salt: the key's SALT value
141 * @authsize: authentication tag size (max = 16)
142 * @mode: crypto mode is applied to the key
143 * @hint: a hint for user key
144 * @rcu: struct rcu_head
145 * @key: the aead key
146 * @gen: the key's generation
147 * @seqno: the per-key TX nonce counter
148 * @refcnt: the key reference counter
149 */
150struct tipc_aead {
151#define TIPC_AEAD_HINT_LEN (5)
152 struct tipc_tfm * __percpu *tfm_entry;
153 struct tipc_crypto *crypto;
154 struct tipc_aead *cloned;
155 atomic_t users;
156 u32 salt;
157 u8 authsize;
158 u8 mode;
159 char hint[2 * TIPC_AEAD_HINT_LEN + 1];
160 struct rcu_head rcu;
161 struct tipc_aead_key *key;
162 u16 gen;
163
164 atomic64_t seqno ____cacheline_aligned;
165 refcount_t refcnt ____cacheline_aligned;
166
167} ____cacheline_aligned;
168
169/**
170 * struct tipc_crypto_stats - TIPC Crypto statistics
171 * @stat: array of crypto statistics
172 */
173struct tipc_crypto_stats {
174 unsigned int stat[MAX_STATS];
175};
176
177/**
178 * struct tipc_crypto - TIPC TX/RX crypto structure
179 * @net: struct net
180 * @node: TIPC node (RX)
181 * @aead: array of pointers to AEAD keys for encryption/decryption
182 * @peer_rx_active: replicated peer RX active key index
183 * @key_gen: TX/RX key generation
184 * @key: the key states
185 * @skey_mode: session key's mode
186 * @skey: received session key
187 * @wq: common workqueue on TX crypto
188 * @work: delayed work sched for TX/RX
189 * @key_distr: key distributing state
190 * @rekeying_intv: rekeying interval (in minutes)
191 * @stats: the crypto statistics
192 * @name: the crypto name
193 * @timer1: general timer 1 (jiffies)
194 * @timer2: general timer 2 (jiffies)
195 * @working: the crypto is working or not
196 * @key_master: flag indicates if master key exists
197 * @legacy_user: flag indicates if a peer joins w/o master key (for bwd comp.)
198 * @nokey: no key indication
199 * @flags: combined flags field
200 * @lock: tipc_key lock
201 */
202struct tipc_crypto {
203 struct net *net;
204 struct tipc_node *node;
205 struct tipc_aead __rcu *aead[KEY_MAX + 1];
206 atomic_t peer_rx_active;
207 u16 key_gen;
208 struct tipc_key key;
209 u8 skey_mode;
210 struct tipc_aead_key *skey;
211 struct workqueue_struct *wq;
212 struct delayed_work work;
213#define KEY_DISTR_SCHED 1
214#define KEY_DISTR_COMPL 2
215 atomic_t key_distr;
216 u32 rekeying_intv;
217
218 struct tipc_crypto_stats __percpu *stats;
219 char name[48];
220
221 unsigned long timer1;
222 unsigned long timer2;
223 union {
224 struct {
225 u8 working:1;
226 u8 key_master:1;
227 u8 legacy_user:1;
228 u8 nokey: 1;
229 };
230 u8 flags;
231 };
232 spinlock_t lock; /* crypto lock */
233
234} ____cacheline_aligned;
235
236/* struct tipc_crypto_tx_ctx - TX context for callbacks */
237struct tipc_crypto_tx_ctx {
238 struct tipc_aead *aead;
239 struct tipc_bearer *bearer;
240 struct tipc_media_addr dst;
241};
242
243/* struct tipc_crypto_rx_ctx - RX context for callbacks */
244struct tipc_crypto_rx_ctx {
245 struct tipc_aead *aead;
246 struct tipc_bearer *bearer;
247};
248
249static struct tipc_aead *tipc_aead_get(struct tipc_aead __rcu *aead);
250static inline void tipc_aead_put(struct tipc_aead *aead);
251static void tipc_aead_free(struct rcu_head *rp);
252static int tipc_aead_users(struct tipc_aead __rcu *aead);
253static void tipc_aead_users_inc(struct tipc_aead __rcu *aead, int lim);
254static void tipc_aead_users_dec(struct tipc_aead __rcu *aead, int lim);
255static void tipc_aead_users_set(struct tipc_aead __rcu *aead, int val);
256static struct crypto_aead *tipc_aead_tfm_next(struct tipc_aead *aead);
257static int tipc_aead_init(struct tipc_aead **aead, struct tipc_aead_key *ukey,
258 u8 mode);
259static int tipc_aead_clone(struct tipc_aead **dst, struct tipc_aead *src);
260static void *tipc_aead_mem_alloc(struct crypto_aead *tfm,
261 unsigned int crypto_ctx_size,
262 u8 **iv, struct aead_request **req,
263 struct scatterlist **sg, int nsg);
264static int tipc_aead_encrypt(struct tipc_aead *aead, struct sk_buff *skb,
265 struct tipc_bearer *b,
266 struct tipc_media_addr *dst,
267 struct tipc_node *__dnode);
268static void tipc_aead_encrypt_done(void *data, int err);
269static int tipc_aead_decrypt(struct net *net, struct tipc_aead *aead,
270 struct sk_buff *skb, struct tipc_bearer *b);
271static void tipc_aead_decrypt_done(void *data, int err);
272static inline int tipc_ehdr_size(struct tipc_ehdr *ehdr);
273static int tipc_ehdr_build(struct net *net, struct tipc_aead *aead,
274 u8 tx_key, struct sk_buff *skb,
275 struct tipc_crypto *__rx);
276static inline void tipc_crypto_key_set_state(struct tipc_crypto *c,
277 u8 new_passive,
278 u8 new_active,
279 u8 new_pending);
280static int tipc_crypto_key_attach(struct tipc_crypto *c,
281 struct tipc_aead *aead, u8 pos,
282 bool master_key);
283static bool tipc_crypto_key_try_align(struct tipc_crypto *rx, u8 new_pending);
284static struct tipc_aead *tipc_crypto_key_pick_tx(struct tipc_crypto *tx,
285 struct tipc_crypto *rx,
286 struct sk_buff *skb,
287 u8 tx_key);
288static void tipc_crypto_key_synch(struct tipc_crypto *rx, struct sk_buff *skb);
289static int tipc_crypto_key_revoke(struct net *net, u8 tx_key);
290static inline void tipc_crypto_clone_msg(struct net *net, struct sk_buff *_skb,
291 struct tipc_bearer *b,
292 struct tipc_media_addr *dst,
293 struct tipc_node *__dnode, u8 type);
294static void tipc_crypto_rcv_complete(struct net *net, struct tipc_aead *aead,
295 struct tipc_bearer *b,
296 struct sk_buff **skb, int err);
297static void tipc_crypto_do_cmd(struct net *net, int cmd);
298static char *tipc_crypto_key_dump(struct tipc_crypto *c, char *buf);
299static char *tipc_key_change_dump(struct tipc_key old, struct tipc_key new,
300 char *buf);
301static int tipc_crypto_key_xmit(struct net *net, struct tipc_aead_key *skey,
302 u16 gen, u8 mode, u32 dnode);
303static bool tipc_crypto_key_rcv(struct tipc_crypto *rx, struct tipc_msg *hdr);
304static void tipc_crypto_work_tx(struct work_struct *work);
305static void tipc_crypto_work_rx(struct work_struct *work);
306static int tipc_aead_key_generate(struct tipc_aead_key *skey);
307
308#define is_tx(crypto) (!(crypto)->node)
309#define is_rx(crypto) (!is_tx(crypto))
310
311#define key_next(cur) ((cur) % KEY_MAX + 1)
312
313#define tipc_aead_rcu_ptr(rcu_ptr, lock) \
314 rcu_dereference_protected((rcu_ptr), lockdep_is_held(lock))
315
316#define tipc_aead_rcu_replace(rcu_ptr, ptr, lock) \
317do { \
318 struct tipc_aead *__tmp = rcu_dereference_protected((rcu_ptr), \
319 lockdep_is_held(lock)); \
320 rcu_assign_pointer((rcu_ptr), (ptr)); \
321 tipc_aead_put(__tmp); \
322} while (0)
323
324#define tipc_crypto_key_detach(rcu_ptr, lock) \
325 tipc_aead_rcu_replace((rcu_ptr), NULL, lock)
326
327/**
328 * tipc_aead_key_validate - Validate a AEAD user key
329 * @ukey: pointer to user key data
330 * @info: netlink info pointer
331 */
332int tipc_aead_key_validate(struct tipc_aead_key *ukey, struct genl_info *info)
333{
334 int keylen;
335
336 /* Check if algorithm exists */
337 if (unlikely(!crypto_has_alg(ukey->alg_name, 0, 0))) {
338 GENL_SET_ERR_MSG(info, "unable to load the algorithm (module existed?)");
339 return -ENODEV;
340 }
341
342 /* Currently, we only support the "gcm(aes)" cipher algorithm */
343 if (strcmp(ukey->alg_name, "gcm(aes)")) {
344 GENL_SET_ERR_MSG(info, "not supported yet the algorithm");
345 return -ENOTSUPP;
346 }
347
348 /* Check if key size is correct */
349 keylen = ukey->keylen - TIPC_AES_GCM_SALT_SIZE;
350 if (unlikely(keylen != TIPC_AES_GCM_KEY_SIZE_128 &&
351 keylen != TIPC_AES_GCM_KEY_SIZE_192 &&
352 keylen != TIPC_AES_GCM_KEY_SIZE_256)) {
353 GENL_SET_ERR_MSG(info, "incorrect key length (20, 28 or 36 octets?)");
354 return -EKEYREJECTED;
355 }
356
357 return 0;
358}
359
360/**
361 * tipc_aead_key_generate - Generate new session key
362 * @skey: input/output key with new content
363 *
364 * Return: 0 in case of success, otherwise < 0
365 */
366static int tipc_aead_key_generate(struct tipc_aead_key *skey)
367{
368 /* Fill the key's content with a random value via stdrng */
369 return crypto_stdrng_get_bytes(skey->key, skey->keylen);
370}
371
372static struct tipc_aead *tipc_aead_get(struct tipc_aead __rcu *aead)
373{
374 struct tipc_aead *tmp;
375
376 rcu_read_lock();
377 tmp = rcu_dereference(aead);
378 if (unlikely(!tmp || !refcount_inc_not_zero(&tmp->refcnt)))
379 tmp = NULL;
380 rcu_read_unlock();
381
382 return tmp;
383}
384
385static inline void tipc_aead_put(struct tipc_aead *aead)
386{
387 if (aead && refcount_dec_and_test(&aead->refcnt))
388 call_rcu(&aead->rcu, tipc_aead_free);
389}
390
391/**
392 * tipc_aead_free - Release AEAD key incl. all the TFMs in the list
393 * @rp: rcu head pointer
394 */
395static void tipc_aead_free(struct rcu_head *rp)
396{
397 struct tipc_aead *aead = container_of(rp, struct tipc_aead, rcu);
398 struct tipc_tfm *tfm_entry, *head, *tmp;
399
400 if (aead->cloned) {
401 tipc_aead_put(aead->cloned);
402 } else {
403 head = *get_cpu_ptr(aead->tfm_entry);
404 put_cpu_ptr(aead->tfm_entry);
405 list_for_each_entry_safe(tfm_entry, tmp, &head->list, list) {
406 crypto_free_aead(tfm_entry->tfm);
407 list_del(&tfm_entry->list);
408 kfree(tfm_entry);
409 }
410 /* Free the head */
411 crypto_free_aead(head->tfm);
412 list_del(&head->list);
413 kfree(head);
414 }
415 free_percpu(aead->tfm_entry);
416 kfree_sensitive(aead->key);
417 kfree_sensitive(aead);
418}
419
420static int tipc_aead_users(struct tipc_aead __rcu *aead)
421{
422 struct tipc_aead *tmp;
423 int users = 0;
424
425 rcu_read_lock();
426 tmp = rcu_dereference(aead);
427 if (tmp)
428 users = atomic_read(&tmp->users);
429 rcu_read_unlock();
430
431 return users;
432}
433
434static void tipc_aead_users_inc(struct tipc_aead __rcu *aead, int lim)
435{
436 struct tipc_aead *tmp;
437
438 rcu_read_lock();
439 tmp = rcu_dereference(aead);
440 if (tmp)
441 atomic_add_unless(&tmp->users, 1, lim);
442 rcu_read_unlock();
443}
444
445static void tipc_aead_users_dec(struct tipc_aead __rcu *aead, int lim)
446{
447 struct tipc_aead *tmp;
448
449 rcu_read_lock();
450 tmp = rcu_dereference(aead);
451 if (tmp)
452 atomic_add_unless(&tmp->users, -1, lim);
453 rcu_read_unlock();
454}
455
456static void tipc_aead_users_set(struct tipc_aead __rcu *aead, int val)
457{
458 struct tipc_aead *tmp;
459 int cur;
460
461 rcu_read_lock();
462 tmp = rcu_dereference(aead);
463 if (tmp) {
464 do {
465 cur = atomic_read(&tmp->users);
466 if (cur == val)
467 break;
468 } while (atomic_cmpxchg(&tmp->users, cur, val) != cur);
469 }
470 rcu_read_unlock();
471}
472
473/**
474 * tipc_aead_tfm_next - Move TFM entry to the next one in list and return it
475 * @aead: the AEAD key pointer
476 */
477static struct crypto_aead *tipc_aead_tfm_next(struct tipc_aead *aead)
478{
479 struct tipc_tfm **tfm_entry;
480 struct crypto_aead *tfm;
481
482 tfm_entry = get_cpu_ptr(aead->tfm_entry);
483 *tfm_entry = list_next_entry(*tfm_entry, list);
484 tfm = (*tfm_entry)->tfm;
485 put_cpu_ptr(tfm_entry);
486
487 return tfm;
488}
489
490/**
491 * tipc_aead_init - Initiate TIPC AEAD
492 * @aead: returned new TIPC AEAD key handle pointer
493 * @ukey: pointer to user key data
494 * @mode: the key mode
495 *
496 * Allocate a (list of) new cipher transformation (TFM) with the specific user
497 * key data if valid. The number of the allocated TFMs can be set via the sysfs
498 * "net/tipc/max_tfms" first.
499 * Also, all the other AEAD data are also initialized.
500 *
501 * Return: 0 if the initiation is successful, otherwise: < 0
502 */
503static int tipc_aead_init(struct tipc_aead **aead, struct tipc_aead_key *ukey,
504 u8 mode)
505{
506 struct tipc_tfm *tfm_entry, *head;
507 struct crypto_aead *tfm;
508 struct tipc_aead *tmp;
509 int keylen, err, cpu;
510 int tfm_cnt = 0;
511
512 if (unlikely(*aead))
513 return -EEXIST;
514
515 /* Allocate a new AEAD */
516 tmp = kzalloc_obj(*tmp, GFP_ATOMIC);
517 if (unlikely(!tmp))
518 return -ENOMEM;
519
520 /* The key consists of two parts: [AES-KEY][SALT] */
521 keylen = ukey->keylen - TIPC_AES_GCM_SALT_SIZE;
522
523 /* Allocate per-cpu TFM entry pointer */
524 tmp->tfm_entry = alloc_percpu(struct tipc_tfm *);
525 if (!tmp->tfm_entry) {
526 kfree_sensitive(tmp);
527 return -ENOMEM;
528 }
529
530 /* Make a list of TFMs with the user key data */
531 do {
532 tfm = crypto_alloc_aead(ukey->alg_name, 0, 0);
533 if (IS_ERR(tfm)) {
534 err = PTR_ERR(tfm);
535 break;
536 }
537
538 if (unlikely(!tfm_cnt &&
539 crypto_aead_ivsize(tfm) != TIPC_AES_GCM_IV_SIZE)) {
540 crypto_free_aead(tfm);
541 err = -ENOTSUPP;
542 break;
543 }
544
545 err = crypto_aead_setauthsize(tfm, TIPC_AES_GCM_TAG_SIZE);
546 err |= crypto_aead_setkey(tfm, ukey->key, keylen);
547 if (unlikely(err)) {
548 crypto_free_aead(tfm);
549 break;
550 }
551
552 tfm_entry = kmalloc_obj(*tfm_entry);
553 if (unlikely(!tfm_entry)) {
554 crypto_free_aead(tfm);
555 err = -ENOMEM;
556 break;
557 }
558 INIT_LIST_HEAD(&tfm_entry->list);
559 tfm_entry->tfm = tfm;
560
561 /* First entry? */
562 if (!tfm_cnt) {
563 head = tfm_entry;
564 for_each_possible_cpu(cpu) {
565 *per_cpu_ptr(tmp->tfm_entry, cpu) = head;
566 }
567 } else {
568 list_add_tail(&tfm_entry->list, &head->list);
569 }
570
571 } while (++tfm_cnt < sysctl_tipc_max_tfms);
572
573 /* Not any TFM is allocated? */
574 if (!tfm_cnt) {
575 free_percpu(tmp->tfm_entry);
576 kfree_sensitive(tmp);
577 return err;
578 }
579
580 /* Form a hex string of some last bytes as the key's hint */
581 bin2hex(tmp->hint, ukey->key + keylen - TIPC_AEAD_HINT_LEN,
582 TIPC_AEAD_HINT_LEN);
583
584 /* Initialize the other data */
585 tmp->mode = mode;
586 tmp->cloned = NULL;
587 tmp->authsize = TIPC_AES_GCM_TAG_SIZE;
588 tmp->key = kmemdup(ukey, tipc_aead_key_size(ukey), GFP_KERNEL);
589 if (!tmp->key) {
590 tipc_aead_free(&tmp->rcu);
591 return -ENOMEM;
592 }
593 memcpy(&tmp->salt, ukey->key + keylen, TIPC_AES_GCM_SALT_SIZE);
594 atomic_set(&tmp->users, 0);
595 atomic64_set(&tmp->seqno, 0);
596 refcount_set(&tmp->refcnt, 1);
597
598 *aead = tmp;
599 return 0;
600}
601
602/**
603 * tipc_aead_clone - Clone a TIPC AEAD key
604 * @dst: dest key for the cloning
605 * @src: source key to clone from
606 *
607 * Make a "copy" of the source AEAD key data to the dest, the TFMs list is
608 * common for the keys.
609 * A reference to the source is hold in the "cloned" pointer for the later
610 * freeing purposes.
611 *
612 * Note: this must be done in cluster-key mode only!
613 * Return: 0 in case of success, otherwise < 0
614 */
615static int tipc_aead_clone(struct tipc_aead **dst, struct tipc_aead *src)
616{
617 struct tipc_aead *aead;
618 int cpu;
619
620 if (!src)
621 return -ENOKEY;
622
623 if (src->mode != CLUSTER_KEY)
624 return -EINVAL;
625
626 if (unlikely(*dst))
627 return -EEXIST;
628
629 aead = kzalloc_obj(*aead, GFP_ATOMIC);
630 if (unlikely(!aead))
631 return -ENOMEM;
632
633 aead->tfm_entry = alloc_percpu_gfp(struct tipc_tfm *, GFP_ATOMIC);
634 if (unlikely(!aead->tfm_entry)) {
635 kfree_sensitive(aead);
636 return -ENOMEM;
637 }
638
639 for_each_possible_cpu(cpu) {
640 *per_cpu_ptr(aead->tfm_entry, cpu) =
641 *per_cpu_ptr(src->tfm_entry, cpu);
642 }
643
644 memcpy(aead->hint, src->hint, sizeof(src->hint));
645 aead->mode = src->mode;
646 aead->salt = src->salt;
647 aead->authsize = src->authsize;
648 atomic_set(&aead->users, 0);
649 atomic64_set(&aead->seqno, 0);
650 refcount_set(&aead->refcnt, 1);
651
652 WARN_ON(!refcount_inc_not_zero(&src->refcnt));
653 aead->cloned = src;
654
655 *dst = aead;
656 return 0;
657}
658
659/**
660 * tipc_aead_mem_alloc - Allocate memory for AEAD request operations
661 * @tfm: cipher handle to be registered with the request
662 * @crypto_ctx_size: size of crypto context for callback
663 * @iv: returned pointer to IV data
664 * @req: returned pointer to AEAD request data
665 * @sg: returned pointer to SG lists
666 * @nsg: number of SG lists to be allocated
667 *
668 * Allocate memory to store the crypto context data, AEAD request, IV and SG
669 * lists, the memory layout is as follows:
670 * crypto_ctx || iv || aead_req || sg[]
671 *
672 * Return: the pointer to the memory areas in case of success, otherwise NULL
673 */
674static void *tipc_aead_mem_alloc(struct crypto_aead *tfm,
675 unsigned int crypto_ctx_size,
676 u8 **iv, struct aead_request **req,
677 struct scatterlist **sg, int nsg)
678{
679 unsigned int iv_size, req_size;
680 unsigned int len;
681 u8 *mem;
682
683 iv_size = crypto_aead_ivsize(tfm);
684 req_size = sizeof(**req) + crypto_aead_reqsize(tfm);
685
686 len = crypto_ctx_size;
687 len += iv_size;
688 len += crypto_aead_alignmask(tfm) & ~(crypto_tfm_ctx_alignment() - 1);
689 len = ALIGN(len, crypto_tfm_ctx_alignment());
690 len += req_size;
691 len = ALIGN(len, __alignof__(struct scatterlist));
692 len += nsg * sizeof(**sg);
693
694 mem = kmalloc(len, GFP_ATOMIC);
695 if (!mem)
696 return NULL;
697
698 *iv = (u8 *)PTR_ALIGN(mem + crypto_ctx_size,
699 crypto_aead_alignmask(tfm) + 1);
700 *req = (struct aead_request *)PTR_ALIGN(*iv + iv_size,
701 crypto_tfm_ctx_alignment());
702 *sg = (struct scatterlist *)PTR_ALIGN((u8 *)*req + req_size,
703 __alignof__(struct scatterlist));
704
705 return (void *)mem;
706}
707
708/**
709 * tipc_aead_encrypt - Encrypt a message
710 * @aead: TIPC AEAD key for the message encryption
711 * @skb: the input/output skb
712 * @b: TIPC bearer where the message will be delivered after the encryption
713 * @dst: the destination media address
714 * @__dnode: TIPC dest node if "known"
715 *
716 * Return:
717 * * 0 : if the encryption has completed
718 * * -EINPROGRESS/-EBUSY : if a callback will be performed
719 * * < 0 : the encryption has failed
720 */
721static int tipc_aead_encrypt(struct tipc_aead *aead, struct sk_buff *skb,
722 struct tipc_bearer *b,
723 struct tipc_media_addr *dst,
724 struct tipc_node *__dnode)
725{
726 struct crypto_aead *tfm = tipc_aead_tfm_next(aead);
727 struct tipc_crypto_tx_ctx *tx_ctx;
728 struct aead_request *req;
729 struct sk_buff *trailer;
730 struct scatterlist *sg;
731 struct tipc_ehdr *ehdr;
732 int ehsz, len, tailen, nsg, rc;
733 void *ctx;
734 u32 salt;
735 u8 *iv;
736
737 /* Make sure message len at least 4-byte aligned */
738 len = ALIGN(skb->len, 4);
739 tailen = len - skb->len + aead->authsize;
740
741 /* Expand skb tail for authentication tag:
742 * As for simplicity, we'd have made sure skb having enough tailroom
743 * for authentication tag @skb allocation. Even when skb is nonlinear
744 * but there is no frag_list, it should be still fine!
745 * Otherwise, we must cow it to be a writable buffer with the tailroom.
746 */
747 SKB_LINEAR_ASSERT(skb);
748 if (tailen > skb_tailroom(skb)) {
749 pr_debug("TX(): skb tailroom is not enough: %d, requires: %d\n",
750 skb_tailroom(skb), tailen);
751 }
752
753 nsg = skb_cow_data(skb, tailen, &trailer);
754 if (unlikely(nsg < 0)) {
755 pr_err("TX: skb_cow_data() returned %d\n", nsg);
756 return nsg;
757 }
758
759 pskb_put(skb, trailer, tailen);
760
761 /* Allocate memory for the AEAD operation */
762 ctx = tipc_aead_mem_alloc(tfm, sizeof(*tx_ctx), &iv, &req, &sg, nsg);
763 if (unlikely(!ctx))
764 return -ENOMEM;
765 TIPC_SKB_CB(skb)->crypto_ctx = ctx;
766
767 /* Map skb to the sg lists */
768 sg_init_table(sg, nsg);
769 rc = skb_to_sgvec(skb, sg, 0, skb->len);
770 if (unlikely(rc < 0)) {
771 pr_err("TX: skb_to_sgvec() returned %d, nsg %d!\n", rc, nsg);
772 goto exit;
773 }
774
775 /* Prepare IV: [SALT (4 octets)][SEQNO (8 octets)]
776 * In case we're in cluster-key mode, SALT is varied by xor-ing with
777 * the source address (or w0 of id), otherwise with the dest address
778 * if dest is known.
779 */
780 ehdr = (struct tipc_ehdr *)skb->data;
781 salt = aead->salt;
782 if (aead->mode == CLUSTER_KEY)
783 salt ^= __be32_to_cpu(ehdr->addr);
784 else if (__dnode)
785 salt ^= tipc_node_get_addr(__dnode);
786 memcpy(iv, &salt, 4);
787 memcpy(iv + 4, (u8 *)&ehdr->seqno, 8);
788
789 /* Prepare request */
790 ehsz = tipc_ehdr_size(ehdr);
791 aead_request_set_tfm(req, tfm);
792 aead_request_set_ad(req, ehsz);
793 aead_request_set_crypt(req, sg, sg, len - ehsz, iv);
794
795 /* Set callback function & data */
796 aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
797 tipc_aead_encrypt_done, skb);
798 tx_ctx = (struct tipc_crypto_tx_ctx *)ctx;
799 tx_ctx->aead = aead;
800 tx_ctx->bearer = b;
801 memcpy(&tx_ctx->dst, dst, sizeof(*dst));
802
803 /* Hold bearer */
804 if (unlikely(!tipc_bearer_hold(b))) {
805 rc = -ENODEV;
806 goto exit;
807 }
808
809 /* Get net to avoid freed tipc_crypto when delete namespace */
810 if (!maybe_get_net(aead->crypto->net)) {
811 tipc_bearer_put(b);
812 rc = -ENODEV;
813 goto exit;
814 }
815
816 /* Now, do encrypt */
817 rc = crypto_aead_encrypt(req);
818 if (rc == -EINPROGRESS || rc == -EBUSY)
819 return rc;
820
821 tipc_bearer_put(b);
822 put_net(aead->crypto->net);
823
824exit:
825 kfree(ctx);
826 TIPC_SKB_CB(skb)->crypto_ctx = NULL;
827 return rc;
828}
829
830static void tipc_aead_encrypt_done(void *data, int err)
831{
832 struct sk_buff *skb = data;
833 struct tipc_crypto_tx_ctx *tx_ctx = TIPC_SKB_CB(skb)->crypto_ctx;
834 struct tipc_bearer *b = tx_ctx->bearer;
835 struct tipc_aead *aead = tx_ctx->aead;
836 struct tipc_crypto *tx = aead->crypto;
837 struct net *net = tx->net;
838
839 switch (err) {
840 case 0:
841 this_cpu_inc(tx->stats->stat[STAT_ASYNC_OK]);
842 rcu_read_lock();
843 if (likely(test_bit(0, &b->up)))
844 b->media->send_msg(net, skb, b, &tx_ctx->dst);
845 else
846 kfree_skb(skb);
847 rcu_read_unlock();
848 break;
849 case -EINPROGRESS:
850 return;
851 default:
852 this_cpu_inc(tx->stats->stat[STAT_ASYNC_NOK]);
853 kfree_skb(skb);
854 break;
855 }
856
857 kfree(tx_ctx);
858 tipc_bearer_put(b);
859 tipc_aead_put(aead);
860 put_net(net);
861}
862
863/**
864 * tipc_aead_decrypt - Decrypt an encrypted message
865 * @net: struct net
866 * @aead: TIPC AEAD for the message decryption
867 * @skb: the input/output skb
868 * @b: TIPC bearer where the message has been received
869 *
870 * Return:
871 * * 0 : if the decryption has completed
872 * * -EINPROGRESS/-EBUSY : if a callback will be performed
873 * * < 0 : the decryption has failed
874 */
875static int tipc_aead_decrypt(struct net *net, struct tipc_aead *aead,
876 struct sk_buff *skb, struct tipc_bearer *b)
877{
878 struct tipc_crypto_rx_ctx *rx_ctx;
879 struct aead_request *req;
880 struct crypto_aead *tfm;
881 struct sk_buff *unused;
882 struct scatterlist *sg;
883 struct tipc_ehdr *ehdr;
884 int ehsz, nsg, rc;
885 void *ctx;
886 u32 salt;
887 u8 *iv;
888
889 if (unlikely(!aead))
890 return -ENOKEY;
891
892 nsg = skb_cow_data(skb, 0, &unused);
893 if (unlikely(nsg < 0)) {
894 pr_err("RX: skb_cow_data() returned %d\n", nsg);
895 return nsg;
896 }
897
898 /* Allocate memory for the AEAD operation */
899 tfm = tipc_aead_tfm_next(aead);
900 ctx = tipc_aead_mem_alloc(tfm, sizeof(*rx_ctx), &iv, &req, &sg, nsg);
901 if (unlikely(!ctx))
902 return -ENOMEM;
903 TIPC_SKB_CB(skb)->crypto_ctx = ctx;
904
905 /* Map skb to the sg lists */
906 sg_init_table(sg, nsg);
907 rc = skb_to_sgvec(skb, sg, 0, skb->len);
908 if (unlikely(rc < 0)) {
909 pr_err("RX: skb_to_sgvec() returned %d, nsg %d\n", rc, nsg);
910 goto exit;
911 }
912
913 /* Reconstruct IV: */
914 ehdr = (struct tipc_ehdr *)skb->data;
915 salt = aead->salt;
916 if (aead->mode == CLUSTER_KEY)
917 salt ^= __be32_to_cpu(ehdr->addr);
918 else if (ehdr->destined)
919 salt ^= tipc_own_addr(net);
920 memcpy(iv, &salt, 4);
921 memcpy(iv + 4, (u8 *)&ehdr->seqno, 8);
922
923 /* Prepare request */
924 ehsz = tipc_ehdr_size(ehdr);
925 aead_request_set_tfm(req, tfm);
926 aead_request_set_ad(req, ehsz);
927 aead_request_set_crypt(req, sg, sg, skb->len - ehsz, iv);
928
929 /* Set callback function & data */
930 aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
931 tipc_aead_decrypt_done, skb);
932 rx_ctx = (struct tipc_crypto_rx_ctx *)ctx;
933 rx_ctx->aead = aead;
934 rx_ctx->bearer = b;
935
936 /* Hold bearer */
937 if (unlikely(!tipc_bearer_hold(b))) {
938 rc = -ENODEV;
939 goto exit;
940 }
941
942 /* Get net to avoid freed tipc_crypto when delete namespace */
943 if (!maybe_get_net(net)) {
944 tipc_bearer_put(b);
945 rc = -ENODEV;
946 goto exit;
947 }
948
949 /* Now, do decrypt */
950 rc = crypto_aead_decrypt(req);
951 if (rc == -EINPROGRESS || rc == -EBUSY)
952 return rc;
953
954 tipc_bearer_put(b);
955 put_net(net);
956
957exit:
958 kfree(ctx);
959 TIPC_SKB_CB(skb)->crypto_ctx = NULL;
960 return rc;
961}
962
963static void tipc_aead_decrypt_done(void *data, int err)
964{
965 struct sk_buff *skb = data;
966 struct tipc_crypto_rx_ctx *rx_ctx = TIPC_SKB_CB(skb)->crypto_ctx;
967 struct tipc_bearer *b = rx_ctx->bearer;
968 struct tipc_aead *aead = rx_ctx->aead;
969 struct tipc_crypto_stats __percpu *stats = aead->crypto->stats;
970 struct net *net = aead->crypto->net;
971
972 switch (err) {
973 case 0:
974 this_cpu_inc(stats->stat[STAT_ASYNC_OK]);
975 break;
976 case -EINPROGRESS:
977 return;
978 default:
979 this_cpu_inc(stats->stat[STAT_ASYNC_NOK]);
980 break;
981 }
982
983 kfree(rx_ctx);
984 tipc_crypto_rcv_complete(net, aead, b, &skb, err);
985 if (likely(skb)) {
986 if (likely(test_bit(0, &b->up)))
987 tipc_rcv(net, skb, b);
988 else
989 kfree_skb(skb);
990 }
991
992 tipc_bearer_put(b);
993 put_net(net);
994}
995
996static inline int tipc_ehdr_size(struct tipc_ehdr *ehdr)
997{
998 return (ehdr->user != LINK_CONFIG) ? EHDR_SIZE : EHDR_CFG_SIZE;
999}
1000
1001/**
1002 * tipc_ehdr_validate - Validate an encryption message
1003 * @skb: the message buffer
1004 *
1005 * Return: "true" if this is a valid encryption message, otherwise "false"
1006 */
1007bool tipc_ehdr_validate(struct sk_buff *skb)
1008{
1009 struct tipc_ehdr *ehdr;
1010 int ehsz;
1011
1012 if (unlikely(!pskb_may_pull(skb, EHDR_MIN_SIZE)))
1013 return false;
1014
1015 ehdr = (struct tipc_ehdr *)skb->data;
1016 if (unlikely(ehdr->version != TIPC_EVERSION))
1017 return false;
1018 ehsz = tipc_ehdr_size(ehdr);
1019 if (unlikely(!pskb_may_pull(skb, ehsz)))
1020 return false;
1021 if (unlikely(skb->len <= ehsz + TIPC_AES_GCM_TAG_SIZE))
1022 return false;
1023
1024 return true;
1025}
1026
1027/**
1028 * tipc_ehdr_build - Build TIPC encryption message header
1029 * @net: struct net
1030 * @aead: TX AEAD key to be used for the message encryption
1031 * @tx_key: key id used for the message encryption
1032 * @skb: input/output message skb
1033 * @__rx: RX crypto handle if dest is "known"
1034 *
1035 * Return: the header size if the building is successful, otherwise < 0
1036 */
1037static int tipc_ehdr_build(struct net *net, struct tipc_aead *aead,
1038 u8 tx_key, struct sk_buff *skb,
1039 struct tipc_crypto *__rx)
1040{
1041 struct tipc_msg *hdr = buf_msg(skb);
1042 struct tipc_ehdr *ehdr;
1043 u32 user = msg_user(hdr);
1044 u64 seqno;
1045 int ehsz;
1046
1047 /* Make room for encryption header */
1048 ehsz = (user != LINK_CONFIG) ? EHDR_SIZE : EHDR_CFG_SIZE;
1049 WARN_ON(skb_headroom(skb) < ehsz);
1050 ehdr = (struct tipc_ehdr *)skb_push(skb, ehsz);
1051
1052 /*
1053 * Keep the nonce unique for the lifetime of the TX key,
1054 * including key state changes and peer reconnection.
1055 */
1056 seqno = atomic64_inc_return(&aead->seqno);
1057
1058 /* Revoke the key if seqno is wrapped around */
1059 if (unlikely(!seqno))
1060 return tipc_crypto_key_revoke(net, tx_key);
1061
1062 /* Word 1-2 */
1063 ehdr->seqno = cpu_to_be64(seqno);
1064
1065 /* Words 0, 3- */
1066 ehdr->version = TIPC_EVERSION;
1067 ehdr->user = 0;
1068 ehdr->keepalive = 0;
1069 ehdr->tx_key = tx_key;
1070 ehdr->destined = (__rx) ? 1 : 0;
1071 ehdr->rx_key_active = (__rx) ? __rx->key.active : 0;
1072 ehdr->rx_nokey = (__rx) ? __rx->nokey : 0;
1073 ehdr->master_key = aead->crypto->key_master;
1074 ehdr->reserved_1 = 0;
1075 ehdr->reserved_2 = 0;
1076
1077 switch (user) {
1078 case LINK_CONFIG:
1079 ehdr->user = LINK_CONFIG;
1080 memcpy(ehdr->id, tipc_own_id(net), NODE_ID_LEN);
1081 break;
1082 default:
1083 if (user == LINK_PROTOCOL && msg_type(hdr) == STATE_MSG) {
1084 ehdr->user = LINK_PROTOCOL;
1085 ehdr->keepalive = msg_is_keepalive(hdr);
1086 }
1087 ehdr->addr = hdr->hdr[3];
1088 break;
1089 }
1090
1091 return ehsz;
1092}
1093
1094static inline void tipc_crypto_key_set_state(struct tipc_crypto *c,
1095 u8 new_passive,
1096 u8 new_active,
1097 u8 new_pending)
1098{
1099 struct tipc_key old = c->key;
1100 char buf[32];
1101
1102 c->key.keys = ((new_passive & KEY_MASK) << (KEY_BITS * 2)) |
1103 ((new_active & KEY_MASK) << (KEY_BITS)) |
1104 ((new_pending & KEY_MASK));
1105
1106 pr_debug("%s: key changing %s ::%pS\n", c->name,
1107 tipc_key_change_dump(old, c->key, buf),
1108 __builtin_return_address(0));
1109}
1110
1111/**
1112 * tipc_crypto_key_init - Initiate a new user / AEAD key
1113 * @c: TIPC crypto to which new key is attached
1114 * @ukey: the user key
1115 * @mode: the key mode (CLUSTER_KEY or PER_NODE_KEY)
1116 * @master_key: specify this is a cluster master key
1117 *
1118 * A new TIPC AEAD key will be allocated and initiated with the specified user
1119 * key, then attached to the TIPC crypto.
1120 *
1121 * Return: new key id in case of success, otherwise: < 0
1122 */
1123int tipc_crypto_key_init(struct tipc_crypto *c, struct tipc_aead_key *ukey,
1124 u8 mode, bool master_key)
1125{
1126 struct tipc_aead *aead = NULL;
1127 int rc = 0;
1128
1129 /* Initiate with the new user key */
1130 rc = tipc_aead_init(&aead, ukey, mode);
1131
1132 /* Attach it to the crypto */
1133 if (likely(!rc)) {
1134 rc = tipc_crypto_key_attach(c, aead, 0, master_key);
1135 if (rc < 0)
1136 tipc_aead_free(&aead->rcu);
1137 }
1138
1139 return rc;
1140}
1141
1142/**
1143 * tipc_crypto_key_attach - Attach a new AEAD key to TIPC crypto
1144 * @c: TIPC crypto to which the new AEAD key is attached
1145 * @aead: the new AEAD key pointer
1146 * @pos: desired slot in the crypto key array, = 0 if any!
1147 * @master_key: specify this is a cluster master key
1148 *
1149 * Return: new key id in case of success, otherwise: -EBUSY
1150 */
1151static int tipc_crypto_key_attach(struct tipc_crypto *c,
1152 struct tipc_aead *aead, u8 pos,
1153 bool master_key)
1154{
1155 struct tipc_key key;
1156 int rc = -EBUSY;
1157 u8 new_key;
1158
1159 spin_lock_bh(&c->lock);
1160 key = c->key;
1161 if (master_key) {
1162 new_key = KEY_MASTER;
1163 goto attach;
1164 }
1165 if (key.active && key.passive)
1166 goto exit;
1167 if (key.pending) {
1168 if (tipc_aead_users(c->aead[key.pending]) > 0)
1169 goto exit;
1170 /* if (pos): ok with replacing, will be aligned when needed */
1171 /* Replace it */
1172 new_key = key.pending;
1173 } else {
1174 if (pos) {
1175 if (key.active && pos != key_next(key.active)) {
1176 key.passive = pos;
1177 new_key = pos;
1178 goto attach;
1179 } else if (!key.active && !key.passive) {
1180 key.pending = pos;
1181 new_key = pos;
1182 goto attach;
1183 }
1184 }
1185 key.pending = key_next(key.active ?: key.passive);
1186 new_key = key.pending;
1187 }
1188
1189attach:
1190 aead->crypto = c;
1191 aead->gen = (is_tx(c)) ? ++c->key_gen : c->key_gen;
1192 tipc_aead_rcu_replace(c->aead[new_key], aead, &c->lock);
1193 if (likely(c->key.keys != key.keys))
1194 tipc_crypto_key_set_state(c, key.passive, key.active,
1195 key.pending);
1196 c->working = 1;
1197 c->nokey = 0;
1198 c->key_master |= master_key;
1199 rc = new_key;
1200
1201exit:
1202 spin_unlock_bh(&c->lock);
1203 return rc;
1204}
1205
1206void tipc_crypto_key_flush(struct tipc_crypto *c)
1207{
1208 struct tipc_crypto *tx, *rx;
1209 int k;
1210
1211 spin_lock_bh(&c->lock);
1212 if (is_rx(c)) {
1213 /* Try to cancel pending work */
1214 rx = c;
1215 tx = tipc_net(rx->net)->crypto_tx;
1216 if (cancel_delayed_work(&rx->work)) {
1217 kfree_sensitive(rx->skey);
1218 rx->skey = NULL;
1219 atomic_xchg(&rx->key_distr, 0);
1220 tipc_node_put(rx->node);
1221 }
1222 /* RX stopping => decrease TX key users if any */
1223 k = atomic_xchg(&rx->peer_rx_active, 0);
1224 if (k) {
1225 tipc_aead_users_dec(tx->aead[k], 0);
1226 /* Mark the point TX key users changed */
1227 tx->timer1 = jiffies;
1228 }
1229 }
1230
1231 c->flags = 0;
1232 tipc_crypto_key_set_state(c, 0, 0, 0);
1233 for (k = KEY_MIN; k <= KEY_MAX; k++)
1234 tipc_crypto_key_detach(c->aead[k], &c->lock);
1235 spin_unlock_bh(&c->lock);
1236}
1237
1238/**
1239 * tipc_crypto_key_try_align - Align RX keys if possible
1240 * @rx: RX crypto handle
1241 * @new_pending: new pending slot if aligned (= TX key from peer)
1242 *
1243 * Peer has used an unknown key slot, this only happens when peer has left and
1244 * rejoned, or we are newcomer.
1245 * That means, there must be no active key but a pending key at unaligned slot.
1246 * If so, we try to move the pending key to the new slot.
1247 * Note: A potential passive key can exist, it will be shifted correspondingly!
1248 *
1249 * Return: "true" if key is successfully aligned, otherwise "false"
1250 */
1251static bool tipc_crypto_key_try_align(struct tipc_crypto *rx, u8 new_pending)
1252{
1253 struct tipc_aead *tmp1, *tmp2 = NULL;
1254 struct tipc_key key;
1255 bool aligned = false;
1256 u8 new_passive = 0;
1257 int x;
1258
1259 spin_lock(&rx->lock);
1260 key = rx->key;
1261 if (key.pending == new_pending) {
1262 aligned = true;
1263 goto exit;
1264 }
1265 if (key.active)
1266 goto exit;
1267 if (!key.pending)
1268 goto exit;
1269 if (tipc_aead_users(rx->aead[key.pending]) > 0)
1270 goto exit;
1271
1272 /* Try to "isolate" this pending key first */
1273 tmp1 = tipc_aead_rcu_ptr(rx->aead[key.pending], &rx->lock);
1274 if (!refcount_dec_if_one(&tmp1->refcnt))
1275 goto exit;
1276 rcu_assign_pointer(rx->aead[key.pending], NULL);
1277
1278 /* Move passive key if any */
1279 if (key.passive) {
1280 tmp2 = rcu_replace_pointer(rx->aead[key.passive], tmp2, lockdep_is_held(&rx->lock));
1281 x = (key.passive - key.pending + new_pending) % KEY_MAX;
1282 new_passive = (x <= 0) ? x + KEY_MAX : x;
1283 }
1284
1285 /* Re-allocate the key(s) */
1286 tipc_crypto_key_set_state(rx, new_passive, 0, new_pending);
1287 rcu_assign_pointer(rx->aead[new_pending], tmp1);
1288 if (new_passive)
1289 rcu_assign_pointer(rx->aead[new_passive], tmp2);
1290 refcount_set(&tmp1->refcnt, 1);
1291 aligned = true;
1292 pr_info_ratelimited("%s: key[%d] -> key[%d]\n", rx->name, key.pending,
1293 new_pending);
1294
1295exit:
1296 spin_unlock(&rx->lock);
1297 return aligned;
1298}
1299
1300/**
1301 * tipc_crypto_key_pick_tx - Pick one TX key for message decryption
1302 * @tx: TX crypto handle
1303 * @rx: RX crypto handle (can be NULL)
1304 * @skb: the message skb which will be decrypted later
1305 * @tx_key: peer TX key id
1306 *
1307 * This function looks up the existing TX keys and pick one which is suitable
1308 * for the message decryption, that must be a cluster key and not used before
1309 * on the same message (i.e. recursive).
1310 *
1311 * Return: the TX AEAD key handle in case of success, otherwise NULL
1312 */
1313static struct tipc_aead *tipc_crypto_key_pick_tx(struct tipc_crypto *tx,
1314 struct tipc_crypto *rx,
1315 struct sk_buff *skb,
1316 u8 tx_key)
1317{
1318 struct tipc_skb_cb *skb_cb = TIPC_SKB_CB(skb);
1319 struct tipc_aead *aead = NULL;
1320 struct tipc_key key = tx->key;
1321 u8 k, i = 0;
1322
1323 /* Initialize data if not yet */
1324 if (!skb_cb->tx_clone_deferred) {
1325 skb_cb->tx_clone_deferred = 1;
1326 memset(&skb_cb->tx_clone_ctx, 0, sizeof(skb_cb->tx_clone_ctx));
1327 }
1328
1329 skb_cb->tx_clone_ctx.rx = rx;
1330 if (++skb_cb->tx_clone_ctx.recurs > 2)
1331 return NULL;
1332
1333 /* Pick one TX key */
1334 spin_lock(&tx->lock);
1335 if (tx_key == KEY_MASTER) {
1336 aead = tipc_aead_rcu_ptr(tx->aead[KEY_MASTER], &tx->lock);
1337 goto done;
1338 }
1339 do {
1340 k = (i == 0) ? key.pending :
1341 ((i == 1) ? key.active : key.passive);
1342 if (!k)
1343 continue;
1344 aead = tipc_aead_rcu_ptr(tx->aead[k], &tx->lock);
1345 if (!aead)
1346 continue;
1347 if (aead->mode != CLUSTER_KEY ||
1348 aead == skb_cb->tx_clone_ctx.last) {
1349 aead = NULL;
1350 continue;
1351 }
1352 /* Ok, found one cluster key */
1353 skb_cb->tx_clone_ctx.last = aead;
1354 WARN_ON(skb->next);
1355 skb->next = skb_clone(skb, GFP_ATOMIC);
1356 if (unlikely(!skb->next))
1357 pr_warn("Failed to clone skb for next round if any\n");
1358 break;
1359 } while (++i < 3);
1360
1361done:
1362 if (likely(aead))
1363 WARN_ON(!refcount_inc_not_zero(&aead->refcnt));
1364 spin_unlock(&tx->lock);
1365
1366 return aead;
1367}
1368
1369/**
1370 * tipc_crypto_key_synch: Synch own key data according to peer key status
1371 * @rx: RX crypto handle
1372 * @skb: TIPCv2 message buffer (incl. the ehdr from peer)
1373 *
1374 * This function updates the peer node related data as the peer RX active key
1375 * has changed, so the number of TX keys' users on this node are increased and
1376 * decreased correspondingly.
1377 *
1378 * It also considers if peer has no key, then we need to make own master key
1379 * (if any) taking over i.e. starting grace period and also trigger key
1380 * distributing process.
1381 */
1382static void tipc_crypto_key_synch(struct tipc_crypto *rx, struct sk_buff *skb)
1383{
1384 struct tipc_ehdr *ehdr = (struct tipc_ehdr *)skb_network_header(skb);
1385 struct tipc_crypto *tx = tipc_net(rx->net)->crypto_tx;
1386 struct tipc_msg *hdr = buf_msg(skb);
1387 u32 self = tipc_own_addr(rx->net);
1388 u8 cur, new;
1389 unsigned long delay;
1390
1391 /* Update RX 'key_master' flag according to peer, also mark "legacy" if
1392 * a peer has no master key.
1393 */
1394 rx->key_master = ehdr->master_key;
1395 if (!rx->key_master)
1396 tx->legacy_user = 1;
1397
1398 /* For later cases, apply only if message is destined to this node */
1399 if (!ehdr->destined || msg_short(hdr) || msg_destnode(hdr) != self)
1400 return;
1401
1402 /* Case 1: Peer has no keys, let's make master key take over */
1403 if (ehdr->rx_nokey) {
1404 /* Set or extend grace period */
1405 tx->timer2 = jiffies;
1406 /* Schedule key distributing for the peer if not yet */
1407 if (tx->key.keys &&
1408 !atomic_cmpxchg(&rx->key_distr, 0, KEY_DISTR_SCHED)) {
1409 get_random_bytes(&delay, 2);
1410 delay %= 5;
1411 delay = msecs_to_jiffies(500 * ++delay);
1412 if (queue_delayed_work(tx->wq, &rx->work, delay))
1413 tipc_node_get(rx->node);
1414 }
1415 } else {
1416 /* Cancel a pending key distributing if any */
1417 atomic_xchg(&rx->key_distr, 0);
1418 }
1419
1420 /* Case 2: Peer RX active key has changed, let's update own TX users */
1421 cur = atomic_read(&rx->peer_rx_active);
1422 new = ehdr->rx_key_active;
1423 if (tx->key.keys &&
1424 cur != new &&
1425 atomic_cmpxchg(&rx->peer_rx_active, cur, new) == cur) {
1426 if (new)
1427 tipc_aead_users_inc(tx->aead[new], INT_MAX);
1428 if (cur)
1429 tipc_aead_users_dec(tx->aead[cur], 0);
1430
1431 /* Mark the point TX key users changed */
1432 tx->timer1 = jiffies;
1433
1434 pr_debug("%s: key users changed %d-- %d++, peer %s\n",
1435 tx->name, cur, new, rx->name);
1436 }
1437}
1438
1439static int tipc_crypto_key_revoke(struct net *net, u8 tx_key)
1440{
1441 struct tipc_crypto *tx = tipc_net(net)->crypto_tx;
1442 struct tipc_key key;
1443
1444 spin_lock_bh(&tx->lock);
1445 key = tx->key;
1446 WARN_ON(!key.active || tx_key != key.active);
1447
1448 /* Free the active key */
1449 tipc_crypto_key_set_state(tx, key.passive, 0, key.pending);
1450 tipc_crypto_key_detach(tx->aead[key.active], &tx->lock);
1451 spin_unlock_bh(&tx->lock);
1452
1453 pr_warn("%s: key is revoked\n", tx->name);
1454 return -EKEYREVOKED;
1455}
1456
1457int tipc_crypto_start(struct tipc_crypto **crypto, struct net *net,
1458 struct tipc_node *node)
1459{
1460 struct tipc_crypto *c;
1461
1462 if (*crypto)
1463 return -EEXIST;
1464
1465 /* Allocate crypto */
1466 c = kzalloc_obj(*c, GFP_ATOMIC);
1467 if (!c)
1468 return -ENOMEM;
1469
1470 /* Allocate workqueue on TX */
1471 if (!node) {
1472 c->wq = alloc_ordered_workqueue("tipc_crypto", 0);
1473 if (!c->wq) {
1474 kfree(c);
1475 return -ENOMEM;
1476 }
1477 }
1478
1479 /* Allocate statistic structure */
1480 c->stats = alloc_percpu_gfp(struct tipc_crypto_stats, GFP_ATOMIC);
1481 if (!c->stats) {
1482 if (c->wq)
1483 destroy_workqueue(c->wq);
1484 kfree_sensitive(c);
1485 return -ENOMEM;
1486 }
1487
1488 c->flags = 0;
1489 c->net = net;
1490 c->node = node;
1491 get_random_bytes(&c->key_gen, 2);
1492 tipc_crypto_key_set_state(c, 0, 0, 0);
1493 atomic_set(&c->key_distr, 0);
1494 atomic_set(&c->peer_rx_active, 0);
1495 c->timer1 = jiffies;
1496 c->timer2 = jiffies;
1497 c->rekeying_intv = TIPC_REKEYING_INTV_DEF;
1498 spin_lock_init(&c->lock);
1499 scnprintf(c->name, 48, "%s(%s)", (is_rx(c)) ? "RX" : "TX",
1500 (is_rx(c)) ? tipc_node_get_id_str(c->node) :
1501 tipc_own_id_string(c->net));
1502
1503 if (is_rx(c))
1504 INIT_DELAYED_WORK(&c->work, tipc_crypto_work_rx);
1505 else
1506 INIT_DELAYED_WORK(&c->work, tipc_crypto_work_tx);
1507
1508 *crypto = c;
1509 return 0;
1510}
1511
1512void tipc_crypto_stop(struct tipc_crypto **crypto)
1513{
1514 struct tipc_crypto *c = *crypto;
1515 u8 k;
1516
1517 if (!c)
1518 return;
1519
1520 /* Flush any queued works & destroy wq */
1521 if (is_tx(c)) {
1522 c->rekeying_intv = 0;
1523 cancel_delayed_work_sync(&c->work);
1524 destroy_workqueue(c->wq);
1525 }
1526
1527 /* Release AEAD keys */
1528 rcu_read_lock();
1529 for (k = KEY_MIN; k <= KEY_MAX; k++)
1530 tipc_aead_put(rcu_dereference(c->aead[k]));
1531 rcu_read_unlock();
1532 pr_debug("%s: has been stopped\n", c->name);
1533
1534 /* Free this crypto statistics */
1535 free_percpu(c->stats);
1536
1537 *crypto = NULL;
1538 kfree_sensitive(c);
1539}
1540
1541void tipc_crypto_timeout(struct tipc_crypto *rx)
1542{
1543 struct tipc_net *tn = tipc_net(rx->net);
1544 struct tipc_crypto *tx = tn->crypto_tx;
1545 struct tipc_key key;
1546 int cmd;
1547
1548 /* TX pending: taking all users & stable -> active */
1549 spin_lock(&tx->lock);
1550 key = tx->key;
1551 if (key.active && tipc_aead_users(tx->aead[key.active]) > 0)
1552 goto s1;
1553 if (!key.pending || tipc_aead_users(tx->aead[key.pending]) <= 0)
1554 goto s1;
1555 if (time_before(jiffies, tx->timer1 + TIPC_TX_LASTING_TIME))
1556 goto s1;
1557
1558 tipc_crypto_key_set_state(tx, key.passive, key.pending, 0);
1559 if (key.active)
1560 tipc_crypto_key_detach(tx->aead[key.active], &tx->lock);
1561 this_cpu_inc(tx->stats->stat[STAT_SWITCHES]);
1562 pr_info("%s: key[%d] is activated\n", tx->name, key.pending);
1563
1564s1:
1565 spin_unlock(&tx->lock);
1566
1567 /* RX pending: having user -> active */
1568 spin_lock(&rx->lock);
1569 key = rx->key;
1570 if (!key.pending || tipc_aead_users(rx->aead[key.pending]) <= 0)
1571 goto s2;
1572
1573 if (key.active)
1574 key.passive = key.active;
1575 key.active = key.pending;
1576 rx->timer2 = jiffies;
1577 tipc_crypto_key_set_state(rx, key.passive, key.active, 0);
1578 this_cpu_inc(rx->stats->stat[STAT_SWITCHES]);
1579 pr_info("%s: key[%d] is activated\n", rx->name, key.pending);
1580 goto s5;
1581
1582s2:
1583 /* RX pending: not working -> remove */
1584 if (!key.pending || tipc_aead_users(rx->aead[key.pending]) > -10)
1585 goto s3;
1586
1587 tipc_crypto_key_set_state(rx, key.passive, key.active, 0);
1588 tipc_crypto_key_detach(rx->aead[key.pending], &rx->lock);
1589 pr_debug("%s: key[%d] is removed\n", rx->name, key.pending);
1590 goto s5;
1591
1592s3:
1593 /* RX active: timed out or no user -> pending */
1594 if (!key.active)
1595 goto s4;
1596 if (time_before(jiffies, rx->timer1 + TIPC_RX_ACTIVE_LIM) &&
1597 tipc_aead_users(rx->aead[key.active]) > 0)
1598 goto s4;
1599
1600 if (key.pending)
1601 key.passive = key.active;
1602 else
1603 key.pending = key.active;
1604 rx->timer2 = jiffies;
1605 tipc_crypto_key_set_state(rx, key.passive, 0, key.pending);
1606 tipc_aead_users_set(rx->aead[key.pending], 0);
1607 pr_debug("%s: key[%d] is deactivated\n", rx->name, key.active);
1608 goto s5;
1609
1610s4:
1611 /* RX passive: outdated or not working -> free */
1612 if (!key.passive)
1613 goto s5;
1614 if (time_before(jiffies, rx->timer2 + TIPC_RX_PASSIVE_LIM) &&
1615 tipc_aead_users(rx->aead[key.passive]) > -10)
1616 goto s5;
1617
1618 tipc_crypto_key_set_state(rx, 0, key.active, key.pending);
1619 tipc_crypto_key_detach(rx->aead[key.passive], &rx->lock);
1620 pr_debug("%s: key[%d] is freed\n", rx->name, key.passive);
1621
1622s5:
1623 spin_unlock(&rx->lock);
1624
1625 /* Relax it here, the flag will be set again if it really is, but only
1626 * when we are not in grace period for safety!
1627 */
1628 if (time_after(jiffies, tx->timer2 + TIPC_TX_GRACE_PERIOD))
1629 tx->legacy_user = 0;
1630
1631 /* Limit max_tfms & do debug commands if needed */
1632 if (likely(sysctl_tipc_max_tfms <= TIPC_MAX_TFMS_LIM))
1633 return;
1634
1635 cmd = sysctl_tipc_max_tfms;
1636 sysctl_tipc_max_tfms = TIPC_MAX_TFMS_DEF;
1637 tipc_crypto_do_cmd(rx->net, cmd);
1638}
1639
1640static inline void tipc_crypto_clone_msg(struct net *net, struct sk_buff *_skb,
1641 struct tipc_bearer *b,
1642 struct tipc_media_addr *dst,
1643 struct tipc_node *__dnode, u8 type)
1644{
1645 struct sk_buff *skb;
1646
1647 skb = skb_clone(_skb, GFP_ATOMIC);
1648 if (skb) {
1649 TIPC_SKB_CB(skb)->xmit_type = type;
1650 tipc_crypto_xmit(net, &skb, b, dst, __dnode);
1651 if (skb)
1652 b->media->send_msg(net, skb, b, dst);
1653 }
1654}
1655
1656/**
1657 * tipc_crypto_xmit - Build & encrypt TIPC message for xmit
1658 * @net: struct net
1659 * @skb: input/output message skb pointer
1660 * @b: bearer used for xmit later
1661 * @dst: destination media address
1662 * @__dnode: destination node for reference if any
1663 *
1664 * First, build an encryption message header on the top of the message, then
1665 * encrypt the original TIPC message by using the pending, master or active
1666 * key with this preference order.
1667 * If the encryption is successful, the encrypted skb is returned directly or
1668 * via the callback.
1669 * Otherwise, the skb is freed!
1670 *
1671 * Return:
1672 * * 0 : the encryption has succeeded (or no encryption)
1673 * * -EINPROGRESS/-EBUSY : the encryption is ongoing, a callback will be made
1674 * * -ENOKEK : the encryption has failed due to no key
1675 * * -EKEYREVOKED : the encryption has failed due to key revoked
1676 * * -ENOMEM : the encryption has failed due to no memory
1677 * * < 0 : the encryption has failed due to other reasons
1678 */
1679int tipc_crypto_xmit(struct net *net, struct sk_buff **skb,
1680 struct tipc_bearer *b, struct tipc_media_addr *dst,
1681 struct tipc_node *__dnode)
1682{
1683 struct tipc_crypto *__rx = tipc_node_crypto_rx(__dnode);
1684 struct tipc_crypto *tx = tipc_net(net)->crypto_tx;
1685 struct tipc_crypto_stats __percpu *stats = tx->stats;
1686 struct tipc_msg *hdr = buf_msg(*skb);
1687 struct tipc_key key = tx->key;
1688 struct tipc_aead *aead = NULL;
1689 u32 user = msg_user(hdr);
1690 u32 type = msg_type(hdr);
1691 int rc = -ENOKEY;
1692 u8 tx_key = 0;
1693
1694 /* No encryption? */
1695 if (!tx->working)
1696 return 0;
1697
1698 /* Pending key if peer has active on it or probing time */
1699 if (unlikely(key.pending)) {
1700 tx_key = key.pending;
1701 if (!tx->key_master && !key.active)
1702 goto encrypt;
1703 if (__rx && atomic_read(&__rx->peer_rx_active) == tx_key)
1704 goto encrypt;
1705 if (TIPC_SKB_CB(*skb)->xmit_type == SKB_PROBING) {
1706 pr_debug("%s: probing for key[%d]\n", tx->name,
1707 key.pending);
1708 goto encrypt;
1709 }
1710 if (user == LINK_CONFIG || user == LINK_PROTOCOL)
1711 tipc_crypto_clone_msg(net, *skb, b, dst, __dnode,
1712 SKB_PROBING);
1713 }
1714
1715 /* Master key if this is a *vital* message or in grace period */
1716 if (tx->key_master) {
1717 tx_key = KEY_MASTER;
1718 if (!key.active)
1719 goto encrypt;
1720 if (TIPC_SKB_CB(*skb)->xmit_type == SKB_GRACING) {
1721 pr_debug("%s: gracing for msg (%d %d)\n", tx->name,
1722 user, type);
1723 goto encrypt;
1724 }
1725 if (user == LINK_CONFIG ||
1726 (user == LINK_PROTOCOL && type == RESET_MSG) ||
1727 (user == MSG_CRYPTO && type == KEY_DISTR_MSG) ||
1728 time_before(jiffies, tx->timer2 + TIPC_TX_GRACE_PERIOD)) {
1729 if (__rx && __rx->key_master &&
1730 !atomic_read(&__rx->peer_rx_active))
1731 goto encrypt;
1732 if (!__rx) {
1733 if (likely(!tx->legacy_user))
1734 goto encrypt;
1735 tipc_crypto_clone_msg(net, *skb, b, dst,
1736 __dnode, SKB_GRACING);
1737 }
1738 }
1739 }
1740
1741 /* Else, use the active key if any */
1742 if (likely(key.active)) {
1743 tx_key = key.active;
1744 goto encrypt;
1745 }
1746
1747 goto exit;
1748
1749encrypt:
1750 aead = tipc_aead_get(tx->aead[tx_key]);
1751 if (unlikely(!aead))
1752 goto exit;
1753 rc = tipc_ehdr_build(net, aead, tx_key, *skb, __rx);
1754 if (likely(rc > 0))
1755 rc = tipc_aead_encrypt(aead, *skb, b, dst, __dnode);
1756
1757exit:
1758 switch (rc) {
1759 case 0:
1760 this_cpu_inc(stats->stat[STAT_OK]);
1761 break;
1762 case -EINPROGRESS:
1763 case -EBUSY:
1764 this_cpu_inc(stats->stat[STAT_ASYNC]);
1765 *skb = NULL;
1766 return rc;
1767 default:
1768 this_cpu_inc(stats->stat[STAT_NOK]);
1769 if (rc == -ENOKEY)
1770 this_cpu_inc(stats->stat[STAT_NOKEYS]);
1771 else if (rc == -EKEYREVOKED)
1772 this_cpu_inc(stats->stat[STAT_BADKEYS]);
1773 kfree_skb(*skb);
1774 *skb = NULL;
1775 break;
1776 }
1777
1778 tipc_aead_put(aead);
1779 return rc;
1780}
1781
1782/**
1783 * tipc_crypto_rcv - Decrypt an encrypted TIPC message from peer
1784 * @net: struct net
1785 * @rx: RX crypto handle
1786 * @skb: input/output message skb pointer
1787 * @b: bearer where the message has been received
1788 *
1789 * If the decryption is successful, the decrypted skb is returned directly or
1790 * as the callback, the encryption header and auth tag will be trimmed out
1791 * before forwarding to tipc_rcv() via the tipc_crypto_rcv_complete().
1792 * Otherwise, the skb will be freed!
1793 * Note: RX key(s) can be re-aligned, or in case of no key suitable, TX
1794 * cluster key(s) can be taken for decryption (- recursive).
1795 *
1796 * Return:
1797 * * 0 : the decryption has successfully completed
1798 * * -EINPROGRESS/-EBUSY : the decryption is ongoing, a callback will be made
1799 * * -ENOKEY : the decryption has failed due to no key
1800 * * -EBADMSG : the decryption has failed due to bad message
1801 * * -ENOMEM : the decryption has failed due to no memory
1802 * * < 0 : the decryption has failed due to other reasons
1803 */
1804int tipc_crypto_rcv(struct net *net, struct tipc_crypto *rx,
1805 struct sk_buff **skb, struct tipc_bearer *b)
1806{
1807 struct tipc_crypto *tx = tipc_net(net)->crypto_tx;
1808 struct tipc_crypto_stats __percpu *stats;
1809 struct tipc_aead *aead = NULL;
1810 struct tipc_key key;
1811 int rc = -ENOKEY;
1812 u8 tx_key, n;
1813
1814 tx_key = ((struct tipc_ehdr *)(*skb)->data)->tx_key;
1815
1816 /* New peer?
1817 * Let's try with TX key (i.e. cluster mode) & verify the skb first!
1818 */
1819 if (unlikely(!rx || tx_key == KEY_MASTER))
1820 goto pick_tx;
1821
1822 /* Pick RX key according to TX key if any */
1823 key = rx->key;
1824 if (tx_key == key.active || tx_key == key.pending ||
1825 tx_key == key.passive)
1826 goto decrypt;
1827
1828 /* Unknown key, let's try to align RX key(s) */
1829 if (tipc_crypto_key_try_align(rx, tx_key))
1830 goto decrypt;
1831
1832pick_tx:
1833 /* No key suitable? Try to pick one from TX... */
1834 aead = tipc_crypto_key_pick_tx(tx, rx, *skb, tx_key);
1835 if (aead)
1836 goto decrypt;
1837 goto exit;
1838
1839decrypt:
1840 rcu_read_lock();
1841 if (!aead)
1842 aead = tipc_aead_get(rx->aead[tx_key]);
1843 rc = tipc_aead_decrypt(net, aead, *skb, b);
1844 rcu_read_unlock();
1845
1846exit:
1847 stats = ((rx) ?: tx)->stats;
1848 switch (rc) {
1849 case 0:
1850 this_cpu_inc(stats->stat[STAT_OK]);
1851 break;
1852 case -EINPROGRESS:
1853 case -EBUSY:
1854 this_cpu_inc(stats->stat[STAT_ASYNC]);
1855 *skb = NULL;
1856 return rc;
1857 default:
1858 this_cpu_inc(stats->stat[STAT_NOK]);
1859 if (rc == -ENOKEY) {
1860 kfree_skb(*skb);
1861 *skb = NULL;
1862 if (rx) {
1863 /* Mark rx->nokey only if we dont have a
1864 * pending received session key, nor a newer
1865 * one i.e. in the next slot.
1866 */
1867 n = key_next(tx_key);
1868 rx->nokey = !(rx->skey ||
1869 rcu_access_pointer(rx->aead[n]));
1870 pr_debug_ratelimited("%s: nokey %d, key %d/%x\n",
1871 rx->name, rx->nokey,
1872 tx_key, rx->key.keys);
1873 tipc_node_put(rx->node);
1874 }
1875 this_cpu_inc(stats->stat[STAT_NOKEYS]);
1876 return rc;
1877 } else if (rc == -EBADMSG) {
1878 this_cpu_inc(stats->stat[STAT_BADMSGS]);
1879 }
1880 break;
1881 }
1882
1883 tipc_crypto_rcv_complete(net, aead, b, skb, rc);
1884 return rc;
1885}
1886
1887static void tipc_crypto_rcv_complete(struct net *net, struct tipc_aead *aead,
1888 struct tipc_bearer *b,
1889 struct sk_buff **skb, int err)
1890{
1891 struct tipc_skb_cb *skb_cb = TIPC_SKB_CB(*skb);
1892 struct tipc_crypto *rx = aead->crypto;
1893 struct tipc_aead *tmp = NULL;
1894 struct tipc_ehdr *ehdr;
1895 struct tipc_node *n;
1896
1897 /* Is this completed by TX? */
1898 if (unlikely(is_tx(aead->crypto))) {
1899 rx = skb_cb->tx_clone_ctx.rx;
1900 pr_debug("TX->RX(%s): err %d, aead %p, skb->next %p, flags %x\n",
1901 (rx) ? tipc_node_get_id_str(rx->node) : "-", err, aead,
1902 (*skb)->next, skb_cb->flags);
1903 pr_debug("skb_cb [recurs %d, last %p], tx->aead [%p %p %p]\n",
1904 skb_cb->tx_clone_ctx.recurs, skb_cb->tx_clone_ctx.last,
1905 aead->crypto->aead[1], aead->crypto->aead[2],
1906 aead->crypto->aead[3]);
1907 if (unlikely(err)) {
1908 if (err == -EBADMSG && (*skb)->next)
1909 tipc_rcv(net, (*skb)->next, b);
1910 goto free_skb;
1911 }
1912
1913 if (likely((*skb)->next)) {
1914 kfree_skb((*skb)->next);
1915 (*skb)->next = NULL;
1916 }
1917 ehdr = (struct tipc_ehdr *)(*skb)->data;
1918 if (!rx) {
1919 WARN_ON(ehdr->user != LINK_CONFIG);
1920 n = tipc_node_create(net, 0, ehdr->id, 0xffffu, 0,
1921 true);
1922 rx = tipc_node_crypto_rx(n);
1923 if (unlikely(!rx))
1924 goto free_skb;
1925 }
1926
1927 /* Ignore cloning if it was TX master key */
1928 if (ehdr->tx_key == KEY_MASTER)
1929 goto rcv;
1930 if (tipc_aead_clone(&tmp, aead) < 0)
1931 goto rcv;
1932 WARN_ON(!refcount_inc_not_zero(&tmp->refcnt));
1933 if (tipc_crypto_key_attach(rx, tmp, ehdr->tx_key, false) < 0) {
1934 tipc_aead_free(&tmp->rcu);
1935 goto rcv;
1936 }
1937 tipc_aead_put(aead);
1938 aead = tmp;
1939 }
1940
1941 if (unlikely(err)) {
1942 tipc_aead_users_dec((struct tipc_aead __force __rcu *)aead, INT_MIN);
1943 goto free_skb;
1944 }
1945
1946 /* Set the RX key's user */
1947 tipc_aead_users_set((struct tipc_aead __force __rcu *)aead, 1);
1948
1949 /* Mark this point, RX works */
1950 rx->timer1 = jiffies;
1951
1952rcv:
1953 /* Remove ehdr & auth. tag prior to tipc_rcv() */
1954 ehdr = (struct tipc_ehdr *)(*skb)->data;
1955
1956 /* Mark this point, RX passive still works */
1957 if (rx->key.passive && ehdr->tx_key == rx->key.passive)
1958 rx->timer2 = jiffies;
1959
1960 skb_reset_network_header(*skb);
1961 skb_pull(*skb, tipc_ehdr_size(ehdr));
1962 if (pskb_trim(*skb, (*skb)->len - aead->authsize))
1963 goto free_skb;
1964
1965 /* Validate TIPCv2 message */
1966 if (unlikely(!tipc_msg_validate(skb))) {
1967 pr_err_ratelimited("Packet dropped after decryption!\n");
1968 goto free_skb;
1969 }
1970
1971 /* Ok, everything's fine, try to synch own keys according to peers' */
1972 tipc_crypto_key_synch(rx, *skb);
1973
1974 /* Re-fetch skb cb as skb might be changed in tipc_msg_validate */
1975 skb_cb = TIPC_SKB_CB(*skb);
1976
1977 /* Mark skb decrypted */
1978 skb_cb->decrypted = 1;
1979
1980 /* Clear clone cxt if any */
1981 if (likely(!skb_cb->tx_clone_deferred))
1982 goto exit;
1983 skb_cb->tx_clone_deferred = 0;
1984 memset(&skb_cb->tx_clone_ctx, 0, sizeof(skb_cb->tx_clone_ctx));
1985 goto exit;
1986
1987free_skb:
1988 kfree_skb(*skb);
1989 *skb = NULL;
1990
1991exit:
1992 tipc_aead_put(aead);
1993 if (rx)
1994 tipc_node_put(rx->node);
1995}
1996
1997static void tipc_crypto_do_cmd(struct net *net, int cmd)
1998{
1999 struct tipc_net *tn = tipc_net(net);
2000 struct tipc_crypto *tx = tn->crypto_tx, *rx;
2001 struct list_head *p;
2002 unsigned int stat;
2003 int i, j, cpu;
2004 char buf[200];
2005
2006 /* Currently only one command is supported */
2007 switch (cmd) {
2008 case 0xfff1:
2009 goto print_stats;
2010 default:
2011 return;
2012 }
2013
2014print_stats:
2015 /* Print a header */
2016 pr_info("\n=============== TIPC Crypto Statistics ===============\n\n");
2017
2018 /* Print key status */
2019 pr_info("Key status:\n");
2020 pr_info("TX(%7.7s)\n%s", tipc_own_id_string(net),
2021 tipc_crypto_key_dump(tx, buf));
2022
2023 rcu_read_lock();
2024 for (p = tn->node_list.next; p != &tn->node_list; p = p->next) {
2025 rx = tipc_node_crypto_rx_by_list(p);
2026 pr_info("RX(%7.7s)\n%s", tipc_node_get_id_str(rx->node),
2027 tipc_crypto_key_dump(rx, buf));
2028 }
2029 rcu_read_unlock();
2030
2031 /* Print crypto statistics */
2032 for (i = 0, j = 0; i < MAX_STATS; i++)
2033 j += scnprintf(buf + j, 200 - j, "|%11s ", hstats[i]);
2034 pr_info("Counter %s", buf);
2035
2036 memset(buf, '-', 115);
2037 buf[115] = '\0';
2038 pr_info("%s\n", buf);
2039
2040 j = scnprintf(buf, 200, "TX(%7.7s) ", tipc_own_id_string(net));
2041 for_each_possible_cpu(cpu) {
2042 for (i = 0; i < MAX_STATS; i++) {
2043 stat = per_cpu_ptr(tx->stats, cpu)->stat[i];
2044 j += scnprintf(buf + j, 200 - j, "|%11d ", stat);
2045 }
2046 pr_info("%s", buf);
2047 j = scnprintf(buf, 200, "%12s", " ");
2048 }
2049
2050 rcu_read_lock();
2051 for (p = tn->node_list.next; p != &tn->node_list; p = p->next) {
2052 rx = tipc_node_crypto_rx_by_list(p);
2053 j = scnprintf(buf, 200, "RX(%7.7s) ",
2054 tipc_node_get_id_str(rx->node));
2055 for_each_possible_cpu(cpu) {
2056 for (i = 0; i < MAX_STATS; i++) {
2057 stat = per_cpu_ptr(rx->stats, cpu)->stat[i];
2058 j += scnprintf(buf + j, 200 - j, "|%11d ",
2059 stat);
2060 }
2061 pr_info("%s", buf);
2062 j = scnprintf(buf, 200, "%12s", " ");
2063 }
2064 }
2065 rcu_read_unlock();
2066
2067 pr_info("\n======================== Done ========================\n");
2068}
2069
2070static char *tipc_crypto_key_dump(struct tipc_crypto *c, char *buf)
2071{
2072 struct tipc_key key = c->key;
2073 struct tipc_aead *aead;
2074 int k, i = 0;
2075 char *s;
2076
2077 for (k = KEY_MIN; k <= KEY_MAX; k++) {
2078 if (k == KEY_MASTER) {
2079 if (is_rx(c))
2080 continue;
2081 if (time_before(jiffies,
2082 c->timer2 + TIPC_TX_GRACE_PERIOD))
2083 s = "ACT";
2084 else
2085 s = "PAS";
2086 } else {
2087 if (k == key.passive)
2088 s = "PAS";
2089 else if (k == key.active)
2090 s = "ACT";
2091 else if (k == key.pending)
2092 s = "PEN";
2093 else
2094 s = "-";
2095 }
2096 i += scnprintf(buf + i, 200 - i, "\tKey%d: %s", k, s);
2097
2098 rcu_read_lock();
2099 aead = rcu_dereference(c->aead[k]);
2100 if (aead)
2101 i += scnprintf(buf + i, 200 - i,
2102 "{\"0x...%s\", \"%s\"}/%d:%d",
2103 aead->hint,
2104 (aead->mode == CLUSTER_KEY) ? "c" : "p",
2105 atomic_read(&aead->users),
2106 refcount_read(&aead->refcnt));
2107 rcu_read_unlock();
2108 i += scnprintf(buf + i, 200 - i, "\n");
2109 }
2110
2111 if (is_rx(c))
2112 i += scnprintf(buf + i, 200 - i, "\tPeer RX active: %d\n",
2113 atomic_read(&c->peer_rx_active));
2114
2115 return buf;
2116}
2117
2118static char *tipc_key_change_dump(struct tipc_key old, struct tipc_key new,
2119 char *buf)
2120{
2121 struct tipc_key *key = &old;
2122 int k, i = 0;
2123 char *s;
2124
2125 /* Output format: "[%s %s %s] -> [%s %s %s]", max len = 32 */
2126again:
2127 i += scnprintf(buf + i, 32 - i, "[");
2128 for (k = KEY_1; k <= KEY_3; k++) {
2129 if (k == key->passive)
2130 s = "pas";
2131 else if (k == key->active)
2132 s = "act";
2133 else if (k == key->pending)
2134 s = "pen";
2135 else
2136 s = "-";
2137 i += scnprintf(buf + i, 32 - i,
2138 (k != KEY_3) ? "%s " : "%s", s);
2139 }
2140 if (key != &new) {
2141 i += scnprintf(buf + i, 32 - i, "] -> ");
2142 key = &new;
2143 goto again;
2144 }
2145 i += scnprintf(buf + i, 32 - i, "]");
2146 return buf;
2147}
2148
2149/**
2150 * tipc_crypto_msg_rcv - Common 'MSG_CRYPTO' processing point
2151 * @net: the struct net
2152 * @skb: the receiving message buffer
2153 */
2154void tipc_crypto_msg_rcv(struct net *net, struct sk_buff *skb)
2155{
2156 struct tipc_crypto *rx;
2157 struct tipc_msg *hdr;
2158
2159 if (unlikely(skb_linearize(skb)))
2160 goto exit;
2161
2162 hdr = buf_msg(skb);
2163 rx = tipc_node_crypto_rx_by_addr(net, msg_prevnode(hdr));
2164 if (unlikely(!rx))
2165 goto exit;
2166
2167 switch (msg_type(hdr)) {
2168 case KEY_DISTR_MSG:
2169 if (tipc_crypto_key_rcv(rx, hdr))
2170 goto exit;
2171 break;
2172 default:
2173 break;
2174 }
2175
2176 tipc_node_put(rx->node);
2177
2178exit:
2179 kfree_skb(skb);
2180}
2181
2182/**
2183 * tipc_crypto_key_distr - Distribute a TX key
2184 * @tx: the TX crypto
2185 * @key: the key's index
2186 * @dest: the destination tipc node, = NULL if distributing to all nodes
2187 *
2188 * Return: 0 in case of success, otherwise < 0
2189 */
2190int tipc_crypto_key_distr(struct tipc_crypto *tx, u8 key,
2191 struct tipc_node *dest)
2192{
2193 struct tipc_aead *aead;
2194 u32 dnode = tipc_node_get_addr(dest);
2195 int rc = -ENOKEY;
2196
2197 if (!sysctl_tipc_key_exchange_enabled)
2198 return 0;
2199
2200 if (key) {
2201 rcu_read_lock();
2202 aead = tipc_aead_get(tx->aead[key]);
2203 if (likely(aead)) {
2204 rc = tipc_crypto_key_xmit(tx->net, aead->key,
2205 aead->gen, aead->mode,
2206 dnode);
2207 tipc_aead_put(aead);
2208 }
2209 rcu_read_unlock();
2210 }
2211
2212 return rc;
2213}
2214
2215/**
2216 * tipc_crypto_key_xmit - Send a session key
2217 * @net: the struct net
2218 * @skey: the session key to be sent
2219 * @gen: the key's generation
2220 * @mode: the key's mode
2221 * @dnode: the destination node address, = 0 if broadcasting to all nodes
2222 *
2223 * The session key 'skey' is packed in a TIPC v2 'MSG_CRYPTO/KEY_DISTR_MSG'
2224 * as its data section, then xmit-ed through the uc/bc link.
2225 *
2226 * Return: 0 in case of success, otherwise < 0
2227 */
2228static int tipc_crypto_key_xmit(struct net *net, struct tipc_aead_key *skey,
2229 u16 gen, u8 mode, u32 dnode)
2230{
2231 struct sk_buff_head pkts;
2232 struct tipc_msg *hdr;
2233 struct sk_buff *skb;
2234 u16 size, cong_link_cnt;
2235 u8 *data;
2236 int rc;
2237
2238 size = tipc_aead_key_size(skey);
2239 skb = tipc_buf_acquire(INT_H_SIZE + size, GFP_ATOMIC);
2240 if (!skb)
2241 return -ENOMEM;
2242
2243 hdr = buf_msg(skb);
2244 tipc_msg_init(tipc_own_addr(net), hdr, MSG_CRYPTO, KEY_DISTR_MSG,
2245 INT_H_SIZE, dnode);
2246 msg_set_size(hdr, INT_H_SIZE + size);
2247 msg_set_key_gen(hdr, gen);
2248 msg_set_key_mode(hdr, mode);
2249
2250 data = msg_data(hdr);
2251 *((__be32 *)(data + TIPC_AEAD_ALG_NAME)) = htonl(skey->keylen);
2252 memcpy(data, skey->alg_name, TIPC_AEAD_ALG_NAME);
2253 memcpy(data + TIPC_AEAD_ALG_NAME + sizeof(__be32), skey->key,
2254 skey->keylen);
2255
2256 __skb_queue_head_init(&pkts);
2257 __skb_queue_tail(&pkts, skb);
2258 if (dnode)
2259 rc = tipc_node_xmit(net, &pkts, dnode, 0);
2260 else
2261 rc = tipc_bcast_xmit(net, &pkts, &cong_link_cnt);
2262
2263 return rc;
2264}
2265
2266/**
2267 * tipc_crypto_key_rcv - Receive a session key
2268 * @rx: the RX crypto
2269 * @hdr: the TIPC v2 message incl. the receiving session key in its data
2270 *
2271 * This function retrieves the session key in the message from peer, then
2272 * schedules a RX work to attach the key to the corresponding RX crypto.
2273 *
2274 * Return: "true" if the key has been scheduled for attaching, otherwise
2275 * "false".
2276 */
2277static bool tipc_crypto_key_rcv(struct tipc_crypto *rx, struct tipc_msg *hdr)
2278{
2279 struct tipc_crypto *tx = tipc_net(rx->net)->crypto_tx;
2280 struct tipc_aead_key *skey = NULL;
2281 u16 key_gen = msg_key_gen(hdr);
2282 u32 size = msg_data_sz(hdr);
2283 u8 *data = msg_data(hdr);
2284 unsigned int keylen;
2285
2286 /* Verify whether the size can exist in the packet */
2287 if (unlikely(size < sizeof(struct tipc_aead_key) + TIPC_AEAD_KEYLEN_MIN)) {
2288 pr_debug("%s: message data size is too small\n", rx->name);
2289 goto exit;
2290 }
2291
2292 keylen = ntohl(*((__be32 *)(data + TIPC_AEAD_ALG_NAME)));
2293
2294 /* Verify the supplied size values */
2295 if (unlikely(keylen > TIPC_AEAD_KEY_SIZE_MAX ||
2296 size != keylen + sizeof(struct tipc_aead_key))) {
2297 pr_debug("%s: invalid MSG_CRYPTO key size\n", rx->name);
2298 goto exit;
2299 }
2300
2301 spin_lock(&rx->lock);
2302 if (unlikely(rx->skey || (key_gen == rx->key_gen && rx->key.keys))) {
2303 pr_err("%s: key existed <%p>, gen %d vs %d\n", rx->name,
2304 rx->skey, key_gen, rx->key_gen);
2305 goto exit_unlock;
2306 }
2307
2308 /* Allocate memory for the key */
2309 skey = kmalloc(size, GFP_ATOMIC);
2310 if (unlikely(!skey)) {
2311 pr_err("%s: unable to allocate memory for skey\n", rx->name);
2312 goto exit_unlock;
2313 }
2314
2315 /* Copy key from msg data */
2316 skey->keylen = keylen;
2317 memcpy(skey->alg_name, data, TIPC_AEAD_ALG_NAME);
2318 memcpy(skey->key, data + TIPC_AEAD_ALG_NAME + sizeof(__be32),
2319 skey->keylen);
2320
2321 rx->key_gen = key_gen;
2322 rx->skey_mode = msg_key_mode(hdr);
2323 rx->skey = skey;
2324 rx->nokey = 0;
2325 mb(); /* for nokey flag */
2326
2327exit_unlock:
2328 spin_unlock(&rx->lock);
2329
2330exit:
2331 /* Schedule the key attaching on this crypto */
2332 if (likely(skey && queue_delayed_work(tx->wq, &rx->work, 0)))
2333 return true;
2334
2335 return false;
2336}
2337
2338/**
2339 * tipc_crypto_work_rx - Scheduled RX works handler
2340 * @work: the struct RX work
2341 *
2342 * The function processes the previous scheduled works i.e. distributing TX key
2343 * or attaching a received session key on RX crypto.
2344 */
2345static void tipc_crypto_work_rx(struct work_struct *work)
2346{
2347 struct delayed_work *dwork = to_delayed_work(work);
2348 struct tipc_crypto *rx = container_of(dwork, struct tipc_crypto, work);
2349 struct tipc_crypto *tx = tipc_net(rx->net)->crypto_tx;
2350 unsigned long delay = msecs_to_jiffies(5000);
2351 bool resched = false;
2352 u8 key;
2353 int rc;
2354
2355 /* Case 1: Distribute TX key to peer if scheduled */
2356 if (atomic_cmpxchg(&rx->key_distr,
2357 KEY_DISTR_SCHED,
2358 KEY_DISTR_COMPL) == KEY_DISTR_SCHED) {
2359 /* Always pick the newest one for distributing */
2360 key = tx->key.pending ?: tx->key.active;
2361 rc = tipc_crypto_key_distr(tx, key, rx->node);
2362 if (unlikely(rc))
2363 pr_warn("%s: unable to distr key[%d] to %s, err %d\n",
2364 tx->name, key, tipc_node_get_id_str(rx->node),
2365 rc);
2366
2367 /* Sched for key_distr releasing */
2368 resched = true;
2369 } else {
2370 atomic_cmpxchg(&rx->key_distr, KEY_DISTR_COMPL, 0);
2371 }
2372
2373 /* Case 2: Attach a pending received session key from peer if any */
2374 if (rx->skey) {
2375 rc = tipc_crypto_key_init(rx, rx->skey, rx->skey_mode, false);
2376 if (unlikely(rc < 0))
2377 pr_warn("%s: unable to attach received skey, err %d\n",
2378 rx->name, rc);
2379 switch (rc) {
2380 case -EBUSY:
2381 case -ENOMEM:
2382 /* Resched the key attaching */
2383 resched = true;
2384 break;
2385 default:
2386 synchronize_rcu();
2387 kfree_sensitive(rx->skey);
2388 rx->skey = NULL;
2389 break;
2390 }
2391 }
2392
2393 if (resched && queue_delayed_work(tx->wq, &rx->work, delay))
2394 return;
2395
2396 tipc_node_put(rx->node);
2397}
2398
2399/**
2400 * tipc_crypto_rekeying_sched - (Re)schedule rekeying w/o new interval
2401 * @tx: TX crypto
2402 * @changed: if the rekeying needs to be rescheduled with new interval
2403 * @new_intv: new rekeying interval (when "changed" = true)
2404 */
2405void tipc_crypto_rekeying_sched(struct tipc_crypto *tx, bool changed,
2406 u32 new_intv)
2407{
2408 unsigned long delay;
2409 bool now = false;
2410
2411 if (changed) {
2412 if (new_intv == TIPC_REKEYING_NOW)
2413 now = true;
2414 else
2415 tx->rekeying_intv = new_intv;
2416 cancel_delayed_work_sync(&tx->work);
2417 }
2418
2419 if (tx->rekeying_intv || now) {
2420 delay = (now) ? 0 : tx->rekeying_intv * 60 * 1000;
2421 queue_delayed_work(tx->wq, &tx->work, msecs_to_jiffies(delay));
2422 }
2423}
2424
2425/**
2426 * tipc_crypto_work_tx - Scheduled TX works handler
2427 * @work: the struct TX work
2428 *
2429 * The function processes the previous scheduled work, i.e. key rekeying, by
2430 * generating a new session key based on current one, then attaching it to the
2431 * TX crypto and finally distributing it to peers. It also re-schedules the
2432 * rekeying if needed.
2433 */
2434static void tipc_crypto_work_tx(struct work_struct *work)
2435{
2436 struct delayed_work *dwork = to_delayed_work(work);
2437 struct tipc_crypto *tx = container_of(dwork, struct tipc_crypto, work);
2438 struct tipc_aead_key *skey = NULL;
2439 struct tipc_key key = tx->key;
2440 struct tipc_aead *aead;
2441 int rc = -ENOMEM;
2442
2443 if (unlikely(key.pending))
2444 goto resched;
2445
2446 /* Take current key as a template */
2447 rcu_read_lock();
2448 aead = rcu_dereference(tx->aead[key.active ?: KEY_MASTER]);
2449 if (unlikely(!aead)) {
2450 rcu_read_unlock();
2451 /* At least one key should exist for securing */
2452 return;
2453 }
2454
2455 /* Lets duplicate it first */
2456 skey = kmemdup(aead->key, tipc_aead_key_size(aead->key), GFP_ATOMIC);
2457 rcu_read_unlock();
2458
2459 /* Now, generate new key, initiate & distribute it */
2460 if (likely(skey)) {
2461 rc = tipc_aead_key_generate(skey) ?:
2462 tipc_crypto_key_init(tx, skey, PER_NODE_KEY, false);
2463 if (likely(rc > 0))
2464 rc = tipc_crypto_key_distr(tx, rc, NULL);
2465 kfree_sensitive(skey);
2466 }
2467
2468 if (unlikely(rc))
2469 pr_warn_ratelimited("%s: rekeying returns %d\n", tx->name, rc);
2470
2471resched:
2472 /* Re-schedule rekeying if any */
2473 tipc_crypto_rekeying_sched(tx, false, 0);
2474}