From: David Howells <dhowells@redhat.com>
To: netdev@vger.kernel.org
Cc: dhowells@redhat.com, linux-afs@lists.infradead.org,
linux-kernel@vger.kernel.org
Subject: [PATCH net-next 18/23] rxrpc: Don't reserve security header in Tx DATA skbuff
Date: Thu, 01 Oct 2020 15:58:48 +0100 [thread overview]
Message-ID: <160156432811.1728886.13296622825563470512.stgit@warthog.procyon.org.uk> (raw)
In-Reply-To: <160156420377.1728886.5309670328610130816.stgit@warthog.procyon.org.uk>
Insert the security header into the skbuff representing a DATA packet to be
transmitted rather than using skb_reserve() when the packet is allocated.
This makes it easier to apply crypto that spans the security header and the
data, particularly in the upcoming RxGK class where we have a common
encrypt-and-checksum function that is used in a number of circumstances.
Signed-off-by: David Howells <dhowells@redhat.com>
---
net/rxrpc/ar-internal.h | 5 +----
net/rxrpc/insecure.c | 6 ++----
net/rxrpc/rxkad.c | 24 +++++++++---------------
net/rxrpc/sendmsg.c | 6 ++----
4 files changed, 14 insertions(+), 27 deletions(-)
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 047587ffe7bb..f314b7a33d37 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -233,10 +233,7 @@ struct rxrpc_security {
/* impose security on a packet */
- int (*secure_packet)(struct rxrpc_call *,
- struct sk_buff *,
- size_t,
- void *);
+ int (*secure_packet)(struct rxrpc_call *, struct sk_buff *, size_t);
/* verify the security on a received packet */
int (*verify_packet)(struct rxrpc_call *, struct sk_buff *,
diff --git a/net/rxrpc/insecure.c b/net/rxrpc/insecure.c
index 914e2f2e2990..e06725e21c05 100644
--- a/net/rxrpc/insecure.c
+++ b/net/rxrpc/insecure.c
@@ -14,10 +14,8 @@ static int none_init_connection_security(struct rxrpc_connection *conn,
return 0;
}
-static int none_secure_packet(struct rxrpc_call *call,
- struct sk_buff *skb,
- size_t data_size,
- void *sechdr)
+static int none_secure_packet(struct rxrpc_call *call, struct sk_buff *skb,
+ size_t data_size)
{
return 0;
}
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 301894857473..37335d887570 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -230,9 +230,7 @@ static void rxkad_free_call_crypto(struct rxrpc_call *call)
* partially encrypt a packet (level 1 security)
*/
static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
- struct sk_buff *skb,
- u32 data_size,
- void *sechdr,
+ struct sk_buff *skb, u32 data_size,
struct skcipher_request *req)
{
struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
@@ -247,12 +245,12 @@ static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
data_size |= (u32)check << 16;
hdr.data_size = htonl(data_size);
- memcpy(sechdr, &hdr, sizeof(hdr));
+ memcpy(skb->head, &hdr, sizeof(hdr));
/* start the encryption afresh */
memset(&iv, 0, sizeof(iv));
- sg_init_one(&sg, sechdr, 8);
+ sg_init_one(&sg, skb->head, 8);
skcipher_request_set_sync_tfm(req, call->conn->cipher);
skcipher_request_set_callback(req, 0, NULL, NULL);
skcipher_request_set_crypt(req, &sg, &sg, 8, iv.x);
@@ -269,7 +267,6 @@ static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
struct sk_buff *skb,
u32 data_size,
- void *sechdr,
struct skcipher_request *req)
{
const struct rxrpc_key_token *token;
@@ -289,13 +286,13 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
rxkhdr.data_size = htonl(data_size | (u32)check << 16);
rxkhdr.checksum = 0;
- memcpy(sechdr, &rxkhdr, sizeof(rxkhdr));
+ memcpy(skb->head, &rxkhdr, sizeof(rxkhdr));
/* encrypt from the session key */
token = call->conn->params.key->payload.data[0];
memcpy(&iv, token->kad->session_key, sizeof(iv));
- sg_init_one(&sg[0], sechdr, sizeof(rxkhdr));
+ sg_init_one(&sg[0], skb->head, sizeof(rxkhdr));
skcipher_request_set_sync_tfm(req, call->conn->cipher);
skcipher_request_set_callback(req, 0, NULL, NULL);
skcipher_request_set_crypt(req, &sg[0], &sg[0], sizeof(rxkhdr), iv.x);
@@ -310,7 +307,7 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
len &= ~(call->conn->size_align - 1);
sg_init_table(sg, ARRAY_SIZE(sg));
- err = skb_to_sgvec(skb, sg, 0, len);
+ err = skb_to_sgvec(skb, sg, 8, len);
if (unlikely(err < 0))
goto out;
skcipher_request_set_crypt(req, sg, sg, len, iv.x);
@@ -329,8 +326,7 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
*/
static int rxkad_secure_packet(struct rxrpc_call *call,
struct sk_buff *skb,
- size_t data_size,
- void *sechdr)
+ size_t data_size)
{
struct rxrpc_skb_priv *sp;
struct skcipher_request *req;
@@ -383,12 +379,10 @@ static int rxkad_secure_packet(struct rxrpc_call *call,
ret = 0;
break;
case RXRPC_SECURITY_AUTH:
- ret = rxkad_secure_packet_auth(call, skb, data_size, sechdr,
- req);
+ ret = rxkad_secure_packet_auth(call, skb, data_size, req);
break;
case RXRPC_SECURITY_ENCRYPT:
- ret = rxkad_secure_packet_encrypt(call, skb, data_size,
- sechdr, req);
+ ret = rxkad_secure_packet_encrypt(call, skb, data_size, req);
break;
default:
ret = -EPERM;
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 258224bb1227..d4d57e2666b8 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -376,8 +376,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
ASSERTCMP(skb->mark, ==, 0);
_debug("HS: %u", call->conn->security_size);
- skb_reserve(skb, call->conn->security_size);
- skb->len += call->conn->security_size;
+ __skb_put(skb, call->conn->security_size);
sp->remain = chunk;
if (sp->remain > skb_tailroom(skb))
@@ -450,8 +449,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
call->tx_winsize)
sp->hdr.flags |= RXRPC_MORE_PACKETS;
- ret = call->security->secure_packet(
- call, skb, skb->mark, skb->head);
+ ret = call->security->secure_packet(call, skb, skb->mark);
if (ret < 0)
goto out;
next prev parent reply other threads:[~2020-10-01 14:59 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-01 14:56 [PATCH net-next 00/23] rxrpc: Fixes and preparation for RxGK David Howells
2020-10-01 14:56 ` [PATCH net-next 01/23] keys: Provide the original description to the key preparser David Howells
2020-10-01 14:56 ` [PATCH net-next 02/23] rxrpc: Fix bundle counting for exclusive connections David Howells
2020-10-01 14:57 ` [PATCH net-next 03/23] rxrpc: Fix rxkad token xdr encoding David Howells
2020-10-01 14:57 ` [PATCH net-next 04/23] rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read() David Howells
2020-10-01 14:57 ` [PATCH net-next 05/23] rxrpc: Fix some missing _bh annotations on locking conn->state_lock David Howells
2020-10-01 14:57 ` [PATCH net-next 06/23] rxrpc: Fix loss of final ack on shutdown David Howells
2020-10-01 14:57 ` [PATCH net-next 07/23] rxrpc: Fix accept on a connection that need securing David Howells
2020-10-01 14:57 ` [PATCH net-next 08/23] rxrpc: The server keyring isn't network-namespaced David Howells
2020-10-01 14:57 ` [PATCH net-next 09/23] rxrpc: Change basic data packet size alignment to 1 David Howells
2020-10-01 14:57 ` [PATCH net-next 10/23] rxrpc: Remove the rxk5 security class as it's now defunct David Howells
2020-10-01 14:57 ` [PATCH net-next 11/23] rxrpc: List the held token types in the key description in /proc/keys David Howells
2020-10-01 14:58 ` [PATCH net-next 12/23] rxrpc: Allow for a security trailer in a packet David Howells
2020-10-01 14:58 ` [PATCH net-next 13/23] rxrpc: Merge prime_packet_security into init_connection_security David Howells
2020-10-01 14:58 ` [PATCH net-next 14/23] rxrpc: Support keys with multiple authentication tokens David Howells
2020-10-01 14:58 ` [PATCH net-next 15/23] rxrpc: Don't retain the server key in the connection David Howells
2020-10-01 14:58 ` [PATCH net-next 16/23] rxrpc: Split the server key type (rxrpc_s) into its own file David Howells
2020-10-01 14:58 ` [PATCH net-next 17/23] rxrpc: Hand server key parsing off to the security class David Howells
2020-10-01 14:58 ` David Howells [this message]
2020-10-01 14:58 ` [PATCH net-next 19/23] rxrpc: Organise connection security to use a union David Howells
2020-10-01 14:59 ` [PATCH net-next 20/23] rxrpc: Don't leak the service-side session key to userspace David Howells
2020-10-01 14:59 ` [PATCH net-next 21/23] rxrpc: Allow security classes to give more info on server keys David Howells
2020-10-01 14:59 ` [PATCH net-next 22/23] rxrpc: Make the parsing of xdr payloads more coherent David Howells
2020-10-01 14:59 ` [PATCH net-next 23/23] rxrpc: rxkad: Don't use pskb_pull() to advance through the response packet David Howells
2020-10-02 23:03 ` [PATCH net-next 00/23] rxrpc: Fixes and preparation for RxGK David Miller
2020-10-03 20:01 ` David Howells
2020-10-03 21:17 ` David Miller
2020-10-03 21:24 ` David Howells
2020-10-03 21:32 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=160156432811.1728886.13296622825563470512.stgit@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=linux-afs@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).