Skip to content

Commit 17926a7

Browse files
dhowellsdavem330
dhowells
authored and
davem330
committed
[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both
Provide AF_RXRPC sockets that can be used to talk to AFS servers, or serve answers to AFS clients. KerberosIV security is fully supported. The patches and some example test programs can be found in: http://people.redhat.com/~dhowells/rxrpc/ This will eventually replace the old implementation of kernel-only RxRPC currently resident in net/rxrpc/. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent e19dff1 commit 17926a7

31 files changed

+11275
-7
lines changed

‎Documentation/networking/rxrpc.txt

Lines changed: 663 additions & 0 deletions
Large diffs are not rendered by default.

‎include/keys/rxrpc-type.h

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/* RxRPC key type
2+
*
3+
* Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
4+
* Written by David Howells (dhowells@redhat.com)
5+
*
6+
* This program is free software; you can redistribute it and/or
7+
* modify it under the terms of the GNU General Public License
8+
* as published by the Free Software Foundation; either version
9+
* 2 of the License, or (at your option) any later version.
10+
*/
11+
12+
#ifndef _KEYS_RXRPC_TYPE_H
13+
#define _KEYS_RXRPC_TYPE_H
14+
15+
#include <linux/key.h>
16+
17+
/*
18+
* key type for AF_RXRPC keys
19+
*/
20+
extern struct key_type key_type_rxrpc;
21+
22+
#endif /* _KEYS_USER_TYPE_H */

‎include/linux/net.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
struct poll_table_struct;
2525
struct inode;
2626

27-
#define NPROTO 33 /* should be enough for now.. */
27+
#define NPROTO 34 /* should be enough for now.. */
2828

2929
#define SYS_SOCKET 1 /* sys_socket(2) */
3030
#define SYS_BIND 2 /* sys_bind(2) */

‎include/linux/rxrpc.h

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
/* AF_RXRPC parameters
2+
*
3+
* Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
4+
* Written by David Howells (dhowells@redhat.com)
5+
*
6+
* This program is free software; you can redistribute it and/or
7+
* modify it under the terms of the GNU General Public License
8+
* as published by the Free Software Foundation; either version
9+
* 2 of the License, or (at your option) any later version.
10+
*/
11+
12+
#ifndef _LINUX_RXRPC_H
13+
#define _LINUX_RXRPC_H
14+
15+
#include <linux/in.h>
16+
#include <linux/in6.h>
17+
18+
/*
19+
* RxRPC socket address
20+
*/
21+
struct sockaddr_rxrpc {
22+
sa_family_t srx_family; /* address family */
23+
u16 srx_service; /* service desired */
24+
u16 transport_type; /* type of transport socket (SOCK_DGRAM) */
25+
u16 transport_len; /* length of transport address */
26+
union {
27+
sa_family_t family; /* transport address family */
28+
struct sockaddr_in sin; /* IPv4 transport address */
29+
struct sockaddr_in6 sin6; /* IPv6 transport address */
30+
} transport;
31+
};
32+
33+
/*
34+
* RxRPC socket options
35+
*/
36+
#define RXRPC_SECURITY_KEY 1 /* [clnt] set client security key */
37+
#define RXRPC_SECURITY_KEYRING 2 /* [srvr] set ring of server security keys */
38+
#define RXRPC_EXCLUSIVE_CONNECTION 3 /* [clnt] use exclusive RxRPC connection */
39+
#define RXRPC_MIN_SECURITY_LEVEL 4 /* minimum security level */
40+
41+
/*
42+
* RxRPC control messages
43+
* - terminal messages mean that a user call ID tag can be recycled
44+
*/
45+
#define RXRPC_USER_CALL_ID 1 /* user call ID specifier */
46+
#define RXRPC_ABORT 2 /* abort request / notification [terminal] */
47+
#define RXRPC_ACK 3 /* [Server] RPC op final ACK received [terminal] */
48+
#define RXRPC_NET_ERROR 5 /* network error received [terminal] */
49+
#define RXRPC_BUSY 6 /* server busy received [terminal] */
50+
#define RXRPC_LOCAL_ERROR 7 /* local error generated [terminal] */
51+
#define RXRPC_NEW_CALL 8 /* [Server] new incoming call notification */
52+
#define RXRPC_ACCEPT 9 /* [Server] accept request */
53+
54+
/*
55+
* RxRPC security levels
56+
*/
57+
#define RXRPC_SECURITY_PLAIN 0 /* plain secure-checksummed packets only */
58+
#define RXRPC_SECURITY_AUTH 1 /* authenticated packets */
59+
#define RXRPC_SECURITY_ENCRYPT 2 /* encrypted packets */
60+
61+
62+
#endif /* _LINUX_RXRPC_H */

‎include/linux/socket.h

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,8 @@ struct ucred {
188188
#define AF_TIPC 30 /* TIPC sockets */
189189
#define AF_BLUETOOTH 31 /* Bluetooth sockets */
190190
#define AF_IUCV 32 /* IUCV sockets */
191-
#define AF_MAX 33 /* For now.. */
191+
#define AF_RXRPC 33 /* RxRPC sockets */
192+
#define AF_MAX 34 /* For now.. */
192193

193194
/* Protocol families, same as address families. */
194195
#define PF_UNSPEC AF_UNSPEC
@@ -222,6 +223,7 @@ struct ucred {
222223
#define PF_TIPC AF_TIPC
223224
#define PF_BLUETOOTH AF_BLUETOOTH
224225
#define PF_IUCV AF_IUCV
226+
#define PF_RXRPC AF_RXRPC
225227
#define PF_MAX AF_MAX
226228

227229
/* Maximum queue length specifiable by listen. */
@@ -284,6 +286,7 @@ struct ucred {
284286
#define SOL_DCCP 269
285287
#define SOL_NETLINK 270
286288
#define SOL_TIPC 271
289+
#define SOL_RXRPC 272
287290

288291
/* IPX options */
289292
#define IPX_TYPE 1

‎include/net/af_rxrpc.h

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
/* RxRPC definitions
2+
*
3+
* Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
4+
* Written by David Howells (dhowells@redhat.com)
5+
*
6+
* This program is free software; you can redistribute it and/or
7+
* modify it under the terms of the GNU General Public License
8+
* as published by the Free Software Foundation; either version
9+
* 2 of the License, or (at your option) any later version.
10+
*/
11+
12+
#ifndef _NET_RXRPC_H
13+
#define _NET_RXRPC_H
14+
15+
#include <linux/rxrpc.h>
16+
17+
#endif /* _NET_RXRPC_H */

‎include/rxrpc/packet.h

Lines changed: 83 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ struct rxrpc_header
3333
#define RXRPC_MAXCALLS 4 /* max active calls per conn */
3434
#define RXRPC_CHANNELMASK (RXRPC_MAXCALLS-1) /* mask for channel ID */
3535
#define RXRPC_CIDMASK (~RXRPC_CHANNELMASK) /* mask for connection ID */
36-
#define RXRPC_CIDSHIFT 2 /* shift for connection ID */
36+
#define RXRPC_CIDSHIFT ilog2(RXRPC_MAXCALLS) /* shift for connection ID */
37+
#define RXRPC_CID_INC (1 << RXRPC_CIDSHIFT) /* connection ID increment */
3738

3839
__be32 callNumber; /* call ID (0 for connection-level packets) */
3940
#define RXRPC_PROCESS_MAXCALLS (1<<2) /* maximum number of active calls per conn (power of 2) */
@@ -62,7 +63,10 @@ struct rxrpc_header
6263

6364
uint8_t userStatus; /* app-layer defined status */
6465
uint8_t securityIndex; /* security protocol ID */
65-
__be16 _rsvd; /* reserved (used by kerberos security as cksum) */
66+
union {
67+
__be16 _rsvd; /* reserved */
68+
__be16 cksum; /* kerberos security checksum */
69+
};
6670
__be16 serviceId; /* service ID */
6771

6872
} __attribute__((packed));
@@ -124,4 +128,81 @@ struct rxrpc_ackpacket
124128

125129
} __attribute__((packed));
126130

131+
/*
132+
* ACK packets can have a further piece of information tagged on the end
133+
*/
134+
struct rxrpc_ackinfo {
135+
__be32 rxMTU; /* maximum Rx MTU size (bytes) [AFS 3.3] */
136+
__be32 maxMTU; /* maximum interface MTU size (bytes) [AFS 3.3] */
137+
__be32 rwind; /* Rx window size (packets) [AFS 3.4] */
138+
__be32 jumbo_max; /* max packets to stick into a jumbo packet [AFS 3.5] */
139+
};
140+
141+
/*****************************************************************************/
142+
/*
143+
* Kerberos security type-2 challenge packet
144+
*/
145+
struct rxkad_challenge {
146+
__be32 version; /* version of this challenge type */
147+
__be32 nonce; /* encrypted random number */
148+
__be32 min_level; /* minimum security level */
149+
__be32 __padding; /* padding to 8-byte boundary */
150+
} __attribute__((packed));
151+
152+
/*****************************************************************************/
153+
/*
154+
* Kerberos security type-2 response packet
155+
*/
156+
struct rxkad_response {
157+
__be32 version; /* version of this reponse type */
158+
__be32 __pad;
159+
160+
/* encrypted bit of the response */
161+
struct {
162+
__be32 epoch; /* current epoch */
163+
__be32 cid; /* parent connection ID */
164+
__be32 checksum; /* checksum */
165+
__be32 securityIndex; /* security type */
166+
__be32 call_id[4]; /* encrypted call IDs */
167+
__be32 inc_nonce; /* challenge nonce + 1 */
168+
__be32 level; /* desired level */
169+
} encrypted;
170+
171+
__be32 kvno; /* Kerberos key version number */
172+
__be32 ticket_len; /* Kerberos ticket length */
173+
} __attribute__((packed));
174+
175+
/*****************************************************************************/
176+
/*
177+
* RxRPC-level abort codes
178+
*/
179+
#define RX_CALL_DEAD -1 /* call/conn has been inactive and is shut down */
180+
#define RX_INVALID_OPERATION -2 /* invalid operation requested / attempted */
181+
#define RX_CALL_TIMEOUT -3 /* call timeout exceeded */
182+
#define RX_EOF -4 /* unexpected end of data on read op */
183+
#define RX_PROTOCOL_ERROR -5 /* low-level protocol error */
184+
#define RX_USER_ABORT -6 /* generic user abort */
185+
#define RX_ADDRINUSE -7 /* UDP port in use */
186+
#define RX_DEBUGI_BADTYPE -8 /* bad debugging packet type */
187+
188+
/*
189+
* Rx kerberos security abort codes
190+
* - unfortunately we have no generalised security abort codes to say things
191+
* like "unsupported security", so we have to use these instead and hope the
192+
* other side understands
193+
*/
194+
#define RXKADINCONSISTENCY 19270400 /* security module structure inconsistent */
195+
#define RXKADPACKETSHORT 19270401 /* packet too short for security challenge */
196+
#define RXKADLEVELFAIL 19270402 /* security level negotiation failed */
197+
#define RXKADTICKETLEN 19270403 /* ticket length too short or too long */
198+
#define RXKADOUTOFSEQUENCE 19270404 /* packet had bad sequence number */
199+
#define RXKADNOAUTH 19270405 /* caller not authorised */
200+
#define RXKADBADKEY 19270406 /* illegal key: bad parity or weak */
201+
#define RXKADBADTICKET 19270407 /* security object was passed a bad ticket */
202+
#define RXKADUNKNOWNKEY 19270408 /* ticket contained unknown key version number */
203+
#define RXKADEXPIRED 19270409 /* authentication expired */
204+
#define RXKADSEALEDINCON 19270410 /* sealed data inconsistent */
205+
#define RXKADDATALEN 19270411 /* user data too long */
206+
#define RXKADILLEGALLEVEL 19270412 /* caller not authorised to use encrypted conns */
207+
127208
#endif /* _LINUX_RXRPC_PACKET_H */

‎net/Kconfig

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,7 @@ endmenu
212212
source "net/ax25/Kconfig"
213213
source "net/irda/Kconfig"
214214
source "net/bluetooth/Kconfig"
215+
source "net/rxrpc/Kconfig"
215216

216217
config FIB_RULES
217218
bool

‎net/Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ obj-$(CONFIG_IRDA) += irda/
3838
obj-$(CONFIG_BT) += bluetooth/
3939
obj-$(CONFIG_SUNRPC) += sunrpc/
4040
obj-$(CONFIG_RXRPC) += rxrpc/
41+
obj-$(CONFIG_AF_RXRPC) += rxrpc/
4142
obj-$(CONFIG_ATM) += atm/
4243
obj-$(CONFIG_DECNET) += decnet/
4344
obj-$(CONFIG_ECONET) += econet/

‎net/core/sock.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,8 @@ static const char *af_family_key_strings[AF_MAX+1] = {
154154
"sk_lock-21" , "sk_lock-AF_SNA" , "sk_lock-AF_IRDA" ,
155155
"sk_lock-AF_PPPOX" , "sk_lock-AF_WANPIPE" , "sk_lock-AF_LLC" ,
156156
"sk_lock-27" , "sk_lock-28" , "sk_lock-29" ,
157-
"sk_lock-AF_TIPC" , "sk_lock-AF_BLUETOOTH", "sk_lock-AF_MAX"
157+
"sk_lock-AF_TIPC" , "sk_lock-AF_BLUETOOTH", "sk_lock-IUCV" ,
158+
"sk_lock-AF_RXRPC" , "sk_lock-AF_MAX"
158159
};
159160
static const char *af_family_slock_key_strings[AF_MAX+1] = {
160161
"slock-AF_UNSPEC", "slock-AF_UNIX" , "slock-AF_INET" ,
@@ -167,7 +168,8 @@ static const char *af_family_slock_key_strings[AF_MAX+1] = {
167168
"slock-21" , "slock-AF_SNA" , "slock-AF_IRDA" ,
168169
"slock-AF_PPPOX" , "slock-AF_WANPIPE" , "slock-AF_LLC" ,
169170
"slock-27" , "slock-28" , "slock-29" ,
170-
"slock-AF_TIPC" , "slock-AF_BLUETOOTH", "slock-AF_MAX"
171+
"slock-AF_TIPC" , "slock-AF_BLUETOOTH", "slock-AF_IUCV" ,
172+
"slock-AF_RXRPC" , "slock-AF_MAX"
171173
};
172174
#endif
173175

‎net/rxrpc/Kconfig

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#
2+
# RxRPC session sockets
3+
#
4+
5+
config AF_RXRPC
6+
tristate "RxRPC session sockets"
7+
depends on EXPERIMENTAL
8+
help
9+
Say Y or M here to include support for RxRPC session sockets (just
10+
the transport part, not the presentation part: (un)marshalling is
11+
left to the application).
12+
13+
These are used for AFS kernel filesystem and userspace utilities.
14+
15+
This module at the moment only supports client operations and is
16+
currently incomplete.
17+
18+
See Documentation/networking/rxrpc.txt.
19+
20+
21+
config AF_RXRPC_DEBUG
22+
bool "RxRPC dynamic debugging"
23+
depends on AF_RXRPC
24+
help
25+
Say Y here to make runtime controllable debugging messages appear.
26+
27+
See Documentation/networking/rxrpc.txt.
28+
29+
30+
config RXKAD
31+
tristate "RxRPC Kerberos security"
32+
depends on AF_RXRPC && KEYS
33+
help
34+
Provide kerberos 4 and AFS kaserver security handling for AF_RXRPC
35+
through the use of the key retention service.
36+
37+
See Documentation/networking/rxrpc.txt.

‎net/rxrpc/Makefile

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,35 @@
44

55
#CFLAGS += -finstrument-functions
66

7+
af-rxrpc-objs := \
8+
af_rxrpc.o \
9+
ar-accept.o \
10+
ar-ack.o \
11+
ar-call.o \
12+
ar-connection.o \
13+
ar-connevent.o \
14+
ar-error.o \
15+
ar-input.o \
16+
ar-key.o \
17+
ar-local.o \
18+
ar-output.o \
19+
ar-peer.o \
20+
ar-recvmsg.o \
21+
ar-security.o \
22+
ar-skbuff.o \
23+
ar-transport.o
24+
25+
ifeq ($(CONFIG_PROC_FS),y)
26+
af-rxrpc-objs += ar-proc.o
27+
endif
28+
29+
obj-$(CONFIG_AF_RXRPC) += af-rxrpc.o
30+
31+
obj-$(CONFIG_RXKAD) += rxkad.o
32+
33+
#
34+
# obsolete RxRPC interface, still used by fs/afs/
35+
#
736
rxrpc-objs := \
837
call.o \
938
connection.o \
@@ -22,4 +51,4 @@ ifeq ($(CONFIG_SYSCTL),y)
2251
rxrpc-objs += sysctl.o
2352
endif
2453

25-
obj-$(CONFIG_RXRPC) := rxrpc.o
54+
obj-$(CONFIG_RXRPC) += rxrpc.o

0 commit comments

Comments
 (0)