rxrpc: Support keys with multiple authentication tokens

rxrpc-type keys can have multiple tokens attached for different security
classes.  Currently, rxrpc always picks the first one, whether or not the
security class it indicates is supported.

Add preliminary support for choosing which security class will be used
(this will need to be directed from a higher layer) and go through the
tokens to find one that's supported.

Signed-off-by: David Howells <dhowells@redhat.com>

diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index dce48162f6c274116f25ff6fa04b54dd7835f372..3c417ec94e4c9fb5e91065f921a11045b452381c 100644 (file)
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -12,6 +12,7 @@
 #include <net/netns/generic.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
+#include <keys/rxrpc-type.h>
 #include "protocol.h"
 
 #if 0
@@ -217,7 +218,8 @@ struct rxrpc_security {
        void (*exit)(void);
 
        /* initialise a connection's security */
-       int (*init_connection_security)(struct rxrpc_connection *);
+       int (*init_connection_security)(struct rxrpc_connection *,
+                                       struct rxrpc_key_token *);
 
        /* prime a connection's packet security */
        int (*prime_packet_security)(struct rxrpc_connection *);

diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index aff184145ffafb28c6c0c118f39ce60dd06a8ec2..bbf86203ed257abbf6ec83e702b3f1f790e4046b 100644 (file)
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -333,7 +333,8 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
                if (ret < 0)
                        return ret;
 
-               ret = conn->security->init_connection_security(conn);
+               ret = conn->security->init_connection_security(
+                       conn, conn->params.key->payload.data[0]);
                if (ret < 0)
                        return ret;
 

diff --git a/net/rxrpc/insecure.c b/net/rxrpc/insecure.c
index f6c59f5fae9d2d6a1e48bdd6605e2f5e2c003ab4..cf3ecffcf4240a217fbc8718bec6a1d11b5ce5e6 100644 (file)
--- a/net/rxrpc/insecure.c
+++ b/net/rxrpc/insecure.c
@@ -8,7 +8,8 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
 
-static int none_init_connection_security(struct rxrpc_connection *conn)
+static int none_init_connection_security(struct rxrpc_connection *conn,
+                                        struct rxrpc_key_token *token)
 {
        return 0;
 }

diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index f114dc2af5cf3a663d5a7e497961e402618c8425..404d1323c23988bd45c50bde3e5888a38a90015c 100644 (file)
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -49,15 +49,14 @@ static DEFINE_MUTEX(rxkad_ci_mutex);
 /*
  * initialise connection security
  */
-static int rxkad_init_connection_security(struct rxrpc_connection *conn)
+static int rxkad_init_connection_security(struct rxrpc_connection *conn,
+                                         struct rxrpc_key_token *token)
 {
        struct crypto_sync_skcipher *ci;
-       struct rxrpc_key_token *token;
        int ret;
 
        _enter("{%d},{%x}", conn->debug_id, key_serial(conn->params.key));
 
-       token = conn->params.key->payload.data[0];
        conn->security_ix = token->security_index;
 
        ci = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);

diff --git a/net/rxrpc/security.c b/net/rxrpc/security.c
index 9b1fb9ed07177215aa533666d9af0fbc8bda791e..0c5168f52bd6c08728520dc4b9ddedc658849be8 100644 (file)
--- a/net/rxrpc/security.c
+++ b/net/rxrpc/security.c
@@ -81,16 +81,17 @@ int rxrpc_init_client_conn_security(struct rxrpc_connection *conn)
        if (ret < 0)
                return ret;
 
-       token = key->payload.data[0];
-       if (!token)
-               return -EKEYREJECTED;
+       for (token = key->payload.data[0]; token; token = token->next) {
+               sec = rxrpc_security_lookup(token->security_index);
+               if (sec)
+                       goto found;
+       }
+       return -EKEYREJECTED;
 
-       sec = rxrpc_security_lookup(token->security_index);
-       if (!sec)
-               return -EKEYREJECTED;
+found:
        conn->security = sec;
 
-       ret = conn->security->init_connection_security(conn);
+       ret = conn->security->init_connection_security(conn, token);
        if (ret < 0) {
                conn->security = &rxrpc_no_security;
                return ret;