rxrpc: Support keys with multiple authentication tokens

rxrpc-type keys can have multiple tokens attached for different security
classes.  Currently, rxrpc always picks the first one, whether or not the
security class it indicates is supported.

Add preliminary support for choosing which security class will be used
(this will need to be directed from a higher layer) and go through the
tokens to find one that's supported.

Signed-off-by: David Howells <dhowells@redhat.com>

diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index dce4816..3c417ec 100644 (file)
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -12,6 +12,7 @@
 #include <net/netns/generic.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
+#include <keys/rxrpc-type.h>
 #include "protocol.h"
 
 #if 0
@@ -217,7 +218,8 @@ struct rxrpc_security {
        void (*exit)(void);
 
        /* initialise a connection's security */
-       int (*init_connection_security)(struct rxrpc_connection *);
+       int (*init_connection_security)(struct rxrpc_connection *,
+                                       struct rxrpc_key_token *);
 
        /* prime a connection's packet security */
        int (*prime_packet_security)(struct rxrpc_connection *);

diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index aff1841..bbf8620 100644 (file)
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -333,7 +333,8 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
                if (ret < 0)
                        return ret;
 
-               ret = conn->security->init_connection_security(conn);
+               ret = conn->security->init_connection_security(
+                       conn, conn->params.key->payload.data[0]);
                if (ret < 0)
                        return ret;
 

diff --git a/net/rxrpc/insecure.c b/net/rxrpc/insecure.c
index f6c59f5..cf3ecff 100644 (file)
--- a/net/rxrpc/insecure.c
+++ b/net/rxrpc/insecure.c
@@ -8,7 +8,8 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
 
-static int none_init_connection_security(struct rxrpc_connection *conn)
+static int none_init_connection_security(struct rxrpc_connection *conn,
+                                        struct rxrpc_key_token *token)
 {
        return 0;
 }

diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index f114dc2..404d132 100644 (file)
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -49,15 +49,14 @@ static DEFINE_MUTEX(rxkad_ci_mutex);
 /*
  * initialise connection security
  */
-static int rxkad_init_connection_security(struct rxrpc_connection *conn)
+static int rxkad_init_connection_security(struct rxrpc_connection *conn,
+                                         struct rxrpc_key_token *token)
 {
        struct crypto_sync_skcipher *ci;
-       struct rxrpc_key_token *token;
        int ret;
 
        _enter("{%d},{%x}", conn->debug_id, key_serial(conn->params.key));
 
-       token = conn->params.key->payload.data[0];
        conn->security_ix = token->security_index;
 
        ci = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);

diff --git a/net/rxrpc/security.c b/net/rxrpc/security.c
index 9b1fb9e..0c5168f 100644 (file)
--- a/net/rxrpc/security.c
+++ b/net/rxrpc/security.c
@@ -81,16 +81,17 @@ int rxrpc_init_client_conn_security(struct rxrpc_connection *conn)
        if (ret < 0)
                return ret;
 
-       token = key->payload.data[0];
-       if (!token)
-               return -EKEYREJECTED;
+       for (token = key->payload.data[0]; token; token = token->next) {
+               sec = rxrpc_security_lookup(token->security_index);
+               if (sec)
+                       goto found;
+       }
+       return -EKEYREJECTED;
 
-       sec = rxrpc_security_lookup(token->security_index);
-       if (!sec)
-               return -EKEYREJECTED;
+found:
        conn->security = sec;
 
-       ret = conn->security->init_connection_security(conn);
+       ret = conn->security->init_connection_security(conn, token);
        if (ret < 0) {
                conn->security = &rxrpc_no_security;
                return ret;