lustre/ptlrpc/gss/gss_bulk.c

   1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
   2  * vim:expandtab:shiftwidth=8:tabstop=8:
   3  *
   4  * Copyright (C) 2006 Cluster File Systems, Inc.
   5  *   Author: Eric Mei <ericm@clusterfs.com>
   6  *
   7  *   This file is part of Lustre, http://www.lustre.org.
   8  *
   9  *   Lustre is free software; you can redistribute it and/or
  10  *   modify it under the terms of version 2 of the GNU General Public
  11  *   License as published by the Free Software Foundation.
  12  *
  13  *   Lustre is distributed in the hope that it will be useful,
  14  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *   GNU General Public License for more details.
  17  *
  18  *   You should have received a copy of the GNU General Public License
  19  *   along with Lustre; if not, write to the Free Software
  20  *   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21  */
  22
  23 #ifndef EXPORT_SYMTAB
  24 # define EXPORT_SYMTAB
  25 #endif
  26 #define DEBUG_SUBSYSTEM S_SEC
  27 #ifdef __KERNEL__
  28 #include <linux/init.h>
  29 #include <linux/module.h>
  30 #include <linux/slab.h>
  31 #include <linux/dcache.h>
  32 #include <linux/fs.h>
  33 #include <linux/random.h>
  34 #include <linux/mutex.h>
  35 #include <linux/crypto.h>
  36 #else
  37 #include <liblustre.h>
  38 #endif
  39
  40 #include <obd.h>
  41 #include <obd_class.h>
  42 #include <obd_support.h>
  43 #include <lustre/lustre_idl.h>
  44 #include <lustre_net.h>
  45 #include <lustre_import.h>
  46 #include <lustre_sec.h>
  47
  48 #include "gss_err.h"
  49 #include "gss_internal.h"
  50 #include "gss_api.h"
  51
  52 static
  53 int do_bulk_privacy(struct gss_ctx *gctx,
  54                     struct ptlrpc_bulk_desc *desc,
  55                     int encrypt, __u32 alg,
  56                     struct ptlrpc_bulk_sec_desc *bsd)
  57 {
  58         struct crypto_tfm  *tfm;
  59         struct scatterlist  sg, sg2, *sgd;
  60         int                 i, rc;
  61         __u8                local_iv[sizeof(bsd->bsd_iv)];
  62
  63         LASSERT(alg < BULK_PRIV_ALG_MAX);
  64
  65         if (encrypt)
  66                 bsd->bsd_priv_alg = BULK_PRIV_ALG_NULL;
  67
  68         if (alg == BULK_PRIV_ALG_NULL)
  69                 return 0;
  70
  71         if (encrypt)
  72                 get_random_bytes(bsd->bsd_iv, sizeof(bsd->bsd_iv));
  73
  74         /* compute the secret iv */
  75         lgss_plain_encrypt(gctx, sizeof(local_iv), bsd->bsd_iv, local_iv);
  76
  77         tfm = crypto_alloc_tfm(sptlrpc_bulk_priv_alg2name(alg),
  78                                sptlrpc_bulk_priv_alg2flags(alg));
  79         if (tfm == NULL) {
  80                 CERROR("Failed to allocate TFM %s\n",
  81                        sptlrpc_bulk_priv_alg2name(alg));
  82                 return -ENOMEM;
  83         }
  84
  85         rc = crypto_cipher_setkey(tfm, local_iv, sizeof(local_iv));
  86         if (rc) {
  87                 CERROR("Failed to set key for TFM %s: %d\n",
  88                        sptlrpc_bulk_priv_alg2name(alg), rc);
  89                 crypto_free_tfm(tfm);
  90                 return rc;
  91         }
  92
  93         for (i = 0; i < desc->bd_iov_count; i++) {
  94                 sg.page = desc->bd_iov[i].kiov_page;
  95                 sg.offset = desc->bd_iov[i].kiov_offset;
  96                 sg.length = desc->bd_iov[i].kiov_len;
  97
  98                 if (desc->bd_enc_pages) {
  99                         sg2.page = desc->bd_enc_pages[i];
 100                         sg2.offset = desc->bd_iov[i].kiov_offset;
 101                         sg2.length = desc->bd_iov[i].kiov_len;
 102
 103                         sgd = &sg2;
 104                 } else
 105                         sgd = &sg;
 106
 107                 if (encrypt)
 108                         rc = crypto_cipher_encrypt(tfm, sgd, &sg, sg.length);
 109                 else
 110                         rc = crypto_cipher_decrypt(tfm, sgd, &sg, sg.length);
 111
 112                 LASSERT(rc == 0);
 113
 114                 if (desc->bd_enc_pages)
 115                         desc->bd_iov[i].kiov_page = desc->bd_enc_pages[i];
 116
 117                 /* although the procedure might be lengthy, the crypto functions
 118                  * internally called cond_resched() from time to time.
 119                  */
 120         }
 121
 122         crypto_free_tfm(tfm);
 123
 124         if (encrypt)
 125                 bsd->bsd_priv_alg = alg;
 126
 127         return 0;
 128 }
 129
 130 int gss_cli_ctx_wrap_bulk(struct ptlrpc_cli_ctx *ctx,
 131                           struct ptlrpc_request *req,
 132                           struct ptlrpc_bulk_desc *desc)
 133 {
 134         struct gss_cli_ctx              *gctx;
 135         struct lustre_msg               *msg;
 136         struct ptlrpc_bulk_sec_desc     *bsdr;
 137         struct sec_flavor_config        *conf;
 138         int                              offset, rc;
 139         ENTRY;
 140
 141         LASSERT(SEC_FLAVOR_HAS_BULK(req->rq_sec_flavor));
 142         LASSERT(req->rq_bulk_read || req->rq_bulk_write);
 143
 144         switch (SEC_FLAVOR_SVC(req->rq_sec_flavor)) {
 145         case SPTLRPC_SVC_NULL:
 146                 LASSERT(req->rq_reqbuf->lm_bufcount >= 3);
 147                 msg = req->rq_reqbuf;
 148                 offset = msg->lm_bufcount - 1;
 149                 break;
 150         case SPTLRPC_SVC_AUTH:
 151         case SPTLRPC_SVC_INTG:
 152                 LASSERT(req->rq_reqbuf->lm_bufcount >= 4);
 153                 msg = req->rq_reqbuf;
 154                 offset = msg->lm_bufcount - 2;
 155                 break;
 156         case SPTLRPC_SVC_PRIV:
 157                 LASSERT(req->rq_clrbuf->lm_bufcount >= 2);
 158                 msg = req->rq_clrbuf;
 159                 offset = msg->lm_bufcount - 1;
 160                 break;
 161         default:
 162                 LBUG();
 163         }
 164
 165         /* make checksum */
 166         conf = &req->rq_import->imp_obd->u.cli.cl_sec_conf;
 167         rc = bulk_csum_cli_request(desc, req->rq_bulk_read, conf->sfc_bulk_csum,
 168                                    msg, offset);
 169         if (rc) {
 170                 CERROR("client bulk %s: failed to generate checksum: %d\n",
 171                        req->rq_bulk_read ? "read" : "write", rc);
 172                 RETURN(rc);
 173         }
 174
 175         if (conf->sfc_bulk_priv == BULK_PRIV_ALG_NULL)
 176                 RETURN(0);
 177
 178         /* previous bulk_csum_cli_request() has verified bsdr is good */
 179         bsdr = lustre_msg_buf(msg, offset, 0);
 180
 181         if (req->rq_bulk_read) {
 182                 bsdr->bsd_priv_alg = conf->sfc_bulk_priv;
 183                 RETURN(0);
 184         }
 185
 186         /* it turn out to be bulk write */
 187         rc = sptlrpc_enc_pool_get_pages(desc);
 188         if (rc) {
 189                 CERROR("bulk write: failed to allocate encryption pages\n");
 190                 RETURN(rc);
 191         }
 192
 193         gctx = container_of(ctx, struct gss_cli_ctx, gc_base);
 194         LASSERT(gctx->gc_mechctx);
 195
 196         rc = do_bulk_privacy(gctx->gc_mechctx, desc, 1,
 197                              conf->sfc_bulk_priv, bsdr);
 198         if (rc)
 199                 CERROR("bulk write: client failed to encrypt pages\n");
 200
 201         RETURN(rc);
 202 }
 203
 204 int gss_cli_ctx_unwrap_bulk(struct ptlrpc_cli_ctx *ctx,
 205                             struct ptlrpc_request *req,
 206                             struct ptlrpc_bulk_desc *desc)
 207 {
 208         struct gss_cli_ctx              *gctx;
 209         struct lustre_msg               *rmsg, *vmsg;
 210         struct ptlrpc_bulk_sec_desc     *bsdr, *bsdv;
 211         int                              roff, voff, rc;
 212         ENTRY;
 213
 214         LASSERT(SEC_FLAVOR_HAS_BULK(req->rq_sec_flavor));
 215         LASSERT(req->rq_bulk_read || req->rq_bulk_write);
 216
 217         switch (SEC_FLAVOR_SVC(req->rq_sec_flavor)) {
 218         case SPTLRPC_SVC_NULL:
 219                 vmsg = req->rq_repbuf;
 220                 voff = vmsg->lm_bufcount - 1;
 221                 LASSERT(vmsg && vmsg->lm_bufcount >= 3);
 222
 223                 rmsg = req->rq_reqbuf;
 224                 roff = rmsg->lm_bufcount - 1; /* last segment */
 225                 LASSERT(rmsg && rmsg->lm_bufcount >= 3);
 226                 break;
 227         case SPTLRPC_SVC_AUTH:
 228         case SPTLRPC_SVC_INTG:
 229                 vmsg = req->rq_repbuf;
 230                 voff = vmsg->lm_bufcount - 2;
 231                 LASSERT(vmsg && vmsg->lm_bufcount >= 4);
 232
 233                 rmsg = req->rq_reqbuf;
 234                 roff = rmsg->lm_bufcount - 2; /* second last segment */
 235                 LASSERT(rmsg && rmsg->lm_bufcount >= 4);
 236                 break;
 237         case SPTLRPC_SVC_PRIV:
 238                 vmsg = req->rq_repbuf;
 239                 voff = vmsg->lm_bufcount - 1;
 240                 LASSERT(vmsg && vmsg->lm_bufcount >= 2);
 241
 242                 rmsg = req->rq_clrbuf;
 243                 roff = rmsg->lm_bufcount - 1; /* last segment */
 244                 LASSERT(rmsg && rmsg->lm_bufcount >= 2);
 245                 break;
 246         default:
 247                 LBUG();
 248         }
 249
 250         if (req->rq_bulk_read) {
 251                 bsdr = lustre_msg_buf(rmsg, roff, 0);
 252                 if (bsdr->bsd_priv_alg == BULK_PRIV_ALG_NULL)
 253                         goto verify_csum;
 254
 255                 bsdv = lustre_msg_buf(vmsg, voff, 0);
 256                 if (bsdr->bsd_priv_alg != bsdv->bsd_priv_alg) {
 257                         CERROR("bulk read: cipher algorithm mismatch: client "
 258                                "request %s but server reply with %s. try to "
 259                                "use the new one for decryption\n",
 260                                sptlrpc_bulk_priv_alg2name(bsdr->bsd_priv_alg),
 261                                sptlrpc_bulk_priv_alg2name(bsdv->bsd_priv_alg));
 262                 }
 263
 264                 gctx = container_of(ctx, struct gss_cli_ctx, gc_base);
 265                 LASSERT(gctx->gc_mechctx);
 266
 267                 rc = do_bulk_privacy(gctx->gc_mechctx, desc, 0,
 268                                      bsdv->bsd_priv_alg, bsdv);
 269                 if (rc) {
 270                         CERROR("bulk read: client failed to decrypt data\n");
 271                         RETURN(rc);
 272                 }
 273         }
 274
 275 verify_csum:
 276         rc = bulk_csum_cli_reply(desc, req->rq_bulk_read,
 277                                  rmsg, roff, vmsg, voff);
 278         RETURN(rc);
 279 }
 280
 281 int gss_svc_unwrap_bulk(struct ptlrpc_request *req,
 282                         struct ptlrpc_bulk_desc *desc)
 283 {
 284         struct gss_svc_reqctx        *grctx;
 285         int                           rc;
 286         ENTRY;
 287
 288         LASSERT(req->rq_svc_ctx);
 289         LASSERT(req->rq_bulk_write);
 290
 291         grctx = gss_svc_ctx2reqctx(req->rq_svc_ctx);
 292
 293         LASSERT(grctx->src_reqbsd);
 294         LASSERT(grctx->src_repbsd);
 295         LASSERT(grctx->src_ctx);
 296         LASSERT(grctx->src_ctx->gsc_mechctx);
 297
 298         /* decrypt bulk data if it's encrypted */
 299         if (grctx->src_reqbsd->bsd_priv_alg != BULK_PRIV_ALG_NULL) {
 300                 rc = do_bulk_privacy(grctx->src_ctx->gsc_mechctx, desc, 0,
 301                                      grctx->src_reqbsd->bsd_priv_alg,
 302                                      grctx->src_reqbsd);
 303                 if (rc) {
 304                         CERROR("bulk write: server failed to decrypt data\n");
 305                         RETURN(rc);
 306                 }
 307         }
 308
 309         /* verify bulk data checksum */
 310         rc = bulk_csum_svc(desc, req->rq_bulk_read,
 311                            grctx->src_reqbsd, grctx->src_reqbsd_size,
 312                            grctx->src_repbsd, grctx->src_repbsd_size);
 313
 314         RETURN(rc);
 315 }
 316
 317 int gss_svc_wrap_bulk(struct ptlrpc_request *req,
 318                       struct ptlrpc_bulk_desc *desc)
 319 {
 320         struct gss_svc_reqctx        *grctx;
 321         int                           rc;
 322         ENTRY;
 323
 324         LASSERT(req->rq_svc_ctx);
 325         LASSERT(req->rq_bulk_read);
 326
 327         grctx = gss_svc_ctx2reqctx(req->rq_svc_ctx);
 328
 329         LASSERT(grctx->src_reqbsd);
 330         LASSERT(grctx->src_repbsd);
 331         LASSERT(grctx->src_ctx);
 332         LASSERT(grctx->src_ctx->gsc_mechctx);
 333
 334         /* generate bulk data checksum */
 335         rc = bulk_csum_svc(desc, req->rq_bulk_read,
 336                            grctx->src_reqbsd, grctx->src_reqbsd_size,
 337                            grctx->src_repbsd, grctx->src_repbsd_size);
 338         if (rc)
 339                 RETURN(rc);
 340
 341         /* encrypt bulk data if required */
 342         if (grctx->src_reqbsd->bsd_priv_alg != BULK_PRIV_ALG_NULL) {
 343                 rc = do_bulk_privacy(grctx->src_ctx->gsc_mechctx, desc, 1,
 344                                      grctx->src_reqbsd->bsd_priv_alg,
 345                                      grctx->src_repbsd);
 346                 if (rc)
 347                         CERROR("bulk read: server failed to encrypt data: "
 348                                "rc %d\n", rc);
 349         }
 350
 351         RETURN(rc);
 352 }
 353