Allow RxRPC transport security to be requested

Honour the -encrypt flag to vos listvldb and make it tell AF_RXRPC to secure
the connection.  This requires an appropriate key to be available in one of
the user's keyrings, labelled:

	afs@<UPPERCASE.CELL.NAME>

Without such a key, error:

	[Errno 126] Required key not available

will be issued.

Signed-off-by: David Howells <dhowells@redhat.com>

diff --git a/af_rxrpc.c b/af_rxrpc.c
index 09f58d1aa18d71686602edbb360668001c722b70..996699453a62d9f1e6525d27898fb82ba1251f36 100644 (file)
--- a/af_rxrpc.c
+++ b/af_rxrpc.c
@@ -121,7 +121,9 @@ struct rx_connection *rx_new_connection(const struct sockaddr *sa,
                                        uint16_t service,
                                        uint16_t local_port,
                                        uint16_t local_service,
-                                       int exclusive)
+                                       int exclusive,
+                                       const char *key,
+                                       int security)
 {
        struct sockaddr_rxrpc srx;
        struct rx_connection *z_conn;
@@ -153,6 +155,10 @@ struct rx_connection *rx_new_connection(const struct sockaddr *sa,
                goto error_conn;
        }
 
+       if (security < RXRPC_SECURITY_PLAIN ||
+           security > RXRPC_SECURITY_ENCRYPT)
+               goto inval;
+
        memcpy(&z_conn->peer.transport, sa, salen);
        switch (sa->sa_family) {
        case AF_INET:
@@ -182,6 +188,18 @@ struct rx_connection *rx_new_connection(const struct sockaddr *sa,
                        goto error_conn;
        }
 
+       if (key) {
+               ret = setsockopt(z_conn->fd, SOL_RXRPC, RXRPC_MIN_SECURITY_LEVEL,
+                                &security, sizeof(security));
+               if (ret == -1)
+                       goto error_conn;
+
+               ret = setsockopt(z_conn->fd, SOL_RXRPC, RXRPC_SECURITY_KEY,
+                                key, strlen(key));
+               if (ret == -1)
+                       goto error_conn;
+       }
+
        /* Bind an address to the local endpoint */
        memset(&srx, 0, sizeof(srx));
        srx.srx_family = AF_RXRPC;

diff --git a/py_rxconn.c b/py_rxconn.c
index 0203ddda9c3b685e33022f571799513ba17284d4..309cbb7f00389e8a9ce9a8a59def6e1b4831d012 100644 (file)
--- a/py_rxconn.c
+++ b/py_rxconn.c
@@ -111,13 +111,13 @@ kafs_py_rx_new_connection(PyObject *_self, PyObject *args)
                struct sockaddr_in sin;
                struct sockaddr_in6 sin6;
        } sa;
-       const char *address = NULL;
+       const char *address = NULL, *key = NULL;
        socklen_t salen;
        uint16_t port, service, local_port = 0, local_service = 0;
-       int exclusive = 0;
+       int exclusive = 0, security = 0;
 
-       if (!PyArg_ParseTuple(args, "sHH|HHp",
-                             &address, &port, &service,
+       if (!PyArg_ParseTuple(args, "sHHzi|HHp",
+                             &address, &port, &service, &key, &security,
                              &local_port, &local_service, &exclusive))
                return NULL;
 
@@ -141,7 +141,8 @@ kafs_py_rx_new_connection(PyObject *_self, PyObject *args)
        assert(obj->x == NULL);
 
        z_conn = rx_new_connection(&sa.sa, salen, service,
-                                  local_port, local_service, exclusive);
+                                  local_port, local_service, exclusive,
+                                  key, security);
        if (!z_conn) {
                Py_DECREF(obj);
                return errno == ENOMEM ? PyExc_MemoryError :

diff --git a/rxgen.h b/rxgen.h
index a6fbdbdeb4662613ed3ad60fe3ae7e14428a7e6c..6d7ef28bde56e913b85337c0e51d82002b5b5c14 100644 (file)
--- a/rxgen.h
+++ b/rxgen.h
@@ -170,7 +170,9 @@ extern struct rx_connection *rx_new_connection(const struct sockaddr *sa,
                                               uint16_t service,
                                               uint16_t local_port,
                                               uint16_t local_service,
-                                              int exclusive);
+                                              int exclusive,
+                                              const char *key,
+                                              int security);
 
 extern void rx_close_connection(struct rx_connection *z_conn);
 

diff --git a/rxgen/rxgen.pl b/rxgen/rxgen.pl
index 1c3322113d2f5ded518712ef40e70578baca856c..33d15c83d1e6ee34ecd02258dbf705979a3adea9 100755 (executable)
--- a/rxgen/rxgen.pl
+++ b/rxgen/rxgen.pl
@@ -36,6 +36,10 @@ our @abort_codes = ();       # Abort codes
 our @py_type_defs = ();        # Python type definitions
 our @py_func_defs = (); # Python function definitions
 
+$constants{RXRPC_SECURITY_PLAIN}       = { name => "RXRPC_SECURITY_PLAIN",   val => 0 };
+$constants{RXRPC_SECURITY_AUTH}                = { name => "RXRPC_SECURITY_AUTH",    val => 1 };
+$constants{RXRPC_SECURITY_ENCRYPT}     = { name => "RXRPC_SECURITY_ENCRYPT", val => 2 };
+
 #
 # Divide the lines from the files up into typed collections
 #

diff --git a/suite/commands/vos/listvldb.py b/suite/commands/vos/listvldb.py
index b0bb5324edc9a1f84f2bdd5942130ed068093711..2bbe7828452c85f4b3d67b0d3b5e472ffd050daf 100644 (file)
--- a/suite/commands/vos/listvldb.py
+++ b/suite/commands/vos/listvldb.py
@@ -100,7 +100,17 @@ def print_record(params, vldb):
 def main(params):
     # Get a list of VLDB servers to query
     cell = params["cell"]
-    z_conn = cell.open_vl_server()
+
+    if "localauth" in params:
+        raise RuntimeError("Don't support -localauth yet")
+    elif "noauth" in params:
+        security = None
+    elif "encrypt" in params:
+        security = kafs.RXRPC_SECURITY_ENCRYPT
+    else:
+        security = None
+
+    z_conn = cell.open_vl_server(security)
     quiet = "quiet" in params
 
     if "name" in params:

diff --git a/suite/lib/cell.py b/suite/lib/cell.py
index a721cec5a7247d853a96e6c4d33f0c4e1b5fca97..a4938ee871d1d3cf12f464c1c858b5e5d817e912 100644 (file)
--- a/suite/lib/cell.py
+++ b/suite/lib/cell.py
@@ -119,14 +119,21 @@ class cell:
         return addrs
 
     # Open a VL Server connection
-    def open_vl_server(self):
+    def open_vl_server(self, security=None):
         if self.__vlconn:
             return
 
         for vlserver in self.query_vl_addrs():
             debug("Trying", vlserver)
 
-            z_conn = kafs.rx_new_connection(vlserver, kafs.VL_PORT, kafs.VL_SERVICE)
+            if security != None:
+                key = "afs@" + self.__name.upper()
+            else:
+                key = None
+                security = 0
+
+            z_conn = kafs.rx_new_connection(vlserver, kafs.VL_PORT, kafs.VL_SERVICE,
+                                            key, security)
             try:
                 ret = kafs.VL_Probe(z_conn)
                 self.__vlconn = z_conn