Commit ac431d59 authored by Ilya Dryomov's avatar Ilya Dryomov
Browse files

libceph: define and enforce CEPH_MAX_KEY_LEN 



When decoding the key, verify that the key material would fit into
a fixed-size buffer in process_auth_done() and generally has a sane
length.

The new CEPH_MAX_KEY_LEN check replaces the existing check for a key
with no key material which is a) not universal since CEPH_CRYPTO_NONE
has to be excluded and b) doesn't provide much value since a smaller
than needed key is just as invalid as no key -- this has to be handled
elsewhere anyway.

Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent 05f7e89a

net/ceph/crypto.c

+5 −3
Original line number Diff line number Diff line
@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf) 
		return -ENOTSUPP;

	}



	if (!key->len)

		return -EINVAL;



	key->key = kmemdup(buf, key->len, GFP_NOIO);

	if (!key->key) {

		ret = -ENOMEM;
@@ -83,6 +80,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end) 
	ceph_decode_copy(p, &key->created, sizeof(key->created));

	key->len = ceph_decode_16(p);

	ceph_decode_need(p, end, key->len, bad);

	if (key->len > CEPH_MAX_KEY_LEN) {

		pr_err("secret too big %d\n", key->len);

		return -EINVAL;

	}



	ret = set_secret(key, *p);

	memzero_explicit(*p, key->len);

	*p += key->len;

net/ceph/crypto.h

+1 −1
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ 
#include <linux/ceph/types.h>

#include <linux/ceph/buffer.h>



#define CEPH_KEY_LEN			16

#define CEPH_MAX_KEY_LEN		16

#define CEPH_MAX_CON_SECRET_LEN		64



/*

net/ceph/messenger_v2.c

+1 −1
Original line number Diff line number Diff line
@@ -2360,7 +2360,7 @@ static int process_auth_reply_more(struct ceph_connection *con, 
 */

static int process_auth_done(struct ceph_connection *con, void *p, void *end)

{

	u8 session_key_buf[CEPH_KEY_LEN + 16];

	u8 session_key_buf[CEPH_MAX_KEY_LEN + 16];

	u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16];

	u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16);

	u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16);