rxrpc: Create a null security type and get rid of conditional calls

Create a null security type for security index 0 and get rid of all
conditional calls to the security operations.  We expect normally to be
using security, so this should be of little negative impact.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/rxrpc/Makefile b/net/rxrpc/Makefile
index fa09cb55bfce7a298baf35468b8adde217cee01a..e05a06ef2254248519616b06dd9dac6c6bf2a2fb 100644 (file)
--- a/net/rxrpc/Makefile
+++ b/net/rxrpc/Makefile
@@ -19,6 +19,7 @@ af-rxrpc-y := \
        ar-security.o \
        ar-skbuff.o \
        ar-transport.o \
+       insecure.o \
        misc.o
 
 af-rxrpc-$(CONFIG_PROC_FS) += ar-proc.o

diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
index 3cd9264806a41a2a555210ae36ced8fe38f51a00..374478e006e7c806a82b9dd907907f39e1d4cd5c 100644 (file)
--- a/net/rxrpc/ar-ack.c
+++ b/net/rxrpc/ar-ack.c
@@ -588,7 +588,8 @@ process_further:
                _proto("OOSQ DATA %%%u { #%u }", sp->hdr.serial, sp->hdr.seq);
 
                /* secured packets must be verified and possibly decrypted */
-               if (rxrpc_verify_packet(call, skb, _abort_code) < 0)
+               if (call->conn->security->verify_packet(call, skb,
+                                                       _abort_code) < 0)
                        goto protocol_error;
 
                rxrpc_insert_oos_packet(call, skb);

diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
index 9b6966777633efc7925529a50cd928c260dd706c..97f4fae74bcab5c2305801d85dca51a3295e3663 100644 (file)
--- a/net/rxrpc/ar-connection.c
+++ b/net/rxrpc/ar-connection.c
@@ -207,6 +207,7 @@ static struct rxrpc_connection *rxrpc_alloc_connection(gfp_t gfp)
                INIT_LIST_HEAD(&conn->bundle_link);
                conn->calls = RB_ROOT;
                skb_queue_head_init(&conn->rx_queue);
+               conn->security = &rxrpc_no_security;
                rwlock_init(&conn->lock);
                spin_lock_init(&conn->state_lock);
                atomic_set(&conn->usage, 1);
@@ -564,8 +565,7 @@ int rxrpc_connect_call(struct rxrpc_sock *rx,
                     candidate->debug_id, candidate->trans->debug_id);
 
                rxrpc_assign_connection_id(candidate);
-               if (candidate->security)
-                       candidate->security->prime_packet_security(candidate);
+               candidate->security->prime_packet_security(candidate);
 
                /* leave the candidate lurking in zombie mode attached to the
                 * bundle until we're ready for it */
@@ -830,7 +830,10 @@ static void rxrpc_destroy_connection(struct rxrpc_connection *conn)
        ASSERT(RB_EMPTY_ROOT(&conn->calls));
        rxrpc_purge_queue(&conn->rx_queue);
 
-       rxrpc_clear_conn_security(conn);
+       conn->security->clear(conn);
+       key_put(conn->key);
+       key_put(conn->server_key);
+
        rxrpc_put_transport(conn->trans);
        kfree(conn);
        _leave("");

diff --git a/net/rxrpc/ar-connevent.c b/net/rxrpc/ar-connevent.c
index 291522392ac7b465c0e4511ad13f0d9923f75dd5..5f9563968a5b498e837bef9baf2921867a8073da 100644 (file)
--- a/net/rxrpc/ar-connevent.c
+++ b/net/rxrpc/ar-connevent.c
@@ -174,15 +174,10 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
                return -ECONNABORTED;
 
        case RXRPC_PACKET_TYPE_CHALLENGE:
-               if (conn->security)
-                       return conn->security->respond_to_challenge(
-                               conn, skb, _abort_code);
-               return -EPROTO;
+               return conn->security->respond_to_challenge(conn, skb,
+                                                           _abort_code);
 
        case RXRPC_PACKET_TYPE_RESPONSE:
-               if (!conn->security)
-                       return -EPROTO;
-
                ret = conn->security->verify_response(conn, skb, _abort_code);
                if (ret < 0)
                        return ret;
@@ -238,8 +233,6 @@ static void rxrpc_secure_connection(struct rxrpc_connection *conn)
                }
        }
 
-       ASSERT(conn->security != NULL);
-
        if (conn->security->issue_challenge(conn) < 0) {
                abort_code = RX_CALL_DEAD;
                ret = -ENOMEM;

diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
index c6c784d3a3e8a864a5e4c8b691236ac7f9d33ba8..01e038146b7ca863e9eacf714067eee365425844 100644 (file)
--- a/net/rxrpc/ar-input.c
+++ b/net/rxrpc/ar-input.c
@@ -193,7 +193,7 @@ static int rxrpc_fast_process_data(struct rxrpc_call *call,
 
        /* if the packet need security things doing to it, then it goes down
         * the slow path */
-       if (call->conn->security)
+       if (call->conn->security_ix)
                goto enqueue_packet;
 
        sp->call = call;

diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 72fd675a891ef1b758d87901d48a80722fe596a7..f0b807a163fa3d7d10cc4ddb7fd66c0129a7ca44 100644 (file)
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -9,6 +9,7 @@
  * 2 of the License, or (at your option) any later version.
  */
 
+#include <net/sock.h>
 #include <rxrpc/packet.h>
 
 #if 0
@@ -612,10 +613,6 @@ int __init rxrpc_init_security(void);
 void rxrpc_exit_security(void);
 int rxrpc_init_client_conn_security(struct rxrpc_connection *);
 int rxrpc_init_server_conn_security(struct rxrpc_connection *);
-int rxrpc_secure_packet(const struct rxrpc_call *, struct sk_buff *, size_t,
-                       void *);
-int rxrpc_verify_packet(const struct rxrpc_call *, struct sk_buff *, u32 *);
-void rxrpc_clear_conn_security(struct rxrpc_connection *);
 
 /*
  * ar-skbuff.c
@@ -634,6 +631,11 @@ void __exit rxrpc_destroy_all_transports(void);
 struct rxrpc_transport *rxrpc_find_transport(struct rxrpc_local *,
                                             struct rxrpc_peer *);
 
+/*
+ * insecure.c
+ */
+extern const struct rxrpc_security rxrpc_no_security;
+
 /*
  * misc.c
  */

diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c
index 94e7d953743758b973b628bbc53bae9192c2b058..51cb10062a8dd2ad877e57a5ba49cc8ea1da0159 100644 (file)
--- a/net/rxrpc/ar-output.c
+++ b/net/rxrpc/ar-output.c
@@ -663,7 +663,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                        size_t pad;
 
                        /* pad out if we're using security */
-                       if (conn->security) {
+                       if (conn->security_ix) {
                                pad = conn->security_size + skb->mark;
                                pad = conn->size_align - pad;
                                pad &= conn->size_align - 1;
@@ -695,7 +695,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                        if (more && seq & 1)
                                sp->hdr.flags |= RXRPC_REQUEST_ACK;
 
-                       ret = rxrpc_secure_packet(
+                       ret = conn->security->secure_packet(
                                call, skb, skb->mark,
                                skb->head + sizeof(struct rxrpc_wire_header));
                        if (ret < 0)

diff --git a/net/rxrpc/ar-security.c b/net/rxrpc/ar-security.c
index 6946aec7ab1fc5f82473a1acc21812ec2818cb03..d223253b22fa05f5aa61e4b375b608e7bb6af3e4 100644 (file)
--- a/net/rxrpc/ar-security.c
+++ b/net/rxrpc/ar-security.c
@@ -23,6 +23,7 @@ static LIST_HEAD(rxrpc_security_methods);
 static DECLARE_RWSEM(rxrpc_security_sem);
 
 static const struct rxrpc_security *rxrpc_security_types[] = {
+       [RXRPC_SECURITY_NONE]   = &rxrpc_no_security,
 #ifdef CONFIG_RXKAD
        [RXRPC_SECURITY_RXKAD]  = &rxkad,
 #endif
@@ -98,7 +99,7 @@ int rxrpc_init_client_conn_security(struct rxrpc_connection *conn)
 
        ret = conn->security->init_connection_security(conn);
        if (ret < 0) {
-               conn->security = NULL;
+               conn->security = &rxrpc_no_security;
                return ret;
        }
 
@@ -165,43 +166,3 @@ found_service:
        _leave(" = 0");
        return 0;
 }
-
-/*
- * secure a packet prior to transmission
- */
-int rxrpc_secure_packet(const struct rxrpc_call *call,
-                       struct sk_buff *skb,
-                       size_t data_size,
-                       void *sechdr)
-{
-       if (call->conn->security)
-               return call->conn->security->secure_packet(
-                       call, skb, data_size, sechdr);
-       return 0;
-}
-
-/*
- * secure a packet prior to transmission
- */
-int rxrpc_verify_packet(const struct rxrpc_call *call, struct sk_buff *skb,
-                       u32 *_abort_code)
-{
-       if (call->conn->security)
-               return call->conn->security->verify_packet(
-                       call, skb, _abort_code);
-       return 0;
-}
-
-/*
- * clear connection security
- */
-void rxrpc_clear_conn_security(struct rxrpc_connection *conn)
-{
-       _enter("{%d}", conn->debug_id);
-
-       if (conn->security)
-               conn->security->clear(conn);
-
-       key_put(conn->key);
-       key_put(conn->server_key);
-}

diff --git a/net/rxrpc/insecure.c b/net/rxrpc/insecure.c
new file mode 100644 (file)
index 0000000..e571403
--- /dev/null
+++ b/net/rxrpc/insecure.c
@@ -0,0 +1,83 @@
+/* Null security operations.
+ *
+ * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#include <net/af_rxrpc.h>
+#include "ar-internal.h"
+
+static int none_init_connection_security(struct rxrpc_connection *conn)
+{
+       return 0;
+}
+
+static void none_prime_packet_security(struct rxrpc_connection *conn)
+{
+}
+
+static int none_secure_packet(const struct rxrpc_call *call,
+                              struct sk_buff *skb,
+                              size_t data_size,
+                              void *sechdr)
+{
+       return 0;
+}
+
+static int none_verify_packet(const struct rxrpc_call *call,
+                              struct sk_buff *skb,
+                              u32 *_abort_code)
+{
+       return 0;
+}
+
+static int none_respond_to_challenge(struct rxrpc_connection *conn,
+                                     struct sk_buff *skb,
+                                     u32 *_abort_code)
+{
+       *_abort_code = RX_PROTOCOL_ERROR;
+       return -EPROTO;
+}
+
+static int none_verify_response(struct rxrpc_connection *conn,
+                                struct sk_buff *skb,
+                                u32 *_abort_code)
+{
+       *_abort_code = RX_PROTOCOL_ERROR;
+       return -EPROTO;
+}
+
+static void none_clear(struct rxrpc_connection *conn)
+{
+}
+
+static int none_init(void)
+{
+       return 0;
+}
+
+static void none_exit(void)
+{
+}
+
+/*
+ * RxRPC Kerberos-based security
+ */
+const struct rxrpc_security rxrpc_no_security = {
+       .name                           = "none",
+       .security_index                 = RXRPC_SECURITY_NONE,
+       .init                           = none_init,
+       .exit                           = none_exit,
+       .init_connection_security       = none_init_connection_security,
+       .prime_packet_security          = none_prime_packet_security,
+       .secure_packet                  = none_secure_packet,
+       .verify_packet                  = none_verify_packet,
+       .respond_to_challenge           = none_respond_to_challenge,
+       .verify_response                = none_verify_response,
+       .clear                          = none_clear,
+};