From: Jakub Kicinski Date: Tue, 15 Apr 2025 00:36:44 +0000 (-0700) Subject: Merge branch 'rxrpc-afs-add-afs-gssapi-security-class-to-af_rxrpc-and-kafs' X-Git-Tag: v6.16-rc1~132^2~308 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5b38e821b929c23a3b7bfa2705cc7b0e76a3ee7b;p=thirdparty%2Fkernel%2Flinux.git Merge branch 'rxrpc-afs-add-afs-gssapi-security-class-to-af_rxrpc-and-kafs' David Howells says: ==================== rxrpc, afs: Add AFS GSSAPI security class to AF_RXRPC and kafs Here's a set of patches to add basic support for the AFS GSSAPI security class to AF_RXRPC and kafs. It provides transport security for keys that match the security index 6 (YFS) for connections to the AFS fileserver and VL server. Note that security index 4 (OpenAFS) can also be supported using this, but it needs more work as it's slightly different. The patches also provide the ability to secure the callback channel - connections from the fileserver back to the client that are used to pass file change notifications, amongst other things. When challenged by the fileserver, kafs will generate a token specific to that server and include it in the RESPONSE packet as the appdata. The server then extracts this and uses it to send callback RPC calls back to the client. It can also be used to provide transport security on the callback channel, but a further set of patches is required to provide the token and key to set that up when the client responds to the fileserver's challenge. This makes use of the previously added crypto-krb5 library that is now upstream (last commit fc0cf10c04f4). This series of patches consist of the following parts: (0) Update kdoc comments to remove some kdoc builder warnings. (1) Push reponding to CHALLENGE packets over to recvmsg() or the kernel equivalent so that the application layer can include user-defined information in the RESPONSE packet. In a follow-up patch set, this will allow the callback channel to be secured by the AFS filesystem. (2) Add the AF_RXRPC RxGK security class that uses a key obtained from the AFS GSS security service to do Kerberos 5-based encryption instead of pcbc(fcrypt) and pcbc(des). (3) Add support for callback channel encryption in kafs. (4) Provide the test rxperf server module with some fixed krb5 keys. ==================== Link: https://patch.msgid.link/20250411095303.2316168-1-dhowells@redhat.com Signed-off-by: Jakub Kicinski --- 5b38e821b929c23a3b7bfa2705cc7b0e76a3ee7b