Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * linux/net/sunrpc/gss_krb5_seal.c | |
3 | * | |
4 | * Adapted from MIT Kerberos 5-1.2.1 lib/gssapi/krb5/k5seal.c | |
5 | * | |
81d4a433 | 6 | * Copyright (c) 2000-2008 The Regents of the University of Michigan. |
1da177e4 LT |
7 | * All rights reserved. |
8 | * | |
9 | * Andy Adamson <andros@umich.edu> | |
10 | * J. Bruce Fields <bfields@umich.edu> | |
11 | */ | |
12 | ||
13 | /* | |
14 | * Copyright 1993 by OpenVision Technologies, Inc. | |
15 | * | |
16 | * Permission to use, copy, modify, distribute, and sell this software | |
17 | * and its documentation for any purpose is hereby granted without fee, | |
18 | * provided that the above copyright notice appears in all copies and | |
19 | * that both that copyright notice and this permission notice appear in | |
20 | * supporting documentation, and that the name of OpenVision not be used | |
21 | * in advertising or publicity pertaining to distribution of the software | |
22 | * without specific, written prior permission. OpenVision makes no | |
23 | * representations about the suitability of this software for any | |
24 | * purpose. It is provided "as is" without express or implied warranty. | |
25 | * | |
26 | * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, | |
27 | * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO | |
28 | * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR | |
29 | * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF | |
30 | * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR | |
31 | * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR | |
32 | * PERFORMANCE OF THIS SOFTWARE. | |
33 | */ | |
34 | ||
35 | /* | |
36 | * Copyright (C) 1998 by the FundsXpress, INC. | |
37 | * | |
38 | * All rights reserved. | |
39 | * | |
40 | * Export of this software from the United States of America may require | |
41 | * a specific license from the United States Government. It is the | |
42 | * responsibility of any person or organization contemplating export to | |
43 | * obtain such a license before exporting. | |
44 | * | |
45 | * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and | |
46 | * distribute this software and its documentation for any purpose and | |
47 | * without fee is hereby granted, provided that the above copyright | |
48 | * notice appear in all copies and that both that copyright notice and | |
49 | * this permission notice appear in supporting documentation, and that | |
50 | * the name of FundsXpress. not be used in advertising or publicity pertaining | |
51 | * to distribution of the software without specific, written prior | |
52 | * permission. FundsXpress makes no representations about the suitability of | |
53 | * this software for any purpose. It is provided "as is" without express | |
54 | * or implied warranty. | |
55 | * | |
56 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR | |
57 | * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED | |
58 | * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. | |
59 | */ | |
60 | ||
61 | #include <linux/types.h> | |
1da177e4 LT |
62 | #include <linux/jiffies.h> |
63 | #include <linux/sunrpc/gss_krb5.h> | |
64 | #include <linux/random.h> | |
1da177e4 LT |
65 | #include <linux/crypto.h> |
66 | ||
67 | #ifdef RPC_DEBUG | |
68 | # define RPCDBG_FACILITY RPCDBG_AUTH | |
69 | #endif | |
70 | ||
34af946a | 71 | DEFINE_SPINLOCK(krb5_seq_lock); |
eaa82edf | 72 | |
81d4a433 KC |
73 | static char * |
74 | setup_token(struct krb5_ctx *ctx, struct xdr_netobj *token) | |
75 | { | |
76 | __be16 *ptr, *krb5_hdr; | |
77 | int body_size = GSS_KRB5_TOK_HDR_LEN + ctx->gk5e->cksumlength; | |
78 | ||
79 | token->len = g_token_size(&ctx->mech_used, body_size); | |
80 | ||
81 | ptr = (__be16 *)token->data; | |
82 | g_make_token_header(&ctx->mech_used, body_size, (unsigned char **)&ptr); | |
83 | ||
84 | /* ptr now at start of header described in rfc 1964, section 1.2.1: */ | |
85 | krb5_hdr = ptr; | |
86 | *ptr++ = KG_TOK_MIC_MSG; | |
87 | *ptr++ = cpu_to_le16(ctx->gk5e->signalg); | |
88 | *ptr++ = SEAL_ALG_NONE; | |
89 | *ptr++ = 0xffff; | |
90 | ||
91 | return (char *)krb5_hdr; | |
92 | } | |
93 | ||
de9c17eb KC |
94 | static void * |
95 | setup_token_v2(struct krb5_ctx *ctx, struct xdr_netobj *token) | |
96 | { | |
97 | __be16 *ptr, *krb5_hdr; | |
98 | u8 *p, flags = 0x00; | |
99 | ||
100 | if ((ctx->flags & KRB5_CTX_FLAG_INITIATOR) == 0) | |
101 | flags |= 0x01; | |
102 | if (ctx->flags & KRB5_CTX_FLAG_ACCEPTOR_SUBKEY) | |
103 | flags |= 0x04; | |
104 | ||
105 | /* Per rfc 4121, sec 4.2.6.1, there is no header, | |
106 | * just start the token */ | |
107 | krb5_hdr = ptr = (__be16 *)token->data; | |
108 | ||
109 | *ptr++ = KG2_TOK_MIC; | |
110 | p = (u8 *)ptr; | |
111 | *p++ = flags; | |
112 | *p++ = 0xff; | |
113 | ptr = (__be16 *)p; | |
114 | *ptr++ = 0xffff; | |
115 | *ptr++ = 0xffff; | |
116 | ||
117 | token->len = GSS_KRB5_TOK_HDR_LEN + ctx->gk5e->cksumlength; | |
118 | return krb5_hdr; | |
119 | } | |
120 | ||
1ac3719a KC |
121 | static u32 |
122 | gss_get_mic_v1(struct krb5_ctx *ctx, struct xdr_buf *text, | |
a0857d03 | 123 | struct xdr_netobj *token) |
1da177e4 | 124 | { |
81d4a433 KC |
125 | char cksumdata[GSS_KRB5_MAX_CKSUM_LEN]; |
126 | struct xdr_netobj md5cksum = {.len = sizeof(cksumdata), | |
127 | .data = cksumdata}; | |
128 | void *ptr; | |
1da177e4 | 129 | s32 now; |
eaa82edf | 130 | u32 seq_send; |
e1f6c07b | 131 | u8 *cksumkey; |
1da177e4 | 132 | |
81d4a433 | 133 | dprintk("RPC: %s\n", __func__); |
ef338bee | 134 | BUG_ON(ctx == NULL); |
1da177e4 LT |
135 | |
136 | now = get_seconds(); | |
137 | ||
81d4a433 | 138 | ptr = setup_token(ctx, token); |
1da177e4 | 139 | |
e1f6c07b KC |
140 | if (ctx->gk5e->keyed_cksum) |
141 | cksumkey = ctx->cksum; | |
142 | else | |
143 | cksumkey = NULL; | |
e678e06b | 144 | |
8b237076 KC |
145 | if (make_checksum(ctx, ptr, 8, text, 0, cksumkey, |
146 | KG_USAGE_SIGN, &md5cksum)) | |
39a21dd1 | 147 | return GSS_S_FAILURE; |
94efa934 | 148 | |
e1f6c07b | 149 | memcpy(ptr + GSS_KRB5_TOK_HDR_LEN, md5cksum.data, md5cksum.len); |
1da177e4 | 150 | |
eaa82edf BF |
151 | spin_lock(&krb5_seq_lock); |
152 | seq_send = ctx->seq_send++; | |
153 | spin_unlock(&krb5_seq_lock); | |
154 | ||
1dbd9029 KC |
155 | if (krb5_make_seq_num(ctx, ctx->seq, ctx->initiate ? 0 : 0xff, |
156 | seq_send, ptr + GSS_KRB5_TOK_HDR_LEN, ptr + 8)) | |
39a21dd1 | 157 | return GSS_S_FAILURE; |
1da177e4 | 158 | |
94efa934 | 159 | return (ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE; |
1da177e4 | 160 | } |
1ac3719a | 161 | |
09acfea5 | 162 | static u32 |
de9c17eb KC |
163 | gss_get_mic_v2(struct krb5_ctx *ctx, struct xdr_buf *text, |
164 | struct xdr_netobj *token) | |
165 | { | |
166 | char cksumdata[GSS_KRB5_MAX_CKSUM_LEN]; | |
167 | struct xdr_netobj cksumobj = { .len = sizeof(cksumdata), | |
168 | .data = cksumdata}; | |
169 | void *krb5_hdr; | |
170 | s32 now; | |
171 | u64 seq_send; | |
172 | u8 *cksumkey; | |
8b237076 | 173 | unsigned int cksum_usage; |
de9c17eb KC |
174 | |
175 | dprintk("RPC: %s\n", __func__); | |
176 | ||
177 | krb5_hdr = setup_token_v2(ctx, token); | |
178 | ||
179 | /* Set up the sequence number. Now 64-bits in clear | |
180 | * text and w/o direction indicator */ | |
181 | spin_lock(&krb5_seq_lock); | |
182 | seq_send = ctx->seq_send64++; | |
183 | spin_unlock(&krb5_seq_lock); | |
184 | *((u64 *)(krb5_hdr + 8)) = cpu_to_be64(seq_send); | |
185 | ||
8b237076 | 186 | if (ctx->initiate) { |
de9c17eb | 187 | cksumkey = ctx->initiator_sign; |
8b237076 KC |
188 | cksum_usage = KG_USAGE_INITIATOR_SIGN; |
189 | } else { | |
de9c17eb | 190 | cksumkey = ctx->acceptor_sign; |
8b237076 KC |
191 | cksum_usage = KG_USAGE_ACCEPTOR_SIGN; |
192 | } | |
de9c17eb KC |
193 | |
194 | if (make_checksum_v2(ctx, krb5_hdr, GSS_KRB5_TOK_HDR_LEN, | |
8b237076 | 195 | text, 0, cksumkey, cksum_usage, &cksumobj)) |
de9c17eb KC |
196 | return GSS_S_FAILURE; |
197 | ||
198 | memcpy(krb5_hdr + GSS_KRB5_TOK_HDR_LEN, cksumobj.data, cksumobj.len); | |
199 | ||
200 | now = get_seconds(); | |
201 | ||
202 | return (ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE; | |
203 | } | |
204 | ||
1ac3719a KC |
205 | u32 |
206 | gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text, | |
207 | struct xdr_netobj *token) | |
208 | { | |
209 | struct krb5_ctx *ctx = gss_ctx->internal_ctx_id; | |
210 | ||
211 | switch (ctx->enctype) { | |
212 | default: | |
213 | BUG(); | |
214 | case ENCTYPE_DES_CBC_RAW: | |
958142e9 | 215 | case ENCTYPE_DES3_CBC_RAW: |
fffdaef2 | 216 | case ENCTYPE_ARCFOUR_HMAC: |
1ac3719a | 217 | return gss_get_mic_v1(ctx, text, token); |
de9c17eb KC |
218 | case ENCTYPE_AES128_CTS_HMAC_SHA1_96: |
219 | case ENCTYPE_AES256_CTS_HMAC_SHA1_96: | |
220 | return gss_get_mic_v2(ctx, text, token); | |
1ac3719a KC |
221 | } |
222 | } | |
223 |