[deliverable/linux.git] / net / sunrpc / auth_gss / gss_krb5_seal.c

/*
 *  linux/net/sunrpc/gss_krb5_seal.c
 *
 *  Adapted from MIT Kerberos 5-1.2.1 lib/gssapi/krb5/k5seal.c
 *
 *  Copyright (c) 2000 The Regents of the University of Michigan.
 *  All rights reserved.
 *
 *  Andy Adamson	<andros@umich.edu>
 *  J. Bruce Fields	<bfields@umich.edu>
 */

/*
 * Copyright 1993 by OpenVision Technologies, Inc.
 *
 * Permission to use, copy, modify, distribute, and sell this software
 * and its documentation for any purpose is hereby granted without fee,
 * provided that the above copyright notice appears in all copies and
 * that both that copyright notice and this permission notice appear in
 * supporting documentation, and that the name of OpenVision not be used
 * in advertising or publicity pertaining to distribution of the software
 * without specific, written prior permission. OpenVision makes no
 * representations about the suitability of this software for any
 * purpose.  It is provided "as is" without express or implied warranty.
 *
 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 * PERFORMANCE OF THIS SOFTWARE.
 */

/*
 * Copyright (C) 1998 by the FundsXpress, INC.
 *
 * All rights reserved.
 *
 * Export of this software from the United States of America may require
 * a specific license from the United States Government.  It is the
 * responsibility of any person or organization contemplating export to
 * obtain such a license before exporting.
 *
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of FundsXpress. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  FundsXpress makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

#include <linux/types.h>
#include <linux/slab.h>
#include <linux/jiffies.h>
#include <linux/sunrpc/gss_krb5.h>
#include <linux/random.h>
#include <asm/scatterlist.h>
#include <linux/crypto.h>

#ifdef RPC_DEBUG
# define RPCDBG_FACILITY        RPCDBG_AUTH
#endif

spinlock_t krb5_seq_lock = SPIN_LOCK_UNLOCKED;

u32
gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text,
		struct xdr_netobj *token)
{
	struct krb5_ctx		*ctx = gss_ctx->internal_ctx_id;
	s32			checksum_type;
	char			cksumdata[16];
	struct xdr_netobj	md5cksum = {.len = 0, .data = cksumdata};
	unsigned char		*ptr, *krb5_hdr, *msg_start;
	s32			now;
	u32			seq_send;

	dprintk("RPC:     gss_krb5_seal\n");

	now = get_seconds();

	switch (ctx->signalg) {
		case SGN_ALG_DES_MAC_MD5:
			checksum_type = CKSUMTYPE_RSA_MD5;
			break;
		default:
			dprintk("RPC:      gss_krb5_seal: ctx->signalg %d not"
				" supported\n", ctx->signalg);
			goto out_err;
	}
	if (ctx->sealalg != SEAL_ALG_NONE && ctx->sealalg != SEAL_ALG_DES) {
		dprintk("RPC:      gss_krb5_seal: ctx->sealalg %d not supported\n",
			ctx->sealalg);
		goto out_err;
	}

	token->len = g_token_size(&ctx->mech_used, 22);

	ptr = token->data;
	g_make_token_header(&ctx->mech_used, 22, &ptr);

	*ptr++ = (unsigned char) ((KG_TOK_MIC_MSG>>8)&0xff);
	*ptr++ = (unsigned char) (KG_TOK_MIC_MSG&0xff);

	/* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */
	krb5_hdr = ptr - 2;
	msg_start = krb5_hdr + 24;

	*(u16 *)(krb5_hdr + 2) = htons(ctx->signalg);
	memset(krb5_hdr + 4, 0xff, 4);

	if (make_checksum(checksum_type, krb5_hdr, 8, text, 0, &md5cksum))
			goto out_err;

	switch (ctx->signalg) {
	case SGN_ALG_DES_MAC_MD5:
		if (krb5_encrypt(ctx->seq, NULL, md5cksum.data,
				  md5cksum.data, md5cksum.len))
			goto out_err;
		memcpy(krb5_hdr + 16,
		       md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
		       KRB5_CKSUM_LENGTH);

		dprintk("RPC:      make_seal_token: cksum data: \n");
		print_hexl((u32 *) (krb5_hdr + 16), KRB5_CKSUM_LENGTH, 0);
		break;
	default:
		BUG();
	}

	spin_lock(&krb5_seq_lock);
	seq_send = ctx->seq_send++;
	spin_unlock(&krb5_seq_lock);

	if ((krb5_make_seq_num(ctx->seq, ctx->initiate ? 0 : 0xff,
			       seq_send, krb5_hdr + 16, krb5_hdr + 8)))
		goto out_err;

	return ((ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE);
out_err:
	return GSS_S_FAILURE;
}
Commit	Line	Data
1da177e4 LT	1	/*
	2	* linux/net/sunrpc/gss_krb5_seal.c
	3	*
	4	* Adapted from MIT Kerberos 5-1.2.1 lib/gssapi/krb5/k5seal.c
	5	*
	6	* Copyright (c) 2000 The Regents of the University of Michigan.
	7	* All rights reserved.
	8	*
	9	* Andy Adamson <andros@umich.edu>
	10	* J. Bruce Fields <bfields@umich.edu>
	11	*/
	12
	13	/*
	14	* Copyright 1993 by OpenVision Technologies, Inc.
	15	*
	16	* Permission to use, copy, modify, distribute, and sell this software
	17	* and its documentation for any purpose is hereby granted without fee,
	18	* provided that the above copyright notice appears in all copies and
	19	* that both that copyright notice and this permission notice appear in
	20	* supporting documentation, and that the name of OpenVision not be used
	21	* in advertising or publicity pertaining to distribution of the software
	22	* without specific, written prior permission. OpenVision makes no
	23	* representations about the suitability of this software for any
	24	* purpose. It is provided "as is" without express or implied warranty.
	25	*
	26	* OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
	27	* INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
	28	* EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
	29	* CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
	30	* USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
	31	* OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
	32	* PERFORMANCE OF THIS SOFTWARE.
	33	*/
	34
	35	/*
	36	* Copyright (C) 1998 by the FundsXpress, INC.
	37	*
	38	* All rights reserved.
	39	*
	40	* Export of this software from the United States of America may require
	41	* a specific license from the United States Government. It is the
	42	* responsibility of any person or organization contemplating export to
	43	* obtain such a license before exporting.
	44	*
	45	* WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
	46	* distribute this software and its documentation for any purpose and
	47	* without fee is hereby granted, provided that the above copyright
	48	* notice appear in all copies and that both that copyright notice and
	49	* this permission notice appear in supporting documentation, and that
	50	* the name of FundsXpress. not be used in advertising or publicity pertaining
	51	* to distribution of the software without specific, written prior
	52	* permission. FundsXpress makes no representations about the suitability of
	53	* this software for any purpose. It is provided "as is" without express
	54	* or implied warranty.
	55	*
	56	* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
	57	* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
	58	* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
	59	*/
	60
	61	#include <linux/types.h>
	62	#include <linux/slab.h>
	63	#include <linux/jiffies.h>
	64	#include <linux/sunrpc/gss_krb5.h>
65	#include <linux/random.h>
66	#include <asm/scatterlist.h>
67	#include <linux/crypto.h>
68
69	#ifdef RPC_DEBUG
70	# define RPCDBG_FACILITY RPCDBG_AUTH
71	#endif
72
eaa82edf BF	73	spinlock_t krb5_seq_lock = SPIN_LOCK_UNLOCKED;
eaa82edf BF	74
1da177e4	75	u32
a0857d03 BF	76	gss_get_mic_kerberos(struct gss_ctx gss_ctx, struct xdr_buf text,
a0857d03 BF	77	struct xdr_netobj *token)
1da177e4	78	{
a0857d03	79	struct krb5_ctx *ctx = gss_ctx->internal_ctx_id;
1da177e4	80	s32 checksum_type;
9e57b302 BF	81	char cksumdata[16];
9e57b302 BF	82	struct xdr_netobj md5cksum = {.len = 0, .data = cksumdata};
1da177e4 LT	83	unsigned char ptr, krb5_hdr, *msg_start;
1da177e4 LT	84	s32 now;
eaa82edf	85	u32 seq_send;
1da177e4 LT	86
	87	dprintk("RPC: gss_krb5_seal\n");
	88
	89	now = get_seconds();
	90
1da177e4 LT	91	switch (ctx->signalg) {
	92	case SGN_ALG_DES_MAC_MD5:
	93	checksum_type = CKSUMTYPE_RSA_MD5;
	94	break;
	95	default:
	96	dprintk("RPC: gss_krb5_seal: ctx->signalg %d not"
	97	" supported\n", ctx->signalg);
	98	goto out_err;
	99	}
	100	if (ctx->sealalg != SEAL_ALG_NONE && ctx->sealalg != SEAL_ALG_DES) {
	101	dprintk("RPC: gss_krb5_seal: ctx->sealalg %d not supported\n",
	102	ctx->sealalg);
	103	goto out_err;
	104	}
	105
bfa91516	106	token->len = g_token_size(&ctx->mech_used, 22);
1da177e4 LT	107
1da177e4 LT	108	ptr = token->data;
bfa91516	109	g_make_token_header(&ctx->mech_used, 22, &ptr);
1da177e4	110
bfa91516 BF	111	*ptr++ = (unsigned char) ((KG_TOK_MIC_MSG>>8)&0xff);
bfa91516 BF	112	*ptr++ = (unsigned char) (KG_TOK_MIC_MSG&0xff);
1da177e4 LT	113
	114	/* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */
	115	krb5_hdr = ptr - 2;
	116	msg_start = krb5_hdr + 24;
	117
	118	(u16 )(krb5_hdr + 2) = htons(ctx->signalg);
	119	memset(krb5_hdr + 4, 0xff, 4);
1da177e4	120
14ae162c BF	121	if (make_checksum(checksum_type, krb5_hdr, 8, text, 0, &md5cksum))
14ae162c BF	122	goto out_err;
1da177e4 LT	123
	124	switch (ctx->signalg) {
	125	case SGN_ALG_DES_MAC_MD5:
	126	if (krb5_encrypt(ctx->seq, NULL, md5cksum.data,
	127	md5cksum.data, md5cksum.len))
	128	goto out_err;
	129	memcpy(krb5_hdr + 16,
	130	md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
	131	KRB5_CKSUM_LENGTH);
	132
	133	dprintk("RPC: make_seal_token: cksum data: \n");
	134	print_hexl((u32 *) (krb5_hdr + 16), KRB5_CKSUM_LENGTH, 0);
	135	break;
	136	default:
	137	BUG();
	138	}
	139
eaa82edf BF	140	spin_lock(&krb5_seq_lock);
	141	seq_send = ctx->seq_send++;
	142	spin_unlock(&krb5_seq_lock);
	143
1da177e4	144	if ((krb5_make_seq_num(ctx->seq, ctx->initiate ? 0 : 0xff,
eaa82edf	145	seq_send, krb5_hdr + 16, krb5_hdr + 8)))
1da177e4 LT	146	goto out_err;
1da177e4 LT	147
1da177e4 LT	148	return ((ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE);
1da177e4 LT	149	out_err:
1da177e4 LT	150	return GSS_S_FAILURE;
1da177e4 LT	151	}