Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * linux/net/sunrpc/gss_krb5_seal.c |
| 3 | * |
| 4 | * Adapted from MIT Kerberos 5-1.2.1 lib/gssapi/krb5/k5seal.c |
| 5 | * |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 6 | * Copyright (c) 2000-2008 The Regents of the University of Michigan. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 7 | * All rights reserved. |
| 8 | * |
| 9 | * Andy Adamson <andros@umich.edu> |
| 10 | * J. Bruce Fields <bfields@umich.edu> |
| 11 | */ |
| 12 | |
| 13 | /* |
| 14 | * Copyright 1993 by OpenVision Technologies, Inc. |
| 15 | * |
| 16 | * Permission to use, copy, modify, distribute, and sell this software |
| 17 | * and its documentation for any purpose is hereby granted without fee, |
| 18 | * provided that the above copyright notice appears in all copies and |
| 19 | * that both that copyright notice and this permission notice appear in |
| 20 | * supporting documentation, and that the name of OpenVision not be used |
| 21 | * in advertising or publicity pertaining to distribution of the software |
| 22 | * without specific, written prior permission. OpenVision makes no |
| 23 | * representations about the suitability of this software for any |
| 24 | * purpose. It is provided "as is" without express or implied warranty. |
| 25 | * |
| 26 | * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, |
| 27 | * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO |
| 28 | * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR |
| 29 | * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF |
| 30 | * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR |
| 31 | * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR |
| 32 | * PERFORMANCE OF THIS SOFTWARE. |
| 33 | */ |
| 34 | |
| 35 | /* |
| 36 | * Copyright (C) 1998 by the FundsXpress, INC. |
| 37 | * |
| 38 | * All rights reserved. |
| 39 | * |
| 40 | * Export of this software from the United States of America may require |
| 41 | * a specific license from the United States Government. It is the |
| 42 | * responsibility of any person or organization contemplating export to |
| 43 | * obtain such a license before exporting. |
| 44 | * |
| 45 | * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and |
| 46 | * distribute this software and its documentation for any purpose and |
| 47 | * without fee is hereby granted, provided that the above copyright |
| 48 | * notice appear in all copies and that both that copyright notice and |
| 49 | * this permission notice appear in supporting documentation, and that |
| 50 | * the name of FundsXpress. not be used in advertising or publicity pertaining |
| 51 | * to distribution of the software without specific, written prior |
| 52 | * permission. FundsXpress makes no representations about the suitability of |
| 53 | * this software for any purpose. It is provided "as is" without express |
| 54 | * or implied warranty. |
| 55 | * |
| 56 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR |
| 57 | * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED |
| 58 | * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. |
| 59 | */ |
| 60 | |
| 61 | #include <linux/types.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 62 | #include <linux/jiffies.h> |
| 63 | #include <linux/sunrpc/gss_krb5.h> |
| 64 | #include <linux/random.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 65 | #include <linux/crypto.h> |
| 66 | |
| 67 | #ifdef RPC_DEBUG |
| 68 | # define RPCDBG_FACILITY RPCDBG_AUTH |
| 69 | #endif |
| 70 | |
Ingo Molnar | 34af946 | 2006-06-27 02:53:55 -0700 | [diff] [blame] | 71 | DEFINE_SPINLOCK(krb5_seq_lock); |
J. Bruce Fields | eaa82ed | 2006-03-20 23:24:04 -0500 | [diff] [blame] | 72 | |
Jeff Layton | 6ac0fbb | 2014-07-16 06:52:20 -0400 | [diff] [blame] | 73 | static void * |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 74 | setup_token(struct krb5_ctx *ctx, struct xdr_netobj *token) |
| 75 | { |
Jeff Layton | 6ac0fbb | 2014-07-16 06:52:20 -0400 | [diff] [blame] | 76 | u16 *ptr; |
| 77 | void *krb5_hdr; |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 78 | int body_size = GSS_KRB5_TOK_HDR_LEN + ctx->gk5e->cksumlength; |
| 79 | |
| 80 | token->len = g_token_size(&ctx->mech_used, body_size); |
| 81 | |
Jeff Layton | 6ac0fbb | 2014-07-16 06:52:20 -0400 | [diff] [blame] | 82 | ptr = (u16 *)token->data; |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 83 | g_make_token_header(&ctx->mech_used, body_size, (unsigned char **)&ptr); |
| 84 | |
| 85 | /* ptr now at start of header described in rfc 1964, section 1.2.1: */ |
| 86 | krb5_hdr = ptr; |
| 87 | *ptr++ = KG_TOK_MIC_MSG; |
Jeff Layton | 6ac0fbb | 2014-07-16 06:52:20 -0400 | [diff] [blame] | 88 | /* |
| 89 | * signalg is stored as if it were converted from LE to host endian, even |
| 90 | * though it's an opaque pair of bytes according to the RFC. |
| 91 | */ |
| 92 | *ptr++ = (__force u16)cpu_to_le16(ctx->gk5e->signalg); |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 93 | *ptr++ = SEAL_ALG_NONE; |
Jeff Layton | 6ac0fbb | 2014-07-16 06:52:20 -0400 | [diff] [blame] | 94 | *ptr = 0xffff; |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 95 | |
Jeff Layton | 6ac0fbb | 2014-07-16 06:52:20 -0400 | [diff] [blame] | 96 | return krb5_hdr; |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 97 | } |
| 98 | |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 99 | static void * |
| 100 | setup_token_v2(struct krb5_ctx *ctx, struct xdr_netobj *token) |
| 101 | { |
Jeff Layton | 6ac0fbb | 2014-07-16 06:52:20 -0400 | [diff] [blame] | 102 | u16 *ptr; |
| 103 | void *krb5_hdr; |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 104 | u8 *p, flags = 0x00; |
| 105 | |
| 106 | if ((ctx->flags & KRB5_CTX_FLAG_INITIATOR) == 0) |
| 107 | flags |= 0x01; |
| 108 | if (ctx->flags & KRB5_CTX_FLAG_ACCEPTOR_SUBKEY) |
| 109 | flags |= 0x04; |
| 110 | |
| 111 | /* Per rfc 4121, sec 4.2.6.1, there is no header, |
| 112 | * just start the token */ |
Jeff Layton | 6ac0fbb | 2014-07-16 06:52:20 -0400 | [diff] [blame] | 113 | krb5_hdr = ptr = (u16 *)token->data; |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 114 | |
| 115 | *ptr++ = KG2_TOK_MIC; |
| 116 | p = (u8 *)ptr; |
| 117 | *p++ = flags; |
| 118 | *p++ = 0xff; |
Jeff Layton | 6ac0fbb | 2014-07-16 06:52:20 -0400 | [diff] [blame] | 119 | ptr = (u16 *)p; |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 120 | *ptr++ = 0xffff; |
Jeff Layton | 6ac0fbb | 2014-07-16 06:52:20 -0400 | [diff] [blame] | 121 | *ptr = 0xffff; |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 122 | |
| 123 | token->len = GSS_KRB5_TOK_HDR_LEN + ctx->gk5e->cksumlength; |
| 124 | return krb5_hdr; |
| 125 | } |
| 126 | |
Kevin Coffman | 1ac3719 | 2010-03-17 13:02:49 -0400 | [diff] [blame] | 127 | static u32 |
| 128 | gss_get_mic_v1(struct krb5_ctx *ctx, struct xdr_buf *text, |
J. Bruce Fields | a0857d0 | 2005-10-13 16:55:23 -0400 | [diff] [blame] | 129 | struct xdr_netobj *token) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 130 | { |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 131 | char cksumdata[GSS_KRB5_MAX_CKSUM_LEN]; |
| 132 | struct xdr_netobj md5cksum = {.len = sizeof(cksumdata), |
| 133 | .data = cksumdata}; |
| 134 | void *ptr; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 135 | s32 now; |
J. Bruce Fields | eaa82ed | 2006-03-20 23:24:04 -0500 | [diff] [blame] | 136 | u32 seq_send; |
Kevin Coffman | e1f6c07 | 2010-03-17 13:02:52 -0400 | [diff] [blame] | 137 | u8 *cksumkey; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 138 | |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 139 | dprintk("RPC: %s\n", __func__); |
Kevin Coffman | ef338be | 2007-11-09 18:42:09 -0500 | [diff] [blame] | 140 | BUG_ON(ctx == NULL); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 141 | |
| 142 | now = get_seconds(); |
| 143 | |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 144 | ptr = setup_token(ctx, token); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 145 | |
Kevin Coffman | e1f6c07 | 2010-03-17 13:02:52 -0400 | [diff] [blame] | 146 | if (ctx->gk5e->keyed_cksum) |
| 147 | cksumkey = ctx->cksum; |
| 148 | else |
| 149 | cksumkey = NULL; |
| 150 | |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 151 | if (make_checksum(ctx, ptr, 8, text, 0, cksumkey, |
| 152 | KG_USAGE_SIGN, &md5cksum)) |
J. Bruce Fields | 39a21dd | 2006-12-04 20:22:39 -0500 | [diff] [blame] | 153 | return GSS_S_FAILURE; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 154 | |
Kevin Coffman | e1f6c07 | 2010-03-17 13:02:52 -0400 | [diff] [blame] | 155 | memcpy(ptr + GSS_KRB5_TOK_HDR_LEN, md5cksum.data, md5cksum.len); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 156 | |
J. Bruce Fields | eaa82ed | 2006-03-20 23:24:04 -0500 | [diff] [blame] | 157 | spin_lock(&krb5_seq_lock); |
| 158 | seq_send = ctx->seq_send++; |
| 159 | spin_unlock(&krb5_seq_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 160 | |
Kevin Coffman | 1dbd902 | 2010-03-17 13:03:04 -0400 | [diff] [blame] | 161 | if (krb5_make_seq_num(ctx, ctx->seq, ctx->initiate ? 0 : 0xff, |
| 162 | seq_send, ptr + GSS_KRB5_TOK_HDR_LEN, ptr + 8)) |
J. Bruce Fields | 39a21dd | 2006-12-04 20:22:39 -0500 | [diff] [blame] | 163 | return GSS_S_FAILURE; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 164 | |
J. Bruce Fields | 94efa93 | 2006-12-04 20:22:42 -0500 | [diff] [blame] | 165 | return (ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 166 | } |
Kevin Coffman | 1ac3719 | 2010-03-17 13:02:49 -0400 | [diff] [blame] | 167 | |
Trond Myklebust | 09acfea | 2012-03-11 15:22:54 -0400 | [diff] [blame] | 168 | static u32 |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 169 | gss_get_mic_v2(struct krb5_ctx *ctx, struct xdr_buf *text, |
| 170 | struct xdr_netobj *token) |
| 171 | { |
| 172 | char cksumdata[GSS_KRB5_MAX_CKSUM_LEN]; |
| 173 | struct xdr_netobj cksumobj = { .len = sizeof(cksumdata), |
| 174 | .data = cksumdata}; |
| 175 | void *krb5_hdr; |
| 176 | s32 now; |
| 177 | u64 seq_send; |
| 178 | u8 *cksumkey; |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 179 | unsigned int cksum_usage; |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 180 | |
| 181 | dprintk("RPC: %s\n", __func__); |
| 182 | |
| 183 | krb5_hdr = setup_token_v2(ctx, token); |
| 184 | |
| 185 | /* Set up the sequence number. Now 64-bits in clear |
| 186 | * text and w/o direction indicator */ |
| 187 | spin_lock(&krb5_seq_lock); |
| 188 | seq_send = ctx->seq_send64++; |
| 189 | spin_unlock(&krb5_seq_lock); |
Jeff Layton | 6ac0fbb | 2014-07-16 06:52:20 -0400 | [diff] [blame] | 190 | *((__be64 *)(krb5_hdr + 8)) = cpu_to_be64(seq_send); |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 191 | |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 192 | if (ctx->initiate) { |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 193 | cksumkey = ctx->initiator_sign; |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 194 | cksum_usage = KG_USAGE_INITIATOR_SIGN; |
| 195 | } else { |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 196 | cksumkey = ctx->acceptor_sign; |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 197 | cksum_usage = KG_USAGE_ACCEPTOR_SIGN; |
| 198 | } |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 199 | |
| 200 | if (make_checksum_v2(ctx, krb5_hdr, GSS_KRB5_TOK_HDR_LEN, |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 201 | text, 0, cksumkey, cksum_usage, &cksumobj)) |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 202 | return GSS_S_FAILURE; |
| 203 | |
| 204 | memcpy(krb5_hdr + GSS_KRB5_TOK_HDR_LEN, cksumobj.data, cksumobj.len); |
| 205 | |
| 206 | now = get_seconds(); |
| 207 | |
| 208 | return (ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE; |
| 209 | } |
| 210 | |
| 211 | u32 |
Kevin Coffman | 1ac3719 | 2010-03-17 13:02:49 -0400 | [diff] [blame] | 212 | gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text, |
| 213 | struct xdr_netobj *token) |
| 214 | { |
| 215 | struct krb5_ctx *ctx = gss_ctx->internal_ctx_id; |
| 216 | |
| 217 | switch (ctx->enctype) { |
| 218 | default: |
| 219 | BUG(); |
| 220 | case ENCTYPE_DES_CBC_RAW: |
Kevin Coffman | 958142e | 2010-03-17 13:02:55 -0400 | [diff] [blame] | 221 | case ENCTYPE_DES3_CBC_RAW: |
Kevin Coffman | fffdaef | 2010-03-17 13:03:06 -0400 | [diff] [blame] | 222 | case ENCTYPE_ARCFOUR_HMAC: |
Kevin Coffman | 1ac3719 | 2010-03-17 13:02:49 -0400 | [diff] [blame] | 223 | return gss_get_mic_v1(ctx, text, token); |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 224 | case ENCTYPE_AES128_CTS_HMAC_SHA1_96: |
| 225 | case ENCTYPE_AES256_CTS_HMAC_SHA1_96: |
| 226 | return gss_get_mic_v2(ctx, text, token); |
Kevin Coffman | 1ac3719 | 2010-03-17 13:02:49 -0400 | [diff] [blame] | 227 | } |
| 228 | } |
| 229 | |