Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * linux/net/sunrpc/gss_krb5_crypto.c |
| 3 | * |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 4 | * Copyright (c) 2000-2008 The Regents of the University of Michigan. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 5 | * All rights reserved. |
| 6 | * |
| 7 | * Andy Adamson <andros@umich.edu> |
| 8 | * Bruce Fields <bfields@umich.edu> |
| 9 | */ |
| 10 | |
| 11 | /* |
| 12 | * Copyright (C) 1998 by the FundsXpress, INC. |
| 13 | * |
| 14 | * All rights reserved. |
| 15 | * |
| 16 | * Export of this software from the United States of America may require |
| 17 | * a specific license from the United States Government. It is the |
| 18 | * responsibility of any person or organization contemplating export to |
| 19 | * obtain such a license before exporting. |
| 20 | * |
| 21 | * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and |
| 22 | * distribute this software and its documentation for any purpose and |
| 23 | * without fee is hereby granted, provided that the above copyright |
| 24 | * notice appear in all copies and that both that copyright notice and |
| 25 | * this permission notice appear in supporting documentation, and that |
| 26 | * the name of FundsXpress. not be used in advertising or publicity pertaining |
| 27 | * to distribution of the software without specific, written prior |
| 28 | * permission. FundsXpress makes no representations about the suitability of |
| 29 | * this software for any purpose. It is provided "as is" without express |
| 30 | * or implied warranty. |
| 31 | * |
| 32 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR |
| 33 | * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED |
| 34 | * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. |
| 35 | */ |
| 36 | |
Herbert Xu | 3505868 | 2006-08-24 19:10:20 +1000 | [diff] [blame] | 37 | #include <linux/err.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 38 | #include <linux/types.h> |
| 39 | #include <linux/mm.h> |
David Hardeman | 378f058 | 2005-09-17 17:55:31 +1000 | [diff] [blame] | 40 | #include <linux/scatterlist.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 41 | #include <linux/crypto.h> |
| 42 | #include <linux/highmem.h> |
| 43 | #include <linux/pagemap.h> |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 44 | #include <linux/random.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 45 | #include <linux/sunrpc/gss_krb5.h> |
Olga Kornievskaia | 37a4e6c | 2006-12-04 20:22:33 -0500 | [diff] [blame] | 46 | #include <linux/sunrpc/xdr.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 47 | |
| 48 | #ifdef RPC_DEBUG |
| 49 | # define RPCDBG_FACILITY RPCDBG_AUTH |
| 50 | #endif |
| 51 | |
| 52 | u32 |
| 53 | krb5_encrypt( |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 54 | struct crypto_blkcipher *tfm, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 55 | void * iv, |
| 56 | void * in, |
| 57 | void * out, |
| 58 | int length) |
| 59 | { |
| 60 | u32 ret = -EINVAL; |
YOSHIFUJI Hideaki | cca5172 | 2007-02-09 15:38:13 -0800 | [diff] [blame] | 61 | struct scatterlist sg[1]; |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 62 | u8 local_iv[GSS_KRB5_MAX_BLOCKSIZE] = {0}; |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 63 | struct blkcipher_desc desc = { .tfm = tfm, .info = local_iv }; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 64 | |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 65 | if (length % crypto_blkcipher_blocksize(tfm) != 0) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 66 | goto out; |
| 67 | |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 68 | if (crypto_blkcipher_ivsize(tfm) > GSS_KRB5_MAX_BLOCKSIZE) { |
Kevin Coffman | 3d4a688 | 2008-02-21 13:44:12 -0500 | [diff] [blame] | 69 | dprintk("RPC: gss_k5encrypt: tfm iv size too large %d\n", |
| 70 | crypto_blkcipher_ivsize(tfm)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 71 | goto out; |
| 72 | } |
| 73 | |
| 74 | if (iv) |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 75 | memcpy(local_iv, iv, crypto_blkcipher_ivsize(tfm)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 76 | |
| 77 | memcpy(out, in, length); |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 78 | sg_init_one(sg, out, length); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 79 | |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 80 | ret = crypto_blkcipher_encrypt_iv(&desc, sg, sg, length); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 81 | out: |
Chuck Lever | 8885cb3 | 2007-01-31 12:14:05 -0500 | [diff] [blame] | 82 | dprintk("RPC: krb5_encrypt returns %d\n", ret); |
J. Bruce Fields | 8fc7500 | 2006-12-04 20:22:31 -0500 | [diff] [blame] | 83 | return ret; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 84 | } |
| 85 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 86 | u32 |
| 87 | krb5_decrypt( |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 88 | struct crypto_blkcipher *tfm, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 89 | void * iv, |
| 90 | void * in, |
| 91 | void * out, |
| 92 | int length) |
| 93 | { |
| 94 | u32 ret = -EINVAL; |
| 95 | struct scatterlist sg[1]; |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 96 | u8 local_iv[GSS_KRB5_MAX_BLOCKSIZE] = {0}; |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 97 | struct blkcipher_desc desc = { .tfm = tfm, .info = local_iv }; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 98 | |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 99 | if (length % crypto_blkcipher_blocksize(tfm) != 0) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 100 | goto out; |
| 101 | |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 102 | if (crypto_blkcipher_ivsize(tfm) > GSS_KRB5_MAX_BLOCKSIZE) { |
Kevin Coffman | 3d4a688 | 2008-02-21 13:44:12 -0500 | [diff] [blame] | 103 | dprintk("RPC: gss_k5decrypt: tfm iv size too large %d\n", |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 104 | crypto_blkcipher_ivsize(tfm)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 105 | goto out; |
| 106 | } |
| 107 | if (iv) |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 108 | memcpy(local_iv,iv, crypto_blkcipher_ivsize(tfm)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 109 | |
| 110 | memcpy(out, in, length); |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 111 | sg_init_one(sg, out, length); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 112 | |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 113 | ret = crypto_blkcipher_decrypt_iv(&desc, sg, sg, length); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 114 | out: |
Chuck Lever | 8885cb3 | 2007-01-31 12:14:05 -0500 | [diff] [blame] | 115 | dprintk("RPC: gss_k5decrypt returns %d\n",ret); |
J. Bruce Fields | 8fc7500 | 2006-12-04 20:22:31 -0500 | [diff] [blame] | 116 | return ret; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 117 | } |
| 118 | |
J. Bruce Fields | f7b3af6 | 2005-10-13 16:55:03 -0400 | [diff] [blame] | 119 | static int |
J. Bruce Fields | f7b3af6 | 2005-10-13 16:55:03 -0400 | [diff] [blame] | 120 | checksummer(struct scatterlist *sg, void *data) |
| 121 | { |
Herbert Xu | 3505868 | 2006-08-24 19:10:20 +1000 | [diff] [blame] | 122 | struct hash_desc *desc = data; |
J. Bruce Fields | f7b3af6 | 2005-10-13 16:55:03 -0400 | [diff] [blame] | 123 | |
Herbert Xu | 3505868 | 2006-08-24 19:10:20 +1000 | [diff] [blame] | 124 | return crypto_hash_update(desc, sg, sg->length); |
J. Bruce Fields | f7b3af6 | 2005-10-13 16:55:03 -0400 | [diff] [blame] | 125 | } |
| 126 | |
Kevin Coffman | fffdaef | 2010-03-17 13:03:06 -0400 | [diff] [blame] | 127 | static int |
| 128 | arcfour_hmac_md5_usage_to_salt(unsigned int usage, u8 salt[4]) |
| 129 | { |
| 130 | unsigned int ms_usage; |
| 131 | |
| 132 | switch (usage) { |
| 133 | case KG_USAGE_SIGN: |
| 134 | ms_usage = 15; |
| 135 | break; |
| 136 | case KG_USAGE_SEAL: |
| 137 | ms_usage = 13; |
| 138 | break; |
| 139 | default: |
Joe Perches | f3c0cee | 2010-11-14 18:08:11 -0800 | [diff] [blame] | 140 | return -EINVAL; |
Kevin Coffman | fffdaef | 2010-03-17 13:03:06 -0400 | [diff] [blame] | 141 | } |
| 142 | salt[0] = (ms_usage >> 0) & 0xff; |
| 143 | salt[1] = (ms_usage >> 8) & 0xff; |
| 144 | salt[2] = (ms_usage >> 16) & 0xff; |
| 145 | salt[3] = (ms_usage >> 24) & 0xff; |
| 146 | |
| 147 | return 0; |
| 148 | } |
| 149 | |
| 150 | static u32 |
| 151 | make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen, |
| 152 | struct xdr_buf *body, int body_offset, u8 *cksumkey, |
| 153 | unsigned int usage, struct xdr_netobj *cksumout) |
| 154 | { |
| 155 | struct hash_desc desc; |
| 156 | struct scatterlist sg[1]; |
| 157 | int err; |
| 158 | u8 checksumdata[GSS_KRB5_MAX_CKSUM_LEN]; |
| 159 | u8 rc4salt[4]; |
| 160 | struct crypto_hash *md5; |
| 161 | struct crypto_hash *hmac_md5; |
| 162 | |
| 163 | if (cksumkey == NULL) |
| 164 | return GSS_S_FAILURE; |
| 165 | |
| 166 | if (cksumout->len < kctx->gk5e->cksumlength) { |
| 167 | dprintk("%s: checksum buffer length, %u, too small for %s\n", |
| 168 | __func__, cksumout->len, kctx->gk5e->name); |
| 169 | return GSS_S_FAILURE; |
| 170 | } |
| 171 | |
| 172 | if (arcfour_hmac_md5_usage_to_salt(usage, rc4salt)) { |
| 173 | dprintk("%s: invalid usage value %u\n", __func__, usage); |
| 174 | return GSS_S_FAILURE; |
| 175 | } |
| 176 | |
| 177 | md5 = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); |
| 178 | if (IS_ERR(md5)) |
| 179 | return GSS_S_FAILURE; |
| 180 | |
| 181 | hmac_md5 = crypto_alloc_hash(kctx->gk5e->cksum_name, 0, |
| 182 | CRYPTO_ALG_ASYNC); |
| 183 | if (IS_ERR(hmac_md5)) { |
| 184 | crypto_free_hash(md5); |
| 185 | return GSS_S_FAILURE; |
| 186 | } |
| 187 | |
| 188 | desc.tfm = md5; |
| 189 | desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP; |
| 190 | |
| 191 | err = crypto_hash_init(&desc); |
| 192 | if (err) |
| 193 | goto out; |
| 194 | sg_init_one(sg, rc4salt, 4); |
| 195 | err = crypto_hash_update(&desc, sg, 4); |
| 196 | if (err) |
| 197 | goto out; |
| 198 | |
| 199 | sg_init_one(sg, header, hdrlen); |
| 200 | err = crypto_hash_update(&desc, sg, hdrlen); |
| 201 | if (err) |
| 202 | goto out; |
| 203 | err = xdr_process_buf(body, body_offset, body->len - body_offset, |
| 204 | checksummer, &desc); |
| 205 | if (err) |
| 206 | goto out; |
| 207 | err = crypto_hash_final(&desc, checksumdata); |
| 208 | if (err) |
| 209 | goto out; |
| 210 | |
| 211 | desc.tfm = hmac_md5; |
| 212 | desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP; |
| 213 | |
| 214 | err = crypto_hash_init(&desc); |
| 215 | if (err) |
| 216 | goto out; |
| 217 | err = crypto_hash_setkey(hmac_md5, cksumkey, kctx->gk5e->keylength); |
| 218 | if (err) |
| 219 | goto out; |
| 220 | |
| 221 | sg_init_one(sg, checksumdata, crypto_hash_digestsize(md5)); |
| 222 | err = crypto_hash_digest(&desc, sg, crypto_hash_digestsize(md5), |
| 223 | checksumdata); |
| 224 | if (err) |
| 225 | goto out; |
| 226 | |
| 227 | memcpy(cksumout->data, checksumdata, kctx->gk5e->cksumlength); |
| 228 | cksumout->len = kctx->gk5e->cksumlength; |
| 229 | out: |
| 230 | crypto_free_hash(md5); |
| 231 | crypto_free_hash(hmac_md5); |
| 232 | return err ? GSS_S_FAILURE : 0; |
| 233 | } |
| 234 | |
Kevin Coffman | e1f6c07 | 2010-03-17 13:02:52 -0400 | [diff] [blame] | 235 | /* |
| 236 | * checksum the plaintext data and hdrlen bytes of the token header |
| 237 | * The checksum is performed over the first 8 bytes of the |
| 238 | * gss token header and then over the data body |
| 239 | */ |
| 240 | u32 |
| 241 | make_checksum(struct krb5_ctx *kctx, char *header, int hdrlen, |
| 242 | struct xdr_buf *body, int body_offset, u8 *cksumkey, |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 243 | unsigned int usage, struct xdr_netobj *cksumout) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 244 | { |
Kevin Coffman | e1f6c07 | 2010-03-17 13:02:52 -0400 | [diff] [blame] | 245 | struct hash_desc desc; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 246 | struct scatterlist sg[1]; |
Herbert Xu | 3505868 | 2006-08-24 19:10:20 +1000 | [diff] [blame] | 247 | int err; |
Kevin Coffman | e1f6c07 | 2010-03-17 13:02:52 -0400 | [diff] [blame] | 248 | u8 checksumdata[GSS_KRB5_MAX_CKSUM_LEN]; |
| 249 | unsigned int checksumlen; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 250 | |
Kevin Coffman | fffdaef | 2010-03-17 13:03:06 -0400 | [diff] [blame] | 251 | if (kctx->gk5e->ctype == CKSUMTYPE_HMAC_MD5_ARCFOUR) |
| 252 | return make_checksum_hmac_md5(kctx, header, hdrlen, |
| 253 | body, body_offset, |
| 254 | cksumkey, usage, cksumout); |
| 255 | |
Kevin Coffman | e1f6c07 | 2010-03-17 13:02:52 -0400 | [diff] [blame] | 256 | if (cksumout->len < kctx->gk5e->cksumlength) { |
| 257 | dprintk("%s: checksum buffer length, %u, too small for %s\n", |
| 258 | __func__, cksumout->len, kctx->gk5e->name); |
| 259 | return GSS_S_FAILURE; |
| 260 | } |
| 261 | |
| 262 | desc.tfm = crypto_alloc_hash(kctx->gk5e->cksum_name, 0, CRYPTO_ALG_ASYNC); |
Herbert Xu | 3505868 | 2006-08-24 19:10:20 +1000 | [diff] [blame] | 263 | if (IS_ERR(desc.tfm)) |
J. Bruce Fields | d4a30e7 | 2006-04-18 13:14:02 -0400 | [diff] [blame] | 264 | return GSS_S_FAILURE; |
Herbert Xu | 3505868 | 2006-08-24 19:10:20 +1000 | [diff] [blame] | 265 | desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 266 | |
Kevin Coffman | e1f6c07 | 2010-03-17 13:02:52 -0400 | [diff] [blame] | 267 | checksumlen = crypto_hash_digestsize(desc.tfm); |
| 268 | |
| 269 | if (cksumkey != NULL) { |
| 270 | err = crypto_hash_setkey(desc.tfm, cksumkey, |
| 271 | kctx->gk5e->keylength); |
| 272 | if (err) |
| 273 | goto out; |
| 274 | } |
| 275 | |
Herbert Xu | 3505868 | 2006-08-24 19:10:20 +1000 | [diff] [blame] | 276 | err = crypto_hash_init(&desc); |
| 277 | if (err) |
| 278 | goto out; |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 279 | sg_init_one(sg, header, hdrlen); |
Herbert Xu | 3505868 | 2006-08-24 19:10:20 +1000 | [diff] [blame] | 280 | err = crypto_hash_update(&desc, sg, hdrlen); |
| 281 | if (err) |
| 282 | goto out; |
Olga Kornievskaia | 37a4e6c | 2006-12-04 20:22:33 -0500 | [diff] [blame] | 283 | err = xdr_process_buf(body, body_offset, body->len - body_offset, |
Herbert Xu | 3505868 | 2006-08-24 19:10:20 +1000 | [diff] [blame] | 284 | checksummer, &desc); |
| 285 | if (err) |
| 286 | goto out; |
Kevin Coffman | e1f6c07 | 2010-03-17 13:02:52 -0400 | [diff] [blame] | 287 | err = crypto_hash_final(&desc, checksumdata); |
| 288 | if (err) |
| 289 | goto out; |
Herbert Xu | 3505868 | 2006-08-24 19:10:20 +1000 | [diff] [blame] | 290 | |
Kevin Coffman | e1f6c07 | 2010-03-17 13:02:52 -0400 | [diff] [blame] | 291 | switch (kctx->gk5e->ctype) { |
| 292 | case CKSUMTYPE_RSA_MD5: |
| 293 | err = kctx->gk5e->encrypt(kctx->seq, NULL, checksumdata, |
| 294 | checksumdata, checksumlen); |
| 295 | if (err) |
| 296 | goto out; |
| 297 | memcpy(cksumout->data, |
| 298 | checksumdata + checksumlen - kctx->gk5e->cksumlength, |
| 299 | kctx->gk5e->cksumlength); |
| 300 | break; |
Kevin Coffman | 958142e | 2010-03-17 13:02:55 -0400 | [diff] [blame] | 301 | case CKSUMTYPE_HMAC_SHA1_DES3: |
| 302 | memcpy(cksumout->data, checksumdata, kctx->gk5e->cksumlength); |
| 303 | break; |
Kevin Coffman | e1f6c07 | 2010-03-17 13:02:52 -0400 | [diff] [blame] | 304 | default: |
| 305 | BUG(); |
| 306 | break; |
| 307 | } |
| 308 | cksumout->len = kctx->gk5e->cksumlength; |
Herbert Xu | 3505868 | 2006-08-24 19:10:20 +1000 | [diff] [blame] | 309 | out: |
| 310 | crypto_free_hash(desc.tfm); |
| 311 | return err ? GSS_S_FAILURE : 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 312 | } |
| 313 | |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 314 | /* |
| 315 | * checksum the plaintext data and hdrlen bytes of the token header |
| 316 | * Per rfc4121, sec. 4.2.4, the checksum is performed over the data |
| 317 | * body then over the first 16 octets of the MIC token |
| 318 | * Inclusion of the header data in the calculation of the |
| 319 | * checksum is optional. |
| 320 | */ |
| 321 | u32 |
| 322 | make_checksum_v2(struct krb5_ctx *kctx, char *header, int hdrlen, |
| 323 | struct xdr_buf *body, int body_offset, u8 *cksumkey, |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 324 | unsigned int usage, struct xdr_netobj *cksumout) |
Kevin Coffman | de9c17e | 2010-03-17 13:02:59 -0400 | [diff] [blame] | 325 | { |
| 326 | struct hash_desc desc; |
| 327 | struct scatterlist sg[1]; |
| 328 | int err; |
| 329 | u8 checksumdata[GSS_KRB5_MAX_CKSUM_LEN]; |
| 330 | unsigned int checksumlen; |
| 331 | |
| 332 | if (kctx->gk5e->keyed_cksum == 0) { |
| 333 | dprintk("%s: expected keyed hash for %s\n", |
| 334 | __func__, kctx->gk5e->name); |
| 335 | return GSS_S_FAILURE; |
| 336 | } |
| 337 | if (cksumkey == NULL) { |
| 338 | dprintk("%s: no key supplied for %s\n", |
| 339 | __func__, kctx->gk5e->name); |
| 340 | return GSS_S_FAILURE; |
| 341 | } |
| 342 | |
| 343 | desc.tfm = crypto_alloc_hash(kctx->gk5e->cksum_name, 0, |
| 344 | CRYPTO_ALG_ASYNC); |
| 345 | if (IS_ERR(desc.tfm)) |
| 346 | return GSS_S_FAILURE; |
| 347 | checksumlen = crypto_hash_digestsize(desc.tfm); |
| 348 | desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP; |
| 349 | |
| 350 | err = crypto_hash_setkey(desc.tfm, cksumkey, kctx->gk5e->keylength); |
| 351 | if (err) |
| 352 | goto out; |
| 353 | |
| 354 | err = crypto_hash_init(&desc); |
| 355 | if (err) |
| 356 | goto out; |
| 357 | err = xdr_process_buf(body, body_offset, body->len - body_offset, |
| 358 | checksummer, &desc); |
| 359 | if (err) |
| 360 | goto out; |
| 361 | if (header != NULL) { |
| 362 | sg_init_one(sg, header, hdrlen); |
| 363 | err = crypto_hash_update(&desc, sg, hdrlen); |
| 364 | if (err) |
| 365 | goto out; |
| 366 | } |
| 367 | err = crypto_hash_final(&desc, checksumdata); |
| 368 | if (err) |
| 369 | goto out; |
| 370 | |
| 371 | cksumout->len = kctx->gk5e->cksumlength; |
| 372 | |
| 373 | switch (kctx->gk5e->ctype) { |
| 374 | case CKSUMTYPE_HMAC_SHA1_96_AES128: |
| 375 | case CKSUMTYPE_HMAC_SHA1_96_AES256: |
| 376 | /* note that this truncates the hash */ |
| 377 | memcpy(cksumout->data, checksumdata, kctx->gk5e->cksumlength); |
| 378 | break; |
| 379 | default: |
| 380 | BUG(); |
| 381 | break; |
| 382 | } |
| 383 | out: |
| 384 | crypto_free_hash(desc.tfm); |
| 385 | return err ? GSS_S_FAILURE : 0; |
| 386 | } |
| 387 | |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 388 | struct encryptor_desc { |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 389 | u8 iv[GSS_KRB5_MAX_BLOCKSIZE]; |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 390 | struct blkcipher_desc desc; |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 391 | int pos; |
| 392 | struct xdr_buf *outbuf; |
| 393 | struct page **pages; |
| 394 | struct scatterlist infrags[4]; |
| 395 | struct scatterlist outfrags[4]; |
| 396 | int fragno; |
| 397 | int fraglen; |
| 398 | }; |
| 399 | |
| 400 | static int |
| 401 | encryptor(struct scatterlist *sg, void *data) |
| 402 | { |
| 403 | struct encryptor_desc *desc = data; |
| 404 | struct xdr_buf *outbuf = desc->outbuf; |
| 405 | struct page *in_page; |
| 406 | int thislen = desc->fraglen + sg->length; |
| 407 | int fraglen, ret; |
| 408 | int page_pos; |
| 409 | |
| 410 | /* Worst case is 4 fragments: head, end of page 1, start |
| 411 | * of page 2, tail. Anything more is a bug. */ |
| 412 | BUG_ON(desc->fragno > 3); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 413 | |
| 414 | page_pos = desc->pos - outbuf->head[0].iov_len; |
| 415 | if (page_pos >= 0 && page_pos < outbuf->page_len) { |
| 416 | /* pages are not in place: */ |
| 417 | int i = (page_pos + outbuf->page_base) >> PAGE_CACHE_SHIFT; |
| 418 | in_page = desc->pages[i]; |
| 419 | } else { |
Jens Axboe | fa05f12 | 2007-10-22 19:44:26 +0200 | [diff] [blame] | 420 | in_page = sg_page(sg); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 421 | } |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 422 | sg_set_page(&desc->infrags[desc->fragno], in_page, sg->length, |
| 423 | sg->offset); |
| 424 | sg_set_page(&desc->outfrags[desc->fragno], sg_page(sg), sg->length, |
| 425 | sg->offset); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 426 | desc->fragno++; |
| 427 | desc->fraglen += sg->length; |
| 428 | desc->pos += sg->length; |
| 429 | |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 430 | fraglen = thislen & (crypto_blkcipher_blocksize(desc->desc.tfm) - 1); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 431 | thislen -= fraglen; |
| 432 | |
| 433 | if (thislen == 0) |
| 434 | return 0; |
| 435 | |
Jens Axboe | c46f233 | 2007-10-31 12:06:37 +0100 | [diff] [blame] | 436 | sg_mark_end(&desc->infrags[desc->fragno - 1]); |
| 437 | sg_mark_end(&desc->outfrags[desc->fragno - 1]); |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 438 | |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 439 | ret = crypto_blkcipher_encrypt_iv(&desc->desc, desc->outfrags, |
| 440 | desc->infrags, thislen); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 441 | if (ret) |
| 442 | return ret; |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 443 | |
| 444 | sg_init_table(desc->infrags, 4); |
| 445 | sg_init_table(desc->outfrags, 4); |
| 446 | |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 447 | if (fraglen) { |
Jens Axboe | 642f149 | 2007-10-24 11:20:47 +0200 | [diff] [blame] | 448 | sg_set_page(&desc->outfrags[0], sg_page(sg), fraglen, |
| 449 | sg->offset + sg->length - fraglen); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 450 | desc->infrags[0] = desc->outfrags[0]; |
Jens Axboe | 642f149 | 2007-10-24 11:20:47 +0200 | [diff] [blame] | 451 | sg_assign_page(&desc->infrags[0], in_page); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 452 | desc->fragno = 1; |
| 453 | desc->fraglen = fraglen; |
| 454 | } else { |
| 455 | desc->fragno = 0; |
| 456 | desc->fraglen = 0; |
| 457 | } |
| 458 | return 0; |
| 459 | } |
| 460 | |
| 461 | int |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 462 | gss_encrypt_xdr_buf(struct crypto_blkcipher *tfm, struct xdr_buf *buf, |
| 463 | int offset, struct page **pages) |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 464 | { |
| 465 | int ret; |
| 466 | struct encryptor_desc desc; |
| 467 | |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 468 | BUG_ON((buf->len - offset) % crypto_blkcipher_blocksize(tfm) != 0); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 469 | |
| 470 | memset(desc.iv, 0, sizeof(desc.iv)); |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 471 | desc.desc.tfm = tfm; |
| 472 | desc.desc.info = desc.iv; |
| 473 | desc.desc.flags = 0; |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 474 | desc.pos = offset; |
| 475 | desc.outbuf = buf; |
| 476 | desc.pages = pages; |
| 477 | desc.fragno = 0; |
| 478 | desc.fraglen = 0; |
| 479 | |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 480 | sg_init_table(desc.infrags, 4); |
| 481 | sg_init_table(desc.outfrags, 4); |
| 482 | |
Olga Kornievskaia | 37a4e6c | 2006-12-04 20:22:33 -0500 | [diff] [blame] | 483 | ret = xdr_process_buf(buf, offset, buf->len - offset, encryptor, &desc); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 484 | return ret; |
| 485 | } |
| 486 | |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 487 | struct decryptor_desc { |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 488 | u8 iv[GSS_KRB5_MAX_BLOCKSIZE]; |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 489 | struct blkcipher_desc desc; |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 490 | struct scatterlist frags[4]; |
| 491 | int fragno; |
| 492 | int fraglen; |
| 493 | }; |
| 494 | |
| 495 | static int |
| 496 | decryptor(struct scatterlist *sg, void *data) |
| 497 | { |
| 498 | struct decryptor_desc *desc = data; |
| 499 | int thislen = desc->fraglen + sg->length; |
| 500 | int fraglen, ret; |
| 501 | |
| 502 | /* Worst case is 4 fragments: head, end of page 1, start |
| 503 | * of page 2, tail. Anything more is a bug. */ |
| 504 | BUG_ON(desc->fragno > 3); |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 505 | sg_set_page(&desc->frags[desc->fragno], sg_page(sg), sg->length, |
| 506 | sg->offset); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 507 | desc->fragno++; |
| 508 | desc->fraglen += sg->length; |
| 509 | |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame] | 510 | fraglen = thislen & (crypto_blkcipher_blocksize(desc->desc.tfm) - 1); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 511 | thislen -= fraglen; |
| 512 | |
| 513 | if (thislen == 0) |
| 514 | return 0; |
| 515 | |
Jens Axboe | c46f233 | 2007-10-31 12:06:37 +0100 | [diff] [blame] | 516 | sg_mark_end(&desc->frags[desc->fragno - 1]); |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 517 | |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 518 | ret = crypto_blkcipher_decrypt_iv(&desc->desc, desc->frags, |
| 519 | desc->frags, thislen); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 520 | if (ret) |
| 521 | return ret; |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 522 | |
| 523 | sg_init_table(desc->frags, 4); |
| 524 | |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 525 | if (fraglen) { |
Jens Axboe | 642f149 | 2007-10-24 11:20:47 +0200 | [diff] [blame] | 526 | sg_set_page(&desc->frags[0], sg_page(sg), fraglen, |
| 527 | sg->offset + sg->length - fraglen); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 528 | desc->fragno = 1; |
| 529 | desc->fraglen = fraglen; |
| 530 | } else { |
| 531 | desc->fragno = 0; |
| 532 | desc->fraglen = 0; |
| 533 | } |
| 534 | return 0; |
| 535 | } |
| 536 | |
| 537 | int |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 538 | gss_decrypt_xdr_buf(struct crypto_blkcipher *tfm, struct xdr_buf *buf, |
| 539 | int offset) |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 540 | { |
| 541 | struct decryptor_desc desc; |
| 542 | |
| 543 | /* XXXJBF: */ |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 544 | BUG_ON((buf->len - offset) % crypto_blkcipher_blocksize(tfm) != 0); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 545 | |
| 546 | memset(desc.iv, 0, sizeof(desc.iv)); |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 547 | desc.desc.tfm = tfm; |
| 548 | desc.desc.info = desc.iv; |
| 549 | desc.desc.flags = 0; |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 550 | desc.fragno = 0; |
| 551 | desc.fraglen = 0; |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 552 | |
| 553 | sg_init_table(desc.frags, 4); |
| 554 | |
Olga Kornievskaia | 37a4e6c | 2006-12-04 20:22:33 -0500 | [diff] [blame] | 555 | return xdr_process_buf(buf, offset, buf->len - offset, decryptor, &desc); |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 556 | } |
Kevin Coffman | 725f286 | 2010-03-17 13:02:46 -0400 | [diff] [blame] | 557 | |
| 558 | /* |
| 559 | * This function makes the assumption that it was ultimately called |
| 560 | * from gss_wrap(). |
| 561 | * |
| 562 | * The client auth_gss code moves any existing tail data into a |
| 563 | * separate page before calling gss_wrap. |
| 564 | * The server svcauth_gss code ensures that both the head and the |
| 565 | * tail have slack space of RPC_MAX_AUTH_SIZE before calling gss_wrap. |
| 566 | * |
| 567 | * Even with that guarantee, this function may be called more than |
| 568 | * once in the processing of gss_wrap(). The best we can do is |
| 569 | * verify at compile-time (see GSS_KRB5_SLACK_CHECK) that the |
| 570 | * largest expected shift will fit within RPC_MAX_AUTH_SIZE. |
| 571 | * At run-time we can verify that a single invocation of this |
| 572 | * function doesn't attempt to use more the RPC_MAX_AUTH_SIZE. |
| 573 | */ |
| 574 | |
| 575 | int |
| 576 | xdr_extend_head(struct xdr_buf *buf, unsigned int base, unsigned int shiftlen) |
| 577 | { |
| 578 | u8 *p; |
| 579 | |
| 580 | if (shiftlen == 0) |
| 581 | return 0; |
| 582 | |
| 583 | BUILD_BUG_ON(GSS_KRB5_MAX_SLACK_NEEDED > RPC_MAX_AUTH_SIZE); |
| 584 | BUG_ON(shiftlen > RPC_MAX_AUTH_SIZE); |
| 585 | |
| 586 | p = buf->head[0].iov_base + base; |
| 587 | |
| 588 | memmove(p + shiftlen, p, buf->head[0].iov_len - base); |
| 589 | |
| 590 | buf->head[0].iov_len += shiftlen; |
| 591 | buf->len += shiftlen; |
| 592 | |
| 593 | return 0; |
| 594 | } |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 595 | |
| 596 | static u32 |
| 597 | gss_krb5_cts_crypt(struct crypto_blkcipher *cipher, struct xdr_buf *buf, |
| 598 | u32 offset, u8 *iv, struct page **pages, int encrypt) |
| 599 | { |
| 600 | u32 ret; |
| 601 | struct scatterlist sg[1]; |
| 602 | struct blkcipher_desc desc = { .tfm = cipher, .info = iv }; |
Trond Myklebust | 0097143 | 2012-03-12 13:29:05 -0400 | [diff] [blame] | 603 | u8 data[GSS_KRB5_MAX_BLOCKSIZE * 2]; |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 604 | struct page **save_pages; |
| 605 | u32 len = buf->len - offset; |
| 606 | |
Trond Myklebust | 0097143 | 2012-03-12 13:29:05 -0400 | [diff] [blame] | 607 | if (len > ARRAY_SIZE(data)) { |
| 608 | WARN_ON(0); |
| 609 | return -ENOMEM; |
| 610 | } |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 611 | |
| 612 | /* |
| 613 | * For encryption, we want to read from the cleartext |
| 614 | * page cache pages, and write the encrypted data to |
| 615 | * the supplied xdr_buf pages. |
| 616 | */ |
| 617 | save_pages = buf->pages; |
| 618 | if (encrypt) |
| 619 | buf->pages = pages; |
| 620 | |
| 621 | ret = read_bytes_from_xdr_buf(buf, offset, data, len); |
| 622 | buf->pages = save_pages; |
| 623 | if (ret) |
| 624 | goto out; |
| 625 | |
| 626 | sg_init_one(sg, data, len); |
| 627 | |
| 628 | if (encrypt) |
| 629 | ret = crypto_blkcipher_encrypt_iv(&desc, sg, sg, len); |
| 630 | else |
| 631 | ret = crypto_blkcipher_decrypt_iv(&desc, sg, sg, len); |
| 632 | |
| 633 | if (ret) |
| 634 | goto out; |
| 635 | |
| 636 | ret = write_bytes_to_xdr_buf(buf, offset, data, len); |
| 637 | |
| 638 | out: |
| 639 | return ret; |
| 640 | } |
| 641 | |
| 642 | u32 |
| 643 | gss_krb5_aes_encrypt(struct krb5_ctx *kctx, u32 offset, |
| 644 | struct xdr_buf *buf, int ec, struct page **pages) |
| 645 | { |
| 646 | u32 err; |
| 647 | struct xdr_netobj hmac; |
| 648 | u8 *cksumkey; |
| 649 | u8 *ecptr; |
| 650 | struct crypto_blkcipher *cipher, *aux_cipher; |
| 651 | int blocksize; |
| 652 | struct page **save_pages; |
| 653 | int nblocks, nbytes; |
| 654 | struct encryptor_desc desc; |
| 655 | u32 cbcbytes; |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 656 | unsigned int usage; |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 657 | |
| 658 | if (kctx->initiate) { |
| 659 | cipher = kctx->initiator_enc; |
| 660 | aux_cipher = kctx->initiator_enc_aux; |
| 661 | cksumkey = kctx->initiator_integ; |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 662 | usage = KG_USAGE_INITIATOR_SEAL; |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 663 | } else { |
| 664 | cipher = kctx->acceptor_enc; |
| 665 | aux_cipher = kctx->acceptor_enc_aux; |
| 666 | cksumkey = kctx->acceptor_integ; |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 667 | usage = KG_USAGE_ACCEPTOR_SEAL; |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 668 | } |
| 669 | blocksize = crypto_blkcipher_blocksize(cipher); |
| 670 | |
| 671 | /* hide the gss token header and insert the confounder */ |
| 672 | offset += GSS_KRB5_TOK_HDR_LEN; |
Kevin Coffman | 5af4654 | 2010-03-17 13:03:05 -0400 | [diff] [blame] | 673 | if (xdr_extend_head(buf, offset, kctx->gk5e->conflen)) |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 674 | return GSS_S_FAILURE; |
Kevin Coffman | 5af4654 | 2010-03-17 13:03:05 -0400 | [diff] [blame] | 675 | gss_krb5_make_confounder(buf->head[0].iov_base + offset, kctx->gk5e->conflen); |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 676 | offset -= GSS_KRB5_TOK_HDR_LEN; |
| 677 | |
| 678 | if (buf->tail[0].iov_base != NULL) { |
| 679 | ecptr = buf->tail[0].iov_base + buf->tail[0].iov_len; |
| 680 | } else { |
| 681 | buf->tail[0].iov_base = buf->head[0].iov_base |
| 682 | + buf->head[0].iov_len; |
| 683 | buf->tail[0].iov_len = 0; |
| 684 | ecptr = buf->tail[0].iov_base; |
| 685 | } |
| 686 | |
| 687 | memset(ecptr, 'X', ec); |
| 688 | buf->tail[0].iov_len += ec; |
| 689 | buf->len += ec; |
| 690 | |
| 691 | /* copy plaintext gss token header after filler (if any) */ |
| 692 | memcpy(ecptr + ec, buf->head[0].iov_base + offset, |
| 693 | GSS_KRB5_TOK_HDR_LEN); |
| 694 | buf->tail[0].iov_len += GSS_KRB5_TOK_HDR_LEN; |
| 695 | buf->len += GSS_KRB5_TOK_HDR_LEN; |
| 696 | |
| 697 | /* Do the HMAC */ |
| 698 | hmac.len = GSS_KRB5_MAX_CKSUM_LEN; |
| 699 | hmac.data = buf->tail[0].iov_base + buf->tail[0].iov_len; |
| 700 | |
| 701 | /* |
| 702 | * When we are called, pages points to the real page cache |
| 703 | * data -- which we can't go and encrypt! buf->pages points |
| 704 | * to scratch pages which we are going to send off to the |
| 705 | * client/server. Swap in the plaintext pages to calculate |
| 706 | * the hmac. |
| 707 | */ |
| 708 | save_pages = buf->pages; |
| 709 | buf->pages = pages; |
| 710 | |
| 711 | err = make_checksum_v2(kctx, NULL, 0, buf, |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 712 | offset + GSS_KRB5_TOK_HDR_LEN, |
| 713 | cksumkey, usage, &hmac); |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 714 | buf->pages = save_pages; |
| 715 | if (err) |
| 716 | return GSS_S_FAILURE; |
| 717 | |
| 718 | nbytes = buf->len - offset - GSS_KRB5_TOK_HDR_LEN; |
| 719 | nblocks = (nbytes + blocksize - 1) / blocksize; |
| 720 | cbcbytes = 0; |
| 721 | if (nblocks > 2) |
| 722 | cbcbytes = (nblocks - 2) * blocksize; |
| 723 | |
| 724 | memset(desc.iv, 0, sizeof(desc.iv)); |
| 725 | |
| 726 | if (cbcbytes) { |
| 727 | desc.pos = offset + GSS_KRB5_TOK_HDR_LEN; |
| 728 | desc.fragno = 0; |
| 729 | desc.fraglen = 0; |
| 730 | desc.pages = pages; |
| 731 | desc.outbuf = buf; |
| 732 | desc.desc.info = desc.iv; |
| 733 | desc.desc.flags = 0; |
| 734 | desc.desc.tfm = aux_cipher; |
| 735 | |
| 736 | sg_init_table(desc.infrags, 4); |
| 737 | sg_init_table(desc.outfrags, 4); |
| 738 | |
| 739 | err = xdr_process_buf(buf, offset + GSS_KRB5_TOK_HDR_LEN, |
| 740 | cbcbytes, encryptor, &desc); |
| 741 | if (err) |
| 742 | goto out_err; |
| 743 | } |
| 744 | |
| 745 | /* Make sure IV carries forward from any CBC results. */ |
| 746 | err = gss_krb5_cts_crypt(cipher, buf, |
| 747 | offset + GSS_KRB5_TOK_HDR_LEN + cbcbytes, |
| 748 | desc.iv, pages, 1); |
| 749 | if (err) { |
| 750 | err = GSS_S_FAILURE; |
| 751 | goto out_err; |
| 752 | } |
| 753 | |
| 754 | /* Now update buf to account for HMAC */ |
| 755 | buf->tail[0].iov_len += kctx->gk5e->cksumlength; |
| 756 | buf->len += kctx->gk5e->cksumlength; |
| 757 | |
| 758 | out_err: |
| 759 | if (err) |
| 760 | err = GSS_S_FAILURE; |
| 761 | return err; |
| 762 | } |
| 763 | |
| 764 | u32 |
| 765 | gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf, |
| 766 | u32 *headskip, u32 *tailskip) |
| 767 | { |
| 768 | struct xdr_buf subbuf; |
| 769 | u32 ret = 0; |
| 770 | u8 *cksum_key; |
| 771 | struct crypto_blkcipher *cipher, *aux_cipher; |
| 772 | struct xdr_netobj our_hmac_obj; |
| 773 | u8 our_hmac[GSS_KRB5_MAX_CKSUM_LEN]; |
| 774 | u8 pkt_hmac[GSS_KRB5_MAX_CKSUM_LEN]; |
| 775 | int nblocks, blocksize, cbcbytes; |
| 776 | struct decryptor_desc desc; |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 777 | unsigned int usage; |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 778 | |
| 779 | if (kctx->initiate) { |
| 780 | cipher = kctx->acceptor_enc; |
| 781 | aux_cipher = kctx->acceptor_enc_aux; |
| 782 | cksum_key = kctx->acceptor_integ; |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 783 | usage = KG_USAGE_ACCEPTOR_SEAL; |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 784 | } else { |
| 785 | cipher = kctx->initiator_enc; |
| 786 | aux_cipher = kctx->initiator_enc_aux; |
| 787 | cksum_key = kctx->initiator_integ; |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 788 | usage = KG_USAGE_INITIATOR_SEAL; |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 789 | } |
| 790 | blocksize = crypto_blkcipher_blocksize(cipher); |
| 791 | |
| 792 | |
| 793 | /* create a segment skipping the header and leaving out the checksum */ |
| 794 | xdr_buf_subsegment(buf, &subbuf, offset + GSS_KRB5_TOK_HDR_LEN, |
| 795 | (buf->len - offset - GSS_KRB5_TOK_HDR_LEN - |
| 796 | kctx->gk5e->cksumlength)); |
| 797 | |
| 798 | nblocks = (subbuf.len + blocksize - 1) / blocksize; |
| 799 | |
| 800 | cbcbytes = 0; |
| 801 | if (nblocks > 2) |
| 802 | cbcbytes = (nblocks - 2) * blocksize; |
| 803 | |
| 804 | memset(desc.iv, 0, sizeof(desc.iv)); |
| 805 | |
| 806 | if (cbcbytes) { |
| 807 | desc.fragno = 0; |
| 808 | desc.fraglen = 0; |
| 809 | desc.desc.info = desc.iv; |
| 810 | desc.desc.flags = 0; |
| 811 | desc.desc.tfm = aux_cipher; |
| 812 | |
| 813 | sg_init_table(desc.frags, 4); |
| 814 | |
| 815 | ret = xdr_process_buf(&subbuf, 0, cbcbytes, decryptor, &desc); |
| 816 | if (ret) |
| 817 | goto out_err; |
| 818 | } |
| 819 | |
| 820 | /* Make sure IV carries forward from any CBC results. */ |
| 821 | ret = gss_krb5_cts_crypt(cipher, &subbuf, cbcbytes, desc.iv, NULL, 0); |
| 822 | if (ret) |
| 823 | goto out_err; |
| 824 | |
| 825 | |
| 826 | /* Calculate our hmac over the plaintext data */ |
| 827 | our_hmac_obj.len = sizeof(our_hmac); |
| 828 | our_hmac_obj.data = our_hmac; |
| 829 | |
| 830 | ret = make_checksum_v2(kctx, NULL, 0, &subbuf, 0, |
Kevin Coffman | 8b23707 | 2010-03-17 13:03:02 -0400 | [diff] [blame] | 831 | cksum_key, usage, &our_hmac_obj); |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 832 | if (ret) |
| 833 | goto out_err; |
| 834 | |
| 835 | /* Get the packet's hmac value */ |
| 836 | ret = read_bytes_from_xdr_buf(buf, buf->len - kctx->gk5e->cksumlength, |
| 837 | pkt_hmac, kctx->gk5e->cksumlength); |
| 838 | if (ret) |
| 839 | goto out_err; |
| 840 | |
| 841 | if (memcmp(pkt_hmac, our_hmac, kctx->gk5e->cksumlength) != 0) { |
| 842 | ret = GSS_S_BAD_SIG; |
| 843 | goto out_err; |
| 844 | } |
Kevin Coffman | 5af4654 | 2010-03-17 13:03:05 -0400 | [diff] [blame] | 845 | *headskip = kctx->gk5e->conflen; |
Kevin Coffman | 934a95a | 2010-03-17 13:03:00 -0400 | [diff] [blame] | 846 | *tailskip = kctx->gk5e->cksumlength; |
| 847 | out_err: |
| 848 | if (ret && ret != GSS_S_BAD_SIG) |
| 849 | ret = GSS_S_FAILURE; |
| 850 | return ret; |
| 851 | } |
Kevin Coffman | fffdaef | 2010-03-17 13:03:06 -0400 | [diff] [blame] | 852 | |
| 853 | /* |
| 854 | * Compute Kseq given the initial session key and the checksum. |
| 855 | * Set the key of the given cipher. |
| 856 | */ |
| 857 | int |
| 858 | krb5_rc4_setup_seq_key(struct krb5_ctx *kctx, struct crypto_blkcipher *cipher, |
| 859 | unsigned char *cksum) |
| 860 | { |
| 861 | struct crypto_hash *hmac; |
| 862 | struct hash_desc desc; |
| 863 | struct scatterlist sg[1]; |
| 864 | u8 Kseq[GSS_KRB5_MAX_KEYLEN]; |
| 865 | u32 zeroconstant = 0; |
| 866 | int err; |
| 867 | |
| 868 | dprintk("%s: entered\n", __func__); |
| 869 | |
| 870 | hmac = crypto_alloc_hash(kctx->gk5e->cksum_name, 0, CRYPTO_ALG_ASYNC); |
| 871 | if (IS_ERR(hmac)) { |
| 872 | dprintk("%s: error %ld, allocating hash '%s'\n", |
| 873 | __func__, PTR_ERR(hmac), kctx->gk5e->cksum_name); |
| 874 | return PTR_ERR(hmac); |
| 875 | } |
| 876 | |
| 877 | desc.tfm = hmac; |
| 878 | desc.flags = 0; |
| 879 | |
| 880 | err = crypto_hash_init(&desc); |
| 881 | if (err) |
| 882 | goto out_err; |
| 883 | |
| 884 | /* Compute intermediate Kseq from session key */ |
| 885 | err = crypto_hash_setkey(hmac, kctx->Ksess, kctx->gk5e->keylength); |
| 886 | if (err) |
| 887 | goto out_err; |
| 888 | |
| 889 | sg_init_table(sg, 1); |
| 890 | sg_set_buf(sg, &zeroconstant, 4); |
| 891 | |
| 892 | err = crypto_hash_digest(&desc, sg, 4, Kseq); |
| 893 | if (err) |
| 894 | goto out_err; |
| 895 | |
| 896 | /* Compute final Kseq from the checksum and intermediate Kseq */ |
| 897 | err = crypto_hash_setkey(hmac, Kseq, kctx->gk5e->keylength); |
| 898 | if (err) |
| 899 | goto out_err; |
| 900 | |
| 901 | sg_set_buf(sg, cksum, 8); |
| 902 | |
| 903 | err = crypto_hash_digest(&desc, sg, 8, Kseq); |
| 904 | if (err) |
| 905 | goto out_err; |
| 906 | |
| 907 | err = crypto_blkcipher_setkey(cipher, Kseq, kctx->gk5e->keylength); |
| 908 | if (err) |
| 909 | goto out_err; |
| 910 | |
| 911 | err = 0; |
| 912 | |
| 913 | out_err: |
| 914 | crypto_free_hash(hmac); |
| 915 | dprintk("%s: returning %d\n", __func__, err); |
| 916 | return err; |
| 917 | } |
| 918 | |
| 919 | /* |
| 920 | * Compute Kcrypt given the initial session key and the plaintext seqnum. |
| 921 | * Set the key of cipher kctx->enc. |
| 922 | */ |
| 923 | int |
| 924 | krb5_rc4_setup_enc_key(struct krb5_ctx *kctx, struct crypto_blkcipher *cipher, |
| 925 | s32 seqnum) |
| 926 | { |
| 927 | struct crypto_hash *hmac; |
| 928 | struct hash_desc desc; |
| 929 | struct scatterlist sg[1]; |
| 930 | u8 Kcrypt[GSS_KRB5_MAX_KEYLEN]; |
| 931 | u8 zeroconstant[4] = {0}; |
| 932 | u8 seqnumarray[4]; |
| 933 | int err, i; |
| 934 | |
| 935 | dprintk("%s: entered, seqnum %u\n", __func__, seqnum); |
| 936 | |
| 937 | hmac = crypto_alloc_hash(kctx->gk5e->cksum_name, 0, CRYPTO_ALG_ASYNC); |
| 938 | if (IS_ERR(hmac)) { |
| 939 | dprintk("%s: error %ld, allocating hash '%s'\n", |
| 940 | __func__, PTR_ERR(hmac), kctx->gk5e->cksum_name); |
| 941 | return PTR_ERR(hmac); |
| 942 | } |
| 943 | |
| 944 | desc.tfm = hmac; |
| 945 | desc.flags = 0; |
| 946 | |
| 947 | err = crypto_hash_init(&desc); |
| 948 | if (err) |
| 949 | goto out_err; |
| 950 | |
| 951 | /* Compute intermediate Kcrypt from session key */ |
| 952 | for (i = 0; i < kctx->gk5e->keylength; i++) |
| 953 | Kcrypt[i] = kctx->Ksess[i] ^ 0xf0; |
| 954 | |
| 955 | err = crypto_hash_setkey(hmac, Kcrypt, kctx->gk5e->keylength); |
| 956 | if (err) |
| 957 | goto out_err; |
| 958 | |
| 959 | sg_init_table(sg, 1); |
| 960 | sg_set_buf(sg, zeroconstant, 4); |
| 961 | |
| 962 | err = crypto_hash_digest(&desc, sg, 4, Kcrypt); |
| 963 | if (err) |
| 964 | goto out_err; |
| 965 | |
| 966 | /* Compute final Kcrypt from the seqnum and intermediate Kcrypt */ |
| 967 | err = crypto_hash_setkey(hmac, Kcrypt, kctx->gk5e->keylength); |
| 968 | if (err) |
| 969 | goto out_err; |
| 970 | |
| 971 | seqnumarray[0] = (unsigned char) ((seqnum >> 24) & 0xff); |
| 972 | seqnumarray[1] = (unsigned char) ((seqnum >> 16) & 0xff); |
| 973 | seqnumarray[2] = (unsigned char) ((seqnum >> 8) & 0xff); |
| 974 | seqnumarray[3] = (unsigned char) ((seqnum >> 0) & 0xff); |
| 975 | |
| 976 | sg_set_buf(sg, seqnumarray, 4); |
| 977 | |
| 978 | err = crypto_hash_digest(&desc, sg, 4, Kcrypt); |
| 979 | if (err) |
| 980 | goto out_err; |
| 981 | |
| 982 | err = crypto_blkcipher_setkey(cipher, Kcrypt, kctx->gk5e->keylength); |
| 983 | if (err) |
| 984 | goto out_err; |
| 985 | |
| 986 | err = 0; |
| 987 | |
| 988 | out_err: |
| 989 | crypto_free_hash(hmac); |
| 990 | dprintk("%s: returning %d\n", __func__, err); |
| 991 | return err; |
| 992 | } |
| 993 | |