Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * linux/net/sunrpc/gss_krb5_mech.c |
| 3 | * |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame^] | 4 | * Copyright (c) 2001-2008 The Regents of the University of Michigan. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 5 | * All rights reserved. |
| 6 | * |
| 7 | * Andy Adamson <andros@umich.edu> |
| 8 | * J. Bruce Fields <bfields@umich.edu> |
| 9 | * |
| 10 | * Redistribution and use in source and binary forms, with or without |
| 11 | * modification, are permitted provided that the following conditions |
| 12 | * are met: |
| 13 | * |
| 14 | * 1. Redistributions of source code must retain the above copyright |
| 15 | * notice, this list of conditions and the following disclaimer. |
| 16 | * 2. Redistributions in binary form must reproduce the above copyright |
| 17 | * notice, this list of conditions and the following disclaimer in the |
| 18 | * documentation and/or other materials provided with the distribution. |
| 19 | * 3. Neither the name of the University nor the names of its |
| 20 | * contributors may be used to endorse or promote products derived |
| 21 | * from this software without specific prior written permission. |
| 22 | * |
| 23 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED |
| 24 | * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF |
| 25 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
| 26 | * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
| 27 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
| 28 | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
| 29 | * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR |
| 30 | * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF |
| 31 | * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING |
| 32 | * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
| 33 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 34 | * |
| 35 | */ |
| 36 | |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 37 | #include <linux/err.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 38 | #include <linux/module.h> |
| 39 | #include <linux/init.h> |
| 40 | #include <linux/types.h> |
| 41 | #include <linux/slab.h> |
| 42 | #include <linux/sunrpc/auth.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 43 | #include <linux/sunrpc/gss_krb5.h> |
| 44 | #include <linux/sunrpc/xdr.h> |
| 45 | #include <linux/crypto.h> |
| 46 | |
| 47 | #ifdef RPC_DEBUG |
| 48 | # define RPCDBG_FACILITY RPCDBG_AUTH |
| 49 | #endif |
| 50 | |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame^] | 51 | static const struct gss_krb5_enctype supported_gss_krb5_enctypes[] = { |
| 52 | /* |
| 53 | * DES (All DES enctypes are mapped to the same gss functionality) |
| 54 | */ |
| 55 | { |
| 56 | .etype = ENCTYPE_DES_CBC_RAW, |
| 57 | .ctype = CKSUMTYPE_RSA_MD5, |
| 58 | .name = "des-cbc-crc", |
| 59 | .encrypt_name = "cbc(des)", |
| 60 | .cksum_name = "md5", |
| 61 | .encrypt = krb5_encrypt, |
| 62 | .decrypt = krb5_decrypt, |
| 63 | .signalg = SGN_ALG_DES_MAC_MD5, |
| 64 | .sealalg = SEAL_ALG_DES, |
| 65 | .keybytes = 7, |
| 66 | .keylength = 8, |
| 67 | .blocksize = 8, |
| 68 | .cksumlength = 8, |
| 69 | }, |
| 70 | }; |
| 71 | |
| 72 | static const int num_supported_enctypes = |
| 73 | ARRAY_SIZE(supported_gss_krb5_enctypes); |
| 74 | |
| 75 | static int |
| 76 | supported_gss_krb5_enctype(int etype) |
| 77 | { |
| 78 | int i; |
| 79 | for (i = 0; i < num_supported_enctypes; i++) |
| 80 | if (supported_gss_krb5_enctypes[i].etype == etype) |
| 81 | return 1; |
| 82 | return 0; |
| 83 | } |
| 84 | |
| 85 | static const struct gss_krb5_enctype * |
| 86 | get_gss_krb5_enctype(int etype) |
| 87 | { |
| 88 | int i; |
| 89 | for (i = 0; i < num_supported_enctypes; i++) |
| 90 | if (supported_gss_krb5_enctypes[i].etype == etype) |
| 91 | return &supported_gss_krb5_enctypes[i]; |
| 92 | return NULL; |
| 93 | } |
| 94 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 95 | static const void * |
| 96 | simple_get_bytes(const void *p, const void *end, void *res, int len) |
| 97 | { |
| 98 | const void *q = (const void *)((const char *)p + len); |
| 99 | if (unlikely(q > end || q < p)) |
| 100 | return ERR_PTR(-EFAULT); |
| 101 | memcpy(res, p, len); |
| 102 | return q; |
| 103 | } |
| 104 | |
| 105 | static const void * |
| 106 | simple_get_netobj(const void *p, const void *end, struct xdr_netobj *res) |
| 107 | { |
| 108 | const void *q; |
| 109 | unsigned int len; |
| 110 | |
| 111 | p = simple_get_bytes(p, end, &len, sizeof(len)); |
| 112 | if (IS_ERR(p)) |
| 113 | return p; |
| 114 | q = (const void *)((const char *)p + len); |
| 115 | if (unlikely(q > end || q < p)) |
| 116 | return ERR_PTR(-EFAULT); |
Trond Myklebust | 0f38b87 | 2008-06-10 18:31:01 -0400 | [diff] [blame] | 117 | res->data = kmemdup(p, len, GFP_NOFS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 118 | if (unlikely(res->data == NULL)) |
| 119 | return ERR_PTR(-ENOMEM); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 120 | res->len = len; |
| 121 | return q; |
| 122 | } |
| 123 | |
| 124 | static inline const void * |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame^] | 125 | get_key(const void *p, const void *end, |
| 126 | struct krb5_ctx *ctx, struct crypto_blkcipher **res) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 127 | { |
| 128 | struct xdr_netobj key; |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 129 | int alg; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 130 | |
| 131 | p = simple_get_bytes(p, end, &alg, sizeof(alg)); |
| 132 | if (IS_ERR(p)) |
| 133 | goto out_err; |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame^] | 134 | |
| 135 | switch (alg) { |
| 136 | case ENCTYPE_DES_CBC_CRC: |
| 137 | case ENCTYPE_DES_CBC_MD4: |
| 138 | case ENCTYPE_DES_CBC_MD5: |
| 139 | /* Map all these key types to ENCTYPE_DES_CBC_RAW */ |
| 140 | alg = ENCTYPE_DES_CBC_RAW; |
| 141 | break; |
| 142 | } |
| 143 | |
| 144 | if (!supported_gss_krb5_enctype(alg)) { |
| 145 | printk(KERN_WARNING "gss_kerberos_mech: unsupported " |
| 146 | "encryption key algorithm %d\n", alg); |
| 147 | goto out_err; |
| 148 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 149 | p = simple_get_netobj(p, end, &key); |
| 150 | if (IS_ERR(p)) |
| 151 | goto out_err; |
| 152 | |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame^] | 153 | *res = crypto_alloc_blkcipher(ctx->gk5e->encrypt_name, 0, |
| 154 | CRYPTO_ALG_ASYNC); |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 155 | if (IS_ERR(*res)) { |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame^] | 156 | printk(KERN_WARNING "gss_kerberos_mech: unable to initialize " |
| 157 | "crypto algorithm %s\n", ctx->gk5e->encrypt_name); |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 158 | *res = NULL; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 159 | goto out_err_free_key; |
J. Bruce Fields | 9e56904 | 2006-01-03 09:56:01 +0100 | [diff] [blame] | 160 | } |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 161 | if (crypto_blkcipher_setkey(*res, key.data, key.len)) { |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame^] | 162 | printk(KERN_WARNING "gss_kerberos_mech: error setting key for " |
| 163 | "crypto algorithm %s\n", ctx->gk5e->encrypt_name); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 164 | goto out_err_free_tfm; |
J. Bruce Fields | 9e56904 | 2006-01-03 09:56:01 +0100 | [diff] [blame] | 165 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 166 | |
| 167 | kfree(key.data); |
| 168 | return p; |
| 169 | |
| 170 | out_err_free_tfm: |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 171 | crypto_free_blkcipher(*res); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 172 | out_err_free_key: |
| 173 | kfree(key.data); |
| 174 | p = ERR_PTR(-EINVAL); |
| 175 | out_err: |
| 176 | return p; |
| 177 | } |
| 178 | |
| 179 | static int |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 180 | gss_import_v1_context(const void *p, const void *end, struct krb5_ctx *ctx) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 181 | { |
J. Bruce Fields | e678e06 | 2006-12-04 20:22:35 -0500 | [diff] [blame] | 182 | int tmp; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 183 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 184 | p = simple_get_bytes(p, end, &ctx->initiate, sizeof(ctx->initiate)); |
| 185 | if (IS_ERR(p)) |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 186 | goto out_err; |
| 187 | |
| 188 | /* Old format supports only DES! Any other enctype uses new format */ |
Kevin Coffman | 1ac3719 | 2010-03-17 13:02:49 -0400 | [diff] [blame] | 189 | ctx->enctype = ENCTYPE_DES_CBC_RAW; |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 190 | |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame^] | 191 | ctx->gk5e = get_gss_krb5_enctype(ctx->enctype); |
| 192 | if (ctx->gk5e == NULL) |
| 193 | goto out_err; |
| 194 | |
J. Bruce Fields | 717757a | 2006-12-04 20:22:41 -0500 | [diff] [blame] | 195 | /* The downcall format was designed before we completely understood |
| 196 | * the uses of the context fields; so it includes some stuff we |
| 197 | * just give some minimal sanity-checking, and some we ignore |
| 198 | * completely (like the next twenty bytes): */ |
| 199 | if (unlikely(p + 20 > end || p + 20 < p)) |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 200 | goto out_err; |
J. Bruce Fields | 717757a | 2006-12-04 20:22:41 -0500 | [diff] [blame] | 201 | p += 20; |
J. Bruce Fields | e678e06 | 2006-12-04 20:22:35 -0500 | [diff] [blame] | 202 | p = simple_get_bytes(p, end, &tmp, sizeof(tmp)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 203 | if (IS_ERR(p)) |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 204 | goto out_err; |
Kevin Coffman | ef338be | 2007-11-09 18:42:09 -0500 | [diff] [blame] | 205 | if (tmp != SGN_ALG_DES_MAC_MD5) { |
| 206 | p = ERR_PTR(-ENOSYS); |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 207 | goto out_err; |
Kevin Coffman | ef338be | 2007-11-09 18:42:09 -0500 | [diff] [blame] | 208 | } |
J. Bruce Fields | d922a84 | 2006-12-04 20:22:40 -0500 | [diff] [blame] | 209 | p = simple_get_bytes(p, end, &tmp, sizeof(tmp)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 210 | if (IS_ERR(p)) |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 211 | goto out_err; |
Kevin Coffman | ef338be | 2007-11-09 18:42:09 -0500 | [diff] [blame] | 212 | if (tmp != SEAL_ALG_DES) { |
| 213 | p = ERR_PTR(-ENOSYS); |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 214 | goto out_err; |
Kevin Coffman | ef338be | 2007-11-09 18:42:09 -0500 | [diff] [blame] | 215 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 216 | p = simple_get_bytes(p, end, &ctx->endtime, sizeof(ctx->endtime)); |
| 217 | if (IS_ERR(p)) |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 218 | goto out_err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 219 | p = simple_get_bytes(p, end, &ctx->seq_send, sizeof(ctx->seq_send)); |
| 220 | if (IS_ERR(p)) |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 221 | goto out_err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 222 | p = simple_get_netobj(p, end, &ctx->mech_used); |
| 223 | if (IS_ERR(p)) |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 224 | goto out_err; |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame^] | 225 | p = get_key(p, end, ctx, &ctx->enc); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 226 | if (IS_ERR(p)) |
| 227 | goto out_err_free_mech; |
Kevin Coffman | 81d4a43 | 2010-03-17 13:02:51 -0400 | [diff] [blame^] | 228 | p = get_key(p, end, ctx, &ctx->seq); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 229 | if (IS_ERR(p)) |
| 230 | goto out_err_free_key1; |
| 231 | if (p != end) { |
| 232 | p = ERR_PTR(-EFAULT); |
| 233 | goto out_err_free_key2; |
| 234 | } |
| 235 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 236 | return 0; |
| 237 | |
| 238 | out_err_free_key2: |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 239 | crypto_free_blkcipher(ctx->seq); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 240 | out_err_free_key1: |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 241 | crypto_free_blkcipher(ctx->enc); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 242 | out_err_free_mech: |
| 243 | kfree(ctx->mech_used.data); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 244 | out_err: |
| 245 | return PTR_ERR(p); |
| 246 | } |
| 247 | |
Kevin Coffman | a8cc1cb | 2010-03-17 13:02:50 -0400 | [diff] [blame] | 248 | static int |
| 249 | gss_import_sec_context_kerberos(const void *p, size_t len, |
| 250 | struct gss_ctx *ctx_id) |
| 251 | { |
| 252 | const void *end = (const void *)((const char *)p + len); |
| 253 | struct krb5_ctx *ctx; |
| 254 | int ret; |
| 255 | |
| 256 | ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); |
| 257 | if (ctx == NULL) |
| 258 | return -ENOMEM; |
| 259 | |
| 260 | if (len == 85) |
| 261 | ret = gss_import_v1_context(p, end, ctx); |
| 262 | else |
| 263 | ret = -EINVAL; |
| 264 | |
| 265 | if (ret == 0) |
| 266 | ctx_id->internal_ctx_id = ctx; |
| 267 | else |
| 268 | kfree(ctx); |
| 269 | |
| 270 | dprintk("RPC: %s: returning %d\n", __func__, ret); |
| 271 | return ret; |
| 272 | } |
| 273 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 274 | static void |
| 275 | gss_delete_sec_context_kerberos(void *internal_ctx) { |
| 276 | struct krb5_ctx *kctx = internal_ctx; |
| 277 | |
Herbert Xu | 378c669 | 2006-08-22 20:33:54 +1000 | [diff] [blame] | 278 | crypto_free_blkcipher(kctx->seq); |
| 279 | crypto_free_blkcipher(kctx->enc); |
Jesper Juhl | 573dbd9 | 2005-09-01 17:44:29 -0700 | [diff] [blame] | 280 | kfree(kctx->mech_used.data); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 281 | kfree(kctx); |
| 282 | } |
| 283 | |
Trond Myklebust | f1c0a86 | 2007-06-23 20:17:58 -0400 | [diff] [blame] | 284 | static const struct gss_api_ops gss_kerberos_ops = { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 285 | .gss_import_sec_context = gss_import_sec_context_kerberos, |
| 286 | .gss_get_mic = gss_get_mic_kerberos, |
| 287 | .gss_verify_mic = gss_verify_mic_kerberos, |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 288 | .gss_wrap = gss_wrap_kerberos, |
| 289 | .gss_unwrap = gss_unwrap_kerberos, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 290 | .gss_delete_sec_context = gss_delete_sec_context_kerberos, |
| 291 | }; |
| 292 | |
| 293 | static struct pf_desc gss_kerberos_pfs[] = { |
| 294 | [0] = { |
| 295 | .pseudoflavor = RPC_AUTH_GSS_KRB5, |
| 296 | .service = RPC_GSS_SVC_NONE, |
| 297 | .name = "krb5", |
| 298 | }, |
| 299 | [1] = { |
| 300 | .pseudoflavor = RPC_AUTH_GSS_KRB5I, |
| 301 | .service = RPC_GSS_SVC_INTEGRITY, |
| 302 | .name = "krb5i", |
| 303 | }, |
J. Bruce Fields | 14ae162 | 2005-10-13 16:55:13 -0400 | [diff] [blame] | 304 | [2] = { |
| 305 | .pseudoflavor = RPC_AUTH_GSS_KRB5P, |
| 306 | .service = RPC_GSS_SVC_PRIVACY, |
| 307 | .name = "krb5p", |
| 308 | }, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 309 | }; |
| 310 | |
| 311 | static struct gss_api_mech gss_kerberos_mech = { |
| 312 | .gm_name = "krb5", |
| 313 | .gm_owner = THIS_MODULE, |
Usha Ketineni | ae4c40b | 2007-07-17 04:04:50 -0700 | [diff] [blame] | 314 | .gm_oid = {9, (void *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"}, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 315 | .gm_ops = &gss_kerberos_ops, |
| 316 | .gm_pf_num = ARRAY_SIZE(gss_kerberos_pfs), |
| 317 | .gm_pfs = gss_kerberos_pfs, |
| 318 | }; |
| 319 | |
| 320 | static int __init init_kerberos_module(void) |
| 321 | { |
| 322 | int status; |
| 323 | |
| 324 | status = gss_mech_register(&gss_kerberos_mech); |
| 325 | if (status) |
| 326 | printk("Failed to register kerberos gss mechanism!\n"); |
| 327 | return status; |
| 328 | } |
| 329 | |
| 330 | static void __exit cleanup_kerberos_module(void) |
| 331 | { |
| 332 | gss_mech_unregister(&gss_kerberos_mech); |
| 333 | } |
| 334 | |
| 335 | MODULE_LICENSE("GPL"); |
| 336 | module_init(init_kerberos_module); |
| 337 | module_exit(cleanup_kerberos_module); |