Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * linux/net/sunrpc/gss_krb5_seal.c |
| 3 | * |
| 4 | * Adapted from MIT Kerberos 5-1.2.1 lib/gssapi/krb5/k5seal.c |
| 5 | * |
| 6 | * Copyright (c) 2000 The Regents of the University of Michigan. |
| 7 | * All rights reserved. |
| 8 | * |
| 9 | * Andy Adamson <andros@umich.edu> |
| 10 | * J. Bruce Fields <bfields@umich.edu> |
| 11 | */ |
| 12 | |
| 13 | /* |
| 14 | * Copyright 1993 by OpenVision Technologies, Inc. |
| 15 | * |
| 16 | * Permission to use, copy, modify, distribute, and sell this software |
| 17 | * and its documentation for any purpose is hereby granted without fee, |
| 18 | * provided that the above copyright notice appears in all copies and |
| 19 | * that both that copyright notice and this permission notice appear in |
| 20 | * supporting documentation, and that the name of OpenVision not be used |
| 21 | * in advertising or publicity pertaining to distribution of the software |
| 22 | * without specific, written prior permission. OpenVision makes no |
| 23 | * representations about the suitability of this software for any |
| 24 | * purpose. It is provided "as is" without express or implied warranty. |
| 25 | * |
| 26 | * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, |
| 27 | * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO |
| 28 | * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR |
| 29 | * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF |
| 30 | * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR |
| 31 | * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR |
| 32 | * PERFORMANCE OF THIS SOFTWARE. |
| 33 | */ |
| 34 | |
| 35 | /* |
| 36 | * Copyright (C) 1998 by the FundsXpress, INC. |
| 37 | * |
| 38 | * All rights reserved. |
| 39 | * |
| 40 | * Export of this software from the United States of America may require |
| 41 | * a specific license from the United States Government. It is the |
| 42 | * responsibility of any person or organization contemplating export to |
| 43 | * obtain such a license before exporting. |
| 44 | * |
| 45 | * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and |
| 46 | * distribute this software and its documentation for any purpose and |
| 47 | * without fee is hereby granted, provided that the above copyright |
| 48 | * notice appear in all copies and that both that copyright notice and |
| 49 | * this permission notice appear in supporting documentation, and that |
| 50 | * the name of FundsXpress. not be used in advertising or publicity pertaining |
| 51 | * to distribution of the software without specific, written prior |
| 52 | * permission. FundsXpress makes no representations about the suitability of |
| 53 | * this software for any purpose. It is provided "as is" without express |
| 54 | * or implied warranty. |
| 55 | * |
| 56 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR |
| 57 | * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED |
| 58 | * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. |
| 59 | */ |
| 60 | |
| 61 | #include <linux/types.h> |
| 62 | #include <linux/slab.h> |
| 63 | #include <linux/jiffies.h> |
| 64 | #include <linux/sunrpc/gss_krb5.h> |
| 65 | #include <linux/random.h> |
| 66 | #include <asm/scatterlist.h> |
| 67 | #include <linux/crypto.h> |
| 68 | |
| 69 | #ifdef RPC_DEBUG |
| 70 | # define RPCDBG_FACILITY RPCDBG_AUTH |
| 71 | #endif |
| 72 | |
Ingo Molnar | 34af946 | 2006-06-27 02:53:55 -0700 | [diff] [blame] | 73 | DEFINE_SPINLOCK(krb5_seq_lock); |
J. Bruce Fields | eaa82ed | 2006-03-20 23:24:04 -0500 | [diff] [blame] | 74 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 75 | u32 |
J. Bruce Fields | a0857d0 | 2005-10-13 16:55:23 -0400 | [diff] [blame] | 76 | gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text, |
| 77 | struct xdr_netobj *token) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 78 | { |
J. Bruce Fields | a0857d0 | 2005-10-13 16:55:23 -0400 | [diff] [blame] | 79 | struct krb5_ctx *ctx = gss_ctx->internal_ctx_id; |
J. Bruce Fields | 9e57b30 | 2006-03-20 23:23:11 -0500 | [diff] [blame] | 80 | char cksumdata[16]; |
| 81 | struct xdr_netobj md5cksum = {.len = 0, .data = cksumdata}; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 82 | unsigned char *ptr, *krb5_hdr, *msg_start; |
| 83 | s32 now; |
J. Bruce Fields | eaa82ed | 2006-03-20 23:24:04 -0500 | [diff] [blame] | 84 | u32 seq_send; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 85 | |
Chuck Lever | 8885cb3 | 2007-01-31 12:14:05 -0500 | [diff] [blame^] | 86 | dprintk("RPC: gss_krb5_seal\n"); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 87 | |
| 88 | now = get_seconds(); |
| 89 | |
J. Bruce Fields | bfa9151 | 2005-10-13 16:55:08 -0400 | [diff] [blame] | 90 | token->len = g_token_size(&ctx->mech_used, 22); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 91 | |
| 92 | ptr = token->data; |
J. Bruce Fields | bfa9151 | 2005-10-13 16:55:08 -0400 | [diff] [blame] | 93 | g_make_token_header(&ctx->mech_used, 22, &ptr); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 94 | |
J. Bruce Fields | bfa9151 | 2005-10-13 16:55:08 -0400 | [diff] [blame] | 95 | *ptr++ = (unsigned char) ((KG_TOK_MIC_MSG>>8)&0xff); |
| 96 | *ptr++ = (unsigned char) (KG_TOK_MIC_MSG&0xff); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 97 | |
| 98 | /* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */ |
| 99 | krb5_hdr = ptr - 2; |
| 100 | msg_start = krb5_hdr + 24; |
| 101 | |
J. Bruce Fields | e678e06 | 2006-12-04 20:22:35 -0500 | [diff] [blame] | 102 | *(__be16 *)(krb5_hdr + 2) = htons(SGN_ALG_DES_MAC_MD5); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 103 | memset(krb5_hdr + 4, 0xff, 4); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 104 | |
J. Bruce Fields | ca54f89 | 2006-12-04 20:22:38 -0500 | [diff] [blame] | 105 | if (make_checksum("md5", krb5_hdr, 8, text, 0, &md5cksum)) |
J. Bruce Fields | 39a21dd | 2006-12-04 20:22:39 -0500 | [diff] [blame] | 106 | return GSS_S_FAILURE; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 107 | |
J. Bruce Fields | e678e06 | 2006-12-04 20:22:35 -0500 | [diff] [blame] | 108 | if (krb5_encrypt(ctx->seq, NULL, md5cksum.data, |
| 109 | md5cksum.data, md5cksum.len)) |
J. Bruce Fields | 39a21dd | 2006-12-04 20:22:39 -0500 | [diff] [blame] | 110 | return GSS_S_FAILURE; |
J. Bruce Fields | 94efa93 | 2006-12-04 20:22:42 -0500 | [diff] [blame] | 111 | |
| 112 | memcpy(krb5_hdr + 16, md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH, |
J. Bruce Fields | e678e06 | 2006-12-04 20:22:35 -0500 | [diff] [blame] | 113 | KRB5_CKSUM_LENGTH); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 114 | |
J. Bruce Fields | eaa82ed | 2006-03-20 23:24:04 -0500 | [diff] [blame] | 115 | spin_lock(&krb5_seq_lock); |
| 116 | seq_send = ctx->seq_send++; |
| 117 | spin_unlock(&krb5_seq_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 118 | |
J. Bruce Fields | 94efa93 | 2006-12-04 20:22:42 -0500 | [diff] [blame] | 119 | if (krb5_make_seq_num(ctx->seq, ctx->initiate ? 0 : 0xff, |
| 120 | ctx->seq_send, krb5_hdr + 16, krb5_hdr + 8)) |
J. Bruce Fields | 39a21dd | 2006-12-04 20:22:39 -0500 | [diff] [blame] | 121 | return GSS_S_FAILURE; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 122 | |
J. Bruce Fields | 94efa93 | 2006-12-04 20:22:42 -0500 | [diff] [blame] | 123 | return (ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 124 | } |