Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * linux/net/sunrpc/gss_krb5_seal.c | |
3 | * | |
4 | * Adapted from MIT Kerberos 5-1.2.1 lib/gssapi/krb5/k5seal.c | |
5 | * | |
6 | * Copyright (c) 2000 The Regents of the University of Michigan. | |
7 | * All rights reserved. | |
8 | * | |
9 | * Andy Adamson <andros@umich.edu> | |
10 | * J. Bruce Fields <bfields@umich.edu> | |
11 | */ | |
12 | ||
13 | /* | |
14 | * Copyright 1993 by OpenVision Technologies, Inc. | |
15 | * | |
16 | * Permission to use, copy, modify, distribute, and sell this software | |
17 | * and its documentation for any purpose is hereby granted without fee, | |
18 | * provided that the above copyright notice appears in all copies and | |
19 | * that both that copyright notice and this permission notice appear in | |
20 | * supporting documentation, and that the name of OpenVision not be used | |
21 | * in advertising or publicity pertaining to distribution of the software | |
22 | * without specific, written prior permission. OpenVision makes no | |
23 | * representations about the suitability of this software for any | |
24 | * purpose. It is provided "as is" without express or implied warranty. | |
25 | * | |
26 | * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, | |
27 | * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO | |
28 | * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR | |
29 | * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF | |
30 | * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR | |
31 | * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR | |
32 | * PERFORMANCE OF THIS SOFTWARE. | |
33 | */ | |
34 | ||
35 | /* | |
36 | * Copyright (C) 1998 by the FundsXpress, INC. | |
37 | * | |
38 | * All rights reserved. | |
39 | * | |
40 | * Export of this software from the United States of America may require | |
41 | * a specific license from the United States Government. It is the | |
42 | * responsibility of any person or organization contemplating export to | |
43 | * obtain such a license before exporting. | |
44 | * | |
45 | * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and | |
46 | * distribute this software and its documentation for any purpose and | |
47 | * without fee is hereby granted, provided that the above copyright | |
48 | * notice appear in all copies and that both that copyright notice and | |
49 | * this permission notice appear in supporting documentation, and that | |
50 | * the name of FundsXpress. not be used in advertising or publicity pertaining | |
51 | * to distribution of the software without specific, written prior | |
52 | * permission. FundsXpress makes no representations about the suitability of | |
53 | * this software for any purpose. It is provided "as is" without express | |
54 | * or implied warranty. | |
55 | * | |
56 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR | |
57 | * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED | |
58 | * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. | |
59 | */ | |
60 | ||
61 | #include <linux/types.h> | |
62 | #include <linux/slab.h> | |
63 | #include <linux/jiffies.h> | |
64 | #include <linux/sunrpc/gss_krb5.h> | |
65 | #include <linux/random.h> | |
66 | #include <asm/scatterlist.h> | |
67 | #include <linux/crypto.h> | |
68 | ||
69 | #ifdef RPC_DEBUG | |
70 | # define RPCDBG_FACILITY RPCDBG_AUTH | |
71 | #endif | |
72 | ||
34af946a | 73 | DEFINE_SPINLOCK(krb5_seq_lock); |
eaa82edf | 74 | |
1da177e4 | 75 | u32 |
a0857d03 BF |
76 | gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text, |
77 | struct xdr_netobj *token) | |
1da177e4 | 78 | { |
a0857d03 | 79 | struct krb5_ctx *ctx = gss_ctx->internal_ctx_id; |
1da177e4 | 80 | s32 checksum_type; |
9e57b302 BF |
81 | char cksumdata[16]; |
82 | struct xdr_netobj md5cksum = {.len = 0, .data = cksumdata}; | |
1da177e4 LT |
83 | unsigned char *ptr, *krb5_hdr, *msg_start; |
84 | s32 now; | |
eaa82edf | 85 | u32 seq_send; |
1da177e4 LT |
86 | |
87 | dprintk("RPC: gss_krb5_seal\n"); | |
88 | ||
89 | now = get_seconds(); | |
90 | ||
1da177e4 LT |
91 | switch (ctx->signalg) { |
92 | case SGN_ALG_DES_MAC_MD5: | |
93 | checksum_type = CKSUMTYPE_RSA_MD5; | |
94 | break; | |
95 | default: | |
96 | dprintk("RPC: gss_krb5_seal: ctx->signalg %d not" | |
97 | " supported\n", ctx->signalg); | |
98 | goto out_err; | |
99 | } | |
100 | if (ctx->sealalg != SEAL_ALG_NONE && ctx->sealalg != SEAL_ALG_DES) { | |
101 | dprintk("RPC: gss_krb5_seal: ctx->sealalg %d not supported\n", | |
102 | ctx->sealalg); | |
103 | goto out_err; | |
104 | } | |
105 | ||
bfa91516 | 106 | token->len = g_token_size(&ctx->mech_used, 22); |
1da177e4 LT |
107 | |
108 | ptr = token->data; | |
bfa91516 | 109 | g_make_token_header(&ctx->mech_used, 22, &ptr); |
1da177e4 | 110 | |
bfa91516 BF |
111 | *ptr++ = (unsigned char) ((KG_TOK_MIC_MSG>>8)&0xff); |
112 | *ptr++ = (unsigned char) (KG_TOK_MIC_MSG&0xff); | |
1da177e4 LT |
113 | |
114 | /* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */ | |
115 | krb5_hdr = ptr - 2; | |
116 | msg_start = krb5_hdr + 24; | |
117 | ||
118 | *(u16 *)(krb5_hdr + 2) = htons(ctx->signalg); | |
119 | memset(krb5_hdr + 4, 0xff, 4); | |
1da177e4 | 120 | |
14ae162c BF |
121 | if (make_checksum(checksum_type, krb5_hdr, 8, text, 0, &md5cksum)) |
122 | goto out_err; | |
1da177e4 LT |
123 | |
124 | switch (ctx->signalg) { | |
125 | case SGN_ALG_DES_MAC_MD5: | |
126 | if (krb5_encrypt(ctx->seq, NULL, md5cksum.data, | |
127 | md5cksum.data, md5cksum.len)) | |
128 | goto out_err; | |
129 | memcpy(krb5_hdr + 16, | |
130 | md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH, | |
131 | KRB5_CKSUM_LENGTH); | |
132 | ||
133 | dprintk("RPC: make_seal_token: cksum data: \n"); | |
134 | print_hexl((u32 *) (krb5_hdr + 16), KRB5_CKSUM_LENGTH, 0); | |
135 | break; | |
136 | default: | |
137 | BUG(); | |
138 | } | |
139 | ||
eaa82edf BF |
140 | spin_lock(&krb5_seq_lock); |
141 | seq_send = ctx->seq_send++; | |
142 | spin_unlock(&krb5_seq_lock); | |
143 | ||
1da177e4 | 144 | if ((krb5_make_seq_num(ctx->seq, ctx->initiate ? 0 : 0xff, |
eaa82edf | 145 | seq_send, krb5_hdr + 16, krb5_hdr + 8))) |
1da177e4 LT |
146 | goto out_err; |
147 | ||
1da177e4 LT |
148 | return ((ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE); |
149 | out_err: | |
1da177e4 LT |
150 | return GSS_S_FAILURE; |
151 | } |