summaryrefslogtreecommitdiffstats
path: root/net/sunrpc/auth_gss
diff options
context:
space:
mode:
Diffstat (limited to 'net/sunrpc/auth_gss')
-rw-r--r--net/sunrpc/auth_gss/auth_gss.c47
-rw-r--r--net/sunrpc/auth_gss/gss_krb5_crypto.c101
-rw-r--r--net/sunrpc/auth_gss/gss_krb5_mech.c21
-rw-r--r--net/sunrpc/auth_gss/gss_krb5_seal.c55
-rw-r--r--net/sunrpc/auth_gss/gss_krb5_unseal.c87
-rw-r--r--net/sunrpc/auth_gss/gss_krb5_wrap.c153
-rw-r--r--net/sunrpc/auth_gss/gss_spkm3_mech.c136
-rw-r--r--net/sunrpc/auth_gss/gss_spkm3_seal.c101
-rw-r--r--net/sunrpc/auth_gss/gss_spkm3_token.c6
-rw-r--r--net/sunrpc/auth_gss/gss_spkm3_unseal.c92
-rw-r--r--net/sunrpc/auth_gss/svcauth_gss.c18
11 files changed, 274 insertions, 543 deletions
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index b36b9463f5a..e1a104abb78 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -68,7 +68,7 @@ static struct rpc_credops gss_credops;
#define GSS_CRED_SLACK 1024 /* XXX: unused */
/* length of a krb5 verifier (48), plus data added before arguments when
* using integrity (two 4-byte integers): */
-#define GSS_VERF_SLACK 56
+#define GSS_VERF_SLACK 100
/* XXX this define must match the gssd define
* as it is passed to gssd to signal the use of
@@ -94,46 +94,6 @@ struct gss_auth {
static void gss_destroy_ctx(struct gss_cl_ctx *);
static struct rpc_pipe_ops gss_upcall_ops;
-void
-print_hexl(u32 *p, u_int length, u_int offset)
-{
- u_int i, j, jm;
- u8 c, *cp;
-
- dprintk("RPC: print_hexl: length %d\n",length);
- dprintk("\n");
- cp = (u8 *) p;
-
- for (i = 0; i < length; i += 0x10) {
- dprintk(" %04x: ", (u_int)(i + offset));
- jm = length - i;
- jm = jm > 16 ? 16 : jm;
-
- for (j = 0; j < jm; j++) {
- if ((j % 2) == 1)
- dprintk("%02x ", (u_int)cp[i+j]);
- else
- dprintk("%02x", (u_int)cp[i+j]);
- }
- for (; j < 16; j++) {
- if ((j % 2) == 1)
- dprintk(" ");
- else
- dprintk(" ");
- }
- dprintk(" ");
-
- for (j = 0; j < jm; j++) {
- c = cp[i+j];
- c = isprint(c) ? c : '.';
- dprintk("%c", c);
- }
- dprintk("\n");
- }
-}
-
-EXPORT_SYMBOL(print_hexl);
-
static inline struct gss_cl_ctx *
gss_get_ctx(struct gss_cl_ctx *ctx)
{
@@ -198,11 +158,10 @@ simple_get_netobj(const void *p, const void *end, struct xdr_netobj *dest)
q = (const void *)((const char *)p + len);
if (unlikely(q > end || q < p))
return ERR_PTR(-EFAULT);
- dest->data = kmalloc(len, GFP_KERNEL);
+ dest->data = kmemdup(p, len, GFP_KERNEL);
if (unlikely(dest->data == NULL))
return ERR_PTR(-ENOMEM);
dest->len = len;
- memcpy(dest->data, p, len);
return q;
}
@@ -542,7 +501,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
if (!buf)
goto out;
- clnt = RPC_I(filp->f_dentry->d_inode)->private;
+ clnt = RPC_I(filp->f_path.dentry->d_inode)->private;
err = -EFAULT;
if (copy_from_user(buf, src, mlen))
goto err;
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index e11a40b25cc..d926cda8862 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -43,6 +43,7 @@
#include <linux/highmem.h>
#include <linux/pagemap.h>
#include <linux/sunrpc/gss_krb5.h>
+#include <linux/sunrpc/xdr.h>
#ifdef RPC_DEBUG
# define RPCDBG_FACILITY RPCDBG_AUTH
@@ -61,9 +62,6 @@ krb5_encrypt(
u8 local_iv[16] = {0};
struct blkcipher_desc desc = { .tfm = tfm, .info = local_iv };
- dprintk("RPC: krb5_encrypt: input data:\n");
- print_hexl((u32 *)in, length, 0);
-
if (length % crypto_blkcipher_blocksize(tfm) != 0)
goto out;
@@ -80,12 +78,9 @@ krb5_encrypt(
sg_set_buf(sg, out, length);
ret = crypto_blkcipher_encrypt_iv(&desc, sg, sg, length);
-
- dprintk("RPC: krb5_encrypt: output data:\n");
- print_hexl((u32 *)out, length, 0);
out:
dprintk("RPC: krb5_encrypt returns %d\n",ret);
- return(ret);
+ return ret;
}
EXPORT_SYMBOL(krb5_encrypt);
@@ -103,9 +98,6 @@ krb5_decrypt(
u8 local_iv[16] = {0};
struct blkcipher_desc desc = { .tfm = tfm, .info = local_iv };
- dprintk("RPC: krb5_decrypt: input data:\n");
- print_hexl((u32 *)in, length, 0);
-
if (length % crypto_blkcipher_blocksize(tfm) != 0)
goto out;
@@ -121,83 +113,14 @@ krb5_decrypt(
sg_set_buf(sg, out, length);
ret = crypto_blkcipher_decrypt_iv(&desc, sg, sg, length);
-
- dprintk("RPC: krb5_decrypt: output_data:\n");
- print_hexl((u32 *)out, length, 0);
out:
dprintk("RPC: gss_k5decrypt returns %d\n",ret);
- return(ret);
+ return ret;
}
EXPORT_SYMBOL(krb5_decrypt);
static int
-process_xdr_buf(struct xdr_buf *buf, int offset, int len,
- int (*actor)(struct scatterlist *, void *), void *data)
-{
- int i, page_len, thislen, page_offset, ret = 0;
- struct scatterlist sg[1];
-
- if (offset >= buf->head[0].iov_len) {
- offset -= buf->head[0].iov_len;
- } else {
- thislen = buf->head[0].iov_len - offset;
- if (thislen > len)
- thislen = len;
- sg_set_buf(sg, buf->head[0].iov_base + offset, thislen);
- ret = actor(sg, data);
- if (ret)
- goto out;
- offset = 0;
- len -= thislen;
- }
- if (len == 0)
- goto out;
-
- if (offset >= buf->page_len) {
- offset -= buf->page_len;
- } else {
- page_len = buf->page_len - offset;
- if (page_len > len)
- page_len = len;
- len -= page_len;
- page_offset = (offset + buf->page_base) & (PAGE_CACHE_SIZE - 1);
- i = (offset + buf->page_base) >> PAGE_CACHE_SHIFT;
- thislen = PAGE_CACHE_SIZE - page_offset;
- do {
- if (thislen > page_len)
- thislen = page_len;
- sg->page = buf->pages[i];
- sg->offset = page_offset;
- sg->length = thislen;
- ret = actor(sg, data);
- if (ret)
- goto out;
- page_len -= thislen;
- i++;
- page_offset = 0;
- thislen = PAGE_CACHE_SIZE;
- } while (page_len != 0);
- offset = 0;
- }
- if (len == 0)
- goto out;
-
- if (offset < buf->tail[0].iov_len) {
- thislen = buf->tail[0].iov_len - offset;
- if (thislen > len)
- thislen = len;
- sg_set_buf(sg, buf->tail[0].iov_base + offset, thislen);
- ret = actor(sg, data);
- len -= thislen;
- }
- if (len != 0)
- ret = -EINVAL;
-out:
- return ret;
-}
-
-static int
checksummer(struct scatterlist *sg, void *data)
{
struct hash_desc *desc = data;
@@ -207,23 +130,13 @@ checksummer(struct scatterlist *sg, void *data)
/* checksum the plaintext data and hdrlen bytes of the token header */
s32
-make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
+make_checksum(char *cksumname, char *header, int hdrlen, struct xdr_buf *body,
int body_offset, struct xdr_netobj *cksum)
{
- char *cksumname;
struct hash_desc desc; /* XXX add to ctx? */
struct scatterlist sg[1];
int err;
- switch (cksumtype) {
- case CKSUMTYPE_RSA_MD5:
- cksumname = "md5";
- break;
- default:
- dprintk("RPC: krb5_make_checksum:"
- " unsupported checksum %d", cksumtype);
- return GSS_S_FAILURE;
- }
desc.tfm = crypto_alloc_hash(cksumname, 0, CRYPTO_ALG_ASYNC);
if (IS_ERR(desc.tfm))
return GSS_S_FAILURE;
@@ -237,7 +150,7 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
err = crypto_hash_update(&desc, sg, hdrlen);
if (err)
goto out;
- err = process_xdr_buf(body, body_offset, body->len - body_offset,
+ err = xdr_process_buf(body, body_offset, body->len - body_offset,
checksummer, &desc);
if (err)
goto out;
@@ -335,7 +248,7 @@ gss_encrypt_xdr_buf(struct crypto_blkcipher *tfm, struct xdr_buf *buf,
desc.fragno = 0;
desc.fraglen = 0;
- ret = process_xdr_buf(buf, offset, buf->len - offset, encryptor, &desc);
+ ret = xdr_process_buf(buf, offset, buf->len - offset, encryptor, &desc);
return ret;
}
@@ -401,7 +314,7 @@ gss_decrypt_xdr_buf(struct crypto_blkcipher *tfm, struct xdr_buf *buf,
desc.desc.flags = 0;
desc.fragno = 0;
desc.fraglen = 0;
- return process_xdr_buf(buf, offset, buf->len - offset, decryptor, &desc);
+ return xdr_process_buf(buf, offset, buf->len - offset, decryptor, &desc);
}
EXPORT_SYMBOL(gss_decrypt_xdr_buf);
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 325e72e4fd3..05d4bee86fc 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -70,10 +70,9 @@ simple_get_netobj(const void *p, const void *end, struct xdr_netobj *res)
q = (const void *)((const char *)p + len);
if (unlikely(q > end || q < p))
return ERR_PTR(-EFAULT);
- res->data = kmalloc(len, GFP_KERNEL);
+ res->data = kmemdup(p, len, GFP_KERNEL);
if (unlikely(res->data == NULL))
return ERR_PTR(-ENOMEM);
- memcpy(res->data, p, len);
res->len = len;
return q;
}
@@ -130,6 +129,7 @@ gss_import_sec_context_kerberos(const void *p,
{
const void *end = (const void *)((const char *)p + len);
struct krb5_ctx *ctx;
+ int tmp;
if (!(ctx = kzalloc(sizeof(*ctx), GFP_KERNEL)))
goto out_err;
@@ -137,18 +137,23 @@ gss_import_sec_context_kerberos(const void *p,
p = simple_get_bytes(p, end, &ctx->initiate, sizeof(ctx->initiate));
if (IS_ERR(p))
goto out_err_free_ctx;
- p = simple_get_bytes(p, end, &ctx->seed_init, sizeof(ctx->seed_init));
- if (IS_ERR(p))
+ /* The downcall format was designed before we completely understood
+ * the uses of the context fields; so it includes some stuff we
+ * just give some minimal sanity-checking, and some we ignore
+ * completely (like the next twenty bytes): */
+ if (unlikely(p + 20 > end || p + 20 < p))
goto out_err_free_ctx;
- p = simple_get_bytes(p, end, ctx->seed, sizeof(ctx->seed));
+ p += 20;
+ p = simple_get_bytes(p, end, &tmp, sizeof(tmp));
if (IS_ERR(p))
goto out_err_free_ctx;
- p = simple_get_bytes(p, end, &ctx->signalg, sizeof(ctx->signalg));
- if (IS_ERR(p))
+ if (tmp != SGN_ALG_DES_MAC_MD5)
goto out_err_free_ctx;
- p = simple_get_bytes(p, end, &ctx->sealalg, sizeof(ctx->sealalg));
+ p = simple_get_bytes(p, end, &tmp, sizeof(tmp));
if (IS_ERR(p))
goto out_err_free_ctx;
+ if (tmp != SEAL_ALG_DES)
+ goto out_err_free_ctx;
p = simple_get_bytes(p, end, &ctx->endtime, sizeof(ctx->endtime));
if (IS_ERR(p))
goto out_err_free_ctx;
diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
index 08601ee4cd7..d0bb5064f8c 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
@@ -77,7 +77,6 @@ gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text,
struct xdr_netobj *token)
{
struct krb5_ctx *ctx = gss_ctx->internal_ctx_id;
- s32 checksum_type;
char cksumdata[16];
struct xdr_netobj md5cksum = {.len = 0, .data = cksumdata};
unsigned char *ptr, *krb5_hdr, *msg_start;
@@ -88,21 +87,6 @@ gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text,
now = get_seconds();
- switch (ctx->signalg) {
- case SGN_ALG_DES_MAC_MD5:
- checksum_type = CKSUMTYPE_RSA_MD5;
- break;
- default:
- dprintk("RPC: gss_krb5_seal: ctx->signalg %d not"
- " supported\n", ctx->signalg);
- goto out_err;
- }
- if (ctx->sealalg != SEAL_ALG_NONE && ctx->sealalg != SEAL_ALG_DES) {
- dprintk("RPC: gss_krb5_seal: ctx->sealalg %d not supported\n",
- ctx->sealalg);
- goto out_err;
- }
-
token->len = g_token_size(&ctx->mech_used, 22);
ptr = token->data;
@@ -115,37 +99,26 @@ gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text,
krb5_hdr = ptr - 2;
msg_start = krb5_hdr + 24;
- *(__be16 *)(krb5_hdr + 2) = htons(ctx->signalg);
+ *(__be16 *)(krb5_hdr + 2) = htons(SGN_ALG_DES_MAC_MD5);
memset(krb5_hdr + 4, 0xff, 4);
- if (make_checksum(checksum_type, krb5_hdr, 8, text, 0, &md5cksum))
- goto out_err;
-
- switch (ctx->signalg) {
- case SGN_ALG_DES_MAC_MD5:
- if (krb5_encrypt(ctx->seq, NULL, md5cksum.data,
- md5cksum.data, md5cksum.len))
- goto out_err;
- memcpy(krb5_hdr + 16,
- md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
- KRB5_CKSUM_LENGTH);
-
- dprintk("RPC: make_seal_token: cksum data: \n");
- print_hexl((u32 *) (krb5_hdr + 16), KRB5_CKSUM_LENGTH, 0);
- break;
- default:
- BUG();
- }
+ if (make_checksum("md5", krb5_hdr, 8, text, 0, &md5cksum))
+ return GSS_S_FAILURE;
+
+ if (krb5_encrypt(ctx->seq, NULL, md5cksum.data,
+ md5cksum.data, md5cksum.len))
+ return GSS_S_FAILURE;
+
+ memcpy(krb5_hdr + 16, md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
+ KRB5_CKSUM_LENGTH);
spin_lock(&krb5_seq_lock);
seq_send = ctx->seq_send++;
spin_unlock(&krb5_seq_lock);
- if ((krb5_make_seq_num(ctx->seq, ctx->initiate ? 0 : 0xff,
- seq_send, krb5_hdr + 16, krb5_hdr + 8)))
- goto out_err;
+ if (krb5_make_seq_num(ctx->seq, ctx->initiate ? 0 : 0xff,
+ ctx->seq_send, krb5_hdr + 16, krb5_hdr + 8))
+ return GSS_S_FAILURE;
- return ((ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE);
-out_err:
- return GSS_S_FAILURE;
+ return (ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE;
}
diff --git a/net/sunrpc/auth_gss/gss_krb5_unseal.c b/net/sunrpc/auth_gss/gss_krb5_unseal.c
index 0828cf64100..87f8977ccec 100644
--- a/net/sunrpc/auth_gss/gss_krb5_unseal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_unseal.c
@@ -78,7 +78,6 @@ gss_verify_mic_kerberos(struct gss_ctx *gss_ctx,
struct krb5_ctx *ctx = gss_ctx->internal_ctx_id;
int signalg;
int sealalg;
- s32 checksum_type;
char cksumdata[16];
struct xdr_netobj md5cksum = {.len = 0, .data = cksumdata};
s32 now;
@@ -86,96 +85,54 @@ gss_verify_mic_kerberos(struct gss_ctx *gss_ctx,
s32 seqnum;
unsigned char *ptr = (unsigned char *)read_token->data;
int bodysize;
- u32 ret = GSS_S_DEFECTIVE_TOKEN;
dprintk("RPC: krb5_read_token\n");
if (g_verify_token_header(&ctx->mech_used, &bodysize, &ptr,
read_token->len))
- goto out;
+ return GSS_S_DEFECTIVE_TOKEN;
if ((*ptr++ != ((KG_TOK_MIC_MSG>>8)&0xff)) ||
(*ptr++ != ( KG_TOK_MIC_MSG &0xff)) )
- goto out;
+ return GSS_S_DEFECTIVE_TOKEN;
/* XXX sanity-check bodysize?? */
- /* get the sign and seal algorithms */
-
signalg = ptr[0] + (ptr[1] << 8);
- sealalg = ptr[2] + (ptr[3] << 8);
+ if (signalg != SGN_ALG_DES_MAC_MD5)
+ return GSS_S_DEFECTIVE_TOKEN;
- /* Sanity checks */
+ sealalg = ptr[2] + (ptr[3] << 8);
+ if (sealalg != SEAL_ALG_NONE)
+ return GSS_S_DEFECTIVE_TOKEN;
if ((ptr[4] != 0xff) || (ptr[5] != 0xff))
- goto out;
-
- if (sealalg != 0xffff)
- goto out;
-
- /* there are several mappings of seal algorithms to sign algorithms,
- but few enough that we can try them all. */
-
- if ((ctx->sealalg == SEAL_ALG_NONE && signalg > 1) ||
- (ctx->sealalg == SEAL_ALG_1 && signalg != SGN_ALG_3) ||
- (ctx->sealalg == SEAL_ALG_DES3KD &&
- signalg != SGN_ALG_HMAC_SHA1_DES3_KD))
- goto out;
-
- /* compute the checksum of the message */
-
- /* initialize the the cksum */
- switch (signalg) {
- case SGN_ALG_DES_MAC_MD5:
- checksum_type = CKSUMTYPE_RSA_MD5;
- break;
- default:
- ret = GSS_S_DEFECTIVE_TOKEN;
- goto out;
- }
-
- switch (signalg) {
- case SGN_ALG_DES_MAC_MD5:
- ret = make_checksum(checksum_type, ptr - 2, 8,
- message_buffer, 0, &md5cksum);
- if (ret)
- goto out;
-
- ret = krb5_encrypt(ctx->seq, NULL, md5cksum.data,
- md5cksum.data, 16);
- if (ret)
- goto out;
-
- if (memcmp(md5cksum.data + 8, ptr + 14, 8)) {
- ret = GSS_S_BAD_SIG;
- goto out;
- }
- break;
- default:
- ret = GSS_S_DEFECTIVE_TOKEN;
- goto out;
- }
+ return GSS_S_DEFECTIVE_TOKEN;
+
+ if (make_checksum("md5", ptr - 2, 8, message_buffer, 0, &md5cksum))
+ return GSS_S_FAILURE;
+
+ if (krb5_encrypt(ctx->seq, NULL, md5cksum.data, md5cksum.data, 16))
+ return GSS_S_FAILURE;
+
+ if (memcmp(md5cksum.data + 8, ptr + 14, 8))
+ return GSS_S_BAD_SIG;
/* it got through unscathed. Make sure the context is unexpired */
now = get_seconds();
- ret = GSS_S_CONTEXT_EXPIRED;
if (now > ctx->endtime)
- goto out;
+ return GSS_S_CONTEXT_EXPIRED;
/* do sequencing checks */
- ret = GSS_S_BAD_SIG;
- if ((ret = krb5_get_seq_num(ctx->seq, ptr + 14, ptr + 6, &direction,
- &seqnum)))
- goto out;
+ if (krb5_get_seq_num(ctx->seq, ptr + 14, ptr + 6, &direction, &seqnum))
+ return GSS_S_FAILURE;
if ((ctx->initiate && direction != 0xff) ||
(!ctx->initiate && direction != 0))
- goto out;
+ return GSS_S_BAD_SIG;
- ret = GSS_S_COMPLETE;
-out:
- return ret;
+ return GSS_S_COMPLETE;
}
diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
index cc45c1605f8..fe25b3d898d 100644
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -57,9 +57,9 @@ gss_krb5_remove_padding(struct xdr_buf *buf, int blocksize)
>>PAGE_CACHE_SHIFT;
int offset = (buf->page_base + len - 1)
& (PAGE_CACHE_SIZE - 1);
- ptr = kmap_atomic(buf->pages[last], KM_SKB_SUNRPC_DATA);
+ ptr = kmap_atomic(buf->pages[last], KM_USER0);
pad = *(ptr + offset);
- kunmap_atomic(ptr, KM_SKB_SUNRPC_DATA);
+ kunmap_atomic(ptr, KM_USER0);
goto out;
} else
len -= buf->page_len;
@@ -120,7 +120,6 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
struct xdr_buf *buf, struct page **pages)
{
struct krb5_ctx *kctx = ctx->internal_ctx_id;
- s32 checksum_type;
char cksumdata[16];
struct xdr_netobj md5cksum = {.len = 0, .data = cksumdata};
int blocksize = 0, plainlen;
@@ -134,21 +133,6 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
now = get_seconds();
- switch (kctx->signalg) {
- case SGN_ALG_DES_MAC_MD5:
- checksum_type = CKSUMTYPE_RSA_MD5;
- break;
- default:
- dprintk("RPC: gss_krb5_seal: kctx->signalg %d not"
- " supported\n", kctx->signalg);
- goto out_err;
- }
- if (kctx->sealalg != SEAL_ALG_NONE && kctx->sealalg != SEAL_ALG_DES) {
- dprintk("RPC: gss_krb5_seal: kctx->sealalg %d not supported\n",
- kctx->sealalg);
- goto out_err;
- }
-
blocksize = crypto_blkcipher_blocksize(kctx->enc);
gss_krb5_add_padding(buf, offset, blocksize);
BUG_ON((buf->len - offset) % blocksize);
@@ -175,37 +159,27 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
/* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */
krb5_hdr = ptr - 2;
msg_start = krb5_hdr + 24;
- /* XXXJBF: */ BUG_ON(buf->head[0].iov_base + offset + headlen != msg_start + blocksize);
- *(__be16 *)(krb5_hdr + 2) = htons(kctx->signalg);
+ *(__be16 *)(krb5_hdr + 2) = htons(SGN_ALG_DES_MAC_MD5);
memset(krb5_hdr + 4, 0xff, 4);
- *(__be16 *)(krb5_hdr + 4) = htons(kctx->sealalg);
+ *(__be16 *)(krb5_hdr + 4) = htons(SEAL_ALG_DES);
make_confounder(msg_start, blocksize);
/* XXXJBF: UGH!: */
tmp_pages = buf->pages;
buf->pages = pages;
- if (make_checksum(checksum_type, krb5_hdr, 8, buf,
+ if (make_checksum("md5", krb5_hdr, 8, buf,
offset + headlen - blocksize, &md5cksum))
- goto out_err;
+ return GSS_S_FAILURE;
buf->pages = tmp_pages;
- switch (kctx->signalg) {
- case SGN_ALG_DES_MAC_MD5:
- if (krb5_encrypt(kctx->seq, NULL, md5cksum.data,
- md5cksum.data, md5cksum.len))
- goto out_err;
- memcpy(krb5_hdr + 16,
- md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
- KRB5_CKSUM_LENGTH);
-
- dprintk("RPC: make_seal_token: cksum data: \n");
- print_hexl((u32 *) (krb5_hdr + 16), KRB5_CKSUM_LENGTH, 0);
- break;
- default:
- BUG();
- }
+ if (krb5_encrypt(kctx->seq, NULL, md5cksum.data,
+ md5cksum.data, md5cksum.len))
+ return GSS_S_FAILURE;
+ memcpy(krb5_hdr + 16,
+ md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
+ KRB5_CKSUM_LENGTH);
spin_lock(&krb5_seq_lock);
seq_send = kctx->seq_send++;
@@ -215,15 +189,13 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
* and encrypt at the same time: */
if ((krb5_make_seq_num(kctx->seq, kctx->initiate ? 0 : 0xff,
seq_send, krb5_hdr + 16, krb5_hdr + 8)))
- goto out_err;
+ return GSS_S_FAILURE;
if (gss_encrypt_xdr_buf(kctx->enc, buf, offset + headlen - blocksize,
pages))
- goto out_err;
+ return GSS_S_FAILURE;
- return ((kctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE);
-out_err:
- return GSS_S_FAILURE;
+ return (kctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE;
}
u32
@@ -232,7 +204,6 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf)
struct krb5_ctx *kctx = ctx->internal_ctx_id;
int signalg;
int sealalg;
- s32 checksum_type;
char cksumdata[16];
struct xdr_netobj md5cksum = {.len = 0, .data = cksumdata};
s32 now;
@@ -240,7 +211,6 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf)
s32 seqnum;
unsigned char *ptr;
int bodysize;
- u32 ret = GSS_S_DEFECTIVE_TOKEN;
void *data_start, *orig_start;
int data_len;
int blocksize;
@@ -250,98 +220,58 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf)
ptr = (u8 *)buf->head[0].iov_base + offset;
if (g_verify_token_header(&kctx->mech_used, &bodysize, &ptr,
buf->len - offset))
- goto out;
+ return GSS_S_DEFECTIVE_TOKEN;
if ((*ptr++ != ((KG_TOK_WRAP_MSG>>8)&0xff)) ||
(*ptr++ != (KG_TOK_WRAP_MSG &0xff)) )
- goto out;
+ return GSS_S_DEFECTIVE_TOKEN;
/* XXX sanity-check bodysize?? */
/* get the sign and seal algorithms */
signalg = ptr[0] + (ptr[1] << 8);
- sealalg = ptr[2] + (ptr[3] << 8);
+ if (signalg != SGN_ALG_DES_MAC_MD5)
+ return GSS_S_DEFECTIVE_TOKEN;
- /* Sanity checks */
+ sealalg = ptr[2] + (ptr[3] << 8);
+ if (sealalg != SEAL_ALG_DES)
+ return GSS_S_DEFECTIVE_TOKEN;
if ((ptr[4] != 0xff) || (ptr[5] != 0xff))
- goto out;
-
- if (sealalg == 0xffff)
- goto out;
-
- /* in the current spec, there is only one valid seal algorithm per
- key type, so a simple comparison is ok */
-
- if (sealalg != kctx->sealalg)
- goto out;
-
- /* there are several mappings of seal algorithms to sign algorithms,
- but few enough that we can try them all. */
-
- if ((kctx->sealalg == SEAL_ALG_NONE && signalg > 1) ||
- (kctx->sealalg == SEAL_ALG_1 && signalg != SGN_ALG_3) ||
- (kctx->sealalg == SEAL_ALG_DES3KD &&
- signalg != SGN_ALG_HMAC_SHA1_DES3_KD))
- goto out;
+ return GSS_S_DEFECTIVE_TOKEN;
if (gss_decrypt_xdr_buf(kctx->enc, buf,
ptr + 22 - (unsigned char *)buf->head[0].iov_base))
- goto out;
+ return GSS_S_DEFECTIVE_TOKEN;
- /* compute the checksum of the message */
+ if (make_checksum("md5", ptr - 2, 8, buf,
+ ptr + 22 - (unsigned char *)buf->head[0].iov_base, &md5cksum))
+ return GSS_S_FAILURE;
- /* initialize the the cksum */
- switch (signalg) {
- case SGN_ALG_DES_MAC_MD5:
- checksum_type = CKSUMTYPE_RSA_MD5;
- break;
- default:
- ret = GSS_S_DEFECTIVE_TOKEN;
- goto out;
- }
-
- switch (signalg) {
- case SGN_ALG_DES_MAC_MD5:
- ret = make_checksum(checksum_type, ptr - 2, 8, buf,
- ptr + 22 - (unsigned char *)buf->head[0].iov_base, &md5cksum);
- if (ret)
- goto out;
-
- ret = krb5_encrypt(kctx->seq, NULL, md5cksum.data,
- md5cksum.data, md5cksum.len);
- if (ret)
- goto out;
-
- if (memcmp(md5cksum.data + 8, ptr + 14, 8)) {
- ret = GSS_S_BAD_SIG;
- goto out;
- }
- break;
- default:
- ret = GSS_S_DEFECTIVE_TOKEN;
- goto out;
- }
+ if (krb5_encrypt(kctx->seq, NULL, md5cksum.data,
+ md5cksum.data, md5cksum.len))
+ return GSS_S_FAILURE;
+
+ if (memcmp(md5cksum.data + 8, ptr + 14, 8))
+ return GSS_S_BAD_SIG;
/* it got through unscathed. Make sure the context is unexpired */
now = get_seconds();
- ret = GSS_S_CONTEXT_EXPIRED;
if (now > kctx->endtime)
- goto out;
+ return GSS_S_CONTEXT_EXPIRED;
/* do sequencing checks */
- ret = GSS_S_BAD_SIG;
- if ((ret = krb5_get_seq_num(kctx->seq, ptr + 14, ptr + 6, &direction,
- &seqnum)))
- goto out;
+ if (krb5_get_seq_num(kctx->seq, ptr + 14, ptr + 6, &direction,
+ &seqnum))
+ return GSS_S_BAD_SIG;
if ((kctx->initiate && direction != 0xff) ||
(!kctx->initiate && direction != 0))
- goto out;
+ return GSS_S_BAD_SIG;
/* Copy the data back to the right position. XXX: Would probably be
* better to copy and encrypt at the same time. */
@@ -354,11 +284,8 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf)
buf->head[0].iov_len -= (data_start - orig_start);
buf->len -= (data_start - orig_start);
- ret = GSS_S_DEFECTIVE_TOKEN;
if (gss_krb5_remove_padding(buf, blocksize))
- goto out;
+ return GSS_S_DEFECTIVE_TOKEN;
- ret = GSS_S_COMPLETE;
-out:
- return ret;
+ return GSS_S_COMPLETE;
}
diff --git a/net/sunrpc/auth_gss/gss_spkm3_mech.c b/net/sunrpc/auth_gss/gss_spkm3_mech.c
index bdedf456bc1..8ef3f1c1943 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_mech.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_mech.c
@@ -76,140 +76,79 @@ simple_get_netobj(const void *p, const void *end, struct xdr_netobj *res)
q = (const void *)((const char *)p + len);
if (unlikely(q > end || q < p))
return ERR_PTR(-EFAULT);
- res->data = kmalloc(len, GFP_KERNEL);
+ res->data = kmemdup(p, len, GFP_KERNEL);
if (unlikely(res->data == NULL))
return ERR_PTR(-ENOMEM);
- memcpy(res->data, p, len);
return q;
}
-static inline const void *
-get_key(const void *p, const void *end, struct crypto_blkcipher **res,
- int *resalg)
-{
- struct xdr_netobj key = { 0 };
- int setkey = 0;
- char *alg_name;
-
- p = simple_get_bytes(p, end, resalg, sizeof(*resalg));
- if (IS_ERR(p))
- goto out_err;
- p = simple_get_netobj(p, end, &key);
- if (IS_ERR(p))
- goto out_err;
-
- switch (*resalg) {
- case NID_des_cbc:
- alg_name = "cbc(des)";
- setkey = 1;
- break;
- case NID_cast5_cbc:
- /* XXXX here in name only, not used */
- alg_name = "cbc(cast5)";
- setkey = 0; /* XXX will need to set to 1 */
- break;
- case NID_md5:
- if (key.len == 0) {
- dprintk("RPC: SPKM3 get_key: NID_md5 zero Key length\n");
- }
- alg_name = "md5";
- setkey = 0;
- break;
- default:
- dprintk("gss_spkm3_mech: unsupported algorithm %d\n", *resalg);
- goto out_err_free_key;
- }
- *res = crypto_alloc_blkcipher(alg_name, 0, CRYPTO_ALG_ASYNC);
- if (IS_ERR(*res)) {
- printk("gss_spkm3_mech: unable to initialize crypto algorthm %s\n", alg_name);
- *res = NULL;
- goto out_err_free_key;
- }
- if (setkey) {
- if (crypto_blkcipher_setkey(*res, key.data, key.len)) {
- printk("gss_spkm3_mech: error setting key for crypto algorthm %s\n", alg_name);
- goto out_err_free_tfm;
- }
- }
-
- if(key.len > 0)
- kfree(key.data);
- return p;
-
-out_err_free_tfm:
- crypto_free_blkcipher(*res);
-out_err_free_key:
- if(key.len > 0)
- kfree(key.data);
- p = ERR_PTR(-EINVAL);
-out_err:
- return p;
-}
-
static int
gss_import_sec_context_spkm3(const void *p, size_t len,
struct gss_ctx *ctx_id)
{
const void *end = (const void *)((const char *)p + len);
struct spkm3_ctx *ctx;
+ int version;
if (!(ctx = kzalloc(sizeof(*ctx), GFP_KERNEL)))
goto out_err;
+ p = simple_get_bytes(p, end, &version, sizeof(version));
+ if (IS_ERR(p))
+ goto out_err_free_ctx;
+ if (version != 1) {
+ dprintk("RPC: unknown spkm3 token format: obsolete nfs-utils?\n");
+ goto out_err_free_ctx;
+ }
+
p = simple_get_netobj(p, end, &ctx->ctx_id);
if (IS_ERR(p))
goto out_err_free_ctx;
- p = simple_get_bytes(p, end, &ctx->qop, sizeof(ctx->qop));
+ p = simple_get_bytes(p, end, &ctx->endtime, sizeof(ctx->endtime));
if (IS_ERR(p))
goto out_err_free_ctx_id;
p = simple_get_netobj(p, end, &ctx->mech_used);
if (IS_ERR(p))
- goto out_err_free_mech;
+ goto out_err_free_ctx_id;
p = simple_get_bytes(p, end, &ctx->ret_flags, sizeof(ctx->ret_flags));
if (IS_ERR(p))
goto out_err_free_mech;
- p = simple_get_bytes(p, end, &ctx->req_flags, sizeof(ctx->req_flags));
+ p = simple_get_netobj(p, end, &ctx->conf_alg);
if (IS_ERR(p))
goto out_err_free_mech;
- p = simple_get_netobj(p, end, &ctx->share_key);
+ p = simple_get_netobj(p, end, &ctx->derived_conf_key);
if (IS_ERR(p))
- goto out_err_free_s_key;
+ goto out_err_free_conf_alg;
- p = get_key(p, end, &ctx->derived_conf_key, &ctx->conf_alg);
+ p = simple_get_netobj(p, end, &ctx->intg_alg);
if (IS_ERR(p))
- goto out_err_free_s_key;
+ goto out_err_free_conf_key;
- p = get_key(p, end, &ctx->derived_integ_key, &ctx->intg_alg);
+ p = simple_get_netobj(p, end, &ctx->derived_integ_key);
if (IS_ERR(p))
- goto out_err_free_key1;
-
- p = simple_get_bytes(p, end, &ctx->keyestb_alg, sizeof(ctx->keyestb_alg));
- if (IS_ERR(p))
- goto out_err_free_key2;
-
- p = simple_get_bytes(p, end, &ctx->owf_alg, sizeof(ctx->owf_alg));
- if (IS_ERR(p))
- goto out_err_free_key2;
+ goto out_err_free_intg_alg;
if (p != end)
- goto out_err_free_key2;
+ goto out_err_free_intg_key;
ctx_id->internal_ctx_id = ctx;
dprintk("Successfully imported new spkm context.\n");
return 0;
-out_err_free_key2:
- crypto_free_blkcipher(ctx->derived_integ_key);
-out_err_free_key1:
- crypto_free_blkcipher(ctx->derived_conf_key);
-out_err_free_s_key:
- kfree(ctx->share_key.data);
+out_err_free_intg_key:
+ kfree(ctx->derived_integ_key.data);
+out_err_free_intg_alg:
+ kfree(ctx->intg_alg.data);
+out_err_free_conf_key:
+ kfree(ctx->derived_conf_key.data);
+out_err_free_conf_alg:
+ kfree(ctx->conf_alg.data);
out_err_free_mech:
kfree(ctx->mech_used.data);
out_err_free_ctx_id:
@@ -221,13 +160,16 @@ out_err:
}
static void
-gss_delete_sec_context_spkm3(void *internal_ctx) {
+gss_delete_sec_context_spkm3(void *internal_ctx)
+{
struct spkm3_ctx *sctx = internal_ctx;
- crypto_free_blkcipher(sctx->derived_integ_key);
- crypto_free_blkcipher(sctx->derived_conf_key);
- kfree(sctx->share_key.data);
+ kfree(sctx->derived_integ_key.data);
+ kfree(sctx->intg_alg.data);
+ kfree(sctx->derived_conf_key.data);
+ kfree(sctx->conf_alg.data);
kfree(sctx->mech_used.data);
+ kfree(sctx->ctx_id.data);
kfree(sctx);
}
@@ -239,7 +181,6 @@ gss_verify_mic_spkm3(struct gss_ctx *ctx,
u32 maj_stat = 0;
struct spkm3_ctx *sctx = ctx->internal_ctx_id;
- dprintk("RPC: gss_verify_mic_spkm3 calling spkm3_read_token\n");
maj_stat = spkm3_read_token(sctx, checksum, signbuf, SPKM_MIC_TOK);
dprintk("RPC: gss_verify_mic_spkm3 returning %d\n", maj_stat);
@@ -254,10 +195,9 @@ gss_get_mic_spkm3(struct gss_ctx *ctx,
u32 err = 0;
struct spkm3_ctx *sctx = ctx->internal_ctx_id;
- dprintk("RPC: gss_get_mic_spkm3\n");
-
err = spkm3_make_token(sctx, message_buffer,
- message_token, SPKM_MIC_TOK);
+ message_token, SPKM_MIC_TOK);
+ dprintk("RPC: gss_get_mic_spkm3 returning %d\n", err);
return err;
}
@@ -288,7 +228,7 @@ static int __init init_spkm3_module(void)
status = gss_mech_register(&gss_spkm3_mech);
if (status)
printk("Failed to register spkm3 gss mechanism!\n");
- return 0;
+ return status;
}
static void __exit cleanup_spkm3_module(void)
diff --git a/net/sunrpc/auth_gss/gss_spkm3_seal.c b/net/sunrpc/auth_gss/gss_spkm3_seal.c
index 18c7862bc23..b179d58c624 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_seal.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_seal.c
@@ -39,11 +39,17 @@
#include <linux/sunrpc/gss_spkm3.h>
#include <linux/random.h>
#include <linux/crypto.h>
+#include <linux/pagemap.h>
+#include <linux/scatterlist.h>
+#include <linux/sunrpc/xdr.h>
#ifdef RPC_DEBUG
# define RPCDBG_FACILITY RPCDBG_AUTH
#endif
+const struct xdr_netobj hmac_md5_oid = { 8, "\x2B\x06\x01\x05\x05\x08\x01\x01"};
+const struct xdr_netobj cast5_cbc_oid = {9, "\x2A\x86\x48\x86\xF6\x7D\x07\x42\x0A"};
+
/*
* spkm3_make_token()
*
@@ -66,29 +72,23 @@ spkm3_make_token(struct spkm3_ctx *ctx,
int ctxelen = 0, ctxzbit = 0;
int md5elen = 0, md5zbit = 0;
- dprintk("RPC: spkm3_make_token\n");
-
now = jiffies;
if (ctx->ctx_id.len != 16) {
dprintk("RPC: spkm3_make_token BAD ctx_id.len %d\n",
- ctx->ctx_id.len);
+ ctx->ctx_id.len);
goto out_err;
}
-
- switch (ctx->intg_alg) {
- case NID_md5:
- checksum_type = CKSUMTYPE_RSA_MD5;
- break;
- default:
- dprintk("RPC: gss_spkm3_seal: ctx->signalg %d not"
- " supported\n", ctx->intg_alg);
- goto out_err;
- }
- /* XXX since we don't support WRAP, perhaps we don't care... */
- if (ctx->conf_alg != NID_cast5_cbc) {
- dprintk("RPC: gss_spkm3_seal: ctx->sealalg %d not supported\n",
- ctx->conf_alg);
+
+ if (!g_OID_equal(&ctx->intg_alg, &hmac_md5_oid)) {
+ dprintk("RPC: gss_spkm3_seal: unsupported I-ALG algorithm."
+ "only support hmac-md5 I-ALG.\n");
+ goto out_err;
+ } else
+ checksum_type = CKSUMTYPE_HMAC_MD5;
+
+ if (!g_OID_equal(&ctx->conf_alg, &cast5_cbc_oid)) {
+ dprintk("RPC: gss_spkm3_seal: unsupported C-ALG algorithm\n");
goto out_err;
}
@@ -96,10 +96,10 @@ spkm3_make_token(struct spkm3_ctx *ctx,
/* Calculate checksum over the mic-header */
asn1_bitstring_len(&ctx->ctx_id, &ctxelen, &ctxzbit);
spkm3_mic_header(&mic_hdr.data, &mic_hdr.len, ctx->ctx_id.data,
- ctxelen, ctxzbit);
-
- if (make_checksum(checksum_type, mic_hdr.data, mic_hdr.len,
- text, 0, &md5cksum))
+ ctxelen, ctxzbit);
+ if (make_spkm3_checksum(checksum_type, &ctx->derived_integ_key,
+ (char *)mic_hdr.data, mic_hdr.len,
+ text, 0, &md5cksum))
goto out_err;
asn1_bitstring_len(&md5cksum, &md5elen, &md5zbit);
@@ -121,7 +121,66 @@ spkm3_make_token(struct spkm3_ctx *ctx,
return GSS_S_COMPLETE;
out_err:
+ if (md5cksum.data)
+ kfree(md5cksum.data);
+
token->data = NULL;
token->len = 0;
return GSS_S_FAILURE;
}
+
+static int
+spkm3_checksummer(struct scatterlist *sg, void *data)
+{
+ struct hash_desc *desc = data;
+
+ return crypto_hash_update(desc, sg, sg->length);
+}
+
+/* checksum the plaintext data and hdrlen bytes of the token header */
+s32
+make_spkm3_checksum(s32 cksumtype, struct xdr_netobj *key, char *header,
+ unsigned int hdrlen, struct xdr_buf *body,
+ unsigned int body_offset, struct xdr_netobj *cksum)
+{
+ char *cksumname;
+ struct hash_desc desc; /* XXX add to ctx? */
+ struct scatterlist sg[1];
+ int err;
+
+ switch (cksumtype) {
+ case CKSUMTYPE_HMAC_MD5:
+ cksumname = "md5";
+ break;
+ default:
+ dprintk("RPC: spkm3_make_checksum:"
+ " unsupported checksum %d", cksumtype);
+ return GSS_S_FAILURE;
+ }
+
+ if (key->data == NULL || key->len <= 0) return GSS_S_FAILURE;
+
+ desc.tfm = crypto_alloc_hash(cksumname, 0, CRYPTO_ALG_ASYNC);
+ if (IS_ERR(desc.tfm))
+ return GSS_S_FAILURE;
+ cksum->len = crypto_hash_digestsize(desc.tfm);
+ desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+
+ err = crypto_hash_setkey(desc.tfm, key->data, key->len);
+ if (err)
+ goto out;
+
+ sg_set_buf(sg, header, hdrlen);
+ crypto_hash_update(&desc, sg, 1);
+
+ xdr_process_buf(body, body_offset, body->len - body_offset,
+ spkm3_checksummer, &desc);
+ crypto_hash_final(&desc, cksum->data);
+
+out:
+ crypto_free_hash(desc.tfm);
+
+ return err ? GSS_S_FAILURE : 0;
+}
+
+EXPORT_SYMBOL(make_spkm3_checksum);
diff --git a/net/sunrpc/auth_gss/gss_spkm3_token.c b/net/sunrpc/auth_gss/gss_spkm3_token.c
index 854a983ccf2..35188b6ea8f 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_token.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_token.c
@@ -172,10 +172,10 @@ spkm3_mic_header(unsigned char **hdrbuf, unsigned int *hdrlen, unsigned char *ct
*(u8 *)hptr++ = zbit;
memcpy(hptr, ctxdata, elen);
hptr += elen;
- *hdrlen = hptr - top;
+ *hdrlen = hptr - top;
}
-
-/*
+
+/*
* spkm3_mic_innercontext_token()
*
* *tokp points to the beginning of the SPKM_MIC token described
diff --git a/net/sunrpc/auth_gss/gss_spkm3_unseal.c b/net/sunrpc/auth_gss/gss_spkm3_unseal.c
index 8537f581ef9..e54581ca757 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_unseal.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_unseal.c
@@ -54,70 +54,70 @@ spkm3_read_token(struct spkm3_ctx *ctx,
struct xdr_buf *message_buffer, /* signbuf */
int toktype)
{
+ s32 checksum_type;
s32 code;
struct xdr_netobj wire_cksum = {.len =0, .data = NULL};
char cksumdata[16];
struct xdr_netobj md5cksum = {.len = 0, .data = cksumdata};
unsigned char *ptr = (unsigned char *)read_token->data;
- unsigned char *cksum;
+ unsigned char *cksum;
int bodysize, md5elen;
int mic_hdrlen;
u32 ret = GSS_S_DEFECTIVE_TOKEN;
- dprintk("RPC: spkm3_read_token read_token->len %d\n", read_token->len);
-
if (g_verify_token_header((struct xdr_netobj *) &ctx->mech_used,
&bodysize, &ptr, read_token->len))
goto out;
/* decode the token */
- if (toktype == SPKM_MIC_TOK) {
-
- if ((ret = spkm3_verify_mic_token(&ptr, &mic_hdrlen, &cksum)))
- goto out;
-
- if (*cksum++ != 0x03) {
- dprintk("RPC: spkm3_read_token BAD checksum type\n");
- goto out;
- }
- md5elen = *cksum++;
- cksum++; /* move past the zbit */
-
- if(!decode_asn1_bitstring(&wire_cksum, cksum, md5elen - 1, 16))
- goto out;
-
- /* HARD CODED FOR MD5 */
-
- /* compute the checksum of the message.
- * ptr + 2 = start of header piece of checksum
- * mic_hdrlen + 2 = length of header piece of checksum
- */
- ret = GSS_S_DEFECTIVE_TOKEN;
- code = make_checksum(CKSUMTYPE_RSA_MD5, ptr + 2,
- mic_hdrlen + 2,
- message_buffer, 0, &md5cksum);
-
- if (code)
- goto out;
-
- dprintk("RPC: spkm3_read_token: digest wire_cksum.len %d:\n",
- wire_cksum.len);
- dprintk(" md5cksum.data\n");
- print_hexl((u32 *) md5cksum.data, 16, 0);
- dprintk(" cksum.data:\n");
- print_hexl((u32 *) wire_cksum.data, wire_cksum.len, 0);
-
- ret = GSS_S_BAD_SIG;
- code = memcmp(md5cksum.data, wire_cksum.data, wire_cksum.len);
- if (code)
- goto out;
-
- } else {
- dprintk("RPC: BAD or UNSUPPORTED SPKM3 token type: %d\n",toktype);
+ if (toktype != SPKM_MIC_TOK) {
+ dprintk("RPC: BAD SPKM3 token type: %d\n", toktype);
+ goto out;
+ }
+
+ if ((ret = spkm3_verify_mic_token(&ptr, &mic_hdrlen, &cksum)))
+ goto out;
+
+ if (*cksum++ != 0x03) {
+ dprintk("RPC: spkm3_read_token BAD checksum type\n");
+ goto out;
+ }
+ md5elen = *cksum++;
+ cksum++; /* move past the zbit */
+
+ if (!decode_asn1_bitstring(&wire_cksum, cksum, md5elen - 1, 16))
+ goto out;
+
+ /* HARD CODED FOR MD5 */
+
+ /* compute the checksum of the message.
+ * ptr + 2 = start of header piece of checksum
+ * mic_hdrlen + 2 = length of header piece of checksum
+ */
+ ret = GSS_S_DEFECTIVE_TOKEN;
+ if (!g_OID_equal(&ctx->intg_alg, &hmac_md5_oid)) {
+ dprintk("RPC: gss_spkm3_seal: unsupported I-ALG algorithm\n");
+ goto out;
+ }
+
+ checksum_type = CKSUMTYPE_HMAC_MD5;
+
+ code = make_spkm3_checksum(checksum_type,
+ &ctx->derived_integ_key, ptr + 2, mic_hdrlen + 2,
+ message_buffer, 0, &md5cksum);
+
+ if (code)
+ goto out;
+
+ ret = GSS_S_BAD_SIG;
+ code = memcmp(md5cksum.data, wire_cksum.data, wire_cksum.len);
+ if (code) {
+ dprintk("RPC: bad MIC checksum\n");
goto out;
}
+
/* XXX: need to add expiration and sequencing */
ret = GSS_S_COMPLETE;
out:
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 1f0f079ffa6..066c64a97fd 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -113,9 +113,7 @@ static int rsi_match(struct cache_head *a, struct cache_head *b)
static int dup_to_netobj(struct xdr_netobj *dst, char *src, int len)
{
dst->len = len;
- dst->data = (len ? kmalloc(len, GFP_KERNEL) : NULL);
- if (dst->data)
- memcpy(dst->data, src, len);
+ dst->data = (len ? kmemdup(src, len, GFP_KERNEL) : NULL);
if (len && !dst->data)
return -ENOMEM;
return 0;
@@ -756,10 +754,9 @@ svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
if (!new)
goto out;
kref_init(&new->h.ref);
- new->h.name = kmalloc(strlen(name) + 1, GFP_KERNEL);
+ new->h.name = kstrdup(name, GFP_KERNEL);
if (!new->h.name)
goto out_free_dom;
- strcpy(new->h.name, name);
new->h.flavour = &svcauthops_gss;
new->pseudoflavor = pseudoflavor;
@@ -807,19 +804,19 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
integ_len = svc_getnl(&buf->head[0]);
if (integ_len & 3)
- goto out;
+ return stat;
if (integ_len > buf->len)
- goto out;
+ return stat;
if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len))
BUG();
/* copy out mic... */
if (read_u32_from_xdr_buf(buf, integ_len, &mic.len))
BUG();
if (mic.len > RPC_MAX_AUTH_SIZE)
- goto out;
+ return stat;
mic.data = kmalloc(mic.len, GFP_KERNEL);
if (!mic.data)
- goto out;
+ return stat;
if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len))
goto out;
maj_stat = gss_verify_mic(ctx, &integ_buf, &mic);
@@ -829,6 +826,7 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
goto out;
stat = 0;
out:
+ kfree(mic.data);
return stat;
}
@@ -1068,7 +1066,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
}
switch(cache_check(&rsi_cache, &rsip->h, &rqstp->rq_chandle)) {
case -EAGAIN:
- goto drop;
+ case -ETIMEDOUT:
case -ENOENT:
goto drop;
case 0:
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-12-03 10:57:00 +0000