gss_krb5_mech.c 6.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256
  1. /*
  2. * linux/net/sunrpc/gss_krb5_mech.c
  3. *
  4. * Copyright (c) 2001 The Regents of the University of Michigan.
  5. * All rights reserved.
  6. *
  7. * Andy Adamson <andros@umich.edu>
  8. * J. Bruce Fields <bfields@umich.edu>
  9. *
  10. * Redistribution and use in source and binary forms, with or without
  11. * modification, are permitted provided that the following conditions
  12. * are met:
  13. *
  14. * 1. Redistributions of source code must retain the above copyright
  15. * notice, this list of conditions and the following disclaimer.
  16. * 2. Redistributions in binary form must reproduce the above copyright
  17. * notice, this list of conditions and the following disclaimer in the
  18. * documentation and/or other materials provided with the distribution.
  19. * 3. Neither the name of the University nor the names of its
  20. * contributors may be used to endorse or promote products derived
  21. * from this software without specific prior written permission.
  22. *
  23. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  24. * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  25. * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  26. * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  27. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  28. * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  29. * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  30. * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31. * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32. * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33. * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34. *
  35. */
  36. #include <linux/err.h>
  37. #include <linux/module.h>
  38. #include <linux/init.h>
  39. #include <linux/types.h>
  40. #include <linux/slab.h>
  41. #include <linux/sunrpc/auth.h>
  42. #include <linux/sunrpc/gss_krb5.h>
  43. #include <linux/sunrpc/xdr.h>
  44. #include <linux/crypto.h>
  45. #ifdef RPC_DEBUG
  46. # define RPCDBG_FACILITY RPCDBG_AUTH
  47. #endif
  48. static const void *
  49. simple_get_bytes(const void *p, const void *end, void *res, int len)
  50. {
  51. const void *q = (const void *)((const char *)p + len);
  52. if (unlikely(q > end || q < p))
  53. return ERR_PTR(-EFAULT);
  54. memcpy(res, p, len);
  55. return q;
  56. }
  57. static const void *
  58. simple_get_netobj(const void *p, const void *end, struct xdr_netobj *res)
  59. {
  60. const void *q;
  61. unsigned int len;
  62. p = simple_get_bytes(p, end, &len, sizeof(len));
  63. if (IS_ERR(p))
  64. return p;
  65. q = (const void *)((const char *)p + len);
  66. if (unlikely(q > end || q < p))
  67. return ERR_PTR(-EFAULT);
  68. res->data = kmemdup(p, len, GFP_KERNEL);
  69. if (unlikely(res->data == NULL))
  70. return ERR_PTR(-ENOMEM);
  71. res->len = len;
  72. return q;
  73. }
  74. static inline const void *
  75. get_key(const void *p, const void *end, struct crypto_blkcipher **res)
  76. {
  77. struct xdr_netobj key;
  78. int alg;
  79. char *alg_name;
  80. p = simple_get_bytes(p, end, &alg, sizeof(alg));
  81. if (IS_ERR(p))
  82. goto out_err;
  83. p = simple_get_netobj(p, end, &key);
  84. if (IS_ERR(p))
  85. goto out_err;
  86. switch (alg) {
  87. case ENCTYPE_DES_CBC_RAW:
  88. alg_name = "cbc(des)";
  89. break;
  90. default:
  91. printk("gss_kerberos_mech: unsupported algorithm %d\n", alg);
  92. goto out_err_free_key;
  93. }
  94. *res = crypto_alloc_blkcipher(alg_name, 0, CRYPTO_ALG_ASYNC);
  95. if (IS_ERR(*res)) {
  96. printk("gss_kerberos_mech: unable to initialize crypto algorithm %s\n", alg_name);
  97. *res = NULL;
  98. goto out_err_free_key;
  99. }
  100. if (crypto_blkcipher_setkey(*res, key.data, key.len)) {
  101. printk("gss_kerberos_mech: error setting key for crypto algorithm %s\n", alg_name);
  102. goto out_err_free_tfm;
  103. }
  104. kfree(key.data);
  105. return p;
  106. out_err_free_tfm:
  107. crypto_free_blkcipher(*res);
  108. out_err_free_key:
  109. kfree(key.data);
  110. p = ERR_PTR(-EINVAL);
  111. out_err:
  112. return p;
  113. }
  114. static int
  115. gss_import_sec_context_kerberos(const void *p,
  116. size_t len,
  117. struct gss_ctx *ctx_id)
  118. {
  119. const void *end = (const void *)((const char *)p + len);
  120. struct krb5_ctx *ctx;
  121. int tmp;
  122. if (!(ctx = kzalloc(sizeof(*ctx), GFP_KERNEL)))
  123. goto out_err;
  124. p = simple_get_bytes(p, end, &ctx->initiate, sizeof(ctx->initiate));
  125. if (IS_ERR(p))
  126. goto out_err_free_ctx;
  127. /* The downcall format was designed before we completely understood
  128. * the uses of the context fields; so it includes some stuff we
  129. * just give some minimal sanity-checking, and some we ignore
  130. * completely (like the next twenty bytes): */
  131. if (unlikely(p + 20 > end || p + 20 < p))
  132. goto out_err_free_ctx;
  133. p += 20;
  134. p = simple_get_bytes(p, end, &tmp, sizeof(tmp));
  135. if (IS_ERR(p))
  136. goto out_err_free_ctx;
  137. if (tmp != SGN_ALG_DES_MAC_MD5)
  138. goto out_err_free_ctx;
  139. p = simple_get_bytes(p, end, &tmp, sizeof(tmp));
  140. if (IS_ERR(p))
  141. goto out_err_free_ctx;
  142. if (tmp != SEAL_ALG_DES)
  143. goto out_err_free_ctx;
  144. p = simple_get_bytes(p, end, &ctx->endtime, sizeof(ctx->endtime));
  145. if (IS_ERR(p))
  146. goto out_err_free_ctx;
  147. p = simple_get_bytes(p, end, &ctx->seq_send, sizeof(ctx->seq_send));
  148. if (IS_ERR(p))
  149. goto out_err_free_ctx;
  150. p = simple_get_netobj(p, end, &ctx->mech_used);
  151. if (IS_ERR(p))
  152. goto out_err_free_ctx;
  153. p = get_key(p, end, &ctx->enc);
  154. if (IS_ERR(p))
  155. goto out_err_free_mech;
  156. p = get_key(p, end, &ctx->seq);
  157. if (IS_ERR(p))
  158. goto out_err_free_key1;
  159. if (p != end) {
  160. p = ERR_PTR(-EFAULT);
  161. goto out_err_free_key2;
  162. }
  163. ctx_id->internal_ctx_id = ctx;
  164. dprintk("RPC: Successfully imported new context.\n");
  165. return 0;
  166. out_err_free_key2:
  167. crypto_free_blkcipher(ctx->seq);
  168. out_err_free_key1:
  169. crypto_free_blkcipher(ctx->enc);
  170. out_err_free_mech:
  171. kfree(ctx->mech_used.data);
  172. out_err_free_ctx:
  173. kfree(ctx);
  174. out_err:
  175. return PTR_ERR(p);
  176. }
  177. static void
  178. gss_delete_sec_context_kerberos(void *internal_ctx) {
  179. struct krb5_ctx *kctx = internal_ctx;
  180. crypto_free_blkcipher(kctx->seq);
  181. crypto_free_blkcipher(kctx->enc);
  182. kfree(kctx->mech_used.data);
  183. kfree(kctx);
  184. }
  185. static struct gss_api_ops gss_kerberos_ops = {
  186. .gss_import_sec_context = gss_import_sec_context_kerberos,
  187. .gss_get_mic = gss_get_mic_kerberos,
  188. .gss_verify_mic = gss_verify_mic_kerberos,
  189. .gss_wrap = gss_wrap_kerberos,
  190. .gss_unwrap = gss_unwrap_kerberos,
  191. .gss_delete_sec_context = gss_delete_sec_context_kerberos,
  192. };
  193. static struct pf_desc gss_kerberos_pfs[] = {
  194. [0] = {
  195. .pseudoflavor = RPC_AUTH_GSS_KRB5,
  196. .service = RPC_GSS_SVC_NONE,
  197. .name = "krb5",
  198. },
  199. [1] = {
  200. .pseudoflavor = RPC_AUTH_GSS_KRB5I,
  201. .service = RPC_GSS_SVC_INTEGRITY,
  202. .name = "krb5i",
  203. },
  204. [2] = {
  205. .pseudoflavor = RPC_AUTH_GSS_KRB5P,
  206. .service = RPC_GSS_SVC_PRIVACY,
  207. .name = "krb5p",
  208. },
  209. };
  210. static struct gss_api_mech gss_kerberos_mech = {
  211. .gm_name = "krb5",
  212. .gm_owner = THIS_MODULE,
  213. .gm_ops = &gss_kerberos_ops,
  214. .gm_pf_num = ARRAY_SIZE(gss_kerberos_pfs),
  215. .gm_pfs = gss_kerberos_pfs,
  216. };
  217. static int __init init_kerberos_module(void)
  218. {
  219. int status;
  220. status = gss_mech_register(&gss_kerberos_mech);
  221. if (status)
  222. printk("Failed to register kerberos gss mechanism!\n");
  223. return status;
  224. }
  225. static void __exit cleanup_kerberos_module(void)
  226. {
  227. gss_mech_unregister(&gss_kerberos_mech);
  228. }
  229. MODULE_LICENSE("GPL");
  230. module_init(init_kerberos_module);
  231. module_exit(cleanup_kerberos_module);