1 /* 2 * linux/net/sunrpc/gss_krb5_mech.c 3 * 4 * Copyright (c) 2001 The Regents of the University of Michigan. 5 * All rights reserved. 6 * 7 * Andy Adamson <andros@umich.edu> 8 * J. Bruce Fields <bfields@umich.edu> 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. Neither the name of the University nor the names of its 20 * contributors may be used to endorse or promote products derived 21 * from this software without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED 24 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 25 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 26 * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 28 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 29 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 30 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 * 35 */ 36 37 #include <linux/module.h> 38 #include <linux/init.h> 39 #include <linux/types.h> 40 #include <linux/slab.h> 41 #include <linux/sunrpc/auth.h> 42 #include <linux/in.h> 43 #include <linux/sunrpc/gss_krb5.h> 44 #include <linux/sunrpc/xdr.h> 45 #include <linux/crypto.h> 46 47 #ifdef RPC_DEBUG 48 # define RPCDBG_FACILITY RPCDBG_AUTH 49 #endif 50 51 static const void * 52 simple_get_bytes(const void *p, const void *end, void *res, int len) 53 { 54 const void *q = (const void *)((const char *)p + len); 55 if (unlikely(q > end || q < p)) 56 return ERR_PTR(-EFAULT); 57 memcpy(res, p, len); 58 return q; 59 } 60 61 static const void * 62 simple_get_netobj(const void *p, const void *end, struct xdr_netobj *res) 63 { 64 const void *q; 65 unsigned int len; 66 67 p = simple_get_bytes(p, end, &len, sizeof(len)); 68 if (IS_ERR(p)) 69 return p; 70 q = (const void *)((const char *)p + len); 71 if (unlikely(q > end || q < p)) 72 return ERR_PTR(-EFAULT); 73 res->data = kmalloc(len, GFP_KERNEL); 74 if (unlikely(res->data == NULL)) 75 return ERR_PTR(-ENOMEM); 76 memcpy(res->data, p, len); 77 res->len = len; 78 return q; 79 } 80 81 static inline const void * 82 get_key(const void *p, const void *end, struct crypto_tfm **res) 83 { 84 struct xdr_netobj key; 85 int alg, alg_mode; 86 char *alg_name; 87 88 p = simple_get_bytes(p, end, &alg, sizeof(alg)); 89 if (IS_ERR(p)) 90 goto out_err; 91 p = simple_get_netobj(p, end, &key); 92 if (IS_ERR(p)) 93 goto out_err; 94 95 switch (alg) { 96 case ENCTYPE_DES_CBC_RAW: 97 alg_name = "des"; 98 alg_mode = CRYPTO_TFM_MODE_CBC; 99 break; 100 default: 101 dprintk("RPC: get_key: unsupported algorithm %d\n", alg); 102 goto out_err_free_key; 103 } 104 if (!(*res = crypto_alloc_tfm(alg_name, alg_mode))) 105 goto out_err_free_key; 106 if (crypto_cipher_setkey(*res, key.data, key.len)) 107 goto out_err_free_tfm; 108 109 kfree(key.data); 110 return p; 111 112 out_err_free_tfm: 113 crypto_free_tfm(*res); 114 out_err_free_key: 115 kfree(key.data); 116 p = ERR_PTR(-EINVAL); 117 out_err: 118 return p; 119 } 120 121 static int 122 gss_import_sec_context_kerberos(const void *p, 123 size_t len, 124 struct gss_ctx *ctx_id) 125 { 126 const void *end = (const void *)((const char *)p + len); 127 struct krb5_ctx *ctx; 128 129 if (!(ctx = kmalloc(sizeof(*ctx), GFP_KERNEL))) 130 goto out_err; 131 memset(ctx, 0, sizeof(*ctx)); 132 133 p = simple_get_bytes(p, end, &ctx->initiate, sizeof(ctx->initiate)); 134 if (IS_ERR(p)) 135 goto out_err_free_ctx; 136 p = simple_get_bytes(p, end, &ctx->seed_init, sizeof(ctx->seed_init)); 137 if (IS_ERR(p)) 138 goto out_err_free_ctx; 139 p = simple_get_bytes(p, end, ctx->seed, sizeof(ctx->seed)); 140 if (IS_ERR(p)) 141 goto out_err_free_ctx; 142 p = simple_get_bytes(p, end, &ctx->signalg, sizeof(ctx->signalg)); 143 if (IS_ERR(p)) 144 goto out_err_free_ctx; 145 p = simple_get_bytes(p, end, &ctx->sealalg, sizeof(ctx->sealalg)); 146 if (IS_ERR(p)) 147 goto out_err_free_ctx; 148 p = simple_get_bytes(p, end, &ctx->endtime, sizeof(ctx->endtime)); 149 if (IS_ERR(p)) 150 goto out_err_free_ctx; 151 p = simple_get_bytes(p, end, &ctx->seq_send, sizeof(ctx->seq_send)); 152 if (IS_ERR(p)) 153 goto out_err_free_ctx; 154 p = simple_get_netobj(p, end, &ctx->mech_used); 155 if (IS_ERR(p)) 156 goto out_err_free_ctx; 157 p = get_key(p, end, &ctx->enc); 158 if (IS_ERR(p)) 159 goto out_err_free_mech; 160 p = get_key(p, end, &ctx->seq); 161 if (IS_ERR(p)) 162 goto out_err_free_key1; 163 if (p != end) { 164 p = ERR_PTR(-EFAULT); 165 goto out_err_free_key2; 166 } 167 168 ctx_id->internal_ctx_id = ctx; 169 dprintk("RPC: Succesfully imported new context.\n"); 170 return 0; 171 172 out_err_free_key2: 173 crypto_free_tfm(ctx->seq); 174 out_err_free_key1: 175 crypto_free_tfm(ctx->enc); 176 out_err_free_mech: 177 kfree(ctx->mech_used.data); 178 out_err_free_ctx: 179 kfree(ctx); 180 out_err: 181 return PTR_ERR(p); 182 } 183 184 static void 185 gss_delete_sec_context_kerberos(void *internal_ctx) { 186 struct krb5_ctx *kctx = internal_ctx; 187 188 crypto_free_tfm(kctx->seq); 189 crypto_free_tfm(kctx->enc); 190 kfree(kctx->mech_used.data); 191 kfree(kctx); 192 } 193 194 static u32 195 gss_verify_mic_kerberos(struct gss_ctx *ctx, 196 struct xdr_buf *message, 197 struct xdr_netobj *mic_token, 198 u32 *qstate) { 199 u32 maj_stat = 0; 200 int qop_state; 201 struct krb5_ctx *kctx = ctx->internal_ctx_id; 202 203 maj_stat = krb5_read_token(kctx, mic_token, message, &qop_state, 204 KG_TOK_MIC_MSG); 205 if (!maj_stat && qop_state) 206 *qstate = qop_state; 207 208 dprintk("RPC: gss_verify_mic_kerberos returning %d\n", maj_stat); 209 return maj_stat; 210 } 211 212 static u32 213 gss_get_mic_kerberos(struct gss_ctx *ctx, 214 u32 qop, 215 struct xdr_buf *message, 216 struct xdr_netobj *mic_token) { 217 u32 err = 0; 218 struct krb5_ctx *kctx = ctx->internal_ctx_id; 219 220 err = krb5_make_token(kctx, qop, message, mic_token, KG_TOK_MIC_MSG); 221 222 dprintk("RPC: gss_get_mic_kerberos returning %d\n",err); 223 224 return err; 225 } 226 227 static struct gss_api_ops gss_kerberos_ops = { 228 .gss_import_sec_context = gss_import_sec_context_kerberos, 229 .gss_get_mic = gss_get_mic_kerberos, 230 .gss_verify_mic = gss_verify_mic_kerberos, 231 .gss_delete_sec_context = gss_delete_sec_context_kerberos, 232 }; 233 234 static struct pf_desc gss_kerberos_pfs[] = { 235 [0] = { 236 .pseudoflavor = RPC_AUTH_GSS_KRB5, 237 .service = RPC_GSS_SVC_NONE, 238 .name = "krb5", 239 }, 240 [1] = { 241 .pseudoflavor = RPC_AUTH_GSS_KRB5I, 242 .service = RPC_GSS_SVC_INTEGRITY, 243 .name = "krb5i", 244 }, 245 }; 246 247 static struct gss_api_mech gss_kerberos_mech = { 248 .gm_name = "krb5", 249 .gm_owner = THIS_MODULE, 250 .gm_ops = &gss_kerberos_ops, 251 .gm_pf_num = ARRAY_SIZE(gss_kerberos_pfs), 252 .gm_pfs = gss_kerberos_pfs, 253 }; 254 255 static int __init init_kerberos_module(void) 256 { 257 int status; 258 259 status = gss_mech_register(&gss_kerberos_mech); 260 if (status) 261 printk("Failed to register kerberos gss mechanism!\n"); 262 return status; 263 } 264 265 static void __exit cleanup_kerberos_module(void) 266 { 267 gss_mech_unregister(&gss_kerberos_mech); 268 } 269 270 MODULE_LICENSE("GPL"); 271 module_init(init_kerberos_module); 272 module_exit(cleanup_kerberos_module); 273