1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
2 * vim:expandtab:shiftwidth=8:tabstop=8:
4 * Modifications for Lustre
5 * Copyright 2004, Cluster File Systems, Inc.
7 * Author: Eric Mei <ericm@clusterfs.com>
11 * linux/net/sunrpc/gss_krb5_seal.c
13 * Adapted from MIT Kerberos 5-1.2.1 lib/gssapi/krb5/k5seal.c
15 * Copyright (c) 2000 The Regents of the University of Michigan.
16 * All rights reserved.
18 * Andy Adamson <andros@umich.edu>
19 * J. Bruce Fields <bfields@umich.edu>
23 * Copyright 1993 by OpenVision Technologies, Inc.
25 * Permission to use, copy, modify, distribute, and sell this software
26 * and its documentation for any purpose is hereby granted without fee,
27 * provided that the above copyright notice appears in all copies and
28 * that both that copyright notice and this permission notice appear in
29 * supporting documentation, and that the name of OpenVision not be used
30 * in advertising or publicity pertaining to distribution of the software
31 * without specific, written prior permission. OpenVision makes no
32 * representations about the suitability of this software for any
33 * purpose. It is provided "as is" without express or implied warranty.
35 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
36 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
37 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
38 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
39 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
40 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
41 * PERFORMANCE OF THIS SOFTWARE.
45 * Copyright (C) 1998 by the FundsXpress, INC.
47 * All rights reserved.
49 * Export of this software from the United States of America may require
50 * a specific license from the United States Government. It is the
51 * responsibility of any person or organization contemplating export to
52 * obtain such a license before exporting.
54 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
55 * distribute this software and its documentation for any purpose and
56 * without fee is hereby granted, provided that the above copyright
57 * notice appear in all copies and that both that copyright notice and
58 * this permission notice appear in supporting documentation, and that
59 * the name of FundsXpress. not be used in advertising or publicity pertaining
60 * to distribution of the software without specific, written prior
61 * permission. FundsXpress makes no representations about the suitability of
62 * this software for any purpose. It is provided "as is" without express
63 * or implied warranty.
65 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
66 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
67 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
71 # define EXPORT_SYMTAB
73 #define DEBUG_SUBSYSTEM S_SEC
75 #include <linux/init.h>
76 #include <linux/module.h>
77 #include <linux/slab.h>
78 #include <linux/crypto.h>
80 #include <liblustre.h>
81 //#include "../kcrypto/libcrypto.h"
82 #include <netinet/in.h>
85 #include <libcfs/kp30.h>
86 #include <linux/obd.h>
87 #include <linux/obd_class.h>
88 #include <linux/obd_support.h>
89 #include <linux/lustre_idl.h>
90 #include <linux/lustre_net.h>
91 #include <linux/lustre_import.h>
92 #include <linux/lustre_sec.h>
95 #include "gss_internal.h"
99 spinlock_t krb5_seq_lock = SPIN_LOCK_UNLOCKED;
102 krb5_make_token(struct krb5_ctx *ctx,
108 rawobj_t md5cksum = {.len = 0, .data = NULL};
109 unsigned char *ptr, *krb5_hdr, *msg_start;
118 switch (ctx->signalg) {
119 case SGN_ALG_DES_MAC_MD5:
120 checksum_type = CKSUMTYPE_RSA_MD5;
123 CERROR("ctx->signalg %d not supported\n", ctx->signalg);
126 if (ctx->sealalg != SEAL_ALG_NONE && ctx->sealalg != SEAL_ALG_DES) {
127 CERROR("ctx->sealalg %d not supported\n", ctx->sealalg);
131 token->len = g_token_size(&ctx->mech_used, 22);
134 g_make_token_header(&ctx->mech_used, 22, &ptr);
136 *ptr++ = (unsigned char) ((KG_TOK_MIC_MSG>>8)&0xff);
137 *ptr++ = (unsigned char) (KG_TOK_MIC_MSG&0xff);
139 /* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */
141 msg_start = krb5_hdr + 24;
143 *(__u16 *)(krb5_hdr + 2) = cpu_to_be16(ctx->signalg);
144 memset(krb5_hdr + 4, 0xff, 4);
146 if (make_checksum(checksum_type, (char *)krb5_hdr, 8, text, &md5cksum))
149 switch (ctx->signalg) {
150 case SGN_ALG_DES_MAC_MD5:
151 if (krb5_encrypt(ctx->seq, NULL, md5cksum.data,
152 md5cksum.data, md5cksum.len))
154 memcpy(krb5_hdr + 16,
155 md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
163 OBD_FREE(md5cksum.data, md5cksum.len);
165 spin_lock(&krb5_seq_lock);
166 seq_send = ctx->seq_send++;
167 spin_unlock(&krb5_seq_lock);
169 if ((krb5_make_seq_num(ctx->seq, ctx->initiate ? 0 : 0xff,
170 seq_send, krb5_hdr + 16, krb5_hdr + 8)))
173 return ((ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE);
176 OBD_FREE(md5cksum.data, md5cksum.len);
177 return GSS_S_FAILURE;