1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
2 * vim:expandtab:shiftwidth=8:tabstop=8:
4 * Modifications for Lustre
5 * Copyright 2004, Cluster File Systems, Inc.
7 * Author: Eric Mei <ericm@clusterfs.com>
11 * linux/net/sunrpc/gss_krb5_unseal.c
13 * Adapted from MIT Kerberos 5-1.2.1 lib/gssapi/krb5/k5unseal.c
15 * Copyright (c) 2000 The Regents of the University of Michigan.
16 * All rights reserved.
18 * Andy Adamson <andros@umich.edu>
22 * Copyright 1993 by OpenVision Technologies, Inc.
24 * Permission to use, copy, modify, distribute, and sell this software
25 * and its documentation for any purpose is hereby granted without fee,
26 * provided that the above copyright notice appears in all copies and
27 * that both that copyright notice and this permission notice appear in
28 * supporting documentation, and that the name of OpenVision not be used
29 * in advertising or publicity pertaining to distribution of the software
30 * without specific, written prior permission. OpenVision makes no
31 * representations about the suitability of this software for any
32 * purpose. It is provided "as is" without express or implied warranty.
34 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
35 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
36 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
37 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
38 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
39 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
40 * PERFORMANCE OF THIS SOFTWARE.
44 * Copyright (C) 1998 by the FundsXpress, INC.
46 * All rights reserved.
48 * Export of this software from the United States of America may require
49 * a specific license from the United States Government. It is the
50 * responsibility of any person or organization contemplating export to
51 * obtain such a license before exporting.
53 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
54 * distribute this software and its documentation for any purpose and
55 * without fee is hereby granted, provided that the above copyright
56 * notice appear in all copies and that both that copyright notice and
57 * this permission notice appear in supporting documentation, and that
58 * the name of FundsXpress. not be used in advertising or publicity pertaining
59 * to distribution of the software without specific, written prior
60 * permission. FundsXpress makes no representations about the suitability of
61 * this software for any purpose. It is provided "as is" without express
62 * or implied warranty.
64 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
65 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
66 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
70 # define EXPORT_SYMTAB
72 #define DEBUG_SUBSYSTEM S_SEC
74 #include <linux/init.h>
75 #include <linux/module.h>
76 #include <linux/slab.h>
77 #include <linux/crypto.h>
79 #include <liblustre.h>
80 //#include "../kcrypto/libcrypto.h"
83 #include <libcfs/kp30.h>
84 #include <linux/obd.h>
85 #include <linux/obd_class.h>
86 #include <linux/obd_support.h>
87 #include <linux/lustre_idl.h>
88 #include <linux/lustre_net.h>
89 #include <linux/lustre_import.h>
90 #include <linux/lustre_sec.h>
93 #include "gss_internal.h"
98 /* read_token is a mic token, and message_buffer is the data that the mic was
99 * supposedly taken over. */
102 krb5_read_token(struct krb5_ctx *ctx,
103 rawobj_t *read_token,
104 rawobj_t *message_buffer,
110 rawobj_t md5cksum = {.len = 0, .data = NULL};
114 unsigned char *ptr = (unsigned char *)read_token->data;
116 __u32 ret = GSS_S_DEFECTIVE_TOKEN;
119 if (g_verify_token_header(&ctx->mech_used, &bodysize, &ptr,
123 if ((*ptr++ != ((KG_TOK_MIC_MSG>>8)&0xff)) ||
124 (*ptr++ != ( KG_TOK_MIC_MSG &0xff)) )
127 /* XXX sanity-check bodysize?? */
129 /* get the sign and seal algorithms */
131 signalg = ptr[0] + (ptr[1] << 8);
132 sealalg = ptr[2] + (ptr[3] << 8);
136 if ((ptr[4] != 0xff) || (ptr[5] != 0xff))
139 if (sealalg != 0xffff)
142 /* there are several mappings of seal algorithms to sign algorithms,
143 but few enough that we can try them all. */
145 if ((ctx->sealalg == SEAL_ALG_NONE && signalg > 1) ||
146 (ctx->sealalg == SEAL_ALG_1 && signalg != SGN_ALG_3) ||
147 (ctx->sealalg == SEAL_ALG_DES3KD &&
148 signalg != SGN_ALG_HMAC_SHA1_DES3_KD))
151 /* compute the checksum of the message */
153 /* initialize the the cksum */
155 case SGN_ALG_DES_MAC_MD5:
156 checksum_type = CKSUMTYPE_RSA_MD5;
159 ret = GSS_S_DEFECTIVE_TOKEN;
164 case SGN_ALG_DES_MAC_MD5:
165 ret = make_checksum(checksum_type, ptr - 2, 8,
166 message_buffer, &md5cksum);
170 ret = krb5_encrypt(ctx->seq, NULL, md5cksum.data,
175 if (memcmp(md5cksum.data + 8, ptr + 14, 8)) {
181 ret = GSS_S_DEFECTIVE_TOKEN;
185 /* it got through unscathed. Make sure the context is unexpired */
188 *qop_state = GSS_C_QOP_DEFAULT;
192 ret = GSS_S_CONTEXT_EXPIRED;
193 if (now > ctx->endtime)
196 /* do sequencing checks */
199 if ((ret = krb5_get_seq_num(ctx->seq, ptr + 14, ptr + 6, &direction,
203 if ((ctx->initiate && direction != 0xff) ||
204 (!ctx->initiate && direction != 0))
207 ret = GSS_S_COMPLETE;
210 OBD_FREE(md5cksum.data, md5cksum.len);