Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * linux/net/sunrpc/gss_spkm3_seal.c |
| 3 | * |
| 4 | * Copyright (c) 2003 The Regents of the University of Michigan. |
| 5 | * All rights reserved. |
| 6 | * |
| 7 | * Andy Adamson <andros@umich.edu> |
| 8 | * |
| 9 | * Redistribution and use in source and binary forms, with or without |
| 10 | * modification, are permitted provided that the following conditions |
| 11 | * are met: |
| 12 | * |
| 13 | * 1. Redistributions of source code must retain the above copyright |
| 14 | * notice, this list of conditions and the following disclaimer. |
| 15 | * 2. Redistributions in binary form must reproduce the above copyright |
| 16 | * notice, this list of conditions and the following disclaimer in the |
| 17 | * documentation and/or other materials provided with the distribution. |
| 18 | * 3. Neither the name of the University nor the names of its |
| 19 | * contributors may be used to endorse or promote products derived |
| 20 | * from this software without specific prior written permission. |
| 21 | * |
| 22 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED |
| 23 | * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF |
| 24 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
| 25 | * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
| 26 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
| 27 | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
| 28 | * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR |
| 29 | * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF |
| 30 | * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING |
| 31 | * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
| 32 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 33 | * |
| 34 | */ |
| 35 | |
| 36 | #include <linux/types.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 37 | #include <linux/jiffies.h> |
| 38 | #include <linux/sunrpc/gss_spkm3.h> |
| 39 | #include <linux/random.h> |
| 40 | #include <linux/crypto.h> |
Olga Kornievskaia | adeb813 | 2006-12-04 20:22:34 -0500 | [diff] [blame] | 41 | #include <linux/pagemap.h> |
| 42 | #include <linux/scatterlist.h> |
| 43 | #include <linux/sunrpc/xdr.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 44 | |
| 45 | #ifdef RPC_DEBUG |
| 46 | # define RPCDBG_FACILITY RPCDBG_AUTH |
| 47 | #endif |
| 48 | |
Olga Kornievskaia | adeb813 | 2006-12-04 20:22:34 -0500 | [diff] [blame] | 49 | const struct xdr_netobj hmac_md5_oid = { 8, "\x2B\x06\x01\x05\x05\x08\x01\x01"}; |
| 50 | const struct xdr_netobj cast5_cbc_oid = {9, "\x2A\x86\x48\x86\xF6\x7D\x07\x42\x0A"}; |
| 51 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 52 | /* |
| 53 | * spkm3_make_token() |
| 54 | * |
| 55 | * Only SPKM_MIC_TOK with md5 intg-alg is supported |
| 56 | */ |
| 57 | |
| 58 | u32 |
J. Bruce Fields | 00fd6e1 | 2005-10-13 16:55:18 -0400 | [diff] [blame] | 59 | spkm3_make_token(struct spkm3_ctx *ctx, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 60 | struct xdr_buf * text, struct xdr_netobj * token, |
| 61 | int toktype) |
| 62 | { |
| 63 | s32 checksum_type; |
| 64 | char tokhdrbuf[25]; |
J. Bruce Fields | 9e57b30 | 2006-03-20 23:23:11 -0500 | [diff] [blame] | 65 | char cksumdata[16]; |
| 66 | struct xdr_netobj md5cksum = {.len = 0, .data = cksumdata}; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 67 | struct xdr_netobj mic_hdr = {.len = 0, .data = tokhdrbuf}; |
J. Bruce Fields | 9eed129 | 2006-01-03 09:56:00 +0100 | [diff] [blame] | 68 | int tokenlen = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 69 | unsigned char *ptr; |
| 70 | s32 now; |
| 71 | int ctxelen = 0, ctxzbit = 0; |
| 72 | int md5elen = 0, md5zbit = 0; |
| 73 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 74 | now = jiffies; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 75 | |
| 76 | if (ctx->ctx_id.len != 16) { |
Chuck Lever | 8885cb3 | 2007-01-31 12:14:05 -0500 | [diff] [blame] | 77 | dprintk("RPC: spkm3_make_token BAD ctx_id.len %d\n", |
Olga Kornievskaia | adeb813 | 2006-12-04 20:22:34 -0500 | [diff] [blame] | 78 | ctx->ctx_id.len); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 79 | goto out_err; |
| 80 | } |
Olga Kornievskaia | adeb813 | 2006-12-04 20:22:34 -0500 | [diff] [blame] | 81 | |
| 82 | if (!g_OID_equal(&ctx->intg_alg, &hmac_md5_oid)) { |
Chuck Lever | 8885cb3 | 2007-01-31 12:14:05 -0500 | [diff] [blame] | 83 | dprintk("RPC: gss_spkm3_seal: unsupported I-ALG " |
| 84 | "algorithm. only support hmac-md5 I-ALG.\n"); |
Olga Kornievskaia | adeb813 | 2006-12-04 20:22:34 -0500 | [diff] [blame] | 85 | goto out_err; |
| 86 | } else |
| 87 | checksum_type = CKSUMTYPE_HMAC_MD5; |
| 88 | |
| 89 | if (!g_OID_equal(&ctx->conf_alg, &cast5_cbc_oid)) { |
Chuck Lever | 8885cb3 | 2007-01-31 12:14:05 -0500 | [diff] [blame] | 90 | dprintk("RPC: gss_spkm3_seal: unsupported C-ALG " |
| 91 | "algorithm\n"); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 92 | goto out_err; |
| 93 | } |
| 94 | |
| 95 | if (toktype == SPKM_MIC_TOK) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 96 | /* Calculate checksum over the mic-header */ |
| 97 | asn1_bitstring_len(&ctx->ctx_id, &ctxelen, &ctxzbit); |
| 98 | spkm3_mic_header(&mic_hdr.data, &mic_hdr.len, ctx->ctx_id.data, |
Olga Kornievskaia | adeb813 | 2006-12-04 20:22:34 -0500 | [diff] [blame] | 99 | ctxelen, ctxzbit); |
| 100 | if (make_spkm3_checksum(checksum_type, &ctx->derived_integ_key, |
| 101 | (char *)mic_hdr.data, mic_hdr.len, |
| 102 | text, 0, &md5cksum)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 103 | goto out_err; |
| 104 | |
| 105 | asn1_bitstring_len(&md5cksum, &md5elen, &md5zbit); |
J. Bruce Fields | 9eed129 | 2006-01-03 09:56:00 +0100 | [diff] [blame] | 106 | tokenlen = 10 + ctxelen + 1 + md5elen + 1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 107 | |
| 108 | /* Create token header using generic routines */ |
Kevin Coffman | 4ab4b0b | 2008-03-31 10:31:44 -0400 | [diff] [blame] | 109 | token->len = g_token_size(&ctx->mech_used, tokenlen + 2); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 110 | |
| 111 | ptr = token->data; |
Kevin Coffman | 4ab4b0b | 2008-03-31 10:31:44 -0400 | [diff] [blame] | 112 | g_make_token_header(&ctx->mech_used, tokenlen + 2, &ptr); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 113 | |
| 114 | spkm3_make_mic_token(&ptr, tokenlen, &mic_hdr, &md5cksum, md5elen, md5zbit); |
| 115 | } else if (toktype == SPKM_WRAP_TOK) { /* Not Supported */ |
Chuck Lever | 8885cb3 | 2007-01-31 12:14:05 -0500 | [diff] [blame] | 116 | dprintk("RPC: gss_spkm3_seal: SPKM_WRAP_TOK " |
| 117 | "not supported\n"); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 118 | goto out_err; |
| 119 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 120 | |
| 121 | /* XXX need to implement sequence numbers, and ctx->expired */ |
| 122 | |
| 123 | return GSS_S_COMPLETE; |
| 124 | out_err: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 125 | token->data = NULL; |
| 126 | token->len = 0; |
| 127 | return GSS_S_FAILURE; |
| 128 | } |
Olga Kornievskaia | adeb813 | 2006-12-04 20:22:34 -0500 | [diff] [blame] | 129 | |
| 130 | static int |
| 131 | spkm3_checksummer(struct scatterlist *sg, void *data) |
| 132 | { |
| 133 | struct hash_desc *desc = data; |
| 134 | |
| 135 | return crypto_hash_update(desc, sg, sg->length); |
| 136 | } |
| 137 | |
| 138 | /* checksum the plaintext data and hdrlen bytes of the token header */ |
| 139 | s32 |
| 140 | make_spkm3_checksum(s32 cksumtype, struct xdr_netobj *key, char *header, |
| 141 | unsigned int hdrlen, struct xdr_buf *body, |
| 142 | unsigned int body_offset, struct xdr_netobj *cksum) |
| 143 | { |
| 144 | char *cksumname; |
| 145 | struct hash_desc desc; /* XXX add to ctx? */ |
| 146 | struct scatterlist sg[1]; |
| 147 | int err; |
| 148 | |
| 149 | switch (cksumtype) { |
| 150 | case CKSUMTYPE_HMAC_MD5: |
J. Bruce Fields - unquoted | f32824d | 2007-02-10 01:33:25 -0500 | [diff] [blame] | 151 | cksumname = "hmac(md5)"; |
Olga Kornievskaia | adeb813 | 2006-12-04 20:22:34 -0500 | [diff] [blame] | 152 | break; |
| 153 | default: |
Chuck Lever | 8885cb3 | 2007-01-31 12:14:05 -0500 | [diff] [blame] | 154 | dprintk("RPC: spkm3_make_checksum:" |
Olga Kornievskaia | adeb813 | 2006-12-04 20:22:34 -0500 | [diff] [blame] | 155 | " unsupported checksum %d", cksumtype); |
| 156 | return GSS_S_FAILURE; |
| 157 | } |
| 158 | |
| 159 | if (key->data == NULL || key->len <= 0) return GSS_S_FAILURE; |
| 160 | |
| 161 | desc.tfm = crypto_alloc_hash(cksumname, 0, CRYPTO_ALG_ASYNC); |
| 162 | if (IS_ERR(desc.tfm)) |
| 163 | return GSS_S_FAILURE; |
| 164 | cksum->len = crypto_hash_digestsize(desc.tfm); |
| 165 | desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP; |
| 166 | |
| 167 | err = crypto_hash_setkey(desc.tfm, key->data, key->len); |
| 168 | if (err) |
| 169 | goto out; |
| 170 | |
J. Bruce Fields - unquoted | 61322b3 | 2007-02-10 01:33:27 -0500 | [diff] [blame] | 171 | err = crypto_hash_init(&desc); |
| 172 | if (err) |
| 173 | goto out; |
| 174 | |
Herbert Xu | 68e3f5d | 2007-10-27 00:52:07 -0700 | [diff] [blame] | 175 | sg_init_one(sg, header, hdrlen); |
J. Bruce Fields - unquoted | f32824d | 2007-02-10 01:33:25 -0500 | [diff] [blame] | 176 | crypto_hash_update(&desc, sg, sg->length); |
Olga Kornievskaia | adeb813 | 2006-12-04 20:22:34 -0500 | [diff] [blame] | 177 | |
| 178 | xdr_process_buf(body, body_offset, body->len - body_offset, |
| 179 | spkm3_checksummer, &desc); |
| 180 | crypto_hash_final(&desc, cksum->data); |
| 181 | |
| 182 | out: |
| 183 | crypto_free_hash(desc.tfm); |
| 184 | |
| 185 | return err ? GSS_S_FAILURE : 0; |
| 186 | } |