2 * linux/net/sunrpc/gss_krb5_crypto.c
4 * Copyright (c) 2000-2008 The Regents of the University of Michigan.
7 * Andy Adamson <andros@umich.edu>
8 * Bruce Fields <bfields@umich.edu>
12 * Copyright (C) 1998 by the FundsXpress, INC.
14 * All rights reserved.
16 * Export of this software from the United States of America may require
17 * a specific license from the United States Government. It is the
18 * responsibility of any person or organization contemplating export to
19 * obtain such a license before exporting.
21 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
22 * distribute this software and its documentation for any purpose and
23 * without fee is hereby granted, provided that the above copyright
24 * notice appear in all copies and that both that copyright notice and
25 * this permission notice appear in supporting documentation, and that
26 * the name of FundsXpress. not be used in advertising or publicity pertaining
27 * to distribution of the software without specific, written prior
28 * permission. FundsXpress makes no representations about the suitability of
29 * this software for any purpose. It is provided "as is" without express
30 * or implied warranty.
32 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
33 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
34 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
37 #include <crypto/algapi.h>
38 #include <crypto/hash.h>
39 #include <crypto/skcipher.h>
40 #include <linux/err.h>
41 #include <linux/types.h>
43 #include <linux/scatterlist.h>
44 #include <linux/highmem.h>
45 #include <linux/pagemap.h>
46 #include <linux/random.h>
47 #include <linux/sunrpc/gss_krb5.h>
48 #include <linux/sunrpc/xdr.h>
50 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
51 # define RPCDBG_FACILITY RPCDBG_AUTH
56 struct crypto_skcipher *tfm,
63 struct scatterlist sg[1];
64 u8 local_iv[GSS_KRB5_MAX_BLOCKSIZE] = {0};
65 SKCIPHER_REQUEST_ON_STACK(req, tfm);
67 if (length % crypto_skcipher_blocksize(tfm) != 0)
70 if (crypto_skcipher_ivsize(tfm) > GSS_KRB5_MAX_BLOCKSIZE) {
71 dprintk("RPC: gss_k5encrypt: tfm iv size too large %d\n",
72 crypto_skcipher_ivsize(tfm));
77 memcpy(local_iv, iv, crypto_skcipher_ivsize(tfm));
79 memcpy(out, in, length);
80 sg_init_one(sg, out, length);
82 skcipher_request_set_tfm(req, tfm);
83 skcipher_request_set_callback(req, 0, NULL, NULL);
84 skcipher_request_set_crypt(req, sg, sg, length, local_iv);
86 ret = crypto_skcipher_encrypt(req);
87 skcipher_request_zero(req);
89 dprintk("RPC: krb5_encrypt returns %d\n", ret);
95 struct crypto_skcipher *tfm,
102 struct scatterlist sg[1];
103 u8 local_iv[GSS_KRB5_MAX_BLOCKSIZE] = {0};
104 SKCIPHER_REQUEST_ON_STACK(req, tfm);
106 if (length % crypto_skcipher_blocksize(tfm) != 0)
109 if (crypto_skcipher_ivsize(tfm) > GSS_KRB5_MAX_BLOCKSIZE) {
110 dprintk("RPC: gss_k5decrypt: tfm iv size too large %d\n",
111 crypto_skcipher_ivsize(tfm));
115 memcpy(local_iv,iv, crypto_skcipher_ivsize(tfm));
117 memcpy(out, in, length);
118 sg_init_one(sg, out, length);
120 skcipher_request_set_tfm(req, tfm);
121 skcipher_request_set_callback(req, 0, NULL, NULL);
122 skcipher_request_set_crypt(req, sg, sg, length, local_iv);
124 ret = crypto_skcipher_decrypt(req);
125 skcipher_request_zero(req);
127 dprintk("RPC: gss_k5decrypt returns %d\n",ret);
132 checksummer(struct scatterlist *sg, void *data)
134 struct ahash_request *req = data;
136 ahash_request_set_crypt(req, sg, NULL, sg->length);
138 return crypto_ahash_update(req);
142 arcfour_hmac_md5_usage_to_salt(unsigned int usage, u8 salt[4])
144 unsigned int ms_usage;
156 salt[0] = (ms_usage >> 0) & 0xff;
157 salt[1] = (ms_usage >> 8) & 0xff;
158 salt[2] = (ms_usage >> 16) & 0xff;
159 salt[3] = (ms_usage >> 24) & 0xff;
165 make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen,
166 struct xdr_buf *body, int body_offset, u8 *cksumkey,
167 unsigned int usage, struct xdr_netobj *cksumout)
169 struct scatterlist sg[1];
173 struct crypto_ahash *md5;
174 struct crypto_ahash *hmac_md5;
175 struct ahash_request *req;
177 if (cksumkey == NULL)
178 return GSS_S_FAILURE;
180 if (cksumout->len < kctx->gk5e->cksumlength) {
181 dprintk("%s: checksum buffer length, %u, too small for %s\n",
182 __func__, cksumout->len, kctx->gk5e->name);
183 return GSS_S_FAILURE;
186 if (arcfour_hmac_md5_usage_to_salt(usage, rc4salt)) {
187 dprintk("%s: invalid usage value %u\n", __func__, usage);
188 return GSS_S_FAILURE;
191 checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_NOFS);
193 return GSS_S_FAILURE;
195 md5 = crypto_alloc_ahash("md5", 0, CRYPTO_ALG_ASYNC);
199 hmac_md5 = crypto_alloc_ahash(kctx->gk5e->cksum_name, 0,
201 if (IS_ERR(hmac_md5))
204 req = ahash_request_alloc(md5, GFP_NOFS);
206 goto out_free_hmac_md5;
208 ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
210 err = crypto_ahash_init(req);
213 sg_init_one(sg, rc4salt, 4);
214 ahash_request_set_crypt(req, sg, NULL, 4);
215 err = crypto_ahash_update(req);
219 sg_init_one(sg, header, hdrlen);
220 ahash_request_set_crypt(req, sg, NULL, hdrlen);
221 err = crypto_ahash_update(req);
224 err = xdr_process_buf(body, body_offset, body->len - body_offset,
228 ahash_request_set_crypt(req, NULL, checksumdata, 0);
229 err = crypto_ahash_final(req);
233 ahash_request_free(req);
234 req = ahash_request_alloc(hmac_md5, GFP_NOFS);
236 goto out_free_hmac_md5;
238 ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
240 err = crypto_ahash_init(req);
243 err = crypto_ahash_setkey(hmac_md5, cksumkey, kctx->gk5e->keylength);
247 sg_init_one(sg, checksumdata, crypto_ahash_digestsize(md5));
248 ahash_request_set_crypt(req, sg, checksumdata,
249 crypto_ahash_digestsize(md5));
250 err = crypto_ahash_digest(req);
254 memcpy(cksumout->data, checksumdata, kctx->gk5e->cksumlength);
255 cksumout->len = kctx->gk5e->cksumlength;
257 ahash_request_free(req);
259 crypto_free_ahash(hmac_md5);
261 crypto_free_ahash(md5);
264 return err ? GSS_S_FAILURE : 0;
268 * checksum the plaintext data and hdrlen bytes of the token header
269 * The checksum is performed over the first 8 bytes of the
270 * gss token header and then over the data body
273 make_checksum(struct krb5_ctx *kctx, char *header, int hdrlen,
274 struct xdr_buf *body, int body_offset, u8 *cksumkey,
275 unsigned int usage, struct xdr_netobj *cksumout)
277 struct crypto_ahash *tfm;
278 struct ahash_request *req;
279 struct scatterlist sg[1];
282 unsigned int checksumlen;
284 if (kctx->gk5e->ctype == CKSUMTYPE_HMAC_MD5_ARCFOUR)
285 return make_checksum_hmac_md5(kctx, header, hdrlen,
287 cksumkey, usage, cksumout);
289 if (cksumout->len < kctx->gk5e->cksumlength) {
290 dprintk("%s: checksum buffer length, %u, too small for %s\n",
291 __func__, cksumout->len, kctx->gk5e->name);
292 return GSS_S_FAILURE;
295 checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_NOFS);
296 if (checksumdata == NULL)
297 return GSS_S_FAILURE;
299 tfm = crypto_alloc_ahash(kctx->gk5e->cksum_name, 0, CRYPTO_ALG_ASYNC);
303 req = ahash_request_alloc(tfm, GFP_NOFS);
307 ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
309 checksumlen = crypto_ahash_digestsize(tfm);
311 if (cksumkey != NULL) {
312 err = crypto_ahash_setkey(tfm, cksumkey,
313 kctx->gk5e->keylength);
318 err = crypto_ahash_init(req);
321 sg_init_one(sg, header, hdrlen);
322 ahash_request_set_crypt(req, sg, NULL, hdrlen);
323 err = crypto_ahash_update(req);
326 err = xdr_process_buf(body, body_offset, body->len - body_offset,
330 ahash_request_set_crypt(req, NULL, checksumdata, 0);
331 err = crypto_ahash_final(req);
335 switch (kctx->gk5e->ctype) {
336 case CKSUMTYPE_RSA_MD5:
337 err = kctx->gk5e->encrypt(kctx->seq, NULL, checksumdata,
338 checksumdata, checksumlen);
341 memcpy(cksumout->data,
342 checksumdata + checksumlen - kctx->gk5e->cksumlength,
343 kctx->gk5e->cksumlength);
345 case CKSUMTYPE_HMAC_SHA1_DES3:
346 memcpy(cksumout->data, checksumdata, kctx->gk5e->cksumlength);
352 cksumout->len = kctx->gk5e->cksumlength;
354 ahash_request_free(req);
356 crypto_free_ahash(tfm);
359 return err ? GSS_S_FAILURE : 0;
363 * checksum the plaintext data and hdrlen bytes of the token header
364 * Per rfc4121, sec. 4.2.4, the checksum is performed over the data
365 * body then over the first 16 octets of the MIC token
366 * Inclusion of the header data in the calculation of the
367 * checksum is optional.
370 make_checksum_v2(struct krb5_ctx *kctx, char *header, int hdrlen,
371 struct xdr_buf *body, int body_offset, u8 *cksumkey,
372 unsigned int usage, struct xdr_netobj *cksumout)
374 struct crypto_ahash *tfm;
375 struct ahash_request *req;
376 struct scatterlist sg[1];
379 unsigned int checksumlen;
381 if (kctx->gk5e->keyed_cksum == 0) {
382 dprintk("%s: expected keyed hash for %s\n",
383 __func__, kctx->gk5e->name);
384 return GSS_S_FAILURE;
386 if (cksumkey == NULL) {
387 dprintk("%s: no key supplied for %s\n",
388 __func__, kctx->gk5e->name);
389 return GSS_S_FAILURE;
392 checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_NOFS);
394 return GSS_S_FAILURE;
396 tfm = crypto_alloc_ahash(kctx->gk5e->cksum_name, 0, CRYPTO_ALG_ASYNC);
399 checksumlen = crypto_ahash_digestsize(tfm);
401 req = ahash_request_alloc(tfm, GFP_NOFS);
405 ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
407 err = crypto_ahash_setkey(tfm, cksumkey, kctx->gk5e->keylength);
411 err = crypto_ahash_init(req);
414 err = xdr_process_buf(body, body_offset, body->len - body_offset,
418 if (header != NULL) {
419 sg_init_one(sg, header, hdrlen);
420 ahash_request_set_crypt(req, sg, NULL, hdrlen);
421 err = crypto_ahash_update(req);
425 ahash_request_set_crypt(req, NULL, checksumdata, 0);
426 err = crypto_ahash_final(req);
430 cksumout->len = kctx->gk5e->cksumlength;
432 switch (kctx->gk5e->ctype) {
433 case CKSUMTYPE_HMAC_SHA1_96_AES128:
434 case CKSUMTYPE_HMAC_SHA1_96_AES256:
435 /* note that this truncates the hash */
436 memcpy(cksumout->data, checksumdata, kctx->gk5e->cksumlength);
443 ahash_request_free(req);
445 crypto_free_ahash(tfm);
448 return err ? GSS_S_FAILURE : 0;
451 struct encryptor_desc {
452 u8 iv[GSS_KRB5_MAX_BLOCKSIZE];
453 struct skcipher_request *req;
455 struct xdr_buf *outbuf;
457 struct scatterlist infrags[4];
458 struct scatterlist outfrags[4];
464 encryptor(struct scatterlist *sg, void *data)
466 struct encryptor_desc *desc = data;
467 struct xdr_buf *outbuf = desc->outbuf;
468 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(desc->req);
469 struct page *in_page;
470 int thislen = desc->fraglen + sg->length;
474 /* Worst case is 4 fragments: head, end of page 1, start
475 * of page 2, tail. Anything more is a bug. */
476 BUG_ON(desc->fragno > 3);
478 page_pos = desc->pos - outbuf->head[0].iov_len;
479 if (page_pos >= 0 && page_pos < outbuf->page_len) {
480 /* pages are not in place: */
481 int i = (page_pos + outbuf->page_base) >> PAGE_SHIFT;
482 in_page = desc->pages[i];
484 in_page = sg_page(sg);
486 sg_set_page(&desc->infrags[desc->fragno], in_page, sg->length,
488 sg_set_page(&desc->outfrags[desc->fragno], sg_page(sg), sg->length,
491 desc->fraglen += sg->length;
492 desc->pos += sg->length;
494 fraglen = thislen & (crypto_skcipher_blocksize(tfm) - 1);
500 sg_mark_end(&desc->infrags[desc->fragno - 1]);
501 sg_mark_end(&desc->outfrags[desc->fragno - 1]);
503 skcipher_request_set_crypt(desc->req, desc->infrags, desc->outfrags,
506 ret = crypto_skcipher_encrypt(desc->req);
510 sg_init_table(desc->infrags, 4);
511 sg_init_table(desc->outfrags, 4);
514 sg_set_page(&desc->outfrags[0], sg_page(sg), fraglen,
515 sg->offset + sg->length - fraglen);
516 desc->infrags[0] = desc->outfrags[0];
517 sg_assign_page(&desc->infrags[0], in_page);
519 desc->fraglen = fraglen;
528 gss_encrypt_xdr_buf(struct crypto_skcipher *tfm, struct xdr_buf *buf,
529 int offset, struct page **pages)
532 struct encryptor_desc desc;
533 SKCIPHER_REQUEST_ON_STACK(req, tfm);
535 BUG_ON((buf->len - offset) % crypto_skcipher_blocksize(tfm) != 0);
537 skcipher_request_set_tfm(req, tfm);
538 skcipher_request_set_callback(req, 0, NULL, NULL);
540 memset(desc.iv, 0, sizeof(desc.iv));
548 sg_init_table(desc.infrags, 4);
549 sg_init_table(desc.outfrags, 4);
551 ret = xdr_process_buf(buf, offset, buf->len - offset, encryptor, &desc);
552 skcipher_request_zero(req);
556 struct decryptor_desc {
557 u8 iv[GSS_KRB5_MAX_BLOCKSIZE];
558 struct skcipher_request *req;
559 struct scatterlist frags[4];
565 decryptor(struct scatterlist *sg, void *data)
567 struct decryptor_desc *desc = data;
568 int thislen = desc->fraglen + sg->length;
569 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(desc->req);
572 /* Worst case is 4 fragments: head, end of page 1, start
573 * of page 2, tail. Anything more is a bug. */
574 BUG_ON(desc->fragno > 3);
575 sg_set_page(&desc->frags[desc->fragno], sg_page(sg), sg->length,
578 desc->fraglen += sg->length;
580 fraglen = thislen & (crypto_skcipher_blocksize(tfm) - 1);
586 sg_mark_end(&desc->frags[desc->fragno - 1]);
588 skcipher_request_set_crypt(desc->req, desc->frags, desc->frags,
591 ret = crypto_skcipher_decrypt(desc->req);
595 sg_init_table(desc->frags, 4);
598 sg_set_page(&desc->frags[0], sg_page(sg), fraglen,
599 sg->offset + sg->length - fraglen);
601 desc->fraglen = fraglen;
610 gss_decrypt_xdr_buf(struct crypto_skcipher *tfm, struct xdr_buf *buf,
614 struct decryptor_desc desc;
615 SKCIPHER_REQUEST_ON_STACK(req, tfm);
618 BUG_ON((buf->len - offset) % crypto_skcipher_blocksize(tfm) != 0);
620 skcipher_request_set_tfm(req, tfm);
621 skcipher_request_set_callback(req, 0, NULL, NULL);
623 memset(desc.iv, 0, sizeof(desc.iv));
628 sg_init_table(desc.frags, 4);
630 ret = xdr_process_buf(buf, offset, buf->len - offset, decryptor, &desc);
631 skcipher_request_zero(req);
636 * This function makes the assumption that it was ultimately called
639 * The client auth_gss code moves any existing tail data into a
640 * separate page before calling gss_wrap.
641 * The server svcauth_gss code ensures that both the head and the
642 * tail have slack space of RPC_MAX_AUTH_SIZE before calling gss_wrap.
644 * Even with that guarantee, this function may be called more than
645 * once in the processing of gss_wrap(). The best we can do is
646 * verify at compile-time (see GSS_KRB5_SLACK_CHECK) that the
647 * largest expected shift will fit within RPC_MAX_AUTH_SIZE.
648 * At run-time we can verify that a single invocation of this
649 * function doesn't attempt to use more the RPC_MAX_AUTH_SIZE.
653 xdr_extend_head(struct xdr_buf *buf, unsigned int base, unsigned int shiftlen)
660 BUILD_BUG_ON(GSS_KRB5_MAX_SLACK_NEEDED > RPC_MAX_AUTH_SIZE);
661 BUG_ON(shiftlen > RPC_MAX_AUTH_SIZE);
663 p = buf->head[0].iov_base + base;
665 memmove(p + shiftlen, p, buf->head[0].iov_len - base);
667 buf->head[0].iov_len += shiftlen;
668 buf->len += shiftlen;
674 gss_krb5_cts_crypt(struct crypto_skcipher *cipher, struct xdr_buf *buf,
675 u32 offset, u8 *iv, struct page **pages, int encrypt)
678 struct scatterlist sg[1];
679 SKCIPHER_REQUEST_ON_STACK(req, cipher);
681 struct page **save_pages;
682 u32 len = buf->len - offset;
684 if (len > GSS_KRB5_MAX_BLOCKSIZE * 2) {
688 data = kmalloc(GSS_KRB5_MAX_BLOCKSIZE * 2, GFP_NOFS);
693 * For encryption, we want to read from the cleartext
694 * page cache pages, and write the encrypted data to
695 * the supplied xdr_buf pages.
697 save_pages = buf->pages;
701 ret = read_bytes_from_xdr_buf(buf, offset, data, len);
702 buf->pages = save_pages;
706 sg_init_one(sg, data, len);
708 skcipher_request_set_tfm(req, cipher);
709 skcipher_request_set_callback(req, 0, NULL, NULL);
710 skcipher_request_set_crypt(req, sg, sg, len, iv);
713 ret = crypto_skcipher_encrypt(req);
715 ret = crypto_skcipher_decrypt(req);
717 skcipher_request_zero(req);
722 ret = write_bytes_to_xdr_buf(buf, offset, data, len);
730 gss_krb5_aes_encrypt(struct krb5_ctx *kctx, u32 offset,
731 struct xdr_buf *buf, struct page **pages)
734 struct xdr_netobj hmac;
737 struct crypto_skcipher *cipher, *aux_cipher;
739 struct page **save_pages;
741 struct encryptor_desc desc;
745 if (kctx->initiate) {
746 cipher = kctx->initiator_enc;
747 aux_cipher = kctx->initiator_enc_aux;
748 cksumkey = kctx->initiator_integ;
749 usage = KG_USAGE_INITIATOR_SEAL;
751 cipher = kctx->acceptor_enc;
752 aux_cipher = kctx->acceptor_enc_aux;
753 cksumkey = kctx->acceptor_integ;
754 usage = KG_USAGE_ACCEPTOR_SEAL;
756 blocksize = crypto_skcipher_blocksize(cipher);
758 /* hide the gss token header and insert the confounder */
759 offset += GSS_KRB5_TOK_HDR_LEN;
760 if (xdr_extend_head(buf, offset, kctx->gk5e->conflen))
761 return GSS_S_FAILURE;
762 gss_krb5_make_confounder(buf->head[0].iov_base + offset, kctx->gk5e->conflen);
763 offset -= GSS_KRB5_TOK_HDR_LEN;
765 if (buf->tail[0].iov_base != NULL) {
766 ecptr = buf->tail[0].iov_base + buf->tail[0].iov_len;
768 buf->tail[0].iov_base = buf->head[0].iov_base
769 + buf->head[0].iov_len;
770 buf->tail[0].iov_len = 0;
771 ecptr = buf->tail[0].iov_base;
774 /* copy plaintext gss token header after filler (if any) */
775 memcpy(ecptr, buf->head[0].iov_base + offset, GSS_KRB5_TOK_HDR_LEN);
776 buf->tail[0].iov_len += GSS_KRB5_TOK_HDR_LEN;
777 buf->len += GSS_KRB5_TOK_HDR_LEN;
780 hmac.len = GSS_KRB5_MAX_CKSUM_LEN;
781 hmac.data = buf->tail[0].iov_base + buf->tail[0].iov_len;
784 * When we are called, pages points to the real page cache
785 * data -- which we can't go and encrypt! buf->pages points
786 * to scratch pages which we are going to send off to the
787 * client/server. Swap in the plaintext pages to calculate
790 save_pages = buf->pages;
793 err = make_checksum_v2(kctx, NULL, 0, buf,
794 offset + GSS_KRB5_TOK_HDR_LEN,
795 cksumkey, usage, &hmac);
796 buf->pages = save_pages;
798 return GSS_S_FAILURE;
800 nbytes = buf->len - offset - GSS_KRB5_TOK_HDR_LEN;
801 nblocks = (nbytes + blocksize - 1) / blocksize;
804 cbcbytes = (nblocks - 2) * blocksize;
806 memset(desc.iv, 0, sizeof(desc.iv));
809 SKCIPHER_REQUEST_ON_STACK(req, aux_cipher);
811 desc.pos = offset + GSS_KRB5_TOK_HDR_LEN;
818 skcipher_request_set_tfm(req, aux_cipher);
819 skcipher_request_set_callback(req, 0, NULL, NULL);
821 sg_init_table(desc.infrags, 4);
822 sg_init_table(desc.outfrags, 4);
824 err = xdr_process_buf(buf, offset + GSS_KRB5_TOK_HDR_LEN,
825 cbcbytes, encryptor, &desc);
826 skcipher_request_zero(req);
831 /* Make sure IV carries forward from any CBC results. */
832 err = gss_krb5_cts_crypt(cipher, buf,
833 offset + GSS_KRB5_TOK_HDR_LEN + cbcbytes,
840 /* Now update buf to account for HMAC */
841 buf->tail[0].iov_len += kctx->gk5e->cksumlength;
842 buf->len += kctx->gk5e->cksumlength;
851 gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf,
852 u32 *headskip, u32 *tailskip)
854 struct xdr_buf subbuf;
857 struct crypto_skcipher *cipher, *aux_cipher;
858 struct xdr_netobj our_hmac_obj;
859 u8 our_hmac[GSS_KRB5_MAX_CKSUM_LEN];
860 u8 pkt_hmac[GSS_KRB5_MAX_CKSUM_LEN];
861 int nblocks, blocksize, cbcbytes;
862 struct decryptor_desc desc;
865 if (kctx->initiate) {
866 cipher = kctx->acceptor_enc;
867 aux_cipher = kctx->acceptor_enc_aux;
868 cksum_key = kctx->acceptor_integ;
869 usage = KG_USAGE_ACCEPTOR_SEAL;
871 cipher = kctx->initiator_enc;
872 aux_cipher = kctx->initiator_enc_aux;
873 cksum_key = kctx->initiator_integ;
874 usage = KG_USAGE_INITIATOR_SEAL;
876 blocksize = crypto_skcipher_blocksize(cipher);
879 /* create a segment skipping the header and leaving out the checksum */
880 xdr_buf_subsegment(buf, &subbuf, offset + GSS_KRB5_TOK_HDR_LEN,
881 (buf->len - offset - GSS_KRB5_TOK_HDR_LEN -
882 kctx->gk5e->cksumlength));
884 nblocks = (subbuf.len + blocksize - 1) / blocksize;
888 cbcbytes = (nblocks - 2) * blocksize;
890 memset(desc.iv, 0, sizeof(desc.iv));
893 SKCIPHER_REQUEST_ON_STACK(req, aux_cipher);
899 skcipher_request_set_tfm(req, aux_cipher);
900 skcipher_request_set_callback(req, 0, NULL, NULL);
902 sg_init_table(desc.frags, 4);
904 ret = xdr_process_buf(&subbuf, 0, cbcbytes, decryptor, &desc);
905 skcipher_request_zero(req);
910 /* Make sure IV carries forward from any CBC results. */
911 ret = gss_krb5_cts_crypt(cipher, &subbuf, cbcbytes, desc.iv, NULL, 0);
916 /* Calculate our hmac over the plaintext data */
917 our_hmac_obj.len = sizeof(our_hmac);
918 our_hmac_obj.data = our_hmac;
920 ret = make_checksum_v2(kctx, NULL, 0, &subbuf, 0,
921 cksum_key, usage, &our_hmac_obj);
925 /* Get the packet's hmac value */
926 ret = read_bytes_from_xdr_buf(buf, buf->len - kctx->gk5e->cksumlength,
927 pkt_hmac, kctx->gk5e->cksumlength);
931 if (crypto_memneq(pkt_hmac, our_hmac, kctx->gk5e->cksumlength) != 0) {
935 *headskip = kctx->gk5e->conflen;
936 *tailskip = kctx->gk5e->cksumlength;
938 if (ret && ret != GSS_S_BAD_SIG)
944 * Compute Kseq given the initial session key and the checksum.
945 * Set the key of the given cipher.
948 krb5_rc4_setup_seq_key(struct krb5_ctx *kctx, struct crypto_skcipher *cipher,
949 unsigned char *cksum)
951 struct crypto_shash *hmac;
952 struct shash_desc *desc;
953 u8 Kseq[GSS_KRB5_MAX_KEYLEN];
954 u32 zeroconstant = 0;
957 dprintk("%s: entered\n", __func__);
959 hmac = crypto_alloc_shash(kctx->gk5e->cksum_name, 0, 0);
961 dprintk("%s: error %ld, allocating hash '%s'\n",
962 __func__, PTR_ERR(hmac), kctx->gk5e->cksum_name);
963 return PTR_ERR(hmac);
966 desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(hmac),
969 dprintk("%s: failed to allocate shash descriptor for '%s'\n",
970 __func__, kctx->gk5e->cksum_name);
971 crypto_free_shash(hmac);
978 /* Compute intermediate Kseq from session key */
979 err = crypto_shash_setkey(hmac, kctx->Ksess, kctx->gk5e->keylength);
983 err = crypto_shash_digest(desc, (u8 *)&zeroconstant, 4, Kseq);
987 /* Compute final Kseq from the checksum and intermediate Kseq */
988 err = crypto_shash_setkey(hmac, Kseq, kctx->gk5e->keylength);
992 err = crypto_shash_digest(desc, cksum, 8, Kseq);
996 err = crypto_skcipher_setkey(cipher, Kseq, kctx->gk5e->keylength);
1004 crypto_free_shash(hmac);
1005 dprintk("%s: returning %d\n", __func__, err);
1010 * Compute Kcrypt given the initial session key and the plaintext seqnum.
1011 * Set the key of cipher kctx->enc.
1014 krb5_rc4_setup_enc_key(struct krb5_ctx *kctx, struct crypto_skcipher *cipher,
1017 struct crypto_shash *hmac;
1018 struct shash_desc *desc;
1019 u8 Kcrypt[GSS_KRB5_MAX_KEYLEN];
1020 u8 zeroconstant[4] = {0};
1024 dprintk("%s: entered, seqnum %u\n", __func__, seqnum);
1026 hmac = crypto_alloc_shash(kctx->gk5e->cksum_name, 0, 0);
1028 dprintk("%s: error %ld, allocating hash '%s'\n",
1029 __func__, PTR_ERR(hmac), kctx->gk5e->cksum_name);
1030 return PTR_ERR(hmac);
1033 desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(hmac),
1036 dprintk("%s: failed to allocate shash descriptor for '%s'\n",
1037 __func__, kctx->gk5e->cksum_name);
1038 crypto_free_shash(hmac);
1045 /* Compute intermediate Kcrypt from session key */
1046 for (i = 0; i < kctx->gk5e->keylength; i++)
1047 Kcrypt[i] = kctx->Ksess[i] ^ 0xf0;
1049 err = crypto_shash_setkey(hmac, Kcrypt, kctx->gk5e->keylength);
1053 err = crypto_shash_digest(desc, zeroconstant, 4, Kcrypt);
1057 /* Compute final Kcrypt from the seqnum and intermediate Kcrypt */
1058 err = crypto_shash_setkey(hmac, Kcrypt, kctx->gk5e->keylength);
1062 seqnumarray[0] = (unsigned char) ((seqnum >> 24) & 0xff);
1063 seqnumarray[1] = (unsigned char) ((seqnum >> 16) & 0xff);
1064 seqnumarray[2] = (unsigned char) ((seqnum >> 8) & 0xff);
1065 seqnumarray[3] = (unsigned char) ((seqnum >> 0) & 0xff);
1067 err = crypto_shash_digest(desc, seqnumarray, 4, Kcrypt);
1071 err = crypto_skcipher_setkey(cipher, Kcrypt, kctx->gk5e->keylength);
1079 crypto_free_shash(hmac);
1080 dprintk("%s: returning %d\n", __func__, err);