Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 00fd6e14 authored by J. Bruce Fields's avatar J. Bruce Fields Committed by Trond Myklebust
Browse files

RPCSEC_GSS remove all qop parameters 



 Not only are the qop parameters that are passed around throughout the gssapi
 unused by any currently implemented mechanism, but there appears to be some
 doubt as to whether they will ever be used.  Let's just kill them off for now.

 Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
 Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
parent 14ae162c

include/linux/sunrpc/gss_api.h

+2 −11
Original line number Diff line number Diff line
@@ -40,23 +40,19 @@ int gss_import_sec_context( 
		struct gss_ctx		**ctx_id);

u32 gss_get_mic(

		struct gss_ctx		*ctx_id,

		u32			qop,

		struct xdr_buf		*message,

		struct xdr_netobj	*mic_token);

u32 gss_verify_mic(

		struct gss_ctx		*ctx_id,

		struct xdr_buf		*message,

		struct xdr_netobj	*mic_token,

		u32			*qstate);

		struct xdr_netobj	*mic_token);

u32 gss_wrap(

		struct gss_ctx		*ctx_id,

		u32			qop,

		int			offset,

		struct xdr_buf		*outbuf,

		struct page		**inpages);

u32 gss_unwrap(

		struct gss_ctx		*ctx_id,

		u32			*qop,

		int			offset,

		struct xdr_buf		*inbuf);

u32 gss_delete_sec_context(
@@ -67,7 +63,6 @@ char *gss_service_to_auth_domain_name(struct gss_api_mech *, u32 service); 


struct pf_desc {

	u32	pseudoflavor;

	u32	qop;

	u32	service;

	char	*name;

	char	*auth_domain_name;
@@ -96,23 +91,19 @@ struct gss_api_ops { 
			struct gss_ctx		*ctx_id);

	u32 (*gss_get_mic)(

			struct gss_ctx		*ctx_id,

			u32			qop, 

			struct xdr_buf		*message,

			struct xdr_netobj	*mic_token);

	u32 (*gss_verify_mic)(

			struct gss_ctx		*ctx_id,

			struct xdr_buf		*message,

			struct xdr_netobj	*mic_token,

			u32			*qstate);

			struct xdr_netobj	*mic_token);

	u32 (*gss_wrap)(

			struct gss_ctx		*ctx_id,

			u32			qop,

			int			offset,

			struct xdr_buf		*outbuf,

			struct page		**inpages);

	u32 (*gss_unwrap)(

			struct gss_ctx		*ctx_id,

			u32			*qop,

			int			offset,

			struct xdr_buf		*buf);

	void (*gss_delete_sec_context)(

include/linux/sunrpc/gss_err.h

+0 −10
Original line number Diff line number Diff line
@@ -65,16 +65,6 @@ typedef unsigned int OM_uint32; 
#define GSS_C_MECH_CODE 2





/*

 * Define the default Quality of Protection for per-message services.  Note

 * that an implementation that offers multiple levels of QOP may either reserve

 * a value (for example zero, as assumed here) to mean "default protection", or

 * alternatively may simply equate GSS_C_QOP_DEFAULT to a specific explicit

 * QOP value.  However a value of 0 should always be interpreted by a GSSAPI

 * implementation as a request for the default protection level.

 */

#define GSS_C_QOP_DEFAULT 0



/*

 * Expiration time of 2^32-1 seconds means infinite lifetime for a

 * credential or security context

include/linux/sunrpc/gss_krb5.h

+4 −4
Original line number Diff line number Diff line
@@ -119,21 +119,21 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body, 
		   int body_offset, struct xdr_netobj *cksum);



u32

krb5_make_token(struct krb5_ctx *context_handle, int qop_req,

krb5_make_token(struct krb5_ctx *context_handle,

	struct xdr_buf *input_message_buffer,

	struct xdr_netobj *output_message_buffer);



u32

krb5_read_token(struct krb5_ctx *context_handle,

	  struct xdr_netobj *input_token_buffer,

	  struct xdr_buf *message_buffer, int *qop_state);

	  struct xdr_buf *message_buffer);



u32

gss_wrap_kerberos(struct gss_ctx *ctx_id, u32 qop, int offset,

gss_wrap_kerberos(struct gss_ctx *ctx_id, int offset,

		struct xdr_buf *outbuf, struct page **pages);



u32

gss_unwrap_kerberos(struct gss_ctx *ctx_id, u32 *qop, int offset,

gss_unwrap_kerberos(struct gss_ctx *ctx_id, int offset,

		struct xdr_buf *buf);

include/linux/sunrpc/gss_spkm3.h

+2 −2
Original line number Diff line number Diff line
@@ -41,9 +41,9 @@ struct spkm3_ctx { 
#define SPKM_WRAP_TOK	5

#define SPKM_DEL_TOK	6



u32 spkm3_make_token(struct spkm3_ctx *ctx, int qop_req, struct xdr_buf * text, struct xdr_netobj * token, int toktype);

u32 spkm3_make_token(struct spkm3_ctx *ctx, struct xdr_buf * text, struct xdr_netobj * token, int toktype);



u32 spkm3_read_token(struct spkm3_ctx *ctx, struct xdr_netobj *read_token, struct xdr_buf *message_buffer, int *qop_state, int toktype);

u32 spkm3_read_token(struct spkm3_ctx *ctx, struct xdr_netobj *read_token, struct xdr_buf *message_buffer, int toktype);



#define CKSUMTYPE_RSA_MD5            0x0007

net/sunrpc/auth_gss/auth_gss.c

+7 −13
Original line number Diff line number Diff line
@@ -854,9 +854,7 @@ gss_marshal(struct rpc_task *task, u32 *p) 
	*p++ = htonl(RPC_AUTH_GSS);



	mic.data = (u8 *)(p + 1);

	maj_stat = gss_get_mic(ctx->gc_gss_ctx,

			       GSS_C_QOP_DEFAULT, 

			       &verf_buf, &mic);

	maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic);

	if (maj_stat == GSS_S_CONTEXT_EXPIRED) {

		cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;

	} else if (maj_stat != 0) {
@@ -888,7 +886,7 @@ gss_validate(struct rpc_task *task, u32 *p) 
{

	struct rpc_cred *cred = task->tk_msg.rpc_cred;

	struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);

	u32		seq, qop_state;

	u32		seq;

	struct kvec	iov;

	struct xdr_buf	verf_buf;

	struct xdr_netobj mic;
@@ -909,7 +907,7 @@ gss_validate(struct rpc_task *task, u32 *p) 
	mic.data = (u8 *)p;

	mic.len = len;



	maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic, &qop_state);

	maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic);

	if (maj_stat == GSS_S_CONTEXT_EXPIRED)

		cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;

	if (maj_stat)
@@ -961,8 +959,7 @@ gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx, 
	p = iov->iov_base + iov->iov_len;

	mic.data = (u8 *)(p + 1);



	maj_stat = gss_get_mic(ctx->gc_gss_ctx,

			GSS_C_QOP_DEFAULT, &integ_buf, &mic);

	maj_stat = gss_get_mic(ctx->gc_gss_ctx, &integ_buf, &mic);

	status = -EIO; /* XXX? */

	if (maj_stat == GSS_S_CONTEXT_EXPIRED)

		cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
@@ -1057,8 +1054,7 @@ gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx, 
		memcpy(tmp, snd_buf->tail[0].iov_base, snd_buf->tail[0].iov_len);

		snd_buf->tail[0].iov_base = tmp;

	}

	maj_stat = gss_wrap(ctx->gc_gss_ctx, GSS_C_QOP_DEFAULT, offset,

				snd_buf, inpages);

	maj_stat = gss_wrap(ctx->gc_gss_ctx, offset, snd_buf, inpages);

	/* RPC_SLACK_SPACE should prevent this ever happening: */

	BUG_ON(snd_buf->len > snd_buf->buflen);

        status = -EIO;
@@ -1150,8 +1146,7 @@ gss_unwrap_resp_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx, 
	if (xdr_buf_read_netobj(rcv_buf, &mic, mic_offset))

		return status;



	maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &integ_buf,

			&mic, NULL);

	maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &integ_buf, &mic);

	if (maj_stat == GSS_S_CONTEXT_EXPIRED)

		cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;

	if (maj_stat != GSS_S_COMPLETE)
@@ -1176,8 +1171,7 @@ gss_unwrap_resp_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx, 
	/* remove padding: */

	rcv_buf->len = offset + opaque_len;



	maj_stat = gss_unwrap(ctx->gc_gss_ctx, NULL,

			offset, rcv_buf);

	maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, rcv_buf);

	if (maj_stat == GSS_S_CONTEXT_EXPIRED)

		cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;

	if (maj_stat != GSS_S_COMPLETE)