Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d00953a5 authored by Kevin Coffman's avatar Kevin Coffman Committed by J. Bruce Fields
Browse files

gss_krb5: create a define for token header size and clean up ptr location 



cleanup:
Document token header size with a #define instead of open-coding it.

Don't needlessly increment "ptr" past the beginning of the header
which makes the values passed to functions more understandable and
eliminates the need for extra "krb5_hdr" pointer.

Clean up some intersecting  white-space issues flagged by checkpatch.pl.

This leaves the checksum length hard-coded at 8 for DES.  A later patch
cleans that up.

Signed-off-by: default avatarKevin Coffman <kwc@citi.umich.edu>
Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
parent 8837abca

include/linux/sunrpc/gss_krb5.h

+3 −0
Original line number Diff line number Diff line
@@ -51,6 +51,9 @@ struct krb5_ctx { 


extern spinlock_t krb5_seq_lock;



/* The length of the Kerberos GSS token header */

#define GSS_KRB5_TOK_HDR_LEN	(16)



#define KG_TOK_MIC_MSG    0x0101

#define KG_TOK_WRAP_MSG   0x0201

net/sunrpc/auth_gss/gss_krb5_seal.c

+13 −13
Original line number Diff line number Diff line
@@ -78,7 +78,7 @@ gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text, 
	struct krb5_ctx		*ctx = gss_ctx->internal_ctx_id;

	char			cksumdata[16];

	struct xdr_netobj	md5cksum = {.len = 0, .data = cksumdata};

	unsigned char		*ptr, *krb5_hdr, *msg_start;

	unsigned char		*ptr, *msg_start;

	s32			now;

	u32			seq_send;
@@ -87,36 +87,36 @@ gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text, 


	now = get_seconds();



	token->len = g_token_size(&ctx->mech_used, 24);

	token->len = g_token_size(&ctx->mech_used, GSS_KRB5_TOK_HDR_LEN + 8);



	ptr = token->data;

	g_make_token_header(&ctx->mech_used, 24, &ptr);

	g_make_token_header(&ctx->mech_used, GSS_KRB5_TOK_HDR_LEN + 8, &ptr);



	*ptr++ = (unsigned char) ((KG_TOK_MIC_MSG>>8)&0xff);

	*ptr++ = (unsigned char) (KG_TOK_MIC_MSG&0xff);

	/* ptr now at header described in rfc 1964, section 1.2.1: */

	ptr[0] = (unsigned char) ((KG_TOK_MIC_MSG >> 8) & 0xff);

	ptr[1] = (unsigned char) (KG_TOK_MIC_MSG & 0xff);



	/* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */

	krb5_hdr = ptr - 2;

	msg_start = krb5_hdr + 24;

	msg_start = ptr + GSS_KRB5_TOK_HDR_LEN + 8;



	*(__be16 *)(krb5_hdr + 2) = htons(SGN_ALG_DES_MAC_MD5);

	memset(krb5_hdr + 4, 0xff, 4);

	*(__be16 *)(ptr + 2) = htons(SGN_ALG_DES_MAC_MD5);

	memset(ptr + 4, 0xff, 4);



	if (make_checksum("md5", krb5_hdr, 8, text, 0, &md5cksum))

	if (make_checksum("md5", ptr, 8, text, 0, &md5cksum))

		return GSS_S_FAILURE;



	if (krb5_encrypt(ctx->seq, NULL, md5cksum.data,

			  md5cksum.data, md5cksum.len))

		return GSS_S_FAILURE;



	memcpy(krb5_hdr + 16, md5cksum.data + md5cksum.len - 8, 8);

	memcpy(ptr + GSS_KRB5_TOK_HDR_LEN, md5cksum.data + md5cksum.len - 8, 8);



	spin_lock(&krb5_seq_lock);

	seq_send = ctx->seq_send++;

	spin_unlock(&krb5_seq_lock);



	if (krb5_make_seq_num(ctx->seq, ctx->initiate ? 0 : 0xff,

			      seq_send, krb5_hdr + 16, krb5_hdr + 8))

			      seq_send, ptr + GSS_KRB5_TOK_HDR_LEN,

			      ptr + 8))

		return GSS_S_FAILURE;



	return (ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE;

net/sunrpc/auth_gss/gss_krb5_unseal.c

+8 −8
Original line number Diff line number Diff line
@@ -92,30 +92,30 @@ gss_verify_mic_kerberos(struct gss_ctx *gss_ctx, 
					read_token->len))

		return GSS_S_DEFECTIVE_TOKEN;



	if ((*ptr++ != ((KG_TOK_MIC_MSG>>8)&0xff)) ||

	    (*ptr++ != ( KG_TOK_MIC_MSG    &0xff))   )

	if ((ptr[0] != ((KG_TOK_MIC_MSG >> 8) & 0xff)) ||

	    (ptr[1] !=  (KG_TOK_MIC_MSG & 0xff)))

		return GSS_S_DEFECTIVE_TOKEN;



	/* XXX sanity-check bodysize?? */



	signalg = ptr[0] + (ptr[1] << 8);

	signalg = ptr[2] + (ptr[3] << 8);

	if (signalg != SGN_ALG_DES_MAC_MD5)

		return GSS_S_DEFECTIVE_TOKEN;



	sealalg = ptr[2] + (ptr[3] << 8);

	sealalg = ptr[4] + (ptr[5] << 8);

	if (sealalg != SEAL_ALG_NONE)

		return GSS_S_DEFECTIVE_TOKEN;



	if ((ptr[4] != 0xff) || (ptr[5] != 0xff))

	if ((ptr[6] != 0xff) || (ptr[7] != 0xff))

		return GSS_S_DEFECTIVE_TOKEN;



	if (make_checksum("md5", ptr - 2, 8, message_buffer, 0, &md5cksum))

	if (make_checksum("md5", ptr, 8, message_buffer, 0, &md5cksum))

		return GSS_S_FAILURE;



	if (krb5_encrypt(ctx->seq, NULL, md5cksum.data, md5cksum.data, 16))

		return GSS_S_FAILURE;



	if (memcmp(md5cksum.data + 8, ptr + 14, 8))

	if (memcmp(md5cksum.data + 8, ptr + GSS_KRB5_TOK_HDR_LEN, 8))

		return GSS_S_BAD_SIG;



	/* it got through unscathed.  Make sure the context is unexpired */
@@ -127,7 +127,7 @@ gss_verify_mic_kerberos(struct gss_ctx *gss_ctx, 


	/* do sequencing checks */



	if (krb5_get_seq_num(ctx->seq, ptr + 14, ptr + 6, &direction, &seqnum))

	if (krb5_get_seq_num(ctx->seq, ptr + GSS_KRB5_TOK_HDR_LEN, ptr + 8, &direction, &seqnum))

		return GSS_S_FAILURE;



	if ((ctx->initiate && direction != 0xff) ||

net/sunrpc/auth_gss/gss_krb5_wrap.c

+25 −25
Original line number Diff line number Diff line
@@ -122,7 +122,7 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset, 
	char			cksumdata[16];

	struct xdr_netobj	md5cksum = {.len = 0, .data = cksumdata};

	int			blocksize = 0, plainlen;

	unsigned char		*ptr, *krb5_hdr, *msg_start;

	unsigned char		*ptr, *msg_start;

	s32			now;

	int			headlen;

	struct page		**tmp_pages;
@@ -149,26 +149,26 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset, 
	buf->len += headlen;

	BUG_ON((buf->len - offset - headlen) % blocksize);



	g_make_token_header(&kctx->mech_used, 24 + plainlen, &ptr);

	g_make_token_header(&kctx->mech_used,

				GSS_KRB5_TOK_HDR_LEN + 8 + plainlen, &ptr);





	*ptr++ = (unsigned char) ((KG_TOK_WRAP_MSG>>8)&0xff);

	*ptr++ = (unsigned char) (KG_TOK_WRAP_MSG&0xff);

	/* ptr now at header described in rfc 1964, section 1.2.1: */

	ptr[0] = (unsigned char) ((KG_TOK_WRAP_MSG >> 8) & 0xff);

	ptr[1] = (unsigned char) (KG_TOK_WRAP_MSG & 0xff);



	/* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */

	krb5_hdr = ptr - 2;

	msg_start = krb5_hdr + 24;

	msg_start = ptr + 24;



	*(__be16 *)(krb5_hdr + 2) = htons(SGN_ALG_DES_MAC_MD5);

	memset(krb5_hdr + 4, 0xff, 4);

	*(__be16 *)(krb5_hdr + 4) = htons(SEAL_ALG_DES);

	*(__be16 *)(ptr + 2) = htons(SGN_ALG_DES_MAC_MD5);

	memset(ptr + 4, 0xff, 4);

	*(__be16 *)(ptr + 4) = htons(SEAL_ALG_DES);



	make_confounder(msg_start, blocksize);



	/* XXXJBF: UGH!: */

	tmp_pages = buf->pages;

	buf->pages = pages;

	if (make_checksum("md5", krb5_hdr, 8, buf,

	if (make_checksum("md5", ptr, 8, buf,

				offset + headlen - blocksize, &md5cksum))

		return GSS_S_FAILURE;

	buf->pages = tmp_pages;
@@ -176,7 +176,7 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset, 
	if (krb5_encrypt(kctx->seq, NULL, md5cksum.data,

			  md5cksum.data, md5cksum.len))

		return GSS_S_FAILURE;

	memcpy(krb5_hdr + 16, md5cksum.data + md5cksum.len - 8, 8);

	memcpy(ptr + GSS_KRB5_TOK_HDR_LEN, md5cksum.data + md5cksum.len - 8, 8);



	spin_lock(&krb5_seq_lock);

	seq_send = kctx->seq_send++;
@@ -185,7 +185,7 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset, 
	/* XXX would probably be more efficient to compute checksum

	 * and encrypt at the same time: */

	if ((krb5_make_seq_num(kctx->seq, kctx->initiate ? 0 : 0xff,

			       seq_send, krb5_hdr + 16, krb5_hdr + 8)))

			       seq_send, ptr + GSS_KRB5_TOK_HDR_LEN, ptr + 8)))

		return GSS_S_FAILURE;



	if (gss_encrypt_xdr_buf(kctx->enc, buf, offset + headlen - blocksize,
@@ -219,38 +219,38 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf) 
					buf->len - offset))

		return GSS_S_DEFECTIVE_TOKEN;



	if ((*ptr++ != ((KG_TOK_WRAP_MSG>>8)&0xff)) ||

	    (*ptr++ !=  (KG_TOK_WRAP_MSG    &0xff))   )

	if ((ptr[0] != ((KG_TOK_WRAP_MSG >> 8) & 0xff)) ||

	    (ptr[1] !=  (KG_TOK_WRAP_MSG & 0xff)))

		return GSS_S_DEFECTIVE_TOKEN;



	/* XXX sanity-check bodysize?? */



	/* get the sign and seal algorithms */



	signalg = ptr[0] + (ptr[1] << 8);

	signalg = ptr[2] + (ptr[3] << 8);

	if (signalg != SGN_ALG_DES_MAC_MD5)

		return GSS_S_DEFECTIVE_TOKEN;



	sealalg = ptr[2] + (ptr[3] << 8);

	sealalg = ptr[4] + (ptr[5] << 8);

	if (sealalg != SEAL_ALG_DES)

		return GSS_S_DEFECTIVE_TOKEN;



	if ((ptr[4] != 0xff) || (ptr[5] != 0xff))

	if ((ptr[6] != 0xff) || (ptr[7] != 0xff))

		return GSS_S_DEFECTIVE_TOKEN;



	if (gss_decrypt_xdr_buf(kctx->enc, buf,

			ptr + 22 - (unsigned char *)buf->head[0].iov_base))

			ptr + GSS_KRB5_TOK_HDR_LEN + 8 - (unsigned char *)buf->head[0].iov_base))

		return GSS_S_DEFECTIVE_TOKEN;



	if (make_checksum("md5", ptr - 2, 8, buf,

		 ptr + 22 - (unsigned char *)buf->head[0].iov_base, &md5cksum))

	if (make_checksum("md5", ptr, 8, buf,

		 ptr + GSS_KRB5_TOK_HDR_LEN + 8 - (unsigned char *)buf->head[0].iov_base, &md5cksum))

		return GSS_S_FAILURE;



	if (krb5_encrypt(kctx->seq, NULL, md5cksum.data,

			   md5cksum.data, md5cksum.len))

		return GSS_S_FAILURE;



	if (memcmp(md5cksum.data + 8, ptr + 14, 8))

	if (memcmp(md5cksum.data + 8, ptr + GSS_KRB5_TOK_HDR_LEN, 8))

		return GSS_S_BAD_SIG;



	/* it got through unscathed.  Make sure the context is unexpired */
@@ -262,8 +262,8 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf) 


	/* do sequencing checks */



	if (krb5_get_seq_num(kctx->seq, ptr + 14, ptr + 6, &direction,

				    &seqnum))

	if (krb5_get_seq_num(kctx->seq, ptr + GSS_KRB5_TOK_HDR_LEN, ptr + 8,

				    &direction, &seqnum))

		return GSS_S_BAD_SIG;



	if ((kctx->initiate && direction != 0xff) ||
@@ -274,7 +274,7 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf) 
	 * better to copy and encrypt at the same time. */



	blocksize = crypto_blkcipher_blocksize(kctx->enc);

	data_start = ptr + 22 + blocksize;

	data_start = ptr + GSS_KRB5_TOK_HDR_LEN + 8 + blocksize;

	orig_start = buf->head[0].iov_base + offset;

	data_len = (buf->head[0].iov_base + buf->head[0].iov_len) - data_start;

	memmove(orig_start, data_start, data_len);