gss_krb5: add support for new token formats in rfc4121
[linux-2.6.git] / net / sunrpc / auth_gss / gss_krb5_seal.c
index 7ede900..477a546 100644 (file)
@@ -91,6 +91,33 @@ setup_token(struct krb5_ctx *ctx, struct xdr_netobj *token)
        return (char *)krb5_hdr;
 }
 
+static void *
+setup_token_v2(struct krb5_ctx *ctx, struct xdr_netobj *token)
+{
+       __be16 *ptr, *krb5_hdr;
+       u8 *p, flags = 0x00;
+
+       if ((ctx->flags & KRB5_CTX_FLAG_INITIATOR) == 0)
+               flags |= 0x01;
+       if (ctx->flags & KRB5_CTX_FLAG_ACCEPTOR_SUBKEY)
+               flags |= 0x04;
+
+       /* Per rfc 4121, sec 4.2.6.1, there is no header,
+        * just start the token */
+       krb5_hdr = ptr = (__be16 *)token->data;
+
+       *ptr++ = KG2_TOK_MIC;
+       p = (u8 *)ptr;
+       *p++ = flags;
+       *p++ = 0xff;
+       ptr = (__be16 *)p;
+       *ptr++ = 0xffff;
+       *ptr++ = 0xffff;
+
+       token->len = GSS_KRB5_TOK_HDR_LEN + ctx->gk5e->cksumlength;
+       return krb5_hdr;
+}
+
 static u32
 gss_get_mic_v1(struct krb5_ctx *ctx, struct xdr_buf *text,
                struct xdr_netobj *token)
@@ -133,6 +160,45 @@ gss_get_mic_v1(struct krb5_ctx *ctx, struct xdr_buf *text,
 }
 
 u32
+gss_get_mic_v2(struct krb5_ctx *ctx, struct xdr_buf *text,
+               struct xdr_netobj *token)
+{
+       char cksumdata[GSS_KRB5_MAX_CKSUM_LEN];
+       struct xdr_netobj cksumobj = { .len = sizeof(cksumdata),
+                                      .data = cksumdata};
+       void *krb5_hdr;
+       s32 now;
+       u64 seq_send;
+       u8 *cksumkey;
+
+       dprintk("RPC:       %s\n", __func__);
+
+       krb5_hdr = setup_token_v2(ctx, token);
+
+       /* Set up the sequence number. Now 64-bits in clear
+        * text and w/o direction indicator */
+       spin_lock(&krb5_seq_lock);
+       seq_send = ctx->seq_send64++;
+       spin_unlock(&krb5_seq_lock);
+       *((u64 *)(krb5_hdr + 8)) = cpu_to_be64(seq_send);
+
+       if (ctx->initiate)
+               cksumkey = ctx->initiator_sign;
+       else
+               cksumkey = ctx->acceptor_sign;
+
+       if (make_checksum_v2(ctx, krb5_hdr, GSS_KRB5_TOK_HDR_LEN,
+                            text, 0, cksumkey, &cksumobj))
+               return GSS_S_FAILURE;
+
+       memcpy(krb5_hdr + GSS_KRB5_TOK_HDR_LEN, cksumobj.data, cksumobj.len);
+
+       now = get_seconds();
+
+       return (ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE;
+}
+
+u32
 gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text,
                     struct xdr_netobj *token)
 {
@@ -144,6 +210,9 @@ gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text,
        case ENCTYPE_DES_CBC_RAW:
        case ENCTYPE_DES3_CBC_RAW:
                return gss_get_mic_v1(ctx, text, token);
+       case ENCTYPE_AES128_CTS_HMAC_SHA1_96:
+       case ENCTYPE_AES256_CTS_HMAC_SHA1_96:
+               return gss_get_mic_v2(ctx, text, token);
        }
 }