|
@@ -136,7 +136,7 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
|
|
|
if (kctx->sealalg != SEAL_ALG_NONE && kctx->sealalg != SEAL_ALG_DES) {
|
|
|
dprintk("RPC: gss_krb5_seal: kctx->sealalg %d not supported\n",
|
|
|
kctx->sealalg);
|
|
|
- goto out_err;
|
|
|
+ return GSS_S_FAILURE;
|
|
|
}
|
|
|
|
|
|
blocksize = crypto_blkcipher_blocksize(kctx->enc);
|
|
@@ -178,12 +178,12 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
|
|
|
buf->pages = pages;
|
|
|
if (make_checksum("md5", krb5_hdr, 8, buf,
|
|
|
offset + headlen - blocksize, &md5cksum))
|
|
|
- goto out_err;
|
|
|
+ return GSS_S_FAILURE;
|
|
|
buf->pages = tmp_pages;
|
|
|
|
|
|
if (krb5_encrypt(kctx->seq, NULL, md5cksum.data,
|
|
|
md5cksum.data, md5cksum.len))
|
|
|
- goto out_err;
|
|
|
+ return GSS_S_FAILURE;
|
|
|
memcpy(krb5_hdr + 16,
|
|
|
md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
|
|
|
KRB5_CKSUM_LENGTH);
|
|
@@ -196,15 +196,13 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
|
|
|
* and encrypt at the same time: */
|
|
|
if ((krb5_make_seq_num(kctx->seq, kctx->initiate ? 0 : 0xff,
|
|
|
seq_send, krb5_hdr + 16, krb5_hdr + 8)))
|
|
|
- goto out_err;
|
|
|
+ return GSS_S_FAILURE;
|
|
|
|
|
|
if (gss_encrypt_xdr_buf(kctx->enc, buf, offset + headlen - blocksize,
|
|
|
pages))
|
|
|
- goto out_err;
|
|
|
+ return GSS_S_FAILURE;
|
|
|
|
|
|
return ((kctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE);
|
|
|
-out_err:
|
|
|
- return GSS_S_FAILURE;
|
|
|
}
|
|
|
|
|
|
u32
|
|
@@ -220,7 +218,6 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf)
|
|
|
s32 seqnum;
|
|
|
unsigned char *ptr;
|
|
|
int bodysize;
|
|
|
- u32 ret = GSS_S_DEFECTIVE_TOKEN;
|
|
|
void *data_start, *orig_start;
|
|
|
int data_len;
|
|
|
int blocksize;
|
|
@@ -230,11 +227,11 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf)
|
|
|
ptr = (u8 *)buf->head[0].iov_base + offset;
|
|
|
if (g_verify_token_header(&kctx->mech_used, &bodysize, &ptr,
|
|
|
buf->len - offset))
|
|
|
- goto out;
|
|
|
+ return GSS_S_DEFECTIVE_TOKEN;
|
|
|
|
|
|
if ((*ptr++ != ((KG_TOK_WRAP_MSG>>8)&0xff)) ||
|
|
|
(*ptr++ != (KG_TOK_WRAP_MSG &0xff)) )
|
|
|
- goto out;
|
|
|
+ return GSS_S_DEFECTIVE_TOKEN;
|
|
|
|
|
|
/* XXX sanity-check bodysize?? */
|
|
|
|
|
@@ -246,18 +243,18 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf)
|
|
|
/* Sanity checks */
|
|
|
|
|
|
if ((ptr[4] != 0xff) || (ptr[5] != 0xff))
|
|
|
- goto out;
|
|
|
+ return GSS_S_DEFECTIVE_TOKEN;
|
|
|
|
|
|
if (sealalg == 0xffff)
|
|
|
- goto out;
|
|
|
+ return GSS_S_DEFECTIVE_TOKEN;
|
|
|
if (signalg != SGN_ALG_DES_MAC_MD5)
|
|
|
- goto out;
|
|
|
+ return GSS_S_DEFECTIVE_TOKEN;
|
|
|
|
|
|
/* in the current spec, there is only one valid seal algorithm per
|
|
|
key type, so a simple comparison is ok */
|
|
|
|
|
|
if (sealalg != kctx->sealalg)
|
|
|
- goto out;
|
|
|
+ return GSS_S_DEFECTIVE_TOKEN;
|
|
|
|
|
|
/* there are several mappings of seal algorithms to sign algorithms,
|
|
|
but few enough that we can try them all. */
|
|
@@ -266,45 +263,39 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf)
|
|
|
(kctx->sealalg == SEAL_ALG_1 && signalg != SGN_ALG_3) ||
|
|
|
(kctx->sealalg == SEAL_ALG_DES3KD &&
|
|
|
signalg != SGN_ALG_HMAC_SHA1_DES3_KD))
|
|
|
- goto out;
|
|
|
+ return GSS_S_DEFECTIVE_TOKEN;
|
|
|
|
|
|
if (gss_decrypt_xdr_buf(kctx->enc, buf,
|
|
|
ptr + 22 - (unsigned char *)buf->head[0].iov_base))
|
|
|
- goto out;
|
|
|
+ return GSS_S_DEFECTIVE_TOKEN;
|
|
|
|
|
|
- ret = make_checksum("md5", ptr - 2, 8, buf,
|
|
|
- ptr + 22 - (unsigned char *)buf->head[0].iov_base, &md5cksum);
|
|
|
- if (ret)
|
|
|
- goto out;
|
|
|
+ if (make_checksum("md5", ptr - 2, 8, buf,
|
|
|
+ ptr + 22 - (unsigned char *)buf->head[0].iov_base, &md5cksum))
|
|
|
+ return GSS_S_FAILURE;
|
|
|
|
|
|
- ret = krb5_encrypt(kctx->seq, NULL, md5cksum.data,
|
|
|
- md5cksum.data, md5cksum.len);
|
|
|
- if (ret)
|
|
|
- goto out;
|
|
|
+ if (krb5_encrypt(kctx->seq, NULL, md5cksum.data,
|
|
|
+ md5cksum.data, md5cksum.len))
|
|
|
+ return GSS_S_FAILURE;
|
|
|
|
|
|
- if (memcmp(md5cksum.data + 8, ptr + 14, 8)) {
|
|
|
- ret = GSS_S_BAD_SIG;
|
|
|
- goto out;
|
|
|
- }
|
|
|
+ if (memcmp(md5cksum.data + 8, ptr + 14, 8))
|
|
|
+ return GSS_S_BAD_SIG;
|
|
|
|
|
|
/* it got through unscathed. Make sure the context is unexpired */
|
|
|
|
|
|
now = get_seconds();
|
|
|
|
|
|
- ret = GSS_S_CONTEXT_EXPIRED;
|
|
|
if (now > kctx->endtime)
|
|
|
- goto out;
|
|
|
+ return GSS_S_CONTEXT_EXPIRED;
|
|
|
|
|
|
/* do sequencing checks */
|
|
|
|
|
|
- ret = GSS_S_BAD_SIG;
|
|
|
- if ((ret = krb5_get_seq_num(kctx->seq, ptr + 14, ptr + 6, &direction,
|
|
|
- &seqnum)))
|
|
|
- goto out;
|
|
|
+ if (krb5_get_seq_num(kctx->seq, ptr + 14, ptr + 6, &direction,
|
|
|
+ &seqnum))
|
|
|
+ return GSS_S_BAD_SIG;
|
|
|
|
|
|
if ((kctx->initiate && direction != 0xff) ||
|
|
|
(!kctx->initiate && direction != 0))
|
|
|
- goto out;
|
|
|
+ return GSS_S_BAD_SIG;
|
|
|
|
|
|
/* Copy the data back to the right position. XXX: Would probably be
|
|
|
* better to copy and encrypt at the same time. */
|
|
@@ -317,11 +308,8 @@ gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf)
|
|
|
buf->head[0].iov_len -= (data_start - orig_start);
|
|
|
buf->len -= (data_start - orig_start);
|
|
|
|
|
|
- ret = GSS_S_DEFECTIVE_TOKEN;
|
|
|
if (gss_krb5_remove_padding(buf, blocksize))
|
|
|
- goto out;
|
|
|
+ return GSS_S_DEFECTIVE_TOKEN;
|
|
|
|
|
|
- ret = GSS_S_COMPLETE;
|
|
|
-out:
|
|
|
- return ret;
|
|
|
+ return GSS_S_COMPLETE;
|
|
|
}
|