github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

SUNRPC: Prepare crypto/krb5 encryption and checksum handles

Browse Source 
Allocate crypto_aead handles for encryption (one per direction)
and crypto_shash handles for checksumming (one per direction)
using the crypto/krb5 library's key preparation functions.

These four handles derive their subkeys from the session key
and the RFC 4121 usage numbers and are ready for use in
encrypt, decrypt, get_mic, and verify_mic operations.

The existing crypto_sync_skcipher and crypto_ahash handles
remain in place for now; subsequent patches switch the
per-message operations to the new handles and then remove
the old ones.

Assisted-by: Claude:claude-opus-4-6
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Acked-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
This commit is contained in:
Chuck Lever 2026-04-27 09:50:49 -04:00 committed by Chuck Lever
parent 6e5e0c58db
commit 25ccbefc9f
2 changed files with 49 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/sunrpc/auth_gss/gss_krb5_internal.h
View File

@ -65,6 +65,10 @@ struct krb5_ctx {
u32 flags;
const struct gss_krb5_enctype *gk5e; /* enctype-specific info */
const struct krb5_enctype *krb5e; /* crypto/krb5 enctype */
struct crypto_aead *initiator_enc_aead;
struct crypto_aead *acceptor_enc_aead;
struct crypto_shash *initiator_sign_shash;
struct crypto_shash *acceptor_sign_shash;
struct crypto_sync_skcipher *enc;
struct crypto_sync_skcipher *seq;
struct crypto_sync_skcipher *acceptor_enc;

45
net/sunrpc/auth_gss/gss_krb5_mech.c
View File

@ -300,6 +300,10 @@ gss_krb5_import_ctx_v2(struct krb5_ctx *ctx, gfp_t gfp_mask)
.len = ctx->gk5e->keylength,
.data = ctx->Ksess,
};
struct krb5_buffer TK = {
.len = ctx->gk5e->keylength,
.data = ctx->Ksess,
};
struct xdr_netobj keyout;
int ret = -EINVAL;
@ -374,12 +378,49 @@ gss_krb5_import_ctx_v2(struct krb5_ctx *ctx, gfp_t gfp_mask)
if (ctx->acceptor_integ == NULL)
goto out_free;
ctx->initiator_enc_aead =
crypto_krb5_prepare_encryption(ctx->krb5e, &TK,
KG_USAGE_INITIATOR_SEAL,
gfp_mask);
if (IS_ERR(ctx->initiator_enc_aead)) {
ret = PTR_ERR(ctx->initiator_enc_aead);
goto out_free;
}
ctx->acceptor_enc_aead =
crypto_krb5_prepare_encryption(ctx->krb5e, &TK,
KG_USAGE_ACCEPTOR_SEAL,
gfp_mask);
if (IS_ERR(ctx->acceptor_enc_aead)) {
ret = PTR_ERR(ctx->acceptor_enc_aead);
goto out_free;
}
ctx->initiator_sign_shash =
crypto_krb5_prepare_checksum(ctx->krb5e, &TK,
KG_USAGE_INITIATOR_SIGN,
gfp_mask);
if (IS_ERR(ctx->initiator_sign_shash)) {
ret = PTR_ERR(ctx->initiator_sign_shash);
goto out_free;
}
ctx->acceptor_sign_shash =
crypto_krb5_prepare_checksum(ctx->krb5e, &TK,
KG_USAGE_ACCEPTOR_SIGN,
gfp_mask);
if (IS_ERR(ctx->acceptor_sign_shash)) {
ret = PTR_ERR(ctx->acceptor_sign_shash);
goto out_free;
}
ret = 0;
out:
kfree_sensitive(keyout.data);
return ret;
out_free:
crypto_free_shash(ctx->acceptor_sign_shash);
crypto_free_shash(ctx->initiator_sign_shash);
crypto_free_aead(ctx->acceptor_enc_aead);
crypto_free_aead(ctx->initiator_enc_aead);
crypto_free_ahash(ctx->acceptor_integ);
crypto_free_ahash(ctx->initiator_integ);
crypto_free_ahash(ctx->acceptor_sign);
@ -502,6 +543,10 @@ gss_krb5_delete_sec_context(void *internal_ctx)
{
struct krb5_ctx *kctx = internal_ctx;
crypto_free_shash(kctx->acceptor_sign_shash);
crypto_free_shash(kctx->initiator_sign_shash);
crypto_free_aead(kctx->acceptor_enc_aead);
crypto_free_aead(kctx->initiator_enc_aead);
crypto_free_sync_skcipher(kctx->seq);
crypto_free_sync_skcipher(kctx->enc);
crypto_free_sync_skcipher(kctx->acceptor_enc);