gss_krb5: create a define for token header size and clean up ptr location

[linux-2.6-omap-h63xx.git] / net / sunrpc / auth_gss / gss_krb5_unseal.c

diff --git a/net/sunrpc/auth_gss/gss_krb5_unseal.c b/net/sunrpc/auth_gss/gss_krb5_unseal.c
index 0828cf64100f977d241dac71d393a0148aa8f09a..066ec73c84d682e2caa83ab4f44f61e5497a7649 100644 (file)
--- a/net/sunrpc/auth_gss/gss_krb5_unseal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_unseal.c
@@ -78,104 +78,61 @@ gss_verify_mic_kerberos(struct gss_ctx *gss_ctx,
        struct krb5_ctx         *ctx = gss_ctx->internal_ctx_id;
        int                     signalg;
        int                     sealalg;
-       s32                     checksum_type;
        char                    cksumdata[16];
        struct xdr_netobj       md5cksum = {.len = 0, .data = cksumdata};
        s32                     now;
        int                     direction;
-       s32                     seqnum;
+       u32                     seqnum;
        unsigned char           *ptr = (unsigned char *)read_token->data;
        int                     bodysize;
-       u32                     ret = GSS_S_DEFECTIVE_TOKEN;
 
-       dprintk("RPC:      krb5_read_token\n");
+       dprintk("RPC:       krb5_read_token\n");
 
        if (g_verify_token_header(&ctx->mech_used, &bodysize, &ptr,
                                        read_token->len))
-               goto out;
+               return GSS_S_DEFECTIVE_TOKEN;
 
-       if ((*ptr++ != ((KG_TOK_MIC_MSG>>8)&0xff)) ||
-           (*ptr++ != ( KG_TOK_MIC_MSG    &0xff))   )
-               goto out;
+       if ((ptr[0] != ((KG_TOK_MIC_MSG >> 8) & 0xff)) ||
+           (ptr[1] !=  (KG_TOK_MIC_MSG & 0xff)))
+               return GSS_S_DEFECTIVE_TOKEN;
 
        /* XXX sanity-check bodysize?? */
 
-       /* get the sign and seal algorithms */
-
-       signalg = ptr[0] + (ptr[1] << 8);
-       sealalg = ptr[2] + (ptr[3] << 8);
-
-       /* Sanity checks */
-
-       if ((ptr[4] != 0xff) || (ptr[5] != 0xff))
-               goto out;
-
-       if (sealalg != 0xffff)
-               goto out;
-
-       /* there are several mappings of seal algorithms to sign algorithms,
-          but few enough that we can try them all. */
-
-       if ((ctx->sealalg == SEAL_ALG_NONE && signalg > 1) ||
-           (ctx->sealalg == SEAL_ALG_1 && signalg != SGN_ALG_3) ||
-           (ctx->sealalg == SEAL_ALG_DES3KD &&
-            signalg != SGN_ALG_HMAC_SHA1_DES3_KD))
-               goto out;
-
-       /* compute the checksum of the message */
-
-       /* initialize the the cksum */
-       switch (signalg) {
-       case SGN_ALG_DES_MAC_MD5:
-               checksum_type = CKSUMTYPE_RSA_MD5;
-               break;
-       default:
-               ret = GSS_S_DEFECTIVE_TOKEN;
-               goto out;
-       }
-
-       switch (signalg) {
-       case SGN_ALG_DES_MAC_MD5:
-               ret = make_checksum(checksum_type, ptr - 2, 8,
-                                        message_buffer, 0, &md5cksum);
-               if (ret)
-                       goto out;
-
-               ret = krb5_encrypt(ctx->seq, NULL, md5cksum.data,
-                                  md5cksum.data, 16);
-               if (ret)
-                       goto out;
-
-               if (memcmp(md5cksum.data + 8, ptr + 14, 8)) {
-                       ret = GSS_S_BAD_SIG;
-                       goto out;
-               }
-               break;
-       default:
-               ret = GSS_S_DEFECTIVE_TOKEN;
-               goto out;
-       }
+       signalg = ptr[2] + (ptr[3] << 8);
+       if (signalg != SGN_ALG_DES_MAC_MD5)
+               return GSS_S_DEFECTIVE_TOKEN;
+
+       sealalg = ptr[4] + (ptr[5] << 8);
+       if (sealalg != SEAL_ALG_NONE)
+               return GSS_S_DEFECTIVE_TOKEN;
+
+       if ((ptr[6] != 0xff) || (ptr[7] != 0xff))
+               return GSS_S_DEFECTIVE_TOKEN;
+
+       if (make_checksum("md5", ptr, 8, message_buffer, 0, &md5cksum))
+               return GSS_S_FAILURE;
+
+       if (krb5_encrypt(ctx->seq, NULL, md5cksum.data, md5cksum.data, 16))
+               return GSS_S_FAILURE;
+
+       if (memcmp(md5cksum.data + 8, ptr + GSS_KRB5_TOK_HDR_LEN, 8))
+               return GSS_S_BAD_SIG;
 
        /* it got through unscathed.  Make sure the context is unexpired */
 
        now = get_seconds();
 
-       ret = GSS_S_CONTEXT_EXPIRED;
        if (now > ctx->endtime)
-               goto out;
+               return GSS_S_CONTEXT_EXPIRED;
 
        /* do sequencing checks */
 
-       ret = GSS_S_BAD_SIG;
-       if ((ret = krb5_get_seq_num(ctx->seq, ptr + 14, ptr + 6, &direction,
-                                   &seqnum)))
-               goto out;
+       if (krb5_get_seq_num(ctx->seq, ptr + GSS_KRB5_TOK_HDR_LEN, ptr + 8, &direction, &seqnum))
+               return GSS_S_FAILURE;
 
        if ((ctx->initiate && direction != 0xff) ||
            (!ctx->initiate && direction != 0))
-               goto out;
+               return GSS_S_BAD_SIG;
 
-       ret = GSS_S_COMPLETE;
-out:
-       return ret;
+       return GSS_S_COMPLETE;
 }