Commit e33d2a7b authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Herbert Xu
Browse files

SUNRPC: remove RC4-HMAC-MD5 support from KerberosV 

The RC4-HMAC-MD5 KerberosV algorithm is based on RFC 4757 [0], which
was specifically issued for interoperability with Windows 2000, but was
never intended to receive the same level of support. The RFC says

  The IETF Kerberos community supports publishing this specification as
  an informational document in order to describe this widely
  implemented technology.  However, while these encryption types
  provide the operations necessary to implement the base Kerberos
  specification [RFC4120], they do not provide all the required
  operations in the Kerberos cryptography framework [RFC3961].  As a
  result, it is not generally possible to implement potential
  extensions to Kerberos using these encryption types.  The Kerberos
  encryption type negotiation mechanism [RFC4537] provides one approach
  for using such extensions even when a Kerberos infrastructure uses
  long-term RC4 keys.  Because this specification does not implement
  operations required by RFC 3961 and because of security concerns with
  the use of RC4 and MD4 discussed in Section 8, this specification is
  not appropriate for publication on the standards track.

  The RC4-HMAC encryption types are used to ease upgrade of existing
  Windows NT environments, provide strong cryptography (128-bit key
  lengths), and provide exportable (meet United States government
  export restriction requirements) encryption.  This document describes
  the implementation of those encryption types.

Furthermore, this RFC was re-classified as 'historic' by RFC 8429 [1] in
2018, stating that 'none of the encryption types it specifies should be
used'

Note that other outdated algorithms are left in place (some of which are
guarded by CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES), so this should only
adversely affect interoperability with Windows NT/2000 systems that have
not received any updates since 2008 (but are connected to a network
nonetheless)

[0] https://tools.ietf.org/html/rfc4757
[1] https://tools.ietf.org/html/rfc8429



Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
Acked-by: default avatarJ. Bruce Fields <bfields@redhat.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent c5960778

include/linux/sunrpc/gss_krb5.h

+0 −11
Original line number Diff line number Diff line
@@ -141,14 +141,12 @@ enum sgn_alg { 
	SGN_ALG_MD2_5 = 0x0001,

	SGN_ALG_DES_MAC = 0x0002,

	SGN_ALG_3 = 0x0003,		/* not published */

	SGN_ALG_HMAC_MD5 = 0x0011,	/* microsoft w2k; no support */

	SGN_ALG_HMAC_SHA1_DES3_KD = 0x0004

};

enum seal_alg {

	SEAL_ALG_NONE = 0xffff,

	SEAL_ALG_DES = 0x0000,

	SEAL_ALG_1 = 0x0001,		/* not published */

	SEAL_ALG_MICROSOFT_RC4 = 0x0010,/* microsoft w2k; no support */

	SEAL_ALG_DES3KD = 0x0002

};
@@ -316,14 +314,5 @@ gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len, 
		     struct xdr_buf *buf, u32 *plainoffset,

		     u32 *plainlen);



int

krb5_rc4_setup_seq_key(struct krb5_ctx *kctx,

		       struct crypto_sync_skcipher *cipher,

		       unsigned char *cksum);



int

krb5_rc4_setup_enc_key(struct krb5_ctx *kctx,

		       struct crypto_sync_skcipher *cipher,

		       s32 seqnum);

void

gss_krb5_make_confounder(char *p, u32 conflen);

include/linux/sunrpc/gss_krb5_enctypes.h

+3 −6
Original line number Diff line number Diff line
@@ -13,15 +13,13 @@ 
#ifdef CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES



/*

 * NB: This list includes encryption types that were deprecated

 * by RFC 8429 (DES3_CBC_SHA1 and ARCFOUR_HMAC).

 * NB: This list includes DES3_CBC_SHA1, which was deprecated by RFC 8429.

 *

 * ENCTYPE_AES256_CTS_HMAC_SHA1_96

 * ENCTYPE_AES128_CTS_HMAC_SHA1_96

 * ENCTYPE_DES3_CBC_SHA1

 * ENCTYPE_ARCFOUR_HMAC

 */

#define KRB5_SUPPORTED_ENCTYPES "18,17,16,23"

#define KRB5_SUPPORTED_ENCTYPES "18,17,16"



#else	/* CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES */
@@ -32,12 +30,11 @@ 
 * ENCTYPE_AES256_CTS_HMAC_SHA1_96

 * ENCTYPE_AES128_CTS_HMAC_SHA1_96

 * ENCTYPE_DES3_CBC_SHA1

 * ENCTYPE_ARCFOUR_HMAC

 * ENCTYPE_DES_CBC_MD5

 * ENCTYPE_DES_CBC_CRC

 * ENCTYPE_DES_CBC_MD4

 */

#define KRB5_SUPPORTED_ENCTYPES "18,17,16,23,3,1,2"

#define KRB5_SUPPORTED_ENCTYPES "18,17,16,3,1,2"



#endif	/* CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES */

net/sunrpc/Kconfig

+0 −1
Original line number Diff line number Diff line
@@ -21,7 +21,6 @@ config RPCSEC_GSS_KRB5 
	depends on SUNRPC && CRYPTO

	depends on CRYPTO_MD5 && CRYPTO_DES && CRYPTO_CBC && CRYPTO_CTS

	depends on CRYPTO_ECB && CRYPTO_HMAC && CRYPTO_SHA1 && CRYPTO_AES

	depends on CRYPTO_ARC4

	default y

	select SUNRPC_GSS

	help

net/sunrpc/auth_gss/gss_krb5_crypto.c

+0 −276
Original line number Diff line number Diff line
@@ -138,135 +138,6 @@ checksummer(struct scatterlist *sg, void *data) 
	return crypto_ahash_update(req);

}



static int

arcfour_hmac_md5_usage_to_salt(unsigned int usage, u8 salt[4])

{

	unsigned int ms_usage;



	switch (usage) {

	case KG_USAGE_SIGN:

		ms_usage = 15;

		break;

	case KG_USAGE_SEAL:

		ms_usage = 13;

		break;

	default:

		return -EINVAL;

	}

	salt[0] = (ms_usage >> 0) & 0xff;

	salt[1] = (ms_usage >> 8) & 0xff;

	salt[2] = (ms_usage >> 16) & 0xff;

	salt[3] = (ms_usage >> 24) & 0xff;



	return 0;

}



static u32

make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen,

		       struct xdr_buf *body, int body_offset, u8 *cksumkey,

		       unsigned int usage, struct xdr_netobj *cksumout)

{

	struct scatterlist              sg[1];

	int err = -1;

	u8 *checksumdata;

	u8 *rc4salt;

	struct crypto_ahash *md5;

	struct crypto_ahash *hmac_md5;

	struct ahash_request *req;



	if (cksumkey == NULL)

		return GSS_S_FAILURE;



	if (cksumout->len < kctx->gk5e->cksumlength) {

		dprintk("%s: checksum buffer length, %u, too small for %s\n",

			__func__, cksumout->len, kctx->gk5e->name);

		return GSS_S_FAILURE;

	}



	rc4salt = kmalloc_array(4, sizeof(*rc4salt), GFP_NOFS);

	if (!rc4salt)

		return GSS_S_FAILURE;



	if (arcfour_hmac_md5_usage_to_salt(usage, rc4salt)) {

		dprintk("%s: invalid usage value %u\n", __func__, usage);

		goto out_free_rc4salt;

	}



	checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_NOFS);

	if (!checksumdata)

		goto out_free_rc4salt;



	md5 = crypto_alloc_ahash("md5", 0, CRYPTO_ALG_ASYNC);

	if (IS_ERR(md5))

		goto out_free_cksum;



	hmac_md5 = crypto_alloc_ahash(kctx->gk5e->cksum_name, 0,

				      CRYPTO_ALG_ASYNC);

	if (IS_ERR(hmac_md5))

		goto out_free_md5;



	req = ahash_request_alloc(md5, GFP_NOFS);

	if (!req)

		goto out_free_hmac_md5;



	ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);



	err = crypto_ahash_init(req);

	if (err)

		goto out;

	sg_init_one(sg, rc4salt, 4);

	ahash_request_set_crypt(req, sg, NULL, 4);

	err = crypto_ahash_update(req);

	if (err)

		goto out;



	sg_init_one(sg, header, hdrlen);

	ahash_request_set_crypt(req, sg, NULL, hdrlen);

	err = crypto_ahash_update(req);

	if (err)

		goto out;

	err = xdr_process_buf(body, body_offset, body->len - body_offset,

			      checksummer, req);

	if (err)

		goto out;

	ahash_request_set_crypt(req, NULL, checksumdata, 0);

	err = crypto_ahash_final(req);

	if (err)

		goto out;



	ahash_request_free(req);

	req = ahash_request_alloc(hmac_md5, GFP_NOFS);

	if (!req)

		goto out_free_hmac_md5;



	ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);



	err = crypto_ahash_setkey(hmac_md5, cksumkey, kctx->gk5e->keylength);

	if (err)

		goto out;



	sg_init_one(sg, checksumdata, crypto_ahash_digestsize(md5));

	ahash_request_set_crypt(req, sg, checksumdata,

				crypto_ahash_digestsize(md5));

	err = crypto_ahash_digest(req);

	if (err)

		goto out;



	memcpy(cksumout->data, checksumdata, kctx->gk5e->cksumlength);

	cksumout->len = kctx->gk5e->cksumlength;

out:

	ahash_request_free(req);

out_free_hmac_md5:

	crypto_free_ahash(hmac_md5);

out_free_md5:

	crypto_free_ahash(md5);

out_free_cksum:

	kfree(checksumdata);

out_free_rc4salt:

	kfree(rc4salt);

	return err ? GSS_S_FAILURE : 0;

}



/*

 * checksum the plaintext data and hdrlen bytes of the token header

 * The checksum is performed over the first 8 bytes of the
@@ -284,11 +155,6 @@ make_checksum(struct krb5_ctx *kctx, char *header, int hdrlen, 
	u8 *checksumdata;

	unsigned int checksumlen;



	if (kctx->gk5e->ctype == CKSUMTYPE_HMAC_MD5_ARCFOUR)

		return make_checksum_hmac_md5(kctx, header, hdrlen,

					      body, body_offset,

					      cksumkey, usage, cksumout);



	if (cksumout->len < kctx->gk5e->cksumlength) {

		dprintk("%s: checksum buffer length, %u, too small for %s\n",

			__func__, cksumout->len, kctx->gk5e->name);
@@ -942,145 +808,3 @@ out_err: 
		ret = GSS_S_FAILURE;

	return ret;

}
 


/*

 * Compute Kseq given the initial session key and the checksum.

 * Set the key of the given cipher.

 */

int

krb5_rc4_setup_seq_key(struct krb5_ctx *kctx,

		       struct crypto_sync_skcipher *cipher,

		       unsigned char *cksum)

{

	struct crypto_shash *hmac;

	struct shash_desc *desc;

	u8 Kseq[GSS_KRB5_MAX_KEYLEN];

	u32 zeroconstant = 0;

	int err;



	dprintk("%s: entered\n", __func__);



	hmac = crypto_alloc_shash(kctx->gk5e->cksum_name, 0, 0);

	if (IS_ERR(hmac)) {

		dprintk("%s: error %ld, allocating hash '%s'\n",

			__func__, PTR_ERR(hmac), kctx->gk5e->cksum_name);

		return PTR_ERR(hmac);

	}



	desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(hmac),

		       GFP_NOFS);

	if (!desc) {

		dprintk("%s: failed to allocate shash descriptor for '%s'\n",

			__func__, kctx->gk5e->cksum_name);

		crypto_free_shash(hmac);

		return -ENOMEM;

	}



	desc->tfm = hmac;



	/* Compute intermediate Kseq from session key */

	err = crypto_shash_setkey(hmac, kctx->Ksess, kctx->gk5e->keylength);

	if (err)

		goto out_err;



	err = crypto_shash_digest(desc, (u8 *)&zeroconstant, 4, Kseq);

	if (err)

		goto out_err;



	/* Compute final Kseq from the checksum and intermediate Kseq */

	err = crypto_shash_setkey(hmac, Kseq, kctx->gk5e->keylength);

	if (err)

		goto out_err;



	err = crypto_shash_digest(desc, cksum, 8, Kseq);

	if (err)

		goto out_err;



	err = crypto_sync_skcipher_setkey(cipher, Kseq, kctx->gk5e->keylength);

	if (err)

		goto out_err;



	err = 0;



out_err:

	kfree_sensitive(desc);

	crypto_free_shash(hmac);

	dprintk("%s: returning %d\n", __func__, err);

	return err;

}



/*

 * Compute Kcrypt given the initial session key and the plaintext seqnum.

 * Set the key of cipher kctx->enc.

 */

int

krb5_rc4_setup_enc_key(struct krb5_ctx *kctx,

		       struct crypto_sync_skcipher *cipher,

		       s32 seqnum)

{

	struct crypto_shash *hmac;

	struct shash_desc *desc;

	u8 Kcrypt[GSS_KRB5_MAX_KEYLEN];

	u8 zeroconstant[4] = {0};

	u8 seqnumarray[4];

	int err, i;



	dprintk("%s: entered, seqnum %u\n", __func__, seqnum);



	hmac = crypto_alloc_shash(kctx->gk5e->cksum_name, 0, 0);

	if (IS_ERR(hmac)) {

		dprintk("%s: error %ld, allocating hash '%s'\n",

			__func__, PTR_ERR(hmac), kctx->gk5e->cksum_name);

		return PTR_ERR(hmac);

	}



	desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(hmac),

		       GFP_NOFS);

	if (!desc) {

		dprintk("%s: failed to allocate shash descriptor for '%s'\n",

			__func__, kctx->gk5e->cksum_name);

		crypto_free_shash(hmac);

		return -ENOMEM;

	}



	desc->tfm = hmac;



	/* Compute intermediate Kcrypt from session key */

	for (i = 0; i < kctx->gk5e->keylength; i++)

		Kcrypt[i] = kctx->Ksess[i] ^ 0xf0;



	err = crypto_shash_setkey(hmac, Kcrypt, kctx->gk5e->keylength);

	if (err)

		goto out_err;



	err = crypto_shash_digest(desc, zeroconstant, 4, Kcrypt);

	if (err)

		goto out_err;



	/* Compute final Kcrypt from the seqnum and intermediate Kcrypt */

	err = crypto_shash_setkey(hmac, Kcrypt, kctx->gk5e->keylength);

	if (err)

		goto out_err;



	seqnumarray[0] = (unsigned char) ((seqnum >> 24) & 0xff);

	seqnumarray[1] = (unsigned char) ((seqnum >> 16) & 0xff);

	seqnumarray[2] = (unsigned char) ((seqnum >> 8) & 0xff);

	seqnumarray[3] = (unsigned char) ((seqnum >> 0) & 0xff);



	err = crypto_shash_digest(desc, seqnumarray, 4, Kcrypt);

	if (err)

		goto out_err;



	err = crypto_sync_skcipher_setkey(cipher, Kcrypt,

					  kctx->gk5e->keylength);

	if (err)

		goto out_err;



	err = 0;



out_err:

	kfree_sensitive(desc);

	crypto_free_shash(hmac);

	dprintk("%s: returning %d\n", __func__, err);

	return err;

}

net/sunrpc/auth_gss/gss_krb5_mech.c

+0 −95
Original line number Diff line number Diff line
@@ -51,27 +51,6 @@ static const struct gss_krb5_enctype supported_gss_krb5_enctypes[] = { 
	  .keyed_cksum = 0,

	},

#endif	/* CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES */

	/*

	 * RC4-HMAC

	 */

	{

	  .etype = ENCTYPE_ARCFOUR_HMAC,

	  .ctype = CKSUMTYPE_HMAC_MD5_ARCFOUR,

	  .name = "rc4-hmac",

	  .encrypt_name = "ecb(arc4)",

	  .cksum_name = "hmac(md5)",

	  .encrypt = krb5_encrypt,

	  .decrypt = krb5_decrypt,

	  .mk_key = NULL,

	  .signalg = SGN_ALG_HMAC_MD5,

	  .sealalg = SEAL_ALG_MICROSOFT_RC4,

	  .keybytes = 16,

	  .keylength = 16,

	  .blocksize = 1,

	  .conflen = 8,

	  .cksumlength = 8,

	  .keyed_cksum = 1,

	},

	/*

	 * 3DES

	 */
@@ -401,78 +380,6 @@ out_err: 
	return -EINVAL;

}



/*

 * Note that RC4 depends on deriving keys using the sequence

 * number or the checksum of a token.  Therefore, the final keys

 * cannot be calculated until the token is being constructed!

 */

static int

context_derive_keys_rc4(struct krb5_ctx *ctx)

{

	struct crypto_shash *hmac;

	char sigkeyconstant[] = "signaturekey";

	int slen = strlen(sigkeyconstant) + 1;	/* include null terminator */

	struct shash_desc *desc;

	int err;



	dprintk("RPC:       %s: entered\n", __func__);

	/*

	 * derive cksum (aka Ksign) key

	 */

	hmac = crypto_alloc_shash(ctx->gk5e->cksum_name, 0, 0);

	if (IS_ERR(hmac)) {

		dprintk("%s: error %ld allocating hash '%s'\n",

			__func__, PTR_ERR(hmac), ctx->gk5e->cksum_name);

		err = PTR_ERR(hmac);

		goto out_err;

	}



	err = crypto_shash_setkey(hmac, ctx->Ksess, ctx->gk5e->keylength);

	if (err)

		goto out_err_free_hmac;





	desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(hmac), GFP_NOFS);

	if (!desc) {

		dprintk("%s: failed to allocate hash descriptor for '%s'\n",

			__func__, ctx->gk5e->cksum_name);

		err = -ENOMEM;

		goto out_err_free_hmac;

	}



	desc->tfm = hmac;



	err = crypto_shash_digest(desc, sigkeyconstant, slen, ctx->cksum);

	kfree_sensitive(desc);

	if (err)

		goto out_err_free_hmac;

	/*

	 * allocate hash, and skciphers for data and seqnum encryption

	 */

	ctx->enc = crypto_alloc_sync_skcipher(ctx->gk5e->encrypt_name, 0, 0);

	if (IS_ERR(ctx->enc)) {

		err = PTR_ERR(ctx->enc);

		goto out_err_free_hmac;

	}



	ctx->seq = crypto_alloc_sync_skcipher(ctx->gk5e->encrypt_name, 0, 0);

	if (IS_ERR(ctx->seq)) {

		crypto_free_sync_skcipher(ctx->enc);

		err = PTR_ERR(ctx->seq);

		goto out_err_free_hmac;

	}



	dprintk("RPC:       %s: returning success\n", __func__);



	err = 0;



out_err_free_hmac:

	crypto_free_shash(hmac);

out_err:

	dprintk("RPC:       %s: returning %d\n", __func__, err);

	return err;

}



static int

context_derive_keys_new(struct krb5_ctx *ctx, gfp_t gfp_mask)

{
@@ -649,8 +556,6 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx, 
	switch (ctx->enctype) {

	case ENCTYPE_DES3_CBC_RAW:

		return context_derive_keys_des3(ctx, gfp_mask);

	case ENCTYPE_ARCFOUR_HMAC:

		return context_derive_keys_rc4(ctx);

	case ENCTYPE_AES128_CTS_HMAC_SHA1_96:

	case ENCTYPE_AES256_CTS_HMAC_SHA1_96:

		return context_derive_keys_new(ctx, gfp_mask);

CRA Git | Maintained and supported by SUSTech CRA and CCSE