gss_krb5.h

  1/*
  2 *  Adapted from MIT Kerberos 5-1.2.1 lib/include/krb5.h,
  3 *  lib/gssapi/krb5/gssapiP_krb5.h, and others
  4 *
  5 *  Copyright (c) 2000-2008 The Regents of the University of Michigan.
  6 *  All rights reserved.
  7 *
  8 *  Andy Adamson   <andros@umich.edu>
  9 *  Bruce Fields   <bfields@umich.edu>
 10 */
 11
 12/*
 13 * Copyright 1995 by the Massachusetts Institute of Technology.
 14 * All Rights Reserved.
 15 *
 16 * Export of this software from the United States of America may
 17 *   require a specific license from the United States Government.
 18 *   It is the responsibility of any person or organization contemplating
 19 *   export to obtain such a license before exporting.
 20 *
 21 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 22 * distribute this software and its documentation for any purpose and
 23 * without fee is hereby granted, provided that the above copyright
 24 * notice appear in all copies and that both that copyright notice and
 25 * this permission notice appear in supporting documentation, and that
 26 * the name of M.I.T. not be used in advertising or publicity pertaining
 27 * to distribution of the software without specific, written prior
 28 * permission.  Furthermore if you modify this software you must label
 29 * your software as modified software and not distribute it in such a
 30 * fashion that it might be confused with the original M.I.T. software.
 31 * M.I.T. makes no representations about the suitability of
 32 * this software for any purpose.  It is provided "as is" without express
 33 * or implied warranty.
 34 *
 35 */
 36
 37#ifndef _LINUX_SUNRPC_GSS_KRB5_H
 38#define _LINUX_SUNRPC_GSS_KRB5_H
 39
 40#include <crypto/skcipher.h>
 41#include <linux/sunrpc/auth_gss.h>
 42#include <linux/sunrpc/gss_err.h>
 43
 44/* Length of constant used in key derivation */
 45#define GSS_KRB5_K5CLENGTH (5)
 46
 47/* Maximum key length (in bytes) for the supported crypto algorithms */
 48#define GSS_KRB5_MAX_KEYLEN (32)
 49
 50/* Maximum checksum function output for the supported enctypes */
 51#define GSS_KRB5_MAX_CKSUM_LEN  (24)
 52
 53/* Maximum blocksize for the supported crypto algorithms */
 54#define GSS_KRB5_MAX_BLOCKSIZE  (16)
 55
 56/* The length of the Kerberos GSS token header */
 57#define GSS_KRB5_TOK_HDR_LEN	(16)
 58
 59#define KG_TOK_MIC_MSG    0x0101
 60#define KG_TOK_WRAP_MSG   0x0201
 61
 62#define KG2_TOK_INITIAL     0x0101
 63#define KG2_TOK_RESPONSE    0x0202
 64#define KG2_TOK_MIC         0x0404
 65#define KG2_TOK_WRAP        0x0504
 66
 67#define KG2_TOKEN_FLAG_SENTBYACCEPTOR   0x01
 68#define KG2_TOKEN_FLAG_SEALED           0x02
 69#define KG2_TOKEN_FLAG_ACCEPTORSUBKEY   0x04
 70
 71#define KG2_RESP_FLAG_ERROR             0x0001
 72#define KG2_RESP_FLAG_DELEG_OK          0x0002
 73
 74enum sgn_alg {
 75	SGN_ALG_DES_MAC_MD5 = 0x0000,
 76	SGN_ALG_MD2_5 = 0x0001,
 77	SGN_ALG_DES_MAC = 0x0002,
 78	SGN_ALG_3 = 0x0003,		/* not published */
 79	SGN_ALG_HMAC_SHA1_DES3_KD = 0x0004
 80};
 81enum seal_alg {
 82	SEAL_ALG_NONE = 0xffff,
 83	SEAL_ALG_DES = 0x0000,
 84	SEAL_ALG_1 = 0x0001,		/* not published */
 85	SEAL_ALG_DES3KD = 0x0002
 86};
 87
 88/*
 89 * These values are assigned by IANA and published via the
 90 * subregistry at the link below:
 91 *
 92 * https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml#kerberos-parameters-2
 93 */
 94#define CKSUMTYPE_CRC32			0x0001
 95#define CKSUMTYPE_RSA_MD4		0x0002
 96#define CKSUMTYPE_RSA_MD4_DES		0x0003
 97#define CKSUMTYPE_DESCBC		0x0004
 98#define CKSUMTYPE_RSA_MD5		0x0007
 99#define CKSUMTYPE_RSA_MD5_DES		0x0008
100#define CKSUMTYPE_NIST_SHA		0x0009
101#define CKSUMTYPE_HMAC_SHA1_DES3	0x000c
102#define CKSUMTYPE_HMAC_SHA1_96_AES128   0x000f
103#define CKSUMTYPE_HMAC_SHA1_96_AES256   0x0010
104#define CKSUMTYPE_CMAC_CAMELLIA128	0x0011
105#define CKSUMTYPE_CMAC_CAMELLIA256	0x0012
106#define CKSUMTYPE_HMAC_SHA256_128_AES128	0x0013
107#define CKSUMTYPE_HMAC_SHA384_192_AES256	0x0014
108#define CKSUMTYPE_HMAC_MD5_ARCFOUR      -138 /* Microsoft md5 hmac cksumtype */
109
110/* from gssapi_err_krb5.h */
111#define KG_CCACHE_NOMATCH                        (39756032L)
112#define KG_KEYTAB_NOMATCH                        (39756033L)
113#define KG_TGT_MISSING                           (39756034L)
114#define KG_NO_SUBKEY                             (39756035L)
115#define KG_CONTEXT_ESTABLISHED                   (39756036L)
116#define KG_BAD_SIGN_TYPE                         (39756037L)
117#define KG_BAD_LENGTH                            (39756038L)
118#define KG_CTX_INCOMPLETE                        (39756039L)
119#define KG_CONTEXT                               (39756040L)
120#define KG_CRED                                  (39756041L)
121#define KG_ENC_DESC                              (39756042L)
122#define KG_BAD_SEQ                               (39756043L)
123#define KG_EMPTY_CCACHE                          (39756044L)
124#define KG_NO_CTYPES                             (39756045L)
125
126/* per Kerberos v5 protocol spec crypto types from the wire. 
127 * these get mapped to linux kernel crypto routines.  
128 *
129 * These values are assigned by IANA and published via the
130 * subregistry at the link below:
131 *
132 * https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml#kerberos-parameters-1
133 */
134#define ENCTYPE_NULL            0x0000
135#define ENCTYPE_DES_CBC_CRC     0x0001	/* DES cbc mode with CRC-32 */
136#define ENCTYPE_DES_CBC_MD4     0x0002	/* DES cbc mode with RSA-MD4 */
137#define ENCTYPE_DES_CBC_MD5     0x0003	/* DES cbc mode with RSA-MD5 */
138#define ENCTYPE_DES_CBC_RAW     0x0004	/* DES cbc mode raw */
139/* XXX deprecated? */
140#define ENCTYPE_DES3_CBC_SHA    0x0005	/* DES-3 cbc mode with NIST-SHA */
141#define ENCTYPE_DES3_CBC_RAW    0x0006	/* DES-3 cbc mode raw */
142#define ENCTYPE_DES_HMAC_SHA1   0x0008
143#define ENCTYPE_DES3_CBC_SHA1   0x0010
144#define ENCTYPE_AES128_CTS_HMAC_SHA1_96 0x0011
145#define ENCTYPE_AES256_CTS_HMAC_SHA1_96 0x0012
146#define ENCTYPE_AES128_CTS_HMAC_SHA256_128	0x0013
147#define ENCTYPE_AES256_CTS_HMAC_SHA384_192	0x0014
148#define ENCTYPE_ARCFOUR_HMAC            0x0017
149#define ENCTYPE_ARCFOUR_HMAC_EXP        0x0018
150#define ENCTYPE_CAMELLIA128_CTS_CMAC	0x0019
151#define ENCTYPE_CAMELLIA256_CTS_CMAC	0x001A
152#define ENCTYPE_UNKNOWN         0x01ff
153
154/*
155 * Constants used for key derivation
156 */
157/* for 3DES */
158#define KG_USAGE_SEAL (22)
159#define KG_USAGE_SIGN (23)
160#define KG_USAGE_SEQ  (24)
161
162/* from rfc3961 */
163#define KEY_USAGE_SEED_CHECKSUM         (0x99)
164#define KEY_USAGE_SEED_ENCRYPTION       (0xAA)
165#define KEY_USAGE_SEED_INTEGRITY        (0x55)
166
167/* from rfc4121 */
168#define KG_USAGE_ACCEPTOR_SEAL  (22)
169#define KG_USAGE_ACCEPTOR_SIGN  (23)
170#define KG_USAGE_INITIATOR_SEAL (24)
171#define KG_USAGE_INITIATOR_SIGN (25)
172
173#endif /* _LINUX_SUNRPC_GSS_KRB5_H */