1 // SPDX-License-Identifier: LGPL-2.1
4 * Encryption and hashing operations relating to NTLM, NTLMv2. See MS-NLMP
5 * for more detailed information
7 * Copyright (C) International Business Machines Corp., 2005,2013
8 * Author(s): Steve French (sfrench@us.ibm.com)
13 #include <linux/slab.h>
16 #include "cifs_debug.h"
17 #include "cifs_unicode.h"
18 #include "cifsproto.h"
20 #include <linux/ctype.h>
21 #include <linux/random.h>
22 #include <linux/highmem.h>
23 #include <linux/fips.h>
24 #include "../smbfs_common/arc4.h"
25 #include <crypto/aead.h>
27 int __cifs_calc_signature(struct smb_rqst
*rqst
,
28 struct TCP_Server_Info
*server
, char *signature
,
29 struct shash_desc
*shash
)
33 struct kvec
*iov
= rqst
->rq_iov
;
34 int n_vec
= rqst
->rq_nvec
;
36 /* iov[0] is actual data and not the rfc1002 length for SMB2+ */
37 if (!is_smb1(server
)) {
38 if (iov
[0].iov_len
<= 4)
42 if (n_vec
< 2 || iov
[0].iov_len
!= 4)
44 i
= 1; /* skip rfc1002 length */
47 for (; i
< n_vec
; i
++) {
48 if (iov
[i
].iov_len
== 0)
50 if (iov
[i
].iov_base
== NULL
) {
51 cifs_dbg(VFS
, "null iovec entry\n");
55 rc
= crypto_shash_update(shash
,
56 iov
[i
].iov_base
, iov
[i
].iov_len
);
58 cifs_dbg(VFS
, "%s: Could not update with payload\n",
64 /* now hash over the rq_pages array */
65 for (i
= 0; i
< rqst
->rq_npages
; i
++) {
67 unsigned int len
, offset
;
69 rqst_page_get_length(rqst
, i
, &len
, &offset
);
71 kaddr
= (char *) kmap(rqst
->rq_pages
[i
]) + offset
;
73 rc
= crypto_shash_update(shash
, kaddr
, len
);
75 cifs_dbg(VFS
, "%s: Could not update with payload\n",
77 kunmap(rqst
->rq_pages
[i
]);
81 kunmap(rqst
->rq_pages
[i
]);
84 rc
= crypto_shash_final(shash
, signature
);
86 cifs_dbg(VFS
, "%s: Could not generate hash\n", __func__
);
92 * Calculate and return the CIFS signature based on the mac key and SMB PDU.
93 * The 16 byte signature must be allocated by the caller. Note we only use the
94 * 1st eight bytes and that the smb header signature field on input contains
95 * the sequence number before this function is called. Also, this function
96 * should be called with the server->srv_mutex held.
98 static int cifs_calc_signature(struct smb_rqst
*rqst
,
99 struct TCP_Server_Info
*server
, char *signature
)
103 if (!rqst
->rq_iov
|| !signature
|| !server
)
106 rc
= cifs_alloc_hash("md5", &server
->secmech
.md5
,
107 &server
->secmech
.sdescmd5
);
111 rc
= crypto_shash_init(&server
->secmech
.sdescmd5
->shash
);
113 cifs_dbg(VFS
, "%s: Could not init md5\n", __func__
);
117 rc
= crypto_shash_update(&server
->secmech
.sdescmd5
->shash
,
118 server
->session_key
.response
, server
->session_key
.len
);
120 cifs_dbg(VFS
, "%s: Could not update with response\n", __func__
);
124 return __cifs_calc_signature(rqst
, server
, signature
,
125 &server
->secmech
.sdescmd5
->shash
);
128 /* must be called with server->srv_mutex held */
129 int cifs_sign_rqst(struct smb_rqst
*rqst
, struct TCP_Server_Info
*server
,
130 __u32
*pexpected_response_sequence_number
)
133 char smb_signature
[20];
134 struct smb_hdr
*cifs_pdu
= (struct smb_hdr
*)rqst
->rq_iov
[0].iov_base
;
136 if (rqst
->rq_iov
[0].iov_len
!= 4 ||
137 rqst
->rq_iov
[0].iov_base
+ 4 != rqst
->rq_iov
[1].iov_base
)
140 if ((cifs_pdu
== NULL
) || (server
== NULL
))
143 spin_lock(&server
->srv_lock
);
144 if (!(cifs_pdu
->Flags2
& SMBFLG2_SECURITY_SIGNATURE
) ||
145 server
->tcpStatus
== CifsNeedNegotiate
) {
146 spin_unlock(&server
->srv_lock
);
149 spin_unlock(&server
->srv_lock
);
151 if (!server
->session_estab
) {
152 memcpy(cifs_pdu
->Signature
.SecuritySignature
, "BSRSPYL", 8);
156 cifs_pdu
->Signature
.Sequence
.SequenceNumber
=
157 cpu_to_le32(server
->sequence_number
);
158 cifs_pdu
->Signature
.Sequence
.Reserved
= 0;
160 *pexpected_response_sequence_number
= ++server
->sequence_number
;
161 ++server
->sequence_number
;
163 rc
= cifs_calc_signature(rqst
, server
, smb_signature
);
165 memset(cifs_pdu
->Signature
.SecuritySignature
, 0, 8);
167 memcpy(cifs_pdu
->Signature
.SecuritySignature
, smb_signature
, 8);
172 int cifs_sign_smbv(struct kvec
*iov
, int n_vec
, struct TCP_Server_Info
*server
,
173 __u32
*pexpected_response_sequence
)
175 struct smb_rqst rqst
= { .rq_iov
= iov
,
178 return cifs_sign_rqst(&rqst
, server
, pexpected_response_sequence
);
181 /* must be called with server->srv_mutex held */
182 int cifs_sign_smb(struct smb_hdr
*cifs_pdu
, struct TCP_Server_Info
*server
,
183 __u32
*pexpected_response_sequence_number
)
187 iov
[0].iov_base
= cifs_pdu
;
189 iov
[1].iov_base
= (char *)cifs_pdu
+ 4;
190 iov
[1].iov_len
= be32_to_cpu(cifs_pdu
->smb_buf_length
);
192 return cifs_sign_smbv(iov
, 2, server
,
193 pexpected_response_sequence_number
);
196 int cifs_verify_signature(struct smb_rqst
*rqst
,
197 struct TCP_Server_Info
*server
,
198 __u32 expected_sequence_number
)
201 char server_response_sig
[8];
202 char what_we_think_sig_should_be
[20];
203 struct smb_hdr
*cifs_pdu
= (struct smb_hdr
*)rqst
->rq_iov
[0].iov_base
;
205 if (rqst
->rq_iov
[0].iov_len
!= 4 ||
206 rqst
->rq_iov
[0].iov_base
+ 4 != rqst
->rq_iov
[1].iov_base
)
209 if (cifs_pdu
== NULL
|| server
== NULL
)
212 if (!server
->session_estab
)
215 if (cifs_pdu
->Command
== SMB_COM_LOCKING_ANDX
) {
216 struct smb_com_lock_req
*pSMB
=
217 (struct smb_com_lock_req
*)cifs_pdu
;
218 if (pSMB
->LockType
& LOCKING_ANDX_OPLOCK_RELEASE
)
222 /* BB what if signatures are supposed to be on for session but
223 server does not send one? BB */
225 /* Do not need to verify session setups with signature "BSRSPYL " */
226 if (memcmp(cifs_pdu
->Signature
.SecuritySignature
, "BSRSPYL ", 8) == 0)
227 cifs_dbg(FYI
, "dummy signature received for smb command 0x%x\n",
230 /* save off the origiginal signature so we can modify the smb and check
231 its signature against what the server sent */
232 memcpy(server_response_sig
, cifs_pdu
->Signature
.SecuritySignature
, 8);
234 cifs_pdu
->Signature
.Sequence
.SequenceNumber
=
235 cpu_to_le32(expected_sequence_number
);
236 cifs_pdu
->Signature
.Sequence
.Reserved
= 0;
238 cifs_server_lock(server
);
239 rc
= cifs_calc_signature(rqst
, server
, what_we_think_sig_should_be
);
240 cifs_server_unlock(server
);
245 /* cifs_dump_mem("what we think it should be: ",
246 what_we_think_sig_should_be, 16); */
248 if (memcmp(server_response_sig
, what_we_think_sig_should_be
, 8))
255 /* Build a proper attribute value/target info pairs blob.
256 * Fill in netbios and dns domain name and workstation name
257 * and client time (total five av pairs and + one end of fields indicator.
258 * Allocate domain name which gets freed when session struct is deallocated.
261 build_avpair_blob(struct cifs_ses
*ses
, const struct nls_table
*nls_cp
)
264 unsigned int size
= 2 * sizeof(struct ntlmssp2_name
);
265 char *defdmname
= "WORKGROUP";
266 unsigned char *blobptr
;
267 struct ntlmssp2_name
*attrptr
;
269 if (!ses
->domainName
) {
270 ses
->domainName
= kstrdup(defdmname
, GFP_KERNEL
);
271 if (!ses
->domainName
)
275 dlen
= strlen(ses
->domainName
);
278 * The length of this blob is two times the size of a
279 * structure (av pair) which holds name/size
280 * ( for NTLMSSP_AV_NB_DOMAIN_NAME followed by NTLMSSP_AV_EOL ) +
281 * unicode length of a netbios domain name
283 ses
->auth_key
.len
= size
+ 2 * dlen
;
284 ses
->auth_key
.response
= kzalloc(ses
->auth_key
.len
, GFP_KERNEL
);
285 if (!ses
->auth_key
.response
) {
286 ses
->auth_key
.len
= 0;
290 blobptr
= ses
->auth_key
.response
;
291 attrptr
= (struct ntlmssp2_name
*) blobptr
;
294 * As defined in MS-NTLM 3.3.2, just this av pair field
295 * is sufficient as part of the temp
297 attrptr
->type
= cpu_to_le16(NTLMSSP_AV_NB_DOMAIN_NAME
);
298 attrptr
->length
= cpu_to_le16(2 * dlen
);
299 blobptr
= (unsigned char *)attrptr
+ sizeof(struct ntlmssp2_name
);
300 cifs_strtoUTF16((__le16
*)blobptr
, ses
->domainName
, dlen
, nls_cp
);
305 /* Server has provided av pairs/target info in the type 2 challenge
306 * packet and we have plucked it and stored within smb session.
307 * We parse that blob here to find netbios domain name to be used
308 * as part of ntlmv2 authentication (in Target String), if not already
309 * specified on the command line.
310 * If this function returns without any error but without fetching
311 * domain name, authentication may fail against some server but
312 * may not fail against other (those who are not very particular
313 * about target string i.e. for some, just user name might suffice.
316 find_domain_name(struct cifs_ses
*ses
, const struct nls_table
*nls_cp
)
318 unsigned int attrsize
;
320 unsigned int onesize
= sizeof(struct ntlmssp2_name
);
321 unsigned char *blobptr
;
322 unsigned char *blobend
;
323 struct ntlmssp2_name
*attrptr
;
325 if (!ses
->auth_key
.len
|| !ses
->auth_key
.response
)
328 blobptr
= ses
->auth_key
.response
;
329 blobend
= blobptr
+ ses
->auth_key
.len
;
331 while (blobptr
+ onesize
< blobend
) {
332 attrptr
= (struct ntlmssp2_name
*) blobptr
;
333 type
= le16_to_cpu(attrptr
->type
);
334 if (type
== NTLMSSP_AV_EOL
)
336 blobptr
+= 2; /* advance attr type */
337 attrsize
= le16_to_cpu(attrptr
->length
);
338 blobptr
+= 2; /* advance attr size */
339 if (blobptr
+ attrsize
> blobend
)
341 if (type
== NTLMSSP_AV_NB_DOMAIN_NAME
) {
342 if (!attrsize
|| attrsize
>= CIFS_MAX_DOMAINNAME_LEN
)
344 if (!ses
->domainName
) {
346 kmalloc(attrsize
+ 1, GFP_KERNEL
);
347 if (!ses
->domainName
)
349 cifs_from_utf16(ses
->domainName
,
350 (__le16
*)blobptr
, attrsize
, attrsize
,
351 nls_cp
, NO_MAP_UNI_RSVD
);
355 blobptr
+= attrsize
; /* advance attr value */
361 /* Server has provided av pairs/target info in the type 2 challenge
362 * packet and we have plucked it and stored within smb session.
363 * We parse that blob here to find the server given timestamp
364 * as part of ntlmv2 authentication (or local current time as
365 * default in case of failure)
368 find_timestamp(struct cifs_ses
*ses
)
370 unsigned int attrsize
;
372 unsigned int onesize
= sizeof(struct ntlmssp2_name
);
373 unsigned char *blobptr
;
374 unsigned char *blobend
;
375 struct ntlmssp2_name
*attrptr
;
376 struct timespec64 ts
;
378 if (!ses
->auth_key
.len
|| !ses
->auth_key
.response
)
381 blobptr
= ses
->auth_key
.response
;
382 blobend
= blobptr
+ ses
->auth_key
.len
;
384 while (blobptr
+ onesize
< blobend
) {
385 attrptr
= (struct ntlmssp2_name
*) blobptr
;
386 type
= le16_to_cpu(attrptr
->type
);
387 if (type
== NTLMSSP_AV_EOL
)
389 blobptr
+= 2; /* advance attr type */
390 attrsize
= le16_to_cpu(attrptr
->length
);
391 blobptr
+= 2; /* advance attr size */
392 if (blobptr
+ attrsize
> blobend
)
394 if (type
== NTLMSSP_AV_TIMESTAMP
) {
395 if (attrsize
== sizeof(u64
))
396 return *((__le64
*)blobptr
);
398 blobptr
+= attrsize
; /* advance attr value */
401 ktime_get_real_ts64(&ts
);
402 return cpu_to_le64(cifs_UnixTimeToNT(ts
));
405 static int calc_ntlmv2_hash(struct cifs_ses
*ses
, char *ntlmv2_hash
,
406 const struct nls_table
*nls_cp
)
410 char nt_hash
[CIFS_NTHASH_SIZE
];
415 if (!ses
->server
->secmech
.sdeschmacmd5
) {
416 cifs_dbg(VFS
, "%s: can't generate ntlmv2 hash\n", __func__
);
420 /* calculate md4 hash of password */
421 E_md4hash(ses
->password
, nt_hash
, nls_cp
);
423 rc
= crypto_shash_setkey(ses
->server
->secmech
.hmacmd5
, nt_hash
,
426 cifs_dbg(VFS
, "%s: Could not set NT Hash as a key\n", __func__
);
430 rc
= crypto_shash_init(&ses
->server
->secmech
.sdeschmacmd5
->shash
);
432 cifs_dbg(VFS
, "%s: Could not init hmacmd5\n", __func__
);
436 /* convert ses->user_name to unicode */
437 len
= ses
->user_name
? strlen(ses
->user_name
) : 0;
438 user
= kmalloc(2 + (len
* 2), GFP_KERNEL
);
445 len
= cifs_strtoUTF16(user
, ses
->user_name
, len
, nls_cp
);
448 memset(user
, '\0', 2);
451 rc
= crypto_shash_update(&ses
->server
->secmech
.sdeschmacmd5
->shash
,
452 (char *)user
, 2 * len
);
455 cifs_dbg(VFS
, "%s: Could not update with user\n", __func__
);
459 /* convert ses->domainName to unicode and uppercase */
460 if (ses
->domainName
) {
461 len
= strlen(ses
->domainName
);
463 domain
= kmalloc(2 + (len
* 2), GFP_KERNEL
);
464 if (domain
== NULL
) {
468 len
= cifs_strtoUTF16((__le16
*)domain
, ses
->domainName
, len
,
471 crypto_shash_update(&ses
->server
->secmech
.sdeschmacmd5
->shash
,
472 (char *)domain
, 2 * len
);
475 cifs_dbg(VFS
, "%s: Could not update with domain\n",
480 /* We use ses->ip_addr if no domain name available */
481 len
= strlen(ses
->ip_addr
);
483 server
= kmalloc(2 + (len
* 2), GFP_KERNEL
);
484 if (server
== NULL
) {
488 len
= cifs_strtoUTF16((__le16
*)server
, ses
->ip_addr
, len
,
491 crypto_shash_update(&ses
->server
->secmech
.sdeschmacmd5
->shash
,
492 (char *)server
, 2 * len
);
495 cifs_dbg(VFS
, "%s: Could not update with server\n",
501 rc
= crypto_shash_final(&ses
->server
->secmech
.sdeschmacmd5
->shash
,
504 cifs_dbg(VFS
, "%s: Could not generate md5 hash\n", __func__
);
510 CalcNTLMv2_response(const struct cifs_ses
*ses
, char *ntlmv2_hash
)
513 struct ntlmv2_resp
*ntlmv2
= (struct ntlmv2_resp
*)
514 (ses
->auth_key
.response
+ CIFS_SESS_KEY_SIZE
);
515 unsigned int hash_len
;
517 /* The MD5 hash starts at challenge_key.key */
518 hash_len
= ses
->auth_key
.len
- (CIFS_SESS_KEY_SIZE
+
519 offsetof(struct ntlmv2_resp
, challenge
.key
[0]));
521 if (!ses
->server
->secmech
.sdeschmacmd5
) {
522 cifs_dbg(VFS
, "%s: can't generate ntlmv2 hash\n", __func__
);
526 rc
= crypto_shash_setkey(ses
->server
->secmech
.hmacmd5
,
527 ntlmv2_hash
, CIFS_HMAC_MD5_HASH_SIZE
);
529 cifs_dbg(VFS
, "%s: Could not set NTLMV2 Hash as a key\n",
534 rc
= crypto_shash_init(&ses
->server
->secmech
.sdeschmacmd5
->shash
);
536 cifs_dbg(VFS
, "%s: Could not init hmacmd5\n", __func__
);
540 if (ses
->server
->negflavor
== CIFS_NEGFLAVOR_EXTENDED
)
541 memcpy(ntlmv2
->challenge
.key
,
542 ses
->ntlmssp
->cryptkey
, CIFS_SERVER_CHALLENGE_SIZE
);
544 memcpy(ntlmv2
->challenge
.key
,
545 ses
->server
->cryptkey
, CIFS_SERVER_CHALLENGE_SIZE
);
546 rc
= crypto_shash_update(&ses
->server
->secmech
.sdeschmacmd5
->shash
,
547 ntlmv2
->challenge
.key
, hash_len
);
549 cifs_dbg(VFS
, "%s: Could not update with response\n", __func__
);
553 /* Note that the MD5 digest over writes anon.challenge_key.key */
554 rc
= crypto_shash_final(&ses
->server
->secmech
.sdeschmacmd5
->shash
,
555 ntlmv2
->ntlmv2_hash
);
557 cifs_dbg(VFS
, "%s: Could not generate md5 hash\n", __func__
);
563 setup_ntlmv2_rsp(struct cifs_ses
*ses
, const struct nls_table
*nls_cp
)
568 struct ntlmv2_resp
*ntlmv2
;
569 char ntlmv2_hash
[16];
570 unsigned char *tiblob
= NULL
; /* target info blob */
571 __le64 rsp_timestamp
;
573 if (nls_cp
== NULL
) {
574 cifs_dbg(VFS
, "%s called with nls_cp==NULL\n", __func__
);
578 if (ses
->server
->negflavor
== CIFS_NEGFLAVOR_EXTENDED
) {
579 if (!ses
->domainName
) {
580 if (ses
->domainAuto
) {
581 rc
= find_domain_name(ses
, nls_cp
);
583 cifs_dbg(VFS
, "error %d finding domain name\n",
585 goto setup_ntlmv2_rsp_ret
;
588 ses
->domainName
= kstrdup("", GFP_KERNEL
);
592 rc
= build_avpair_blob(ses
, nls_cp
);
594 cifs_dbg(VFS
, "error %d building av pair blob\n", rc
);
595 goto setup_ntlmv2_rsp_ret
;
599 /* Must be within 5 minutes of the server (or in range +/-2h
600 * in case of Mac OS X), so simply carry over server timestamp
601 * (as Windows 7 does)
603 rsp_timestamp
= find_timestamp(ses
);
605 baselen
= CIFS_SESS_KEY_SIZE
+ sizeof(struct ntlmv2_resp
);
606 tilen
= ses
->auth_key
.len
;
607 tiblob
= ses
->auth_key
.response
;
609 ses
->auth_key
.response
= kmalloc(baselen
+ tilen
, GFP_KERNEL
);
610 if (!ses
->auth_key
.response
) {
612 ses
->auth_key
.len
= 0;
613 goto setup_ntlmv2_rsp_ret
;
615 ses
->auth_key
.len
+= baselen
;
617 ntlmv2
= (struct ntlmv2_resp
*)
618 (ses
->auth_key
.response
+ CIFS_SESS_KEY_SIZE
);
619 ntlmv2
->blob_signature
= cpu_to_le32(0x00000101);
620 ntlmv2
->reserved
= 0;
621 ntlmv2
->time
= rsp_timestamp
;
623 get_random_bytes(&ntlmv2
->client_chal
, sizeof(ntlmv2
->client_chal
));
624 ntlmv2
->reserved2
= 0;
626 memcpy(ses
->auth_key
.response
+ baselen
, tiblob
, tilen
);
628 cifs_server_lock(ses
->server
);
630 rc
= cifs_alloc_hash("hmac(md5)",
631 &ses
->server
->secmech
.hmacmd5
,
632 &ses
->server
->secmech
.sdeschmacmd5
);
637 /* calculate ntlmv2_hash */
638 rc
= calc_ntlmv2_hash(ses
, ntlmv2_hash
, nls_cp
);
640 cifs_dbg(VFS
, "Could not get v2 hash rc %d\n", rc
);
644 /* calculate first part of the client response (CR1) */
645 rc
= CalcNTLMv2_response(ses
, ntlmv2_hash
);
647 cifs_dbg(VFS
, "Could not calculate CR1 rc: %d\n", rc
);
651 /* now calculate the session key for NTLMv2 */
652 rc
= crypto_shash_setkey(ses
->server
->secmech
.hmacmd5
,
653 ntlmv2_hash
, CIFS_HMAC_MD5_HASH_SIZE
);
655 cifs_dbg(VFS
, "%s: Could not set NTLMV2 Hash as a key\n",
660 rc
= crypto_shash_init(&ses
->server
->secmech
.sdeschmacmd5
->shash
);
662 cifs_dbg(VFS
, "%s: Could not init hmacmd5\n", __func__
);
666 rc
= crypto_shash_update(&ses
->server
->secmech
.sdeschmacmd5
->shash
,
668 CIFS_HMAC_MD5_HASH_SIZE
);
670 cifs_dbg(VFS
, "%s: Could not update with response\n", __func__
);
674 rc
= crypto_shash_final(&ses
->server
->secmech
.sdeschmacmd5
->shash
,
675 ses
->auth_key
.response
);
677 cifs_dbg(VFS
, "%s: Could not generate md5 hash\n", __func__
);
680 cifs_server_unlock(ses
->server
);
681 setup_ntlmv2_rsp_ret
:
688 calc_seckey(struct cifs_ses
*ses
)
690 unsigned char sec_key
[CIFS_SESS_KEY_SIZE
]; /* a nonce */
691 struct arc4_ctx
*ctx_arc4
;
696 get_random_bytes(sec_key
, CIFS_SESS_KEY_SIZE
);
698 ctx_arc4
= kmalloc(sizeof(*ctx_arc4
), GFP_KERNEL
);
700 cifs_dbg(VFS
, "Could not allocate arc4 context\n");
704 cifs_arc4_setkey(ctx_arc4
, ses
->auth_key
.response
, CIFS_SESS_KEY_SIZE
);
705 cifs_arc4_crypt(ctx_arc4
, ses
->ntlmssp
->ciphertext
, sec_key
,
708 /* make secondary_key/nonce as session key */
709 memcpy(ses
->auth_key
.response
, sec_key
, CIFS_SESS_KEY_SIZE
);
710 /* and make len as that of session key only */
711 ses
->auth_key
.len
= CIFS_SESS_KEY_SIZE
;
713 memzero_explicit(sec_key
, CIFS_SESS_KEY_SIZE
);
714 kfree_sensitive(ctx_arc4
);
719 cifs_crypto_secmech_release(struct TCP_Server_Info
*server
)
721 if (server
->secmech
.cmacaes
) {
722 crypto_free_shash(server
->secmech
.cmacaes
);
723 server
->secmech
.cmacaes
= NULL
;
726 if (server
->secmech
.hmacsha256
) {
727 crypto_free_shash(server
->secmech
.hmacsha256
);
728 server
->secmech
.hmacsha256
= NULL
;
731 if (server
->secmech
.md5
) {
732 crypto_free_shash(server
->secmech
.md5
);
733 server
->secmech
.md5
= NULL
;
736 if (server
->secmech
.sha512
) {
737 crypto_free_shash(server
->secmech
.sha512
);
738 server
->secmech
.sha512
= NULL
;
741 if (server
->secmech
.hmacmd5
) {
742 crypto_free_shash(server
->secmech
.hmacmd5
);
743 server
->secmech
.hmacmd5
= NULL
;
746 if (server
->secmech
.ccmaesencrypt
) {
747 crypto_free_aead(server
->secmech
.ccmaesencrypt
);
748 server
->secmech
.ccmaesencrypt
= NULL
;
751 if (server
->secmech
.ccmaesdecrypt
) {
752 crypto_free_aead(server
->secmech
.ccmaesdecrypt
);
753 server
->secmech
.ccmaesdecrypt
= NULL
;
756 kfree(server
->secmech
.sdesccmacaes
);
757 server
->secmech
.sdesccmacaes
= NULL
;
758 kfree(server
->secmech
.sdeschmacsha256
);
759 server
->secmech
.sdeschmacsha256
= NULL
;
760 kfree(server
->secmech
.sdeschmacmd5
);
761 server
->secmech
.sdeschmacmd5
= NULL
;
762 kfree(server
->secmech
.sdescmd5
);
763 server
->secmech
.sdescmd5
= NULL
;
764 kfree(server
->secmech
.sdescsha512
);
765 server
->secmech
.sdescsha512
= NULL
;