SUNRPC: Add crypto/krb5 enctype lookup to krb5_ctx

Each krb5_ctx currently points to a gss_krb5_enctype, the
rpcsec_gss_krb5 module's own enctype descriptor. To begin
using the common crypto/krb5 library, store a pointer to the
corresponding struct krb5_enctype (from <crypto/krb5.h>) as
well.

The lookup is performed in gss_import_v2_context() immediately
after the existing gss_krb5_lookup_enctype() call. If
crypto_krb5_find_enctype() cannot find a matching enctype the
context import fails, ensuring the module never operates with
a partially-initialized krb5_ctx.

Assisted-by: Claude:claude-opus-4-6
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Acked-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

diff --git a/net/sunrpc/auth_gss/gss_krb5_internal.h b/net/sunrpc/auth_gss/gss_krb5_internal.h
index 8769e9e705bfaec0f82ccdbab18736acf4f79106..11402c3b4972ddb40c4670937436d23d8d84cc46 100644 (file)
--- a/net/sunrpc/auth_gss/gss_krb5_internal.h
+++ b/net/sunrpc/auth_gss/gss_krb5_internal.h
@@ -8,6 +8,8 @@
 #ifndef _NET_SUNRPC_AUTH_GSS_KRB5_INTERNAL_H
 #define _NET_SUNRPC_AUTH_GSS_KRB5_INTERNAL_H
 
+#include <crypto/krb5.h>
+
 /*
  * The RFCs often specify payload lengths in bits. This helper
  * converts a specified bit-length to the number of octets/bytes.
@@ -62,6 +64,7 @@ struct krb5_ctx {
        u32                     enctype;
        u32                     flags;
        const struct gss_krb5_enctype *gk5e; /* enctype-specific info */
+       const struct krb5_enctype *krb5e; /* crypto/krb5 enctype */
        struct crypto_sync_skcipher *enc;
        struct crypto_sync_skcipher *seq;
        struct crypto_sync_skcipher *acceptor_enc;

diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 6db64a9111a927f2b0981573820d1ebb36851075..060d8fc4358eef54bd0b054da2dd5355f744cee6 100644 (file)
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -432,6 +432,13 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx,
                p = ERR_PTR(-EINVAL);
                goto out_err;
        }
+       ctx->krb5e = crypto_krb5_find_enctype(ctx->enctype);
+       if (!ctx->krb5e) {
+               dprintk("gss_kerberos_mech: crypto/krb5 missing enctype %u\n",
+                       ctx->enctype);
+               p = ERR_PTR(-EINVAL);
+               goto out_err;
+       }
        keylen = ctx->gk5e->keylength;
 
        p = simple_get_bytes(p, end, ctx->Ksess, keylen);