SUNRPC: Switch wrap token decryption to crypto/krb5

Browse source

Replace the per-enctype .decrypt callbacks (gss_krb5_aes_decrypt
and krb5_etm_decrypt) with a single gss_krb5_aead_decrypt()
wrapper that delegates to crypto_krb5_decrypt().

The new wrapper builds a scatterlist covering the secured
region (confounder through checksum), passes it to the AEAD
decrypt operation, and derives the confounder and checksum
lengths from the data offset and length that
crypto_krb5_decrypt() reports. The caller's token header
verification and buffer adjustment logic is unchanged.

Assisted-by: Claude:claude-opus-4-6
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Acked-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

...

This commit is contained in:

Chuck Lever 2026-04-27 09:50:51 -04:00 • committed by Chuck Lever

parent f1965a3bcb

commit 598de25dea

2 changed files with 57 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

53

net/sunrpc/auth_gss/gss_krb5_crypto.c

View file

8

net/sunrpc/auth_gss/gss_krb5_mech.c

View file