lib/libc/rpc/svc_auth_des.c

   1
   2 /*
   3  * Copyright (c) 1988 by Sun Microsystems, Inc.
   4  *
   5  * @(#)svcauth_des.c    2.3 89/07/11 4.0 RPCSRC; from 1.15 88/02/08 SMI
   6  * $FreeBSD: src/lib/libc/rpc/svc_auth_des.c,v 1.9 2002/03/22 23:18:37 obrien Exp $
   7  */
   8
   9 /*-
  10  * Copyright (c) 2009, Sun Microsystems, Inc.
  11  * All rights reserved.
  12  *
  13  * Redistribution and use in source and binary forms, with or without
  14  * modification, are permitted provided that the following conditions are met:
  15  * - Redistributions of source code must retain the above copyright notice,
  16  *   this list of conditions and the following disclaimer.
  17  * - Redistributions in binary form must reproduce the above copyright notice,
  18  *   this list of conditions and the following disclaimer in the documentation
  19  *   and/or other materials provided with the distribution.
  20  * - Neither the name of Sun Microsystems, Inc. nor the names of its
  21  *   contributors may be used to endorse or promote products derived
  22  *   from this software without specific prior written permission.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  25  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
  28  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  29  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  32  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  34  * POSSIBILITY OF SUCH DAMAGE.
  35  */
  36
  37 /*
  38  * svcauth_des.c, server-side des authentication
  39  *
  40  * We insure for the service the following:
  41  * (1) The timestamp microseconds do not exceed 1 million.
  42  * (2) The timestamp plus the window is less than the current time.
  43  * (3) The timestamp is not less than the one previously
  44  *     seen in the current session.
  45  *
  46  * It is up to the server to determine if the window size is
  47  * too small .
  48  *
  49  */
  50
  51 #include "namespace.h"
  52 #include "reentrant.h"
  53 #include <string.h>
  54 #include <stdlib.h>
  55 #include <stdio.h>
  56 #include <unistd.h>
  57 #include <rpc/des_crypt.h>
  58 #include <sys/param.h>
  59 #include <netinet/in.h>
  60 #include <rpc/types.h>
  61 #include <rpc/xdr.h>
  62 #include <rpc/auth.h>
  63 #include <rpc/auth_des.h>
  64 #include <rpc/svc.h>
  65 #include <rpc/rpc_msg.h>
  66 #include <rpc/svc_auth.h>
  67 #include "un-namespace.h"
  68
  69 #include "libc_private.h"
  70
  71 extern int key_decryptsession_pk(const char *, netobj *, des_block *);
  72
  73 #define debug(msg)       printf("svcauth_des: %s\n", msg)
  74
  75 #define USEC_PER_SEC ((u_long) 1000000L)
  76 #define BEFORE(t1, t2) timercmp(t1, t2, <)
  77
  78 /*
  79  * LRU cache of conversation keys and some other useful items.
  80  */
  81 #define AUTHDES_CACHESZ 64
  82 struct cache_entry {
  83         des_block key;          /* conversation key */
  84         char *rname;            /* client's name */
  85         u_int window;           /* credential lifetime window */
  86         struct timeval laststamp;       /* detect replays of creds */
  87         char *localcred;        /* generic local credential */
  88 };
  89 static struct cache_entry *authdes_cache/* [AUTHDES_CACHESZ] */;
  90 static short *authdes_lru/* [AUTHDES_CACHESZ] */;
  91
  92 static void cache_init(void);   /* initialize the cache */
  93 static short cache_spot(des_block *, char *, struct timeval *);
  94                                 /* find an entry in the cache */
  95 static void cache_ref(short sid);       /* note that sid was ref'd */
  96
  97 static void invalidate(char *); /* invalidate entry in cache */
  98
  99 /*
 100  * cache statistics
 101  */
 102 static struct {
 103         u_long ncachehits;      /* times cache hit, and is not replay */
 104         u_long ncachereplays;   /* times cache hit, and is replay */
 105         u_long ncachemisses;    /* times cache missed */
 106 } svcauthdes_stats;
 107
 108 /*
 109  * Service side authenticator for AUTH_DES
 110  */
 111 enum auth_stat
 112 _svcauth_des(struct svc_req *rqst, struct rpc_msg *msg)
 113 {
 114
 115         long *ixdr;
 116         des_block cryptbuf[2];
 117         struct authdes_cred *cred;
 118         struct authdes_verf verf;
 119         int status;
 120         struct cache_entry *entry;
 121         short sid = 0;
 122         des_block *sessionkey;
 123         des_block ivec;
 124         u_int window;
 125         struct timeval timestamp;
 126         u_long namelen;
 127         struct area {
 128                 struct authdes_cred area_cred;
 129                 char area_netname[MAXNETNAMELEN+1];
 130         } *area;
 131
 132         if (authdes_cache == NULL) {
 133                 cache_init();
 134         }
 135
 136         area = (struct area *)rqst->rq_clntcred;
 137         cred = (struct authdes_cred *)&area->area_cred;
 138
 139         /*
 140          * Get the credential
 141          */
 142         ixdr = (long *)msg->rm_call.cb_cred.oa_base;
 143         cred->adc_namekind = IXDR_GET_ENUM(ixdr, enum authdes_namekind);
 144         switch (cred->adc_namekind) {
 145         case ADN_FULLNAME:
 146                 namelen = IXDR_GET_U_LONG(ixdr);
 147                 if (namelen > MAXNETNAMELEN) {
 148                         return (AUTH_BADCRED);
 149                 }
 150                 cred->adc_fullname.name = area->area_netname;
 151                 bcopy((char *)ixdr, cred->adc_fullname.name,
 152                         (u_int)namelen);
 153                 cred->adc_fullname.name[namelen] = 0;
 154                 ixdr += (RNDUP(namelen) / BYTES_PER_XDR_UNIT);
 155                 cred->adc_fullname.key.key.high = (u_long)*ixdr++;
 156                 cred->adc_fullname.key.key.low = (u_long)*ixdr++;
 157                 cred->adc_fullname.window = (u_long)*ixdr++;
 158                 break;
 159         case ADN_NICKNAME:
 160                 cred->adc_nickname = (u_long)*ixdr++;
 161                 break;
 162         default:
 163                 return (AUTH_BADCRED);
 164         }
 165
 166         /*
 167          * Get the verifier
 168          */
 169         ixdr = (long *)msg->rm_call.cb_verf.oa_base;
 170         verf.adv_xtimestamp.key.high = (u_long)*ixdr++;
 171         verf.adv_xtimestamp.key.low =  (u_long)*ixdr++;
 172         verf.adv_int_u = (u_long)*ixdr++;
 173
 174
 175         /*
 176          * Get the conversation key
 177          */
 178         if (cred->adc_namekind == ADN_FULLNAME) {
 179                 netobj pkey;
 180                 char pkey_data[1024];
 181
 182                 sessionkey = &cred->adc_fullname.key;
 183                 if (! getpublickey(cred->adc_fullname.name, pkey_data)) {
 184                         debug("getpublickey");
 185                         return(AUTH_BADCRED);
 186                 }
 187                 pkey.n_bytes = pkey_data;
 188                 pkey.n_len = strlen(pkey_data) + 1;
 189                 if (key_decryptsession_pk(cred->adc_fullname.name, &pkey,
 190                                        sessionkey) < 0) {
 191                         debug("decryptsessionkey");
 192                         return (AUTH_BADCRED); /* key not found */
 193                 }
 194         } else { /* ADN_NICKNAME */
 195                 sid = (short)cred->adc_nickname;
 196                 if (sid < 0 || sid >= AUTHDES_CACHESZ) {
 197                         debug("bad nickname");
 198                         return (AUTH_BADCRED);  /* garbled credential */
 199                 }
 200                 sessionkey = &authdes_cache[sid].key;
 201         }
 202
 203
 204         /*
 205          * Decrypt the timestamp
 206          */
 207         cryptbuf[0] = verf.adv_xtimestamp;
 208         if (cred->adc_namekind == ADN_FULLNAME) {
 209                 cryptbuf[1].key.high = cred->adc_fullname.window;
 210                 cryptbuf[1].key.low = verf.adv_winverf;
 211                 ivec.key.high = ivec.key.low = 0;
 212                 status = cbc_crypt((char *)sessionkey, (char *)cryptbuf,
 213                         2*sizeof(des_block), DES_DECRYPT | DES_HW,
 214                         (char *)&ivec);
 215         } else {
 216                 status = ecb_crypt((char *)sessionkey, (char *)cryptbuf,
 217                         sizeof(des_block), DES_DECRYPT | DES_HW);
 218         }
 219         if (DES_FAILED(status)) {
 220                 debug("decryption failure");
 221                 return (AUTH_FAILED);   /* system error */
 222         }
 223
 224         /*
 225          * XDR the decrypted timestamp
 226          */
 227         ixdr = (long *)cryptbuf;
 228         timestamp.tv_sec = IXDR_GET_LONG(ixdr);
 229         timestamp.tv_usec = IXDR_GET_LONG(ixdr);
 230
 231         /*
 232          * Check for valid credentials and verifiers.
 233          * They could be invalid because the key was flushed
 234          * out of the cache, and so a new session should begin.
 235          * Be sure and send AUTH_REJECTED{CRED, VERF} if this is the case.
 236          */
 237         {
 238                 struct timeval current;
 239                 int nick;
 240                 int winverf;
 241
 242                 if (cred->adc_namekind == ADN_FULLNAME) {
 243                         window = IXDR_GET_U_LONG(ixdr);
 244                         winverf = IXDR_GET_U_LONG(ixdr);
 245                         if (winverf != window - 1) {
 246                                 debug("window verifier mismatch");
 247                                 return (AUTH_BADCRED);  /* garbled credential */
 248                         }
 249                         sid = cache_spot(sessionkey, cred->adc_fullname.name,
 250                             &timestamp);
 251                         if (sid < 0) {
 252                                 debug("replayed credential");
 253                                 return (AUTH_REJECTEDCRED);     /* replay */
 254                         }
 255                         nick = 0;
 256                 } else {        /* ADN_NICKNAME */
 257                         window = authdes_cache[sid].window;
 258                         nick = 1;
 259                 }
 260
 261                 if ((u_long)timestamp.tv_usec >= USEC_PER_SEC) {
 262                         debug("invalid usecs");
 263                         /* cached out (bad key), or garbled verifier */
 264                         return (nick ? AUTH_REJECTEDVERF : AUTH_BADVERF);
 265                 }
 266                 if (nick && BEFORE(&timestamp,
 267                                    &authdes_cache[sid].laststamp)) {
 268                         debug("timestamp before last seen");
 269                         return (AUTH_REJECTEDVERF);     /* replay */
 270                 }
 271                 gettimeofday(&current, NULL);
 272                 current.tv_sec -= window;       /* allow for expiration */
 273                 if (!BEFORE(&current, &timestamp)) {
 274                         debug("timestamp expired");
 275                         /* replay, or garbled credential */
 276                         return (nick ? AUTH_REJECTEDVERF : AUTH_BADCRED);
 277                 }
 278         }
 279
 280         /*
 281          * Set up the reply verifier
 282          */
 283         verf.adv_nickname = (u_long)sid;
 284
 285         /*
 286          * xdr the timestamp before encrypting
 287          */
 288         ixdr = (long *)cryptbuf;
 289         IXDR_PUT_LONG(ixdr, timestamp.tv_sec - 1);
 290         IXDR_PUT_LONG(ixdr, timestamp.tv_usec);
 291
 292         /*
 293          * encrypt the timestamp
 294          */
 295         status = ecb_crypt((char *)sessionkey, (char *)cryptbuf,
 296             sizeof(des_block), DES_ENCRYPT | DES_HW);
 297         if (DES_FAILED(status)) {
 298                 debug("encryption failure");
 299                 return (AUTH_FAILED);   /* system error */
 300         }
 301         verf.adv_xtimestamp = cryptbuf[0];
 302
 303         /*
 304          * Serialize the reply verifier, and update rqst
 305          */
 306         ixdr = (long *)msg->rm_call.cb_verf.oa_base;
 307         *ixdr++ = (long)verf.adv_xtimestamp.key.high;
 308         *ixdr++ = (long)verf.adv_xtimestamp.key.low;
 309         *ixdr++ = (long)verf.adv_int_u;
 310
 311         rqst->rq_xprt->xp_verf.oa_flavor = AUTH_DES;
 312         rqst->rq_xprt->xp_verf.oa_base = msg->rm_call.cb_verf.oa_base;
 313         rqst->rq_xprt->xp_verf.oa_length =
 314                 (char *)ixdr - msg->rm_call.cb_verf.oa_base;
 315
 316         /*
 317          * We succeeded, commit the data to the cache now and
 318          * finish cooking the credential.
 319          */
 320         entry = &authdes_cache[sid];
 321         entry->laststamp = timestamp;
 322         cache_ref(sid);
 323         if (cred->adc_namekind == ADN_FULLNAME) {
 324                 cred->adc_fullname.window = window;
 325                 cred->adc_nickname = (u_long)sid;       /* save nickname */
 326                 if (entry->rname != NULL) {
 327                         mem_free(entry->rname, strlen(entry->rname) + 1);
 328                 }
 329                 entry->rname = (char *)mem_alloc((u_int)strlen(cred->adc_fullname.name)
 330                                          + 1);
 331                 if (entry->rname != NULL) {
 332                         strcpy(entry->rname, cred->adc_fullname.name);
 333                 } else {
 334                         debug("out of memory");
 335                 }
 336                 entry->key = *sessionkey;
 337                 entry->window = window;
 338                 invalidate(entry->localcred); /* mark any cached cred invalid */
 339         } else { /* ADN_NICKNAME */
 340                 /*
 341                  * nicknames are cooked into fullnames
 342                  */
 343                 cred->adc_namekind = ADN_FULLNAME;
 344                 cred->adc_fullname.name = entry->rname;
 345                 cred->adc_fullname.key = entry->key;
 346                 cred->adc_fullname.window = entry->window;
 347         }
 348         return (AUTH_OK);       /* we made it!*/
 349 }
 350
 351
 352 /*
 353  * Initialize the cache
 354  */
 355 static void
 356 cache_init(void)
 357 {
 358         int i;
 359
 360         authdes_cache = (struct cache_entry *)
 361                 mem_alloc(sizeof(struct cache_entry) * AUTHDES_CACHESZ);
 362         bzero((char *)authdes_cache,
 363                 sizeof(struct cache_entry) * AUTHDES_CACHESZ);
 364
 365         authdes_lru = (short *)mem_alloc(sizeof(short) * AUTHDES_CACHESZ);
 366         /*
 367          * Initialize the lru list
 368          */
 369         for (i = 0; i < AUTHDES_CACHESZ; i++) {
 370                 authdes_lru[i] = i;
 371         }
 372 }
 373
 374
 375 /*
 376  * Find the lru victim
 377  */
 378 static short
 379 cache_victim(void)
 380 {
 381         return (authdes_lru[AUTHDES_CACHESZ-1]);
 382 }
 383
 384 /*
 385  * Note that sid was referenced
 386  */
 387 static void
 388 cache_ref(short sid)
 389 {
 390         int i;
 391         short curr;
 392         short prev;
 393
 394         prev = authdes_lru[0];
 395         authdes_lru[0] = sid;
 396         for (i = 1; prev != sid; i++) {
 397                 curr = authdes_lru[i];
 398                 authdes_lru[i] = prev;
 399                 prev = curr;
 400         }
 401 }
 402
 403
 404 /*
 405  * Find a spot in the cache for a credential containing
 406  * the items given.  Return -1 if a replay is detected, otherwise
 407  * return the spot in the cache.
 408  */
 409 static short
 410 cache_spot(des_block *key, char *name, struct timeval *timestamp)
 411 {
 412         struct cache_entry *cp;
 413         int i;
 414         u_long hi;
 415
 416         hi = key->key.high;
 417         for (cp = authdes_cache, i = 0; i < AUTHDES_CACHESZ; i++, cp++) {
 418                 if (cp->key.key.high == hi &&
 419                     cp->key.key.low == key->key.low &&
 420                     cp->rname != NULL &&
 421                     bcmp(cp->rname, name, strlen(name) + 1) == 0) {
 422                         if (BEFORE(timestamp, &cp->laststamp)) {
 423                                 svcauthdes_stats.ncachereplays++;
 424                                 return (-1); /* replay */
 425                         }
 426                         svcauthdes_stats.ncachehits++;
 427                         return (i);     /* refresh */
 428                 }
 429         }
 430         svcauthdes_stats.ncachemisses++;
 431         return (cache_victim());        /* new credential */
 432 }
 433
 434
 435 #if defined(sun) || defined(vax) || \
 436     defined(__FreeBSD__) || defined(__DragonFly__)
 437 /*
 438  * Local credential handling stuff.
 439  * NOTE: bsd unix dependent.
 440  * Other operating systems should put something else here.
 441  */
 442 #define UNKNOWN         -2      /* grouplen, if cached cred is unknown user */
 443 #define INVALID         -1      /* grouplen, if cache entry is invalid */
 444
 445 struct bsdcred {
 446         short uid;              /* cached uid */
 447         short gid;              /* cached gid */
 448         short grouplen; /* length of cached groups */
 449         short groups[NGROUPS];  /* cached groups */
 450 };
 451
 452 /*
 453  * Map a des credential into a unix cred.
 454  * We cache the credential here so the application does
 455  * not have to make an rpc call every time to interpret
 456  * the credential.
 457  */
 458 int
 459 authdes_getucred(struct authdes_cred *adc, uid_t *uid, gid_t *gid,
 460                  int *grouplen, gid_t *groups)
 461 {
 462         unsigned sid;
 463         int i;
 464         uid_t i_uid;
 465         gid_t i_gid;
 466         int i_grouplen;
 467         struct bsdcred *cred;
 468
 469         sid = adc->adc_nickname;
 470         if (sid >= AUTHDES_CACHESZ) {
 471                 debug("invalid nickname");
 472                 return (0);
 473         }
 474         cred = (struct bsdcred *)authdes_cache[sid].localcred;
 475         if (cred == NULL) {
 476                 cred = (struct bsdcred *)mem_alloc(sizeof(struct bsdcred));
 477                 authdes_cache[sid].localcred = (char *)cred;
 478                 cred->grouplen = INVALID;
 479         }
 480         if (cred->grouplen == INVALID) {
 481                 /*
 482                  * not in cache: lookup
 483                  */
 484                 if (!netname2user(adc->adc_fullname.name, &i_uid, &i_gid,
 485                         &i_grouplen, groups))
 486                 {
 487                         debug("unknown netname");
 488                         cred->grouplen = UNKNOWN;       /* mark as lookup up, but not found */
 489                         return (0);
 490                 }
 491                 debug("missed ucred cache");
 492                 *uid = cred->uid = i_uid;
 493                 *gid = cred->gid = i_gid;
 494                 *grouplen = cred->grouplen = i_grouplen;
 495                 for (i = i_grouplen - 1; i >= 0; i--) {
 496                         cred->groups[i] = groups[i]; /* int to short */
 497                 }
 498                 return (1);
 499         } else if (cred->grouplen == UNKNOWN) {
 500                 /*
 501                  * Already lookup up, but no match found
 502                  */
 503                 return (0);
 504         }
 505
 506         /*
 507          * cached credentials
 508          */
 509         *uid = cred->uid;
 510         *gid = cred->gid;
 511         *grouplen = cred->grouplen;
 512         for (i = cred->grouplen - 1; i >= 0; i--) {
 513                 groups[i] = cred->groups[i];    /* short to int */
 514         }
 515         return (1);
 516 }
 517
 518 static void
 519 invalidate(char *cred)
 520 {
 521         if (cred == NULL) {
 522                 return;
 523         }
 524         ((struct bsdcred *)cred)->grouplen = INVALID;
 525 }
 526 #endif
 527