crypto/dist/heimdal/lib/krb5/rd_cred.c

   1 /*
   2  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include <krb5_locl.h>
  35
  36 __RCSID("$Heimdal: rd_cred.c 20304 2007-04-11 11:15:05Z lha $"
  37         "$NetBSD$");
  38
  39 static krb5_error_code
  40 compare_addrs(krb5_context context,
  41               krb5_address *a,
  42               krb5_address *b,
  43               const char *message)
  44 {
  45     char a_str[64], b_str[64];
  46     size_t len;
  47
  48     if(krb5_address_compare (context, a, b))
  49         return 0;
  50
  51     krb5_print_address (a, a_str, sizeof(a_str), &len);
  52     krb5_print_address (b, b_str, sizeof(b_str), &len);
  53     krb5_set_error_string(context, "%s: %s != %s", message, b_str, a_str);
  54     return KRB5KRB_AP_ERR_BADADDR;
  55 }
  56
  57 krb5_error_code KRB5_LIB_FUNCTION
  58 krb5_rd_cred(krb5_context context,
  59              krb5_auth_context auth_context,
  60              krb5_data *in_data,
  61              krb5_creds ***ret_creds,
  62              krb5_replay_data *outdata)
  63 {
  64     krb5_error_code ret;
  65     size_t len;
  66     KRB_CRED cred;
  67     EncKrbCredPart enc_krb_cred_part;
  68     krb5_data enc_krb_cred_part_data;
  69     krb5_crypto crypto;
  70     int i;
  71
  72     memset(&enc_krb_cred_part, 0, sizeof(enc_krb_cred_part));
  73
  74     if ((auth_context->flags &
  75          (KRB5_AUTH_CONTEXT_RET_TIME | KRB5_AUTH_CONTEXT_RET_SEQUENCE)) &&
  76         outdata == NULL)
  77         return KRB5_RC_REQUIRED; /* XXX better error, MIT returns this */
  78
  79     *ret_creds = NULL;
  80
  81     ret = decode_KRB_CRED(in_data->data, in_data->length,
  82                           &cred, &len);
  83     if(ret) {
  84         krb5_clear_error_string(context);
  85         return ret;
  86     }
  87
  88     if (cred.pvno != 5) {
  89         ret = KRB5KRB_AP_ERR_BADVERSION;
  90         krb5_clear_error_string (context);
  91         goto out;
  92     }
  93
  94     if (cred.msg_type != krb_cred) {
  95         ret = KRB5KRB_AP_ERR_MSG_TYPE;
  96         krb5_clear_error_string (context);
  97         goto out;
  98     }
  99
 100     if (cred.enc_part.etype == ETYPE_NULL) {
 101         /* DK: MIT GSS-API Compatibility */
 102         enc_krb_cred_part_data.length = cred.enc_part.cipher.length;
 103         enc_krb_cred_part_data.data   = cred.enc_part.cipher.data;
 104     } else {
 105         /* Try both subkey and session key.
 106          *
 107          * RFC4120 claims we should use the session key, but Heimdal
 108          * before 0.8 used the remote subkey if it was send in the
 109          * auth_context.
 110          */
 111
 112         if (auth_context->remote_subkey) {
 113             ret = krb5_crypto_init(context, auth_context->remote_subkey,
 114                                    0, &crypto);
 115             if (ret)
 116                 goto out;
 117
 118             ret = krb5_decrypt_EncryptedData(context,
 119                                              crypto,
 120                                              KRB5_KU_KRB_CRED,
 121                                              &cred.enc_part,
 122                                              &enc_krb_cred_part_data);
 123
 124             krb5_crypto_destroy(context, crypto);
 125         }
 126
 127         /*
 128          * If there was not subkey, or we failed using subkey,
 129          * retry using the session key
 130          */
 131         if (auth_context->remote_subkey == NULL || ret == KRB5KRB_AP_ERR_BAD_INTEGRITY)
 132         {
 133
 134             ret = krb5_crypto_init(context, auth_context->keyblock,
 135                                    0, &crypto);
 136
 137             if (ret)
 138                 goto out;
 139
 140             ret = krb5_decrypt_EncryptedData(context,
 141                                              crypto,
 142                                              KRB5_KU_KRB_CRED,
 143                                              &cred.enc_part,
 144                                              &enc_krb_cred_part_data);
 145
 146             krb5_crypto_destroy(context, crypto);
 147         }
 148         if (ret)
 149             goto out;
 150     }
 151
 152     ret = krb5_decode_EncKrbCredPart (context,
 153                                       enc_krb_cred_part_data.data,
 154                                       enc_krb_cred_part_data.length,
 155                                       &enc_krb_cred_part,
 156                                       &len);
 157     if (enc_krb_cred_part_data.data != cred.enc_part.cipher.data)
 158         krb5_data_free(&enc_krb_cred_part_data);
 159     if (ret)
 160         goto out;
 161
 162     /* check sender address */
 163
 164     if (enc_krb_cred_part.s_address
 165         && auth_context->remote_address
 166         && auth_context->remote_port) {
 167         krb5_address *a;
 168
 169         ret = krb5_make_addrport (context, &a,
 170                                   auth_context->remote_address,
 171                                   auth_context->remote_port);
 172         if (ret)
 173             goto out;
 174
 175
 176         ret = compare_addrs(context, a, enc_krb_cred_part.s_address,
 177                             "sender address is wrong in received creds");
 178         krb5_free_address(context, a);
 179         free(a);
 180         if(ret)
 181             goto out;
 182     }
 183
 184     /* check receiver address */
 185
 186     if (enc_krb_cred_part.r_address
 187         && auth_context->local_address) {
 188         if(auth_context->local_port &&
 189            enc_krb_cred_part.r_address->addr_type == KRB5_ADDRESS_ADDRPORT) {
 190             krb5_address *a;
 191             ret = krb5_make_addrport (context, &a,
 192                                       auth_context->local_address,
 193                                       auth_context->local_port);
 194             if (ret)
 195                 goto out;
 196
 197             ret = compare_addrs(context, a, enc_krb_cred_part.r_address,
 198                                 "receiver address is wrong in received creds");
 199             krb5_free_address(context, a);
 200             free(a);
 201             if(ret)
 202                 goto out;
 203         } else {
 204             ret = compare_addrs(context, auth_context->local_address,
 205                                 enc_krb_cred_part.r_address,
 206                                 "receiver address is wrong in received creds");
 207             if(ret)
 208                 goto out;
 209         }
 210     }
 211
 212     /* check timestamp */
 213     if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_TIME) {
 214         krb5_timestamp sec;
 215
 216         krb5_timeofday (context, &sec);
 217
 218         if (enc_krb_cred_part.timestamp == NULL ||
 219             enc_krb_cred_part.usec      == NULL ||
 220             abs(*enc_krb_cred_part.timestamp - sec)
 221             > context->max_skew) {
 222             krb5_clear_error_string (context);
 223             ret = KRB5KRB_AP_ERR_SKEW;
 224             goto out;
 225         }
 226     }
 227
 228     if ((auth_context->flags &
 229          (KRB5_AUTH_CONTEXT_RET_TIME | KRB5_AUTH_CONTEXT_RET_SEQUENCE))) {
 230         /* if these fields are not present in the cred-part, silently
 231            return zero */
 232         memset(outdata, 0, sizeof(*outdata));
 233         if(enc_krb_cred_part.timestamp)
 234             outdata->timestamp = *enc_krb_cred_part.timestamp;
 235         if(enc_krb_cred_part.usec)
 236             outdata->usec = *enc_krb_cred_part.usec;
 237         if(enc_krb_cred_part.nonce)
 238             outdata->seq = *enc_krb_cred_part.nonce;
 239     }
 240
 241     /* Convert to NULL terminated list of creds */
 242
 243     *ret_creds = calloc(enc_krb_cred_part.ticket_info.len + 1,
 244                         sizeof(**ret_creds));
 245
 246     if (*ret_creds == NULL) {
 247         ret = ENOMEM;
 248         krb5_set_error_string (context, "malloc: out of memory");
 249         goto out;
 250     }
 251
 252     for (i = 0; i < enc_krb_cred_part.ticket_info.len; ++i) {
 253         KrbCredInfo *kci = &enc_krb_cred_part.ticket_info.val[i];
 254         krb5_creds *creds;
 255
 256         creds = calloc(1, sizeof(*creds));
 257         if(creds == NULL) {
 258             ret = ENOMEM;
 259             krb5_set_error_string (context, "malloc: out of memory");
 260             goto out;
 261         }
 262
 263         ASN1_MALLOC_ENCODE(Ticket, creds->ticket.data, creds->ticket.length,
 264                            &cred.tickets.val[i], &len, ret);
 265         if (ret) {
 266             free(creds);
 267             goto out;
 268         }
 269         if(creds->ticket.length != len)
 270             krb5_abortx(context, "internal error in ASN.1 encoder");
 271         copy_EncryptionKey (&kci->key, &creds->session);
 272         if (kci->prealm && kci->pname)
 273             _krb5_principalname2krb5_principal (context,
 274                                                 &creds->client,
 275                                                 *kci->pname,
 276                                                 *kci->prealm);
 277         if (kci->flags)
 278             creds->flags.b = *kci->flags;
 279         if (kci->authtime)
 280             creds->times.authtime = *kci->authtime;
 281         if (kci->starttime)
 282             creds->times.starttime = *kci->starttime;
 283         if (kci->endtime)
 284             creds->times.endtime = *kci->endtime;
 285         if (kci->renew_till)
 286             creds->times.renew_till = *kci->renew_till;
 287         if (kci->srealm && kci->sname)
 288             _krb5_principalname2krb5_principal (context,
 289                                                 &creds->server,
 290                                                 *kci->sname,
 291                                                 *kci->srealm);
 292         if (kci->caddr)
 293             krb5_copy_addresses (context,
 294                                  kci->caddr,
 295                                  &creds->addresses);
 296
 297         (*ret_creds)[i] = creds;
 298
 299     }
 300     (*ret_creds)[i] = NULL;
 301
 302     free_KRB_CRED (&cred);
 303     free_EncKrbCredPart(&enc_krb_cred_part);
 304
 305     return 0;
 306
 307   out:
 308     free_EncKrbCredPart(&enc_krb_cred_part);
 309     free_KRB_CRED (&cred);
 310     if(*ret_creds) {
 311         for(i = 0; (*ret_creds)[i]; i++)
 312             krb5_free_creds(context, (*ret_creds)[i]);
 313         free(*ret_creds);
 314         *ret_creds = NULL;
 315     }
 316     return ret;
 317 }
 318
 319 krb5_error_code KRB5_LIB_FUNCTION
 320 krb5_rd_cred2 (krb5_context      context,
 321                krb5_auth_context auth_context,
 322                krb5_ccache       ccache,
 323                krb5_data         *in_data)
 324 {
 325     krb5_error_code ret;
 326     krb5_creds **creds;
 327     int i;
 328
 329     ret = krb5_rd_cred(context, auth_context, in_data, &creds, NULL);
 330     if(ret)
 331         return ret;
 332
 333     /* Store the creds in the ccache */
 334
 335     for(i = 0; creds && creds[i]; i++) {
 336         krb5_cc_store_cred(context, ccache, creds[i]);
 337         krb5_free_creds(context, creds[i]);
 338     }
 339     free(creds);
 340     return 0;
 341 }