lib/krb5/transited.c

   1 /*
   2  * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35
  36 /* this is an attempt at one of the most horrible `compression'
  37    schemes that has ever been invented; it's so amazingly brain-dead
  38    that words can not describe it, and all this just to save a few
  39    silly bytes */
  40
  41 struct tr_realm {
  42     char *realm;
  43     unsigned leading_space:1;
  44     unsigned leading_slash:1;
  45     unsigned trailing_dot:1;
  46     struct tr_realm *next;
  47 };
  48
  49 static void
  50 free_realms(struct tr_realm *r)
  51 {
  52     struct tr_realm *p;
  53     while(r){
  54         p = r;
  55         r = r->next;
  56         free(p->realm);
  57         free(p);
  58     }
  59 }
  60
  61 static int
  62 make_path(krb5_context context, struct tr_realm *r,
  63           const char *from, const char *to)
  64 {
  65     struct tr_realm *tmp;
  66     const char *p;
  67
  68     if(strlen(from) < strlen(to)){
  69         const char *str;
  70         str = from;
  71         from = to;
  72         to = str;
  73     }
  74
  75     if(strcmp(from + strlen(from) - strlen(to), to) == 0){
  76         p = from;
  77         while(1){
  78             p = strchr(p, '.');
  79             if(p == NULL) {
  80                 krb5_clear_error_message (context);
  81                 return KRB5KDC_ERR_POLICY;
  82             }
  83             p++;
  84             if(strcmp(p, to) == 0)
  85                 break;
  86             tmp = calloc(1, sizeof(*tmp));
  87             if(tmp == NULL)
  88                 return krb5_enomem(context);
  89             tmp->next = r->next;
  90             r->next = tmp;
  91             tmp->realm = strdup(p);
  92             if(tmp->realm == NULL){
  93                 r->next = tmp->next;
  94                 free(tmp);
  95                 return krb5_enomem(context);
  96             }
  97         }
  98     }else if(strncmp(from, to, strlen(to)) == 0){
  99         p = from + strlen(from);
 100         while(1){
 101             while(p >= from && *p != '/') p--;
 102             if(p == from)
 103                 return KRB5KDC_ERR_POLICY;
 104
 105             if(strncmp(to, from, p - from) == 0)
 106                 break;
 107             tmp = calloc(1, sizeof(*tmp));
 108             if(tmp == NULL)
 109                 return krb5_enomem(context);
 110             tmp->next = r->next;
 111             r->next = tmp;
 112             tmp->realm = malloc(p - from + 1);
 113             if(tmp->realm == NULL){
 114                 r->next = tmp->next;
 115                 free(tmp);
 116                 return krb5_enomem(context);
 117             }
 118             memcpy(tmp->realm, from, p - from);
 119             tmp->realm[p - from] = '\0';
 120             p--;
 121         }
 122     } else {
 123         krb5_clear_error_message (context);
 124         return KRB5KDC_ERR_POLICY;
 125     }
 126
 127     return 0;
 128 }
 129
 130 static int
 131 make_paths(krb5_context context,
 132            struct tr_realm *realms, const char *client_realm,
 133            const char *server_realm)
 134 {
 135     struct tr_realm *r;
 136     int ret;
 137     const char *prev_realm = client_realm;
 138     const char *next_realm = NULL;
 139     for(r = realms; r; r = r->next){
 140         /* it *might* be that you can have more than one empty
 141            component in a row, at least that's how I interpret the
 142            "," exception in 1510 */
 143         if(r->realm[0] == '\0'){
 144             while(r->next && r->next->realm[0] == '\0')
 145                 r = r->next;
 146             if(r->next)
 147                 next_realm = r->next->realm;
 148             else
 149                 next_realm = server_realm;
 150             ret = make_path(context, r, prev_realm, next_realm);
 151             if(ret){
 152                 free_realms(realms);
 153                 return ret;
 154             }
 155         }
 156         prev_realm = r->realm;
 157     }
 158     return 0;
 159 }
 160
 161 static int
 162 expand_realms(krb5_context context,
 163               struct tr_realm *realms, const char *client_realm)
 164 {
 165     struct tr_realm *r;
 166     const char *prev_realm = NULL;
 167     for(r = realms; r; r = r->next){
 168         if(r->trailing_dot){
 169             char *tmp;
 170             size_t len;
 171
 172             if(prev_realm == NULL)
 173                 prev_realm = client_realm;
 174
 175             len = strlen(r->realm) + strlen(prev_realm) + 1;
 176
 177             tmp = realloc(r->realm, len);
 178             if(tmp == NULL){
 179                 free_realms(realms);
 180                 return krb5_enomem(context);
 181             }
 182             r->realm = tmp;
 183             strlcat(r->realm, prev_realm, len);
 184         }else if(r->leading_slash && !r->leading_space && prev_realm){
 185             /* yet another exception: if you use x500-names, the
 186                leading realm doesn't have to be "quoted" with a space */
 187             char *tmp;
 188             size_t len = strlen(r->realm) + strlen(prev_realm) + 1;
 189
 190             tmp = malloc(len);
 191             if(tmp == NULL){
 192                 free_realms(realms);
 193                 return krb5_enomem(context);
 194             }
 195             strlcpy(tmp, prev_realm, len);
 196             strlcat(tmp, r->realm, len);
 197             free(r->realm);
 198             r->realm = tmp;
 199         }
 200         prev_realm = r->realm;
 201     }
 202     return 0;
 203 }
 204
 205 static struct tr_realm *
 206 make_realm(char *realm)
 207 {
 208     struct tr_realm *r;
 209     char *p, *q;
 210     int quote = 0;
 211     r = calloc(1, sizeof(*r));
 212     if(r == NULL){
 213         free(realm);
 214         return NULL;
 215     }
 216     r->realm = realm;
 217     for(p = q = r->realm; *p; p++){
 218         if(p == r->realm && *p == ' '){
 219             r->leading_space = 1;
 220             continue;
 221         }
 222         if(q == r->realm && *p == '/')
 223             r->leading_slash = 1;
 224         if(quote){
 225             *q++ = *p;
 226             quote = 0;
 227             continue;
 228         }
 229         if(*p == '\\'){
 230             quote = 1;
 231             continue;
 232         }
 233         if(p[0] == '.' && p[1] == '\0')
 234             r->trailing_dot = 1;
 235         *q++ = *p;
 236     }
 237     *q = '\0';
 238     return r;
 239 }
 240
 241 static struct tr_realm*
 242 append_realm(struct tr_realm *head, struct tr_realm *r)
 243 {
 244     struct tr_realm *p;
 245     if(head == NULL){
 246         r->next = NULL;
 247         return r;
 248     }
 249     p = head;
 250     while(p->next) p = p->next;
 251     p->next = r;
 252     return head;
 253 }
 254
 255 static int
 256 decode_realms(krb5_context context,
 257               const char *tr, int length, struct tr_realm **realms)
 258 {
 259     struct tr_realm *r = NULL;
 260
 261     char *tmp;
 262     int quote = 0;
 263     const char *start = tr;
 264     int i;
 265
 266     for(i = 0; i < length; i++){
 267         if(quote){
 268             quote = 0;
 269             continue;
 270         }
 271         if(tr[i] == '\\'){
 272             quote = 1;
 273             continue;
 274         }
 275         if(tr[i] == ','){
 276             tmp = malloc(tr + i - start + 1);
 277             if(tmp == NULL)
 278                 return krb5_enomem(context);
 279             memcpy(tmp, start, tr + i - start);
 280             tmp[tr + i - start] = '\0';
 281             r = make_realm(tmp);
 282             if(r == NULL){
 283                 free_realms(*realms);
 284                 return krb5_enomem(context);
 285             }
 286             *realms = append_realm(*realms, r);
 287             start = tr + i + 1;
 288         }
 289     }
 290     tmp = malloc(tr + i - start + 1);
 291     if(tmp == NULL){
 292         free(*realms);
 293         return krb5_enomem(context);
 294     }
 295     memcpy(tmp, start, tr + i - start);
 296     tmp[tr + i - start] = '\0';
 297     r = make_realm(tmp);
 298     if(r == NULL){
 299         free_realms(*realms);
 300         return krb5_enomem(context);
 301     }
 302     *realms = append_realm(*realms, r);
 303
 304     return 0;
 305 }
 306
 307
 308 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 309 krb5_domain_x500_decode(krb5_context context,
 310                         krb5_data tr, char ***realms, unsigned int *num_realms,
 311                         const char *client_realm, const char *server_realm)
 312 {
 313     struct tr_realm *r = NULL;
 314     struct tr_realm *p, **q;
 315     int ret;
 316
 317     if(tr.length == 0) {
 318         *realms = NULL;
 319         *num_realms = 0;
 320         return 0;
 321     }
 322
 323     /* split string in components */
 324     ret = decode_realms(context, tr.data, tr.length, &r);
 325     if(ret)
 326         return ret;
 327
 328     /* apply prefix rule */
 329     ret = expand_realms(context, r, client_realm);
 330     if(ret)
 331         return ret;
 332
 333     ret = make_paths(context, r, client_realm, server_realm);
 334     if(ret)
 335         return ret;
 336
 337     /* remove empty components and count realms */
 338     *num_realms = 0;
 339     for(q = &r; *q; ){
 340         if((*q)->realm[0] == '\0'){
 341             p = *q;
 342             *q = (*q)->next;
 343             free(p->realm);
 344             free(p);
 345         }else{
 346             q = &(*q)->next;
 347             (*num_realms)++;
 348         }
 349     }
 350     if (*num_realms + 1 > UINT_MAX/sizeof(**realms))
 351         return ERANGE;
 352
 353     {
 354         char **R;
 355         R = malloc((*num_realms + 1) * sizeof(*R));
 356         if (R == NULL)
 357             return krb5_enomem(context);
 358         *realms = R;
 359         while(r){
 360             *R++ = r->realm;
 361             p = r->next;
 362             free(r);
 363             r = p;
 364         }
 365     }
 366     return 0;
 367 }
 368
 369 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 370 krb5_domain_x500_encode(char **realms, unsigned int num_realms,
 371                         krb5_data *encoding)
 372 {
 373     char *s = NULL;
 374     int len = 0;
 375     unsigned int i;
 376     krb5_data_zero(encoding);
 377     if (num_realms == 0)
 378         return 0;
 379     for(i = 0; i < num_realms; i++){
 380         len += strlen(realms[i]);
 381         if(realms[i][0] == '/')
 382             len++;
 383     }
 384     len += num_realms - 1;
 385     s = malloc(len + 1);
 386     if (s == NULL)
 387         return ENOMEM;
 388     *s = '\0';
 389     for(i = 0; i < num_realms; i++){
 390         if(i)
 391             strlcat(s, ",", len + 1);
 392         if(realms[i][0] == '/')
 393             strlcat(s, " ", len + 1);
 394         strlcat(s, realms[i], len + 1);
 395     }
 396     encoding->data = s;
 397     encoding->length = strlen(s);
 398     return 0;
 399 }
 400
 401 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 402 _krb5_free_capath(krb5_context context, char **capath)
 403 {
 404     char **s;
 405
 406     for (s = capath; s && *s; ++s)
 407         free(*s);
 408     free(capath);
 409 }
 410
 411 struct hier_iter {
 412     const char *local_realm;
 413     const char *server_realm;
 414     const char *lr;     /* Pointer into tail of local realm */
 415     const char *sr;     /* Pointer into tail of server realm */
 416     size_t llen;        /* Length of local_realm */
 417     size_t slen;        /* Length of server_realm */
 418     size_t len;         /* Length of common suffix */
 419     size_t num;         /* Path element count */
 420 };
 421
 422 /*
 423  * Step up from local_realm to common suffix, or else down to server_realm.
 424  */
 425 static const char *
 426 hier_next(struct hier_iter *state)
 427 {
 428     const char *lr = state->lr;
 429     const char *sr = state->sr;
 430     const char *lsuffix = state->local_realm + state->llen - state->len;
 431     const char *server_realm = state->server_realm;
 432
 433     if (lr != NULL) {
 434         while (lr < lsuffix)
 435             if (*lr++ == '.')
 436                 return state->lr = lr;
 437         state->lr = NULL;
 438     }
 439     if (sr != NULL) {
 440         while (--sr >= server_realm)
 441             if (sr == server_realm || sr[-1] == '.')
 442                 return state->sr = sr;
 443         state->sr = NULL;
 444     }
 445     return NULL;
 446 }
 447
 448 static void
 449 hier_init(struct hier_iter *state, const char *local_realm, const char *server_realm)
 450 {
 451     size_t llen;
 452     size_t slen;
 453     size_t len = 0;
 454     const char *lr;
 455     const char *sr;
 456
 457     state->local_realm = local_realm;
 458     state->server_realm = server_realm;
 459     state->llen = llen = strlen(local_realm);
 460     state->slen = slen = strlen(server_realm);
 461     state->len = 0;
 462     state->num = 0;
 463
 464     if (slen == 0 || llen == 0)
 465         return;
 466
 467     /* Find first difference from the back */
 468     for (lr = local_realm + llen, sr = server_realm + slen;
 469          lr != local_realm && sr != server_realm;
 470          --lr, --sr) {
 471         if (lr[-1] != sr[-1])
 472             break;
 473         if (lr[-1] == '.')
 474             len = llen - (lr - local_realm);
 475     }
 476
 477     /* Nothing in common? */
 478     if (*lr == '\0')
 479         return;
 480
 481     /* Everything in common? */
 482     if (llen == slen && lr == local_realm)
 483         return;
 484
 485     /* Is one realm is a suffix of the other? */
 486     if ((llen < slen && lr == local_realm && sr[-1] == '.') ||
 487         (llen > slen && sr == server_realm && lr[-1] == '.'))
 488         len = llen - (lr - local_realm);
 489
 490     state->len = len;
 491     /* `lr` starts at local realm and walks up the tree to common suffix */
 492     state->lr = local_realm;
 493     /* `sr` starts at common suffix in server realm and walks down the tree */
 494     state->sr = server_realm + slen - len;
 495
 496     /* Count elements and reset */
 497     while (hier_next(state) != NULL)
 498         ++state->num;
 499     state->lr = local_realm;
 500     state->sr = server_realm + slen - len;
 501 }
 502
 503 /*
 504  * Find a referral path from client_realm to server_realm via local_realm.
 505  * Either via [capaths] or hierarchicaly.
 506  */
 507 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 508 _krb5_find_capath(krb5_context context,
 509                   const char *client_realm,
 510                   const char *local_realm,
 511                   const char *server_realm,
 512                   krb5_boolean use_hierarchical,
 513                   char ***rpath,
 514                   size_t *npath)
 515 {
 516     char **confpath;
 517     char **capath;
 518     struct hier_iter hier_state;
 519     char **rp;
 520     const char *r;
 521
 522     *rpath = NULL;
 523     *npath = 0;
 524
 525     confpath = krb5_config_get_strings(context, NULL, "capaths",
 526                                        client_realm, server_realm, NULL);
 527     if (confpath == NULL)
 528         confpath = krb5_config_get_strings(context, NULL, "capaths",
 529                                            local_realm, server_realm, NULL);
 530     /*
 531      * With a [capaths] setting from the client to the server we look for our
 532      * own realm in the list.  If our own realm is not present, we return the
 533      * full list.  Otherwise, we return our realm's successors, or possibly
 534      * NULL.  Ignoring a [capaths] settings risks loops plus would violate
 535      * explicit policy and the principle of least surpise.
 536      */
 537     if (confpath != NULL) {
 538         char **start = confpath;
 539         size_t i;
 540         size_t n;
 541
 542         for (rp = start; *rp; rp++)
 543             if (strcmp(*rp, local_realm) == 0)
 544                 start = rp+1;
 545         n = rp - start;
 546
 547         if (n == 0) {
 548             krb5_config_free_strings(confpath);
 549             return 0;
 550         }
 551
 552         capath = calloc(n + 1, sizeof(*capath));
 553         if (capath == NULL) {
 554             krb5_config_free_strings(confpath);
 555             return krb5_enomem(context);
 556         }
 557
 558         for (i = 0, rp = start; *rp; rp++) {
 559             if ((capath[i++] = strdup(*rp)) == NULL) {
 560                 _krb5_free_capath(context, capath);
 561                 krb5_config_free_strings(confpath);
 562                 return krb5_enomem(context);
 563             }
 564         }
 565         krb5_config_free_strings(confpath);
 566         capath[i] = NULL;
 567         *rpath = capath;
 568         *npath = n;
 569         return 0;
 570     }
 571
 572     /* The use_hierarchical flag makes hierarchical path lookup unconditional */
 573     if (! use_hierarchical &&
 574         ! krb5_config_get_bool_default(context, NULL, TRUE, "libdefaults",
 575                                        "allow_hierarchical_capaths", NULL))
 576         return 0;
 577
 578     /*
 579      * When validating transit paths, local_realm == client_realm.  Otherwise,
 580      * with hierarchical referrals, they may differ, and we may be building a
 581      * path forward from our own realm!
 582      */
 583     hier_init(&hier_state, local_realm, server_realm);
 584     if (hier_state.num == 0)
 585         return 0;
 586
 587     rp = capath = calloc(hier_state.num + 1, sizeof(*capath));
 588     if (capath == NULL)
 589         return krb5_enomem(context);
 590     while ((r = hier_next(&hier_state)) != NULL) {
 591         if ((*rp++ = strdup(r)) == NULL) {
 592             _krb5_free_capath(context, capath);
 593             return krb5_enomem(context);
 594         }
 595     }
 596
 597     *rp = NULL;
 598     *rpath = capath;
 599     *npath = hier_state.num;
 600     return 0;
 601 }
 602
 603 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 604 krb5_check_transited(krb5_context context,
 605                      krb5_const_realm client_realm,
 606                      krb5_const_realm server_realm,
 607                      krb5_realm *realms,
 608                      unsigned int num_realms,
 609                      int *bad_realm)
 610 {
 611     krb5_error_code ret = 0;
 612     char **capath = NULL;
 613     size_t num_capath = 0;
 614     size_t i = 0;
 615     size_t j = 0;
 616
 617     /* In transit checks hierarchical capaths are optional */
 618     ret = _krb5_find_capath(context, client_realm, client_realm, server_realm,
 619                             FALSE, &capath, &num_capath);
 620     if (ret)
 621         return ret;
 622
 623     for (i = 0; i < num_realms; i++) {
 624         for (j = 0; j < num_capath; ++j) {
 625             if (strcmp(realms[i], capath[j]) == 0)
 626                 break;
 627         }
 628         if (j == num_capath) {
 629             _krb5_free_capath(context, capath);
 630             krb5_set_error_message (context, KRB5KRB_AP_ERR_ILL_CR_TKT,
 631                                     N_("no transit allowed "
 632                                        "through realm %s from %s to %s", ""),
 633                                        realms[i], client_realm, server_realm);
 634             if (bad_realm)
 635                 *bad_realm = i;
 636             return KRB5KRB_AP_ERR_ILL_CR_TKT;
 637         }
 638     }
 639
 640     _krb5_free_capath(context, capath);
 641     return 0;
 642 }
 643
 644 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 645 krb5_check_transited_realms(krb5_context context,
 646                             const char *const *realms,
 647                             unsigned int num_realms,
 648                             int *bad_realm)
 649 {
 650     size_t i;
 651     int ret = 0;
 652     char **bad_realms = krb5_config_get_strings(context, NULL,
 653                                                 "libdefaults",
 654                                                 "transited_realms_reject",
 655                                                 NULL);
 656     if(bad_realms == NULL)
 657         return 0;
 658
 659     for(i = 0; i < num_realms; i++) {
 660         char **p;
 661         for(p = bad_realms; *p; p++)
 662             if(strcmp(*p, realms[i]) == 0) {
 663                 ret = KRB5KRB_AP_ERR_ILL_CR_TKT;
 664                 krb5_set_error_message (context, ret,
 665                                         N_("no transit allowed "
 666                                            "through realm %s", ""),
 667                                         *p);
 668                 if(bad_realm)
 669                     *bad_realm = i;
 670                 break;
 671             }
 672     }
 673     krb5_config_free_strings(bad_realms);
 674     return ret;
 675 }
 676
 677 #if 0
 678 int
 679 main(int argc, char **argv)
 680 {
 681     krb5_data x;
 682     char **r;
 683     int num, i;
 684     x.data = argv[1];
 685     x.length = strlen(x.data);
 686     if(domain_expand(x, &r, &num, argv[2], argv[3]))
 687         exit(1);
 688     for(i = 0; i < num; i++)
 689         printf("%s\n", r[i]);
 690     return 0;
 691 }
 692 #endif