lib/gssapi/krb5/8003.c

   1 /*
   2  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "gssapi_locl.h"
  35
  36 RCSID("$Id$");
  37
  38 static krb5_error_code
  39 encode_om_uint32(OM_uint32 n, u_char *p)
  40 {
  41   p[0] = (n >> 0)  & 0xFF;
  42   p[1] = (n >> 8)  & 0xFF;
  43   p[2] = (n >> 16) & 0xFF;
  44   p[3] = (n >> 24) & 0xFF;
  45   return 0;
  46 }
  47
  48 static krb5_error_code
  49 decode_om_uint32(u_char *p, OM_uint32 *n)
  50 {
  51     *n = (p[0] << 0) | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
  52     return 0;
  53 }
  54
  55 static krb5_error_code
  56 hash_input_chan_bindings (const gss_channel_bindings_t b,
  57                           u_char *p)
  58 {
  59   u_char num[4];
  60   MD5_CTX md5;
  61
  62   MD5_Init(&md5);
  63   encode_om_uint32 (b->initiator_addrtype, num);
  64   MD5_Update (&md5, num, sizeof(num));
  65   encode_om_uint32 (b->initiator_address.length, num);
  66   MD5_Update (&md5, num, sizeof(num));
  67   if (b->initiator_address.length)
  68     MD5_Update (&md5,
  69                 b->initiator_address.value,
  70                 b->initiator_address.length);
  71   encode_om_uint32 (b->acceptor_addrtype, num);
  72   MD5_Update (&md5, num, sizeof(num));
  73   encode_om_uint32 (b->acceptor_address.length, num);
  74   MD5_Update (&md5, num, sizeof(num));
  75   if (b->acceptor_address.length)
  76     MD5_Update (&md5,
  77                 b->acceptor_address.value,
  78                 b->acceptor_address.length);
  79   encode_om_uint32 (b->application_data.length, num);
  80   MD5_Update (&md5, num, sizeof(num));
  81   if (b->application_data.length)
  82     MD5_Update (&md5,
  83                 b->application_data.value,
  84                 b->application_data.length);
  85   MD5_Final (p, &md5);
  86   return 0;
  87 }
  88
  89 krb5_error_code
  90 gssapi_krb5_create_8003_checksum (
  91                       const gss_channel_bindings_t input_chan_bindings,
  92                       OM_uint32 flags,
  93                       krb5_data *fwd_data,
  94                       Checksum *result)
  95 {
  96   u_char *p;
  97
  98   /*
  99    * see rfc1964 (section 1.1.1 (Initial Token), and the checksum value
 100    * field's format)
 101    */
 102   result->cksumtype = 0x8003;
 103   if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG))
 104     result->checksum.length = 24 + 4 + fwd_data->length;
 105   else
 106     result->checksum.length = 24;
 107   result->checksum.data   = malloc (result->checksum.length);
 108   if (result->checksum.data == NULL)
 109     return ENOMEM;
 110
 111   p = result->checksum.data;
 112   encode_om_uint32 (16, p);
 113   p += 4;
 114   if (input_chan_bindings == GSS_C_NO_CHANNEL_BINDINGS) {
 115     memset (p, 0, 16);
 116   } else {
 117     hash_input_chan_bindings (input_chan_bindings, p);
 118   }
 119   p += 16;
 120   encode_om_uint32 (flags, p);
 121   p += 4;
 122
 123   if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG)) {
 124 #if 0
 125      u_char *tmp;
 126
 127      result->checksum.length = 28 + fwd_data->length;
 128      tmp = realloc(result->checksum.data, result->checksum.length);
 129      if (tmp == NULL)
 130         return ENOMEM;
 131      result->checksum.data = tmp;
 132
 133      p = (u_char*)result->checksum.data + 24;
 134 #endif
 135      *p++ = (1 >> 0) & 0xFF;                   /* DlgOpt */ /* == 1 */
 136      *p++ = (1 >> 8) & 0xFF;                   /* DlgOpt */ /* == 0 */
 137      *p++ = (fwd_data->length >> 0) & 0xFF;    /* Dlgth  */
 138      *p++ = (fwd_data->length >> 8) & 0xFF;    /* Dlgth  */
 139      memcpy(p, (unsigned char *) fwd_data->data, fwd_data->length);
 140
 141      p += fwd_data->length;
 142
 143   if (p - (u_char *)result->checksum.data != result->checksum.length)
 144         abort();
 145   }
 146
 147   return 0;
 148 }
 149
 150 krb5_error_code
 151 gssapi_krb5_verify_8003_checksum(
 152                       const gss_channel_bindings_t input_chan_bindings,
 153                       Checksum *cksum,
 154                       OM_uint32 *flags,
 155                       krb5_data *fwd_data)
 156 {
 157     unsigned char hash[16];
 158     unsigned char *p;
 159     OM_uint32 length;
 160     int DlgOpt;
 161
 162     /* XXX should handle checksums > 24 bytes */
 163     if(cksum->cksumtype != 0x8003)
 164         return GSS_S_BAD_BINDINGS;
 165
 166     p = cksum->checksum.data;
 167     decode_om_uint32(p, &length);
 168     if(length != sizeof(hash))
 169         return GSS_S_FAILURE;
 170
 171     p += 4;
 172
 173     if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS) {
 174         if(hash_input_chan_bindings(input_chan_bindings, hash) != 0)
 175             return GSS_S_FAILURE;
 176         if(memcmp(hash, p, sizeof(hash)) != 0)
 177             return GSS_S_FAILURE;
 178     }
 179
 180     p += sizeof(hash);
 181
 182     decode_om_uint32(p, flags);
 183
 184     if (cksum->checksum.length > 24 && (*flags & GSS_C_DELEG_FLAG)) {
 185
 186       p += 4;
 187
 188       DlgOpt = (p[0] << 0) | (p[1] << 8 );
 189       if (DlgOpt != 1)
 190          return GSS_S_BAD_BINDINGS;
 191
 192       p += 2;
 193       fwd_data->length = (p[0] << 0) | (p[1] << 8);
 194       fwd_data->data = malloc(fwd_data->length);
 195       if (fwd_data->data == NULL)
 196          return ENOMEM;
 197
 198       p += 2;
 199       memcpy(fwd_data->data, p, fwd_data->length);
 200     }
 201
 202     return 0;
 203 }