lib/krb5/rd_cred.c

   1 /*
   2  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include <krb5_locl.h>
  35
  36 RCSID("$Id$");
  37
  38 static krb5_error_code
  39 compare_addrs(krb5_context context,
  40               krb5_address *a,
  41               krb5_address *b,
  42               const char *message)
  43 {
  44     char a_str[64], b_str[64];
  45     size_t len;
  46
  47     if(krb5_address_compare (context, a, b))
  48         return 0;
  49
  50     krb5_print_address (a, a_str, sizeof(a_str), &len);
  51     krb5_print_address (b, b_str, sizeof(b_str), &len);
  52     krb5_set_error_string(context, "%s: %s != %s", message, b_str, a_str);
  53     return KRB5KRB_AP_ERR_BADADDR;
  54 }
  55
  56 krb5_error_code KRB5_LIB_FUNCTION
  57 krb5_rd_cred(krb5_context context,
  58              krb5_auth_context auth_context,
  59              krb5_data *in_data,
  60              krb5_creds ***ret_creds,
  61              krb5_replay_data *outdata)
  62 {
  63     krb5_error_code ret;
  64     size_t len;
  65     KRB_CRED cred;
  66     EncKrbCredPart enc_krb_cred_part;
  67     krb5_data enc_krb_cred_part_data;
  68     krb5_crypto crypto;
  69     int i;
  70
  71     memset(&enc_krb_cred_part, 0, sizeof(enc_krb_cred_part));
  72
  73     if ((auth_context->flags &
  74          (KRB5_AUTH_CONTEXT_RET_TIME | KRB5_AUTH_CONTEXT_RET_SEQUENCE)) &&
  75         outdata == NULL)
  76         return KRB5_RC_REQUIRED; /* XXX better error, MIT returns this */
  77
  78     *ret_creds = NULL;
  79
  80     ret = decode_KRB_CRED(in_data->data, in_data->length,
  81                           &cred, &len);
  82     if(ret)
  83         return ret;
  84
  85     if (cred.pvno != 5) {
  86         ret = KRB5KRB_AP_ERR_BADVERSION;
  87         krb5_clear_error_string (context);
  88         goto out;
  89     }
  90
  91     if (cred.msg_type != krb_cred) {
  92         ret = KRB5KRB_AP_ERR_MSG_TYPE;
  93         krb5_clear_error_string (context);
  94         goto out;
  95     }
  96
  97     if (cred.enc_part.etype == ETYPE_NULL) {
  98         /* DK: MIT GSS-API Compatibility */
  99         enc_krb_cred_part_data.length = cred.enc_part.cipher.length;
 100         enc_krb_cred_part_data.data   = cred.enc_part.cipher.data;
 101     } else {
 102         /* Try both subkey and session key.
 103          *
 104          * RFC2140 claims we should use the session key, but Heimdal
 105          * before 0.8 used the remote subkey if it was send in the
 106          * auth_context.
 107          */
 108
 109         if (auth_context->remote_subkey) {
 110             ret = krb5_crypto_init(context, auth_context->remote_subkey,
 111                                    0, &crypto);
 112             if (ret)
 113                 goto out;
 114
 115             ret = krb5_decrypt_EncryptedData(context,
 116                                              crypto,
 117                                              KRB5_KU_KRB_CRED,
 118                                              &cred.enc_part,
 119                                              &enc_krb_cred_part_data);
 120
 121             krb5_crypto_destroy(context, crypto);
 122         }
 123
 124         /*
 125          * If there was not subkey, or we failed using subkey,
 126          * retry using the session key
 127          */
 128         if (auth_context->remote_subkey == NULL || ret == KRB5KRB_AP_ERR_BAD_INTEGRITY)
 129         {
 130
 131             ret = krb5_crypto_init(context, auth_context->keyblock,
 132                                    0, &crypto);
 133
 134             if (ret)
 135                 goto out;
 136
 137             ret = krb5_decrypt_EncryptedData(context,
 138                                              crypto,
 139                                              KRB5_KU_KRB_CRED,
 140                                              &cred.enc_part,
 141                                              &enc_krb_cred_part_data);
 142
 143             krb5_crypto_destroy(context, crypto);
 144         }
 145         if (ret)
 146             goto out;
 147     }
 148
 149     ret = krb5_decode_EncKrbCredPart (context,
 150                                       enc_krb_cred_part_data.data,
 151                                       enc_krb_cred_part_data.length,
 152                                       &enc_krb_cred_part,
 153                                       &len);
 154     if (ret)
 155         goto out;
 156
 157     /* check sender address */
 158
 159     if (enc_krb_cred_part.s_address
 160         && auth_context->remote_address
 161         && auth_context->remote_port) {
 162         krb5_address *a;
 163
 164         ret = krb5_make_addrport (context, &a,
 165                                   auth_context->remote_address,
 166                                   auth_context->remote_port);
 167         if (ret)
 168             goto out;
 169
 170
 171         ret = compare_addrs(context, a, enc_krb_cred_part.s_address,
 172                             "sender address is wrong in received creds");
 173         krb5_free_address(context, a);
 174         free(a);
 175         if(ret)
 176             goto out;
 177     }
 178
 179     /* check receiver address */
 180
 181     if (enc_krb_cred_part.r_address
 182         && auth_context->local_address) {
 183         if(auth_context->local_port &&
 184            enc_krb_cred_part.r_address->addr_type == KRB5_ADDRESS_ADDRPORT) {
 185             krb5_address *a;
 186             ret = krb5_make_addrport (context, &a,
 187                                       auth_context->local_address,
 188                                       auth_context->local_port);
 189             if (ret)
 190                 goto out;
 191
 192             ret = compare_addrs(context, a, enc_krb_cred_part.r_address,
 193                                 "receiver address is wrong in received creds");
 194             krb5_free_address(context, a);
 195             free(a);
 196             if(ret)
 197                 goto out;
 198         } else {
 199             ret = compare_addrs(context, auth_context->local_address,
 200                                 enc_krb_cred_part.r_address,
 201                                 "receiver address is wrong in received creds");
 202             if(ret)
 203                 goto out;
 204         }
 205     }
 206
 207     /* check timestamp */
 208     if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_TIME) {
 209         krb5_timestamp sec;
 210
 211         krb5_timeofday (context, &sec);
 212
 213         if (enc_krb_cred_part.timestamp == NULL ||
 214             enc_krb_cred_part.usec      == NULL ||
 215             abs(*enc_krb_cred_part.timestamp - sec)
 216             > context->max_skew) {
 217             krb5_clear_error_string (context);
 218             ret = KRB5KRB_AP_ERR_SKEW;
 219             goto out;
 220         }
 221     }
 222
 223     if ((auth_context->flags &
 224          (KRB5_AUTH_CONTEXT_RET_TIME | KRB5_AUTH_CONTEXT_RET_SEQUENCE))) {
 225         /* if these fields are not present in the cred-part, silently
 226            return zero */
 227         memset(outdata, 0, sizeof(*outdata));
 228         if(enc_krb_cred_part.timestamp)
 229             outdata->timestamp = *enc_krb_cred_part.timestamp;
 230         if(enc_krb_cred_part.usec)
 231             outdata->usec = *enc_krb_cred_part.usec;
 232         if(enc_krb_cred_part.nonce)
 233             outdata->seq = *enc_krb_cred_part.nonce;
 234     }
 235
 236     /* Convert to NULL terminated list of creds */
 237
 238     *ret_creds = calloc(enc_krb_cred_part.ticket_info.len + 1,
 239                         sizeof(**ret_creds));
 240
 241     if (*ret_creds == NULL) {
 242         ret = ENOMEM;
 243         krb5_set_error_string (context, "malloc: out of memory");
 244         goto out;
 245     }
 246
 247     for (i = 0; i < enc_krb_cred_part.ticket_info.len; ++i) {
 248         KrbCredInfo *kci = &enc_krb_cred_part.ticket_info.val[i];
 249         krb5_creds *creds;
 250         size_t len;
 251
 252         creds = calloc(1, sizeof(*creds));
 253         if(creds == NULL) {
 254             ret = ENOMEM;
 255             krb5_set_error_string (context, "malloc: out of memory");
 256             goto out;
 257         }
 258
 259         ASN1_MALLOC_ENCODE(Ticket, creds->ticket.data, creds->ticket.length,
 260                            &cred.tickets.val[i], &len, ret);
 261         if (ret)
 262             goto out;
 263         if(creds->ticket.length != len)
 264             krb5_abortx(context, "internal error in ASN.1 encoder");
 265         copy_EncryptionKey (&kci->key, &creds->session);
 266         if (kci->prealm && kci->pname)
 267             _krb5_principalname2krb5_principal (&creds->client,
 268                                                 *kci->pname,
 269                                                 *kci->prealm);
 270         if (kci->flags)
 271             creds->flags.b = *kci->flags;
 272         if (kci->authtime)
 273             creds->times.authtime = *kci->authtime;
 274         if (kci->starttime)
 275             creds->times.starttime = *kci->starttime;
 276         if (kci->endtime)
 277             creds->times.endtime = *kci->endtime;
 278         if (kci->renew_till)
 279             creds->times.renew_till = *kci->renew_till;
 280         if (kci->srealm && kci->sname)
 281             _krb5_principalname2krb5_principal (&creds->server,
 282                                                 *kci->sname,
 283                                                 *kci->srealm);
 284         if (kci->caddr)
 285             krb5_copy_addresses (context,
 286                                  kci->caddr,
 287                                  &creds->addresses);
 288
 289         (*ret_creds)[i] = creds;
 290
 291     }
 292     (*ret_creds)[i] = NULL;
 293
 294     free_KRB_CRED (&cred);
 295     free_EncKrbCredPart(&enc_krb_cred_part);
 296
 297     return 0;
 298
 299   out:
 300     free_EncKrbCredPart(&enc_krb_cred_part);
 301     free_KRB_CRED (&cred);
 302     if(*ret_creds) {
 303         for(i = 0; (*ret_creds)[i]; i++)
 304             krb5_free_creds(context, (*ret_creds)[i]);
 305         free(*ret_creds);
 306     }
 307     return ret;
 308 }
 309
 310 krb5_error_code KRB5_LIB_FUNCTION
 311 krb5_rd_cred2 (krb5_context      context,
 312                krb5_auth_context auth_context,
 313                krb5_ccache       ccache,
 314                krb5_data         *in_data)
 315 {
 316     krb5_error_code ret;
 317     krb5_creds **creds;
 318     int i;
 319
 320     ret = krb5_rd_cred(context, auth_context, in_data, &creds, NULL);
 321     if(ret)
 322         return ret;
 323
 324     /* Store the creds in the ccache */
 325
 326     for(i = 0; creds && creds[i]; i++) {
 327         krb5_cc_store_cred(context, ccache, creds[i]);
 328         krb5_free_creds(context, creds[i]);
 329     }
 330     free(creds);
 331     return 0;
 332 }