3 * Copyright (c) 1988 by Sun Microsystems, Inc.
5 * @(#)svcauth_des.c 2.3 89/07/11 4.0 RPCSRC; from 1.15 88/02/08 SMI
6 * $FreeBSD: src/lib/libc/rpc/svc_auth_des.c,v 1.9 2002/03/22 23:18:37 obrien Exp $
10 * Copyright (c) 2009, Sun Microsystems, Inc.
11 * All rights reserved.
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions are met:
15 * - Redistributions of source code must retain the above copyright notice,
16 * this list of conditions and the following disclaimer.
17 * - Redistributions in binary form must reproduce the above copyright notice,
18 * this list of conditions and the following disclaimer in the documentation
19 * and/or other materials provided with the distribution.
20 * - Neither the name of Sun Microsystems, Inc. nor the names of its
21 * contributors may be used to endorse or promote products derived
22 * from this software without specific prior written permission.
24 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
25 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34 * POSSIBILITY OF SUCH DAMAGE.
38 * svcauth_des.c, server-side des authentication
40 * We insure for the service the following:
41 * (1) The timestamp microseconds do not exceed 1 million.
42 * (2) The timestamp plus the window is less than the current time.
43 * (3) The timestamp is not less than the one previously
44 * seen in the current session.
46 * It is up to the server to determine if the window size is
51 #include "namespace.h"
52 #include "reentrant.h"
57 #include <rpc/des_crypt.h>
58 #include <sys/param.h>
59 #include <netinet/in.h>
60 #include <rpc/types.h>
63 #include <rpc/auth_des.h>
65 #include <rpc/rpc_msg.h>
66 #include <rpc/svc_auth.h>
67 #include "un-namespace.h"
69 #include "libc_private.h"
71 extern int key_decryptsession_pk(const char *, netobj
*, des_block
*);
73 #define debug(msg) printf("svcauth_des: %s\n", msg)
75 #define USEC_PER_SEC ((u_long) 1000000L)
76 #define BEFORE(t1, t2) timercmp(t1, t2, <)
79 * LRU cache of conversation keys and some other useful items.
81 #define AUTHDES_CACHESZ 64
83 des_block key
; /* conversation key */
84 char *rname
; /* client's name */
85 u_int window
; /* credential lifetime window */
86 struct timeval laststamp
; /* detect replays of creds */
87 char *localcred
; /* generic local credential */
89 static struct cache_entry
*authdes_cache
/* [AUTHDES_CACHESZ] */;
90 static short *authdes_lru
/* [AUTHDES_CACHESZ] */;
92 static void cache_init(void); /* initialize the cache */
93 static short cache_spot(des_block
*, char *, struct timeval
*);
94 /* find an entry in the cache */
95 static void cache_ref(short sid
); /* note that sid was ref'd */
97 static void invalidate(char *); /* invalidate entry in cache */
103 u_long ncachehits
; /* times cache hit, and is not replay */
104 u_long ncachereplays
; /* times cache hit, and is replay */
105 u_long ncachemisses
; /* times cache missed */
109 * Service side authenticator for AUTH_DES
112 _svcauth_des(struct svc_req
*rqst
, struct rpc_msg
*msg
)
116 des_block cryptbuf
[2];
117 struct authdes_cred
*cred
;
118 struct authdes_verf verf
;
120 struct cache_entry
*entry
;
122 des_block
*sessionkey
;
125 struct timeval timestamp
;
128 struct authdes_cred area_cred
;
129 char area_netname
[MAXNETNAMELEN
+1];
132 if (authdes_cache
== NULL
) {
136 area
= (struct area
*)rqst
->rq_clntcred
;
137 cred
= (struct authdes_cred
*)&area
->area_cred
;
142 ixdr
= (long *)msg
->rm_call
.cb_cred
.oa_base
;
143 cred
->adc_namekind
= IXDR_GET_ENUM(ixdr
, enum authdes_namekind
);
144 switch (cred
->adc_namekind
) {
146 namelen
= IXDR_GET_U_LONG(ixdr
);
147 if (namelen
> MAXNETNAMELEN
) {
148 return (AUTH_BADCRED
);
150 cred
->adc_fullname
.name
= area
->area_netname
;
151 bcopy((char *)ixdr
, cred
->adc_fullname
.name
,
153 cred
->adc_fullname
.name
[namelen
] = 0;
154 ixdr
+= (RNDUP(namelen
) / BYTES_PER_XDR_UNIT
);
155 cred
->adc_fullname
.key
.key
.high
= (u_long
)*ixdr
++;
156 cred
->adc_fullname
.key
.key
.low
= (u_long
)*ixdr
++;
157 cred
->adc_fullname
.window
= (u_long
)*ixdr
++;
160 cred
->adc_nickname
= (u_long
)*ixdr
++;
163 return (AUTH_BADCRED
);
169 ixdr
= (long *)msg
->rm_call
.cb_verf
.oa_base
;
170 verf
.adv_xtimestamp
.key
.high
= (u_long
)*ixdr
++;
171 verf
.adv_xtimestamp
.key
.low
= (u_long
)*ixdr
++;
172 verf
.adv_int_u
= (u_long
)*ixdr
++;
176 * Get the conversation key
178 if (cred
->adc_namekind
== ADN_FULLNAME
) {
180 char pkey_data
[1024];
182 sessionkey
= &cred
->adc_fullname
.key
;
183 if (! getpublickey(cred
->adc_fullname
.name
, pkey_data
)) {
184 debug("getpublickey");
185 return(AUTH_BADCRED
);
187 pkey
.n_bytes
= pkey_data
;
188 pkey
.n_len
= strlen(pkey_data
) + 1;
189 if (key_decryptsession_pk(cred
->adc_fullname
.name
, &pkey
,
191 debug("decryptsessionkey");
192 return (AUTH_BADCRED
); /* key not found */
194 } else { /* ADN_NICKNAME */
195 sid
= (short)cred
->adc_nickname
;
196 if (sid
< 0 || sid
>= AUTHDES_CACHESZ
) {
197 debug("bad nickname");
198 return (AUTH_BADCRED
); /* garbled credential */
200 sessionkey
= &authdes_cache
[sid
].key
;
205 * Decrypt the timestamp
207 cryptbuf
[0] = verf
.adv_xtimestamp
;
208 if (cred
->adc_namekind
== ADN_FULLNAME
) {
209 cryptbuf
[1].key
.high
= cred
->adc_fullname
.window
;
210 cryptbuf
[1].key
.low
= verf
.adv_winverf
;
211 ivec
.key
.high
= ivec
.key
.low
= 0;
212 status
= cbc_crypt((char *)sessionkey
, (char *)cryptbuf
,
213 2*sizeof(des_block
), DES_DECRYPT
| DES_HW
,
216 status
= ecb_crypt((char *)sessionkey
, (char *)cryptbuf
,
217 sizeof(des_block
), DES_DECRYPT
| DES_HW
);
219 if (DES_FAILED(status
)) {
220 debug("decryption failure");
221 return (AUTH_FAILED
); /* system error */
225 * XDR the decrypted timestamp
227 ixdr
= (long *)cryptbuf
;
228 timestamp
.tv_sec
= IXDR_GET_LONG(ixdr
);
229 timestamp
.tv_usec
= IXDR_GET_LONG(ixdr
);
232 * Check for valid credentials and verifiers.
233 * They could be invalid because the key was flushed
234 * out of the cache, and so a new session should begin.
235 * Be sure and send AUTH_REJECTED{CRED, VERF} if this is the case.
238 struct timeval current
;
242 if (cred
->adc_namekind
== ADN_FULLNAME
) {
243 window
= IXDR_GET_U_LONG(ixdr
);
244 winverf
= IXDR_GET_U_LONG(ixdr
);
245 if (winverf
!= window
- 1) {
246 debug("window verifier mismatch");
247 return (AUTH_BADCRED
); /* garbled credential */
249 sid
= cache_spot(sessionkey
, cred
->adc_fullname
.name
,
252 debug("replayed credential");
253 return (AUTH_REJECTEDCRED
); /* replay */
256 } else { /* ADN_NICKNAME */
257 window
= authdes_cache
[sid
].window
;
261 if ((u_long
)timestamp
.tv_usec
>= USEC_PER_SEC
) {
262 debug("invalid usecs");
263 /* cached out (bad key), or garbled verifier */
264 return (nick
? AUTH_REJECTEDVERF
: AUTH_BADVERF
);
266 if (nick
&& BEFORE(×tamp
,
267 &authdes_cache
[sid
].laststamp
)) {
268 debug("timestamp before last seen");
269 return (AUTH_REJECTEDVERF
); /* replay */
271 gettimeofday(¤t
, NULL
);
272 current
.tv_sec
-= window
; /* allow for expiration */
273 if (!BEFORE(¤t
, ×tamp
)) {
274 debug("timestamp expired");
275 /* replay, or garbled credential */
276 return (nick
? AUTH_REJECTEDVERF
: AUTH_BADCRED
);
281 * Set up the reply verifier
283 verf
.adv_nickname
= (u_long
)sid
;
286 * xdr the timestamp before encrypting
288 ixdr
= (long *)cryptbuf
;
289 IXDR_PUT_LONG(ixdr
, timestamp
.tv_sec
- 1);
290 IXDR_PUT_LONG(ixdr
, timestamp
.tv_usec
);
293 * encrypt the timestamp
295 status
= ecb_crypt((char *)sessionkey
, (char *)cryptbuf
,
296 sizeof(des_block
), DES_ENCRYPT
| DES_HW
);
297 if (DES_FAILED(status
)) {
298 debug("encryption failure");
299 return (AUTH_FAILED
); /* system error */
301 verf
.adv_xtimestamp
= cryptbuf
[0];
304 * Serialize the reply verifier, and update rqst
306 ixdr
= (long *)msg
->rm_call
.cb_verf
.oa_base
;
307 *ixdr
++ = (long)verf
.adv_xtimestamp
.key
.high
;
308 *ixdr
++ = (long)verf
.adv_xtimestamp
.key
.low
;
309 *ixdr
++ = (long)verf
.adv_int_u
;
311 rqst
->rq_xprt
->xp_verf
.oa_flavor
= AUTH_DES
;
312 rqst
->rq_xprt
->xp_verf
.oa_base
= msg
->rm_call
.cb_verf
.oa_base
;
313 rqst
->rq_xprt
->xp_verf
.oa_length
=
314 (char *)ixdr
- msg
->rm_call
.cb_verf
.oa_base
;
317 * We succeeded, commit the data to the cache now and
318 * finish cooking the credential.
320 entry
= &authdes_cache
[sid
];
321 entry
->laststamp
= timestamp
;
323 if (cred
->adc_namekind
== ADN_FULLNAME
) {
324 cred
->adc_fullname
.window
= window
;
325 cred
->adc_nickname
= (u_long
)sid
; /* save nickname */
326 if (entry
->rname
!= NULL
) {
327 mem_free(entry
->rname
, strlen(entry
->rname
) + 1);
329 entry
->rname
= (char *)mem_alloc((u_int
)strlen(cred
->adc_fullname
.name
)
331 if (entry
->rname
!= NULL
) {
332 strcpy(entry
->rname
, cred
->adc_fullname
.name
);
334 debug("out of memory");
336 entry
->key
= *sessionkey
;
337 entry
->window
= window
;
338 invalidate(entry
->localcred
); /* mark any cached cred invalid */
339 } else { /* ADN_NICKNAME */
341 * nicknames are cooked into fullnames
343 cred
->adc_namekind
= ADN_FULLNAME
;
344 cred
->adc_fullname
.name
= entry
->rname
;
345 cred
->adc_fullname
.key
= entry
->key
;
346 cred
->adc_fullname
.window
= entry
->window
;
348 return (AUTH_OK
); /* we made it!*/
353 * Initialize the cache
360 authdes_cache
= (struct cache_entry
*)
361 mem_alloc(sizeof(struct cache_entry
) * AUTHDES_CACHESZ
);
362 bzero((char *)authdes_cache
,
363 sizeof(struct cache_entry
) * AUTHDES_CACHESZ
);
365 authdes_lru
= (short *)mem_alloc(sizeof(short) * AUTHDES_CACHESZ
);
367 * Initialize the lru list
369 for (i
= 0; i
< AUTHDES_CACHESZ
; i
++) {
376 * Find the lru victim
381 return (authdes_lru
[AUTHDES_CACHESZ
-1]);
385 * Note that sid was referenced
394 prev
= authdes_lru
[0];
395 authdes_lru
[0] = sid
;
396 for (i
= 1; prev
!= sid
; i
++) {
397 curr
= authdes_lru
[i
];
398 authdes_lru
[i
] = prev
;
405 * Find a spot in the cache for a credential containing
406 * the items given. Return -1 if a replay is detected, otherwise
407 * return the spot in the cache.
410 cache_spot(des_block
*key
, char *name
, struct timeval
*timestamp
)
412 struct cache_entry
*cp
;
417 for (cp
= authdes_cache
, i
= 0; i
< AUTHDES_CACHESZ
; i
++, cp
++) {
418 if (cp
->key
.key
.high
== hi
&&
419 cp
->key
.key
.low
== key
->key
.low
&&
421 bcmp(cp
->rname
, name
, strlen(name
) + 1) == 0) {
422 if (BEFORE(timestamp
, &cp
->laststamp
)) {
423 svcauthdes_stats
.ncachereplays
++;
424 return (-1); /* replay */
426 svcauthdes_stats
.ncachehits
++;
427 return (i
); /* refresh */
430 svcauthdes_stats
.ncachemisses
++;
431 return (cache_victim()); /* new credential */
435 #if defined(sun) || defined(vax) || \
436 defined(__FreeBSD__) || defined(__DragonFly__)
438 * Local credential handling stuff.
439 * NOTE: bsd unix dependent.
440 * Other operating systems should put something else here.
442 #define UNKNOWN -2 /* grouplen, if cached cred is unknown user */
443 #define INVALID -1 /* grouplen, if cache entry is invalid */
446 short uid
; /* cached uid */
447 short gid
; /* cached gid */
448 short grouplen
; /* length of cached groups */
449 short groups
[NGROUPS
]; /* cached groups */
453 * Map a des credential into a unix cred.
454 * We cache the credential here so the application does
455 * not have to make an rpc call every time to interpret
459 authdes_getucred(struct authdes_cred
*adc
, uid_t
*uid
, gid_t
*gid
,
460 int *grouplen
, gid_t
*groups
)
467 struct bsdcred
*cred
;
469 sid
= adc
->adc_nickname
;
470 if (sid
>= AUTHDES_CACHESZ
) {
471 debug("invalid nickname");
474 cred
= (struct bsdcred
*)authdes_cache
[sid
].localcred
;
476 cred
= (struct bsdcred
*)mem_alloc(sizeof(struct bsdcred
));
477 authdes_cache
[sid
].localcred
= (char *)cred
;
478 cred
->grouplen
= INVALID
;
480 if (cred
->grouplen
== INVALID
) {
482 * not in cache: lookup
484 if (!netname2user(adc
->adc_fullname
.name
, &i_uid
, &i_gid
,
485 &i_grouplen
, groups
))
487 debug("unknown netname");
488 cred
->grouplen
= UNKNOWN
; /* mark as lookup up, but not found */
491 debug("missed ucred cache");
492 *uid
= cred
->uid
= i_uid
;
493 *gid
= cred
->gid
= i_gid
;
494 *grouplen
= cred
->grouplen
= i_grouplen
;
495 for (i
= i_grouplen
- 1; i
>= 0; i
--) {
496 cred
->groups
[i
] = groups
[i
]; /* int to short */
499 } else if (cred
->grouplen
== UNKNOWN
) {
501 * Already lookup up, but no match found
511 *grouplen
= cred
->grouplen
;
512 for (i
= cred
->grouplen
- 1; i
>= 0; i
--) {
513 groups
[i
] = cred
->groups
[i
]; /* short to int */
519 invalidate(char *cred
)
524 ((struct bsdcred
*)cred
)->grouplen
= INVALID
;