sunrpc/svcauth_des.c

   1 #if defined(LIBC_SCCS) && !defined(lint)
   2 static char sccsid[] = "@(#)svcauth_des.c       2.3 89/07/11 4.0 RPCSRC; from 1.15 88/02/08 SMI";
   3 #endif
   4
   5 /*
   6  * Copyright (c) 1988 by Sun Microsystems, Inc.
   7  */
   8
   9 /*
  10  * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
  11  * unrestricted use provided that this legend is included on all tape
  12  * media and as a part of the software program in whole or part.  Users
  13  * may copy or modify Sun RPC without charge, but are not authorized
  14  * to license or distribute it to anyone else except as part of a product or
  15  * program developed by the user.
  16  *
  17  * SUN RPC IS PROVIDED AS IS WITH NO WARRANTIES OF ANY KIND INCLUDING THE
  18  * WARRANTIES OF DESIGN, MERCHANTIBILITY AND FITNESS FOR A PARTICULAR
  19  * PURPOSE, OR ARISING FROM A COURSE OF DEALING, USAGE OR TRADE PRACTICE.
  20  *
  21  * Sun RPC is provided with no support and without any obligation on the
  22  * part of Sun Microsystems, Inc. to assist in its use, correction,
  23  * modification or enhancement.
  24  *
  25  * SUN MICROSYSTEMS, INC. SHALL HAVE NO LIABILITY WITH RESPECT TO THE
  26  * INFRINGEMENT OF COPYRIGHTS, TRADE SECRETS OR ANY PATENTS BY SUN RPC
  27  * OR ANY PART THEREOF.
  28  *
  29  * In no event will Sun Microsystems, Inc. be liable for any lost revenue
  30  * or profits or other special, indirect and consequential damages, even if
  31  * Sun has been advised of the possibility of such damages.
  32  *
  33  * Sun Microsystems, Inc.
  34  * 2550 Garcia Avenue
  35  * Mountain View, California  94043
  36  */
  37
  38 /*
  39  * svcauth_des.c, server-side des authentication
  40  *
  41  * We insure for the service the following:
  42  * (1) The timestamp microseconds do not exceed 1 million.
  43  * (2) The timestamp plus the window is less than the current time.
  44  * (3) The timestamp is not less than the one previously
  45  *     seen in the current session.
  46  *
  47  * It is up to the server to determine if the window size is
  48  * too small .
  49  *
  50  */
  51
  52 #include <string.h>
  53 #include <sys/param.h>
  54 #include <netinet/in.h>
  55 #include <rpc/types.h>
  56 #include <rpc/xdr.h>
  57 #include <rpc/auth.h>
  58 #include <rpc/auth_des.h>
  59 #include <rpc/svc_auth.h>
  60 #include <rpc/svc.h>
  61 #include <rpc/des_crypt.h>
  62
  63 #define debug(msg)              /*printf("svcauth_des: %s\n", msg) */
  64
  65 #define USEC_PER_SEC ((u_long) 1000000L)
  66 #define BEFORE(t1, t2) timercmp(t1, t2, <)
  67
  68 /*
  69  * LRU cache of conversation keys and some other useful items.
  70  */
  71 #define AUTHDES_CACHESZ 64
  72 struct cache_entry
  73   {
  74     des_block key;              /* conversation key */
  75     char *rname;                /* client's name */
  76     u_int window;               /* credential lifetime window */
  77     struct timeval laststamp;   /* detect replays of creds */
  78     char *localcred;            /* generic local credential */
  79   };
  80 static struct cache_entry *authdes_cache /* [AUTHDES_CACHESZ] */ ;
  81 static short *authdes_lru /* [AUTHDES_CACHESZ] */ ;
  82
  83 static void cache_init (void) internal_function; /* initialize the cache */
  84 static short cache_spot (des_block *, char *, struct timeval *)
  85      internal_function;         /* find an entry in the cache */
  86 static void cache_ref (short sid) internal_function;
  87                                 /* note that sid was ref'd */
  88
  89 static void invalidate (char *cred) internal_function;
  90                                 /* invalidate entry in cache */
  91
  92 /*
  93  * cache statistics
  94  */
  95 struct
  96   {
  97     u_long ncachehits;          /* times cache hit, and is not replay */
  98     u_long ncachereplays;       /* times cache hit, and is replay */
  99     u_long ncachemisses;        /* times cache missed */
 100   }
 101 svcauthdes_stats;
 102
 103 /*
 104  * Service side authenticator for AUTH_DES
 105  */
 106 enum auth_stat
 107 _svcauth_des (register struct svc_req *rqst, register struct rpc_msg *msg)
 108 {
 109   register long *ixdr;
 110   des_block cryptbuf[2];
 111   register struct authdes_cred *cred;
 112   struct authdes_verf verf;
 113   int status;
 114   register struct cache_entry *entry;
 115   short sid = 0;
 116   des_block *sessionkey;
 117   des_block ivec;
 118   u_int window;
 119   struct timeval timestamp;
 120   u_long namelen;
 121   struct area
 122     {
 123       struct authdes_cred area_cred;
 124       char area_netname[MAXNETNAMELEN + 1];
 125     }
 126    *area;
 127
 128   if (authdes_cache == NULL)
 129     cache_init ();
 130
 131   area = (struct area *) rqst->rq_clntcred;
 132   cred = (struct authdes_cred *) &area->area_cred;
 133
 134   /*
 135    * Get the credential
 136    */
 137   ixdr = (long *) msg->rm_call.cb_cred.oa_base;
 138   cred->adc_namekind = IXDR_GET_ENUM (ixdr, enum authdes_namekind);
 139   switch (cred->adc_namekind)
 140     {
 141     case ADN_FULLNAME:
 142       namelen = IXDR_GET_U_LONG (ixdr);
 143       if (namelen > MAXNETNAMELEN)
 144         {
 145           return AUTH_BADCRED;
 146         }
 147       cred->adc_fullname.name = area->area_netname;
 148       bcopy ((char *) ixdr, cred->adc_fullname.name,
 149              (u_int) namelen);
 150       cred->adc_fullname.name[namelen] = 0;
 151       ixdr += (RNDUP (namelen) / BYTES_PER_XDR_UNIT);
 152       cred->adc_fullname.key.key.high = (u_long) * ixdr++;
 153       cred->adc_fullname.key.key.low = (u_long) * ixdr++;
 154       cred->adc_fullname.window = (u_long) * ixdr++;
 155       break;
 156     case ADN_NICKNAME:
 157       cred->adc_nickname = (u_long) * ixdr++;
 158       break;
 159     default:
 160       return AUTH_BADCRED;
 161     }
 162
 163   /*
 164    * Get the verifier
 165    */
 166   ixdr = (long *) msg->rm_call.cb_verf.oa_base;
 167   verf.adv_xtimestamp.key.high = (u_long) * ixdr++;
 168   verf.adv_xtimestamp.key.low = (u_long) * ixdr++;
 169   verf.adv_int_u = (u_long) * ixdr++;
 170
 171
 172   /*
 173    * Get the conversation key
 174    */
 175   if (cred->adc_namekind == ADN_FULLNAME)
 176     {
 177       netobj pkey;
 178       char pkey_data[1024];
 179
 180       sessionkey = &cred->adc_fullname.key;
 181       if (!getpublickey (cred->adc_fullname.name, pkey_data))
 182         {
 183           debug("getpublickey");
 184           return AUTH_BADCRED;
 185         }
 186       pkey.n_bytes = pkey_data;
 187       pkey.n_len = strlen (pkey_data) + 1;
 188       if (key_decryptsession_pk (cred->adc_fullname.name, &pkey,
 189                                  sessionkey) < 0)
 190         {
 191           debug ("decryptsessionkey");
 192           return AUTH_BADCRED;  /* key not found */
 193         }
 194     }
 195   else
 196     {                           /* ADN_NICKNAME */
 197       sid = (short) cred->adc_nickname;
 198       if (sid >= AUTHDES_CACHESZ)
 199         {
 200           debug ("bad nickname");
 201           return AUTH_BADCRED;  /* garbled credential */
 202         }
 203       sessionkey = &authdes_cache[sid].key;
 204     }
 205
 206
 207   /*
 208    * Decrypt the timestamp
 209    */
 210   cryptbuf[0] = verf.adv_xtimestamp;
 211   if (cred->adc_namekind == ADN_FULLNAME)
 212     {
 213       cryptbuf[1].key.high = cred->adc_fullname.window;
 214       cryptbuf[1].key.low = verf.adv_winverf;
 215       ivec.key.high = ivec.key.low = 0;
 216       status = cbc_crypt ((char *) sessionkey, (char *) cryptbuf,
 217                           2 * sizeof (des_block), DES_DECRYPT | DES_HW,
 218                           (char *) &ivec);
 219     }
 220   else
 221     {
 222       status = ecb_crypt ((char *) sessionkey, (char *) cryptbuf,
 223                           sizeof (des_block), DES_DECRYPT | DES_HW);
 224     }
 225   if (DES_FAILED (status))
 226     {
 227       debug ("decryption failure");
 228       return AUTH_FAILED;       /* system error */
 229     }
 230
 231   /*
 232    * XDR the decrypted timestamp
 233    */
 234   ixdr = (long *) cryptbuf;
 235   timestamp.tv_sec = IXDR_GET_LONG (ixdr);
 236   timestamp.tv_usec = IXDR_GET_LONG (ixdr);
 237
 238   /*
 239    * Check for valid credentials and verifiers.
 240    * They could be invalid because the key was flushed
 241    * out of the cache, and so a new session should begin.
 242    * Be sure and send AUTH_REJECTED{CRED, VERF} if this is the case.
 243    */
 244   {
 245     struct timeval current;
 246     int nick;
 247     u_int winverf;
 248
 249     if (cred->adc_namekind == ADN_FULLNAME)
 250       {
 251         window = IXDR_GET_U_LONG (ixdr);
 252         winverf = IXDR_GET_U_LONG (ixdr);
 253         if (winverf != window - 1)
 254           {
 255             debug ("window verifier mismatch");
 256             return AUTH_BADCRED;        /* garbled credential */
 257           }
 258         sid = cache_spot (sessionkey, cred->adc_fullname.name,
 259                           &timestamp);
 260         if (sid < 0)
 261           {
 262             debug ("replayed credential");
 263             return AUTH_REJECTEDCRED;           /* replay */
 264           }
 265         nick = 0;
 266       }
 267     else
 268       {                         /* ADN_NICKNAME */
 269         window = authdes_cache[sid].window;
 270         nick = 1;
 271       }
 272
 273     if ((u_long) timestamp.tv_usec >= USEC_PER_SEC)
 274       {
 275         debug ("invalid usecs");
 276         /* cached out (bad key), or garbled verifier */
 277         return nick ? AUTH_REJECTEDVERF : AUTH_BADVERF;
 278       }
 279     if (nick && BEFORE (&timestamp,
 280                         &authdes_cache[sid].laststamp))
 281       {
 282         debug ("timestamp before last seen");
 283         return (AUTH_REJECTEDVERF);     /* replay */
 284       }
 285     __gettimeofday (&current, (struct timezone *) NULL);
 286     current.tv_sec -= window;   /* allow for expiration */
 287     if (!BEFORE (&current, &timestamp))
 288       {
 289         debug ("timestamp expired");
 290         /* replay, or garbled credential */
 291         return nick ? AUTH_REJECTEDVERF : AUTH_BADCRED;
 292       }
 293   }
 294
 295   /*
 296    * Set up the reply verifier
 297    */
 298   verf.adv_nickname = (u_long) sid;
 299
 300   /*
 301    * xdr the timestamp before encrypting
 302    */
 303   ixdr = (long *) cryptbuf;
 304   IXDR_PUT_LONG (ixdr, timestamp.tv_sec - 1);
 305   IXDR_PUT_LONG (ixdr, timestamp.tv_usec);
 306
 307   /*
 308    * encrypt the timestamp
 309    */
 310   status = ecb_crypt ((char *) sessionkey, (char *) cryptbuf,
 311                       sizeof (des_block), DES_ENCRYPT | DES_HW);
 312   if (DES_FAILED (status))
 313     {
 314       debug ("encryption failure");
 315       return AUTH_FAILED;       /* system error */
 316     }
 317   verf.adv_xtimestamp = cryptbuf[0];
 318
 319   /*
 320    * Serialize the reply verifier, and update rqst
 321    */
 322   ixdr = (long *) msg->rm_call.cb_verf.oa_base;
 323   *ixdr++ = (long) verf.adv_xtimestamp.key.high;
 324   *ixdr++ = (long) verf.adv_xtimestamp.key.low;
 325   *ixdr++ = (long) verf.adv_int_u;
 326
 327   rqst->rq_xprt->xp_verf.oa_flavor = AUTH_DES;
 328   rqst->rq_xprt->xp_verf.oa_base = msg->rm_call.cb_verf.oa_base;
 329   rqst->rq_xprt->xp_verf.oa_length =
 330     (char *) ixdr - msg->rm_call.cb_verf.oa_base;
 331
 332   /*
 333    * We succeeded, commit the data to the cache now and
 334    * finish cooking the credential.
 335    */
 336   entry = &authdes_cache[sid];
 337   entry->laststamp = timestamp;
 338   cache_ref (sid);
 339   if (cred->adc_namekind == ADN_FULLNAME)
 340     {
 341       size_t full_len;
 342
 343       cred->adc_fullname.window = window;
 344       cred->adc_nickname = (u_long) sid;        /* save nickname */
 345       if (entry->rname != NULL)
 346         {
 347           mem_free (entry->rname, strlen (entry->rname) + 1);
 348         }
 349       full_len = strlen (cred->adc_fullname.name) + 1;
 350       entry->rname = mem_alloc ((u_int) full_len);
 351       if (entry->rname != NULL)
 352         {
 353           memcpy (entry->rname, cred->adc_fullname.name, full_len);
 354         }
 355       else
 356         {
 357           debug ("out of memory");
 358         }
 359       entry->key = *sessionkey;
 360       entry->window = window;
 361       invalidate (entry->localcred);    /* mark any cached cred invalid */
 362     }
 363   else
 364     {                           /* ADN_NICKNAME */
 365       /*
 366        * nicknames are cooked into fullnames
 367        */
 368       cred->adc_namekind = ADN_FULLNAME;
 369       cred->adc_fullname.name = entry->rname;
 370       cred->adc_fullname.key = entry->key;
 371       cred->adc_fullname.window = entry->window;
 372     }
 373   return AUTH_OK;               /* we made it! */
 374 }
 375
 376
 377 /*
 378  * Initialize the cache
 379  */
 380 static void
 381 internal_function
 382 cache_init (void)
 383 {
 384   register int i;
 385
 386   authdes_cache = (struct cache_entry *)
 387     mem_alloc (sizeof (struct cache_entry) * AUTHDES_CACHESZ);
 388   __bzero ((char *) authdes_cache,
 389            sizeof (struct cache_entry) * AUTHDES_CACHESZ);
 390
 391   authdes_lru = (short *) mem_alloc (sizeof (short) * AUTHDES_CACHESZ);
 392   /*
 393    * Initialize the lru list
 394    */
 395   for (i = 0; i < AUTHDES_CACHESZ; i++)
 396     {
 397       authdes_lru[i] = i;
 398     }
 399 }
 400
 401
 402 /*
 403  * Find the lru victim
 404  */
 405 static short
 406 cache_victim (void)
 407 {
 408   return (authdes_lru[AUTHDES_CACHESZ - 1]);
 409 }
 410
 411 /*
 412  * Note that sid was referenced
 413  */
 414 static void
 415 internal_function
 416 cache_ref (register short sid)
 417 {
 418   register int i;
 419   register short curr;
 420   register short prev;
 421
 422   prev = authdes_lru[0];
 423   authdes_lru[0] = sid;
 424   for (i = 1; prev != sid; i++)
 425     {
 426       curr = authdes_lru[i];
 427       authdes_lru[i] = prev;
 428       prev = curr;
 429     }
 430 }
 431
 432
 433 /*
 434  * Find a spot in the cache for a credential containing
 435  * the items given.  Return -1 if a replay is detected, otherwise
 436  * return the spot in the cache.
 437  */
 438 static short
 439 internal_function
 440 cache_spot (register des_block * key, char *name, struct timeval *timestamp)
 441 {
 442   register struct cache_entry *cp;
 443   register int i;
 444   register u_long hi;
 445
 446   hi = key->key.high;
 447   for (cp = authdes_cache, i = 0; i < AUTHDES_CACHESZ; i++, cp++)
 448     {
 449       if (cp->key.key.high == hi &&
 450           cp->key.key.low == key->key.low &&
 451           cp->rname != NULL &&
 452           memcmp (cp->rname, name, strlen (name) + 1) == 0)
 453         {
 454           if (BEFORE (timestamp, &cp->laststamp))
 455             {
 456               svcauthdes_stats.ncachereplays++;
 457               return -1;        /* replay */
 458             }
 459           svcauthdes_stats.ncachehits++;
 460           return i;             /* refresh */
 461         }
 462     }
 463   svcauthdes_stats.ncachemisses++;
 464   return cache_victim ();       /* new credential */
 465 }
 466
 467
 468 /*
 469  * Local credential handling stuff.
 470  * NOTE: bsd unix dependent.
 471  * Other operating systems should put something else here.
 472  */
 473 #define UNKNOWN         -2      /* grouplen, if cached cred is unknown user */
 474 #define INVALID         -1      /* grouplen, if cache entry is invalid */
 475
 476 struct bsdcred
 477 {
 478   uid_t uid;                    /* cached uid */
 479   gid_t gid;                    /* cached gid */
 480   short grouplen;               /* length of cached groups */
 481   gid_t groups[NGROUPS];        /* cached groups */
 482 };
 483
 484 /*
 485  * Map a des credential into a unix cred.
 486  * We cache the credential here so the application does
 487  * not have to make an rpc call every time to interpret
 488  * the credential.
 489  */
 490 int
 491 authdes_getucred (const struct authdes_cred *adc, uid_t * uid, gid_t * gid,
 492                   short *grouplen, gid_t * groups)
 493 {
 494   unsigned sid;
 495   register int i;
 496   uid_t i_uid;
 497   gid_t i_gid;
 498   int i_grouplen;
 499   struct bsdcred *cred;
 500
 501   sid = adc->adc_nickname;
 502   if (sid >= AUTHDES_CACHESZ)
 503     {
 504       debug ("invalid nickname");
 505       return 0;
 506     }
 507   cred = (struct bsdcred *) authdes_cache[sid].localcred;
 508   if (cred == NULL)
 509     {
 510       cred = (struct bsdcred *) mem_alloc (sizeof (struct bsdcred));
 511       authdes_cache[sid].localcred = (char *) cred;
 512       cred->grouplen = INVALID;
 513     }
 514   if (cred->grouplen == INVALID)
 515     {
 516       /*
 517        * not in cache: lookup
 518        */
 519       if (!netname2user (adc->adc_fullname.name, &i_uid, &i_gid,
 520                          &i_grouplen, groups))
 521         {
 522           debug ("unknown netname");
 523           cred->grouplen = UNKNOWN;     /* mark as lookup up, but not found */
 524           return 0;
 525         }
 526       debug ("missed ucred cache");
 527       *uid = cred->uid = i_uid;
 528       *gid = cred->gid = i_gid;
 529       *grouplen = cred->grouplen = i_grouplen;
 530       for (i = i_grouplen - 1; i >= 0; i--)
 531         {
 532           cred->groups[i] = groups[i];  /* int to short */
 533         }
 534       return 1;
 535     }
 536   else if (cred->grouplen == UNKNOWN)
 537     {
 538       /*
 539        * Already lookup up, but no match found
 540        */
 541       return 0;
 542     }
 543
 544   /*
 545    * cached credentials
 546    */
 547   *uid = cred->uid;
 548   *gid = cred->gid;
 549   *grouplen = cred->grouplen;
 550   for (i = cred->grouplen - 1; i >= 0; i--)
 551     {
 552       groups[i] = cred->groups[i];      /* short to int */
 553     }
 554   return 1;
 555 }
 556
 557 static void
 558 internal_function
 559 invalidate (char *cred)
 560 {
 561   if (cred == NULL)
 562     {
 563       return;
 564     }
 565   ((struct bsdcred *) cred)->grouplen = INVALID;
 566 }