sunrpc/svcauth_des.c

   1 /*
   2  * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
   3  * unrestricted use provided that this legend is included on all tape
   4  * media and as a part of the software program in whole or part.  Users
   5  * may copy or modify Sun RPC without charge, but are not authorized
   6  * to license or distribute it to anyone else except as part of a product or
   7  * program developed by the user.
   8  *
   9  * SUN RPC IS PROVIDED AS IS WITH NO WARRANTIES OF ANY KIND INCLUDING THE
  10  * WARRANTIES OF DESIGN, MERCHANTIBILITY AND FITNESS FOR A PARTICULAR
  11  * PURPOSE, OR ARISING FROM A COURSE OF DEALING, USAGE OR TRADE PRACTICE.
  12  *
  13  * Sun RPC is provided with no support and without any obligation on the
  14  * part of Sun Microsystems, Inc. to assist in its use, correction,
  15  * modification or enhancement.
  16  *
  17  * SUN MICROSYSTEMS, INC. SHALL HAVE NO LIABILITY WITH RESPECT TO THE
  18  * INFRINGEMENT OF COPYRIGHTS, TRADE SECRETS OR ANY PATENTS BY SUN RPC
  19  * OR ANY PART THEREOF.
  20  *
  21  * In no event will Sun Microsystems, Inc. be liable for any lost revenue
  22  * or profits or other special, indirect and consequential damages, even if
  23  * Sun has been advised of the possibility of such damages.
  24  *
  25  * Sun Microsystems, Inc.
  26  * 2550 Garcia Avenue
  27  * Mountain View, California  94043
  28  */
  29 /*
  30  * Copyright (c) 1988 by Sun Microsystems, Inc.
  31  */
  32 /*
  33  * svcauth_des.c, server-side des authentication
  34  *
  35  * We insure for the service the following:
  36  * (1) The timestamp microseconds do not exceed 1 million.
  37  * (2) The timestamp plus the window is less than the current time.
  38  * (3) The timestamp is not less than the one previously
  39  *     seen in the current session.
  40  *
  41  * It is up to the server to determine if the window size is
  42  * too small .
  43  *
  44  */
  45
  46 #include <limits.h>
  47 #include <string.h>
  48 #include <sys/param.h>
  49 #include <netinet/in.h>
  50 #include <rpc/rpc.h>
  51 #include <rpc/xdr.h>
  52 #include <rpc/auth.h>
  53 #include <rpc/auth_des.h>
  54 #include <rpc/svc_auth.h>
  55 #include <rpc/svc.h>
  56 #include <rpc/des_crypt.h>
  57
  58 #define debug(msg)              /*printf("svcauth_des: %s\n", msg) */
  59
  60 #define USEC_PER_SEC ((uint32_t) 1000000L)
  61 #define BEFORE(t1, t2) timercmp(t1, t2, <)
  62
  63 /*
  64  * LRU cache of conversation keys and some other useful items.
  65  */
  66 #define AUTHDES_CACHESZ 64
  67 struct cache_entry
  68   {
  69     des_block key;              /* conversation key */
  70     char *rname;                /* client's name */
  71     u_int window;               /* credential lifetime window */
  72     struct rpc_timeval laststamp;       /* detect replays of creds */
  73     char *localcred;            /* generic local credential */
  74   };
  75 #ifdef _RPC_THREAD_SAFE_
  76 #define authdes_cache RPC_THREAD_VARIABLE(authdes_cache_s)
  77 #define authdes_lru RPC_THREAD_VARIABLE(authdes_lru_s)
  78 #else
  79 static struct cache_entry *authdes_cache;
  80 static int *authdes_lru;
  81 #endif
  82
  83 static void cache_init (void) internal_function; /* initialize the cache */
  84 static short cache_spot (des_block *, char *, struct rpc_timeval *)
  85      internal_function;         /* find an entry in the cache */
  86 static void cache_ref (uint32_t sid) internal_function;
  87                                 /* note that sid was ref'd */
  88
  89 static void invalidate (char *cred) internal_function;
  90                                 /* invalidate entry in cache */
  91
  92 /*
  93  * cache statistics
  94  */
  95 struct
  96   {
  97     u_long ncachehits;          /* times cache hit, and is not replay */
  98     u_long ncachereplays;       /* times cache hit, and is replay */
  99     u_long ncachemisses;        /* times cache missed */
 100   }
 101 svcauthdes_stats;
 102
 103 /*
 104  * Service side authenticator for AUTH_DES
 105  */
 106 enum auth_stat
 107 _svcauth_des (register struct svc_req *rqst, register struct rpc_msg *msg)
 108 {
 109   register uint32_t *ixdr;
 110   des_block cryptbuf[2];
 111   register struct authdes_cred *cred;
 112   struct authdes_verf verf;
 113   int status;
 114   register struct cache_entry *entry;
 115   uint32_t sid = 0;
 116   des_block *sessionkey;
 117   des_block ivec;
 118   u_int window;
 119   struct rpc_timeval timestamp;
 120   uint32_t namelen;
 121   struct area
 122     {
 123       struct authdes_cred area_cred;
 124       char area_netname[MAXNETNAMELEN + 1];
 125     }
 126    *area;
 127
 128   if (authdes_cache == NULL)
 129     cache_init ();
 130   if (authdes_cache == NULL) /* No free memory */
 131     return AUTH_FAILED;
 132
 133   area = (struct area *) rqst->rq_clntcred;
 134   cred = (struct authdes_cred *) &area->area_cred;
 135
 136   /*
 137    * Get the credential
 138    */
 139   if (msg->rm_call.cb_cred.oa_length <= 0 ||
 140       msg->rm_call.cb_cred.oa_length > MAX_AUTH_BYTES)
 141     return AUTH_BADCRED;
 142
 143   ixdr = (uint32_t *) msg->rm_call.cb_cred.oa_base;
 144   cred->adc_namekind = IXDR_GET_ENUM (ixdr, enum authdes_namekind);
 145   switch (cred->adc_namekind)
 146     {
 147     case ADN_FULLNAME:
 148       namelen = IXDR_GET_U_INT32 (ixdr);
 149       if (namelen > MAXNETNAMELEN)
 150         {
 151           return AUTH_BADCRED;
 152         }
 153       cred->adc_fullname.name = area->area_netname;
 154       memcpy (cred->adc_fullname.name, (char *) ixdr, namelen);
 155       cred->adc_fullname.name[namelen] = 0;
 156       ixdr += (RNDUP (namelen) / BYTES_PER_XDR_UNIT);
 157       cred->adc_fullname.key.key.high = *ixdr++;
 158       cred->adc_fullname.key.key.low = *ixdr++;
 159       cred->adc_fullname.window = *ixdr++;
 160       break;
 161     case ADN_NICKNAME:
 162       cred->adc_nickname = *ixdr++;
 163       break;
 164     default:
 165       return AUTH_BADCRED;
 166     }
 167
 168   /*
 169    * Get the verifier
 170    */
 171   if (msg->rm_call.cb_verf.oa_length <= 0 ||
 172       msg->rm_call.cb_verf.oa_length > MAX_AUTH_BYTES)
 173     return AUTH_BADCRED;
 174
 175   ixdr = (uint32_t *) msg->rm_call.cb_verf.oa_base;
 176   verf.adv_xtimestamp.key.high = *ixdr++;
 177   verf.adv_xtimestamp.key.low = *ixdr++;
 178   verf.adv_int_u = *ixdr++;
 179
 180   /*
 181    * Get the conversation key
 182    */
 183   if (cred->adc_namekind == ADN_FULLNAME)
 184     {
 185       netobj pkey;
 186       char pkey_data[1024];
 187
 188       sessionkey = &cred->adc_fullname.key;
 189       if (!getpublickey (cred->adc_fullname.name, pkey_data))
 190         {
 191           debug("getpublickey");
 192           return AUTH_BADCRED;
 193         }
 194       pkey.n_bytes = pkey_data;
 195       pkey.n_len = strlen (pkey_data) + 1;
 196       if (key_decryptsession_pk (cred->adc_fullname.name, &pkey,
 197                                  sessionkey) < 0)
 198         {
 199           debug ("decryptsessionkey");
 200           return AUTH_BADCRED;  /* key not found */
 201         }
 202     }
 203   else
 204     {                           /* ADN_NICKNAME */
 205       if (cred->adc_nickname >= AUTHDES_CACHESZ)
 206         {
 207           debug ("bad nickname");
 208           return AUTH_BADCRED;  /* garbled credential */
 209         }
 210       else
 211         sid = cred->adc_nickname;
 212
 213       /* XXX This could be wrong, but else we have a
 214          security problem */
 215       if (authdes_cache[sid].rname == NULL)
 216         return AUTH_BADCRED;
 217       sessionkey = &authdes_cache[sid].key;
 218     }
 219
 220
 221   /*
 222    * Decrypt the timestamp
 223    */
 224   cryptbuf[0] = verf.adv_xtimestamp;
 225   if (cred->adc_namekind == ADN_FULLNAME)
 226     {
 227       cryptbuf[1].key.high = cred->adc_fullname.window;
 228       cryptbuf[1].key.low = verf.adv_winverf;
 229       ivec.key.high = ivec.key.low = 0;
 230       status = cbc_crypt ((char *) sessionkey, (char *) cryptbuf,
 231                           2 * sizeof (des_block), DES_DECRYPT | DES_HW,
 232                           (char *) &ivec);
 233     }
 234   else
 235     status = ecb_crypt ((char *) sessionkey, (char *) cryptbuf,
 236                         sizeof (des_block), DES_DECRYPT | DES_HW);
 237
 238   if (DES_FAILED (status))
 239     {
 240       debug ("decryption failure");
 241       return AUTH_FAILED;       /* system error */
 242     }
 243
 244   /*
 245    * XDR the decrypted timestamp
 246    */
 247   ixdr = (uint32_t *) cryptbuf;
 248   timestamp.tv_sec = IXDR_GET_INT32 (ixdr);
 249   timestamp.tv_usec = IXDR_GET_INT32 (ixdr);
 250
 251   /*
 252    * Check for valid credentials and verifiers.
 253    * They could be invalid because the key was flushed
 254    * out of the cache, and so a new session should begin.
 255    * Be sure and send AUTH_REJECTED{CRED, VERF} if this is the case.
 256    */
 257   {
 258     struct timeval current;
 259     int nick;
 260     u_int winverf;
 261
 262     if (cred->adc_namekind == ADN_FULLNAME)
 263       {
 264         short tmp_spot;
 265
 266         window = IXDR_GET_U_INT32 (ixdr);
 267         winverf = IXDR_GET_U_INT32 (ixdr);
 268         if (winverf != window - 1)
 269           {
 270             debug ("window verifier mismatch");
 271             return AUTH_BADCRED;        /* garbled credential */
 272           }
 273         tmp_spot = cache_spot (sessionkey, cred->adc_fullname.name,
 274                                &timestamp);
 275         if (tmp_spot < 0 || tmp_spot > AUTHDES_CACHESZ)
 276           {
 277             debug ("replayed credential");
 278             return AUTH_REJECTEDCRED;           /* replay */
 279           }
 280         sid = tmp_spot;
 281         nick = 0;
 282       }
 283     else
 284       {                         /* ADN_NICKNAME */
 285         window = authdes_cache[sid].window;
 286         nick = 1;
 287       }
 288
 289     if (timestamp.tv_usec >= USEC_PER_SEC)
 290       {
 291         debug ("invalid usecs");
 292         /* cached out (bad key), or garbled verifier */
 293         return nick ? AUTH_REJECTEDVERF : AUTH_BADVERF;
 294       }
 295     if (nick && BEFORE (&timestamp, &authdes_cache[sid].laststamp))
 296       {
 297         debug ("timestamp before last seen");
 298         return AUTH_REJECTEDVERF;       /* replay */
 299       }
 300     __gettimeofday (&current, (struct timezone *) NULL);
 301     current.tv_sec -= window;   /* allow for expiration */
 302     if (!BEFORE (&current, &timestamp))
 303       {
 304         debug ("timestamp expired");
 305         /* replay, or garbled credential */
 306         return nick ? AUTH_REJECTEDVERF : AUTH_BADCRED;
 307       }
 308   }
 309
 310   /*
 311    * Set up the reply verifier
 312    */
 313   verf.adv_nickname = sid;
 314
 315   /*
 316    * xdr the timestamp before encrypting
 317    */
 318   ixdr = (int32_t *) cryptbuf;
 319   IXDR_PUT_INT32 (ixdr, timestamp.tv_sec - 1);
 320   IXDR_PUT_INT32 (ixdr, timestamp.tv_usec);
 321
 322   /*
 323    * encrypt the timestamp
 324    */
 325   status = ecb_crypt ((char *) sessionkey, (char *) cryptbuf,
 326                       sizeof (des_block), DES_ENCRYPT | DES_HW);
 327   if (DES_FAILED (status))
 328     {
 329       debug ("encryption failure");
 330       return AUTH_FAILED;       /* system error */
 331     }
 332   verf.adv_xtimestamp = cryptbuf[0];
 333
 334   /*
 335    * Serialize the reply verifier, and update rqst
 336    */
 337   ixdr = (uint32_t *) msg->rm_call.cb_verf.oa_base;
 338   *ixdr++ = verf.adv_xtimestamp.key.high;
 339   *ixdr++ = verf.adv_xtimestamp.key.low;
 340   *ixdr++ = verf.adv_int_u;
 341
 342   rqst->rq_xprt->xp_verf.oa_flavor = AUTH_DES;
 343   rqst->rq_xprt->xp_verf.oa_base = msg->rm_call.cb_verf.oa_base;
 344   rqst->rq_xprt->xp_verf.oa_length =
 345     (char *) ixdr - msg->rm_call.cb_verf.oa_base;
 346
 347   /*
 348    * We succeeded, commit the data to the cache now and
 349    * finish cooking the credential.
 350    */
 351   entry = &authdes_cache[sid];
 352   entry->laststamp = timestamp;
 353   cache_ref (sid);
 354   if (cred->adc_namekind == ADN_FULLNAME)
 355     {
 356       size_t full_len;
 357
 358       cred->adc_fullname.window = window;
 359       cred->adc_nickname = sid; /* save nickname */
 360       if (entry->rname != NULL)
 361         mem_free (entry->rname, strlen (entry->rname) + 1);
 362       full_len = strlen (cred->adc_fullname.name) + 1;
 363       entry->rname = mem_alloc ((u_int) full_len);
 364       if (entry->rname != NULL)
 365         memcpy (entry->rname, cred->adc_fullname.name, full_len);
 366       else
 367         {
 368           debug ("out of memory");
 369           return AUTH_FAILED; /* out of memory is bad */
 370         }
 371       entry->key = *sessionkey;
 372       entry->window = window;
 373       invalidate (entry->localcred);    /* mark any cached cred invalid */
 374     }
 375   else
 376     {                           /* ADN_NICKNAME */
 377       /*
 378        * nicknames are cooked into fullnames
 379        */
 380       cred->adc_namekind = ADN_FULLNAME;
 381       cred->adc_fullname.name = entry->rname;
 382       cred->adc_fullname.key = entry->key;
 383       cred->adc_fullname.window = entry->window;
 384     }
 385   return AUTH_OK;               /* we made it! */
 386 }
 387
 388
 389 /*
 390  * Initialize the cache
 391  */
 392 static void
 393 internal_function
 394 cache_init (void)
 395 {
 396   register int i;
 397
 398   authdes_cache = (struct cache_entry *)
 399     mem_alloc (sizeof (struct cache_entry) * AUTHDES_CACHESZ);
 400   if (authdes_cache == NULL)
 401     return;
 402   __bzero ((char *) authdes_cache,
 403            sizeof (struct cache_entry) * AUTHDES_CACHESZ);
 404
 405   authdes_lru = (int *) mem_alloc (sizeof (int) * AUTHDES_CACHESZ);
 406   /*
 407    * Initialize the lru list
 408    */
 409   for (i = 0; i < AUTHDES_CACHESZ; ++i)
 410     authdes_lru[i] = i;
 411 }
 412
 413
 414 /*
 415  * Find the lru victim
 416  */
 417 static short
 418 cache_victim (void)
 419 {
 420   return authdes_lru[AUTHDES_CACHESZ - 1];
 421 }
 422
 423 /*
 424  * Note that sid was referenced
 425  */
 426 static void
 427 internal_function
 428 cache_ref (register uint32_t sid)
 429 {
 430   register int i;
 431   register int curr;
 432   register int prev;
 433
 434   prev = authdes_lru[0];
 435   authdes_lru[0] = sid;
 436   for (i = 1; prev != sid; ++i)
 437     {
 438       curr = authdes_lru[i];
 439       authdes_lru[i] = prev;
 440       prev = curr;
 441     }
 442 }
 443
 444 /*
 445  * Find a spot in the cache for a credential containing
 446  * the items given.  Return -1 if a replay is detected, otherwise
 447  * return the spot in the cache.
 448  */
 449 static short
 450 internal_function
 451 cache_spot (register des_block *key, char *name,
 452             struct rpc_timeval *timestamp)
 453 {
 454   register struct cache_entry *cp;
 455   register int i;
 456   register uint32_t hi;
 457
 458   hi = key->key.high;
 459   for (cp = authdes_cache, i = 0; i < AUTHDES_CACHESZ; ++i, ++cp)
 460     {
 461       if (cp->key.key.high == hi &&
 462           cp->key.key.low == key->key.low &&
 463           cp->rname != NULL &&
 464           memcmp (cp->rname, name, strlen (name) + 1) == 0)
 465         {
 466           if (BEFORE (timestamp, &cp->laststamp))
 467             {
 468               ++svcauthdes_stats.ncachereplays;
 469               return -1;        /* replay */
 470             }
 471           ++svcauthdes_stats.ncachehits;
 472           return i;             /* refresh */
 473         }
 474     }
 475   ++svcauthdes_stats.ncachemisses;
 476   return cache_victim ();       /* new credential */
 477 }
 478
 479 /*
 480  * Local credential handling stuff.
 481  * NOTE: bsd unix dependent.
 482  * Other operating systems should put something else here.
 483  */
 484 #define UNKNOWN         -2      /* grouplen, if cached cred is unknown user */
 485 #define INVALID         -1      /* grouplen, if cache entry is invalid */
 486
 487 struct bsdcred
 488 {
 489   uid_t uid;                    /* cached uid */
 490   gid_t gid;                    /* cached gid */
 491   int grouplen;                 /* length of cached groups */
 492   int grouplen_max;             /* length of allocated cached groups */
 493   gid_t groups[0];              /* cached groups */
 494 };
 495
 496 /*
 497  * Map a des credential into a unix cred.
 498  * We cache the credential here so the application does
 499  * not have to make an rpc call every time to interpret
 500  * the credential.
 501  */
 502 int
 503 authdes_getucred (const struct authdes_cred *adc, uid_t * uid, gid_t * gid,
 504                   short *grouplen, gid_t * groups)
 505 {
 506   unsigned sid;
 507   register int i;
 508   uid_t i_uid;
 509   gid_t i_gid;
 510   int i_grouplen;
 511   struct bsdcred *cred;
 512
 513   sid = adc->adc_nickname;
 514   if (sid >= AUTHDES_CACHESZ)
 515     {
 516       debug ("invalid nickname");
 517       return 0;
 518     }
 519   cred = (struct bsdcred *) authdes_cache[sid].localcred;
 520   if (cred == NULL || cred->grouplen == INVALID)
 521     {
 522       /*
 523        * not in cache: lookup
 524        */
 525       if (!netname2user (adc->adc_fullname.name, &i_uid, &i_gid,
 526                          &i_grouplen, groups))
 527         {
 528           debug ("unknown netname");
 529           if (cred != NULL)
 530             cred->grouplen = UNKNOWN;   /* mark as lookup up, but not found */
 531           return 0;
 532         }
 533
 534       if (cred != NULL && cred->grouplen_max < i_grouplen)
 535         {
 536           /* We already have an allocated data structure.  But it is
 537              too small.  */
 538           free (cred);
 539           authdes_cache[sid].localcred = NULL;
 540           cred = NULL;
 541         }
 542
 543       if (cred == NULL)
 544         {
 545           /* We should allocate room for at least NGROUPS groups.  */
 546           int ngroups_max = MAX (i_grouplen, NGROUPS);
 547
 548           cred = (struct bsdcred *) mem_alloc (sizeof (struct bsdcred)
 549                                                + ngroups_max * sizeof (gid_t));
 550           if (cred == NULL)
 551             return 0;
 552
 553           authdes_cache[sid].localcred = (char *) cred;
 554           cred->grouplen = INVALID;
 555           cred->grouplen_max = ngroups_max;
 556         }
 557
 558       debug ("missed ucred cache");
 559       *uid = cred->uid = i_uid;
 560       *gid = cred->gid = i_gid;
 561       cred->grouplen = i_grouplen;
 562       for (i = i_grouplen - 1; i >= 0; --i)
 563         cred->groups[i] = groups[i];
 564       /* Make sure no too large values are reported.  */
 565       *grouplen = MIN (SHRT_MAX, i_grouplen);
 566       return 1;
 567     }
 568   else if (cred->grouplen == UNKNOWN)
 569     {
 570       /*
 571        * Already lookup up, but no match found
 572        */
 573       return 0;
 574     }
 575
 576   /*
 577    * cached credentials
 578    */
 579   *uid = cred->uid;
 580   *gid = cred->gid;
 581
 582   /* Another stupidity in the interface: *grouplen is of type short.
 583      So we might have to cut the information passed up short.  */
 584   int grouplen_copy = MIN (SHRT_MAX, cred->grouplen);
 585   *grouplen = grouplen_copy;
 586   for (i = grouplen_copy - 1; i >= 0; --i)
 587     groups[i] = cred->groups[i];
 588   return 1;
 589 }
 590
 591 static void
 592 internal_function
 593 invalidate (char *cred)
 594 {
 595   if (cred == NULL)
 596     return;
 597   ((struct bsdcred *) cred)->grouplen = INVALID;
 598 }