sunrpc/svcauth_des.c

   1 /*
   2  * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
   3  * unrestricted use provided that this legend is included on all tape
   4  * media and as a part of the software program in whole or part.  Users
   5  * may copy or modify Sun RPC without charge, but are not authorized
   6  * to license or distribute it to anyone else except as part of a product or
   7  * program developed by the user.
   8  *
   9  * SUN RPC IS PROVIDED AS IS WITH NO WARRANTIES OF ANY KIND INCLUDING THE
  10  * WARRANTIES OF DESIGN, MERCHANTIBILITY AND FITNESS FOR A PARTICULAR
  11  * PURPOSE, OR ARISING FROM A COURSE OF DEALING, USAGE OR TRADE PRACTICE.
  12  *
  13  * Sun RPC is provided with no support and without any obligation on the
  14  * part of Sun Microsystems, Inc. to assist in its use, correction,
  15  * modification or enhancement.
  16  *
  17  * SUN MICROSYSTEMS, INC. SHALL HAVE NO LIABILITY WITH RESPECT TO THE
  18  * INFRINGEMENT OF COPYRIGHTS, TRADE SECRETS OR ANY PATENTS BY SUN RPC
  19  * OR ANY PART THEREOF.
  20  *
  21  * In no event will Sun Microsystems, Inc. be liable for any lost revenue
  22  * or profits or other special, indirect and consequential damages, even if
  23  * Sun has been advised of the possibility of such damages.
  24  *
  25  * Sun Microsystems, Inc.
  26  * 2550 Garcia Avenue
  27  * Mountain View, California  94043
  28  */
  29 /*
  30  * Copyright (c) 1988 by Sun Microsystems, Inc.
  31  */
  32 /*
  33  * svcauth_des.c, server-side des authentication
  34  *
  35  * We insure for the service the following:
  36  * (1) The timestamp microseconds do not exceed 1 million.
  37  * (2) The timestamp plus the window is less than the current time.
  38  * (3) The timestamp is not less than the one previously
  39  *     seen in the current session.
  40  *
  41  * It is up to the server to determine if the window size is
  42  * too small .
  43  *
  44  */
  45
  46 #include <string.h>
  47 #include <sys/param.h>
  48 #include <netinet/in.h>
  49 #include <rpc/types.h>
  50 #include <rpc/xdr.h>
  51 #include <rpc/auth.h>
  52 #include <rpc/auth_des.h>
  53 #include <rpc/svc_auth.h>
  54 #include <rpc/svc.h>
  55 #include <rpc/des_crypt.h>
  56
  57 #define debug(msg)              /*printf("svcauth_des: %s\n", msg) */
  58
  59 #define USEC_PER_SEC ((uint32_t) 1000000L)
  60 #define BEFORE(t1, t2) timercmp(t1, t2, <)
  61
  62 /*
  63  * LRU cache of conversation keys and some other useful items.
  64  */
  65 #define AUTHDES_CACHESZ 64
  66 struct cache_entry
  67   {
  68     des_block key;              /* conversation key */
  69     char *rname;                /* client's name */
  70     u_int window;               /* credential lifetime window */
  71     struct rpc_timeval laststamp;       /* detect replays of creds */
  72     char *localcred;            /* generic local credential */
  73   };
  74 static struct cache_entry *authdes_cache /* [AUTHDES_CACHESZ] */ ;
  75 static int *authdes_lru /* [AUTHDES_CACHESZ] */ ;
  76
  77 static void cache_init (void) internal_function; /* initialize the cache */
  78 static short cache_spot (des_block *, char *, struct rpc_timeval *)
  79      internal_function;         /* find an entry in the cache */
  80 static void cache_ref (uint32_t sid) internal_function;
  81                                 /* note that sid was ref'd */
  82
  83 static void invalidate (char *cred) internal_function;
  84                                 /* invalidate entry in cache */
  85
  86 /*
  87  * cache statistics
  88  */
  89 struct
  90   {
  91     u_long ncachehits;          /* times cache hit, and is not replay */
  92     u_long ncachereplays;       /* times cache hit, and is replay */
  93     u_long ncachemisses;        /* times cache missed */
  94   }
  95 svcauthdes_stats;
  96
  97 /*
  98  * Service side authenticator for AUTH_DES
  99  */
 100 enum auth_stat
 101 _svcauth_des (register struct svc_req *rqst, register struct rpc_msg *msg)
 102 {
 103   register uint32_t *ixdr;
 104   des_block cryptbuf[2];
 105   register struct authdes_cred *cred;
 106   struct authdes_verf verf;
 107   int status;
 108   register struct cache_entry *entry;
 109   uint32_t sid = 0;
 110   des_block *sessionkey;
 111   des_block ivec;
 112   u_int window;
 113   struct rpc_timeval timestamp;
 114   uint32_t namelen;
 115   struct area
 116     {
 117       struct authdes_cred area_cred;
 118       char area_netname[MAXNETNAMELEN + 1];
 119     }
 120    *area;
 121
 122   if (authdes_cache == NULL)
 123     cache_init ();
 124   if (authdes_cache == NULL) /* No free memory */
 125     return AUTH_FAILED;
 126
 127   area = (struct area *) rqst->rq_clntcred;
 128   cred = (struct authdes_cred *) &area->area_cred;
 129
 130   /*
 131    * Get the credential
 132    */
 133   if (msg->rm_call.cb_cred.oa_length <= 0 ||
 134       msg->rm_call.cb_cred.oa_length > MAX_AUTH_BYTES)
 135     return AUTH_BADCRED;
 136
 137   ixdr = (uint32_t *) msg->rm_call.cb_cred.oa_base;
 138   cred->adc_namekind = IXDR_GET_ENUM (ixdr, enum authdes_namekind);
 139   switch (cred->adc_namekind)
 140     {
 141     case ADN_FULLNAME:
 142       namelen = IXDR_GET_U_INT32 (ixdr);
 143       if (namelen > MAXNETNAMELEN)
 144         {
 145           return AUTH_BADCRED;
 146         }
 147       cred->adc_fullname.name = area->area_netname;
 148       bcopy ((char *) ixdr, cred->adc_fullname.name, namelen);
 149       cred->adc_fullname.name[namelen] = 0;
 150       ixdr += (RNDUP (namelen) / BYTES_PER_XDR_UNIT);
 151       cred->adc_fullname.key.key.high = *ixdr++;
 152       cred->adc_fullname.key.key.low = *ixdr++;
 153       cred->adc_fullname.window = *ixdr++;
 154       break;
 155     case ADN_NICKNAME:
 156       cred->adc_nickname = *ixdr++;
 157       break;
 158     default:
 159       return AUTH_BADCRED;
 160     }
 161
 162   /*
 163    * Get the verifier
 164    */
 165   if (msg->rm_call.cb_verf.oa_length <= 0 ||
 166       msg->rm_call.cb_verf.oa_length > MAX_AUTH_BYTES)
 167     return AUTH_BADCRED;
 168
 169   ixdr = (uint32_t *) msg->rm_call.cb_verf.oa_base;
 170   verf.adv_xtimestamp.key.high = *ixdr++;
 171   verf.adv_xtimestamp.key.low = *ixdr++;
 172   verf.adv_int_u = *ixdr++;
 173
 174   /*
 175    * Get the conversation key
 176    */
 177   if (cred->adc_namekind == ADN_FULLNAME)
 178     {
 179       netobj pkey;
 180       char pkey_data[1024];
 181
 182       sessionkey = &cred->adc_fullname.key;
 183       if (!getpublickey (cred->adc_fullname.name, pkey_data))
 184         {
 185           debug("getpublickey");
 186           return AUTH_BADCRED;
 187         }
 188       pkey.n_bytes = pkey_data;
 189       pkey.n_len = strlen (pkey_data) + 1;
 190       if (key_decryptsession_pk (cred->adc_fullname.name, &pkey,
 191                                  sessionkey) < 0)
 192         {
 193           debug ("decryptsessionkey");
 194           return AUTH_BADCRED;  /* key not found */
 195         }
 196     }
 197   else
 198     {                           /* ADN_NICKNAME */
 199       if (cred->adc_nickname >= AUTHDES_CACHESZ)
 200         {
 201           debug ("bad nickname");
 202           return AUTH_BADCRED;  /* garbled credential */
 203         }
 204       else
 205         sid = cred->adc_nickname;
 206
 207       /* XXX This could be wrong, but else we have a
 208          security problem */
 209       if (authdes_cache[sid].rname == NULL)
 210         return AUTH_BADCRED;
 211       sessionkey = &authdes_cache[sid].key;
 212     }
 213
 214
 215   /*
 216    * Decrypt the timestamp
 217    */
 218   cryptbuf[0] = verf.adv_xtimestamp;
 219   if (cred->adc_namekind == ADN_FULLNAME)
 220     {
 221       cryptbuf[1].key.high = cred->adc_fullname.window;
 222       cryptbuf[1].key.low = verf.adv_winverf;
 223       ivec.key.high = ivec.key.low = 0;
 224       status = cbc_crypt ((char *) sessionkey, (char *) cryptbuf,
 225                           2 * sizeof (des_block), DES_DECRYPT | DES_HW,
 226                           (char *) &ivec);
 227     }
 228   else
 229     status = ecb_crypt ((char *) sessionkey, (char *) cryptbuf,
 230                         sizeof (des_block), DES_DECRYPT | DES_HW);
 231
 232   if (DES_FAILED (status))
 233     {
 234       debug ("decryption failure");
 235       return AUTH_FAILED;       /* system error */
 236     }
 237
 238   /*
 239    * XDR the decrypted timestamp
 240    */
 241   ixdr = (uint32_t *) cryptbuf;
 242   timestamp.tv_sec = IXDR_GET_INT32 (ixdr);
 243   timestamp.tv_usec = IXDR_GET_INT32 (ixdr);
 244
 245   /*
 246    * Check for valid credentials and verifiers.
 247    * They could be invalid because the key was flushed
 248    * out of the cache, and so a new session should begin.
 249    * Be sure and send AUTH_REJECTED{CRED, VERF} if this is the case.
 250    */
 251   {
 252     struct timeval current;
 253     int nick;
 254     u_int winverf;
 255
 256     if (cred->adc_namekind == ADN_FULLNAME)
 257       {
 258         short tmp_spot;
 259
 260         window = IXDR_GET_U_INT32 (ixdr);
 261         winverf = IXDR_GET_U_INT32 (ixdr);
 262         if (winverf != window - 1)
 263           {
 264             debug ("window verifier mismatch");
 265             return AUTH_BADCRED;        /* garbled credential */
 266           }
 267         tmp_spot = cache_spot (sessionkey, cred->adc_fullname.name,
 268                                &timestamp);
 269         if (tmp_spot < 0 || tmp_spot > AUTHDES_CACHESZ)
 270           {
 271             debug ("replayed credential");
 272             return AUTH_REJECTEDCRED;           /* replay */
 273           }
 274         sid = tmp_spot;
 275         nick = 0;
 276       }
 277     else
 278       {                         /* ADN_NICKNAME */
 279         window = authdes_cache[sid].window;
 280         nick = 1;
 281       }
 282
 283     if (timestamp.tv_usec >= USEC_PER_SEC)
 284       {
 285         debug ("invalid usecs");
 286         /* cached out (bad key), or garbled verifier */
 287         return nick ? AUTH_REJECTEDVERF : AUTH_BADVERF;
 288       }
 289     if (nick && BEFORE (&timestamp, &authdes_cache[sid].laststamp))
 290       {
 291         debug ("timestamp before last seen");
 292         return AUTH_REJECTEDVERF;       /* replay */
 293       }
 294     __gettimeofday (&current, (struct timezone *) NULL);
 295     current.tv_sec -= window;   /* allow for expiration */
 296     if (!BEFORE (&current, &timestamp))
 297       {
 298         debug ("timestamp expired");
 299         /* replay, or garbled credential */
 300         return nick ? AUTH_REJECTEDVERF : AUTH_BADCRED;
 301       }
 302   }
 303
 304   /*
 305    * Set up the reply verifier
 306    */
 307   verf.adv_nickname = sid;
 308
 309   /*
 310    * xdr the timestamp before encrypting
 311    */
 312   ixdr = (int32_t *) cryptbuf;
 313   IXDR_PUT_INT32 (ixdr, timestamp.tv_sec - 1);
 314   IXDR_PUT_INT32 (ixdr, timestamp.tv_usec);
 315
 316   /*
 317    * encrypt the timestamp
 318    */
 319   status = ecb_crypt ((char *) sessionkey, (char *) cryptbuf,
 320                       sizeof (des_block), DES_ENCRYPT | DES_HW);
 321   if (DES_FAILED (status))
 322     {
 323       debug ("encryption failure");
 324       return AUTH_FAILED;       /* system error */
 325     }
 326   verf.adv_xtimestamp = cryptbuf[0];
 327
 328   /*
 329    * Serialize the reply verifier, and update rqst
 330    */
 331   ixdr = (uint32_t *) msg->rm_call.cb_verf.oa_base;
 332   *ixdr++ = verf.adv_xtimestamp.key.high;
 333   *ixdr++ = verf.adv_xtimestamp.key.low;
 334   *ixdr++ = verf.adv_int_u;
 335
 336   rqst->rq_xprt->xp_verf.oa_flavor = AUTH_DES;
 337   rqst->rq_xprt->xp_verf.oa_base = msg->rm_call.cb_verf.oa_base;
 338   rqst->rq_xprt->xp_verf.oa_length =
 339     (char *) ixdr - msg->rm_call.cb_verf.oa_base;
 340
 341   /*
 342    * We succeeded, commit the data to the cache now and
 343    * finish cooking the credential.
 344    */
 345   entry = &authdes_cache[sid];
 346   entry->laststamp = timestamp;
 347   cache_ref (sid);
 348   if (cred->adc_namekind == ADN_FULLNAME)
 349     {
 350       size_t full_len;
 351
 352       cred->adc_fullname.window = window;
 353       cred->adc_nickname = sid; /* save nickname */
 354       if (entry->rname != NULL)
 355         mem_free (entry->rname, strlen (entry->rname) + 1);
 356       full_len = strlen (cred->adc_fullname.name) + 1;
 357       entry->rname = mem_alloc ((u_int) full_len);
 358       if (entry->rname != NULL)
 359         memcpy (entry->rname, cred->adc_fullname.name, full_len);
 360       else
 361         {
 362           debug ("out of memory");
 363           return AUTH_FAILED; /* out of memory is bad */
 364         }
 365       entry->key = *sessionkey;
 366       entry->window = window;
 367       invalidate (entry->localcred);    /* mark any cached cred invalid */
 368     }
 369   else
 370     {                           /* ADN_NICKNAME */
 371       /*
 372        * nicknames are cooked into fullnames
 373        */
 374       cred->adc_namekind = ADN_FULLNAME;
 375       cred->adc_fullname.name = entry->rname;
 376       cred->adc_fullname.key = entry->key;
 377       cred->adc_fullname.window = entry->window;
 378     }
 379   return AUTH_OK;               /* we made it! */
 380 }
 381
 382
 383 /*
 384  * Initialize the cache
 385  */
 386 static void
 387 internal_function
 388 cache_init (void)
 389 {
 390   register int i;
 391
 392   authdes_cache = (struct cache_entry *)
 393     mem_alloc (sizeof (struct cache_entry) * AUTHDES_CACHESZ);
 394   if (authdes_cache == NULL)
 395     return;
 396   __bzero ((char *) authdes_cache,
 397            sizeof (struct cache_entry) * AUTHDES_CACHESZ);
 398
 399   authdes_lru = (int *) mem_alloc (sizeof (int) * AUTHDES_CACHESZ);
 400   /*
 401    * Initialize the lru list
 402    */
 403   for (i = 0; i < AUTHDES_CACHESZ; ++i)
 404     authdes_lru[i] = i;
 405 }
 406
 407
 408 /*
 409  * Find the lru victim
 410  */
 411 static short
 412 cache_victim (void)
 413 {
 414   return authdes_lru[AUTHDES_CACHESZ - 1];
 415 }
 416
 417 /*
 418  * Note that sid was referenced
 419  */
 420 static void
 421 internal_function
 422 cache_ref (register uint32_t sid)
 423 {
 424   register int i;
 425   register int curr;
 426   register int prev;
 427
 428   prev = authdes_lru[0];
 429   authdes_lru[0] = sid;
 430   for (i = 1; prev != sid; ++i)
 431     {
 432       curr = authdes_lru[i];
 433       authdes_lru[i] = prev;
 434       prev = curr;
 435     }
 436 }
 437
 438 /*
 439  * Find a spot in the cache for a credential containing
 440  * the items given.  Return -1 if a replay is detected, otherwise
 441  * return the spot in the cache.
 442  */
 443 static short
 444 internal_function
 445 cache_spot (register des_block *key, char *name,
 446             struct rpc_timeval *timestamp)
 447 {
 448   register struct cache_entry *cp;
 449   register int i;
 450   register uint32_t hi;
 451
 452   hi = key->key.high;
 453   for (cp = authdes_cache, i = 0; i < AUTHDES_CACHESZ; ++i, ++cp)
 454     {
 455       if (cp->key.key.high == hi &&
 456           cp->key.key.low == key->key.low &&
 457           cp->rname != NULL &&
 458           memcmp (cp->rname, name, strlen (name) + 1) == 0)
 459         {
 460           if (BEFORE (timestamp, &cp->laststamp))
 461             {
 462               ++svcauthdes_stats.ncachereplays;
 463               return -1;        /* replay */
 464             }
 465           ++svcauthdes_stats.ncachehits;
 466           return i;             /* refresh */
 467         }
 468     }
 469   ++svcauthdes_stats.ncachemisses;
 470   return cache_victim ();       /* new credential */
 471 }
 472
 473 /*
 474  * Local credential handling stuff.
 475  * NOTE: bsd unix dependent.
 476  * Other operating systems should put something else here.
 477  */
 478 #define UNKNOWN         -2      /* grouplen, if cached cred is unknown user */
 479 #define INVALID         -1      /* grouplen, if cache entry is invalid */
 480
 481 struct bsdcred
 482 {
 483   uid_t uid;                    /* cached uid */
 484   gid_t gid;                    /* cached gid */
 485   short grouplen;               /* length of cached groups */
 486   gid_t groups[NGROUPS];        /* cached groups */
 487 };
 488
 489 /*
 490  * Map a des credential into a unix cred.
 491  * We cache the credential here so the application does
 492  * not have to make an rpc call every time to interpret
 493  * the credential.
 494  */
 495 int
 496 authdes_getucred (const struct authdes_cred *adc, uid_t * uid, gid_t * gid,
 497                   short *grouplen, gid_t * groups)
 498 {
 499   unsigned sid;
 500   register int i;
 501   uid_t i_uid;
 502   gid_t i_gid;
 503   int i_grouplen;
 504   struct bsdcred *cred;
 505
 506   sid = adc->adc_nickname;
 507   if (sid >= AUTHDES_CACHESZ)
 508     {
 509       debug ("invalid nickname");
 510       return 0;
 511     }
 512   cred = (struct bsdcred *) authdes_cache[sid].localcred;
 513   if (cred == NULL)
 514     {
 515       cred = (struct bsdcred *) mem_alloc (sizeof (struct bsdcred));
 516       authdes_cache[sid].localcred = (char *) cred;
 517       cred->grouplen = INVALID;
 518     }
 519   if (cred->grouplen == INVALID)
 520     {
 521       /*
 522        * not in cache: lookup
 523        */
 524       if (!netname2user (adc->adc_fullname.name, &i_uid, &i_gid,
 525                          &i_grouplen, groups))
 526         {
 527           debug ("unknown netname");
 528           cred->grouplen = UNKNOWN;     /* mark as lookup up, but not found */
 529           return 0;
 530         }
 531       debug ("missed ucred cache");
 532       *uid = cred->uid = i_uid;
 533       *gid = cred->gid = i_gid;
 534       *grouplen = cred->grouplen = i_grouplen;
 535       for (i = i_grouplen - 1; i >= 0; --i)
 536         cred->groups[i] = groups[i];    /* int to short */
 537       return 1;
 538     }
 539   else if (cred->grouplen == UNKNOWN)
 540     {
 541       /*
 542        * Already lookup up, but no match found
 543        */
 544       return 0;
 545     }
 546
 547   /*
 548    * cached credentials
 549    */
 550   *uid = cred->uid;
 551   *gid = cred->gid;
 552   *grouplen = cred->grouplen;
 553   for (i = cred->grouplen - 1; i >= 0; --i)
 554     groups[i] = cred->groups[i];        /* short to int */
 555   return 1;
 556 }
 557
 558 static void
 559 internal_function
 560 invalidate (char *cred)
 561 {
 562   if (cred == NULL)
 563     return;
 564   ((struct bsdcred *) cred)->grouplen = INVALID;
 565 }