lib/krb5/build_auth.c

   1 /*
   2  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35
  36 static krb5_error_code
  37 add_auth_data(krb5_context context,
  38               AuthorizationData *src,
  39               AuthorizationData **dst)
  40 {
  41     krb5_error_code ret = 0;
  42     size_t i;
  43
  44     if (*dst == NULL &&
  45         (*dst = calloc(1, sizeof(**dst))) == NULL)
  46         return krb5_enomem(context);
  47     for (i = 0; ret == 0 && i < src->len; i++)
  48         ret = add_AuthorizationData(*dst, &src->val[i]);
  49     return ret;
  50 }
  51
  52 static krb5_error_code
  53 add_etypelist(krb5_context context,
  54               krb5_authdata *auth_data)
  55 {
  56     AuthorizationDataElement ade;
  57     EtypeList etypes;
  58     krb5_error_code ret;
  59     krb5_data e;
  60     size_t len = 0;
  61
  62     ret = _krb5_init_etype(context, KRB5_PDU_NONE,
  63                            &etypes.len, &etypes.val,
  64                            NULL);
  65     if (ret)
  66         return ret;
  67
  68     ASN1_MALLOC_ENCODE(EtypeList, e.data, e.length, &etypes, &len, ret);
  69     if (ret) {
  70         free_EtypeList(&etypes);
  71         return ret;
  72     }
  73     if(e.length != len)
  74         krb5_abortx(context, "internal error in ASN.1 encoder");
  75     free_EtypeList(&etypes);
  76
  77     ade.ad_type = KRB5_AUTHDATA_GSS_API_ETYPE_NEGOTIATION;
  78     ade.ad_data = e;
  79
  80     ret = add_AuthorizationData(auth_data, &ade);
  81
  82     krb5_data_free(&e);
  83
  84     return ret;
  85 }
  86
  87 static krb5_error_code
  88 add_ap_options(krb5_context context,
  89                krb5_boolean channel_bound,
  90                krb5_authdata *auth_data)
  91 {
  92     krb5_error_code ret;
  93     AuthorizationDataElement ade;
  94     krb5_boolean require_cb;
  95     uint8_t ap_options[4];
  96
  97     require_cb = krb5_config_get_bool_default(context, NULL, FALSE,
  98                                               "libdefaults",
  99                                               "client_aware_channel_bindings",
 100                                               NULL);
 101
 102     if (channel_bound)
 103         require_cb = TRUE;
 104
 105     if (!require_cb)
 106         return 0;
 107
 108     ap_options[0] = (KERB_AP_OPTIONS_CBT >> 0 ) & 0xFF;
 109     ap_options[1] = (KERB_AP_OPTIONS_CBT >> 8 ) & 0xFF;
 110     ap_options[2] = (KERB_AP_OPTIONS_CBT >> 16) & 0xFF;
 111     ap_options[3] = (KERB_AP_OPTIONS_CBT >> 24) & 0xFF;
 112
 113     ade.ad_type = KRB5_AUTHDATA_AP_OPTIONS;
 114     ade.ad_data.length = sizeof(ap_options);
 115     ade.ad_data.data = ap_options;
 116
 117     ret = add_AuthorizationData(auth_data, &ade);
 118
 119     return ret;
 120 }
 121
 122 static krb5_error_code
 123 make_ap_authdata(krb5_context context,
 124                  krb5_boolean channel_bound,
 125                  krb5_authdata **auth_data)
 126 {
 127     krb5_error_code ret;
 128     AuthorizationData ad;
 129     krb5_data ir;
 130     size_t len;
 131
 132     ad.len = 0;
 133     ad.val = NULL;
 134
 135     ret = add_etypelist(context, &ad);
 136     if (ret)
 137         return ret;
 138
 139     /*
 140      * Windows has a bug and only looks for first occurrence of AD-IF-RELEVANT
 141      * in the AP authenticator when looking for AD-AP-OPTIONS. Make sure to
 142      * bundle it together with etypes.
 143      */
 144     ret = add_ap_options(context, channel_bound, &ad);
 145     if (ret) {
 146         free_AuthorizationData(&ad);
 147         return ret;
 148     }
 149
 150     ASN1_MALLOC_ENCODE(AuthorizationData, ir.data, ir.length, &ad, &len, ret);
 151     if (ret) {
 152         free_AuthorizationData(&ad);
 153         return ret;
 154     }
 155     if(ir.length != len)
 156         krb5_abortx(context, "internal error in ASN.1 encoder");
 157
 158     ret = _krb5_add_1auth_data(context, KRB5_AUTHDATA_IF_RELEVANT, &ir, 1,
 159                                auth_data);
 160
 161     free_AuthorizationData(&ad);
 162     krb5_data_free(&ir);
 163
 164     return ret;
 165 }
 166
 167 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 168 _krb5_build_authenticator (krb5_context context,
 169                            krb5_auth_context auth_context,
 170                            krb5_enctype enctype,
 171                            krb5_creds *cred,
 172                            Checksum *cksum,
 173                            krb5_boolean channel_bound,
 174                            krb5_data *result,
 175                            krb5_key_usage usage)
 176 {
 177     Authenticator auth;
 178     u_char *buf = NULL;
 179     size_t buf_size;
 180     size_t len = 0;
 181     krb5_error_code ret;
 182     krb5_crypto crypto;
 183
 184     memset(&auth, 0, sizeof(auth));
 185
 186     auth.authenticator_vno = 5;
 187     ret = copy_Realm(&cred->client->realm, &auth.crealm);
 188     if (ret)
 189         goto fail;
 190     ret = copy_PrincipalName(&cred->client->name, &auth.cname);
 191     if (ret)
 192         goto fail;
 193
 194     krb5_us_timeofday (context, &auth.ctime, &auth.cusec);
 195
 196     ret = krb5_auth_con_getlocalsubkey(context, auth_context, &auth.subkey);
 197     if(ret)
 198         goto fail;
 199
 200     if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) {
 201         if(auth_context->local_seqnumber == 0)
 202             krb5_generate_seq_number (context,
 203                                       &cred->session,
 204                                       &auth_context->local_seqnumber);
 205         ALLOC(auth.seq_number, 1);
 206         if(auth.seq_number == NULL) {
 207             ret = krb5_enomem(context);
 208             goto fail;
 209         }
 210         *auth.seq_number = auth_context->local_seqnumber;
 211     } else
 212         auth.seq_number = NULL;
 213     auth.authorization_data = NULL;
 214
 215     if (cksum) {
 216         ALLOC(auth.cksum, 1);
 217         if (auth.cksum == NULL) {
 218             ret = krb5_enomem(context);
 219             goto fail;
 220         }
 221         ret = copy_Checksum(cksum, auth.cksum);
 222         if (ret)
 223             goto fail;
 224
 225         if (auth.cksum->cksumtype == CKSUMTYPE_GSSAPI) {
 226             /*
 227              * This is not GSS-API specific, we only enable it for
 228              * GSS for now
 229              */
 230             ret = make_ap_authdata(context,
 231                                    channel_bound,
 232                                    &auth.authorization_data);
 233             if (ret)
 234                 goto fail;
 235         }
 236     }
 237
 238     /* Copy other authz data from auth_context */
 239     if (auth_context->auth_data) {
 240         ret = add_auth_data(context, auth_context->auth_data, &auth.authorization_data);
 241         if (ret)
 242             goto fail;
 243     }
 244
 245     /* XXX - Copy more to auth_context? */
 246
 247     auth_context->authenticator->ctime = auth.ctime;
 248     auth_context->authenticator->cusec = auth.cusec;
 249
 250     ASN1_MALLOC_ENCODE(Authenticator, buf, buf_size, &auth, &len, ret);
 251     if (ret)
 252         goto fail;
 253     if(buf_size != len)
 254         krb5_abortx(context, "internal error in ASN.1 encoder");
 255
 256     ret = krb5_crypto_init(context, &cred->session, enctype, &crypto);
 257     if (ret)
 258         goto fail;
 259     ret = krb5_encrypt (context,
 260                         crypto,
 261                         usage /* KRB5_KU_AP_REQ_AUTH */,
 262                         buf,
 263                         len,
 264                         result);
 265     krb5_crypto_destroy(context, crypto);
 266
 267     if (ret)
 268         goto fail;
 269
 270  fail:
 271     free_Authenticator (&auth);
 272     free (buf);
 273
 274     return ret;
 275 }