lib/krb5/transited.c

   1 /*
   2  * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35
  36 /* this is an attempt at one of the most horrible `compression'
  37    schemes that has ever been invented; it's so amazingly brain-dead
  38    that words can not describe it, and all this just to save a few
  39    silly bytes */
  40
  41 struct tr_realm {
  42     char *realm;
  43     unsigned leading_space:1;
  44     unsigned leading_slash:1;
  45     unsigned trailing_dot:1;
  46     struct tr_realm *next;
  47 };
  48
  49 static void
  50 free_realms(struct tr_realm *r)
  51 {
  52     struct tr_realm *p;
  53     while(r){
  54         p = r;
  55         r = r->next;
  56         free(p->realm);
  57         free(p);
  58     }
  59 }
  60
  61 static int
  62 make_path(krb5_context context, struct tr_realm *r,
  63           const char *from, const char *to)
  64 {
  65     struct tr_realm *tmp;
  66     const char *p;
  67
  68     if(strlen(from) < strlen(to)){
  69         const char *str;
  70         str = from;
  71         from = to;
  72         to = str;
  73     }
  74
  75     if(strcmp(from + strlen(from) - strlen(to), to) == 0){
  76         p = from;
  77         while(1){
  78             p = strchr(p, '.');
  79             if(p == NULL) {
  80                 krb5_clear_error_message (context);
  81                 return KRB5KDC_ERR_POLICY;
  82             }
  83             p++;
  84             if(strcmp(p, to) == 0)
  85                 break;
  86             tmp = calloc(1, sizeof(*tmp));
  87             if(tmp == NULL)
  88                 return krb5_enomem(context);
  89             tmp->next = r->next;
  90             r->next = tmp;
  91             tmp->realm = strdup(p);
  92             if(tmp->realm == NULL){
  93                 r->next = tmp->next;
  94                 free(tmp);
  95                 return krb5_enomem(context);
  96             }
  97         }
  98     }else if(strncmp(from, to, strlen(to)) == 0){
  99         p = from + strlen(from);
 100         while(1){
 101             while(p >= from && *p != '/') p--;
 102             if(p == from)
 103                 return KRB5KDC_ERR_POLICY;
 104
 105             if(strncmp(to, from, p - from) == 0)
 106                 break;
 107             tmp = calloc(1, sizeof(*tmp));
 108             if(tmp == NULL)
 109                 return krb5_enomem(context);
 110             tmp->next = r->next;
 111             r->next = tmp;
 112             tmp->realm = malloc(p - from + 1);
 113             if(tmp->realm == NULL){
 114                 r->next = tmp->next;
 115                 free(tmp);
 116                 return krb5_enomem(context);
 117             }
 118             memcpy(tmp->realm, from, p - from);
 119             tmp->realm[p - from] = '\0';
 120             p--;
 121         }
 122     } else {
 123         krb5_clear_error_message (context);
 124         return KRB5KDC_ERR_POLICY;
 125     }
 126
 127     return 0;
 128 }
 129
 130 static int
 131 make_paths(krb5_context context,
 132            struct tr_realm *realms, const char *client_realm,
 133            const char *server_realm)
 134 {
 135     struct tr_realm *r;
 136     int ret;
 137     const char *prev_realm = client_realm;
 138     const char *next_realm = NULL;
 139     for(r = realms; r; r = r->next){
 140         /* it *might* be that you can have more than one empty
 141            component in a row, at least that's how I interpret the
 142            "," exception in 1510 */
 143         if(r->realm[0] == '\0'){
 144             while(r->next && r->next->realm[0] == '\0')
 145                 r = r->next;
 146             if(r->next)
 147                 next_realm = r->next->realm;
 148             else
 149                 next_realm = server_realm;
 150             ret = make_path(context, r, prev_realm, next_realm);
 151             if(ret){
 152                 free_realms(realms);
 153                 return ret;
 154             }
 155         }
 156         prev_realm = r->realm;
 157     }
 158     return 0;
 159 }
 160
 161 static int
 162 expand_realms(krb5_context context,
 163               struct tr_realm *realms, const char *client_realm)
 164 {
 165     struct tr_realm *r;
 166     const char *prev_realm = NULL;
 167     for(r = realms; r; r = r->next){
 168         if(r->trailing_dot){
 169             char *tmp;
 170             size_t len;
 171
 172             if(prev_realm == NULL)
 173                 prev_realm = client_realm;
 174
 175             len = strlen(r->realm) + strlen(prev_realm) + 1;
 176
 177             tmp = realloc(r->realm, len);
 178             if(tmp == NULL){
 179                 free_realms(realms);
 180                 return krb5_enomem(context);
 181             }
 182             r->realm = tmp;
 183             strlcat(r->realm, prev_realm, len);
 184         }else if(r->leading_slash && !r->leading_space && prev_realm){
 185             /* yet another exception: if you use x500-names, the
 186                leading realm doesn't have to be "quoted" with a space */
 187             char *tmp;
 188             size_t len = strlen(r->realm) + strlen(prev_realm) + 1;
 189
 190             tmp = malloc(len);
 191             if(tmp == NULL){
 192                 free_realms(realms);
 193                 return krb5_enomem(context);
 194             }
 195             strlcpy(tmp, prev_realm, len);
 196             strlcat(tmp, r->realm, len);
 197             free(r->realm);
 198             r->realm = tmp;
 199         }
 200         prev_realm = r->realm;
 201     }
 202     return 0;
 203 }
 204
 205 static struct tr_realm *
 206 make_realm(char *realm)
 207 {
 208     struct tr_realm *r;
 209     char *p, *q;
 210     int quote = 0;
 211     r = calloc(1, sizeof(*r));
 212     if(r == NULL){
 213         free(realm);
 214         return NULL;
 215     }
 216     r->realm = realm;
 217     for(p = q = r->realm; *p; p++){
 218         if(p == r->realm && *p == ' '){
 219             r->leading_space = 1;
 220             continue;
 221         }
 222         if(q == r->realm && *p == '/')
 223             r->leading_slash = 1;
 224         if(quote){
 225             *q++ = *p;
 226             quote = 0;
 227             continue;
 228         }
 229         if(*p == '\\'){
 230             quote = 1;
 231             continue;
 232         }
 233         if(p[0] == '.' && p[1] == '\0')
 234             r->trailing_dot = 1;
 235         *q++ = *p;
 236     }
 237     *q = '\0';
 238     return r;
 239 }
 240
 241 static struct tr_realm*
 242 append_realm(struct tr_realm *head, struct tr_realm *r)
 243 {
 244     struct tr_realm *p;
 245     if(head == NULL){
 246         r->next = NULL;
 247         return r;
 248     }
 249     p = head;
 250     while(p->next) p = p->next;
 251     p->next = r;
 252     return head;
 253 }
 254
 255 static int
 256 decode_realms(krb5_context context,
 257               const char *tr, int length, struct tr_realm **realms)
 258 {
 259     struct tr_realm *r = NULL;
 260
 261     char *tmp;
 262     int quote = 0;
 263     const char *start = tr;
 264     int i;
 265
 266     for(i = 0; i < length; i++){
 267         if(quote){
 268             quote = 0;
 269             continue;
 270         }
 271         if(tr[i] == '\\'){
 272             quote = 1;
 273             continue;
 274         }
 275         if(tr[i] == ','){
 276             tmp = malloc(tr + i - start + 1);
 277             if(tmp == NULL)
 278                 return krb5_enomem(context);
 279             memcpy(tmp, start, tr + i - start);
 280             tmp[tr + i - start] = '\0';
 281             r = make_realm(tmp);
 282             if(r == NULL){
 283                 free_realms(*realms);
 284                 return krb5_enomem(context);
 285             }
 286             *realms = append_realm(*realms, r);
 287             start = tr + i + 1;
 288         }
 289     }
 290     tmp = malloc(tr + i - start + 1);
 291     if(tmp == NULL){
 292         free(*realms);
 293         return krb5_enomem(context);
 294     }
 295     memcpy(tmp, start, tr + i - start);
 296     tmp[tr + i - start] = '\0';
 297     r = make_realm(tmp);
 298     if(r == NULL){
 299         free_realms(*realms);
 300         return krb5_enomem(context);
 301     }
 302     *realms = append_realm(*realms, r);
 303
 304     return 0;
 305 }
 306
 307
 308 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 309 krb5_domain_x500_decode(krb5_context context,
 310                         krb5_data tr, char ***realms, unsigned int *num_realms,
 311                         const char *client_realm, const char *server_realm)
 312 {
 313     struct tr_realm *r = NULL;
 314     struct tr_realm *p, **q;
 315     int ret;
 316
 317     if(tr.length == 0) {
 318         *realms = NULL;
 319         *num_realms = 0;
 320         return 0;
 321     }
 322
 323     /* split string in components */
 324     ret = decode_realms(context, tr.data, tr.length, &r);
 325     if(ret)
 326         return ret;
 327
 328     /* apply prefix rule */
 329     ret = expand_realms(context, r, client_realm);
 330     if(ret)
 331         return ret;
 332
 333     ret = make_paths(context, r, client_realm, server_realm);
 334     if(ret)
 335         return ret;
 336
 337     /* remove empty components and count realms */
 338     *num_realms = 0;
 339     for(q = &r; *q; ){
 340         if((*q)->realm[0] == '\0'){
 341             p = *q;
 342             *q = (*q)->next;
 343             free(p->realm);
 344             free(p);
 345         }else{
 346             q = &(*q)->next;
 347             (*num_realms)++;
 348         }
 349     }
 350     if (*num_realms + 1 > UINT_MAX/sizeof(**realms))
 351         return ERANGE;
 352
 353     {
 354         char **R;
 355         R = malloc((*num_realms + 1) * sizeof(*R));
 356         if (R == NULL)
 357             return krb5_enomem(context);
 358         *realms = R;
 359         while(r){
 360             *R++ = r->realm;
 361             p = r->next;
 362             free(r);
 363             r = p;
 364         }
 365     }
 366     return 0;
 367 }
 368
 369 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 370 krb5_domain_x500_encode(char **realms, unsigned int num_realms,
 371                         krb5_data *encoding)
 372 {
 373     char *s = NULL;
 374     int len = 0;
 375     unsigned int i;
 376     krb5_data_zero(encoding);
 377     if (num_realms == 0)
 378         return 0;
 379     for(i = 0; i < num_realms; i++){
 380         len += strlen(realms[i]);
 381         if(realms[i][0] == '/')
 382             len++;
 383     }
 384     len += num_realms - 1;
 385     s = malloc(len + 1);
 386     if (s == NULL)
 387         return ENOMEM;
 388     *s = '\0';
 389     for(i = 0; i < num_realms; i++){
 390         if(i)
 391             strlcat(s, ",", len + 1);
 392         if(realms[i][0] == '/')
 393             strlcat(s, " ", len + 1);
 394         strlcat(s, realms[i], len + 1);
 395     }
 396     encoding->data = s;
 397     encoding->length = strlen(s);
 398     return 0;
 399 }
 400
 401 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 402 krb5_check_transited(krb5_context context,
 403                      krb5_const_realm client_realm,
 404                      krb5_const_realm server_realm,
 405                      krb5_realm *realms,
 406                      unsigned int num_realms,
 407                      int *bad_realm)
 408 {
 409     char **tr_realms;
 410     char **p;
 411     size_t i;
 412
 413     if(num_realms == 0)
 414         return 0;
 415
 416     tr_realms = krb5_config_get_strings(context, NULL,
 417                                         "capaths",
 418                                         client_realm,
 419                                         server_realm,
 420                                         NULL);
 421     for(i = 0; i < num_realms; i++) {
 422         for(p = tr_realms; p && *p; p++) {
 423             if(strcmp(*p, realms[i]) == 0)
 424                 break;
 425         }
 426         if(p == NULL || *p == NULL) {
 427             krb5_config_free_strings(tr_realms);
 428             krb5_set_error_message (context, KRB5KRB_AP_ERR_ILL_CR_TKT,
 429                                     N_("no transit allowed "
 430                                        "through realm %s from %s to %s", ""),
 431                                        realms[i], client_realm, server_realm);
 432             if(bad_realm)
 433                 *bad_realm = i;
 434             return KRB5KRB_AP_ERR_ILL_CR_TKT;
 435         }
 436     }
 437     krb5_config_free_strings(tr_realms);
 438     return 0;
 439 }
 440
 441 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 442 krb5_check_transited_realms(krb5_context context,
 443                             const char *const *realms,
 444                             unsigned int num_realms,
 445                             int *bad_realm)
 446 {
 447     size_t i;
 448     int ret = 0;
 449     char **bad_realms = krb5_config_get_strings(context, NULL,
 450                                                 "libdefaults",
 451                                                 "transited_realms_reject",
 452                                                 NULL);
 453     if(bad_realms == NULL)
 454         return 0;
 455
 456     for(i = 0; i < num_realms; i++) {
 457         char **p;
 458         for(p = bad_realms; *p; p++)
 459             if(strcmp(*p, realms[i]) == 0) {
 460                 ret = KRB5KRB_AP_ERR_ILL_CR_TKT;
 461                 krb5_set_error_message (context, ret,
 462                                         N_("no transit allowed "
 463                                            "through realm %s", ""),
 464                                         *p);
 465                 if(bad_realm)
 466                     *bad_realm = i;
 467                 break;
 468             }
 469     }
 470     krb5_config_free_strings(bad_realms);
 471     return ret;
 472 }
 473
 474 #if 0
 475 int
 476 main(int argc, char **argv)
 477 {
 478     krb5_data x;
 479     char **r;
 480     int num, i;
 481     x.data = argv[1];
 482     x.length = strlen(x.data);
 483     if(domain_expand(x, &r, &num, argv[2], argv[3]))
 484         exit(1);
 485     for(i = 0; i < num; i++)
 486         printf("%s\n", r[i]);
 487     return 0;
 488 }
 489 #endif
 490