1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2 /* cammac_util.c - CAMMAC related functions */
3 /*
4 * Copyright (C) 2016 by Red Hat, Inc.
5 * All Rights Reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * * Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 *
14 * * Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
17 * distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
24 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
26 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
28 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
30 * OF THE POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 #include "k5-int.h"
34
35 /* Return 0 if cammac's service verifier is valid for server_key. */
36 static krb5_error_code
check_svcver(krb5_context context,const krb5_cammac * cammac,const krb5_keyblock * server_key)37 check_svcver(krb5_context context, const krb5_cammac *cammac,
38 const krb5_keyblock *server_key)
39 {
40 krb5_error_code ret;
41 krb5_boolean valid = FALSE;
42 krb5_verifier_mac *ver = cammac->svc_verifier;
43 krb5_data *der_authdata = NULL;
44
45 if (ver == NULL)
46 return EINVAL;
47
48 ret = encode_krb5_authdata(cammac->elements, &der_authdata);
49 if (ret)
50 return ret;
51
52 ret = krb5_c_verify_checksum(context, server_key, KRB5_KEYUSAGE_CAMMAC,
53 der_authdata, &ver->checksum, &valid);
54 if (!ret && !valid)
55 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
56
57 krb5_free_data(context, der_authdata);
58 return ret;
59 }
60
61 /* Decode and verify CAMMAC authdata using the svc verifier,
62 * and return the contents as an allocated array of authdata pointers. */
63 krb5_error_code
k5_unwrap_cammac_svc(krb5_context context,const krb5_authdata * ad,const krb5_keyblock * key,krb5_authdata *** adata_out)64 k5_unwrap_cammac_svc(krb5_context context, const krb5_authdata *ad,
65 const krb5_keyblock *key, krb5_authdata ***adata_out)
66 {
67 krb5_data ad_data;
68 krb5_error_code ret;
69 krb5_cammac *cammac = NULL;
70
71 *adata_out = NULL;
72
73 ad_data = make_data(ad->contents, ad->length);
74 ret = decode_krb5_cammac(&ad_data, &cammac);
75 if (ret)
76 return ret;
77
78 ret = check_svcver(context, cammac, key);
79 if (!ret) {
80 *adata_out = cammac->elements;
81 cammac->elements = NULL;
82 }
83
84 k5_free_cammac(context, cammac);
85 return ret;
86 }
87