1c19800e8SDoug Rabson /* 2c19800e8SDoug Rabson * Copyright (c) 1997 - 2003 Kungliga Tekniska H�gskolan 3c19800e8SDoug Rabson * (Royal Institute of Technology, Stockholm, Sweden). 4c19800e8SDoug Rabson * All rights reserved. 5c19800e8SDoug Rabson * 6c19800e8SDoug Rabson * Redistribution and use in source and binary forms, with or without 7c19800e8SDoug Rabson * modification, are permitted provided that the following conditions 8c19800e8SDoug Rabson * are met: 9c19800e8SDoug Rabson * 10c19800e8SDoug Rabson * 1. Redistributions of source code must retain the above copyright 11c19800e8SDoug Rabson * notice, this list of conditions and the following disclaimer. 12c19800e8SDoug Rabson * 13c19800e8SDoug Rabson * 2. Redistributions in binary form must reproduce the above copyright 14c19800e8SDoug Rabson * notice, this list of conditions and the following disclaimer in the 15c19800e8SDoug Rabson * documentation and/or other materials provided with the distribution. 16c19800e8SDoug Rabson * 17c19800e8SDoug Rabson * 3. Neither the name of the Institute nor the names of its contributors 18c19800e8SDoug Rabson * may be used to endorse or promote products derived from this software 19c19800e8SDoug Rabson * without specific prior written permission. 20c19800e8SDoug Rabson * 21c19800e8SDoug Rabson * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22c19800e8SDoug Rabson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23c19800e8SDoug Rabson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24c19800e8SDoug Rabson * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25c19800e8SDoug Rabson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26c19800e8SDoug Rabson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27c19800e8SDoug Rabson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28c19800e8SDoug Rabson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29c19800e8SDoug Rabson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30c19800e8SDoug Rabson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31c19800e8SDoug Rabson * SUCH DAMAGE. 32c19800e8SDoug Rabson */ 33c19800e8SDoug Rabson 34c19800e8SDoug Rabson #include "krb5/gsskrb5_locl.h" 35c19800e8SDoug Rabson 36c19800e8SDoug Rabson RCSID("$Id: 8003.c 18334 2006-10-07 22:16:04Z lha $"); 37c19800e8SDoug Rabson 38c19800e8SDoug Rabson krb5_error_code 39c19800e8SDoug Rabson _gsskrb5_encode_om_uint32(OM_uint32 n, u_char *p) 40c19800e8SDoug Rabson { 41c19800e8SDoug Rabson p[0] = (n >> 0) & 0xFF; 42c19800e8SDoug Rabson p[1] = (n >> 8) & 0xFF; 43c19800e8SDoug Rabson p[2] = (n >> 16) & 0xFF; 44c19800e8SDoug Rabson p[3] = (n >> 24) & 0xFF; 45c19800e8SDoug Rabson return 0; 46c19800e8SDoug Rabson } 47c19800e8SDoug Rabson 48c19800e8SDoug Rabson krb5_error_code 49c19800e8SDoug Rabson _gsskrb5_encode_be_om_uint32(OM_uint32 n, u_char *p) 50c19800e8SDoug Rabson { 51c19800e8SDoug Rabson p[0] = (n >> 24) & 0xFF; 52c19800e8SDoug Rabson p[1] = (n >> 16) & 0xFF; 53c19800e8SDoug Rabson p[2] = (n >> 8) & 0xFF; 54c19800e8SDoug Rabson p[3] = (n >> 0) & 0xFF; 55c19800e8SDoug Rabson return 0; 56c19800e8SDoug Rabson } 57c19800e8SDoug Rabson 58c19800e8SDoug Rabson krb5_error_code 59c19800e8SDoug Rabson _gsskrb5_decode_om_uint32(const void *ptr, OM_uint32 *n) 60c19800e8SDoug Rabson { 61c19800e8SDoug Rabson const u_char *p = ptr; 62c19800e8SDoug Rabson *n = (p[0] << 0) | (p[1] << 8) | (p[2] << 16) | (p[3] << 24); 63c19800e8SDoug Rabson return 0; 64c19800e8SDoug Rabson } 65c19800e8SDoug Rabson 66c19800e8SDoug Rabson krb5_error_code 67c19800e8SDoug Rabson _gsskrb5_decode_be_om_uint32(const void *ptr, OM_uint32 *n) 68c19800e8SDoug Rabson { 69c19800e8SDoug Rabson const u_char *p = ptr; 70c19800e8SDoug Rabson *n = (p[0] <<24) | (p[1] << 16) | (p[2] << 8) | (p[3] << 0); 71c19800e8SDoug Rabson return 0; 72c19800e8SDoug Rabson } 73c19800e8SDoug Rabson 74c19800e8SDoug Rabson static krb5_error_code 75c19800e8SDoug Rabson hash_input_chan_bindings (const gss_channel_bindings_t b, 76c19800e8SDoug Rabson u_char *p) 77c19800e8SDoug Rabson { 78c19800e8SDoug Rabson u_char num[4]; 79c19800e8SDoug Rabson MD5_CTX md5; 80c19800e8SDoug Rabson 81c19800e8SDoug Rabson MD5_Init(&md5); 82c19800e8SDoug Rabson _gsskrb5_encode_om_uint32 (b->initiator_addrtype, num); 83c19800e8SDoug Rabson MD5_Update (&md5, num, sizeof(num)); 84c19800e8SDoug Rabson _gsskrb5_encode_om_uint32 (b->initiator_address.length, num); 85c19800e8SDoug Rabson MD5_Update (&md5, num, sizeof(num)); 86c19800e8SDoug Rabson if (b->initiator_address.length) 87c19800e8SDoug Rabson MD5_Update (&md5, 88c19800e8SDoug Rabson b->initiator_address.value, 89c19800e8SDoug Rabson b->initiator_address.length); 90c19800e8SDoug Rabson _gsskrb5_encode_om_uint32 (b->acceptor_addrtype, num); 91c19800e8SDoug Rabson MD5_Update (&md5, num, sizeof(num)); 92c19800e8SDoug Rabson _gsskrb5_encode_om_uint32 (b->acceptor_address.length, num); 93c19800e8SDoug Rabson MD5_Update (&md5, num, sizeof(num)); 94c19800e8SDoug Rabson if (b->acceptor_address.length) 95c19800e8SDoug Rabson MD5_Update (&md5, 96c19800e8SDoug Rabson b->acceptor_address.value, 97c19800e8SDoug Rabson b->acceptor_address.length); 98c19800e8SDoug Rabson _gsskrb5_encode_om_uint32 (b->application_data.length, num); 99c19800e8SDoug Rabson MD5_Update (&md5, num, sizeof(num)); 100c19800e8SDoug Rabson if (b->application_data.length) 101c19800e8SDoug Rabson MD5_Update (&md5, 102c19800e8SDoug Rabson b->application_data.value, 103c19800e8SDoug Rabson b->application_data.length); 104c19800e8SDoug Rabson MD5_Final (p, &md5); 105c19800e8SDoug Rabson return 0; 106c19800e8SDoug Rabson } 107c19800e8SDoug Rabson 108c19800e8SDoug Rabson /* 109c19800e8SDoug Rabson * create a checksum over the chanel bindings in 110c19800e8SDoug Rabson * `input_chan_bindings', `flags' and `fwd_data' and return it in 111c19800e8SDoug Rabson * `result' 112c19800e8SDoug Rabson */ 113c19800e8SDoug Rabson 114c19800e8SDoug Rabson OM_uint32 115c19800e8SDoug Rabson _gsskrb5_create_8003_checksum ( 116c19800e8SDoug Rabson OM_uint32 *minor_status, 117c19800e8SDoug Rabson const gss_channel_bindings_t input_chan_bindings, 118c19800e8SDoug Rabson OM_uint32 flags, 119c19800e8SDoug Rabson const krb5_data *fwd_data, 120c19800e8SDoug Rabson Checksum *result) 121c19800e8SDoug Rabson { 122c19800e8SDoug Rabson u_char *p; 123c19800e8SDoug Rabson 124c19800e8SDoug Rabson /* 125c19800e8SDoug Rabson * see rfc1964 (section 1.1.1 (Initial Token), and the checksum value 126c19800e8SDoug Rabson * field's format) */ 127c19800e8SDoug Rabson result->cksumtype = CKSUMTYPE_GSSAPI; 128c19800e8SDoug Rabson if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG)) 129c19800e8SDoug Rabson result->checksum.length = 24 + 4 + fwd_data->length; 130c19800e8SDoug Rabson else 131c19800e8SDoug Rabson result->checksum.length = 24; 132c19800e8SDoug Rabson result->checksum.data = malloc (result->checksum.length); 133c19800e8SDoug Rabson if (result->checksum.data == NULL) { 134c19800e8SDoug Rabson *minor_status = ENOMEM; 135c19800e8SDoug Rabson return GSS_S_FAILURE; 136c19800e8SDoug Rabson } 137c19800e8SDoug Rabson 138c19800e8SDoug Rabson p = result->checksum.data; 139c19800e8SDoug Rabson _gsskrb5_encode_om_uint32 (16, p); 140c19800e8SDoug Rabson p += 4; 141c19800e8SDoug Rabson if (input_chan_bindings == GSS_C_NO_CHANNEL_BINDINGS) { 142c19800e8SDoug Rabson memset (p, 0, 16); 143c19800e8SDoug Rabson } else { 144c19800e8SDoug Rabson hash_input_chan_bindings (input_chan_bindings, p); 145c19800e8SDoug Rabson } 146c19800e8SDoug Rabson p += 16; 147c19800e8SDoug Rabson _gsskrb5_encode_om_uint32 (flags, p); 148c19800e8SDoug Rabson p += 4; 149c19800e8SDoug Rabson 150c19800e8SDoug Rabson if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG)) { 151c19800e8SDoug Rabson 152c19800e8SDoug Rabson *p++ = (1 >> 0) & 0xFF; /* DlgOpt */ /* == 1 */ 153c19800e8SDoug Rabson *p++ = (1 >> 8) & 0xFF; /* DlgOpt */ /* == 0 */ 154c19800e8SDoug Rabson *p++ = (fwd_data->length >> 0) & 0xFF; /* Dlgth */ 155c19800e8SDoug Rabson *p++ = (fwd_data->length >> 8) & 0xFF; /* Dlgth */ 156c19800e8SDoug Rabson memcpy(p, (unsigned char *) fwd_data->data, fwd_data->length); 157c19800e8SDoug Rabson 158c19800e8SDoug Rabson p += fwd_data->length; 159c19800e8SDoug Rabson } 160c19800e8SDoug Rabson 161c19800e8SDoug Rabson return GSS_S_COMPLETE; 162c19800e8SDoug Rabson } 163c19800e8SDoug Rabson 164c19800e8SDoug Rabson /* 165c19800e8SDoug Rabson * verify the checksum in `cksum' over `input_chan_bindings' 166c19800e8SDoug Rabson * returning `flags' and `fwd_data' 167c19800e8SDoug Rabson */ 168c19800e8SDoug Rabson 169c19800e8SDoug Rabson OM_uint32 170c19800e8SDoug Rabson _gsskrb5_verify_8003_checksum( 171c19800e8SDoug Rabson OM_uint32 *minor_status, 172c19800e8SDoug Rabson const gss_channel_bindings_t input_chan_bindings, 173c19800e8SDoug Rabson const Checksum *cksum, 174c19800e8SDoug Rabson OM_uint32 *flags, 175c19800e8SDoug Rabson krb5_data *fwd_data) 176c19800e8SDoug Rabson { 177c19800e8SDoug Rabson unsigned char hash[16]; 178c19800e8SDoug Rabson unsigned char *p; 179c19800e8SDoug Rabson OM_uint32 length; 180c19800e8SDoug Rabson int DlgOpt; 181c19800e8SDoug Rabson static unsigned char zeros[16]; 182c19800e8SDoug Rabson 183c19800e8SDoug Rabson if (cksum == NULL) { 184c19800e8SDoug Rabson *minor_status = 0; 185c19800e8SDoug Rabson return GSS_S_BAD_BINDINGS; 186c19800e8SDoug Rabson } 187c19800e8SDoug Rabson 188c19800e8SDoug Rabson /* XXX should handle checksums > 24 bytes */ 189c19800e8SDoug Rabson if(cksum->cksumtype != CKSUMTYPE_GSSAPI || cksum->checksum.length < 24) { 190c19800e8SDoug Rabson *minor_status = 0; 191c19800e8SDoug Rabson return GSS_S_BAD_BINDINGS; 192c19800e8SDoug Rabson } 193c19800e8SDoug Rabson 194c19800e8SDoug Rabson p = cksum->checksum.data; 195c19800e8SDoug Rabson _gsskrb5_decode_om_uint32(p, &length); 196c19800e8SDoug Rabson if(length != sizeof(hash)) { 197c19800e8SDoug Rabson *minor_status = 0; 198c19800e8SDoug Rabson return GSS_S_BAD_BINDINGS; 199c19800e8SDoug Rabson } 200c19800e8SDoug Rabson 201c19800e8SDoug Rabson p += 4; 202c19800e8SDoug Rabson 203c19800e8SDoug Rabson if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS 204c19800e8SDoug Rabson && memcmp(p, zeros, sizeof(zeros)) != 0) { 205c19800e8SDoug Rabson if(hash_input_chan_bindings(input_chan_bindings, hash) != 0) { 206c19800e8SDoug Rabson *minor_status = 0; 207c19800e8SDoug Rabson return GSS_S_BAD_BINDINGS; 208c19800e8SDoug Rabson } 209c19800e8SDoug Rabson if(memcmp(hash, p, sizeof(hash)) != 0) { 210c19800e8SDoug Rabson *minor_status = 0; 211c19800e8SDoug Rabson return GSS_S_BAD_BINDINGS; 212c19800e8SDoug Rabson } 213c19800e8SDoug Rabson } 214c19800e8SDoug Rabson 215c19800e8SDoug Rabson p += sizeof(hash); 216c19800e8SDoug Rabson 217c19800e8SDoug Rabson _gsskrb5_decode_om_uint32(p, flags); 218c19800e8SDoug Rabson p += 4; 219c19800e8SDoug Rabson 220c19800e8SDoug Rabson if (cksum->checksum.length > 24 && (*flags & GSS_C_DELEG_FLAG)) { 221c19800e8SDoug Rabson if(cksum->checksum.length < 28) { 222c19800e8SDoug Rabson *minor_status = 0; 223c19800e8SDoug Rabson return GSS_S_BAD_BINDINGS; 224c19800e8SDoug Rabson } 225c19800e8SDoug Rabson 226c19800e8SDoug Rabson DlgOpt = (p[0] << 0) | (p[1] << 8); 227c19800e8SDoug Rabson p += 2; 228c19800e8SDoug Rabson if (DlgOpt != 1) { 229c19800e8SDoug Rabson *minor_status = 0; 230c19800e8SDoug Rabson return GSS_S_BAD_BINDINGS; 231c19800e8SDoug Rabson } 232c19800e8SDoug Rabson 233c19800e8SDoug Rabson fwd_data->length = (p[0] << 0) | (p[1] << 8); 234c19800e8SDoug Rabson p += 2; 235c19800e8SDoug Rabson if(cksum->checksum.length < 28 + fwd_data->length) { 236c19800e8SDoug Rabson *minor_status = 0; 237c19800e8SDoug Rabson return GSS_S_BAD_BINDINGS; 238c19800e8SDoug Rabson } 239c19800e8SDoug Rabson fwd_data->data = malloc(fwd_data->length); 240c19800e8SDoug Rabson if (fwd_data->data == NULL) { 241c19800e8SDoug Rabson *minor_status = ENOMEM; 242c19800e8SDoug Rabson return GSS_S_FAILURE; 243c19800e8SDoug Rabson } 244c19800e8SDoug Rabson memcpy(fwd_data->data, p, fwd_data->length); 245c19800e8SDoug Rabson } 246c19800e8SDoug Rabson 247c19800e8SDoug Rabson return GSS_S_COMPLETE; 248c19800e8SDoug Rabson } 249