17c478bd9Sstevel@tonic-gate /*
2*159d09a2SMark Phalan * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
37c478bd9Sstevel@tonic-gate * Use is subject to license terms.
47c478bd9Sstevel@tonic-gate */
57c478bd9Sstevel@tonic-gate
67c478bd9Sstevel@tonic-gate
77c478bd9Sstevel@tonic-gate /*
87c478bd9Sstevel@tonic-gate * lib/krb5/krb/mk_priv.c
97c478bd9Sstevel@tonic-gate *
107c478bd9Sstevel@tonic-gate * Copyright 1990,1991 by the Massachusetts Institute of Technology.
117c478bd9Sstevel@tonic-gate * All Rights Reserved.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may
147c478bd9Sstevel@tonic-gate * require a specific license from the United States Government.
157c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating
167c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting.
177c478bd9Sstevel@tonic-gate *
187c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
197c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
207c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
217c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
227c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
237c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
247c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior
257c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label
267c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a
277c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
287c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of
297c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
307c478bd9Sstevel@tonic-gate * or implied warranty.
317c478bd9Sstevel@tonic-gate *
327c478bd9Sstevel@tonic-gate *
337c478bd9Sstevel@tonic-gate * krb5_mk_priv()
347c478bd9Sstevel@tonic-gate */
357c478bd9Sstevel@tonic-gate
36*159d09a2SMark Phalan #include "k5-int.h"
377c478bd9Sstevel@tonic-gate #include "cleanup.h"
38*159d09a2SMark Phalan #include "auth_con.h"
397c478bd9Sstevel@tonic-gate
407c478bd9Sstevel@tonic-gate /*ARGSUSED*/
417c478bd9Sstevel@tonic-gate static krb5_error_code
krb5_mk_priv_basic(krb5_context context,const krb5_data * userdata,const krb5_keyblock * keyblock,krb5_replay_data * replaydata,krb5_address * local_addr,krb5_address * remote_addr,krb5_pointer i_vector,krb5_data * outbuf)42*159d09a2SMark Phalan krb5_mk_priv_basic(krb5_context context, const krb5_data *userdata, const krb5_keyblock *keyblock, krb5_replay_data *replaydata, krb5_address *local_addr, krb5_address *remote_addr, krb5_pointer i_vector, krb5_data *outbuf)
437c478bd9Sstevel@tonic-gate {
447c478bd9Sstevel@tonic-gate krb5_error_code retval;
457c478bd9Sstevel@tonic-gate krb5_priv privmsg;
467c478bd9Sstevel@tonic-gate krb5_priv_enc_part privmsg_enc_part;
477c478bd9Sstevel@tonic-gate krb5_data *scratch1, *scratch2, ivdata;
487c478bd9Sstevel@tonic-gate size_t blocksize, enclen;
497c478bd9Sstevel@tonic-gate
507c478bd9Sstevel@tonic-gate privmsg.enc_part.kvno = 0; /* XXX allow user-set? */
517c478bd9Sstevel@tonic-gate privmsg.enc_part.enctype = keyblock->enctype;
527c478bd9Sstevel@tonic-gate
537c478bd9Sstevel@tonic-gate privmsg_enc_part.user_data = *userdata;
547c478bd9Sstevel@tonic-gate privmsg_enc_part.s_address = local_addr;
557c478bd9Sstevel@tonic-gate privmsg_enc_part.r_address = remote_addr;
567c478bd9Sstevel@tonic-gate
577c478bd9Sstevel@tonic-gate /* We should check too make sure one exists. */
587c478bd9Sstevel@tonic-gate privmsg_enc_part.timestamp = replaydata->timestamp;
597c478bd9Sstevel@tonic-gate privmsg_enc_part.usec = replaydata->usec;
607c478bd9Sstevel@tonic-gate privmsg_enc_part.seq_number = replaydata->seq;
617c478bd9Sstevel@tonic-gate
627c478bd9Sstevel@tonic-gate /* start by encoding to-be-encrypted part of the message */
637c478bd9Sstevel@tonic-gate if ((retval = encode_krb5_enc_priv_part(&privmsg_enc_part, &scratch1)))
647c478bd9Sstevel@tonic-gate return retval;
657c478bd9Sstevel@tonic-gate
667c478bd9Sstevel@tonic-gate /* put together an eblock for this encryption */
677c478bd9Sstevel@tonic-gate if ((retval = krb5_c_encrypt_length(context, keyblock->enctype,
687c478bd9Sstevel@tonic-gate scratch1->length, &enclen)))
697c478bd9Sstevel@tonic-gate goto clean_scratch;
707c478bd9Sstevel@tonic-gate
717c478bd9Sstevel@tonic-gate privmsg.enc_part.ciphertext.length = enclen;
727c478bd9Sstevel@tonic-gate if (!(privmsg.enc_part.ciphertext.data =
737c478bd9Sstevel@tonic-gate malloc(privmsg.enc_part.ciphertext.length))) {
747c478bd9Sstevel@tonic-gate retval = ENOMEM;
757c478bd9Sstevel@tonic-gate goto clean_scratch;
767c478bd9Sstevel@tonic-gate }
777c478bd9Sstevel@tonic-gate
787c478bd9Sstevel@tonic-gate /* call the encryption routine */
797c478bd9Sstevel@tonic-gate if (i_vector) {
807c478bd9Sstevel@tonic-gate if ((retval = krb5_c_block_size(context, keyblock->enctype,
817c478bd9Sstevel@tonic-gate &blocksize)))
827c478bd9Sstevel@tonic-gate goto clean_encpart;
837c478bd9Sstevel@tonic-gate
847c478bd9Sstevel@tonic-gate ivdata.length = blocksize;
857c478bd9Sstevel@tonic-gate ivdata.data = i_vector;
867c478bd9Sstevel@tonic-gate }
877c478bd9Sstevel@tonic-gate
88*159d09a2SMark Phalan if ((retval = krb5_c_encrypt(context, keyblock,
89*159d09a2SMark Phalan KRB5_KEYUSAGE_KRB_PRIV_ENCPART,
90*159d09a2SMark Phalan i_vector?&ivdata:0,
91*159d09a2SMark Phalan scratch1, &privmsg.enc_part)))
927c478bd9Sstevel@tonic-gate goto clean_encpart;
937c478bd9Sstevel@tonic-gate
94*159d09a2SMark Phalan if ((retval = encode_krb5_priv(&privmsg, &scratch2)))
957c478bd9Sstevel@tonic-gate goto clean_encpart;
967c478bd9Sstevel@tonic-gate
977c478bd9Sstevel@tonic-gate *outbuf = *scratch2;
987c478bd9Sstevel@tonic-gate krb5_xfree(scratch2);
997c478bd9Sstevel@tonic-gate retval = 0;
1007c478bd9Sstevel@tonic-gate
1017c478bd9Sstevel@tonic-gate clean_encpart:
1027c478bd9Sstevel@tonic-gate memset(privmsg.enc_part.ciphertext.data, 0,
1037c478bd9Sstevel@tonic-gate privmsg.enc_part.ciphertext.length);
1047c478bd9Sstevel@tonic-gate free(privmsg.enc_part.ciphertext.data);
1057c478bd9Sstevel@tonic-gate privmsg.enc_part.ciphertext.length = 0;
1067c478bd9Sstevel@tonic-gate privmsg.enc_part.ciphertext.data = 0;
1077c478bd9Sstevel@tonic-gate
1087c478bd9Sstevel@tonic-gate clean_scratch:
1097c478bd9Sstevel@tonic-gate memset(scratch1->data, 0, scratch1->length);
1107c478bd9Sstevel@tonic-gate krb5_free_data(context, scratch1);
1117c478bd9Sstevel@tonic-gate
1127c478bd9Sstevel@tonic-gate return retval;
1137c478bd9Sstevel@tonic-gate }
1147c478bd9Sstevel@tonic-gate
1157c478bd9Sstevel@tonic-gate
1167c478bd9Sstevel@tonic-gate krb5_error_code KRB5_CALLCONV
krb5_mk_priv(krb5_context context,krb5_auth_context auth_context,const krb5_data * userdata,krb5_data * outbuf,krb5_replay_data * outdata)117*159d09a2SMark Phalan krb5_mk_priv(krb5_context context, krb5_auth_context auth_context,
118*159d09a2SMark Phalan const krb5_data *userdata, krb5_data *outbuf,
119505d05c7Sgtb krb5_replay_data *outdata)
1207c478bd9Sstevel@tonic-gate {
1217c478bd9Sstevel@tonic-gate krb5_error_code retval;
1227c478bd9Sstevel@tonic-gate krb5_keyblock * keyblock;
1237c478bd9Sstevel@tonic-gate krb5_replay_data replaydata;
1247c478bd9Sstevel@tonic-gate
1257c478bd9Sstevel@tonic-gate /* Clear replaydata block */
1267c478bd9Sstevel@tonic-gate memset((char *) &replaydata, 0, sizeof(krb5_replay_data));
1277c478bd9Sstevel@tonic-gate
1287c478bd9Sstevel@tonic-gate /* Get keyblock */
1297c478bd9Sstevel@tonic-gate if ((keyblock = auth_context->send_subkey) == NULL)
1307c478bd9Sstevel@tonic-gate keyblock = auth_context->keyblock;
1317c478bd9Sstevel@tonic-gate
1327c478bd9Sstevel@tonic-gate /* Get replay info */
1337c478bd9Sstevel@tonic-gate if ((auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_TIME) &&
1347c478bd9Sstevel@tonic-gate (auth_context->rcache == NULL))
1357c478bd9Sstevel@tonic-gate return KRB5_RC_REQUIRED;
1367c478bd9Sstevel@tonic-gate
1377c478bd9Sstevel@tonic-gate if (((auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_TIME) ||
1387c478bd9Sstevel@tonic-gate (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_SEQUENCE)) &&
1397c478bd9Sstevel@tonic-gate (outdata == NULL))
1407c478bd9Sstevel@tonic-gate /* Need a better error */
1417c478bd9Sstevel@tonic-gate return KRB5_RC_REQUIRED;
1427c478bd9Sstevel@tonic-gate
1437c478bd9Sstevel@tonic-gate if ((auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_TIME) ||
1447c478bd9Sstevel@tonic-gate (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_TIME)) {
1457c478bd9Sstevel@tonic-gate if ((retval = krb5_us_timeofday(context, &replaydata.timestamp,
1467c478bd9Sstevel@tonic-gate &replaydata.usec)))
1477c478bd9Sstevel@tonic-gate return retval;
1487c478bd9Sstevel@tonic-gate if (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_TIME) {
1497c478bd9Sstevel@tonic-gate outdata->timestamp = replaydata.timestamp;
1507c478bd9Sstevel@tonic-gate outdata->usec = replaydata.usec;
1517c478bd9Sstevel@tonic-gate }
1527c478bd9Sstevel@tonic-gate }
1537c478bd9Sstevel@tonic-gate if ((auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) ||
1547c478bd9Sstevel@tonic-gate (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_SEQUENCE)) {
1557c478bd9Sstevel@tonic-gate replaydata.seq = auth_context->local_seq_number;
1567c478bd9Sstevel@tonic-gate if (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) {
1577c478bd9Sstevel@tonic-gate auth_context->local_seq_number++;
1587c478bd9Sstevel@tonic-gate } else {
1597c478bd9Sstevel@tonic-gate outdata->seq = replaydata.seq;
1607c478bd9Sstevel@tonic-gate }
1617c478bd9Sstevel@tonic-gate }
1627c478bd9Sstevel@tonic-gate
1637c478bd9Sstevel@tonic-gate {
1647c478bd9Sstevel@tonic-gate krb5_address * premote_fulladdr = NULL;
1657c478bd9Sstevel@tonic-gate krb5_address * plocal_fulladdr = NULL;
1667c478bd9Sstevel@tonic-gate krb5_address remote_fulladdr;
1677c478bd9Sstevel@tonic-gate krb5_address local_fulladdr;
1687c478bd9Sstevel@tonic-gate CLEANUP_INIT(2);
1697c478bd9Sstevel@tonic-gate
1707c478bd9Sstevel@tonic-gate if (auth_context->local_addr) {
1717c478bd9Sstevel@tonic-gate if (auth_context->local_port) {
1727c478bd9Sstevel@tonic-gate if (!(retval = krb5_make_fulladdr(context, auth_context->local_addr,
1737c478bd9Sstevel@tonic-gate auth_context->local_port,
1747c478bd9Sstevel@tonic-gate &local_fulladdr))) {
1757c478bd9Sstevel@tonic-gate CLEANUP_PUSH(local_fulladdr.contents, free);
1767c478bd9Sstevel@tonic-gate plocal_fulladdr = &local_fulladdr;
1777c478bd9Sstevel@tonic-gate } else {
1787c478bd9Sstevel@tonic-gate goto error;
1797c478bd9Sstevel@tonic-gate }
1807c478bd9Sstevel@tonic-gate } else {
1817c478bd9Sstevel@tonic-gate plocal_fulladdr = auth_context->local_addr;
1827c478bd9Sstevel@tonic-gate }
1837c478bd9Sstevel@tonic-gate }
1847c478bd9Sstevel@tonic-gate
1857c478bd9Sstevel@tonic-gate if (auth_context->remote_addr) {
1867c478bd9Sstevel@tonic-gate if (auth_context->remote_port) {
1877c478bd9Sstevel@tonic-gate if (!(retval = krb5_make_fulladdr(context,auth_context->remote_addr,
1887c478bd9Sstevel@tonic-gate auth_context->remote_port,
1897c478bd9Sstevel@tonic-gate &remote_fulladdr))){
1907c478bd9Sstevel@tonic-gate CLEANUP_PUSH(remote_fulladdr.contents, free);
1917c478bd9Sstevel@tonic-gate premote_fulladdr = &remote_fulladdr;
1927c478bd9Sstevel@tonic-gate } else {
1937c478bd9Sstevel@tonic-gate CLEANUP_DONE();
1947c478bd9Sstevel@tonic-gate goto error;
1957c478bd9Sstevel@tonic-gate }
1967c478bd9Sstevel@tonic-gate } else {
1977c478bd9Sstevel@tonic-gate premote_fulladdr = auth_context->remote_addr;
1987c478bd9Sstevel@tonic-gate }
1997c478bd9Sstevel@tonic-gate }
2007c478bd9Sstevel@tonic-gate
2017c478bd9Sstevel@tonic-gate if ((retval = krb5_mk_priv_basic(context, userdata, keyblock, &replaydata,
2027c478bd9Sstevel@tonic-gate plocal_fulladdr, premote_fulladdr,
2037c478bd9Sstevel@tonic-gate auth_context->i_vector, outbuf))) {
2047c478bd9Sstevel@tonic-gate CLEANUP_DONE();
2057c478bd9Sstevel@tonic-gate goto error;
2067c478bd9Sstevel@tonic-gate }
2077c478bd9Sstevel@tonic-gate
2087c478bd9Sstevel@tonic-gate CLEANUP_DONE();
2097c478bd9Sstevel@tonic-gate }
2107c478bd9Sstevel@tonic-gate
2117c478bd9Sstevel@tonic-gate if (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_TIME) {
2127c478bd9Sstevel@tonic-gate krb5_donot_replay replay;
2137c478bd9Sstevel@tonic-gate
2147c478bd9Sstevel@tonic-gate if ((retval = krb5_gen_replay_name(context, auth_context->local_addr,
2157c478bd9Sstevel@tonic-gate "_priv", &replay.client))) {
2167c478bd9Sstevel@tonic-gate krb5_xfree(outbuf);
2177c478bd9Sstevel@tonic-gate goto error;
2187c478bd9Sstevel@tonic-gate }
2197c478bd9Sstevel@tonic-gate
2207c478bd9Sstevel@tonic-gate replay.server = ""; /* XXX */
2217c478bd9Sstevel@tonic-gate replay.cusec = replaydata.usec;
2227c478bd9Sstevel@tonic-gate replay.ctime = replaydata.timestamp;
223*159d09a2SMark Phalan if ((retval = krb5_rc_store(context, auth_context->rcache, &replay))) {
2247c478bd9Sstevel@tonic-gate /* should we really error out here? XXX */
2257c478bd9Sstevel@tonic-gate krb5_xfree(replay.client);
2267c478bd9Sstevel@tonic-gate goto error;
2277c478bd9Sstevel@tonic-gate }
2287c478bd9Sstevel@tonic-gate krb5_xfree(replay.client);
2297c478bd9Sstevel@tonic-gate }
2307c478bd9Sstevel@tonic-gate
2317c478bd9Sstevel@tonic-gate return 0;
2327c478bd9Sstevel@tonic-gate
2337c478bd9Sstevel@tonic-gate error:
2347c478bd9Sstevel@tonic-gate if ((auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) ||
2357c478bd9Sstevel@tonic-gate (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_SEQUENCE))
2367c478bd9Sstevel@tonic-gate auth_context->local_seq_number--;
2377c478bd9Sstevel@tonic-gate
2387c478bd9Sstevel@tonic-gate return retval;
2397c478bd9Sstevel@tonic-gate }
240*159d09a2SMark Phalan
241