17c478bd9Sstevel@tonic-gate /*
2*159d09a2SMark Phalan * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
37c478bd9Sstevel@tonic-gate * Use is subject to license terms.
47c478bd9Sstevel@tonic-gate */
57c478bd9Sstevel@tonic-gate
67c478bd9Sstevel@tonic-gate
77c478bd9Sstevel@tonic-gate /*
87c478bd9Sstevel@tonic-gate * lib/krb5/krb/mk_safe.c
97c478bd9Sstevel@tonic-gate *
107c478bd9Sstevel@tonic-gate * Copyright 1990,1991 by the Massachusetts Institute of Technology.
117c478bd9Sstevel@tonic-gate * All Rights Reserved.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may
147c478bd9Sstevel@tonic-gate * require a specific license from the United States Government.
157c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating
167c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting.
177c478bd9Sstevel@tonic-gate *
187c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
197c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
207c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
217c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
227c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
237c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
247c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior
257c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label
267c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a
277c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
287c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of
297c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
307c478bd9Sstevel@tonic-gate * or implied warranty.
317c478bd9Sstevel@tonic-gate *
327c478bd9Sstevel@tonic-gate *
337c478bd9Sstevel@tonic-gate * krb5_mk_safe()
347c478bd9Sstevel@tonic-gate */
357c478bd9Sstevel@tonic-gate
36*159d09a2SMark Phalan #include "k5-int.h"
377c478bd9Sstevel@tonic-gate #include "cleanup.h"
38*159d09a2SMark Phalan #include "auth_con.h"
397c478bd9Sstevel@tonic-gate
407c478bd9Sstevel@tonic-gate #ifdef KRB5_DEBUG
417c478bd9Sstevel@tonic-gate #include <sys/types.h>
427c478bd9Sstevel@tonic-gate #include <sys/socket.h>
437c478bd9Sstevel@tonic-gate #include <netinet/in.h>
447c478bd9Sstevel@tonic-gate #include <arpa/inet.h>
457c478bd9Sstevel@tonic-gate #endif
467c478bd9Sstevel@tonic-gate
477c478bd9Sstevel@tonic-gate /*
487c478bd9Sstevel@tonic-gate Formats a KRB_SAFE message into outbuf.
497c478bd9Sstevel@tonic-gate
507c478bd9Sstevel@tonic-gate userdata is formatted as the user data in the message.
517c478bd9Sstevel@tonic-gate sumtype specifies the encryption type; key specifies the key which
527c478bd9Sstevel@tonic-gate might be used to seed the checksum; sender_addr and recv_addr specify
537c478bd9Sstevel@tonic-gate the full addresses (host and port) of the sender and receiver.
547c478bd9Sstevel@tonic-gate The host portion of sender_addr is used to form the addresses used in the
557c478bd9Sstevel@tonic-gate KRB_SAFE message.
567c478bd9Sstevel@tonic-gate
577c478bd9Sstevel@tonic-gate The outbuf buffer storage is allocated, and should be freed by the
587c478bd9Sstevel@tonic-gate caller when finished.
597c478bd9Sstevel@tonic-gate
607c478bd9Sstevel@tonic-gate returns system errors
617c478bd9Sstevel@tonic-gate */
627c478bd9Sstevel@tonic-gate /*ARGSUSED*/
637c478bd9Sstevel@tonic-gate static krb5_error_code
krb5_mk_safe_basic(krb5_context context,const krb5_data * userdata,const krb5_keyblock * keyblock,krb5_replay_data * replaydata,krb5_address * local_addr,krb5_address * remote_addr,krb5_cksumtype sumtype,krb5_data * outbuf)64*159d09a2SMark Phalan krb5_mk_safe_basic(krb5_context context, const krb5_data *userdata,
65*159d09a2SMark Phalan const krb5_keyblock *keyblock, krb5_replay_data *replaydata,
66*159d09a2SMark Phalan krb5_address *local_addr, krb5_address *remote_addr,
67*159d09a2SMark Phalan krb5_cksumtype sumtype, krb5_data *outbuf)
687c478bd9Sstevel@tonic-gate {
697c478bd9Sstevel@tonic-gate krb5_error_code retval;
707c478bd9Sstevel@tonic-gate krb5_safe safemsg;
717c478bd9Sstevel@tonic-gate krb5_octet zero_octet = 0;
727c478bd9Sstevel@tonic-gate krb5_checksum safe_checksum;
737c478bd9Sstevel@tonic-gate krb5_data *scratch1, *scratch2;
747c478bd9Sstevel@tonic-gate
75*159d09a2SMark Phalan /* Solaris Kerberos */
767c478bd9Sstevel@tonic-gate KRB5_LOG0(KRB5_INFO, "krb5_mk_safe_basic() start");
777c478bd9Sstevel@tonic-gate
787c478bd9Sstevel@tonic-gate if (!krb5_c_valid_cksumtype(sumtype))
797c478bd9Sstevel@tonic-gate return KRB5_PROG_SUMTYPE_NOSUPP;
80*159d09a2SMark Phalan if (!krb5_c_is_coll_proof_cksum(sumtype)
81*159d09a2SMark Phalan || !krb5_c_is_keyed_cksum(sumtype))
827c478bd9Sstevel@tonic-gate return KRB5KRB_AP_ERR_INAPP_CKSUM;
837c478bd9Sstevel@tonic-gate
847c478bd9Sstevel@tonic-gate safemsg.user_data = *userdata;
857c478bd9Sstevel@tonic-gate safemsg.s_address = (krb5_address *) local_addr;
867c478bd9Sstevel@tonic-gate safemsg.r_address = (krb5_address *) remote_addr;
877c478bd9Sstevel@tonic-gate
887c478bd9Sstevel@tonic-gate /* We should check too make sure one exists. */
897c478bd9Sstevel@tonic-gate safemsg.timestamp = replaydata->timestamp;
907c478bd9Sstevel@tonic-gate safemsg.usec = replaydata->usec;
917c478bd9Sstevel@tonic-gate safemsg.seq_number = replaydata->seq;
927c478bd9Sstevel@tonic-gate
937c478bd9Sstevel@tonic-gate /*
947c478bd9Sstevel@tonic-gate * To do the checksum stuff, we need to encode the message with a
957c478bd9Sstevel@tonic-gate * zero-length zero-type checksum, then checksum the encoding, then
967c478bd9Sstevel@tonic-gate * re-encode with the checksum.
977c478bd9Sstevel@tonic-gate */
987c478bd9Sstevel@tonic-gate
997c478bd9Sstevel@tonic-gate safe_checksum.length = 0;
1007c478bd9Sstevel@tonic-gate safe_checksum.checksum_type = 0;
1017c478bd9Sstevel@tonic-gate safe_checksum.contents = &zero_octet;
1027c478bd9Sstevel@tonic-gate
1037c478bd9Sstevel@tonic-gate safemsg.checksum = &safe_checksum;
1047c478bd9Sstevel@tonic-gate
105*159d09a2SMark Phalan /* Solaris Kerberos */
1067c478bd9Sstevel@tonic-gate if ((retval = encode_krb5_safe(&safemsg, &scratch1))){
1077c478bd9Sstevel@tonic-gate KRB5_LOG(KRB5_ERR, "krb5_mk_safe_basic() end, error retval=%d", retval);
1087c478bd9Sstevel@tonic-gate return retval;
1097c478bd9Sstevel@tonic-gate }
1107c478bd9Sstevel@tonic-gate
111*159d09a2SMark Phalan /* Solaris Kerberos */
1127c478bd9Sstevel@tonic-gate if ((retval = krb5_c_make_checksum(context, sumtype, keyblock,
1137c478bd9Sstevel@tonic-gate KRB5_KEYUSAGE_KRB_SAFE_CKSUM,
1147c478bd9Sstevel@tonic-gate scratch1, &safe_checksum)) != 0){
1157c478bd9Sstevel@tonic-gate KRB5_LOG(KRB5_ERR, "krb5_mk_safe_basic() error retval=%d", retval);
1167c478bd9Sstevel@tonic-gate goto cleanup_checksum;
1177c478bd9Sstevel@tonic-gate }
1187c478bd9Sstevel@tonic-gate
1197c478bd9Sstevel@tonic-gate safemsg.checksum = &safe_checksum;
120*159d09a2SMark Phalan
121*159d09a2SMark Phalan /* Solaris Kerberos */
1227c478bd9Sstevel@tonic-gate if ((retval = encode_krb5_safe(&safemsg, &scratch2))) {
1237c478bd9Sstevel@tonic-gate KRB5_LOG(KRB5_ERR, "krb5_mk_safe_basic() error retval=%d", retval);
1247c478bd9Sstevel@tonic-gate goto cleanup_checksum;
1257c478bd9Sstevel@tonic-gate }
1267c478bd9Sstevel@tonic-gate *outbuf = *scratch2;
1277c478bd9Sstevel@tonic-gate krb5_xfree(scratch2);
1287c478bd9Sstevel@tonic-gate retval = 0;
1297c478bd9Sstevel@tonic-gate
1307c478bd9Sstevel@tonic-gate cleanup_checksum:
1317c478bd9Sstevel@tonic-gate krb5_xfree(safe_checksum.contents);
1327c478bd9Sstevel@tonic-gate
1337c478bd9Sstevel@tonic-gate memset((char *)scratch1->data, 0, scratch1->length);
1347c478bd9Sstevel@tonic-gate krb5_free_data(context, scratch1);
135*159d09a2SMark Phalan /* Solaris Kerberos */
1367c478bd9Sstevel@tonic-gate KRB5_LOG(KRB5_INFO, "krb5_mk_safe_basic() end, retval=%d", retval);
1377c478bd9Sstevel@tonic-gate return retval;
1387c478bd9Sstevel@tonic-gate }
1397c478bd9Sstevel@tonic-gate
1407c478bd9Sstevel@tonic-gate krb5_error_code KRB5_CALLCONV
krb5_mk_safe(krb5_context context,krb5_auth_context auth_context,const krb5_data * userdata,krb5_data * outbuf,krb5_replay_data * outdata)141*159d09a2SMark Phalan krb5_mk_safe(krb5_context context, krb5_auth_context auth_context, const krb5_data *userdata, krb5_data *outbuf, krb5_replay_data *outdata)
1427c478bd9Sstevel@tonic-gate {
1437c478bd9Sstevel@tonic-gate krb5_error_code retval;
1447c478bd9Sstevel@tonic-gate krb5_keyblock * keyblock;
1457c478bd9Sstevel@tonic-gate krb5_replay_data replaydata;
1467c478bd9Sstevel@tonic-gate
147*159d09a2SMark Phalan /* Solaris Kerberos */
1487c478bd9Sstevel@tonic-gate KRB5_LOG0(KRB5_INFO, "krb5_mk_safe() start");
1497c478bd9Sstevel@tonic-gate
1507c478bd9Sstevel@tonic-gate /* Clear replaydata block */
1517c478bd9Sstevel@tonic-gate memset((char *) &replaydata, 0, sizeof(krb5_replay_data));
1527c478bd9Sstevel@tonic-gate
1537c478bd9Sstevel@tonic-gate /* Get keyblock */
1547c478bd9Sstevel@tonic-gate if ((keyblock = auth_context->send_subkey) == NULL)
1557c478bd9Sstevel@tonic-gate keyblock = auth_context->keyblock;
1567c478bd9Sstevel@tonic-gate
1577c478bd9Sstevel@tonic-gate /* Get replay info */
158*159d09a2SMark Phalan /* Solaris Kerberos */
1597c478bd9Sstevel@tonic-gate if ((auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_TIME) &&
1607c478bd9Sstevel@tonic-gate (auth_context->rcache == NULL)){
1617c478bd9Sstevel@tonic-gate KRB5_LOG(KRB5_ERR, "krb5_mk_safe() end error retval=%d", KRB5_RC_REQUIRED);
1627c478bd9Sstevel@tonic-gate return KRB5_RC_REQUIRED;
1637c478bd9Sstevel@tonic-gate }
1647c478bd9Sstevel@tonic-gate
1657c478bd9Sstevel@tonic-gate if (((auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_TIME) ||
1667c478bd9Sstevel@tonic-gate (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_SEQUENCE)) &&
1677c478bd9Sstevel@tonic-gate (outdata == NULL)){
1687c478bd9Sstevel@tonic-gate /* Need a better error */
169*159d09a2SMark Phalan /* Solaris Kerberos */
1707c478bd9Sstevel@tonic-gate KRB5_LOG(KRB5_ERR, "krb5_mk_safe() end error retval=%d", KRB5_RC_REQUIRED);
1717c478bd9Sstevel@tonic-gate return KRB5_RC_REQUIRED;
1727c478bd9Sstevel@tonic-gate }
1737c478bd9Sstevel@tonic-gate
1747c478bd9Sstevel@tonic-gate if ((auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_TIME) ||
1757c478bd9Sstevel@tonic-gate (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_TIME)) {
1767c478bd9Sstevel@tonic-gate if ((retval = krb5_us_timeofday(context, &replaydata.timestamp,
1777c478bd9Sstevel@tonic-gate &replaydata.usec))){
178*159d09a2SMark Phalan /* Solaris Kerberos */
1797c478bd9Sstevel@tonic-gate KRB5_LOG(KRB5_ERR, "krb5_mk_safe() end error retval=%d", retval);
1807c478bd9Sstevel@tonic-gate return retval;
1817c478bd9Sstevel@tonic-gate }
1827c478bd9Sstevel@tonic-gate if (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_TIME) {
1837c478bd9Sstevel@tonic-gate outdata->timestamp = replaydata.timestamp;
1847c478bd9Sstevel@tonic-gate outdata->usec = replaydata.usec;
1857c478bd9Sstevel@tonic-gate }
1867c478bd9Sstevel@tonic-gate }
1877c478bd9Sstevel@tonic-gate if ((auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) ||
1887c478bd9Sstevel@tonic-gate (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_SEQUENCE)) {
1897c478bd9Sstevel@tonic-gate replaydata.seq = auth_context->local_seq_number++;
1907c478bd9Sstevel@tonic-gate if (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_SEQUENCE) {
1917c478bd9Sstevel@tonic-gate outdata->seq = replaydata.seq;
1927c478bd9Sstevel@tonic-gate }
1937c478bd9Sstevel@tonic-gate }
1947c478bd9Sstevel@tonic-gate
1957c478bd9Sstevel@tonic-gate {
1967c478bd9Sstevel@tonic-gate krb5_address * premote_fulladdr = NULL;
1977c478bd9Sstevel@tonic-gate krb5_address * plocal_fulladdr = NULL;
1987c478bd9Sstevel@tonic-gate krb5_address remote_fulladdr;
1997c478bd9Sstevel@tonic-gate krb5_address local_fulladdr;
2007c478bd9Sstevel@tonic-gate krb5_cksumtype sumtype;
2017c478bd9Sstevel@tonic-gate
2027c478bd9Sstevel@tonic-gate CLEANUP_INIT(2);
2037c478bd9Sstevel@tonic-gate
2047c478bd9Sstevel@tonic-gate if (auth_context->local_addr) {
2057c478bd9Sstevel@tonic-gate if (auth_context->local_port) {
2067c478bd9Sstevel@tonic-gate if (!(retval = krb5_make_fulladdr(context, auth_context->local_addr,
2077c478bd9Sstevel@tonic-gate auth_context->local_port,
2087c478bd9Sstevel@tonic-gate &local_fulladdr))){
2097c478bd9Sstevel@tonic-gate CLEANUP_PUSH(local_fulladdr.contents, free);
2107c478bd9Sstevel@tonic-gate plocal_fulladdr = &local_fulladdr;
2117c478bd9Sstevel@tonic-gate } else {
2127c478bd9Sstevel@tonic-gate goto error;
2137c478bd9Sstevel@tonic-gate }
2147c478bd9Sstevel@tonic-gate } else {
2157c478bd9Sstevel@tonic-gate plocal_fulladdr = auth_context->local_addr;
2167c478bd9Sstevel@tonic-gate }
2177c478bd9Sstevel@tonic-gate
2187c478bd9Sstevel@tonic-gate }
2197c478bd9Sstevel@tonic-gate
2207c478bd9Sstevel@tonic-gate if (auth_context->remote_addr) {
2217c478bd9Sstevel@tonic-gate if (auth_context->remote_port) {
2227c478bd9Sstevel@tonic-gate if (!(retval = krb5_make_fulladdr(context,auth_context->remote_addr,
2237c478bd9Sstevel@tonic-gate auth_context->remote_port,
2247c478bd9Sstevel@tonic-gate &remote_fulladdr))){
2257c478bd9Sstevel@tonic-gate CLEANUP_PUSH(remote_fulladdr.contents, free);
2267c478bd9Sstevel@tonic-gate premote_fulladdr = &remote_fulladdr;
2277c478bd9Sstevel@tonic-gate } else {
2287c478bd9Sstevel@tonic-gate CLEANUP_DONE();
2297c478bd9Sstevel@tonic-gate goto error;
2307c478bd9Sstevel@tonic-gate }
2317c478bd9Sstevel@tonic-gate } else {
2327c478bd9Sstevel@tonic-gate premote_fulladdr = auth_context->remote_addr;
2337c478bd9Sstevel@tonic-gate }
2347c478bd9Sstevel@tonic-gate }
2357c478bd9Sstevel@tonic-gate
2367c478bd9Sstevel@tonic-gate {
2377c478bd9Sstevel@tonic-gate unsigned int nsumtypes;
2387c478bd9Sstevel@tonic-gate unsigned int i;
2397c478bd9Sstevel@tonic-gate krb5_cksumtype *sumtypes;
2407c478bd9Sstevel@tonic-gate retval = krb5_c_keyed_checksum_types (context, keyblock->enctype,
2417c478bd9Sstevel@tonic-gate &nsumtypes, &sumtypes);
2427c478bd9Sstevel@tonic-gate if (retval) {
2437c478bd9Sstevel@tonic-gate CLEANUP_DONE ();
2447c478bd9Sstevel@tonic-gate goto error;
2457c478bd9Sstevel@tonic-gate }
2467c478bd9Sstevel@tonic-gate if (nsumtypes == 0) {
2477c478bd9Sstevel@tonic-gate retval = KRB5_BAD_ENCTYPE;
2487c478bd9Sstevel@tonic-gate krb5_free_cksumtypes (context, sumtypes);
2497c478bd9Sstevel@tonic-gate CLEANUP_DONE ();
2507c478bd9Sstevel@tonic-gate goto error;
2517c478bd9Sstevel@tonic-gate }
2527c478bd9Sstevel@tonic-gate for (i = 0; i < nsumtypes; i++)
2537c478bd9Sstevel@tonic-gate if (auth_context->safe_cksumtype == sumtypes[i])
2547c478bd9Sstevel@tonic-gate break;
2557c478bd9Sstevel@tonic-gate if (i == nsumtypes)
2567c478bd9Sstevel@tonic-gate i = 0;
2577c478bd9Sstevel@tonic-gate sumtype = sumtypes[i];
2587c478bd9Sstevel@tonic-gate krb5_free_cksumtypes (context, sumtypes);
2597c478bd9Sstevel@tonic-gate }
2607c478bd9Sstevel@tonic-gate if ((retval = krb5_mk_safe_basic(context, userdata, keyblock, &replaydata,
2617c478bd9Sstevel@tonic-gate plocal_fulladdr, premote_fulladdr,
2627c478bd9Sstevel@tonic-gate sumtype, outbuf))) {
2637c478bd9Sstevel@tonic-gate CLEANUP_DONE();
2647c478bd9Sstevel@tonic-gate goto error;
2657c478bd9Sstevel@tonic-gate }
2667c478bd9Sstevel@tonic-gate
2677c478bd9Sstevel@tonic-gate CLEANUP_DONE();
2687c478bd9Sstevel@tonic-gate }
2697c478bd9Sstevel@tonic-gate
2707c478bd9Sstevel@tonic-gate if (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_TIME) {
2717c478bd9Sstevel@tonic-gate krb5_donot_replay replay;
2727c478bd9Sstevel@tonic-gate
2737c478bd9Sstevel@tonic-gate if ((retval = krb5_gen_replay_name(context, auth_context->local_addr,
2747c478bd9Sstevel@tonic-gate "_safe", &replay.client))) {
2757c478bd9Sstevel@tonic-gate krb5_xfree(outbuf);
2767c478bd9Sstevel@tonic-gate goto error;
2777c478bd9Sstevel@tonic-gate }
2787c478bd9Sstevel@tonic-gate
2797c478bd9Sstevel@tonic-gate replay.server = ""; /* XXX */
2807c478bd9Sstevel@tonic-gate replay.cusec = replaydata.usec;
2817c478bd9Sstevel@tonic-gate replay.ctime = replaydata.timestamp;
282*159d09a2SMark Phalan /* Solaris Kerberos */
2837c478bd9Sstevel@tonic-gate if ((retval = krb5_rc_store(context, auth_context->rcache, &replay)) != 0) {
2847c478bd9Sstevel@tonic-gate /* should we really error out here? XXX */
2857c478bd9Sstevel@tonic-gate krb5_xfree(outbuf);
2867c478bd9Sstevel@tonic-gate goto error;
2877c478bd9Sstevel@tonic-gate }
2887c478bd9Sstevel@tonic-gate krb5_xfree(replay.client);
2897c478bd9Sstevel@tonic-gate }
290*159d09a2SMark Phalan /* Solaris Kerberos */
2917c478bd9Sstevel@tonic-gate KRB5_LOG0(KRB5_INFO, "krb5_mk_safe() end");
2927c478bd9Sstevel@tonic-gate return 0;
2937c478bd9Sstevel@tonic-gate
2947c478bd9Sstevel@tonic-gate error:
2957c478bd9Sstevel@tonic-gate if ((auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) ||
2967c478bd9Sstevel@tonic-gate (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_RET_SEQUENCE))
2977c478bd9Sstevel@tonic-gate auth_context->local_seq_number--;
2987c478bd9Sstevel@tonic-gate
299*159d09a2SMark Phalan /* Solaris Kerberos */
3007c478bd9Sstevel@tonic-gate KRB5_LOG(KRB5_ERR, "krb5_mk_safe() end error retval=%d", retval);
3017c478bd9Sstevel@tonic-gate return retval;
3027c478bd9Sstevel@tonic-gate }
303*159d09a2SMark Phalan
304