Back to index

glibc  2.9
svcauth_des.c
Go to the documentation of this file.
00001 /*
00002  * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
00003  * unrestricted use provided that this legend is included on all tape
00004  * media and as a part of the software program in whole or part.  Users
00005  * may copy or modify Sun RPC without charge, but are not authorized
00006  * to license or distribute it to anyone else except as part of a product or
00007  * program developed by the user.
00008  *
00009  * SUN RPC IS PROVIDED AS IS WITH NO WARRANTIES OF ANY KIND INCLUDING THE
00010  * WARRANTIES OF DESIGN, MERCHANTIBILITY AND FITNESS FOR A PARTICULAR
00011  * PURPOSE, OR ARISING FROM A COURSE OF DEALING, USAGE OR TRADE PRACTICE.
00012  *
00013  * Sun RPC is provided with no support and without any obligation on the
00014  * part of Sun Microsystems, Inc. to assist in its use, correction,
00015  * modification or enhancement.
00016  *
00017  * SUN MICROSYSTEMS, INC. SHALL HAVE NO LIABILITY WITH RESPECT TO THE
00018  * INFRINGEMENT OF COPYRIGHTS, TRADE SECRETS OR ANY PATENTS BY SUN RPC
00019  * OR ANY PART THEREOF.
00020  *
00021  * In no event will Sun Microsystems, Inc. be liable for any lost revenue
00022  * or profits or other special, indirect and consequential damages, even if
00023  * Sun has been advised of the possibility of such damages.
00024  *
00025  * Sun Microsystems, Inc.
00026  * 2550 Garcia Avenue
00027  * Mountain View, California  94043
00028  */
00029 /*
00030  * Copyright (c) 1988 by Sun Microsystems, Inc.
00031  */
00032 /*
00033  * svcauth_des.c, server-side des authentication
00034  *
00035  * We insure for the service the following:
00036  * (1) The timestamp microseconds do not exceed 1 million.
00037  * (2) The timestamp plus the window is less than the current time.
00038  * (3) The timestamp is not less than the one previously
00039  *     seen in the current session.
00040  *
00041  * It is up to the server to determine if the window size is
00042  * too small .
00043  *
00044  */
00045 
00046 #include <limits.h>
00047 #include <string.h>
00048 #include <sys/param.h>
00049 #include <netinet/in.h>
00050 #include <rpc/rpc.h>
00051 #include <rpc/xdr.h>
00052 #include <rpc/auth.h>
00053 #include <rpc/auth_des.h>
00054 #include <rpc/svc_auth.h>
00055 #include <rpc/svc.h>
00056 #include <rpc/des_crypt.h>
00057 
00058 #define debug(msg)          /*printf("svcauth_des: %s\n", msg) */
00059 
00060 #define USEC_PER_SEC ((uint32_t) 1000000L)
00061 #define BEFORE(t1, t2) timercmp(t1, t2, <)
00062 
00063 /*
00064  * LRU cache of conversation keys and some other useful items.
00065  */
00066 #define AUTHDES_CACHESZ 64
00067 struct cache_entry
00068   {
00069     des_block key;          /* conversation key */
00070     char *rname;            /* client's name */
00071     u_int window;           /* credential lifetime window */
00072     struct rpc_timeval laststamp;  /* detect replays of creds */
00073     char *localcred;        /* generic local credential */
00074   };
00075 #ifdef _RPC_THREAD_SAFE_
00076 #define authdes_cache RPC_THREAD_VARIABLE(authdes_cache_s)
00077 #define authdes_lru RPC_THREAD_VARIABLE(authdes_lru_s)
00078 #else
00079 static struct cache_entry *authdes_cache;
00080 static int *authdes_lru;
00081 #endif
00082 
00083 static void cache_init (void) internal_function; /* initialize the cache */
00084 static short cache_spot (des_block *, char *, struct rpc_timeval *)
00085      internal_function;            /* find an entry in the cache */
00086 static void cache_ref (uint32_t sid) internal_function;
00087                             /* note that sid was ref'd */
00088 
00089 static void invalidate (char *cred) internal_function;
00090                             /* invalidate entry in cache */
00091 
00092 /*
00093  * cache statistics
00094  */
00095 struct
00096   {
00097     u_long ncachehits;             /* times cache hit, and is not replay */
00098     u_long ncachereplays;   /* times cache hit, and is replay */
00099     u_long ncachemisses;    /* times cache missed */
00100   }
00101 svcauthdes_stats;
00102 
00103 /*
00104  * Service side authenticator for AUTH_DES
00105  */
00106 enum auth_stat
00107 _svcauth_des (register struct svc_req *rqst, register struct rpc_msg *msg)
00108 {
00109   register uint32_t *ixdr;
00110   des_block cryptbuf[2];
00111   register struct authdes_cred *cred;
00112   struct authdes_verf verf;
00113   int status;
00114   register struct cache_entry *entry;
00115   uint32_t sid = 0;
00116   des_block *sessionkey;
00117   des_block ivec;
00118   u_int window;
00119   struct rpc_timeval timestamp;
00120   uint32_t namelen;
00121   struct area
00122     {
00123       struct authdes_cred area_cred;
00124       char area_netname[MAXNETNAMELEN + 1];
00125     }
00126    *area;
00127 
00128   if (authdes_cache == NULL)
00129     cache_init ();
00130   if (authdes_cache == NULL) /* No free memory */
00131     return AUTH_FAILED;
00132 
00133   area = (struct area *) rqst->rq_clntcred;
00134   cred = (struct authdes_cred *) &area->area_cred;
00135 
00136   /*
00137    * Get the credential
00138    */
00139   if (msg->rm_call.cb_cred.oa_length <= 0 ||
00140       msg->rm_call.cb_cred.oa_length > MAX_AUTH_BYTES)
00141     return AUTH_BADCRED;
00142 
00143   ixdr = (uint32_t *) msg->rm_call.cb_cred.oa_base;
00144   cred->adc_namekind = IXDR_GET_ENUM (ixdr, enum authdes_namekind);
00145   switch (cred->adc_namekind)
00146     {
00147     case ADN_FULLNAME:
00148       namelen = IXDR_GET_U_INT32 (ixdr);
00149       if (namelen > MAXNETNAMELEN)
00150        {
00151          return AUTH_BADCRED;
00152        }
00153       cred->adc_fullname.name = area->area_netname;
00154       memcpy (cred->adc_fullname.name, (char *) ixdr, namelen);
00155       cred->adc_fullname.name[namelen] = 0;
00156       ixdr += (RNDUP (namelen) / BYTES_PER_XDR_UNIT);
00157       cred->adc_fullname.key.key.high = *ixdr++;
00158       cred->adc_fullname.key.key.low = *ixdr++;
00159       cred->adc_fullname.window = *ixdr++;
00160       break;
00161     case ADN_NICKNAME:
00162       cred->adc_nickname = *ixdr++;
00163       break;
00164     default:
00165       return AUTH_BADCRED;
00166     }
00167 
00168   /*
00169    * Get the verifier
00170    */
00171   if (msg->rm_call.cb_verf.oa_length <= 0 ||
00172       msg->rm_call.cb_verf.oa_length > MAX_AUTH_BYTES)
00173     return AUTH_BADCRED;
00174 
00175   ixdr = (uint32_t *) msg->rm_call.cb_verf.oa_base;
00176   verf.adv_xtimestamp.key.high = *ixdr++;
00177   verf.adv_xtimestamp.key.low = *ixdr++;
00178   verf.adv_int_u = *ixdr++;
00179 
00180   /*
00181    * Get the conversation key
00182    */
00183   if (cred->adc_namekind == ADN_FULLNAME)
00184     {
00185       netobj pkey;
00186       char pkey_data[1024];
00187 
00188       sessionkey = &cred->adc_fullname.key;
00189       if (!getpublickey (cred->adc_fullname.name, pkey_data))
00190        {
00191          debug("getpublickey");
00192          return AUTH_BADCRED;
00193        }
00194       pkey.n_bytes = pkey_data;
00195       pkey.n_len = strlen (pkey_data) + 1;
00196       if (key_decryptsession_pk (cred->adc_fullname.name, &pkey,
00197                              sessionkey) < 0)
00198        {
00199          debug ("decryptsessionkey");
00200          return AUTH_BADCRED;      /* key not found */
00201        }
00202     }
00203   else
00204     {                       /* ADN_NICKNAME */
00205       if (cred->adc_nickname >= AUTHDES_CACHESZ)
00206        {
00207          debug ("bad nickname");
00208          return AUTH_BADCRED;      /* garbled credential */
00209        }
00210       else
00211        sid = cred->adc_nickname;
00212 
00213       /* XXX This could be wrong, but else we have a
00214         security problem */
00215       if (authdes_cache[sid].rname == NULL)
00216        return AUTH_BADCRED;
00217       sessionkey = &authdes_cache[sid].key;
00218     }
00219 
00220 
00221   /*
00222    * Decrypt the timestamp
00223    */
00224   cryptbuf[0] = verf.adv_xtimestamp;
00225   if (cred->adc_namekind == ADN_FULLNAME)
00226     {
00227       cryptbuf[1].key.high = cred->adc_fullname.window;
00228       cryptbuf[1].key.low = verf.adv_winverf;
00229       ivec.key.high = ivec.key.low = 0;
00230       status = cbc_crypt ((char *) sessionkey, (char *) cryptbuf,
00231                        2 * sizeof (des_block), DES_DECRYPT | DES_HW,
00232                        (char *) &ivec);
00233     }
00234   else
00235     status = ecb_crypt ((char *) sessionkey, (char *) cryptbuf,
00236                      sizeof (des_block), DES_DECRYPT | DES_HW);
00237 
00238   if (DES_FAILED (status))
00239     {
00240       debug ("decryption failure");
00241       return AUTH_FAILED;   /* system error */
00242     }
00243 
00244   /*
00245    * XDR the decrypted timestamp
00246    */
00247   ixdr = (uint32_t *) cryptbuf;
00248   timestamp.tv_sec = IXDR_GET_INT32 (ixdr);
00249   timestamp.tv_usec = IXDR_GET_INT32 (ixdr);
00250 
00251   /*
00252    * Check for valid credentials and verifiers.
00253    * They could be invalid because the key was flushed
00254    * out of the cache, and so a new session should begin.
00255    * Be sure and send AUTH_REJECTED{CRED, VERF} if this is the case.
00256    */
00257   {
00258     struct timeval current;
00259     int nick;
00260     u_int winverf;
00261 
00262     if (cred->adc_namekind == ADN_FULLNAME)
00263       {
00264        short tmp_spot;
00265 
00266        window = IXDR_GET_U_INT32 (ixdr);
00267        winverf = IXDR_GET_U_INT32 (ixdr);
00268        if (winverf != window - 1)
00269          {
00270            debug ("window verifier mismatch");
00271            return AUTH_BADCRED;    /* garbled credential */
00272          }
00273        tmp_spot = cache_spot (sessionkey, cred->adc_fullname.name,
00274                             &timestamp);
00275        if (tmp_spot < 0 || tmp_spot > AUTHDES_CACHESZ)
00276          {
00277            debug ("replayed credential");
00278            return AUTH_REJECTEDCRED;             /* replay */
00279          }
00280        sid = tmp_spot;
00281        nick = 0;
00282       }
00283     else
00284       {                            /* ADN_NICKNAME */
00285        window = authdes_cache[sid].window;
00286        nick = 1;
00287       }
00288 
00289     if (timestamp.tv_usec >= USEC_PER_SEC)
00290       {
00291        debug ("invalid usecs");
00292        /* cached out (bad key), or garbled verifier */
00293        return nick ? AUTH_REJECTEDVERF : AUTH_BADVERF;
00294       }
00295     if (nick && BEFORE (&timestamp, &authdes_cache[sid].laststamp))
00296       {
00297        debug ("timestamp before last seen");
00298        return AUTH_REJECTEDVERF;   /* replay */
00299       }
00300     __gettimeofday (&current, (struct timezone *) NULL);
00301     current.tv_sec -= window;      /* allow for expiration */
00302     if (!BEFORE (&current, &timestamp))
00303       {
00304        debug ("timestamp expired");
00305        /* replay, or garbled credential */
00306        return nick ? AUTH_REJECTEDVERF : AUTH_BADCRED;
00307       }
00308   }
00309 
00310   /*
00311    * Set up the reply verifier
00312    */
00313   verf.adv_nickname = sid;
00314 
00315   /*
00316    * xdr the timestamp before encrypting
00317    */
00318   ixdr = (uint32_t *) cryptbuf;
00319   IXDR_PUT_INT32 (ixdr, timestamp.tv_sec - 1);
00320   IXDR_PUT_INT32 (ixdr, timestamp.tv_usec);
00321 
00322   /*
00323    * encrypt the timestamp
00324    */
00325   status = ecb_crypt ((char *) sessionkey, (char *) cryptbuf,
00326                     sizeof (des_block), DES_ENCRYPT | DES_HW);
00327   if (DES_FAILED (status))
00328     {
00329       debug ("encryption failure");
00330       return AUTH_FAILED;   /* system error */
00331     }
00332   verf.adv_xtimestamp = cryptbuf[0];
00333 
00334   /*
00335    * Serialize the reply verifier, and update rqst
00336    */
00337   ixdr = (uint32_t *) msg->rm_call.cb_verf.oa_base;
00338   *ixdr++ = verf.adv_xtimestamp.key.high;
00339   *ixdr++ = verf.adv_xtimestamp.key.low;
00340   *ixdr++ = verf.adv_int_u;
00341 
00342   rqst->rq_xprt->xp_verf.oa_flavor = AUTH_DES;
00343   rqst->rq_xprt->xp_verf.oa_base = msg->rm_call.cb_verf.oa_base;
00344   rqst->rq_xprt->xp_verf.oa_length =
00345     (char *) ixdr - msg->rm_call.cb_verf.oa_base;
00346 
00347   /*
00348    * We succeeded, commit the data to the cache now and
00349    * finish cooking the credential.
00350    */
00351   entry = &authdes_cache[sid];
00352   entry->laststamp = timestamp;
00353   cache_ref (sid);
00354   if (cred->adc_namekind == ADN_FULLNAME)
00355     {
00356       size_t full_len;
00357 
00358       cred->adc_fullname.window = window;
00359       cred->adc_nickname = sid;    /* save nickname */
00360       if (entry->rname != NULL)
00361        mem_free (entry->rname, strlen (entry->rname) + 1);
00362       full_len = strlen (cred->adc_fullname.name) + 1;
00363       entry->rname = mem_alloc ((u_int) full_len);
00364       if (entry->rname != NULL)
00365        memcpy (entry->rname, cred->adc_fullname.name, full_len);
00366       else
00367        {
00368          debug ("out of memory");
00369          return AUTH_FAILED; /* out of memory is bad */
00370        }
00371       entry->key = *sessionkey;
00372       entry->window = window;
00373       invalidate (entry->localcred);      /* mark any cached cred invalid */
00374     }
00375   else
00376     {                       /* ADN_NICKNAME */
00377       /*
00378        * nicknames are cooked into fullnames
00379        */
00380       cred->adc_namekind = ADN_FULLNAME;
00381       cred->adc_fullname.name = entry->rname;
00382       cred->adc_fullname.key = entry->key;
00383       cred->adc_fullname.window = entry->window;
00384     }
00385   return AUTH_OK;           /* we made it! */
00386 }
00387 
00388 
00389 /*
00390  * Initialize the cache
00391  */
00392 static void
00393 internal_function
00394 cache_init (void)
00395 {
00396   register int i;
00397 
00398   authdes_cache = (struct cache_entry *)
00399     calloc (sizeof (struct cache_entry) * AUTHDES_CACHESZ, 1);
00400   if (authdes_cache == NULL)
00401     return;
00402 
00403   authdes_lru = (int *) mem_alloc (sizeof (int) * AUTHDES_CACHESZ);
00404   /*
00405    * Initialize the lru list
00406    */
00407   for (i = 0; i < AUTHDES_CACHESZ; ++i)
00408     authdes_lru[i] = i;
00409 }
00410 
00411 
00412 /*
00413  * Find the lru victim
00414  */
00415 static short
00416 cache_victim (void)
00417 {
00418   return authdes_lru[AUTHDES_CACHESZ - 1];
00419 }
00420 
00421 /*
00422  * Note that sid was referenced
00423  */
00424 static void
00425 internal_function
00426 cache_ref (register uint32_t sid)
00427 {
00428   register int i;
00429   register int curr;
00430   register int prev;
00431 
00432   prev = authdes_lru[0];
00433   authdes_lru[0] = sid;
00434   for (i = 1; prev != sid; ++i)
00435     {
00436       curr = authdes_lru[i];
00437       authdes_lru[i] = prev;
00438       prev = curr;
00439     }
00440 }
00441 
00442 /*
00443  * Find a spot in the cache for a credential containing
00444  * the items given.  Return -1 if a replay is detected, otherwise
00445  * return the spot in the cache.
00446  */
00447 static short
00448 internal_function
00449 cache_spot (register des_block *key, char *name,
00450            struct rpc_timeval *timestamp)
00451 {
00452   register struct cache_entry *cp;
00453   register int i;
00454   register uint32_t hi;
00455 
00456   hi = key->key.high;
00457   for (cp = authdes_cache, i = 0; i < AUTHDES_CACHESZ; ++i, ++cp)
00458     {
00459       if (cp->key.key.high == hi &&
00460          cp->key.key.low == key->key.low &&
00461          cp->rname != NULL &&
00462          memcmp (cp->rname, name, strlen (name) + 1) == 0)
00463        {
00464          if (BEFORE (timestamp, &cp->laststamp))
00465            {
00466              ++svcauthdes_stats.ncachereplays;
00467              return -1;     /* replay */
00468            }
00469          ++svcauthdes_stats.ncachehits;
00470          return i;          /* refresh */
00471        }
00472     }
00473   ++svcauthdes_stats.ncachemisses;
00474   return cache_victim ();   /* new credential */
00475 }
00476 
00477 /*
00478  * Local credential handling stuff.
00479  * NOTE: bsd unix dependent.
00480  * Other operating systems should put something else here.
00481  */
00482 #define UNKNOWN      -2     /* grouplen, if cached cred is unknown user */
00483 #define INVALID             -1     /* grouplen, if cache entry is invalid */
00484 
00485 struct bsdcred
00486 {
00487   uid_t uid;                /* cached uid */
00488   gid_t gid;                /* cached gid */
00489   int grouplen;                    /* length of cached groups */
00490   int grouplen_max;         /* length of allocated cached groups */
00491   gid_t groups[0];          /* cached groups */
00492 };
00493 
00494 /*
00495  * Map a des credential into a unix cred.
00496  * We cache the credential here so the application does
00497  * not have to make an rpc call every time to interpret
00498  * the credential.
00499  */
00500 int
00501 authdes_getucred (const struct authdes_cred *adc, uid_t * uid, gid_t * gid,
00502                 short *grouplen, gid_t * groups)
00503 {
00504   unsigned sid;
00505   register int i;
00506   uid_t i_uid;
00507   gid_t i_gid;
00508   int i_grouplen;
00509   struct bsdcred *cred;
00510 
00511   sid = adc->adc_nickname;
00512   if (sid >= AUTHDES_CACHESZ)
00513     {
00514       debug ("invalid nickname");
00515       return 0;
00516     }
00517   cred = (struct bsdcred *) authdes_cache[sid].localcred;
00518   if (cred == NULL || cred->grouplen == INVALID)
00519     {
00520       /*
00521        * not in cache: lookup
00522        */
00523       if (!netname2user (adc->adc_fullname.name, &i_uid, &i_gid,
00524                       &i_grouplen, groups))
00525        {
00526          debug ("unknown netname");
00527          if (cred != NULL)
00528            cred->grouplen = UNKNOWN;      /* mark as lookup up, but not found */
00529          return 0;
00530        }
00531 
00532       if (cred != NULL && cred->grouplen_max < i_grouplen)
00533        {
00534          /* We already have an allocated data structure.  But it is
00535             too small.  */
00536          free (cred);
00537          authdes_cache[sid].localcred = NULL;
00538          cred = NULL;
00539        }
00540 
00541       if (cred == NULL)
00542        {
00543          /* We should allocate room for at least NGROUPS groups.  */
00544          int ngroups_max = MAX (i_grouplen, NGROUPS);
00545 
00546          cred = (struct bsdcred *) mem_alloc (sizeof (struct bsdcred)
00547                                           + ngroups_max * sizeof (gid_t));
00548          if (cred == NULL)
00549            return 0;
00550 
00551          authdes_cache[sid].localcred = (char *) cred;
00552          cred->grouplen = INVALID;
00553          cred->grouplen_max = ngroups_max;
00554        }
00555 
00556       debug ("missed ucred cache");
00557       *uid = cred->uid = i_uid;
00558       *gid = cred->gid = i_gid;
00559       cred->grouplen = i_grouplen;
00560       for (i = i_grouplen - 1; i >= 0; --i)
00561        cred->groups[i] = groups[i];
00562       /* Make sure no too large values are reported.  */
00563       *grouplen = MIN (SHRT_MAX, i_grouplen);
00564       return 1;
00565     }
00566   else if (cred->grouplen == UNKNOWN)
00567     {
00568       /*
00569        * Already lookup up, but no match found
00570        */
00571       return 0;
00572     }
00573 
00574   /*
00575    * cached credentials
00576    */
00577   *uid = cred->uid;
00578   *gid = cred->gid;
00579 
00580   /* Another stupidity in the interface: *grouplen is of type short.
00581      So we might have to cut the information passed up short.  */
00582   int grouplen_copy = MIN (SHRT_MAX, cred->grouplen);
00583   *grouplen = grouplen_copy;
00584   for (i = grouplen_copy - 1; i >= 0; --i)
00585     groups[i] = cred->groups[i];
00586   return 1;
00587 }
00588 
00589 static void
00590 internal_function
00591 invalidate (char *cred)
00592 {
00593   if (cred == NULL)
00594     return;
00595   ((struct bsdcred *) cred)->grouplen = INVALID;
00596 }