1 2/* 3 * Copyright (c) 1988 by Sun Microsystems, Inc. 4 */ 5 6/* 7 * Sun RPC is a product of Sun Microsystems, Inc. and is provided for 8 * unrestricted use provided that this legend is included on all tape 9 * media and as a part of the software program in whole or part. Users 10 * may copy or modify Sun RPC without charge, but are not authorized 11 * to license or distribute it to anyone else except as part of a product or 12 * program developed by the user. 13 * 14 * SUN RPC IS PROVIDED AS IS WITH NO WARRANTIES OF ANY KIND INCLUDING THE 15 * WARRANTIES OF DESIGN, MERCHANTIBILITY AND FITNESS FOR A PARTICULAR 16 * PURPOSE, OR ARISING FROM A COURSE OF DEALING, USAGE OR TRADE PRACTICE. 17 * 18 * Sun RPC is provided with no support and without any obligation on the 19 * part of Sun Microsystems, Inc. to assist in its use, correction, 20 * modification or enhancement. 21 * 22 * SUN MICROSYSTEMS, INC. SHALL HAVE NO LIABILITY WITH RESPECT TO THE 23 * INFRINGEMENT OF COPYRIGHTS, TRADE SECRETS OR ANY PATENTS BY SUN RPC 24 * OR ANY PART THEREOF. 25 * 26 * In no event will Sun Microsystems, Inc. be liable for any lost revenue 27 * or profits or other special, indirect and consequential damages, even if 28 * Sun has been advised of the possibility of such damages. 29 * 30 * Sun Microsystems, Inc. 31 * 2550 Garcia Avenue 32 * Mountain View, California 94043 33 */ 34 35/* 36 * svcauth_des.c, server-side des authentication 37 * 38 * We insure for the service the following: 39 * (1) The timestamp microseconds do not exceed 1 million. 40 * (2) The timestamp plus the window is less than the current time. 41 * (3) The timestamp is not less than the one previously 42 * seen in the current session. 43 * 44 * It is up to the server to determine if the window size is 45 * too small . 46 * 47 */ 48 49#include "namespace.h" 50#include "reentrant.h" 51#include <string.h> 52#include <stdlib.h> 53#include <stdio.h> 54#include <unistd.h> 55#include <rpc/des_crypt.h> 56#include <sys/param.h> 57#include <netinet/in.h> 58#include <rpc/types.h> 59#include <rpc/xdr.h> 60#include <rpc/auth.h> 61#include <rpc/auth_des.h> 62#include <rpc/svc.h> 63#include <rpc/rpc_msg.h> 64#include <rpc/svc_auth.h> 65#include "libc_private.h" 66 67#if defined(LIBC_SCCS) && !defined(lint) 68static char sccsid[] = "@(#)svcauth_des.c 2.3 89/07/11 4.0 RPCSRC; from 1.15 88/02/08 SMI"; 69#endif 70#include <sys/cdefs.h> 71__FBSDID("$FreeBSD$"); 72 73extern int key_decryptsession_pk(const char *, netobj *, des_block *); 74 75#define debug(msg) printf("svcauth_des: %s\n", msg) 76 77#define USEC_PER_SEC ((u_long) 1000000L) 78#define BEFORE(t1, t2) timercmp(t1, t2, <) 79 80/* 81 * LRU cache of conversation keys and some other useful items. 82 */ 83#define AUTHDES_CACHESZ 64 84struct cache_entry { 85 des_block key; /* conversation key */ 86 char *rname; /* client's name */ 87 u_int window; /* credential lifetime window */ 88 struct timeval laststamp; /* detect replays of creds */ 89 char *localcred; /* generic local credential */ 90}; 91static struct cache_entry *authdes_cache/* [AUTHDES_CACHESZ] */; 92static short *authdes_lru/* [AUTHDES_CACHESZ] */; 93 94static void cache_init(); /* initialize the cache */ 95static short cache_spot(); /* find an entry in the cache */ 96static void cache_ref(/*short sid*/); /* note that sid was ref'd */ 97 98static void invalidate(); /* invalidate entry in cache */ 99 100/* 101 * cache statistics 102 */ 103static struct { 104 u_long ncachehits; /* times cache hit, and is not replay */ 105 u_long ncachereplays; /* times cache hit, and is replay */ 106 u_long ncachemisses; /* times cache missed */ 107} svcauthdes_stats; 108 109/* 110 * Service side authenticator for AUTH_DES 111 */ 112enum auth_stat 113_svcauth_des(rqst, msg) 114 struct svc_req *rqst; 115 struct rpc_msg *msg; 116{ 117 118 long *ixdr; 119 des_block cryptbuf[2]; 120 struct authdes_cred *cred; 121 struct authdes_verf verf; 122 int status; 123 struct cache_entry *entry; 124 short sid = 0; 125 des_block *sessionkey; 126 des_block ivec; 127 u_int window; 128 struct timeval timestamp; 129 u_long namelen; 130 struct area { 131 struct authdes_cred area_cred; 132 char area_netname[MAXNETNAMELEN+1]; 133 } *area; 134 135 if (authdes_cache == NULL) { 136 cache_init(); 137 } 138 139 area = (struct area *)rqst->rq_clntcred; 140 cred = (struct authdes_cred *)&area->area_cred; 141 142 /* 143 * Get the credential 144 */ 145 ixdr = (long *)msg->rm_call.cb_cred.oa_base; 146 cred->adc_namekind = IXDR_GET_ENUM(ixdr, enum authdes_namekind); 147 switch (cred->adc_namekind) { 148 case ADN_FULLNAME: 149 namelen = IXDR_GET_U_LONG(ixdr); 150 if (namelen > MAXNETNAMELEN) { 151 return (AUTH_BADCRED); 152 } 153 cred->adc_fullname.name = area->area_netname; 154 bcopy((char *)ixdr, cred->adc_fullname.name, 155 (u_int)namelen); 156 cred->adc_fullname.name[namelen] = 0; 157 ixdr += (RNDUP(namelen) / BYTES_PER_XDR_UNIT); 158 cred->adc_fullname.key.key.high = (u_long)*ixdr++; 159 cred->adc_fullname.key.key.low = (u_long)*ixdr++; 160 cred->adc_fullname.window = (u_long)*ixdr++; 161 break; 162 case ADN_NICKNAME: 163 cred->adc_nickname = (u_long)*ixdr++; 164 break; 165 default: 166 return (AUTH_BADCRED); 167 } 168 169 /* 170 * Get the verifier 171 */ 172 ixdr = (long *)msg->rm_call.cb_verf.oa_base; 173 verf.adv_xtimestamp.key.high = (u_long)*ixdr++; 174 verf.adv_xtimestamp.key.low = (u_long)*ixdr++; 175 verf.adv_int_u = (u_long)*ixdr++; 176 177 178 /* 179 * Get the conversation key 180 */ 181 if (cred->adc_namekind == ADN_FULLNAME) { 182 netobj pkey; 183 char pkey_data[1024]; 184 185 sessionkey = &cred->adc_fullname.key; 186 if (! getpublickey(cred->adc_fullname.name, pkey_data)) { 187 debug("getpublickey"); 188 return(AUTH_BADCRED); 189 } 190 pkey.n_bytes = pkey_data; 191 pkey.n_len = strlen(pkey_data) + 1; 192 if (key_decryptsession_pk(cred->adc_fullname.name, &pkey, 193 sessionkey) < 0) { 194 debug("decryptsessionkey"); 195 return (AUTH_BADCRED); /* key not found */ 196 } 197 } else { /* ADN_NICKNAME */ 198 sid = (short)cred->adc_nickname; 199 if (sid < 0 || sid >= AUTHDES_CACHESZ) { 200 debug("bad nickname"); 201 return (AUTH_BADCRED); /* garbled credential */ 202 } 203 sessionkey = &authdes_cache[sid].key; 204 } 205 206 207 /* 208 * Decrypt the timestamp 209 */ 210 cryptbuf[0] = verf.adv_xtimestamp; 211 if (cred->adc_namekind == ADN_FULLNAME) { 212 cryptbuf[1].key.high = cred->adc_fullname.window; 213 cryptbuf[1].key.low = verf.adv_winverf; 214 ivec.key.high = ivec.key.low = 0; 215 status = cbc_crypt((char *)sessionkey, (char *)cryptbuf, 216 2*sizeof(des_block), DES_DECRYPT | DES_HW, 217 (char *)&ivec); 218 } else { 219 status = ecb_crypt((char *)sessionkey, (char *)cryptbuf, 220 sizeof(des_block), DES_DECRYPT | DES_HW); 221 } 222 if (DES_FAILED(status)) { 223 debug("decryption failure"); 224 return (AUTH_FAILED); /* system error */ 225 } 226 227 /* 228 * XDR the decrypted timestamp 229 */ 230 ixdr = (long *)cryptbuf; 231 timestamp.tv_sec = IXDR_GET_LONG(ixdr); 232 timestamp.tv_usec = IXDR_GET_LONG(ixdr); 233 234 /* 235 * Check for valid credentials and verifiers. 236 * They could be invalid because the key was flushed 237 * out of the cache, and so a new session should begin. 238 * Be sure and send AUTH_REJECTED{CRED, VERF} if this is the case. 239 */ 240 { 241 struct timeval current; 242 int nick; 243 int winverf; 244 245 if (cred->adc_namekind == ADN_FULLNAME) { 246 window = IXDR_GET_U_LONG(ixdr); 247 winverf = IXDR_GET_U_LONG(ixdr); 248 if (winverf != window - 1) { 249 debug("window verifier mismatch"); 250 return (AUTH_BADCRED); /* garbled credential */ 251 } 252 sid = cache_spot(sessionkey, cred->adc_fullname.name, 253 ×tamp); 254 if (sid < 0) { 255 debug("replayed credential"); 256 return (AUTH_REJECTEDCRED); /* replay */ 257 } 258 nick = 0; 259 } else { /* ADN_NICKNAME */ 260 window = authdes_cache[sid].window; 261 nick = 1; 262 } 263 264 if ((u_long)timestamp.tv_usec >= USEC_PER_SEC) { 265 debug("invalid usecs"); 266 /* cached out (bad key), or garbled verifier */ 267 return (nick ? AUTH_REJECTEDVERF : AUTH_BADVERF); 268 } 269 if (nick && BEFORE(×tamp, 270 &authdes_cache[sid].laststamp)) { 271 debug("timestamp before last seen"); 272 return (AUTH_REJECTEDVERF); /* replay */ 273 } 274 (void)gettimeofday(¤t, NULL); 275 current.tv_sec -= window; /* allow for expiration */ 276 if (!BEFORE(¤t, ×tamp)) { 277 debug("timestamp expired"); 278 /* replay, or garbled credential */ 279 return (nick ? AUTH_REJECTEDVERF : AUTH_BADCRED); 280 } 281 } 282 283 /* 284 * Set up the reply verifier 285 */ 286 verf.adv_nickname = (u_long)sid; 287 288 /* 289 * xdr the timestamp before encrypting 290 */ 291 ixdr = (long *)cryptbuf; 292 IXDR_PUT_LONG(ixdr, timestamp.tv_sec - 1); 293 IXDR_PUT_LONG(ixdr, timestamp.tv_usec); 294 295 /* 296 * encrypt the timestamp 297 */ 298 status = ecb_crypt((char *)sessionkey, (char *)cryptbuf, 299 sizeof(des_block), DES_ENCRYPT | DES_HW); 300 if (DES_FAILED(status)) { 301 debug("encryption failure"); 302 return (AUTH_FAILED); /* system error */ 303 } 304 verf.adv_xtimestamp = cryptbuf[0]; 305 306 /* 307 * Serialize the reply verifier, and update rqst 308 */ 309 ixdr = (long *)msg->rm_call.cb_verf.oa_base; 310 *ixdr++ = (long)verf.adv_xtimestamp.key.high; 311 *ixdr++ = (long)verf.adv_xtimestamp.key.low; 312 *ixdr++ = (long)verf.adv_int_u; 313 314 rqst->rq_xprt->xp_verf.oa_flavor = AUTH_DES; 315 rqst->rq_xprt->xp_verf.oa_base = msg->rm_call.cb_verf.oa_base; 316 rqst->rq_xprt->xp_verf.oa_length = 317 (char *)ixdr - msg->rm_call.cb_verf.oa_base; 318 319 /* 320 * We succeeded, commit the data to the cache now and 321 * finish cooking the credential. 322 */ 323 entry = &authdes_cache[sid]; 324 entry->laststamp = timestamp; 325 cache_ref(sid); 326 if (cred->adc_namekind == ADN_FULLNAME) { 327 cred->adc_fullname.window = window; 328 cred->adc_nickname = (u_long)sid; /* save nickname */ 329 if (entry->rname != NULL) { 330 mem_free(entry->rname, strlen(entry->rname) + 1); 331 } 332 entry->rname = (char *)mem_alloc((u_int)strlen(cred->adc_fullname.name) 333 + 1); 334 if (entry->rname != NULL) { 335 (void) strcpy(entry->rname, cred->adc_fullname.name); 336 } else { 337 debug("out of memory"); 338 } 339 entry->key = *sessionkey; 340 entry->window = window; 341 invalidate(entry->localcred); /* mark any cached cred invalid */ 342 } else { /* ADN_NICKNAME */ 343 /* 344 * nicknames are cooked into fullnames 345 */ 346 cred->adc_namekind = ADN_FULLNAME; 347 cred->adc_fullname.name = entry->rname; 348 cred->adc_fullname.key = entry->key; 349 cred->adc_fullname.window = entry->window; 350 } 351 return (AUTH_OK); /* we made it!*/ 352} 353 354 355/* 356 * Initialize the cache 357 */ 358static void 359cache_init() 360{ 361 int i; 362 363 authdes_cache = (struct cache_entry *) 364 mem_alloc(sizeof(struct cache_entry) * AUTHDES_CACHESZ); 365 bzero((char *)authdes_cache, 366 sizeof(struct cache_entry) * AUTHDES_CACHESZ); 367 368 authdes_lru = (short *)mem_alloc(sizeof(short) * AUTHDES_CACHESZ); 369 /* 370 * Initialize the lru list 371 */ 372 for (i = 0; i < AUTHDES_CACHESZ; i++) { 373 authdes_lru[i] = i; 374 } 375} 376 377 378/* 379 * Find the lru victim 380 */ 381static short 382cache_victim() 383{ 384 return (authdes_lru[AUTHDES_CACHESZ-1]); 385} 386 387/* 388 * Note that sid was referenced 389 */ 390static void 391cache_ref(sid) 392 short sid; 393{ 394 int i; 395 short curr; 396 short prev; 397 398 prev = authdes_lru[0]; 399 authdes_lru[0] = sid; 400 for (i = 1; prev != sid; i++) { 401 curr = authdes_lru[i]; 402 authdes_lru[i] = prev; 403 prev = curr; 404 } 405} 406 407 408/* 409 * Find a spot in the cache for a credential containing 410 * the items given. Return -1 if a replay is detected, otherwise 411 * return the spot in the cache. 412 */ 413static short 414cache_spot(key, name, timestamp) 415 des_block *key; 416 char *name; 417 struct timeval *timestamp; 418{ 419 struct cache_entry *cp; 420 int i; 421 u_long hi; 422 423 hi = key->key.high; 424 for (cp = authdes_cache, i = 0; i < AUTHDES_CACHESZ; i++, cp++) { 425 if (cp->key.key.high == hi && 426 cp->key.key.low == key->key.low && 427 cp->rname != NULL && 428 bcmp(cp->rname, name, strlen(name) + 1) == 0) { 429 if (BEFORE(timestamp, &cp->laststamp)) { 430 svcauthdes_stats.ncachereplays++; 431 return (-1); /* replay */ 432 } 433 svcauthdes_stats.ncachehits++; 434 return (i); /* refresh */ 435 } 436 } 437 svcauthdes_stats.ncachemisses++; 438 return (cache_victim()); /* new credential */ 439} 440 441 442#if (defined(sun) || defined(vax) || defined(__FreeBSD__)) 443/* 444 * Local credential handling stuff. 445 * NOTE: bsd unix dependent. 446 * Other operating systems should put something else here. 447 */ 448#define UNKNOWN -2 /* grouplen, if cached cred is unknown user */ 449#define INVALID -1 /* grouplen, if cache entry is invalid */ 450 451struct bsdcred { 452 uid_t uid; /* cached uid */ 453 gid_t gid; /* cached gid */ 454 int grouplen; /* length of cached groups */ 455 gid_t groups[NGRPS]; /* cached groups */ 456}; 457 458/* 459 * Map a des credential into a unix cred. 460 * We cache the credential here so the application does 461 * not have to make an rpc call every time to interpret 462 * the credential. 463 */ 464int 465authdes_getucred(adc, uid, gid, grouplen, groups) 466 struct authdes_cred *adc; 467 uid_t *uid; 468 gid_t *gid; 469 int *grouplen; 470 gid_t *groups; 471{ 472 unsigned sid; 473 int i; 474 uid_t i_uid; 475 gid_t i_gid; 476 int i_grouplen; 477 struct bsdcred *cred; 478 479 sid = adc->adc_nickname; 480 if (sid >= AUTHDES_CACHESZ) { 481 debug("invalid nickname"); 482 return (0); 483 } 484 cred = (struct bsdcred *)authdes_cache[sid].localcred; 485 if (cred == NULL) { 486 cred = (struct bsdcred *)mem_alloc(sizeof(struct bsdcred)); 487 authdes_cache[sid].localcred = (char *)cred; 488 cred->grouplen = INVALID; 489 } 490 if (cred->grouplen == INVALID) { 491 /* 492 * not in cache: lookup 493 */ 494 if (!netname2user(adc->adc_fullname.name, &i_uid, &i_gid, 495 &i_grouplen, groups)) 496 { 497 debug("unknown netname"); 498 cred->grouplen = UNKNOWN; /* mark as lookup up, but not found */ 499 return (0); 500 } 501 debug("missed ucred cache"); 502 *uid = cred->uid = i_uid; 503 *gid = cred->gid = i_gid; 504 *grouplen = cred->grouplen = i_grouplen; 505 for (i = i_grouplen - 1; i >= 0; i--) { 506 cred->groups[i] = groups[i]; /* int to short */ 507 } 508 return (1); 509 } else if (cred->grouplen == UNKNOWN) { 510 /* 511 * Already lookup up, but no match found 512 */ 513 return (0); 514 } 515 516 /* 517 * cached credentials 518 */ 519 *uid = cred->uid; 520 *gid = cred->gid; 521 *grouplen = cred->grouplen; 522 for (i = cred->grouplen - 1; i >= 0; i--) { 523 groups[i] = cred->groups[i]; /* short to int */ 524 } 525 return (1); 526} 527 528static void 529invalidate(cred) 530 char *cred; 531{ 532 if (cred == NULL) { 533 return; 534 } 535 ((struct bsdcred *)cred)->grouplen = INVALID; 536} 537#endif 538 539