1219820Sjeff/* $NetBSD$ */ 2219820Sjeff 3219820Sjeff/* 4219820Sjeff * Copyright (c) 1997 - 2003 Kungliga Tekniska H��gskolan 5219820Sjeff * (Royal Institute of Technology, Stockholm, Sweden). 6219820Sjeff * All rights reserved. 7219820Sjeff * 8219820Sjeff * Redistribution and use in source and binary forms, with or without 9219820Sjeff * modification, are permitted provided that the following conditions 10219820Sjeff * are met: 11219820Sjeff * 12219820Sjeff * 1. Redistributions of source code must retain the above copyright 13219820Sjeff * notice, this list of conditions and the following disclaimer. 14219820Sjeff * 15219820Sjeff * 2. Redistributions in binary form must reproduce the above copyright 16219820Sjeff * notice, this list of conditions and the following disclaimer in the 17219820Sjeff * documentation and/or other materials provided with the distribution. 18219820Sjeff * 19219820Sjeff * 3. Neither the name of the Institute nor the names of its contributors 20219820Sjeff * may be used to endorse or promote products derived from this software 21219820Sjeff * without specific prior written permission. 22219820Sjeff * 23219820Sjeff * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24219820Sjeff * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25219820Sjeff * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26219820Sjeff * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27219820Sjeff * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28219820Sjeff * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29219820Sjeff * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30219820Sjeff * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31219820Sjeff * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32219820Sjeff * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33219820Sjeff * SUCH DAMAGE. 34219820Sjeff */ 35255932Salfred 36219820Sjeff#include "gsskrb5_locl.h" 37219820Sjeff 38219820Sjeffkrb5_error_code 39255932Salfred_gsskrb5_encode_om_uint32(OM_uint32 n, u_char *p) 40219820Sjeff{ 41255932Salfred p[0] = (n >> 0) & 0xFF; 42219820Sjeff p[1] = (n >> 8) & 0xFF; 43219820Sjeff p[2] = (n >> 16) & 0xFF; 44219820Sjeff p[3] = (n >> 24) & 0xFF; 45219820Sjeff return 0; 46219820Sjeff} 47219820Sjeff 48219820Sjeffkrb5_error_code 49219820Sjeff_gsskrb5_encode_be_om_uint32(OM_uint32 n, u_char *p) 50255932Salfred{ 51255932Salfred p[0] = (n >> 24) & 0xFF; 52219820Sjeff p[1] = (n >> 16) & 0xFF; 53219820Sjeff p[2] = (n >> 8) & 0xFF; 54219820Sjeff p[3] = (n >> 0) & 0xFF; 55219820Sjeff return 0; 56219820Sjeff} 57219820Sjeff 58219820Sjeffkrb5_error_code 59219820Sjeff_gsskrb5_decode_om_uint32(const void *ptr, OM_uint32 *n) 60219820Sjeff{ 61219820Sjeff const u_char *p = ptr; 62219820Sjeff *n = (p[0] << 0) | (p[1] << 8) | (p[2] << 16) | (p[3] << 24); 63219820Sjeff return 0; 64219820Sjeff} 65219820Sjeff 66219820Sjeffkrb5_error_code 67219820Sjeff_gsskrb5_decode_be_om_uint32(const void *ptr, OM_uint32 *n) 68219820Sjeff{ 69219820Sjeff const u_char *p = ptr; 70219820Sjeff *n = (p[0] <<24) | (p[1] << 16) | (p[2] << 8) | (p[3] << 0); 71255932Salfred return 0; 72255932Salfred} 73255932Salfred 74255932Salfredstatic krb5_error_code 75255932Salfredhash_input_chan_bindings (const gss_channel_bindings_t b, 76255932Salfred u_char *p) 77255932Salfred{ 78219820Sjeff u_char num[4]; 79255932Salfred EVP_MD_CTX *ctx; 80255932Salfred 81255932Salfred ctx = EVP_MD_CTX_create(); 82255932Salfred EVP_DigestInit_ex(ctx, EVP_md5(), NULL); 83219820Sjeff 84255932Salfred _gsskrb5_encode_om_uint32 (b->initiator_addrtype, num); 85255932Salfred EVP_DigestUpdate(ctx, num, sizeof(num)); 86219820Sjeff _gsskrb5_encode_om_uint32 (b->initiator_address.length, num); 87219820Sjeff EVP_DigestUpdate(ctx, num, sizeof(num)); 88219820Sjeff if (b->initiator_address.length) 89219820Sjeff EVP_DigestUpdate(ctx, 90219820Sjeff b->initiator_address.value, 91219820Sjeff b->initiator_address.length); 92219820Sjeff _gsskrb5_encode_om_uint32 (b->acceptor_addrtype, num); 93219820Sjeff EVP_DigestUpdate(ctx, num, sizeof(num)); 94219820Sjeff _gsskrb5_encode_om_uint32 (b->acceptor_address.length, num); 95219820Sjeff EVP_DigestUpdate(ctx, num, sizeof(num)); 96219820Sjeff if (b->acceptor_address.length) 97219820Sjeff EVP_DigestUpdate(ctx, 98219820Sjeff b->acceptor_address.value, 99219820Sjeff b->acceptor_address.length); 100219820Sjeff _gsskrb5_encode_om_uint32 (b->application_data.length, num); 101219820Sjeff EVP_DigestUpdate(ctx, num, sizeof(num)); 102219820Sjeff if (b->application_data.length) 103219820Sjeff EVP_DigestUpdate(ctx, 104219820Sjeff b->application_data.value, 105219820Sjeff b->application_data.length); 106219820Sjeff EVP_DigestFinal_ex(ctx, p, NULL); 107255932Salfred EVP_MD_CTX_destroy(ctx); 108255932Salfred 109255932Salfred return 0; 110255932Salfred} 111219820Sjeff 112219820Sjeff/* 113219820Sjeff * create a checksum over the chanel bindings in 114255932Salfred * `input_chan_bindings', `flags' and `fwd_data' and return it in 115255932Salfred * `result' 116219820Sjeff */ 117219820Sjeff 118219820SjeffOM_uint32 119219820Sjeff_gsskrb5_create_8003_checksum ( 120219820Sjeff OM_uint32 *minor_status, 121219820Sjeff const gss_channel_bindings_t input_chan_bindings, 122219820Sjeff OM_uint32 flags, 123219820Sjeff const krb5_data *fwd_data, 124219820Sjeff Checksum *result) 125219820Sjeff{ 126255932Salfred u_char *p; 127219820Sjeff 128255932Salfred /* 129255932Salfred * see rfc1964 (section 1.1.1 (Initial Token), and the checksum value 130255932Salfred * field's format) */ 131255932Salfred result->cksumtype = CKSUMTYPE_GSSAPI; 132219820Sjeff if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG)) 133219820Sjeff result->checksum.length = 24 + 4 + fwd_data->length; 134219820Sjeff else 135219820Sjeff result->checksum.length = 24; 136219820Sjeff result->checksum.data = malloc (result->checksum.length); 137219820Sjeff if (result->checksum.data == NULL) { 138219820Sjeff *minor_status = ENOMEM; 139219820Sjeff return GSS_S_FAILURE; 140219820Sjeff } 141255932Salfred 142255932Salfred p = result->checksum.data; 143219820Sjeff _gsskrb5_encode_om_uint32 (16, p); 144219820Sjeff p += 4; 145219820Sjeff if (input_chan_bindings == GSS_C_NO_CHANNEL_BINDINGS) { 146219820Sjeff memset (p, 0, 16); 147219820Sjeff } else { 148219820Sjeff hash_input_chan_bindings (input_chan_bindings, p); 149219820Sjeff } 150219820Sjeff p += 16; 151219820Sjeff _gsskrb5_encode_om_uint32 (flags, p); 152219820Sjeff p += 4; 153219820Sjeff 154219820Sjeff if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG)) { 155219820Sjeff 156219820Sjeff *p++ = (1 >> 0) & 0xFF; /* DlgOpt */ /* == 1 */ 157219820Sjeff *p++ = (1 >> 8) & 0xFF; /* DlgOpt */ /* == 0 */ 158219820Sjeff *p++ = (fwd_data->length >> 0) & 0xFF; /* Dlgth */ 159219820Sjeff *p++ = (fwd_data->length >> 8) & 0xFF; /* Dlgth */ 160219820Sjeff memcpy(p, (unsigned char *) fwd_data->data, fwd_data->length); 161219820Sjeff 162219820Sjeff p += fwd_data->length; 163219820Sjeff } 164219820Sjeff 165219820Sjeff return GSS_S_COMPLETE; 166219820Sjeff} 167219820Sjeff 168219820Sjeff/* 169219820Sjeff * verify the checksum in `cksum' over `input_chan_bindings' 170219820Sjeff * returning `flags' and `fwd_data' 171 */ 172 173OM_uint32 174_gsskrb5_verify_8003_checksum( 175 OM_uint32 *minor_status, 176 const gss_channel_bindings_t input_chan_bindings, 177 const Checksum *cksum, 178 OM_uint32 *flags, 179 krb5_data *fwd_data) 180{ 181 unsigned char hash[16]; 182 unsigned char *p; 183 OM_uint32 length; 184 int DlgOpt; 185 static unsigned char zeros[16]; 186 187 /* XXX should handle checksums > 24 bytes */ 188 if(cksum->cksumtype != CKSUMTYPE_GSSAPI || cksum->checksum.length < 24) { 189 *minor_status = 0; 190 return GSS_S_BAD_BINDINGS; 191 } 192 193 p = cksum->checksum.data; 194 _gsskrb5_decode_om_uint32(p, &length); 195 if(length != sizeof(hash)) { 196 *minor_status = 0; 197 return GSS_S_BAD_BINDINGS; 198 } 199 200 p += 4; 201 202 if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS 203 && memcmp(p, zeros, sizeof(zeros)) != 0) { 204 if(hash_input_chan_bindings(input_chan_bindings, hash) != 0) { 205 *minor_status = 0; 206 return GSS_S_BAD_BINDINGS; 207 } 208 if(ct_memcmp(hash, p, sizeof(hash)) != 0) { 209 *minor_status = 0; 210 return GSS_S_BAD_BINDINGS; 211 } 212 } 213 214 p += sizeof(hash); 215 216 _gsskrb5_decode_om_uint32(p, flags); 217 p += 4; 218 219 if (cksum->checksum.length > 24 && (*flags & GSS_C_DELEG_FLAG)) { 220 if(cksum->checksum.length < 28) { 221 *minor_status = 0; 222 return GSS_S_BAD_BINDINGS; 223 } 224 225 DlgOpt = (p[0] << 0) | (p[1] << 8); 226 p += 2; 227 if (DlgOpt != 1) { 228 *minor_status = 0; 229 return GSS_S_BAD_BINDINGS; 230 } 231 232 fwd_data->length = (p[0] << 0) | (p[1] << 8); 233 p += 2; 234 if(cksum->checksum.length < 28 + fwd_data->length) { 235 *minor_status = 0; 236 return GSS_S_BAD_BINDINGS; 237 } 238 fwd_data->data = malloc(fwd_data->length); 239 if (fwd_data->data == NULL) { 240 *minor_status = ENOMEM; 241 return GSS_S_FAILURE; 242 } 243 memcpy(fwd_data->data, p, fwd_data->length); 244 } 245 246 return GSS_S_COMPLETE; 247} 248