1/*	$NetBSD: replay.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
2
3/*
4 * Copyright (c) 1997-2001 Kungliga Tekniska H��gskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 *
19 * 3. Neither the name of the Institute nor the names of its contributors
20 *    may be used to endorse or promote products derived from this software
21 *    without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36#include "krb5_locl.h"
37#include <vis.h>
38
39struct krb5_rcache_data {
40    char *name;
41};
42
43KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
44krb5_rc_resolve(krb5_context context,
45		krb5_rcache id,
46		const char *name)
47{
48    id->name = strdup(name);
49    if(id->name == NULL) {
50	krb5_set_error_message(context, KRB5_RC_MALLOC,
51			       N_("malloc: out of memory", ""));
52	return KRB5_RC_MALLOC;
53    }
54    return 0;
55}
56
57KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
58krb5_rc_resolve_type(krb5_context context,
59		     krb5_rcache *id,
60		     const char *type)
61{
62    *id = NULL;
63    if(strcmp(type, "FILE")) {
64	krb5_set_error_message (context, KRB5_RC_TYPE_NOTFOUND,
65				N_("replay cache type %s not supported", ""),
66				type);
67	return KRB5_RC_TYPE_NOTFOUND;
68    }
69    *id = calloc(1, sizeof(**id));
70    if(*id == NULL) {
71	krb5_set_error_message(context, KRB5_RC_MALLOC,
72			       N_("malloc: out of memory", ""));
73	return KRB5_RC_MALLOC;
74    }
75    return 0;
76}
77
78KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
79krb5_rc_resolve_full(krb5_context context,
80		     krb5_rcache *id,
81		     const char *string_name)
82{
83    krb5_error_code ret;
84
85    *id = NULL;
86
87    if(strncmp(string_name, "FILE:", 5)) {
88	krb5_set_error_message(context, KRB5_RC_TYPE_NOTFOUND,
89			       N_("replay cache type %s not supported", ""),
90			       string_name);
91	return KRB5_RC_TYPE_NOTFOUND;
92    }
93    ret = krb5_rc_resolve_type(context, id, "FILE");
94    if(ret)
95	return ret;
96    ret = krb5_rc_resolve(context, *id, string_name + 5);
97    if (ret) {
98	krb5_rc_close(context, *id);
99	*id = NULL;
100    }
101    return ret;
102}
103
104KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
105krb5_rc_default_name(krb5_context context)
106{
107    return "FILE:/var/run/default_rcache";
108}
109
110KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
111krb5_rc_default_type(krb5_context context)
112{
113    return "FILE";
114}
115
116KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
117krb5_rc_default(krb5_context context,
118		krb5_rcache *id)
119{
120    return krb5_rc_resolve_full(context, id, krb5_rc_default_name(context));
121}
122
123struct rc_entry{
124    time_t stamp;
125    unsigned char data[16];
126};
127
128KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
129krb5_rc_initialize(krb5_context context,
130		   krb5_rcache id,
131		   krb5_deltat auth_lifespan)
132{
133    FILE *f = fopen(id->name, "w");
134    struct rc_entry tmp;
135    int ret;
136
137    if(f == NULL) {
138	char buf[128];
139	ret = errno;
140	rk_strerror_r(ret, buf, sizeof(buf));
141	krb5_set_error_message(context, ret, "open(%s): %s", id->name, buf);
142	return ret;
143    }
144    memset(&tmp, 0, sizeof(tmp));
145    tmp.stamp = auth_lifespan;
146    fwrite(&tmp, 1, sizeof(tmp), f);
147    fclose(f);
148    return 0;
149}
150
151KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
152krb5_rc_recover(krb5_context context,
153		krb5_rcache id)
154{
155    return 0;
156}
157
158KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
159krb5_rc_destroy(krb5_context context,
160		krb5_rcache id)
161{
162    int ret;
163
164    if(remove(id->name) < 0) {
165	char buf[128];
166	ret = errno;
167	rk_strerror_r(ret, buf, sizeof(buf));
168	krb5_set_error_message(context, ret, "remove(%s): %s", id->name, buf);
169	return ret;
170    }
171    return krb5_rc_close(context, id);
172}
173
174KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
175krb5_rc_close(krb5_context context,
176	      krb5_rcache id)
177{
178    free(id->name);
179    free(id);
180    return 0;
181}
182
183static void
184checksum_authenticator(Authenticator *auth, void *data)
185{
186    EVP_MD_CTX *m = EVP_MD_CTX_create();
187    unsigned i;
188
189    EVP_DigestInit_ex(m, EVP_md5(), NULL);
190
191    EVP_DigestUpdate(m, auth->crealm, strlen(auth->crealm));
192    for(i = 0; i < auth->cname.name_string.len; i++)
193	EVP_DigestUpdate(m, auth->cname.name_string.val[i],
194		   strlen(auth->cname.name_string.val[i]));
195    EVP_DigestUpdate(m, &auth->ctime, sizeof(auth->ctime));
196    EVP_DigestUpdate(m, &auth->cusec, sizeof(auth->cusec));
197
198    EVP_DigestFinal_ex(m, data, NULL);
199    EVP_MD_CTX_destroy(m);
200}
201
202KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
203krb5_rc_store(krb5_context context,
204	      krb5_rcache id,
205	      krb5_donot_replay *rep)
206{
207    struct rc_entry ent, tmp;
208    time_t t;
209    FILE *f;
210    int ret;
211    size_t count;
212
213    ent.stamp = time(NULL);
214    checksum_authenticator(rep, ent.data);
215    f = fopen(id->name, "r");
216    if(f == NULL) {
217	char buf[128];
218	ret = errno;
219	rk_strerror_r(ret, buf, sizeof(buf));
220	krb5_set_error_message(context, ret, "open(%s): %s", id->name, buf);
221	return ret;
222    }
223    rk_cloexec_file(f);
224    count = fread(&tmp, sizeof(ent), 1, f);
225    if(count != 1)
226	return KRB5_RC_IO_UNKNOWN;
227    t = ent.stamp - tmp.stamp;
228    while(fread(&tmp, sizeof(ent), 1, f)){
229	if(tmp.stamp < t)
230	    continue;
231	if(memcmp(tmp.data, ent.data, sizeof(ent.data)) == 0){
232	    fclose(f);
233	    krb5_clear_error_message (context);
234	    return KRB5_RC_REPLAY;
235	}
236    }
237    if(ferror(f)){
238	char buf[128];
239	ret = errno;
240	fclose(f);
241	rk_strerror_r(ret, buf, sizeof(buf));
242	krb5_set_error_message(context, ret, "%s: %s",
243			       id->name, buf);
244	return ret;
245    }
246    fclose(f);
247    f = fopen(id->name, "a");
248    if(f == NULL) {
249	char buf[128];
250	rk_strerror_r(errno, buf, sizeof(buf));
251	krb5_set_error_message(context, KRB5_RC_IO_UNKNOWN,
252			       "open(%s): %s", id->name, buf);
253	return KRB5_RC_IO_UNKNOWN;
254    }
255    fwrite(&ent, 1, sizeof(ent), f);
256    fclose(f);
257    return 0;
258}
259
260KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
261krb5_rc_expunge(krb5_context context,
262		krb5_rcache id)
263{
264    return 0;
265}
266
267KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
268krb5_rc_get_lifespan(krb5_context context,
269		     krb5_rcache id,
270		     krb5_deltat *auth_lifespan)
271{
272    FILE *f = fopen(id->name, "r");
273    int r;
274    struct rc_entry ent;
275    r = fread(&ent, sizeof(ent), 1, f);
276    fclose(f);
277    if(r){
278	*auth_lifespan = ent.stamp;
279	return 0;
280    }
281    krb5_clear_error_message (context);
282    return KRB5_RC_IO_UNKNOWN;
283}
284
285KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
286krb5_rc_get_name(krb5_context context,
287		 krb5_rcache id)
288{
289    return id->name;
290}
291
292KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
293krb5_rc_get_type(krb5_context context,
294		 krb5_rcache id)
295{
296    return "FILE";
297}
298
299KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
300krb5_get_server_rcache(krb5_context context,
301		       const krb5_data *piece,
302		       krb5_rcache *id)
303{
304    krb5_rcache rcache;
305    krb5_error_code ret;
306
307    char *tmp = malloc(4 * piece->length + 1);
308    char *name;
309
310    if (tmp == NULL)
311	return krb5_enomem(context);
312    strvisx(tmp, piece->data, piece->length, VIS_WHITE | VIS_OCTAL);
313#ifdef HAVE_GETEUID
314    ret = asprintf(&name, "FILE:rc_%s_%u", tmp, (unsigned)geteuid());
315#else
316    ret = asprintf(&name, "FILE:rc_%s", tmp);
317#endif
318    free(tmp);
319    if (ret < 0 || name == NULL)
320	return krb5_enomem(context);
321
322    ret = krb5_rc_resolve_full(context, &rcache, name);
323    free(name);
324    if(ret)
325	return ret;
326    *id = rcache;
327    return ret;
328}
329