1 /* $NetBSD: replay.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $ */
2
3 /*
4 * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36 #include "krb5_locl.h"
37 #include <vis.h>
38
39 struct krb5_rcache_data {
40 char *name;
41 };
42
43 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_resolve(krb5_context context,krb5_rcache id,const char * name)44 krb5_rc_resolve(krb5_context context,
45 krb5_rcache id,
46 const char *name)
47 {
48 id->name = strdup(name);
49 if(id->name == NULL) {
50 krb5_set_error_message(context, KRB5_RC_MALLOC,
51 N_("malloc: out of memory", ""));
52 return KRB5_RC_MALLOC;
53 }
54 return 0;
55 }
56
57 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_resolve_type(krb5_context context,krb5_rcache * id,const char * type)58 krb5_rc_resolve_type(krb5_context context,
59 krb5_rcache *id,
60 const char *type)
61 {
62 *id = NULL;
63 if(strcmp(type, "FILE")) {
64 krb5_set_error_message (context, KRB5_RC_TYPE_NOTFOUND,
65 N_("replay cache type %s not supported", ""),
66 type);
67 return KRB5_RC_TYPE_NOTFOUND;
68 }
69 *id = calloc(1, sizeof(**id));
70 if(*id == NULL) {
71 krb5_set_error_message(context, KRB5_RC_MALLOC,
72 N_("malloc: out of memory", ""));
73 return KRB5_RC_MALLOC;
74 }
75 return 0;
76 }
77
78 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_resolve_full(krb5_context context,krb5_rcache * id,const char * string_name)79 krb5_rc_resolve_full(krb5_context context,
80 krb5_rcache *id,
81 const char *string_name)
82 {
83 krb5_error_code ret;
84
85 *id = NULL;
86
87 if(strncmp(string_name, "FILE:", 5)) {
88 krb5_set_error_message(context, KRB5_RC_TYPE_NOTFOUND,
89 N_("replay cache type %s not supported", ""),
90 string_name);
91 return KRB5_RC_TYPE_NOTFOUND;
92 }
93 ret = krb5_rc_resolve_type(context, id, "FILE");
94 if(ret)
95 return ret;
96 ret = krb5_rc_resolve(context, *id, string_name + 5);
97 if (ret) {
98 krb5_rc_close(context, *id);
99 *id = NULL;
100 }
101 return ret;
102 }
103
104 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
krb5_rc_default_name(krb5_context context)105 krb5_rc_default_name(krb5_context context)
106 {
107 return "FILE:/var/run/default_rcache";
108 }
109
110 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
krb5_rc_default_type(krb5_context context)111 krb5_rc_default_type(krb5_context context)
112 {
113 return "FILE";
114 }
115
116 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_default(krb5_context context,krb5_rcache * id)117 krb5_rc_default(krb5_context context,
118 krb5_rcache *id)
119 {
120 return krb5_rc_resolve_full(context, id, krb5_rc_default_name(context));
121 }
122
123 struct rc_entry{
124 time_t stamp;
125 unsigned char data[16];
126 };
127
128 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_initialize(krb5_context context,krb5_rcache id,krb5_deltat auth_lifespan)129 krb5_rc_initialize(krb5_context context,
130 krb5_rcache id,
131 krb5_deltat auth_lifespan)
132 {
133 FILE *f = fopen(id->name, "w");
134 struct rc_entry tmp;
135 int ret;
136
137 if(f == NULL) {
138 char buf[128];
139 ret = errno;
140 rk_strerror_r(ret, buf, sizeof(buf));
141 krb5_set_error_message(context, ret, "open(%s): %s", id->name, buf);
142 return ret;
143 }
144 tmp.stamp = auth_lifespan;
145 fwrite(&tmp, 1, sizeof(tmp), f);
146 fclose(f);
147 return 0;
148 }
149
150 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_recover(krb5_context context,krb5_rcache id)151 krb5_rc_recover(krb5_context context,
152 krb5_rcache id)
153 {
154 return 0;
155 }
156
157 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_destroy(krb5_context context,krb5_rcache id)158 krb5_rc_destroy(krb5_context context,
159 krb5_rcache id)
160 {
161 int ret;
162
163 if(remove(id->name) < 0) {
164 char buf[128];
165 ret = errno;
166 rk_strerror_r(ret, buf, sizeof(buf));
167 krb5_set_error_message(context, ret, "remove(%s): %s", id->name, buf);
168 return ret;
169 }
170 return krb5_rc_close(context, id);
171 }
172
173 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_close(krb5_context context,krb5_rcache id)174 krb5_rc_close(krb5_context context,
175 krb5_rcache id)
176 {
177 free(id->name);
178 free(id);
179 return 0;
180 }
181
182 static void
checksum_authenticator(Authenticator * auth,void * data)183 checksum_authenticator(Authenticator *auth, void *data)
184 {
185 EVP_MD_CTX *m = EVP_MD_CTX_create();
186 unsigned i;
187
188 EVP_DigestInit_ex(m, EVP_md5(), NULL);
189
190 EVP_DigestUpdate(m, auth->crealm, strlen(auth->crealm));
191 for(i = 0; i < auth->cname.name_string.len; i++)
192 EVP_DigestUpdate(m, auth->cname.name_string.val[i],
193 strlen(auth->cname.name_string.val[i]));
194 EVP_DigestUpdate(m, &auth->ctime, sizeof(auth->ctime));
195 EVP_DigestUpdate(m, &auth->cusec, sizeof(auth->cusec));
196
197 EVP_DigestFinal_ex(m, data, NULL);
198 EVP_MD_CTX_destroy(m);
199 }
200
201 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_store(krb5_context context,krb5_rcache id,krb5_donot_replay * rep)202 krb5_rc_store(krb5_context context,
203 krb5_rcache id,
204 krb5_donot_replay *rep)
205 {
206 struct rc_entry ent, tmp;
207 time_t t;
208 FILE *f;
209 int ret;
210
211 ent.stamp = time(NULL);
212 checksum_authenticator(rep, ent.data);
213 f = fopen(id->name, "r");
214 if(f == NULL) {
215 char buf[128];
216 ret = errno;
217 rk_strerror_r(ret, buf, sizeof(buf));
218 krb5_set_error_message(context, ret, "open(%s): %s", id->name, buf);
219 return ret;
220 }
221 rk_cloexec_file(f);
222 fread(&tmp, sizeof(ent), 1, f);
223 t = ent.stamp - tmp.stamp;
224 while(fread(&tmp, sizeof(ent), 1, f)){
225 if(tmp.stamp < t)
226 continue;
227 if(memcmp(tmp.data, ent.data, sizeof(ent.data)) == 0){
228 fclose(f);
229 krb5_clear_error_message (context);
230 return KRB5_RC_REPLAY;
231 }
232 }
233 if(ferror(f)){
234 char buf[128];
235 ret = errno;
236 fclose(f);
237 rk_strerror_r(ret, buf, sizeof(buf));
238 krb5_set_error_message(context, ret, "%s: %s",
239 id->name, buf);
240 return ret;
241 }
242 fclose(f);
243 f = fopen(id->name, "a");
244 if(f == NULL) {
245 char buf[128];
246 rk_strerror_r(errno, buf, sizeof(buf));
247 krb5_set_error_message(context, KRB5_RC_IO_UNKNOWN,
248 "open(%s): %s", id->name, buf);
249 return KRB5_RC_IO_UNKNOWN;
250 }
251 fwrite(&ent, 1, sizeof(ent), f);
252 fclose(f);
253 return 0;
254 }
255
256 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_expunge(krb5_context context,krb5_rcache id)257 krb5_rc_expunge(krb5_context context,
258 krb5_rcache id)
259 {
260 return 0;
261 }
262
263 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_get_lifespan(krb5_context context,krb5_rcache id,krb5_deltat * auth_lifespan)264 krb5_rc_get_lifespan(krb5_context context,
265 krb5_rcache id,
266 krb5_deltat *auth_lifespan)
267 {
268 FILE *f = fopen(id->name, "r");
269 int r;
270 struct rc_entry ent;
271 r = fread(&ent, sizeof(ent), 1, f);
272 fclose(f);
273 if(r){
274 *auth_lifespan = ent.stamp;
275 return 0;
276 }
277 krb5_clear_error_message (context);
278 return KRB5_RC_IO_UNKNOWN;
279 }
280
281 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
krb5_rc_get_name(krb5_context context,krb5_rcache id)282 krb5_rc_get_name(krb5_context context,
283 krb5_rcache id)
284 {
285 return id->name;
286 }
287
288 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
krb5_rc_get_type(krb5_context context,krb5_rcache id)289 krb5_rc_get_type(krb5_context context,
290 krb5_rcache id)
291 {
292 return "FILE";
293 }
294
295 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_get_server_rcache(krb5_context context,const krb5_data * piece,krb5_rcache * id)296 krb5_get_server_rcache(krb5_context context,
297 const krb5_data *piece,
298 krb5_rcache *id)
299 {
300 krb5_rcache rcache;
301 krb5_error_code ret;
302
303 char *tmp = malloc(4 * piece->length + 1);
304 char *name;
305
306 if(tmp == NULL) {
307 krb5_set_error_message(context, ENOMEM,
308 N_("malloc: out of memory", ""));
309 return ENOMEM;
310 }
311 strvisx(tmp, piece->data, piece->length, VIS_WHITE | VIS_OCTAL);
312 #ifdef HAVE_GETEUID
313 ret = asprintf(&name, "FILE:rc_%s_%u", tmp, (unsigned)geteuid());
314 #else
315 ret = asprintf(&name, "FILE:rc_%s", tmp);
316 #endif
317 free(tmp);
318 if(ret < 0 || name == NULL) {
319 krb5_set_error_message(context, ENOMEM,
320 N_("malloc: out of memory", ""));
321 return ENOMEM;
322 }
323
324 ret = krb5_rc_resolve_full(context, &rcache, name);
325 free(name);
326 if(ret)
327 return ret;
328 *id = rcache;
329 return ret;
330 }
331