1 /* $NetBSD: replay.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $ */ 2 3 /* 4 * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include "krb5_locl.h" 37 #include <vis.h> 38 39 struct krb5_rcache_data { 40 char *name; 41 }; 42 43 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 44 krb5_rc_resolve(krb5_context context, 45 krb5_rcache id, 46 const char *name) 47 { 48 id->name = strdup(name); 49 if(id->name == NULL) { 50 krb5_set_error_message(context, KRB5_RC_MALLOC, 51 N_("malloc: out of memory", "")); 52 return KRB5_RC_MALLOC; 53 } 54 return 0; 55 } 56 57 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 58 krb5_rc_resolve_type(krb5_context context, 59 krb5_rcache *id, 60 const char *type) 61 { 62 *id = NULL; 63 if(strcmp(type, "FILE")) { 64 krb5_set_error_message (context, KRB5_RC_TYPE_NOTFOUND, 65 N_("replay cache type %s not supported", ""), 66 type); 67 return KRB5_RC_TYPE_NOTFOUND; 68 } 69 *id = calloc(1, sizeof(**id)); 70 if(*id == NULL) { 71 krb5_set_error_message(context, KRB5_RC_MALLOC, 72 N_("malloc: out of memory", "")); 73 return KRB5_RC_MALLOC; 74 } 75 return 0; 76 } 77 78 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 79 krb5_rc_resolve_full(krb5_context context, 80 krb5_rcache *id, 81 const char *string_name) 82 { 83 krb5_error_code ret; 84 85 *id = NULL; 86 87 if(strncmp(string_name, "FILE:", 5)) { 88 krb5_set_error_message(context, KRB5_RC_TYPE_NOTFOUND, 89 N_("replay cache type %s not supported", ""), 90 string_name); 91 return KRB5_RC_TYPE_NOTFOUND; 92 } 93 ret = krb5_rc_resolve_type(context, id, "FILE"); 94 if(ret) 95 return ret; 96 ret = krb5_rc_resolve(context, *id, string_name + 5); 97 if (ret) { 98 krb5_rc_close(context, *id); 99 *id = NULL; 100 } 101 return ret; 102 } 103 104 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL 105 krb5_rc_default_name(krb5_context context) 106 { 107 return "FILE:/var/run/default_rcache"; 108 } 109 110 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL 111 krb5_rc_default_type(krb5_context context) 112 { 113 return "FILE"; 114 } 115 116 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 117 krb5_rc_default(krb5_context context, 118 krb5_rcache *id) 119 { 120 return krb5_rc_resolve_full(context, id, krb5_rc_default_name(context)); 121 } 122 123 struct rc_entry{ 124 time_t stamp; 125 unsigned char data[16]; 126 }; 127 128 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 129 krb5_rc_initialize(krb5_context context, 130 krb5_rcache id, 131 krb5_deltat auth_lifespan) 132 { 133 FILE *f = fopen(id->name, "w"); 134 struct rc_entry tmp; 135 int ret; 136 137 if(f == NULL) { 138 char buf[128]; 139 ret = errno; 140 rk_strerror_r(ret, buf, sizeof(buf)); 141 krb5_set_error_message(context, ret, "open(%s): %s", id->name, buf); 142 return ret; 143 } 144 tmp.stamp = auth_lifespan; 145 fwrite(&tmp, 1, sizeof(tmp), f); 146 fclose(f); 147 return 0; 148 } 149 150 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 151 krb5_rc_recover(krb5_context context, 152 krb5_rcache id) 153 { 154 return 0; 155 } 156 157 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 158 krb5_rc_destroy(krb5_context context, 159 krb5_rcache id) 160 { 161 int ret; 162 163 if(remove(id->name) < 0) { 164 char buf[128]; 165 ret = errno; 166 rk_strerror_r(ret, buf, sizeof(buf)); 167 krb5_set_error_message(context, ret, "remove(%s): %s", id->name, buf); 168 return ret; 169 } 170 return krb5_rc_close(context, id); 171 } 172 173 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 174 krb5_rc_close(krb5_context context, 175 krb5_rcache id) 176 { 177 free(id->name); 178 free(id); 179 return 0; 180 } 181 182 static void 183 checksum_authenticator(Authenticator *auth, void *data) 184 { 185 EVP_MD_CTX *m = EVP_MD_CTX_create(); 186 unsigned i; 187 188 EVP_DigestInit_ex(m, EVP_md5(), NULL); 189 190 EVP_DigestUpdate(m, auth->crealm, strlen(auth->crealm)); 191 for(i = 0; i < auth->cname.name_string.len; i++) 192 EVP_DigestUpdate(m, auth->cname.name_string.val[i], 193 strlen(auth->cname.name_string.val[i])); 194 EVP_DigestUpdate(m, &auth->ctime, sizeof(auth->ctime)); 195 EVP_DigestUpdate(m, &auth->cusec, sizeof(auth->cusec)); 196 197 EVP_DigestFinal_ex(m, data, NULL); 198 EVP_MD_CTX_destroy(m); 199 } 200 201 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 202 krb5_rc_store(krb5_context context, 203 krb5_rcache id, 204 krb5_donot_replay *rep) 205 { 206 struct rc_entry ent, tmp; 207 time_t t; 208 FILE *f; 209 int ret; 210 211 ent.stamp = time(NULL); 212 checksum_authenticator(rep, ent.data); 213 f = fopen(id->name, "r"); 214 if(f == NULL) { 215 char buf[128]; 216 ret = errno; 217 rk_strerror_r(ret, buf, sizeof(buf)); 218 krb5_set_error_message(context, ret, "open(%s): %s", id->name, buf); 219 return ret; 220 } 221 rk_cloexec_file(f); 222 fread(&tmp, sizeof(ent), 1, f); 223 t = ent.stamp - tmp.stamp; 224 while(fread(&tmp, sizeof(ent), 1, f)){ 225 if(tmp.stamp < t) 226 continue; 227 if(memcmp(tmp.data, ent.data, sizeof(ent.data)) == 0){ 228 fclose(f); 229 krb5_clear_error_message (context); 230 return KRB5_RC_REPLAY; 231 } 232 } 233 if(ferror(f)){ 234 char buf[128]; 235 ret = errno; 236 fclose(f); 237 rk_strerror_r(ret, buf, sizeof(buf)); 238 krb5_set_error_message(context, ret, "%s: %s", 239 id->name, buf); 240 return ret; 241 } 242 fclose(f); 243 f = fopen(id->name, "a"); 244 if(f == NULL) { 245 char buf[128]; 246 rk_strerror_r(errno, buf, sizeof(buf)); 247 krb5_set_error_message(context, KRB5_RC_IO_UNKNOWN, 248 "open(%s): %s", id->name, buf); 249 return KRB5_RC_IO_UNKNOWN; 250 } 251 fwrite(&ent, 1, sizeof(ent), f); 252 fclose(f); 253 return 0; 254 } 255 256 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 257 krb5_rc_expunge(krb5_context context, 258 krb5_rcache id) 259 { 260 return 0; 261 } 262 263 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 264 krb5_rc_get_lifespan(krb5_context context, 265 krb5_rcache id, 266 krb5_deltat *auth_lifespan) 267 { 268 FILE *f = fopen(id->name, "r"); 269 int r; 270 struct rc_entry ent; 271 r = fread(&ent, sizeof(ent), 1, f); 272 fclose(f); 273 if(r){ 274 *auth_lifespan = ent.stamp; 275 return 0; 276 } 277 krb5_clear_error_message (context); 278 return KRB5_RC_IO_UNKNOWN; 279 } 280 281 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL 282 krb5_rc_get_name(krb5_context context, 283 krb5_rcache id) 284 { 285 return id->name; 286 } 287 288 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL 289 krb5_rc_get_type(krb5_context context, 290 krb5_rcache id) 291 { 292 return "FILE"; 293 } 294 295 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 296 krb5_get_server_rcache(krb5_context context, 297 const krb5_data *piece, 298 krb5_rcache *id) 299 { 300 krb5_rcache rcache; 301 krb5_error_code ret; 302 303 char *tmp = malloc(4 * piece->length + 1); 304 char *name; 305 306 if(tmp == NULL) { 307 krb5_set_error_message(context, ENOMEM, 308 N_("malloc: out of memory", "")); 309 return ENOMEM; 310 } 311 strvisx(tmp, piece->data, piece->length, VIS_WHITE | VIS_OCTAL); 312 #ifdef HAVE_GETEUID 313 ret = asprintf(&name, "FILE:rc_%s_%u", tmp, (unsigned)geteuid()); 314 #else 315 ret = asprintf(&name, "FILE:rc_%s", tmp); 316 #endif 317 free(tmp); 318 if(ret < 0 || name == NULL) { 319 krb5_set_error_message(context, ENOMEM, 320 N_("malloc: out of memory", "")); 321 return ENOMEM; 322 } 323 324 ret = krb5_rc_resolve_full(context, &rcache, name); 325 free(name); 326 if(ret) 327 return ret; 328 *id = rcache; 329 return ret; 330 } 331