1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * CDDL HEADER START
3*0Sstevel@tonic-gate *
4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*0Sstevel@tonic-gate * with the License.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*0Sstevel@tonic-gate * See the License for the specific language governing permissions
12*0Sstevel@tonic-gate * and limitations under the License.
13*0Sstevel@tonic-gate *
14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*0Sstevel@tonic-gate *
20*0Sstevel@tonic-gate * CDDL HEADER END
21*0Sstevel@tonic-gate */
22*0Sstevel@tonic-gate /*
23*0Sstevel@tonic-gate * Copyright 2005 Sun Microsystems, Inc. All rights reserved.
24*0Sstevel@tonic-gate * Use is subject to license terms.
25*0Sstevel@tonic-gate */
26*0Sstevel@tonic-gate
27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
28*0Sstevel@tonic-gate
29*0Sstevel@tonic-gate #include <sys/types.h>
30*0Sstevel@tonic-gate #include <unistd.h>
31*0Sstevel@tonic-gate #include <rpc/rpc.h>
32*0Sstevel@tonic-gate #include <rpc/key_prot.h>
33*0Sstevel@tonic-gate #include <rpcsvc/nis_dhext.h>
34*0Sstevel@tonic-gate #include <syslog.h>
35*0Sstevel@tonic-gate #include <note.h>
36*0Sstevel@tonic-gate
37*0Sstevel@tonic-gate /* defined in usr/src/libnsl/rpc/key_call.c */
38*0Sstevel@tonic-gate extern bool_t (*__key_encryptsession_pk_LOCAL)();
39*0Sstevel@tonic-gate extern bool_t (*__key_decryptsession_pk_LOCAL)();
40*0Sstevel@tonic-gate extern bool_t (*__key_gendes_LOCAL)();
41*0Sstevel@tonic-gate
42*0Sstevel@tonic-gate #define CLASSIC_PK_DH(k, a) (((k) == 192) && ((a) == 0))
43*0Sstevel@tonic-gate
44*0Sstevel@tonic-gate /*
45*0Sstevel@tonic-gate * authsys_create_uid(uid_t uid)
46*0Sstevel@tonic-gate *
47*0Sstevel@tonic-gate * Create SYS (UNIX) style authenticator for the given uid/gid
48*0Sstevel@tonic-gate * We don't include suplementary groups, since these are of no
49*0Sstevel@tonic-gate * interest for the keyserv operations that we do.
50*0Sstevel@tonic-gate */
51*0Sstevel@tonic-gate AUTH *
authsys_create_uid(uid_t uid,gid_t gid)52*0Sstevel@tonic-gate authsys_create_uid(uid_t uid, gid_t gid)
53*0Sstevel@tonic-gate {
54*0Sstevel@tonic-gate char host[MAX_MACHINE_NAME + 1];
55*0Sstevel@tonic-gate AUTH *res;
56*0Sstevel@tonic-gate
57*0Sstevel@tonic-gate if (gethostname(host, sizeof (host) - 1) == -1) {
58*0Sstevel@tonic-gate syslog(LOG_ERR,
59*0Sstevel@tonic-gate "pam_dhkeys: Can't determine hostname: %m");
60*0Sstevel@tonic-gate return (NULL);
61*0Sstevel@tonic-gate }
62*0Sstevel@tonic-gate host[MAX_MACHINE_NAME] = '\0';
63*0Sstevel@tonic-gate
64*0Sstevel@tonic-gate res = authsys_create(host, uid, gid, 0, (gid_t *)NULL);
65*0Sstevel@tonic-gate
66*0Sstevel@tonic-gate return (res);
67*0Sstevel@tonic-gate }
68*0Sstevel@tonic-gate
69*0Sstevel@tonic-gate /*
70*0Sstevel@tonic-gate * my_key_call(proc, xdr_arg, arg, xdr_rslt, rslt, uit, gid)
71*0Sstevel@tonic-gate *
72*0Sstevel@tonic-gate * my_key_call is a copy of key_call() from libnsl with the
73*0Sstevel@tonic-gate * added AUTHSYS rpc credential to make the keyserver use our
74*0Sstevel@tonic-gate * REAL UID instead of our EFFECTIVE UID when handling our keys.
75*0Sstevel@tonic-gate */
76*0Sstevel@tonic-gate int
my_key_call(rpcproc_t proc,xdrproc_t xdr_arg,char * arg,xdrproc_t xdr_rslt,char * rslt,uid_t uid,gid_t gid)77*0Sstevel@tonic-gate my_key_call(rpcproc_t proc, xdrproc_t xdr_arg, char *arg,
78*0Sstevel@tonic-gate xdrproc_t xdr_rslt, char *rslt, uid_t uid, gid_t gid)
79*0Sstevel@tonic-gate {
80*0Sstevel@tonic-gate CLIENT *clnt;
81*0Sstevel@tonic-gate struct timeval wait_time = {0, 0};
82*0Sstevel@tonic-gate enum clnt_stat status;
83*0Sstevel@tonic-gate int vers;
84*0Sstevel@tonic-gate
85*0Sstevel@tonic-gate if (proc == KEY_ENCRYPT_PK && __key_encryptsession_pk_LOCAL) {
86*0Sstevel@tonic-gate cryptkeyres res;
87*0Sstevel@tonic-gate bool_t r;
88*0Sstevel@tonic-gate r = (*__key_encryptsession_pk_LOCAL)(uid, arg, &res);
89*0Sstevel@tonic-gate if (r == TRUE) {
90*0Sstevel@tonic-gate /* LINTED pointer alignment */
91*0Sstevel@tonic-gate *(cryptkeyres*)rslt = res;
92*0Sstevel@tonic-gate return (1);
93*0Sstevel@tonic-gate }
94*0Sstevel@tonic-gate return (0);
95*0Sstevel@tonic-gate }
96*0Sstevel@tonic-gate if (proc == KEY_DECRYPT_PK && __key_decryptsession_pk_LOCAL) {
97*0Sstevel@tonic-gate cryptkeyres res;
98*0Sstevel@tonic-gate bool_t r;
99*0Sstevel@tonic-gate r = (*__key_decryptsession_pk_LOCAL)(uid, arg, &res);
100*0Sstevel@tonic-gate if (r == TRUE) {
101*0Sstevel@tonic-gate /* LINTED pointer alignment */
102*0Sstevel@tonic-gate *(cryptkeyres*)rslt = res;
103*0Sstevel@tonic-gate return (1);
104*0Sstevel@tonic-gate }
105*0Sstevel@tonic-gate return (0);
106*0Sstevel@tonic-gate }
107*0Sstevel@tonic-gate if (proc == KEY_GEN && __key_gendes_LOCAL) {
108*0Sstevel@tonic-gate des_block res;
109*0Sstevel@tonic-gate bool_t r;
110*0Sstevel@tonic-gate r = (*__key_gendes_LOCAL)(uid, 0, &res);
111*0Sstevel@tonic-gate if (r == TRUE) {
112*0Sstevel@tonic-gate /* LINTED pointer alignment */
113*0Sstevel@tonic-gate *(des_block*)rslt = res;
114*0Sstevel@tonic-gate return (1);
115*0Sstevel@tonic-gate }
116*0Sstevel@tonic-gate return (0);
117*0Sstevel@tonic-gate }
118*0Sstevel@tonic-gate
119*0Sstevel@tonic-gate if ((proc == KEY_ENCRYPT_PK) || (proc == KEY_DECRYPT_PK) ||
120*0Sstevel@tonic-gate (proc == KEY_NET_GET) || (proc == KEY_NET_PUT) ||
121*0Sstevel@tonic-gate (proc == KEY_GET_CONV))
122*0Sstevel@tonic-gate vers = 2; /* talk to version 2 */
123*0Sstevel@tonic-gate else
124*0Sstevel@tonic-gate vers = 1; /* talk to version 1 */
125*0Sstevel@tonic-gate
126*0Sstevel@tonic-gate clnt = clnt_door_create(KEY_PROG, vers, 0);
127*0Sstevel@tonic-gate
128*0Sstevel@tonic-gate if (clnt == NULL)
129*0Sstevel@tonic-gate return (0);
130*0Sstevel@tonic-gate
131*0Sstevel@tonic-gate clnt->cl_auth = authsys_create_uid(uid, gid);
132*0Sstevel@tonic-gate
133*0Sstevel@tonic-gate status = CLNT_CALL(clnt, proc, xdr_arg, arg, xdr_rslt,
134*0Sstevel@tonic-gate rslt, wait_time);
135*0Sstevel@tonic-gate
136*0Sstevel@tonic-gate auth_destroy(clnt->cl_auth);
137*0Sstevel@tonic-gate clnt_destroy(clnt);
138*0Sstevel@tonic-gate
139*0Sstevel@tonic-gate return (status == RPC_SUCCESS ? 1 : 0);
140*0Sstevel@tonic-gate }
141*0Sstevel@tonic-gate
142*0Sstevel@tonic-gate int
key_setnet_uid(struct key_netstarg * arg,uid_t uid,gid_t gid)143*0Sstevel@tonic-gate key_setnet_uid(struct key_netstarg *arg, uid_t uid, gid_t gid)
144*0Sstevel@tonic-gate {
145*0Sstevel@tonic-gate keystatus status;
146*0Sstevel@tonic-gate
147*0Sstevel@tonic-gate if (!my_key_call((rpcproc_t)KEY_NET_PUT, xdr_key_netstarg,
148*0Sstevel@tonic-gate (char *)arg, xdr_keystatus, (char *)&status, uid, gid)) {
149*0Sstevel@tonic-gate return (-1);
150*0Sstevel@tonic-gate }
151*0Sstevel@tonic-gate if (status != KEY_SUCCESS) {
152*0Sstevel@tonic-gate return (-1);
153*0Sstevel@tonic-gate }
154*0Sstevel@tonic-gate
155*0Sstevel@tonic-gate return (1);
156*0Sstevel@tonic-gate }
157*0Sstevel@tonic-gate
158*0Sstevel@tonic-gate int
key_setnet_g_uid(const char * netname,const char * skey,keylen_t skeylen,const char * pkey,keylen_t pkeylen,algtype_t algtype,uid_t uid,gid_t gid)159*0Sstevel@tonic-gate key_setnet_g_uid(const char *netname, const char *skey, keylen_t skeylen,
160*0Sstevel@tonic-gate const char *pkey, keylen_t pkeylen, algtype_t algtype,
161*0Sstevel@tonic-gate uid_t uid, gid_t gid)
162*0Sstevel@tonic-gate {
163*0Sstevel@tonic-gate key_netstarg3 arg;
164*0Sstevel@tonic-gate keystatus status;
165*0Sstevel@tonic-gate
166*0Sstevel@tonic-gate arg.st_netname = (char *)netname;
167*0Sstevel@tonic-gate arg.algtype = algtype;
168*0Sstevel@tonic-gate
169*0Sstevel@tonic-gate if (skeylen == 0)
170*0Sstevel@tonic-gate arg.st_priv_key.keybuf3_len = 0;
171*0Sstevel@tonic-gate else
172*0Sstevel@tonic-gate arg.st_priv_key.keybuf3_len = skeylen/4 + 1;
173*0Sstevel@tonic-gate
174*0Sstevel@tonic-gate arg.st_priv_key.keybuf3_val = (char *)skey;
175*0Sstevel@tonic-gate
176*0Sstevel@tonic-gate if (pkeylen == 0)
177*0Sstevel@tonic-gate arg.st_pub_key.keybuf3_len = 0;
178*0Sstevel@tonic-gate else
179*0Sstevel@tonic-gate arg.st_pub_key.keybuf3_len = pkeylen/4 + 1;
180*0Sstevel@tonic-gate
181*0Sstevel@tonic-gate arg.st_pub_key.keybuf3_val = (char *)pkey;
182*0Sstevel@tonic-gate
183*0Sstevel@tonic-gate if (skeylen == 0) {
184*0Sstevel@tonic-gate if (pkeylen == 0) {
185*0Sstevel@tonic-gate /* debug("keylens are both 0"); */
186*0Sstevel@tonic-gate return (-1);
187*0Sstevel@tonic-gate }
188*0Sstevel@tonic-gate arg.keylen = pkeylen;
189*0Sstevel@tonic-gate } else {
190*0Sstevel@tonic-gate if ((pkeylen != 0) && (skeylen != pkeylen)) {
191*0Sstevel@tonic-gate /* debug("keylens don't match"); */
192*0Sstevel@tonic-gate return (-1);
193*0Sstevel@tonic-gate }
194*0Sstevel@tonic-gate arg.keylen = skeylen;
195*0Sstevel@tonic-gate }
196*0Sstevel@tonic-gate
197*0Sstevel@tonic-gate if (CLASSIC_PK_DH(arg.keylen, arg.algtype)) {
198*0Sstevel@tonic-gate key_netstarg tmp;
199*0Sstevel@tonic-gate
200*0Sstevel@tonic-gate if (skeylen != 0) {
201*0Sstevel@tonic-gate (void) memcpy(&tmp.st_priv_key, skey,
202*0Sstevel@tonic-gate sizeof (tmp.st_priv_key));
203*0Sstevel@tonic-gate } else {
204*0Sstevel@tonic-gate (void) memset(&tmp.st_priv_key, 0,
205*0Sstevel@tonic-gate sizeof (tmp.st_priv_key));
206*0Sstevel@tonic-gate }
207*0Sstevel@tonic-gate if (pkeylen != 0) {
208*0Sstevel@tonic-gate (void) memcpy(&tmp.st_pub_key, skey,
209*0Sstevel@tonic-gate sizeof (tmp.st_pub_key));
210*0Sstevel@tonic-gate } else {
211*0Sstevel@tonic-gate (void) memset(&tmp.st_pub_key, 0,
212*0Sstevel@tonic-gate sizeof (tmp.st_pub_key));
213*0Sstevel@tonic-gate }
214*0Sstevel@tonic-gate tmp.st_netname = (char *)netname;
215*0Sstevel@tonic-gate return (key_setnet_uid(&tmp, uid, gid));
216*0Sstevel@tonic-gate }
217*0Sstevel@tonic-gate
218*0Sstevel@tonic-gate if (!my_key_call((rpcproc_t)KEY_NET_PUT_3, xdr_key_netstarg3,
219*0Sstevel@tonic-gate (char *)&arg, xdr_keystatus, (char *)&status, uid, gid)) {
220*0Sstevel@tonic-gate return (-1);
221*0Sstevel@tonic-gate }
222*0Sstevel@tonic-gate
223*0Sstevel@tonic-gate if (status != KEY_SUCCESS) {
224*0Sstevel@tonic-gate /* debug("key_setnet3 status is nonzero"); */
225*0Sstevel@tonic-gate return (-1);
226*0Sstevel@tonic-gate }
227*0Sstevel@tonic-gate return (0);
228*0Sstevel@tonic-gate }
229*0Sstevel@tonic-gate
230*0Sstevel@tonic-gate
231*0Sstevel@tonic-gate /*
232*0Sstevel@tonic-gate * key_secretkey_is_set_uid() returns 1 if the keyserver has a secret key
233*0Sstevel@tonic-gate * stored for the caller's REAL uid; it returns 0 otherwise
234*0Sstevel@tonic-gate */
235*0Sstevel@tonic-gate int
key_secretkey_is_set_uid(uid_t uid,gid_t gid)236*0Sstevel@tonic-gate key_secretkey_is_set_uid(uid_t uid, gid_t gid)
237*0Sstevel@tonic-gate {
238*0Sstevel@tonic-gate struct key_netstres kres;
239*0Sstevel@tonic-gate
240*0Sstevel@tonic-gate (void) memset((void*)&kres, 0, sizeof (kres));
241*0Sstevel@tonic-gate
242*0Sstevel@tonic-gate if (my_key_call((rpcproc_t)KEY_NET_GET, xdr_void, (char *)NULL,
243*0Sstevel@tonic-gate xdr_key_netstres, (char *)&kres, uid, gid) &&
244*0Sstevel@tonic-gate (kres.status == KEY_SUCCESS) &&
245*0Sstevel@tonic-gate (kres.key_netstres_u.knet.st_priv_key[0] != 0)) {
246*0Sstevel@tonic-gate /* avoid leaving secret key in memory */
247*0Sstevel@tonic-gate (void) memset(kres.key_netstres_u.knet.st_priv_key, 0,
248*0Sstevel@tonic-gate HEXKEYBYTES);
249*0Sstevel@tonic-gate xdr_free(xdr_key_netstres, (char *)&kres);
250*0Sstevel@tonic-gate return (1);
251*0Sstevel@tonic-gate }
252*0Sstevel@tonic-gate return (0);
253*0Sstevel@tonic-gate }
254*0Sstevel@tonic-gate
255*0Sstevel@tonic-gate int
key_removesecret_g_uid(uid_t uid,gid_t gid)256*0Sstevel@tonic-gate key_removesecret_g_uid(uid_t uid, gid_t gid)
257*0Sstevel@tonic-gate {
258*0Sstevel@tonic-gate keystatus status;
259*0Sstevel@tonic-gate
260*0Sstevel@tonic-gate if (my_key_call((rpcproc_t)KEY_CLEAR_3, xdr_void, (char *)NULL,
261*0Sstevel@tonic-gate xdr_keystatus, (char *)&status, uid, gid))
262*0Sstevel@tonic-gate return (-1);
263*0Sstevel@tonic-gate
264*0Sstevel@tonic-gate if (status != KEY_SUCCESS)
265*0Sstevel@tonic-gate return (-1);
266*0Sstevel@tonic-gate
267*0Sstevel@tonic-gate return (0);
268*0Sstevel@tonic-gate }
269