util_krb.c

   1 /*
   2  * Copyright (c) 2011, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 /*
  34  * Kerberos 5 helpers.
  35  */
  36
  37 #include "gssapiP_eap.h"
  38
  39 static GSSEAP_THREAD_ONCE krbContextKeyOnce = GSSEAP_ONCE_INITIALIZER;
  40 static GSSEAP_THREAD_KEY krbContextKey;
  41
  42 static void
  43 destroyKrbContext(void *arg)
  44 {
  45     krb5_context context = (krb5_context)arg;
  46
  47     if (context != NULL)
  48         krb5_free_context(context);
  49 }
  50
  51 static void
  52 createKrbContextKey(void)
  53 {
  54     GSSEAP_KEY_CREATE(&krbContextKey, destroyKrbContext);
  55 }
  56
  57 OM_uint32
  58 gssEapKerberosInit(OM_uint32 *minor, krb5_context *context)
  59 {
  60     *minor = 0;
  61
  62     GSSEAP_ONCE(&krbContextKeyOnce, createKrbContextKey);
  63
  64     *context = GSSEAP_GETSPECIFIC(krbContextKey);
  65     if (*context == NULL) {
  66         *minor = krb5_init_context(context);
  67         if (*minor == 0) {
  68             if (GSSEAP_SETSPECIFIC(krbContextKey, *context) != 0) {
  69                 *minor = errno;
  70                 krb5_free_context(*context);
  71                 *context = NULL;
  72             }
  73         }
  74     }
  75
  76     return *minor == 0 ? GSS_S_COMPLETE : GSS_S_FAILURE;
  77 }
  78
  79 /*
  80  * Derive a key K for RFC 4121 use by using the following
  81  * derivation function (based on RFC 4402);
  82  *
  83  * KMSK = random-to-key(MSK)
  84  * Tn = pseudo-random(KMSK, n || "rfc4121-gss-eap")
  85  * L = output key size
  86  * K = truncate(L, T1 || T2 || .. || Tn)
  87  */
  88 OM_uint32
  89 gssEapDeriveRfc3961Key(OM_uint32 *minor,
  90                        const unsigned char *inputKey,
  91                        size_t inputKeyLength,
  92                        krb5_enctype encryptionType,
  93                        krb5_keyblock *pKey)
  94 {
  95     krb5_context krbContext;
  96 #ifndef HAVE_HEIMDAL_VERSION
  97     krb5_data data;
  98 #endif
  99     krb5_data ns, t, prfOut;
 100     krb5_keyblock kd;
 101     krb5_error_code code;
 102     size_t randomLength, keyLength, prfLength;
 103     unsigned char constant[4 + sizeof("rfc4121-gss-eap") - 1], *p;
 104     ssize_t i, remain;
 105
 106     assert(encryptionType != ENCTYPE_NULL);
 107
 108     memset(pKey, 0, sizeof(*pKey));
 109
 110     GSSEAP_KRB_INIT(&krbContext);
 111
 112     KRB_KEY_INIT(&kd);
 113     KRB_KEY_TYPE(&kd) = encryptionType;
 114
 115     t.data = NULL;
 116     t.length = 0;
 117
 118     prfOut.data = NULL;
 119     prfOut.length = 0;
 120
 121     code = krb5_c_keylengths(krbContext, encryptionType,
 122                              &randomLength, &keyLength);
 123     if (code != 0)
 124         goto cleanup;
 125
 126     KRB_KEY_DATA(&kd) = GSSEAP_MALLOC(keyLength);
 127     if (KRB_KEY_DATA(&kd) == NULL) {
 128         code = ENOMEM;
 129         goto cleanup;
 130     }
 131     KRB_KEY_LENGTH(&kd) = keyLength;
 132
 133     /* Convert MSK into a Kerberos key */
 134 #ifdef HAVE_HEIMDAL_VERSION
 135     code = krb5_random_to_key(krbContext, encryptionType, inputKey,
 136                               MIN(inputKeyLength, randomLength), &kd);
 137 #else
 138     data.length = MIN(inputKeyLength, randomLength);
 139     data.data = (char *)inputKey;
 140
 141     code = krb5_c_random_to_key(krbContext, encryptionType, &data, &kd);
 142 #endif
 143     if (code != 0)
 144         goto cleanup;
 145
 146     memset(&constant[0], 0, 4);
 147     memcpy(&constant[4], "rfc4121-gss-eap", sizeof("rfc4121-gss-eap") - 1);
 148
 149     ns.length = sizeof(constant);
 150     ns.data = (char *)constant;
 151
 152     /* Plug derivation constant and key into PRF */
 153     code = krb5_c_prf_length(krbContext, encryptionType, &prfLength);
 154     if (code != 0)
 155         goto cleanup;
 156
 157     t.length = prfLength;
 158     t.data = GSSEAP_MALLOC(t.length);
 159     if (t.data == NULL) {
 160         code = ENOMEM;
 161         goto cleanup;
 162     }
 163
 164     prfOut.length = randomLength;
 165     prfOut.data = GSSEAP_MALLOC(prfOut.length);
 166     if (prfOut.data == NULL) {
 167         code = ENOMEM;
 168         goto cleanup;
 169     }
 170
 171     for (i = 0, p = (unsigned char *)prfOut.data, remain = randomLength;
 172          remain > 0;
 173          p += t.length, remain -= t.length, i++)
 174     {
 175         store_uint32_be(i, ns.data);
 176
 177         code = krb5_c_prf(krbContext, &kd, &ns, &t);
 178         if (code != 0)
 179             goto cleanup;
 180
 181         memcpy(p, t.data, MIN(t.length, remain));
 182      }
 183
 184     /* Finally, convert PRF output into a new key which we will return */
 185 #ifdef HAVE_HEIMDAL_VERSION
 186     code = krb5_random_to_key(krbContext, encryptionType,
 187                               prfOut.data, prfOut.length, &kd);
 188 #else
 189     code = krb5_c_random_to_key(krbContext, encryptionType, &prfOut, &kd);
 190 #endif
 191     if (code != 0)
 192         goto cleanup;
 193
 194     *pKey = kd;
 195     KRB_KEY_DATA(&kd) = NULL;
 196
 197 cleanup:
 198     if (KRB_KEY_DATA(&kd) != NULL) {
 199         memset(KRB_KEY_DATA(&kd), 0, KRB_KEY_LENGTH(&kd));
 200         GSSEAP_FREE(KRB_KEY_DATA(&kd));
 201     }
 202     if (t.data != NULL) {
 203         memset(t.data, 0, t.length);
 204         GSSEAP_FREE(t.data);
 205     }
 206     if (prfOut.data != NULL) {
 207         memset(prfOut.data, 0, prfOut.length);
 208         GSSEAP_FREE(prfOut.data);
 209     }
 210     *minor = code;
 211     return (code == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE;
 212 }
 213
 214 #ifdef HAVE_KRB5INT_C_MANDATORY_CKSUMTYPE
 215 extern krb5_error_code
 216 krb5int_c_mandatory_cksumtype(krb5_context, krb5_enctype, krb5_cksumtype *);
 217 #endif
 218
 219 OM_uint32
 220 rfc3961ChecksumTypeForKey(OM_uint32 *minor,
 221                           krb5_keyblock *key,
 222                           krb5_cksumtype *cksumtype)
 223 {
 224     krb5_context krbContext;
 225 #ifndef HAVE_KRB5INT_C_MANDATORY_CKSUMTYPE
 226     krb5_data data;
 227     krb5_checksum cksum;
 228 #endif
 229
 230     GSSEAP_KRB_INIT(&krbContext);
 231
 232 #ifdef HAVE_KRB5INT_C_MANDATORY_CKSUMTYPE
 233     *minor = krb5int_c_mandatory_cksumtype(krbContext, KRB_KEY_TYPE(key),
 234                                            cksumtype);
 235     if (*minor != 0)
 236         return GSS_S_FAILURE;
 237 #else
 238     data.length = 0;
 239     data.data = NULL;
 240
 241     memset(&cksum, 0, sizeof(cksum));
 242
 243     /*
 244      * This is a complete hack but it's the only way to work with
 245      * MIT Kerberos pre-1.9 without using private API, as it does
 246      * not support passing in zero as the checksum type.
 247      */
 248     *minor = krb5_c_make_checksum(krbContext, 0, key, 0, &data, &cksum);
 249     if (*minor != 0)
 250         return GSS_S_FAILURE;
 251
 252 #ifdef HAVE_HEIMDAL_VERSION
 253     *cksumtype = cksum.cksumtype;
 254 #else
 255     *cksumtype = cksum.checksum_type;
 256 #endif
 257
 258     krb5_free_checksum_contents(krbContext, &cksum);
 259 #endif /* HAVE_KRB5INT_C_MANDATORY_CKSUMTYPE */
 260
 261     if (!krb5_c_is_keyed_cksum(*cksumtype)) {
 262         *minor = KRB5KRB_AP_ERR_INAPP_CKSUM;
 263         return GSS_S_FAILURE;
 264     }
 265
 266     return GSS_S_COMPLETE;
 267 }
 268
 269 #ifdef HAVE_HEIMDAL_VERSION
 270 static heim_general_string krbAnonymousPrincipalComponents[] =
 271     { KRB5_WELLKNOWN_NAME, KRB5_ANON_NAME };
 272
 273 static const Principal krbAnonymousPrincipalData = {
 274     { KRB5_NT_WELLKNOWN, { 2, krbAnonymousPrincipalComponents } },
 275     "WELLKNOWN:ANONYMOUS"
 276 };
 277 #endif
 278
 279 krb5_const_principal
 280 krbAnonymousPrincipal(void)
 281 {
 282 #ifdef HAVE_HEIMDAL_VERSION
 283     return &krbAnonymousPrincipalData;
 284 #else
 285     return krb5_anonymous_principal();
 286 #endif
 287 }
 288
 289 krb5_error_code
 290 krbCryptoLength(krb5_context krbContext,
 291 #ifdef HAVE_HEIMDAL_VERSION
 292                 krb5_crypto krbCrypto,
 293 #else
 294                 krb5_keyblock *key,
 295 #endif
 296                 int type,
 297                 size_t *length)
 298 {
 299 #ifdef HAVE_HEIMDAL_VERSION
 300     return krb5_crypto_length(krbContext, krbCrypto, type, length);
 301 #else
 302     unsigned int len;
 303     krb5_error_code code;
 304
 305     code = krb5_c_crypto_length(krbContext, KRB_KEY_TYPE(key), type, &len);
 306     if (code == 0)
 307         *length = (size_t)len;
 308
 309     return code;
 310 #endif
 311 }
 312
 313 krb5_error_code
 314 krbPaddingLength(krb5_context krbContext,
 315 #ifdef HAVE_HEIMDAL_VERSION
 316                  krb5_crypto krbCrypto,
 317 #else
 318                  krb5_keyblock *key,
 319 #endif
 320                  size_t dataLength,
 321                  size_t *padLength)
 322 {
 323     krb5_error_code code;
 324 #ifdef HAVE_HEIMDAL_VERSION
 325     size_t headerLength, paddingLength;
 326
 327     code = krbCryptoLength(krbContext, krbCrypto,
 328                            KRB5_CRYPTO_TYPE_HEADER, &headerLength);
 329     if (code != 0)
 330         return code;
 331
 332     dataLength += headerLength;
 333
 334     code = krb5_crypto_length(krbContext, krbCrypto,
 335                               KRB5_CRYPTO_TYPE_PADDING, &paddingLength);
 336     if (code != 0)
 337         return code;
 338
 339     if (paddingLength != 0 && (dataLength % paddingLength) != 0)
 340         *padLength = paddingLength - (dataLength % paddingLength);
 341     else
 342         *padLength = 0;
 343
 344     return 0;
 345 #else
 346     unsigned int pad;
 347
 348     code = krb5_c_padding_length(krbContext, KRB_KEY_TYPE(key), dataLength, &pad);
 349     if (code == 0)
 350         *padLength = (size_t)pad;
 351
 352     return code;
 353 #endif /* HAVE_HEIMDAL_VERSION */
 354 }
 355
 356 krb5_error_code
 357 krbBlockSize(krb5_context krbContext,
 358 #ifdef HAVE_HEIMDAL_VERSION
 359                  krb5_crypto krbCrypto,
 360 #else
 361                  krb5_keyblock *key,
 362 #endif
 363                  size_t *blockSize)
 364 {
 365 #ifdef HAVE_HEIMDAL_VERSION
 366     return krb5_crypto_getblocksize(krbContext, krbCrypto, blockSize);
 367 #else
 368     return krb5_c_block_size(krbContext, KRB_KEY_TYPE(key), blockSize);
 369 #endif
 370 }
 371
 372 krb5_error_code
 373 krbEnctypeToString(
 374 #ifdef HAVE_HEIMDAL_VERSION
 375                    krb5_context krbContext,
 376 #else
 377                    krb5_context krbContext GSSEAP_UNUSED,
 378 #endif
 379                    krb5_enctype enctype,
 380                    const char *prefix,
 381                    gss_buffer_t string)
 382 {
 383     krb5_error_code code;
 384 #ifdef HAVE_HEIMDAL_VERSION
 385     char *enctypeBuf = NULL;
 386 #else
 387     char enctypeBuf[128];
 388 #endif
 389     size_t prefixLength, enctypeLength;
 390
 391 #ifdef HAVE_HEIMDAL_VERSION
 392     code = krb5_enctype_to_string(krbContext, enctype, &enctypeBuf);
 393 #else
 394     code = krb5_enctype_to_name(enctype, 0, enctypeBuf, sizeof(enctypeBuf));
 395 #endif
 396     if (code != 0)
 397         return code;
 398
 399     prefixLength = (prefix != NULL) ? strlen(prefix) : 0;
 400     enctypeLength = strlen(enctypeBuf);
 401
 402     string->value = GSSEAP_MALLOC(prefixLength + enctypeLength + 1);
 403     if (string->value == NULL) {
 404 #ifdef HAVE_HEIMDAL_VERSION
 405         krb5_xfree(enctypeBuf);
 406 #endif
 407         return ENOMEM;
 408     }
 409
 410     if (prefixLength != 0)
 411         memcpy(string->value, prefix, prefixLength);
 412     memcpy((char *)string->value + prefixLength, enctypeBuf, enctypeLength);
 413
 414     string->length = prefixLength + enctypeLength;
 415     ((char *)string->value)[string->length] = '\0';
 416
 417 #ifdef HAVE_HEIMDAL_VERSION
 418     krb5_xfree(enctypeBuf);
 419 #endif
 420
 421     return 0;
 422 }
 423
 424 krb5_error_code
 425 krbMakeAuthDataKdcIssued(krb5_context context,
 426                          const krb5_keyblock *key,
 427                          krb5_const_principal issuer,
 428 #ifdef HAVE_HEIMDAL_VERSION
 429                          const AuthorizationData *authdata,
 430                          AuthorizationData *adKdcIssued
 431 #else
 432                          krb5_authdata *const *authdata,
 433                          krb5_authdata ***adKdcIssued
 434 #endif
 435                          )
 436 {
 437 #ifdef HAVE_HEIMDAL_VERSION
 438     krb5_error_code code;
 439     AD_KDCIssued kdcIssued;
 440     AuthorizationDataElement adDatum;
 441     unsigned char *buf;
 442     size_t buf_size, len;
 443     krb5_crypto crypto = NULL;
 444
 445     memset(&kdcIssued, 0, sizeof(kdcIssued));
 446     memset(adKdcIssued, 0, sizeof(*adKdcIssued));
 447
 448     kdcIssued.i_realm = issuer->realm != NULL ? (Realm *)&issuer->realm : NULL;
 449     kdcIssued.i_sname = (PrincipalName *)&issuer->name;
 450     kdcIssued.elements = *authdata;
 451
 452     ASN1_MALLOC_ENCODE(AuthorizationData, buf, buf_size, authdata, &len, code);
 453     if (code != 0)
 454         goto cleanup;
 455
 456     code = krb5_crypto_init(context, key, 0, &crypto);
 457     if (code != 0)
 458         goto cleanup;
 459
 460     code = krb5_create_checksum(context, crypto, KRB5_KU_AD_KDC_ISSUED,
 461                                 0, buf, buf_size, &kdcIssued.ad_checksum);
 462     if (code != 0)
 463         goto cleanup;
 464
 465     GSSEAP_FREE(buf);
 466     buf = NULL;
 467
 468     ASN1_MALLOC_ENCODE(AD_KDCIssued, buf, buf_size, &kdcIssued, &len, code);
 469     if (code != 0)
 470         goto cleanup;
 471
 472     adDatum.ad_type = KRB5_AUTHDATA_KDC_ISSUED;
 473     adDatum.ad_data.length = buf_size;
 474     adDatum.ad_data.data = buf;
 475
 476     code = add_AuthorizationData(adKdcIssued, &adDatum);
 477     if (code != 0)
 478         goto cleanup;
 479
 480 cleanup:
 481     if (buf != NULL)
 482         GSSEAP_FREE(buf);
 483     if (crypto != NULL)
 484         krb5_crypto_destroy(context, crypto);
 485     free_Checksum(&kdcIssued.ad_checksum);
 486
 487     return code;
 488 #else
 489     return krb5_make_authdata_kdc_issued(context, key, issuer, authdata,
 490                                          adKdcIssued);
 491 #endif /* HAVE_HEIMDAL_VERSION */
 492 }
 493
 494 krb5_error_code
 495 krbMakeCred(krb5_context krbContext,
 496             krb5_auth_context authContext,
 497             krb5_creds *creds,
 498             krb5_data *data)
 499 {
 500     krb5_error_code code;
 501 #ifdef HAVE_HEIMDAL_VERSION
 502     KRB_CRED krbCred;
 503     KrbCredInfo krbCredInfo;
 504     EncKrbCredPart encKrbCredPart;
 505     krb5_keyblock *key;
 506     krb5_crypto krbCrypto = NULL;
 507     krb5_data encKrbCredPartData;
 508     krb5_replay_data rdata;
 509     size_t len;
 510 #else
 511     krb5_data *d = NULL;
 512 #endif
 513
 514     memset(data, 0, sizeof(*data));
 515 #ifdef HAVE_HEIMDAL_VERSION
 516     memset(&krbCred,        0, sizeof(krbCred));
 517     memset(&krbCredInfo,    0, sizeof(krbCredInfo));
 518     memset(&encKrbCredPart, 0, sizeof(encKrbCredPart));
 519     memset(&rdata,          0, sizeof(rdata));
 520
 521     if (authContext->local_subkey)
 522         key = authContext->local_subkey;
 523     else if (authContext->remote_subkey)
 524         key = authContext->remote_subkey;
 525     else
 526         key = authContext->keyblock;
 527
 528     krbCred.pvno = 5;
 529     krbCred.msg_type = krb_cred;
 530     krbCred.tickets.val = (Ticket *)GSSEAP_CALLOC(1, sizeof(Ticket));
 531     if (krbCred.tickets.val == NULL) {
 532         code = ENOMEM;
 533         goto cleanup;
 534     }
 535     krbCred.tickets.len = 1;
 536
 537     code = decode_Ticket(creds->ticket.data,
 538                          creds->ticket.length,
 539                          krbCred.tickets.val, &len);
 540     if (code != 0)
 541         goto cleanup;
 542
 543     krbCredInfo.key         = creds->session;
 544     krbCredInfo.prealm      = &creds->client->realm;
 545     krbCredInfo.pname       = &creds->client->name;
 546     krbCredInfo.flags       = &creds->flags.b;
 547     krbCredInfo.authtime    = &creds->times.authtime;
 548     krbCredInfo.starttime   = &creds->times.starttime;
 549     krbCredInfo.endtime     = &creds->times.endtime;
 550     krbCredInfo.renew_till  = &creds->times.renew_till;
 551     krbCredInfo.srealm      = &creds->server->realm;
 552     krbCredInfo.sname       = &creds->server->name;
 553     krbCredInfo.caddr       = creds->addresses.len ? &creds->addresses : NULL;
 554
 555     encKrbCredPart.ticket_info.len = 1;
 556     encKrbCredPart.ticket_info.val = &krbCredInfo;
 557     if (authContext->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) {
 558         rdata.seq                  = authContext->local_seqnumber;
 559         encKrbCredPart.nonce       = (int32_t *)&rdata.seq;
 560     } else {
 561         encKrbCredPart.nonce       = NULL;
 562     }
 563     if (authContext->flags & KRB5_AUTH_CONTEXT_DO_TIME) {
 564         krb5_us_timeofday(krbContext, &rdata.timestamp, &rdata.usec);
 565         encKrbCredPart.timestamp   = &rdata.timestamp;
 566         encKrbCredPart.usec        = &rdata.usec;
 567     } else {
 568         encKrbCredPart.timestamp   = NULL;
 569         encKrbCredPart.usec        = NULL;
 570     }
 571     encKrbCredPart.s_address       = authContext->local_address;
 572     encKrbCredPart.r_address       = authContext->remote_address;
 573
 574     ASN1_MALLOC_ENCODE(EncKrbCredPart, encKrbCredPartData.data,
 575                        encKrbCredPartData.length, &encKrbCredPart,
 576                        &len, code);
 577     if (code != 0)
 578         goto cleanup;
 579
 580     code = krb5_crypto_init(krbContext, key, 0, &krbCrypto);
 581     if (code != 0)
 582         goto cleanup;
 583
 584     code = krb5_encrypt_EncryptedData(krbContext,
 585                                       krbCrypto,
 586                                       KRB5_KU_KRB_CRED,
 587                                       encKrbCredPartData.data,
 588                                       encKrbCredPartData.length,
 589                                       0,
 590                                       &krbCred.enc_part);
 591     if (code != 0)
 592         goto cleanup;
 593
 594     ASN1_MALLOC_ENCODE(KRB_CRED, data->data, data->length,
 595                        &krbCred, &len, code);
 596     if (code != 0)
 597         goto cleanup;
 598
 599     if (authContext->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE)
 600         authContext->local_seqnumber++;
 601
 602 cleanup:
 603     if (krbCrypto != NULL)
 604         krb5_crypto_destroy(krbContext, krbCrypto);
 605     free_KRB_CRED(&krbCred);
 606     krb5_data_free(&encKrbCredPartData);
 607
 608     return code;
 609 #else
 610     code = krb5_mk_1cred(krbContext, authContext, creds, &d, NULL);
 611     if (code == 0) {
 612         *data = *d;
 613         GSSEAP_FREE(d);
 614     }
 615
 616     return code;
 617 #endif /* HAVE_HEIMDAL_VERSION */
 618 }