path: root/server/kstuff.c.auth

#ifdef KERBEROS
/* This file is part of the Project Athena Zephyr Notification System.
 * It contains functions for dealing with Kerberos functions in the server.
 *
 *	Created by:	John T Kohl
 *
 *	Copyright (c) 1988 by the Massachusetts Institute of Technology.
 *	For copying and distribution information, see the file
 *	"mit-copyright.h". 
 */
/*
 *	$Source$
 *	$Header$
 */

#ifndef lint
#ifndef SABER
static char rcsid_kstuff_c[] = "$Id$";
#endif
#endif

#include "zserver.h"

#include <ctype.h>
#include <netdb.h>
#include <string.h>

#include <zephyr/zephyr_internal.h>
#ifdef KERBEROS
#include <zephyr/krb_err.h>
#endif

/* Keep a hash table mapping tickets to session keys, so we can do a fast
 * check of the cryptographic checksum without doing and DES decryptions.
 * Also remember the expiry time of the ticket, so that we can sweep the
 * table periodically. */

#define HASHTAB_SIZE 4091

typedef struct hash_entry Hash_entry;

/* The ticket comes at the end, in a variable-length array. */
struct hash_entry {
    C_Block session_key;
    time_t expires;
    char srcprincipal[ANAME_SZ+INST_SZ+REALM_SZ+4];
    Hash_entry *next;
    int ticket_len;
    unsigned char ticket[1];
};

Hash_entry *hashtab[HASHTAB_SIZE];

static char tkt_file[] = ZEPHYR_TKFILE;

#ifdef __STDC__
static int hash_ticket(unsigned char *, int);
static void add_session_key(KTEXT, C_Block, char *, time_t);
static int find_session_key(KTEXT, C_Block, char *);
#else
static int hash_ticket();
static void add_session_key();
static int find_session_key();
#endif

/*
 * GetKerberosData
 *
 * get ticket from file descriptor and decode it.
 * Return KFAILURE if we barf on reading the ticket, else return
 * the value of rd_ap_req() applied to the ticket.
 */
int
GetKerberosData(fd, haddr, kdata, service, srvtab)
     int fd; /* file descr. to read from */
     struct in_addr haddr; /* address of foreign host on fd */
     AUTH_DAT *kdata;	/* kerberos data (returned) */
     char *service; /* service principal desired */
     char *srvtab; /* file to get keys from */
{
    char p[20];
    KTEXT_ST ticket;		/* will get Kerberos ticket from client */
    int i;
    char instance[INST_SZ];

    /*
     * Get the Kerberos ticket.  The first few characters, terminated
     * by a blank, should give us a length; then get than many chars
     * which will be the ticket proper.
     */
    for (i=0; i<20; i++) {
	if (read(fd, &p[i], 1) != 1) {
	    syslog(LOG_WARNING,"bad read tkt len");
	    return(KFAILURE);
	}
	if (p[i] == ' ') {
	    p[i] = '\0';
	    break;
	}
    }
    ticket.length = atoi(p);
    if ((i==20) || (ticket.length<=0) || (ticket.length>MAX_KTXT_LEN)) {
	syslog(LOG_WARNING,"bad tkt len %d",ticket.length);
	return(KFAILURE);
    }
    for (i=0; i<ticket.length; i++) {
	if (read(fd, (caddr_t) &(ticket.dat[i]), 1) != 1) {
	    syslog(LOG_WARNING,"bad tkt read");
	    return(KFAILURE);
	}
    }
    /*
     * now have the ticket.  use it to get the authenticated
     * data from Kerberos.
     */
    (void) strcpy(instance,"*");		/* let Kerberos fill it in */

    return(krb_rd_req(&ticket, service, instance, haddr.s_addr,
		      kdata, srvtab ? srvtab : ""));
}

/*
 * SendKerberosData
 * 
 * create and transmit a ticket over the file descriptor for service.host
 * return failure codes if appropriate, or 0 if we
 * get the ticket and write it to the file descriptor
 */

int
SendKerberosData(fd, ticket, service, host)
     int fd;	/* file descriptor to write onto */
     KTEXT ticket;	/* where to put ticket (return) */
     char *service;	/* service name, foreign host */
     char *host;
{
    int rem;
    char p[32];
    char krb_realm[REALM_SZ];
    int written;
    int size_to_write;

    rem = krb_get_lrealm(krb_realm,1);
    if (rem != KSUCCESS)
	return rem + krb_err_base;

    rem = krb_mk_req( ticket, service, host, krb_realm, (u_long)0 );
    if (rem != KSUCCESS)
	return rem + krb_err_base;

    (void) sprintf(p,"%d ",ticket->length);
    size_to_write = strlen (p);
    if ((written = write(fd, p, size_to_write)) != size_to_write)
	    if (written < 0)
		    return errno;
	    else
		    return ZSRV_PKSHORT;
    if ((written = write(fd, (caddr_t) (ticket->dat), ticket->length)) != ticket->length)
	    if (written < 0)
		    return errno;
	    else
		    return ZSRV_PKSHORT;

    return 0;
}

/* Hack to replace the kerberos library's idea of the ticket file with
   our idea */
char *
tkt_string()
{
    return tkt_file;
}

int
ZCheckAuthentication(notice, from)
    ZNotice_t *notice;
    struct sockaddr_in *from;
{	
#ifdef Z_HaveKerberos
    int result, len;
    char srcprincipal[ANAME_SZ+INST_SZ+REALM_SZ+4];
    KTEXT_ST authent, ticket;
    AUTH_DAT dat;
    ZChecksum_t our_checksum;
    unsigned long cksum;
    CREDENTIALS cred;
    C_Block session_key;

    if (!notice->z_auth)
	return (ZAUTH_NO);

    /* Check for bogus authentication data length. */
    if (notice->z_authent_len <= 0)
	return(ZAUTH_FAILED);

    /* Read in the authentication data. */
    if (ZReadAscii(notice->z_ascii_authent, 
		   strlen(notice->z_ascii_authent)+1, 
		   (unsigned char *)authent.dat, 
		   notice->z_authent_len) == ZERR_BADFIELD) {
	return (ZAUTH_FAILED);
    }
    authent.length = notice->z_authent_len;

    /* Copy the ticket out of the authentication data. */
    if (krb_find_ticket(&authent, &ticket) != RD_AP_OK)
	return (ZAUTH_FAILED);

    /* Try to do a fast check against the cryptographic checksum. */
    if (find_session_key(&ticket, session_key, srcprincipal) >= 0) {
	if (strcmp(srcprincipal, notice->z_sender) != 0)
	    return (ZAUTH_FAILED);
	if (notice->z_time.tv_sec - NOW > CLOCK_SKEW)
	    return (ZAUTH_FAILED);
#ifdef NOENCRYPTION
	our_checksum = 0;
#else
	len = notice->z_default_format + strlen(notice->z_default_format)
	    + 1 - notice->z_packet;
	result = des_quad_cksum(notice->z_packet, NULL, len, 0, session_key);
	result ^= des_quad_cksum(notice->z_message, NULL, notice->z_message_len,
				 0, session_key);
	our_checksum = (ZChecksum_t) result;
#endif
	/* If checksum matches, packet is authentic.  Otherwise, check
	 * the authenticator as if we didn't have the session key cached
	 * and return ZAUTH_CKSUM_FAILED.  This is a rare case (since the
	 * ticket isn't cached after a checksum failure), so don't worry
	 * about the extra des_quad_cksum() call. */
	if (our_checksum == notice->z_checksum)
	    return (ZAUTH_YES);
    }

    /* We don't have the session key cached; do it the long way. */
    result = krb_rd_req(&authent, SERVER_SERVICE, SERVER_INSTANCE,
			from->sin_addr.s_addr, &dat, SERVER_SRVTAB);
    if (result == RD_AP_OK) {
	(void) memcpy((char *)__Zephyr_session, (char *)dat.session, 
		      sizeof(C_Block));
	(void) sprintf(srcprincipal, "%s%s%s@%s", dat.pname, 
		       dat.pinst[0]?".":"", dat.pinst, dat.prealm);
	if (strcmp(srcprincipal, notice->z_sender))
	    return (ZAUTH_FAILED);
    } else {
	return (ZAUTH_FAILED);	/* didn't decode correctly */
    }

    /* Check the cryptographic checksum. */
#ifdef NOENCRYPTION
    our_checksum = 0;
#else
    len = notice->z_default_format + strlen(notice->z_default_format)
	+ 1 - notice->z_packet;
    cksum = des_quad_cksum(notice->z_packet, NULL, len, 0, dat.session);
    our_checksum = (ZChecksum_t) cksum;
#endif
    if (our_checksum != notice->z_checksum)
	return (ZAUTH_CKSUM_FAILED);

    /* Record the session key, expiry time, and source principal in the
     * hash table, so we can do a fast check next time. */
    add_session_key(&ticket, dat.session, srcprincipal,
		    (time_t)(dat.time_sec + dat.life * 5 * 60));

    return (ZAUTH_YES);

#else /* not Z_HaveKerberos */
    return (notice->z_auth ? ZAUTH_YES : ZAUTH_NO);
#endif
}

static int hash_ticket(p, len)
    unsigned char *p;
    int len;
{
    unsigned long hashval = 0, g;

    for (; len > 0; p++, len--) {
	hashval = (hashval << 4) + *p;
	g = hashval & 0xf0000000;
	if (g) {
	    hashval ^= g >> 24;
	    hashval ^= g;
	}
    }
    return hashval % HASHTAB_SIZE;
}

static void add_session_key(ticket, session_key, srcprincipal, expires)
    KTEXT ticket;
    C_Block session_key;
    char *srcprincipal;
    time_t expires;
{
    Hash_entry *entry;
    int hashval;

    /* If we can't allocate memory for the hash table entry, just forget
     * about it. */
    entry = (Hash_entry *) xmalloc(sizeof(Hash_entry) - 1 + ticket->length);
    if (!entry)
	return;

    /* Initialize the new entry. */
    memcpy(entry->session_key, session_key, sizeof(entry->session_key));
    strcpy(entry->srcprincipal, srcprincipal);
    entry->expires = expires;
    entry->ticket_len = ticket->length;
    memcpy(entry->ticket, ticket->dat, ticket->length * sizeof(unsigned char));

    /* Insert the new entry in the hash table. */
    hashval = hash_ticket(ticket->dat, ticket->length);
    entry->next = hashtab[hashval];
    hashtab[hashval] = entry;
}

static int find_session_key(ticket, key, srcprincipal)
    KTEXT ticket;
    C_Block key;
    char *srcprincipal;
{
    unsigned char *dat;
    int hashval, len;
    Hash_entry *entry;

    dat = ticket->dat;
    len = ticket->length;
    hashval = hash_ticket(dat, len);

    for (entry = hashtab[hashval]; entry; entry = entry->next) {
	if (entry->ticket_len == len && memcmp(entry->ticket, dat, len) == 0) {
	    memcpy(key, entry->session_key, sizeof(entry->session_key));
	    strcpy(srcprincipal, entry->srcprincipal);
	    return 0;
	}
    }
    return -1;
}

void sweep_ticket_hash_table(arg)
    void *arg;
{
    int i;
    Hash_entry **ptr, *entry;

    for (i = 0; i < HASHTAB_SIZE; i++) {
	ptr = &hashtab[i];
	while (*ptr) {
	    entry = *ptr;
	    if (entry->expires < NOW) {
		*ptr = entry->next;
		free(entry);
	    } else {
		ptr = &(*ptr)->next;
	    }
	}
    }
    timer_set_rel(SWEEP_INTERVAL, sweep_ticket_hash_table, NULL);
}

#endif /* KERBEROS */