2 * Copyright (c) 2006 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 RCSID("$Id: kx509.c,v 1.1 2006/12/28 21:03:53 lha Exp $");
44 _kdc_try_kx509_request(void *ptr, size_t len, Kx509Request *req, size_t *size)
48 if (memcmp("\x00\x00\x02\x00", ptr, 4) != 0)
50 return decode_Kx509Request(((unsigned char *)ptr) + 4, len - 4, req, size);
57 static const char version_2_0[4] = {0 , 0, 2, 0};
59 static krb5_error_code
60 verify_req_hash(krb5_context context,
61 const Kx509Request *req,
64 unsigned char digest[SHA_DIGEST_LENGTH];
67 if (req->pk_hash.length != sizeof(digest)) {
68 krb5_set_error_string(context, "pk-hash have wrong length: %lu",
69 (unsigned long)req->pk_hash.length);
70 return KRB5KDC_ERR_PREAUTH_FAILED;
75 key->keyvalue.data, key->keyvalue.length,
77 if (sizeof(digest) != HMAC_size(&ctx))
78 krb5_abortx(context, "runtime error, hmac buffer wrong size in kx509");
79 HMAC_Update(&ctx, version_2_0, sizeof(version_2_0));
80 HMAC_Update(&ctx, req->pk_key.data, req->pk_key.length);
81 HMAC_Final(&ctx, digest, 0);
82 HMAC_CTX_cleanup(&ctx);
84 if (memcmp(req->pk_hash.data, digest, sizeof(digest)) != 0) {
85 krb5_set_error_string(context, "pk-hash is not correct");
86 return KRB5KDC_ERR_PREAUTH_FAILED;
91 static krb5_error_code
92 calculate_reply_hash(krb5_context context,
101 key->keyvalue.data, key->keyvalue.length,
103 rep->hash->length = HMAC_size(&ctx);
104 rep->hash->data = malloc(rep->hash->length);
105 if (rep->hash->data == NULL) {
106 HMAC_CTX_cleanup(&ctx);
107 krb5_set_error_string(context, "out of memory");
111 HMAC_Update(&ctx, version_2_0, sizeof(version_2_0));
112 if (rep->error_code) {
113 int32_t t = *rep->error_code;
115 unsigned char p = (t & 0xff);
116 HMAC_Update(&ctx, &p, 1);
120 if (rep->certificate)
121 HMAC_Update(&ctx, rep->certificate->data, rep->certificate->length);
123 HMAC_Update(&ctx, *rep->e_text, strlen(*rep->e_text));
125 HMAC_Final(&ctx, rep->hash->data, 0);
126 HMAC_CTX_cleanup(&ctx);
132 * Build a certifate for `principal´ that will expire at `endtime´.
135 static krb5_error_code
136 build_certificate(krb5_context context,
137 krb5_kdc_configuration *config,
138 const krb5_data *key,
140 krb5_principal principal,
141 krb5_data *certificate)
143 /* XXX write code here to generate certificates */
151 snprintf(tstr, sizeof(tstr), "%lu", (unsigned long)endtime);
153 ret = base64_encode(key->data, key->length, &strkey);
155 krb5_set_error_string(context, "failed to base64 encode key");
159 program = krb5_config_get_string(context,
162 "kx509_cert_program",
164 if (program == NULL) {
166 krb5_set_error_string(context, "no certificate program configured");
170 ret = krb5_unparse_name(context, principal, &str);
176 pid = pipe_execv(&in, &out, NULL, program, str, tstr, NULL);
180 krb5_set_error_string(context,
181 "Failed to run the cert program %s",
185 fprintf(in, "%s\n", strkey);
190 unsigned buf[1024 * 10];
193 len = fread(buf, 1, sizeof(buf), out);
196 krb5_set_error_string(context,
197 "Certificate program returned no data");
198 return KRB5KDC_ERR_PREAUTH_FAILED;
200 ret = krb5_data_copy(certificate, buf, len);
202 krb5_set_error_string(context, "Failed To copy certificate");
207 waitpid(pid, NULL, 0);
216 _kdc_do_kx509(krb5_context context,
217 krb5_kdc_configuration *config,
218 const Kx509Request *req, krb5_data *reply,
219 const char *from, struct sockaddr *addr)
222 krb5_ticket *ticket = NULL;
223 krb5_flags ap_req_options;
224 krb5_auth_context ac = NULL;
225 krb5_keytab id = NULL;
226 krb5_principal sprincipal = NULL, cprincipal = NULL;
230 krb5_keyblock *key = NULL;
232 krb5_data_zero(reply);
233 memset(&rep, 0, sizeof(rep));
235 if(!config->enable_kx509) {
236 kdc_log(context, config, 0,
237 "Rejected kx509 request (disabled) from %s", from);
238 return KRB5KDC_ERR_POLICY;
241 kdc_log(context, config, 0, "Kx509 request from %s", from);
243 ret = krb5_kt_resolve(context, "HDB:", &id);
245 kdc_log(context, config, 0, "Can't open database for digest");
249 ret = krb5_rd_req(context,
259 ret = krb5_ticket_get_client(context, ticket, &cprincipal);
263 ret = krb5_unparse_name(context, cprincipal, &cname);
267 /* verify server principal */
269 ret = krb5_sname_to_principal(context, NULL, "kca_service",
270 KRB5_NT_UNKNOWN, &sprincipal);
275 krb5_principal principal = NULL;
277 ret = krb5_ticket_get_server(context, ticket, &principal);
281 ret = krb5_principal_compare(context, sprincipal, principal);
282 krb5_free_principal(context, principal);
284 ret = KRB5KDC_ERR_SERVER_NOMATCH;
285 krb5_set_error_string(context,
286 "User %s used wrong Kx509 service principal",
292 ret = krb5_auth_con_getkey(context, ac, &key);
293 if (ret || key == NULL) {
294 krb5_set_error_string(context, "Kx509 can't get session key");
298 ret = verify_req_hash(context, req, key);
302 ALLOC(rep.certificate);
303 if (rep.certificate == NULL)
305 krb5_data_zero(rep.certificate);
307 if (rep.hash == NULL)
309 krb5_data_zero(rep.hash);
311 ret = build_certificate(context, config, &req->pk_key,
312 krb5_ticket_get_endtime(context, ticket),
313 cprincipal, rep.certificate);
317 ret = calculate_reply_hash(context, key, &rep);
322 * Encode reply, [ version | Kx509Response ]
328 ASN1_MALLOC_ENCODE(Kx509Response, data.data, data.length, &rep,
331 krb5_set_error_string(context, "Failed to encode kx509 reply");
334 if (size != data.length)
335 krb5_abortx(context, "ASN1 internal error");
337 ret = krb5_data_alloc(reply, data.length + sizeof(version_2_0));
342 memcpy(reply->data, version_2_0, sizeof(version_2_0));
343 memcpy(((unsigned char *)reply->data) + sizeof(version_2_0),
344 data.data, data.length);
348 kdc_log(context, config, 0, "Successful Kx509 request for %s", cname);
352 krb5_auth_con_free(context, ac);
354 krb5_warn(context, ret, "Kx509 request from %s failed", from);
356 krb5_free_ticket(context, ticket);
358 krb5_kt_close(context, id);
360 krb5_free_principal(context, sprincipal);
362 krb5_free_principal(context, cprincipal);
364 krb5_free_keyblock (context, key);
367 free_Kx509Response(&rep);