src/kdc/kdc_util.h

   1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
   2 /* kdc/kdc_util.h */
   3 /*
   4  * Portions Copyright (C) 2007 Apple Inc.
   5  * Copyright 1990, 2007, 2014 by the Massachusetts Institute of Technology.
   6  *
   7  * Export of this software from the United States of America may
   8  *   require a specific license from the United States Government.
   9  *   It is the responsibility of any person or organization contemplating
  10  *   export to obtain such a license before exporting.
  11  *
  12  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
  13  * distribute this software and its documentation for any purpose and
  14  * without fee is hereby granted, provided that the above copyright
  15  * notice appear in all copies and that both that copyright notice and
  16  * this permission notice appear in supporting documentation, and that
  17  * the name of M.I.T. not be used in advertising or publicity pertaining
  18  * to distribution of the software without specific, written prior
  19  * permission.  Furthermore if you modify this software you must label
  20  * your software as modified software and not distribute it in such a
  21  * fashion that it might be confused with the original M.I.T. software.
  22  * M.I.T. makes no representations about the suitability of
  23  * this software for any purpose.  It is provided "as is" without express
  24  * or implied warranty.
  25  *
  26  *
  27  * Declarations for policy.c
  28  */
  29
  30 #ifndef __KRB5_KDC_UTIL__
  31 #define __KRB5_KDC_UTIL__
  32
  33 #include <krb5/kdcpreauth_plugin.h>
  34 #include "kdb.h"
  35 #include "net-server.h"
  36 #include "realm_data.h"
  37 #include "reqstate.h"
  38
  39 krb5_error_code check_hot_list (krb5_ticket *);
  40 krb5_boolean is_local_principal(kdc_realm_t *kdc_active_realm,
  41                                 krb5_const_principal princ1);
  42 krb5_boolean krb5_is_tgs_principal (krb5_const_principal);
  43 krb5_boolean is_cross_tgs_principal(krb5_const_principal);
  44 krb5_error_code
  45 add_to_transited (krb5_data *,
  46                   krb5_data *,
  47                   krb5_principal,
  48                   krb5_principal,
  49                   krb5_principal);
  50 krb5_error_code
  51 compress_transited (krb5_data *,
  52                     krb5_principal,
  53                     krb5_data *);
  54 krb5_error_code
  55 concat_authorization_data (krb5_context,
  56                            krb5_authdata **,
  57                            krb5_authdata **,
  58                            krb5_authdata ***);
  59 krb5_error_code
  60 fetch_last_req_info (krb5_db_entry *, krb5_last_req_entry ***);
  61
  62 krb5_error_code
  63 kdc_convert_key (krb5_keyblock *, krb5_keyblock *, int);
  64 krb5_error_code
  65 kdc_process_tgs_req (kdc_realm_t *, krb5_kdc_req *,
  66                      const krb5_fulladdr *,
  67                      krb5_data *,
  68                      krb5_ticket **,
  69                      krb5_db_entry **krbtgt_ptr,
  70                      krb5_keyblock **, krb5_keyblock **,
  71                      krb5_pa_data **pa_tgs_req);
  72
  73 krb5_error_code
  74 kdc_get_server_key (krb5_context, krb5_ticket *, unsigned int,
  75                     krb5_boolean match_enctype,
  76                     krb5_db_entry **, krb5_keyblock **, krb5_kvno *);
  77
  78 krb5_error_code
  79 get_local_tgt(krb5_context context, const krb5_data *realm,
  80               krb5_db_entry *candidate, krb5_db_entry **alias_out,
  81               krb5_db_entry **storage_out);
  82
  83 int
  84 validate_as_request (kdc_realm_t *, krb5_kdc_req *, krb5_db_entry,
  85                      krb5_db_entry, krb5_timestamp,
  86                      const char **, krb5_pa_data ***);
  87
  88 int
  89 validate_forwardable(krb5_kdc_req *, krb5_db_entry,
  90                      krb5_db_entry, krb5_timestamp,
  91                      const char **);
  92
  93 int
  94 validate_tgs_request (kdc_realm_t *, krb5_kdc_req *, krb5_db_entry,
  95                       krb5_ticket *, krb5_timestamp,
  96                       const char **, krb5_pa_data ***);
  97
  98 krb5_error_code
  99 check_indicators(krb5_context context, krb5_db_entry *server,
 100                  krb5_data *const *indicators);
 101
 102 int
 103 fetch_asn1_field (unsigned char *, unsigned int, unsigned int, krb5_data *);
 104
 105 krb5_enctype
 106 select_session_keytype (kdc_realm_t *kdc_active_realm,
 107                         krb5_db_entry *server,
 108                         int nktypes,
 109                         krb5_enctype *ktypes);
 110
 111 void limit_string (char *name);
 112
 113 void
 114 ktypes2str(char *s, size_t len, int nktypes, krb5_enctype *ktype);
 115
 116 void
 117 rep_etypes2str(char *s, size_t len, krb5_kdc_rep *rep);
 118
 119 /* authind.c */
 120 krb5_boolean
 121 authind_contains(krb5_data *const *indicators, const char *ind);
 122
 123 krb5_error_code
 124 authind_add(krb5_context context, const char *ind, krb5_data ***indicators);
 125
 126 krb5_error_code
 127 authind_extract(krb5_context context, krb5_authdata **authdata,
 128                 krb5_data ***indicators);
 129
 130 /* cammac.c */
 131 krb5_error_code
 132 cammac_create(krb5_context context, krb5_enc_tkt_part *enc_tkt_reply,
 133               krb5_keyblock *server_key, krb5_db_entry *krbtgt,
 134               krb5_authdata **contents, krb5_authdata ***cammac_out);
 135
 136 krb5_boolean
 137 cammac_check_kdcver(krb5_context context, krb5_cammac *cammac,
 138                     krb5_enc_tkt_part *enc_tkt, krb5_db_entry *krbtgt);
 139
 140 /* do_as_req.c */
 141 void
 142 process_as_req (krb5_kdc_req *, krb5_data *,
 143                 const krb5_fulladdr *, const krb5_fulladdr *, kdc_realm_t *,
 144                 verto_ctx *, loop_respond_fn, void *);
 145
 146 /* do_tgs_req.c */
 147 krb5_error_code
 148 process_tgs_req (krb5_kdc_req *, krb5_data *, const krb5_fulladdr *,
 149                  kdc_realm_t *, krb5_data ** );
 150 /* dispatch.c */
 151 void
 152 dispatch (void *,
 153           const krb5_fulladdr *,
 154           const krb5_fulladdr *,
 155           krb5_data *,
 156           int,
 157           verto_ctx *,
 158           loop_respond_fn,
 159           void *);
 160
 161 void
 162 kdc_err(krb5_context call_context, errcode_t code, const char *fmt, ...)
 163 #if !defined(__cplusplus) && (__GNUC__ > 2)
 164     __attribute__((__format__(__printf__, 3, 4)))
 165 #endif
 166     ;
 167
 168 /* kdc_preauth.c */
 169 krb5_boolean
 170 enctype_requires_etype_info_2(krb5_enctype enctype);
 171
 172 const char *
 173 missing_required_preauth (krb5_db_entry *client,
 174                           krb5_db_entry *server,
 175                           krb5_enc_tkt_part *enc_tkt_reply);
 176 typedef void (*kdc_hint_respond_fn)(void *arg);
 177 void
 178 get_preauth_hint_list(krb5_kdc_req *request,
 179                       krb5_kdcpreauth_rock rock, krb5_pa_data ***e_data_out,
 180                       kdc_hint_respond_fn respond, void *arg);
 181 void
 182 load_preauth_plugins(struct server_handle * handle, krb5_context context,
 183                      verto_ctx *ctx);
 184 void
 185 unload_preauth_plugins(krb5_context context);
 186
 187 typedef void (*kdc_preauth_respond_fn)(void *arg, krb5_error_code code);
 188
 189 void
 190 check_padata(krb5_context context, krb5_kdcpreauth_rock rock,
 191              krb5_data *req_pkt, krb5_kdc_req *request,
 192              krb5_enc_tkt_part *enc_tkt_reply, void **padata_context,
 193              krb5_pa_data ***e_data, krb5_boolean *typed_e_data,
 194              kdc_preauth_respond_fn respond, void *state);
 195
 196 krb5_error_code
 197 return_padata(krb5_context context, krb5_kdcpreauth_rock rock,
 198               krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply,
 199               krb5_keyblock *encrypting_key, void **padata_context);
 200
 201 void
 202 free_padata_context(krb5_context context, void *padata_context);
 203
 204 krb5_error_code
 205 alloc_pa_data(krb5_preauthtype pa_type, size_t len, krb5_pa_data **out);
 206
 207 krb5_error_code
 208 add_pa_data_element(krb5_pa_data ***list, krb5_pa_data *pa);
 209
 210 /* kdc_preauth_ec.c */
 211 krb5_error_code
 212 kdcpreauth_encrypted_challenge_initvt(krb5_context context, int maj_ver,
 213                                       int min_ver, krb5_plugin_vtable vtable);
 214
 215 /* kdc_preauth_enctsc.c */
 216 krb5_error_code
 217 kdcpreauth_encrypted_timestamp_initvt(krb5_context context, int maj_ver,
 218                                       int min_ver, krb5_plugin_vtable vtable);
 219
 220 /* kdc_authdata.c */
 221 krb5_error_code
 222 load_authdata_plugins(krb5_context context);
 223 krb5_error_code
 224 unload_authdata_plugins(krb5_context context);
 225
 226 krb5_error_code
 227 get_auth_indicators(krb5_context context, krb5_enc_tkt_part *enc_tkt,
 228                     krb5_db_entry *local_tgt, krb5_data ***indicators_out);
 229
 230 krb5_error_code
 231 handle_authdata (krb5_context context,
 232                  unsigned int flags,
 233                  krb5_db_entry *client,
 234                  krb5_db_entry *server,
 235                  krb5_db_entry *header_server,
 236                  krb5_db_entry *local_tgt,
 237                  krb5_keyblock *client_key,
 238                  krb5_keyblock *server_key,
 239                  krb5_keyblock *header_key,
 240                  krb5_data *req_pkt,
 241                  krb5_kdc_req *request,
 242                  krb5_const_principal for_user_princ,
 243                  krb5_enc_tkt_part *enc_tkt_request,
 244                  krb5_data *const *auth_indicators,
 245                  krb5_enc_tkt_part *enc_tkt_reply);
 246
 247 /* replay.c */
 248 krb5_error_code kdc_init_lookaside(krb5_context context);
 249 krb5_boolean kdc_check_lookaside (krb5_context, krb5_data *, krb5_data **);
 250 void kdc_insert_lookaside (krb5_context, krb5_data *, krb5_data *);
 251 void kdc_remove_lookaside (krb5_context kcontext, krb5_data *);
 252 void kdc_free_lookaside(krb5_context);
 253
 254 /* kdc_util.c */
 255 void reset_for_hangup(void *);
 256
 257 krb5_boolean
 258 include_pac_p(krb5_context context, krb5_kdc_req *request);
 259
 260 krb5_error_code
 261 return_enc_padata(krb5_context context,
 262                   krb5_data *req_pkt, krb5_kdc_req *request,
 263                   krb5_keyblock *reply_key,
 264                   krb5_db_entry *server,
 265                   krb5_enc_kdc_rep_part *reply_encpart,
 266                   krb5_boolean is_referral);
 267
 268 krb5_error_code
 269 kdc_process_s4u2self_req (kdc_realm_t *kdc_active_realm,
 270                           krb5_kdc_req *request,
 271                           krb5_const_principal client_princ,
 272                           krb5_const_principal header_srv_princ,
 273                           krb5_boolean issuing_referral,
 274                           const krb5_db_entry *server,
 275                           krb5_keyblock *tgs_subkey,
 276                           krb5_keyblock *tgs_session,
 277                           krb5_timestamp kdc_time,
 278                           krb5_pa_s4u_x509_user **s4u2self_req,
 279                           krb5_db_entry **princ_ptr,
 280                           const char **status);
 281
 282 krb5_error_code
 283 kdc_make_s4u2self_rep (krb5_context context,
 284                        krb5_keyblock *tgs_subkey,
 285                        krb5_keyblock *tgs_session,
 286                        krb5_pa_s4u_x509_user *req_s4u_user,
 287                        krb5_kdc_rep *reply,
 288                        krb5_enc_kdc_rep_part *reply_encpart);
 289
 290 krb5_error_code
 291 kdc_process_s4u2proxy_req (kdc_realm_t *kdc_active_realm,
 292                            krb5_kdc_req *request,
 293                            const krb5_enc_tkt_part *t2enc,
 294                            const krb5_db_entry *server,
 295                            krb5_const_principal server_princ,
 296                            krb5_const_principal proxy_princ,
 297                            const char **status);
 298
 299 krb5_error_code
 300 kdc_check_transited_list (kdc_realm_t *kdc_active_realm,
 301                           const krb5_data *trans,
 302                           const krb5_data *realm1,
 303                           const krb5_data *realm2);
 304
 305 krb5_error_code
 306 audit_as_request (krb5_kdc_req *request,
 307                   krb5_db_entry *client,
 308                   krb5_db_entry *server,
 309                   krb5_timestamp authtime,
 310                   krb5_error_code errcode);
 311
 312 krb5_error_code
 313 audit_tgs_request (krb5_kdc_req *request,
 314                    krb5_const_principal client,
 315                    krb5_db_entry *server,
 316                    krb5_timestamp authtime,
 317                    krb5_error_code errcode);
 318
 319 krb5_error_code
 320 validate_transit_path(krb5_context context,
 321                       krb5_const_principal client,
 322                       krb5_db_entry *server,
 323                       krb5_db_entry *krbtgt);
 324 void
 325 kdc_get_ticket_endtime(kdc_realm_t *kdc_active_realm,
 326                        krb5_timestamp now,
 327                        krb5_timestamp endtime,
 328                        krb5_timestamp till,
 329                        krb5_db_entry *client,
 330                        krb5_db_entry *server,
 331                        krb5_timestamp *out_endtime);
 332
 333 void
 334 kdc_get_ticket_renewtime(kdc_realm_t *realm, krb5_kdc_req *request,
 335                          krb5_enc_tkt_part *tgt, krb5_db_entry *client,
 336                          krb5_db_entry *server, krb5_enc_tkt_part *tkt);
 337
 338 void
 339 log_as_req(krb5_context context,
 340            const krb5_fulladdr *local_addr,
 341            const krb5_fulladdr *remote_addr,
 342            krb5_kdc_req *request, krb5_kdc_rep *reply,
 343            krb5_db_entry *client, const char *cname,
 344            krb5_db_entry *server, const char *sname,
 345            krb5_timestamp authtime,
 346            const char *status, krb5_error_code errcode, const char *emsg);
 347 void
 348 log_tgs_req(krb5_context ctx, const krb5_fulladdr *from,
 349             krb5_kdc_req *request, krb5_kdc_rep *reply,
 350             krb5_principal cprinc, krb5_principal sprinc,
 351             krb5_principal altcprinc,
 352             krb5_timestamp authtime,
 353             unsigned int c_flags,
 354             const char *status, krb5_error_code errcode, const char *emsg);
 355 void
 356 log_tgs_badtrans(krb5_context ctx, krb5_principal cprinc,
 357                  krb5_principal sprinc, krb5_data *trcont,
 358                  krb5_error_code errcode);
 359
 360 void
 361 log_tgs_alt_tgt(krb5_context context, krb5_principal p);
 362
 363 /* FAST*/
 364 enum krb5_fast_kdc_flags {
 365     KRB5_FAST_REPLY_KEY_USED = 0x1,
 366     KRB5_FAST_REPLY_KEY_REPLACED = 0x02
 367 };
 368
 369 /*
 370  * If *requestptr contains FX_FAST padata, compute the armor key, verify the
 371  * checksum over checksummed_data, decode the FAST request, and substitute
 372  * *requestptr with the inner request.  Set the armor_key, cookie, and
 373  * fast_options fields in state.  state->cookie will be set for a non-FAST
 374  * request if it contains FX_COOKIE padata.  If inner_body_out is non-NULL, set
 375  * *inner_body_out to a copy of the encoded inner body, or to NULL if the
 376  * request is not a FAST request.
 377  */
 378 krb5_error_code
 379 kdc_find_fast (krb5_kdc_req **requestptr,  krb5_data *checksummed_data,
 380                krb5_keyblock *tgs_subkey, krb5_keyblock *tgs_session,
 381                struct kdc_request_state *state, krb5_data **inner_body_out);
 382
 383 krb5_error_code
 384 kdc_fast_response_handle_padata (struct kdc_request_state *state,
 385                                  krb5_kdc_req *request,
 386                                  krb5_kdc_rep *rep,
 387                                  krb5_enctype enctype);
 388 krb5_error_code
 389 kdc_fast_handle_error (krb5_context context,
 390                        struct kdc_request_state *state,
 391                        krb5_kdc_req *request,
 392                        krb5_pa_data  **in_padata, krb5_error *err,
 393                        krb5_data **fast_edata_out);
 394
 395 krb5_error_code kdc_fast_handle_reply_key(struct kdc_request_state *state,
 396                                           krb5_keyblock *existing_key,
 397                                           krb5_keyblock **out_key);
 398
 399
 400 krb5_boolean
 401 kdc_fast_hide_client(struct kdc_request_state *state);
 402
 403 krb5_error_code
 404 kdc_handle_protected_negotiation( krb5_context context,
 405                                   krb5_data *req_pkt, krb5_kdc_req *request,
 406                                   const krb5_keyblock *reply_key,
 407                                   krb5_pa_data ***out_enc_padata);
 408
 409 krb5_error_code
 410 kdc_fast_read_cookie(krb5_context context, struct kdc_request_state *state,
 411                      krb5_kdc_req *req, krb5_db_entry *local_tgt);
 412
 413 krb5_boolean kdc_fast_search_cookie(struct kdc_request_state *state,
 414                                     krb5_preauthtype pa_type, krb5_data *out);
 415
 416 krb5_error_code kdc_fast_set_cookie(struct kdc_request_state *state,
 417                                     krb5_preauthtype pa_type,
 418                                     const krb5_data *data);
 419
 420 krb5_error_code
 421 kdc_fast_make_cookie(krb5_context context, struct kdc_request_state *state,
 422                      krb5_db_entry *local_tgt,
 423                      krb5_const_principal client_princ,
 424                      krb5_pa_data **cookie_out);
 425
 426 /* Information handle for kdcpreauth callbacks.  All pointers are aliases. */
 427 struct krb5_kdcpreauth_rock_st {
 428     krb5_kdc_req *request;
 429     krb5_data *inner_body;
 430     krb5_db_entry *client;
 431     krb5_db_entry *local_tgt;
 432     krb5_key_data *client_key;
 433     krb5_keyblock *client_keyblock;
 434     struct kdc_request_state *rstate;
 435     verto_ctx *vctx;
 436     krb5_data ***auth_indicators;
 437     krb5_boolean send_freshness_token;
 438 };
 439
 440 #define isflagset(flagfield, flag) (flagfield & (flag))
 441 #define setflag(flagfield, flag) (flagfield |= (flag))
 442 #define clear(flagfield, flag) (flagfield &= ~(flag))
 443
 444 #ifndef min
 445 #define min(a, b)       ((a) < (b) ? (a) : (b))
 446 #define max(a, b)       ((a) > (b) ? (a) : (b))
 447 #endif
 448
 449 #define ts_min(a, b) (ts_after(a, b) ? (b) : (a))
 450
 451 #define ADDRTYPE2FAMILY(X)                                              \
 452     ((X) == ADDRTYPE_INET6 ? AF_INET6 : (X) == ADDRTYPE_INET ? AF_INET : -1)
 453
 454 /* RFC 4120: KRB5KDC_ERR_KEY_TOO_WEAK
 455  * RFC 4556: KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED */
 456 #define KRB5KDC_ERR_KEY_TOO_WEAK KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED
 457 /* TGS-REQ options where the service can be a non-TGS principal  */
 458
 459 #define NON_TGT_OPTION (KDC_OPT_FORWARDED | KDC_OPT_PROXY | KDC_OPT_RENEW | \
 460                         KDC_OPT_VALIDATE)
 461
 462 /* TGS-REQ options which are not compatible with referrals */
 463 #define NO_REFERRAL_OPTION (NON_TGT_OPTION | KDC_OPT_ENC_TKT_IN_SKEY)
 464
 465 /*
 466  * Mask of KDC options that request the corresponding ticket flag with
 467  * the same number.  Some of these are invalid for AS-REQs, but
 468  * validate_as_request() takes care of that.  KDC_OPT_RENEWABLE isn't
 469  * here because it needs special handling in
 470  * kdc_get_ticket_renewtime().
 471  *
 472  * According to RFC 4120 section 3.1.3 the following AS-REQ options
 473  * request their corresponding ticket flags if local policy allows:
 474  *
 475  * KDC_OPT_FORWARDABLE  KDC_OPT_ALLOW_POSTDATE
 476  * KDC_OPT_POSTDATED    KDC_OPT_PROXIABLE
 477  * KDC_OPT_RENEWABLE
 478  *
 479  * RFC 1510 section A.6 shows pseudocode indicating that the following
 480  * TGS-REQ options request their corresponding ticket flags if local
 481  * policy allows:
 482  *
 483  * KDC_OPT_FORWARDABLE  KDC_OPT_FORWARDED
 484  * KDC_OPT_PROXIABLE    KDC_OPT_PROXY
 485  * KDC_OPT_POSTDATED    KDC_OPT_RENEWABLE
 486  *
 487  * The above list omits KDC_OPT_ALLOW_POSTDATE, but RFC 4120 section
 488  * 5.4.1 says the TGS also handles it.
 489  *
 490  * RFC 6112 makes KDC_OPT_REQUEST_ANONYMOUS the same bit number as
 491  * TKT_FLG_ANONYMOUS.
 492  */
 493 #define OPTS_COMMON_FLAGS_MASK                                  \
 494     (KDC_OPT_FORWARDABLE        | KDC_OPT_FORWARDED     |       \
 495      KDC_OPT_PROXIABLE          | KDC_OPT_PROXY         |       \
 496      KDC_OPT_ALLOW_POSTDATE     | KDC_OPT_POSTDATED     |       \
 497      KDC_OPT_REQUEST_ANONYMOUS)
 498
 499 /* Copy KDC options that request the corresponding ticket flags. */
 500 #define OPTS2FLAGS(x) (x & OPTS_COMMON_FLAGS_MASK)
 501
 502 /*
 503  * Mask of ticket flags for the TGS to propagate from a ticket to a
 504  * derivative ticket.
 505  *
 506  * RFC 4120 section 2.1 says the following flags are carried forward
 507  * from an initial ticket to derivative tickets:
 508  *
 509  * TKT_FLG_PRE_AUTH
 510  * TKT_FLG_HW_AUTH
 511  *
 512  * RFC 4120 section 2.6 says TKT_FLG_FORWARDED is carried forward to
 513  * derivative tickets.  Proxy tickets are basically identical to
 514  * forwarded tickets except that a TGT may never be proxied, therefore
 515  * tickets derived from proxy tickets should have TKT_FLAG_PROXY set.
 516  * RFC 4120 and RFC 1510 apparently have an accidental omission in not
 517  * requiring that tickets derived from a proxy ticket have
 518  * TKT_FLG_PROXY set.  Previous code also omitted this behavior.
 519  *
 520  * RFC 6112 section 4.2 implies that TKT_FLG_ANONYMOUS must be
 521  * propagated from an anonymous ticket to derivative tickets.
 522  */
 523 #define TGS_COPIED_FLAGS_MASK                           \
 524     (TKT_FLG_FORWARDED  | TKT_FLG_PROXY         |       \
 525      TKT_FLG_PRE_AUTH   | TKT_FLG_HW_AUTH       |       \
 526      TKT_FLG_ANONYMOUS)
 527
 528 /* Copy appropriate header ticket flags to new ticket. */
 529 #define COPY_TKT_FLAGS(x) (x & TGS_COPIED_FLAGS_MASK)
 530
 531 int check_anon(kdc_realm_t *kdc_active_realm,
 532                krb5_principal client, krb5_principal server);
 533 int errcode_to_protocol(krb5_error_code code);
 534
 535 char *data2string(krb5_data *d);
 536
 537 #endif /* __KRB5_KDC_UTIL__ */