OpenSolaris_b135/lib/gss_mechs/mech_dh/backend/mech/token.c
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License, Version 1.0 only
* (the "License"). You may not use this file except in compliance
* with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* token.c
*
* Copyright (c) 1997, by Sun Microsystems, Inc.
* All rights reserved.
*
*/
#pragma ident "%Z%%M% %I% %E% SMI"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "dh_gssapi.h"
#include "crypto.h"
extern int
get_der_length(unsigned char **, unsigned int, unsigned int *);
extern unsigned int
der_length_size(unsigned int);
extern int
put_der_length(unsigned int, unsigned char **, unsigned int);
#define MSO_BIT (8*(sizeof (int) - 1)) /* Most significant octet bit */
static OM_uint32
__xdr_encode_token(XDR *, gss_buffer_t, dh_token_t, dh_key_set_t);
static OM_uint32
__xdr_decode_token(XDR *, gss_buffer_t,
dh_token_t, dh_key_set_t, dh_signature_t);
/*
* get_qop: For a Diffie-Hellman token_t, return the associate QOP
*/
static dh_qop_t
get_qop(dh_token_t t)
{
dh_token_body_t body = &t->ver.dh_version_u.body;
switch (body->type) {
case DH_INIT_CNTX:
case DH_ACCEPT_CNTX:
return (DH_MECH_QOP);
case DH_MIC:
return (body->dh_token_body_desc_u.sign.qop);
case DH_WRAP:
return (body->dh_token_body_desc_u.seal.mic.qop);
default:
/* Should never get here */
return (DH_MECH_QOP);
}
}
/*
* __make_ap_token: This routine generates a Diffie-Hellman serialized
* token which has an ASN.1 application 0 header prepended. The unserialized
* token supplied should be of type DH_INIT_CNTX.
*
* The ASN.1 applicationtion prefix is encoded as follows:
*
* +------+
* | 0x60 | 1 TAG for APPLICATION 0
* +------+
* | |
* ~ ~ app_size DER encoded length of oid_size + token_size
* | |
* +------+
* | 0x06 | 1 TAG for OID
* +------+
* | | der_length_size
* ~ ~ (mech->length) DER encoded length of mech->length
* | |
* +------+
* | |
* ~ ~ mech->length OID elements (mech->elements)
* | |
* +------+
* | 0x00 | 0-3 XDR padding
* +------+
* | |
* ~ ~ Serialized DH token
* | |
* +------+
* | 0x00 | 0-3 Left over XDR padding
* +------+
*
* We will define the token_size to be the sizeof the serialize token plus
* 3 the maximum XDR paddinging that will be needed. Thus the XDR padding
* plus the left over XDR padding will alway equal 3.
*/
OM_uint32
__make_ap_token(gss_buffer_t result, /* The serialized token */
gss_OID mech, /* The mechanism this is for */
dh_token_t token, /* The unserialized input token */
dh_key_set_t keys /* The session keys to sign the token */)
{
unsigned int size, hsize, token_size, app_size, oid_size, start;
XDR xdrs;
unsigned char *sv, *buf, *xdrmem;
OM_uint32 stat;
/* Allocate the signature for the input token */
if ((stat = __alloc_sig(get_qop(token),
&token->verifier))
!= DH_SUCCESS)
return (stat);
/*
* We will first determine the size of the output token in
* a bottom up fashion.
*/
/* Fetch the size of a serialized DH token */
token_size = xdr_sizeof((xdrproc_t)xdr_dh_token_desc, (void *)token);
/*
* The token itself needs to be pasted on to the ASN.1
* application header on BYTES_PER_XDR_UNIT boundry. So we may
* need upto BYTES_PER_XDR_UNIT - 1 extra bytes.
*/
token_size += BYTES_PER_XDR_UNIT -1;
oid_size = mech->length;
oid_size += der_length_size(mech->length);
oid_size += 1; /* tag x06 for Oid */
/* bytes to store the length */
app_size = der_length_size(oid_size + token_size);
hsize = app_size + oid_size;
hsize += 1; /* tag 0x60 for application 0 */
size = hsize + token_size;
/* Allocate a buffer to serialize into */
buf = New(unsigned char, size);
if (buf == NULL) {
__free_signature(&token->verifier);
return (DH_NOMEM_FAILURE);
}
result->value = sv = buf;
result->length = size;
/* ASN.1 application 0 header */
/* Encode the tag */
*buf++ = 0x60;
/* Encode the app length */
put_der_length(oid_size + token_size, &buf, app_size);
/* Encode the OID tag */
*buf++ = 0x06;
/* Encode the OID length */
put_der_length(mech->length, &buf, oid_size);
/* Encode the OID elemeents */
memcpy(buf, mech->elements, mech->length);
/* Encode the Diffie-Hellmam token */
/*
* Token has to be on BYTES_PER_XDR_UNIT boundry. (RNDUP is
* from xdr.h)
*/
start = RNDUP(hsize);
/* Buffer for xdrmem_create to use */
xdrmem = &sv[start];
xdrmem_create(&xdrs, (caddr_t)xdrmem, token_size, XDR_ENCODE);
/* Paste the DH token on */
if ((stat = __xdr_encode_token(&xdrs, NULL, token, keys))
!= DH_SUCCESS) {
__free_signature(&token->verifier);
__dh_release_buffer(result);
}
/* We're done with the signature, the token has been serialized */
__free_signature(&token->verifier);
return (stat);
}
/*
* __make_token: Given an unserialized DH token, serialize it puting the
* serialized output in result. If this token has a type of DH_MIC, then
* the optional message, msg, should be supplied. The mic caluclated will be
* over the message as well as the serialized token.
*/
OM_uint32
__make_token(gss_buffer_t result, /* Serialized token goes here */
gss_buffer_t msg, /* Optional message for DH_MIC tokens */
dh_token_t token, /* The token to encode */
dh_key_set_t keys /* The keys to encrypt the check sum with */)
{
unsigned int token_size;
XDR xdrs;
unsigned char *buf;
OM_uint32 stat;
/* Allocate a signature for this token */
if ((stat = __alloc_sig(get_qop(token),
&token->verifier))
!= DH_SUCCESS)
return (stat);
/* Get the output token size to know how much to allocate */
token_size = xdr_sizeof((xdrproc_t)xdr_dh_token_desc, (void *)token);
/* Allocate the buffer to hold the serialized token */
buf = New(unsigned char, token_size);
if (buf == NULL) {
__free_signature(&token->verifier);
return (DH_NOMEM_FAILURE);
}
/* Set the result */
result->length = token_size;
result->value = (void *)buf;
/* Create the xdr stream using the allocated buffer */
xdrmem_create(&xdrs, (char *)buf, token_size, XDR_ENCODE);
/* Encode the token */
if ((stat = __xdr_encode_token(&xdrs, msg, token, keys))
!= DH_SUCCESS) {
__free_signature(&token->verifier);
__dh_release_buffer(result);
}
/* Release the signature */
__free_signature(&token->verifier);
return (stat);
}
/*
* __get_ap_token: This routine deserializes a Diffie-Hellman serialized
* token which has an ASN.1 application 0 header prepended. The resulting
* unserialized token supplied should be of type DH_INIT_CNTX..
*
* The ASN.1 applicationtion prefix and token is encoded as follows:
*
* +------+
* | 0x60 | 1 TAG for APPLICATION 0
* +------+
* | |
* ~ ~ app_size DER encoded length of oid_size + token_size
* | |
* +------+
* | 0x06 | 1 TAG for OID
* +------+
* | | der_length_size
* ~ ~ (mech->length) DER encoded length of mech->length
* | |
* +------+
* | |
* ~ ~ mech->length OID elements (mech->elements)
* | |
* +------+
* | 0x00 | 0-3 XDR padding
* +------+
* | |
* ~ ~ Serialized DH token
* | |
* +------+
* | 0x00 | 0-3 Left over XDR padding
* +------+
*
* We will define the token_size to be the sizeof the serialize token plus
* 3 the maximum XDR paddinging that will be needed. Thus the XDR padding
* plus the left over XDR padding will alway equal 3.
*/
OM_uint32
__get_ap_token(gss_buffer_t input, /* The token to deserialize */
gss_OID mech, /* This context's OID */
dh_token_t token, /* The resulting token */
dh_signature_t sig /* The signature found over the input token */)
{
unsigned char *buf, *p;
unsigned int oid_len, token_len, bytes, hsize;
int len;
OM_uint32 stat;
XDR xdrs;
/* Set p and buf to point to the beginning of the token */
p = buf = (unsigned char *)input->value;
/* Check that this is an ASN.1 APPLICATION 0 token */
if (*p++ != 0x60)
return (DH_DECODE_FAILURE);
/* Determine the length for the DER encoding of the packet length */
if ((len = get_der_length(&p, input->length - 1, &bytes)) < 0)
return (DH_DECODE_FAILURE);
/*
* See if the number of bytes specified by the
* encoded length is all there
*/
if (input->length - 1 - bytes != len)
return (DH_DECODE_FAILURE);
/*
* Running total of the APPLICATION 0 prefix so far. One for the
* tag (0x60) and the bytes necessary to encode the length of the
* packet.
*/
hsize = 1 + bytes;
/* Check that we're now looking at an OID */
if (*p++ != 0x06)
return (DH_DECODE_FAILURE);
/* Get OID length and the number of bytes that to encode it */
oid_len = get_der_length(&p, len - 1, &bytes);
/*
* Now add the byte for the OID tag, plus the bytes for the oid
* length, plus the oid length its self. That is, add the size
* of the encoding of the OID to the running total of the
* APPLICATION 0 header. The result is the total size of the header.
*/
hsize += 1 + bytes + oid_len;
/*
* The DH token length is the application length minus the length
* of the OID encoding.
*/
token_len = len - 1 - bytes - oid_len;
/* Sanity check the token length */
if (input->length - hsize != token_len)
return (DH_DECODE_FAILURE);
/* Check that this token is for this OID */
if (mech->length != oid_len)
return (DH_DECODE_FAILURE);
if (memcmp(mech->elements, p, oid_len) != 0)
return (DH_DECODE_FAILURE);
/* Round up the header size to XDR boundry */
hsize = RNDUP(hsize);
/* Get the start of XDR encoded token */
p = &buf[hsize];
/* Create and XDR stream to decode from */
xdrmem_create(&xdrs, (caddr_t)p, token_len, XDR_DECODE);
/*
* Clear the deserialized token (we'll have the xdr routines
* do the the allocations).
*/
memset(token, 0, sizeof (dh_token_desc));
/* Zero out the signature */
memset(sig, 0, sizeof (*sig));
/*
* Decode the DH_INIT_CNTX token. Note that at this point we have no
* session keys established, so that keys is null. The unencrypted
* signature will be made available to the caller in sig. The
* caller can then attempt to decrypt the session keys in token
* and encrypt the returned sig with those keys to check the
* integrity of the token.
*/
if ((stat = __xdr_decode_token(&xdrs, NULL, token, NULL, sig))
!= DH_SUCCESS) {
xdr_free(xdr_dh_token_desc, (char *)token);
return (stat);
}
return (stat);
}
/*
* __get_token: Deserialize a supplied Diffie-Hellman token. Note the
* session keys should always be supplied to this routine. The message
* should only be supplied if the token is of DH_MIC type.
*/
OM_uint32
__get_token(gss_buffer_t input, /* The token to deserialize */
gss_buffer_t msg, /* Optional message to generate verifier over */
dh_token_t token, /* The decode token */
dh_key_set_t keys /* The session keys */)
{
XDR xdrs;
dh_signature sig;
OM_uint32 stat;
/* Create a an XDR stream out of the input token */
xdrmem_create(&xdrs, (caddr_t)input->value, input->length, XDR_DECODE);
/* Clear the token_desc and signature. */
memset(token, 0, sizeof (dh_token_desc));
memset(&sig, 0, sizeof (sig));
/* Decode the token */
if ((stat = __xdr_decode_token(&xdrs, msg, token, keys, &sig))
!= DH_SUCCESS)
/* If we fail release the deserialized token */
xdr_free(xdr_dh_token_desc, (char *)token);
/* We always free the signature */
__free_signature(&sig);
return (stat);
}
/*
* Warning these routines assumes that xdrs was created with xdrmem_create!
*/
/*
* __xdr_encode_token: Given an allocated xdrs stream serialize the supplied
* token_desc pointed to by objp, using keys to encrypt the signature. If
* msg is non null then calculate the signature over msg as well as the
* serialized token. Note this protocol is designed with the signature as
* the last part of any token. In this way the signature that is calculated is
* always done over the entire token. All fields in any token are thus
* protected from tampering
*/
static OM_uint32
__xdr_encode_token(register XDR *xdrs, gss_buffer_t msg,
dh_token_desc *objp, dh_key_set_t keys)
{
OM_uint32 stat;
/* Check that xdrs is valid */
if (xdrs == 0 || xdrs->x_op != XDR_ENCODE)
return (DH_BADARG_FAILURE);
/* Encode the protocol versioned body */
if (!xdr_dh_version(xdrs, &objp->ver))
return (DH_ENCODE_FAILURE);
/* Calculate the signature */
stat = __mk_sig(get_qop(objp), xdrs->x_base,
xdr_getpos(xdrs), msg, keys,
&objp->verifier);
if (stat != DH_SUCCESS)
return (stat);
/* Encode the signature */
if (!xdr_dh_signature(xdrs, &objp->verifier))
return (DH_ENCODE_FAILURE);
return (DH_SUCCESS);
}
/*
* __xdr_decode_token: Decode a token from an XDR stream into a token_desc
* pointed to by objp. We will calculate a signature over the serialized
* token and an optional message. The calculated signature will be
* returned to the caller in sig. If the supplied keys are available this
* routine will compare that the verifier in the deserialized token is
* the same as the calculated signature over the input stream. This is
* the usual case. However if the supplied serialized token is DH_INIT_CNTX,
* the keys have not yet been established. So we just give the caller back
* our raw signature (Non encrypted) and the deserialized token. Higher in
* the food chain (currently __dh_gss_accept_sec_context), we will attempt
* to decrypt the session keys and call __verify_sig with the decrypted
* session keys the signature returned from this routine and the deserialized
* token.
*
* Note it is assumed that sig does point to a valid uninitialized signature.
*/
static OM_uint32
__xdr_decode_token(register XDR *xdrs, gss_buffer_t msg,
dh_token_desc *objp, dh_key_set_t keys, dh_signature_t sig)
{
OM_uint32 stat;
/* Check that we are decoding */
if (xdrs == 0 || xdrs->x_op != XDR_DECODE)
return (DH_BADARG_FAILURE);
/* Decode the protocol versioned body */
if (!xdr_dh_version(xdrs, &objp->ver))
return (DH_DECODE_FAILURE);
/* Allocate the signature for this tokens QOP */
if ((stat = __alloc_sig(get_qop(objp), sig)) != DH_SUCCESS)
return (stat);
/*
* Call __mk_sig in crypto.c to calculate the signature based on
* the decoded QOP. __mk_sig will encrypt the signature with the
* supplied keys if they are available. If keys is null the signature
* will be just the unencrypted check sum.
*/
stat = __mk_sig(get_qop(objp), xdrs->x_base,
xdr_getpos(xdrs), msg, keys, sig);
if (stat != DH_SUCCESS)
return (stat);
/* Now decode the supplied signature */
if (!xdr_dh_signature(xdrs, &objp->verifier))
return (stat);
/*
* If we have keys then we can check that the signatures
* are the same
*/
if (keys && !__cmpsig(sig, &objp->verifier))
return (DH_VERIFIER_MISMATCH);
return (DH_SUCCESS);
}