1 /* $NetBSD: transited.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $ */
2
3 /*
4 * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36 #include "krb5_locl.h"
37
38 /* this is an attempt at one of the most horrible `compression'
39 schemes that has ever been invented; it's so amazingly brain-dead
40 that words can not describe it, and all this just to save a few
41 silly bytes */
42
43 struct tr_realm {
44 char *realm;
45 unsigned leading_space:1;
46 unsigned leading_slash:1;
47 unsigned trailing_dot:1;
48 struct tr_realm *next;
49 };
50
51 static void
free_realms(struct tr_realm * r)52 free_realms(struct tr_realm *r)
53 {
54 struct tr_realm *p;
55 while(r){
56 p = r;
57 r = r->next;
58 free(p->realm);
59 free(p);
60 }
61 }
62
63 static int
make_path(krb5_context context,struct tr_realm * r,const char * from,const char * to)64 make_path(krb5_context context, struct tr_realm *r,
65 const char *from, const char *to)
66 {
67 struct tr_realm *tmp;
68 const char *p;
69
70 if(strlen(from) < strlen(to)){
71 const char *str;
72 str = from;
73 from = to;
74 to = str;
75 }
76
77 if(strcmp(from + strlen(from) - strlen(to), to) == 0){
78 p = from;
79 while(1){
80 p = strchr(p, '.');
81 if(p == NULL) {
82 krb5_clear_error_message (context);
83 return KRB5KDC_ERR_POLICY;
84 }
85 p++;
86 if(strcmp(p, to) == 0)
87 break;
88 tmp = calloc(1, sizeof(*tmp));
89 if(tmp == NULL)
90 return krb5_enomem(context);
91 tmp->next = r->next;
92 r->next = tmp;
93 tmp->realm = strdup(p);
94 if(tmp->realm == NULL){
95 r->next = tmp->next;
96 free(tmp);
97 return krb5_enomem(context);
98 }
99 }
100 }else if(strncmp(from, to, strlen(to)) == 0){
101 p = from + strlen(from);
102 while(1){
103 while(p >= from && *p != '/') p--;
104 if(p == from)
105 return KRB5KDC_ERR_POLICY;
106
107 if(strncmp(to, from, p - from) == 0)
108 break;
109 tmp = calloc(1, sizeof(*tmp));
110 if(tmp == NULL)
111 return krb5_enomem(context);
112 tmp->next = r->next;
113 r->next = tmp;
114 tmp->realm = malloc(p - from + 1);
115 if(tmp->realm == NULL){
116 r->next = tmp->next;
117 free(tmp);
118 return krb5_enomem(context);
119 }
120 memcpy(tmp->realm, from, p - from);
121 tmp->realm[p - from] = '\0';
122 p--;
123 }
124 } else {
125 krb5_clear_error_message (context);
126 return KRB5KDC_ERR_POLICY;
127 }
128
129 return 0;
130 }
131
132 static int
make_paths(krb5_context context,struct tr_realm * realms,const char * client_realm,const char * server_realm)133 make_paths(krb5_context context,
134 struct tr_realm *realms, const char *client_realm,
135 const char *server_realm)
136 {
137 struct tr_realm *r;
138 int ret;
139 const char *prev_realm = client_realm;
140 const char *next_realm = NULL;
141 for(r = realms; r; r = r->next){
142 /* it *might* be that you can have more than one empty
143 component in a row, at least that's how I interpret the
144 "," exception in 1510 */
145 if(r->realm[0] == '\0'){
146 while(r->next && r->next->realm[0] == '\0')
147 r = r->next;
148 if(r->next)
149 next_realm = r->next->realm;
150 else
151 next_realm = server_realm;
152 ret = make_path(context, r, prev_realm, next_realm);
153 if(ret){
154 free_realms(realms);
155 return ret;
156 }
157 }
158 prev_realm = r->realm;
159 }
160 return 0;
161 }
162
163 static int
expand_realms(krb5_context context,struct tr_realm * realms,const char * client_realm)164 expand_realms(krb5_context context,
165 struct tr_realm *realms, const char *client_realm)
166 {
167 struct tr_realm *r;
168 const char *prev_realm = NULL;
169 for(r = realms; r; r = r->next){
170 if(r->trailing_dot){
171 char *tmp;
172 size_t len;
173
174 if(prev_realm == NULL)
175 prev_realm = client_realm;
176
177 len = strlen(r->realm) + strlen(prev_realm) + 1;
178
179 tmp = realloc(r->realm, len);
180 if(tmp == NULL){
181 free_realms(realms);
182 return krb5_enomem(context);
183 }
184 r->realm = tmp;
185 strlcat(r->realm, prev_realm, len);
186 }else if(r->leading_slash && !r->leading_space && prev_realm){
187 /* yet another exception: if you use x500-names, the
188 leading realm doesn't have to be "quoted" with a space */
189 char *tmp;
190 size_t len = strlen(r->realm) + strlen(prev_realm) + 1;
191
192 tmp = malloc(len);
193 if(tmp == NULL){
194 free_realms(realms);
195 return krb5_enomem(context);
196 }
197 strlcpy(tmp, prev_realm, len);
198 strlcat(tmp, r->realm, len);
199 free(r->realm);
200 r->realm = tmp;
201 }
202 prev_realm = r->realm;
203 }
204 return 0;
205 }
206
207 static struct tr_realm *
make_realm(char * realm)208 make_realm(char *realm)
209 {
210 struct tr_realm *r;
211 char *p, *q;
212 int quote = 0;
213 r = calloc(1, sizeof(*r));
214 if(r == NULL){
215 free(realm);
216 return NULL;
217 }
218 r->realm = realm;
219 for(p = q = r->realm; *p; p++){
220 if(p == r->realm && *p == ' '){
221 r->leading_space = 1;
222 continue;
223 }
224 if(q == r->realm && *p == '/')
225 r->leading_slash = 1;
226 if(quote){
227 *q++ = *p;
228 quote = 0;
229 continue;
230 }
231 if(*p == '\\'){
232 quote = 1;
233 continue;
234 }
235 if(p[0] == '.' && p[1] == '\0')
236 r->trailing_dot = 1;
237 *q++ = *p;
238 }
239 *q = '\0';
240 return r;
241 }
242
243 static struct tr_realm*
append_realm(struct tr_realm * head,struct tr_realm * r)244 append_realm(struct tr_realm *head, struct tr_realm *r)
245 {
246 struct tr_realm *p;
247 if(head == NULL){
248 r->next = NULL;
249 return r;
250 }
251 p = head;
252 while(p->next) p = p->next;
253 p->next = r;
254 return head;
255 }
256
257 static int
decode_realms(krb5_context context,const char * tr,int length,struct tr_realm ** realms)258 decode_realms(krb5_context context,
259 const char *tr, int length, struct tr_realm **realms)
260 {
261 struct tr_realm *r = NULL;
262
263 char *tmp;
264 int quote = 0;
265 const char *start = tr;
266 int i;
267
268 for(i = 0; i < length; i++){
269 if(quote){
270 quote = 0;
271 continue;
272 }
273 if(tr[i] == '\\'){
274 quote = 1;
275 continue;
276 }
277 if(tr[i] == ','){
278 tmp = malloc(tr + i - start + 1);
279 if(tmp == NULL)
280 return krb5_enomem(context);
281 memcpy(tmp, start, tr + i - start);
282 tmp[tr + i - start] = '\0';
283 r = make_realm(tmp);
284 if(r == NULL){
285 free_realms(*realms);
286 return krb5_enomem(context);
287 }
288 *realms = append_realm(*realms, r);
289 start = tr + i + 1;
290 }
291 }
292 tmp = malloc(tr + i - start + 1);
293 if(tmp == NULL){
294 free(*realms);
295 return krb5_enomem(context);
296 }
297 memcpy(tmp, start, tr + i - start);
298 tmp[tr + i - start] = '\0';
299 r = make_realm(tmp);
300 if(r == NULL){
301 free_realms(*realms);
302 return krb5_enomem(context);
303 }
304 *realms = append_realm(*realms, r);
305
306 return 0;
307 }
308
309
310 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_domain_x500_decode(krb5_context context,krb5_data tr,char *** realms,unsigned int * num_realms,const char * client_realm,const char * server_realm)311 krb5_domain_x500_decode(krb5_context context,
312 krb5_data tr, char ***realms, unsigned int *num_realms,
313 const char *client_realm, const char *server_realm)
314 {
315 struct tr_realm *r = NULL;
316 struct tr_realm *p, **q;
317 int ret;
318
319 if(tr.length == 0) {
320 *realms = NULL;
321 *num_realms = 0;
322 return 0;
323 }
324
325 /* split string in components */
326 ret = decode_realms(context, tr.data, tr.length, &r);
327 if(ret)
328 return ret;
329
330 /* apply prefix rule */
331 ret = expand_realms(context, r, client_realm);
332 if(ret)
333 return ret;
334
335 ret = make_paths(context, r, client_realm, server_realm);
336 if(ret)
337 return ret;
338
339 /* remove empty components and count realms */
340 *num_realms = 0;
341 for(q = &r; *q; ){
342 if((*q)->realm[0] == '\0'){
343 p = *q;
344 *q = (*q)->next;
345 free(p->realm);
346 free(p);
347 }else{
348 q = &(*q)->next;
349 (*num_realms)++;
350 }
351 }
352 if (*num_realms + 1 > UINT_MAX/sizeof(**realms))
353 return ERANGE;
354
355 {
356 char **R;
357 R = malloc((*num_realms + 1) * sizeof(*R));
358 if (R == NULL)
359 return krb5_enomem(context);
360 *realms = R;
361 while(r){
362 *R++ = r->realm;
363 p = r->next;
364 free(r);
365 r = p;
366 }
367 }
368 return 0;
369 }
370
371 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_domain_x500_encode(char ** realms,unsigned int num_realms,krb5_data * encoding)372 krb5_domain_x500_encode(char **realms, unsigned int num_realms,
373 krb5_data *encoding)
374 {
375 char *s = NULL;
376 int len = 0;
377 unsigned int i;
378 krb5_data_zero(encoding);
379 if (num_realms == 0)
380 return 0;
381 for(i = 0; i < num_realms; i++){
382 len += strlen(realms[i]);
383 if(realms[i][0] == '/')
384 len++;
385 }
386 len += num_realms - 1;
387 s = malloc(len + 1);
388 if (s == NULL)
389 return ENOMEM;
390 *s = '\0';
391 for(i = 0; i < num_realms; i++){
392 if(i)
393 strlcat(s, ",", len + 1);
394 if(realms[i][0] == '/')
395 strlcat(s, " ", len + 1);
396 strlcat(s, realms[i], len + 1);
397 }
398 encoding->data = s;
399 encoding->length = strlen(s);
400 return 0;
401 }
402
403 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_check_transited(krb5_context context,krb5_const_realm client_realm,krb5_const_realm server_realm,krb5_realm * realms,unsigned int num_realms,int * bad_realm)404 krb5_check_transited(krb5_context context,
405 krb5_const_realm client_realm,
406 krb5_const_realm server_realm,
407 krb5_realm *realms,
408 unsigned int num_realms,
409 int *bad_realm)
410 {
411 char **tr_realms;
412 char **p;
413 size_t i;
414
415 if(num_realms == 0)
416 return 0;
417
418 tr_realms = krb5_config_get_strings(context, NULL,
419 "capaths",
420 client_realm,
421 server_realm,
422 NULL);
423 for(i = 0; i < num_realms; i++) {
424 for(p = tr_realms; p && *p; p++) {
425 if(strcmp(*p, realms[i]) == 0)
426 break;
427 }
428 if(p == NULL || *p == NULL) {
429 krb5_config_free_strings(tr_realms);
430 krb5_set_error_message (context, KRB5KRB_AP_ERR_ILL_CR_TKT,
431 N_("no transit allowed "
432 "through realm %s", ""),
433 realms[i]);
434 if(bad_realm)
435 *bad_realm = i;
436 return KRB5KRB_AP_ERR_ILL_CR_TKT;
437 }
438 }
439 krb5_config_free_strings(tr_realms);
440 return 0;
441 }
442
443 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_check_transited_realms(krb5_context context,const char * const * realms,unsigned int num_realms,int * bad_realm)444 krb5_check_transited_realms(krb5_context context,
445 const char *const *realms,
446 unsigned int num_realms,
447 int *bad_realm)
448 {
449 size_t i;
450 int ret = 0;
451 char **bad_realms = krb5_config_get_strings(context, NULL,
452 "libdefaults",
453 "transited_realms_reject",
454 NULL);
455 if(bad_realms == NULL)
456 return 0;
457
458 for(i = 0; i < num_realms; i++) {
459 char **p;
460 for(p = bad_realms; *p; p++)
461 if(strcmp(*p, realms[i]) == 0) {
462 ret = KRB5KRB_AP_ERR_ILL_CR_TKT;
463 krb5_set_error_message (context, ret,
464 N_("no transit allowed "
465 "through realm %s", ""),
466 *p);
467 if(bad_realm)
468 *bad_realm = i;
469 break;
470 }
471 }
472 krb5_config_free_strings(bad_realms);
473 return ret;
474 }
475
476 #if 0
477 int
478 main(int argc, char **argv)
479 {
480 krb5_data x;
481 char **r;
482 int num, i;
483 x.data = argv[1];
484 x.length = strlen(x.data);
485 if(domain_expand(x, &r, &num, argv[2], argv[3]))
486 exit(1);
487 for(i = 0; i < num; i++)
488 printf("%s\n", r[i]);
489 return 0;
490 }
491 #endif
492
493