2 * COPYRIGHT (c) 2006 The Regents of the University of Michigan
5 * Copyright (c) 2012, 2014, Intel Corporation.
7 * Permission is granted to use, copy, create derivative works
8 * and redistribute this software and such derivative works
9 * for any purpose, so long as the name of The University of
10 * Michigan is not used in any advertising or publicity
11 * pertaining to the use of distribution of this software
12 * without specific, written prior authorization. If the
13 * above copyright notice or any other identification of the
14 * University of Michigan is included in any copy of any
15 * portion of this software, then the disclaimer below must
18 * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION
19 * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY
20 * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF
21 * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING
22 * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF
23 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
24 * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE
25 * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR
26 * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING
27 * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN
28 * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF
34 #ifdef HAVE_LUCID_CONTEXT_SUPPORT
37 * Newer versions of MIT and Heimdal have lucid context support.
38 * We can use common code if it is supported.
47 #include <gssapi/gssapi.h>
49 typedef uint64_t OM_uint64;
51 #include <gssapi/gssapi_krb5.h>
54 # include "lgss_utils.h"
56 # include "gss_util.h"
57 # include "gss_oids.h"
58 # include "err_util.h"
60 #include "write_bytes.h"
65 write_lucid_keyblock(char **p, char *end, gss_krb5_lucid_key_t *key)
69 if (WRITE_BYTES(p, end, key->type)) return -1;
70 tmp.length = key->length;
71 tmp.value = key->data;
72 if (write_buffer(p, end, &tmp)) return -1;
77 prepare_krb5_rfc1964_buffer(gss_krb5_lucid_context_v1_t *lctx,
81 static int constant_zero = 0;
82 unsigned char fakeseed[16] = { 0 };
83 uint32_t word_send_seq;
84 gss_krb5_lucid_key_t enc_key;
89 * The new Kerberos interface to get the gss context
90 * does not include the seed or seed_init fields
91 * because we never really use them. But for now,
92 * send down a fake buffer so we can use the same
93 * interface to the kernel.
95 memset(&enc_key, 0, sizeof(enc_key));
97 if (!(buf->value = calloc(1, MAX_CTX_LEN)))
100 end = buf->value + MAX_CTX_LEN;
102 if (WRITE_BYTES(&p, end, lctx->initiate)) goto out_err;
104 /* seed_init and seed not used by kernel anyway */
105 if (WRITE_BYTES(&p, end, constant_zero)) goto out_err;
106 if (write_bytes(&p, end, &fakeseed, 16)) goto out_err;
108 if (WRITE_BYTES(&p, end, lctx->rfc1964_kd.sign_alg)) goto out_err;
109 if (WRITE_BYTES(&p, end, lctx->rfc1964_kd.seal_alg)) goto out_err;
110 if (WRITE_BYTES(&p, end, lctx->endtime)) goto out_err;
111 word_send_seq = lctx->send_seq; /* XXX send_seq is 64-bit */
112 if (WRITE_BYTES(&p, end, word_send_seq)) goto out_err;
113 if (write_oid(&p, end, &krb5oid)) goto out_err;
117 * The kernel gss code expects des-cbc-raw for all flavors of des.
118 * The keytype from MIT has this type, but Heimdal does not.
119 * Force the Heimdal keytype to 4 (des-cbc-raw).
120 * Note that the rfc1964 version only supports DES enctypes.
122 if (lctx->rfc1964_kd.ctx_key.type != 4) {
123 printerr(2, "%s: overriding heimdal keytype (%d => %d)\n",
124 __FUNCTION__, lctx->rfc1964_kd.ctx_key.type, 4);
125 lctx->rfc1964_kd.ctx_key.type = 4;
128 printerr(2, "%s: serializing keys with enctype %d and length %d\n",
129 __FUNCTION__, lctx->rfc1964_kd.ctx_key.type,
130 lctx->rfc1964_kd.ctx_key.length);
132 /* derive the encryption key and copy it into buffer */
133 enc_key.type = lctx->rfc1964_kd.ctx_key.type;
134 enc_key.length = lctx->rfc1964_kd.ctx_key.length;
135 if ((enc_key.data = calloc(1, enc_key.length)) == NULL)
137 skd = (char *) lctx->rfc1964_kd.ctx_key.data;
138 dkd = (char *) enc_key.data;
139 for (i = 0; i < enc_key.length; i++)
140 dkd[i] = skd[i] ^ 0xf0;
141 if (write_lucid_keyblock(&p, end, &enc_key))
143 if (write_lucid_keyblock(&p, end, &lctx->rfc1964_kd.ctx_key))
147 buf->length = p - (char *)buf->value;
150 printerr(0, "ERROR: failed serializing krb5 context for kernel\n");
156 if (enc_key.data) free(enc_key.data);
160 /* XXX Hack alert! XXX Do NOT submit upstream! XXX */
161 /* XXX Hack alert! XXX Do NOT submit upstream! XXX */
164 #define KG_USAGE_SEAL 22
165 #define KG_USAGE_SIGN 23
166 #define KG_USAGE_SEQ 24
169 #define KG_USAGE_ACCEPTOR_SEAL 22
170 #define KG_USAGE_ACCEPTOR_SIGN 23
171 #define KG_USAGE_INITIATOR_SEAL 24
172 #define KG_USAGE_INITIATOR_SIGN 25
174 /* Lifted from mit src/lib/gssapi/krb5/gssapiP_krb5.h */
176 SEAL_ALG_NONE = 0xffff,
177 SEAL_ALG_DES = 0x0000,
178 SEAL_ALG_1 = 0x0001, /* not published */
179 SEAL_ALG_MICROSOFT_RC4 = 0x0010, /* microsoft w2k; */
180 SEAL_ALG_DES3KD = 0x0002
183 #define KEY_USAGE_SEED_ENCRYPTION 0xAA
184 #define KEY_USAGE_SEED_INTEGRITY 0x55
185 #define KEY_USAGE_SEED_CHECKSUM 0x99
188 /* Flags for version 2 context flags */
189 #define KRB5_CTX_FLAG_INITIATOR 0x00000001
190 #define KRB5_CTX_FLAG_CFX 0x00000002
191 #define KRB5_CTX_FLAG_ACCEPTOR_SUBKEY 0x00000004
193 /* XXX Hack alert! XXX Do NOT submit upstream! XXX */
194 /* XXX Hack alert! XXX Do NOT submit upstream! XXX */
196 * We don't have "legal" access to these MIT-only
197 * structures located in libk5crypto
199 extern void *krb5int_enc_arcfour;
200 #ifdef HAVE_DES3_SUPPORT
201 extern void *krb5int_enc_des3;
203 extern void *krb5int_enc_aes128;
204 extern void *krb5int_enc_aes256;
207 key_lucid_to_krb5(const gss_krb5_lucid_key_t *lin, krb5_keyblock *kout)
209 memset(kout, 0, sizeof(*kout));
211 kout->enctype = lin->type;
212 kout->length = lin->length;
213 kout->contents = lin->data;
215 kout->keytype = lin->type;
216 kout->keyvalue.length = lin->length;
217 kout->keyvalue.data = lin->data;
222 key_krb5_to_lucid(const krb5_keyblock *kin, gss_krb5_lucid_key_t *lout)
224 memset(lout, 0, sizeof(*lout));
227 lout->data = malloc(kin->length);
228 if (lout->data == NULL)
229 return KRB5_CC_NOMEM;
231 lout->type = kin->enctype;
232 lout->length = kin->length;
233 memcpy(lout->data, kin->contents, kin->length);
235 lout->data = malloc(kin->keyvalue.length);
236 if (lout->data == NULL)
237 return KRB5_CC_NOMEM;
239 lout->type = kin->keytype;
240 lout->length = kin->keyvalue.length;
241 memcpy(lout->data, kin->keyvalue.data, kin->keyvalue.length);
247 /* XXX Hack alert! XXX Do NOT submit upstream! XXX */
248 /* XXX Hack alert! XXX Do NOT submit upstream! XXX */
249 /* XXX Hack alert! XXX Do NOT submit upstream! XXX */
250 /* XXX Hack alert! XXX Do NOT submit upstream! XXX */
252 * Function to derive a new key from a given key and given constant data.
254 static krb5_error_code
255 derive_key_lucid(const gss_krb5_lucid_key_t *in, gss_krb5_lucid_key_t *out,
256 int usage, char extra)
258 krb5_error_code code;
259 unsigned char constant_data[K5CLENGTH];
261 int keylength __attribute__ ((unused));
265 krb5_keyblock kin; /* must send krb5_keyblock, not lucid! */
266 #if defined(HAVE_HEIMDAL) || HAVE_KRB5INT_DERIVE_KEY
267 krb5_context kcontext;
268 krb5_keyblock *outkey;
272 #if HAVE_KRB5INT_DERIVE_KEY
273 krb5_key key_in, key_out;
277 * XXX Hack alert. We don't have "legal" access to these
278 * values and structures located in libk5crypto
281 #ifdef HAVE_DES3_SUPPORT
282 case ENCTYPE_DES3_CBC_SHA1:
284 case ENCTYPE_DES3_CBC_RAW:
288 enc = &krb5int_enc_des3;
292 case ENCTYPE_AES128_CTS_HMAC_SHA1_96:
295 enc = &krb5int_enc_aes128;
298 case ENCTYPE_AES256_CTS_HMAC_SHA1_96:
301 enc = &krb5int_enc_aes256;
305 code = KRB5_BAD_ENCTYPE;
309 /* Convert to correct format for call to krb5_derive_key */
310 key_lucid_to_krb5(in, &kin);
312 datain.data = (char *) constant_data;
313 datain.length = K5CLENGTH;
315 ((char *)(datain.data))[0] = (usage>>24)&0xff;
316 ((char *)(datain.data))[1] = (usage>>16)&0xff;
317 ((char *)(datain.data))[2] = (usage>>8)&0xff;
318 ((char *)(datain.data))[3] = usage&0xff;
320 ((char *)(datain.data))[4] = (char) extra;
322 /* Step 1: Init context */
323 /* Heimdal and newer MIT Kerberos require kcontext */
324 #if defined(HAVE_KRB5INT_DERIVE_KEY) || defined(HAVE_HEIMDAL)
325 code = krb5_init_context(&kcontext);
330 /* Step 2: Get the derived key */
332 #if HAVE_KRB5INT_DERIVE_KEY
333 code = krb5_k_create_key(kcontext, &kin, &key_in);
337 code = ll_krb5int_derive_key(enc, key_in, &key_out, &datain,
340 krb5_k_free_key(kcontext, key_in);
342 krb5_k_key_keyblock(kcontext, key_out, &outkey);
343 krb5_k_free_key(kcontext, key_out);
345 #else /* !HAVE_KRB5INT_DERIVE_KEY */
346 out->length = keylength;
347 out->type = in->type;
349 key_lucid_to_krb5(out, &kout);
351 code = krb5_derive_key(enc, &kin, &kout, &datain);
352 #endif /* HAVE_KRB5INT_DERIVE_KEY */
353 #else /* !defined(HAVE_KRB5) */
354 code = krb5_derive_key(kcontext, &kin, in->type, constant_data, K5CLENGTH, &outkey);
355 #endif /* defined(HAVE_KRB5) */
360 /* Step 3: Copy the key to out */
361 #if defined(HAVE_KRB5INT_DERIVE_KEY) || defined(HAVE_HEIMDAL)
362 code = key_krb5_to_lucid(outkey, out);
363 krb5_free_keyblock(kcontext, outkey);
364 #else /* !defined(HAVE_KRB5) */
365 code = key_krb5_to_lucid(&kout, out);
366 #endif /* defined(HAVE_KRB5) */
368 /* Step 4: Free the context */
369 #if defined(HAVE_KRB5INT_DERIVE_KEY) || defined(HAVE_HEIMDAL)
370 krb5_free_context(kcontext);
375 printerr(0, "ERROR: %s: returning error %d (%s)\n",
376 __FUNCTION__, code, error_message(code));
382 * Prepare a new-style buffer, as defined in rfc4121 (a.k.a. cfx),
383 * to send to the kernel for newer encryption types -- or for DES3.
387 * u32 initiate; ( whether we are the initiator or not )
390 * #define KRB5_CTX_FLAG_INITIATOR 0x00000001
391 * #define KRB5_CTX_FLAG_CFX 0x00000002
392 * #define KRB5_CTX_FLAG_ACCEPTOR_SUBKEY 0x00000004
394 * u32 enctype; ( encrption type of keys )
395 * u32 size_of_each_key; ( size of each key in bytes )
396 * u32 number_of_keys; ( N -- should always be 3 for now )
403 prepare_krb5_rfc4121_buffer(gss_krb5_lucid_context_v1_t *lctx,
404 gss_buffer_desc *buf)
406 static int constant_two = 2;
408 uint32_t v2_flags = 0;
409 gss_krb5_lucid_key_t enc_key;
410 gss_krb5_lucid_key_t derived_key;
411 gss_buffer_desc fakeoid;
416 memset(&enc_key, 0, sizeof(enc_key));
417 memset(&fakeoid, 0, sizeof(fakeoid));
419 if (!(buf->value = calloc(1, MAX_CTX_LEN)))
422 end = buf->value + MAX_CTX_LEN;
425 if (WRITE_BYTES(&p, end, constant_two)) goto out_err;
426 if (WRITE_BYTES(&p, end, lctx->endtime)) goto out_err;
429 v2_flags |= KRB5_CTX_FLAG_INITIATOR;
430 if (lctx->protocol != 0)
431 v2_flags |= KRB5_CTX_FLAG_CFX;
432 if (lctx->protocol != 0 && lctx->cfx_kd.have_acceptor_subkey == 1)
433 v2_flags |= KRB5_CTX_FLAG_ACCEPTOR_SUBKEY;
435 if (WRITE_BYTES(&p, end, v2_flags)) goto out_err;
437 if (WRITE_BYTES(&p, end, lctx->send_seq)) goto out_err;
439 /* Protocol 0 here implies DES3 or RC4 */
440 printerr(3, "protocol %d\n", lctx->protocol);
441 if (lctx->protocol == 0) {
442 enctype = lctx->rfc1964_kd.ctx_key.type;
445 * The kernel gss code expects ENCTYPE_DES3_CBC_RAW (6) for
446 * 3des keys, but Heimdal key has ENCTYPE_DES3_CBC_SHA1 (16).
447 * Force the Heimdal enctype to 6.
449 if (enctype == ENCTYPE_DES3_CBC_SHA1) {
450 printerr(2, "%s: overriding heimdal keytype (%d => %d)\n",
451 __FUNCTION__, enctype, 6);
456 keysize = lctx->rfc1964_kd.ctx_key.length;
457 numkeys = 3; /* XXX is always gonna be three? */
459 if (lctx->cfx_kd.have_acceptor_subkey) {
460 enctype = lctx->cfx_kd.acceptor_subkey.type;
461 keysize = lctx->cfx_kd.acceptor_subkey.length;
463 enctype = lctx->cfx_kd.ctx_key.type;
464 keysize = lctx->cfx_kd.ctx_key.length;
468 printerr(3, "serializing %d keys with enctype %d and size %d\n",
469 numkeys, enctype, keysize);
470 if (WRITE_BYTES(&p, end, enctype)) goto out_err;
471 if (WRITE_BYTES(&p, end, keysize)) goto out_err;
472 if (WRITE_BYTES(&p, end, numkeys)) goto out_err;
474 if (lctx->protocol == 0) {
475 /* derive and send down: Ke, Ki, and Kc */
477 if (write_bytes(&p, end, lctx->rfc1964_kd.ctx_key.data,
478 lctx->rfc1964_kd.ctx_key.length))
482 if (write_bytes(&p, end, lctx->rfc1964_kd.ctx_key.data,
483 lctx->rfc1964_kd.ctx_key.length))
488 * RC4 is special, it dosen't need key derivation. Actually
489 * the Ke is based on plain text. Here we just let all three
490 * key identical, kernel will handle everything. --ericm
492 if (lctx->rfc1964_kd.ctx_key.type == ENCTYPE_ARCFOUR_HMAC) {
493 if (write_bytes(&p, end, lctx->rfc1964_kd.ctx_key.data,
494 lctx->rfc1964_kd.ctx_key.length))
497 if (derive_key_lucid(&lctx->rfc1964_kd.ctx_key,
499 KG_USAGE_SIGN, KEY_USAGE_SEED_CHECKSUM))
501 if (write_bytes(&p, end, derived_key.data,
504 free(derived_key.data);
507 gss_krb5_lucid_key_t *keyptr;
508 uint32_t sign_usage, seal_usage;
510 if (lctx->cfx_kd.have_acceptor_subkey)
511 keyptr = &lctx->cfx_kd.acceptor_subkey;
513 keyptr = &lctx->cfx_kd.ctx_key;
516 * These are from rfc4142, but I don't understand:
517 * if we supply different 'usage' value for client &
518 * server, then the peers will have different derived
519 * keys. How could this work?
521 * Here we simply use old SIGN/SEAL values until we
522 * find the answer. --ericm
525 sign_usage = KG_USAGE_SIGN;
526 seal_usage = KG_USAGE_SEAL;
528 /* derive and send down: Ke, Ki, and Kc */
531 if (derive_key_lucid(keyptr, &derived_key,
532 seal_usage, KEY_USAGE_SEED_ENCRYPTION))
534 if (write_bytes(&p, end, derived_key.data,
537 free(derived_key.data);
540 if (derive_key_lucid(keyptr, &derived_key,
541 seal_usage, KEY_USAGE_SEED_INTEGRITY))
543 if (write_bytes(&p, end, derived_key.data,
546 free(derived_key.data);
549 if (derive_key_lucid(keyptr, &derived_key,
550 sign_usage, KEY_USAGE_SEED_CHECKSUM))
552 if (write_bytes(&p, end, derived_key.data,
555 free(derived_key.data);
558 buf->length = p - (char *)buf->value;
562 printerr(0, "ERROR: %s: failed serializing krb5 context for kernel\n",
576 serialize_krb5_ctx(gss_ctx_id_t ctx, gss_buffer_desc *buf)
578 OM_uint32 maj_stat, min_stat;
579 void *return_ctx = 0;
581 gss_krb5_lucid_context_v1_t *lctx = 0;
584 printerr(3, "lucid version!\n");
585 maj_stat = gss_krb5_export_lucid_sec_context(&min_stat, &ctx,
587 if (maj_stat != GSS_S_COMPLETE) {
588 pgsserr("gss_krb5_export_lucid_sec_context",
589 maj_stat, min_stat, &krb5oid);
593 /* Check the version returned, we only support v1 right now */
594 vers = ((gss_krb5_lucid_context_version_t *)return_ctx)->version;
597 lctx = (gss_krb5_lucid_context_v1_t *) return_ctx;
600 printerr(0, "ERROR: unsupported lucid sec context version %d\n",
607 * Now lctx points to a lucid context that we can send down to kernel
609 * Note: we send down different information to the kernel depending
610 * on the protocol version and the enctyption type.
611 * For protocol version 0 with all enctypes besides DES3, we use
612 * the original format. For protocol version != 0 or DES3, we
613 * send down the new style information.
616 if (lctx->protocol == 0 && lctx->rfc1964_kd.ctx_key.type <= 4)
617 retcode = prepare_krb5_rfc1964_buffer(lctx, buf);
619 retcode = prepare_krb5_rfc4121_buffer(lctx, buf);
621 maj_stat = gss_krb5_free_lucid_sec_context(&min_stat, return_ctx);
622 if (maj_stat != GSS_S_COMPLETE) {
623 pgsserr("gss_krb5_export_lucid_sec_context",
624 maj_stat, min_stat, &krb5oid);
625 printerr(0, "WARN: failed to free lucid sec context\n");
629 printerr(1, "%s: prepare_krb5_*_buffer failed (retcode = %d)\n",
630 __FUNCTION__, retcode);
637 printerr(0, "ERROR: failed serializing krb5 context for kernel\n");
643 #endif /* HAVE_LUCID_CONTEXT_SUPPORT */