1*7c478bd9Sstevel@tonic-gate /*
2*7c478bd9Sstevel@tonic-gate * CDDL HEADER START
3*7c478bd9Sstevel@tonic-gate *
4*7c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*7c478bd9Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*7c478bd9Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*7c478bd9Sstevel@tonic-gate * with the License.
8*7c478bd9Sstevel@tonic-gate *
9*7c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*7c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*7c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
12*7c478bd9Sstevel@tonic-gate * and limitations under the License.
13*7c478bd9Sstevel@tonic-gate *
14*7c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*7c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*7c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*7c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*7c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*7c478bd9Sstevel@tonic-gate *
20*7c478bd9Sstevel@tonic-gate * CDDL HEADER END
21*7c478bd9Sstevel@tonic-gate */
22*7c478bd9Sstevel@tonic-gate /*
23*7c478bd9Sstevel@tonic-gate * Copyright 2005 Sun Microsystems, Inc. All rights reserved.
24*7c478bd9Sstevel@tonic-gate * Use is subject to license terms.
25*7c478bd9Sstevel@tonic-gate */
26*7c478bd9Sstevel@tonic-gate
27*7c478bd9Sstevel@tonic-gate #include <sys/types.h>
28*7c478bd9Sstevel@tonic-gate #include <unistd.h>
29*7c478bd9Sstevel@tonic-gate #include <rpc/rpc.h>
30*7c478bd9Sstevel@tonic-gate #include <rpc/key_prot.h>
31*7c478bd9Sstevel@tonic-gate #include <rpcsvc/nis_dhext.h>
32*7c478bd9Sstevel@tonic-gate #include <syslog.h>
33*7c478bd9Sstevel@tonic-gate #include <note.h>
34*7c478bd9Sstevel@tonic-gate
35*7c478bd9Sstevel@tonic-gate /* defined in usr/src/libnsl/rpc/key_call.c */
36*7c478bd9Sstevel@tonic-gate extern bool_t (*__key_encryptsession_pk_LOCAL)();
37*7c478bd9Sstevel@tonic-gate extern bool_t (*__key_decryptsession_pk_LOCAL)();
38*7c478bd9Sstevel@tonic-gate extern bool_t (*__key_gendes_LOCAL)();
39*7c478bd9Sstevel@tonic-gate
40*7c478bd9Sstevel@tonic-gate #define CLASSIC_PK_DH(k, a) (((k) == 192) && ((a) == 0))
41*7c478bd9Sstevel@tonic-gate
42*7c478bd9Sstevel@tonic-gate /*
43*7c478bd9Sstevel@tonic-gate * authsys_create_uid(uid_t uid)
44*7c478bd9Sstevel@tonic-gate *
45*7c478bd9Sstevel@tonic-gate * Create SYS (UNIX) style authenticator for the given uid/gid
46*7c478bd9Sstevel@tonic-gate * We don't include suplementary groups, since these are of no
47*7c478bd9Sstevel@tonic-gate * interest for the keyserv operations that we do.
48*7c478bd9Sstevel@tonic-gate */
49*7c478bd9Sstevel@tonic-gate AUTH *
authsys_create_uid(uid_t uid,gid_t gid)50*7c478bd9Sstevel@tonic-gate authsys_create_uid(uid_t uid, gid_t gid)
51*7c478bd9Sstevel@tonic-gate {
52*7c478bd9Sstevel@tonic-gate char host[MAX_MACHINE_NAME + 1];
53*7c478bd9Sstevel@tonic-gate AUTH *res;
54*7c478bd9Sstevel@tonic-gate
55*7c478bd9Sstevel@tonic-gate if (gethostname(host, sizeof (host) - 1) == -1) {
56*7c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
57*7c478bd9Sstevel@tonic-gate "pam_dhkeys: Can't determine hostname: %m");
58*7c478bd9Sstevel@tonic-gate return (NULL);
59*7c478bd9Sstevel@tonic-gate }
60*7c478bd9Sstevel@tonic-gate host[MAX_MACHINE_NAME] = '\0';
61*7c478bd9Sstevel@tonic-gate
62*7c478bd9Sstevel@tonic-gate res = authsys_create(host, uid, gid, 0, (gid_t *)NULL);
63*7c478bd9Sstevel@tonic-gate
64*7c478bd9Sstevel@tonic-gate return (res);
65*7c478bd9Sstevel@tonic-gate }
66*7c478bd9Sstevel@tonic-gate
67*7c478bd9Sstevel@tonic-gate /*
68*7c478bd9Sstevel@tonic-gate * my_key_call(proc, xdr_arg, arg, xdr_rslt, rslt, uit, gid)
69*7c478bd9Sstevel@tonic-gate *
70*7c478bd9Sstevel@tonic-gate * my_key_call is a copy of key_call() from libnsl with the
71*7c478bd9Sstevel@tonic-gate * added AUTHSYS rpc credential to make the keyserver use our
72*7c478bd9Sstevel@tonic-gate * REAL UID instead of our EFFECTIVE UID when handling our keys.
73*7c478bd9Sstevel@tonic-gate */
74*7c478bd9Sstevel@tonic-gate int
my_key_call(rpcproc_t proc,xdrproc_t xdr_arg,char * arg,xdrproc_t xdr_rslt,char * rslt,uid_t uid,gid_t gid)75*7c478bd9Sstevel@tonic-gate my_key_call(rpcproc_t proc, xdrproc_t xdr_arg, char *arg,
76*7c478bd9Sstevel@tonic-gate xdrproc_t xdr_rslt, char *rslt, uid_t uid, gid_t gid)
77*7c478bd9Sstevel@tonic-gate {
78*7c478bd9Sstevel@tonic-gate CLIENT *clnt;
79*7c478bd9Sstevel@tonic-gate struct timeval wait_time = {0, 0};
80*7c478bd9Sstevel@tonic-gate enum clnt_stat status;
81*7c478bd9Sstevel@tonic-gate int vers;
82*7c478bd9Sstevel@tonic-gate
83*7c478bd9Sstevel@tonic-gate if (proc == KEY_ENCRYPT_PK && __key_encryptsession_pk_LOCAL) {
84*7c478bd9Sstevel@tonic-gate cryptkeyres res;
85*7c478bd9Sstevel@tonic-gate bool_t r;
86*7c478bd9Sstevel@tonic-gate r = (*__key_encryptsession_pk_LOCAL)(uid, arg, &res);
87*7c478bd9Sstevel@tonic-gate if (r == TRUE) {
88*7c478bd9Sstevel@tonic-gate /* LINTED pointer alignment */
89*7c478bd9Sstevel@tonic-gate *(cryptkeyres*)rslt = res;
90*7c478bd9Sstevel@tonic-gate return (1);
91*7c478bd9Sstevel@tonic-gate }
92*7c478bd9Sstevel@tonic-gate return (0);
93*7c478bd9Sstevel@tonic-gate }
94*7c478bd9Sstevel@tonic-gate if (proc == KEY_DECRYPT_PK && __key_decryptsession_pk_LOCAL) {
95*7c478bd9Sstevel@tonic-gate cryptkeyres res;
96*7c478bd9Sstevel@tonic-gate bool_t r;
97*7c478bd9Sstevel@tonic-gate r = (*__key_decryptsession_pk_LOCAL)(uid, arg, &res);
98*7c478bd9Sstevel@tonic-gate if (r == TRUE) {
99*7c478bd9Sstevel@tonic-gate /* LINTED pointer alignment */
100*7c478bd9Sstevel@tonic-gate *(cryptkeyres*)rslt = res;
101*7c478bd9Sstevel@tonic-gate return (1);
102*7c478bd9Sstevel@tonic-gate }
103*7c478bd9Sstevel@tonic-gate return (0);
104*7c478bd9Sstevel@tonic-gate }
105*7c478bd9Sstevel@tonic-gate if (proc == KEY_GEN && __key_gendes_LOCAL) {
106*7c478bd9Sstevel@tonic-gate des_block res;
107*7c478bd9Sstevel@tonic-gate bool_t r;
108*7c478bd9Sstevel@tonic-gate r = (*__key_gendes_LOCAL)(uid, 0, &res);
109*7c478bd9Sstevel@tonic-gate if (r == TRUE) {
110*7c478bd9Sstevel@tonic-gate /* LINTED pointer alignment */
111*7c478bd9Sstevel@tonic-gate *(des_block*)rslt = res;
112*7c478bd9Sstevel@tonic-gate return (1);
113*7c478bd9Sstevel@tonic-gate }
114*7c478bd9Sstevel@tonic-gate return (0);
115*7c478bd9Sstevel@tonic-gate }
116*7c478bd9Sstevel@tonic-gate
117*7c478bd9Sstevel@tonic-gate if ((proc == KEY_ENCRYPT_PK) || (proc == KEY_DECRYPT_PK) ||
118*7c478bd9Sstevel@tonic-gate (proc == KEY_NET_GET) || (proc == KEY_NET_PUT) ||
119*7c478bd9Sstevel@tonic-gate (proc == KEY_GET_CONV))
120*7c478bd9Sstevel@tonic-gate vers = 2; /* talk to version 2 */
121*7c478bd9Sstevel@tonic-gate else
122*7c478bd9Sstevel@tonic-gate vers = 1; /* talk to version 1 */
123*7c478bd9Sstevel@tonic-gate
124*7c478bd9Sstevel@tonic-gate clnt = clnt_door_create(KEY_PROG, vers, 0);
125*7c478bd9Sstevel@tonic-gate
126*7c478bd9Sstevel@tonic-gate if (clnt == NULL)
127*7c478bd9Sstevel@tonic-gate return (0);
128*7c478bd9Sstevel@tonic-gate
129*7c478bd9Sstevel@tonic-gate clnt->cl_auth = authsys_create_uid(uid, gid);
130*7c478bd9Sstevel@tonic-gate
131*7c478bd9Sstevel@tonic-gate status = CLNT_CALL(clnt, proc, xdr_arg, arg, xdr_rslt,
132*7c478bd9Sstevel@tonic-gate rslt, wait_time);
133*7c478bd9Sstevel@tonic-gate
134*7c478bd9Sstevel@tonic-gate auth_destroy(clnt->cl_auth);
135*7c478bd9Sstevel@tonic-gate clnt_destroy(clnt);
136*7c478bd9Sstevel@tonic-gate
137*7c478bd9Sstevel@tonic-gate return (status == RPC_SUCCESS ? 1 : 0);
138*7c478bd9Sstevel@tonic-gate }
139*7c478bd9Sstevel@tonic-gate
140*7c478bd9Sstevel@tonic-gate int
key_setnet_uid(struct key_netstarg * arg,uid_t uid,gid_t gid)141*7c478bd9Sstevel@tonic-gate key_setnet_uid(struct key_netstarg *arg, uid_t uid, gid_t gid)
142*7c478bd9Sstevel@tonic-gate {
143*7c478bd9Sstevel@tonic-gate keystatus status;
144*7c478bd9Sstevel@tonic-gate
145*7c478bd9Sstevel@tonic-gate if (!my_key_call((rpcproc_t)KEY_NET_PUT, xdr_key_netstarg,
146*7c478bd9Sstevel@tonic-gate (char *)arg, xdr_keystatus, (char *)&status, uid, gid)) {
147*7c478bd9Sstevel@tonic-gate return (-1);
148*7c478bd9Sstevel@tonic-gate }
149*7c478bd9Sstevel@tonic-gate if (status != KEY_SUCCESS) {
150*7c478bd9Sstevel@tonic-gate return (-1);
151*7c478bd9Sstevel@tonic-gate }
152*7c478bd9Sstevel@tonic-gate
153*7c478bd9Sstevel@tonic-gate return (1);
154*7c478bd9Sstevel@tonic-gate }
155*7c478bd9Sstevel@tonic-gate
156*7c478bd9Sstevel@tonic-gate int
key_setnet_g_uid(const char * netname,const char * skey,keylen_t skeylen,const char * pkey,keylen_t pkeylen,algtype_t algtype,uid_t uid,gid_t gid)157*7c478bd9Sstevel@tonic-gate key_setnet_g_uid(const char *netname, const char *skey, keylen_t skeylen,
158*7c478bd9Sstevel@tonic-gate const char *pkey, keylen_t pkeylen, algtype_t algtype,
159*7c478bd9Sstevel@tonic-gate uid_t uid, gid_t gid)
160*7c478bd9Sstevel@tonic-gate {
161*7c478bd9Sstevel@tonic-gate key_netstarg3 arg;
162*7c478bd9Sstevel@tonic-gate keystatus status;
163*7c478bd9Sstevel@tonic-gate
164*7c478bd9Sstevel@tonic-gate arg.st_netname = (char *)netname;
165*7c478bd9Sstevel@tonic-gate arg.algtype = algtype;
166*7c478bd9Sstevel@tonic-gate
167*7c478bd9Sstevel@tonic-gate if (skeylen == 0)
168*7c478bd9Sstevel@tonic-gate arg.st_priv_key.keybuf3_len = 0;
169*7c478bd9Sstevel@tonic-gate else
170*7c478bd9Sstevel@tonic-gate arg.st_priv_key.keybuf3_len = skeylen/4 + 1;
171*7c478bd9Sstevel@tonic-gate
172*7c478bd9Sstevel@tonic-gate arg.st_priv_key.keybuf3_val = (char *)skey;
173*7c478bd9Sstevel@tonic-gate
174*7c478bd9Sstevel@tonic-gate if (pkeylen == 0)
175*7c478bd9Sstevel@tonic-gate arg.st_pub_key.keybuf3_len = 0;
176*7c478bd9Sstevel@tonic-gate else
177*7c478bd9Sstevel@tonic-gate arg.st_pub_key.keybuf3_len = pkeylen/4 + 1;
178*7c478bd9Sstevel@tonic-gate
179*7c478bd9Sstevel@tonic-gate arg.st_pub_key.keybuf3_val = (char *)pkey;
180*7c478bd9Sstevel@tonic-gate
181*7c478bd9Sstevel@tonic-gate if (skeylen == 0) {
182*7c478bd9Sstevel@tonic-gate if (pkeylen == 0) {
183*7c478bd9Sstevel@tonic-gate /* debug("keylens are both 0"); */
184*7c478bd9Sstevel@tonic-gate return (-1);
185*7c478bd9Sstevel@tonic-gate }
186*7c478bd9Sstevel@tonic-gate arg.keylen = pkeylen;
187*7c478bd9Sstevel@tonic-gate } else {
188*7c478bd9Sstevel@tonic-gate if ((pkeylen != 0) && (skeylen != pkeylen)) {
189*7c478bd9Sstevel@tonic-gate /* debug("keylens don't match"); */
190*7c478bd9Sstevel@tonic-gate return (-1);
191*7c478bd9Sstevel@tonic-gate }
192*7c478bd9Sstevel@tonic-gate arg.keylen = skeylen;
193*7c478bd9Sstevel@tonic-gate }
194*7c478bd9Sstevel@tonic-gate
195*7c478bd9Sstevel@tonic-gate if (CLASSIC_PK_DH(arg.keylen, arg.algtype)) {
196*7c478bd9Sstevel@tonic-gate key_netstarg tmp;
197*7c478bd9Sstevel@tonic-gate
198*7c478bd9Sstevel@tonic-gate if (skeylen != 0) {
199*7c478bd9Sstevel@tonic-gate (void) memcpy(&tmp.st_priv_key, skey,
200*7c478bd9Sstevel@tonic-gate sizeof (tmp.st_priv_key));
201*7c478bd9Sstevel@tonic-gate } else {
202*7c478bd9Sstevel@tonic-gate (void) memset(&tmp.st_priv_key, 0,
203*7c478bd9Sstevel@tonic-gate sizeof (tmp.st_priv_key));
204*7c478bd9Sstevel@tonic-gate }
205*7c478bd9Sstevel@tonic-gate if (pkeylen != 0) {
206*7c478bd9Sstevel@tonic-gate (void) memcpy(&tmp.st_pub_key, skey,
207*7c478bd9Sstevel@tonic-gate sizeof (tmp.st_pub_key));
208*7c478bd9Sstevel@tonic-gate } else {
209*7c478bd9Sstevel@tonic-gate (void) memset(&tmp.st_pub_key, 0,
210*7c478bd9Sstevel@tonic-gate sizeof (tmp.st_pub_key));
211*7c478bd9Sstevel@tonic-gate }
212*7c478bd9Sstevel@tonic-gate tmp.st_netname = (char *)netname;
213*7c478bd9Sstevel@tonic-gate return (key_setnet_uid(&tmp, uid, gid));
214*7c478bd9Sstevel@tonic-gate }
215*7c478bd9Sstevel@tonic-gate
216*7c478bd9Sstevel@tonic-gate if (!my_key_call((rpcproc_t)KEY_NET_PUT_3, xdr_key_netstarg3,
217*7c478bd9Sstevel@tonic-gate (char *)&arg, xdr_keystatus, (char *)&status, uid, gid)) {
218*7c478bd9Sstevel@tonic-gate return (-1);
219*7c478bd9Sstevel@tonic-gate }
220*7c478bd9Sstevel@tonic-gate
221*7c478bd9Sstevel@tonic-gate if (status != KEY_SUCCESS) {
222*7c478bd9Sstevel@tonic-gate /* debug("key_setnet3 status is nonzero"); */
223*7c478bd9Sstevel@tonic-gate return (-1);
224*7c478bd9Sstevel@tonic-gate }
225*7c478bd9Sstevel@tonic-gate return (0);
226*7c478bd9Sstevel@tonic-gate }
227*7c478bd9Sstevel@tonic-gate
228*7c478bd9Sstevel@tonic-gate
229*7c478bd9Sstevel@tonic-gate /*
230*7c478bd9Sstevel@tonic-gate * key_secretkey_is_set_uid() returns 1 if the keyserver has a secret key
231*7c478bd9Sstevel@tonic-gate * stored for the caller's REAL uid; it returns 0 otherwise
232*7c478bd9Sstevel@tonic-gate */
233*7c478bd9Sstevel@tonic-gate int
key_secretkey_is_set_uid(uid_t uid,gid_t gid)234*7c478bd9Sstevel@tonic-gate key_secretkey_is_set_uid(uid_t uid, gid_t gid)
235*7c478bd9Sstevel@tonic-gate {
236*7c478bd9Sstevel@tonic-gate struct key_netstres kres;
237*7c478bd9Sstevel@tonic-gate
238*7c478bd9Sstevel@tonic-gate (void) memset((void*)&kres, 0, sizeof (kres));
239*7c478bd9Sstevel@tonic-gate
240*7c478bd9Sstevel@tonic-gate if (my_key_call((rpcproc_t)KEY_NET_GET, xdr_void, (char *)NULL,
241*7c478bd9Sstevel@tonic-gate xdr_key_netstres, (char *)&kres, uid, gid) &&
242*7c478bd9Sstevel@tonic-gate (kres.status == KEY_SUCCESS) &&
243*7c478bd9Sstevel@tonic-gate (kres.key_netstres_u.knet.st_priv_key[0] != 0)) {
244*7c478bd9Sstevel@tonic-gate /* avoid leaving secret key in memory */
245*7c478bd9Sstevel@tonic-gate (void) memset(kres.key_netstres_u.knet.st_priv_key, 0,
246*7c478bd9Sstevel@tonic-gate HEXKEYBYTES);
247*7c478bd9Sstevel@tonic-gate xdr_free(xdr_key_netstres, (char *)&kres);
248*7c478bd9Sstevel@tonic-gate return (1);
249*7c478bd9Sstevel@tonic-gate }
250*7c478bd9Sstevel@tonic-gate return (0);
251*7c478bd9Sstevel@tonic-gate }
252*7c478bd9Sstevel@tonic-gate
253*7c478bd9Sstevel@tonic-gate int
key_removesecret_g_uid(uid_t uid,gid_t gid)254*7c478bd9Sstevel@tonic-gate key_removesecret_g_uid(uid_t uid, gid_t gid)
255*7c478bd9Sstevel@tonic-gate {
256*7c478bd9Sstevel@tonic-gate keystatus status;
257*7c478bd9Sstevel@tonic-gate
258*7c478bd9Sstevel@tonic-gate if (my_key_call((rpcproc_t)KEY_CLEAR_3, xdr_void, (char *)NULL,
259*7c478bd9Sstevel@tonic-gate xdr_keystatus, (char *)&status, uid, gid))
260*7c478bd9Sstevel@tonic-gate return (-1);
261*7c478bd9Sstevel@tonic-gate
262*7c478bd9Sstevel@tonic-gate if (status != KEY_SUCCESS)
263*7c478bd9Sstevel@tonic-gate return (-1);
264*7c478bd9Sstevel@tonic-gate
265*7c478bd9Sstevel@tonic-gate return (0);
266*7c478bd9Sstevel@tonic-gate }
267