1*7c478bd9Sstevel@tonic-gate /*
2*7c478bd9Sstevel@tonic-gate * CDDL HEADER START
3*7c478bd9Sstevel@tonic-gate *
4*7c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*7c478bd9Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*7c478bd9Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*7c478bd9Sstevel@tonic-gate * with the License.
8*7c478bd9Sstevel@tonic-gate *
9*7c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*7c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*7c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
12*7c478bd9Sstevel@tonic-gate * and limitations under the License.
13*7c478bd9Sstevel@tonic-gate *
14*7c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*7c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*7c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*7c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*7c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*7c478bd9Sstevel@tonic-gate *
20*7c478bd9Sstevel@tonic-gate * CDDL HEADER END
21*7c478bd9Sstevel@tonic-gate */
22*7c478bd9Sstevel@tonic-gate /*
23*7c478bd9Sstevel@tonic-gate * Copyright 2003 Sun Microsystems, Inc. All rights reserved.
24*7c478bd9Sstevel@tonic-gate * Use is subject to license terms.
25*7c478bd9Sstevel@tonic-gate */
26*7c478bd9Sstevel@tonic-gate
27*7c478bd9Sstevel@tonic-gate /* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
28*7c478bd9Sstevel@tonic-gate /* All Rights Reserved */
29*7c478bd9Sstevel@tonic-gate
30*7c478bd9Sstevel@tonic-gate /*
31*7c478bd9Sstevel@tonic-gate * Portions of this source code were derived from Berkeley 4.3 BSD
32*7c478bd9Sstevel@tonic-gate * under license from the Regents of the University of California.
33*7c478bd9Sstevel@tonic-gate */
34*7c478bd9Sstevel@tonic-gate
35*7c478bd9Sstevel@tonic-gate /*
36*7c478bd9Sstevel@tonic-gate * auth_des.c, client-side implementation of DES authentication
37*7c478bd9Sstevel@tonic-gate */
38*7c478bd9Sstevel@tonic-gate
39*7c478bd9Sstevel@tonic-gate #include <sys/types.h>
40*7c478bd9Sstevel@tonic-gate #include <sys/t_lock.h>
41*7c478bd9Sstevel@tonic-gate #include <sys/time.h>
42*7c478bd9Sstevel@tonic-gate #include <sys/systm.h>
43*7c478bd9Sstevel@tonic-gate #include <sys/socket.h>
44*7c478bd9Sstevel@tonic-gate #include <sys/tiuser.h>
45*7c478bd9Sstevel@tonic-gate #include <sys/errno.h>
46*7c478bd9Sstevel@tonic-gate #include <rpc/des_crypt.h>
47*7c478bd9Sstevel@tonic-gate #include <rpc/types.h>
48*7c478bd9Sstevel@tonic-gate #include <rpc/auth.h>
49*7c478bd9Sstevel@tonic-gate #include <rpc/auth_des.h>
50*7c478bd9Sstevel@tonic-gate #include <rpc/xdr.h>
51*7c478bd9Sstevel@tonic-gate #include <rpc/clnt.h>
52*7c478bd9Sstevel@tonic-gate #include <rpc/rpc_msg.h>
53*7c478bd9Sstevel@tonic-gate #include <netinet/in.h> /* XXX: just to get htonl() and ntohl() */
54*7c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h>
55*7c478bd9Sstevel@tonic-gate #include <sys/debug.h>
56*7c478bd9Sstevel@tonic-gate
57*7c478bd9Sstevel@tonic-gate #define MILLION 1000000
58*7c478bd9Sstevel@tonic-gate #define RTIME_TIMEOUT 5 /* seconds to wait for sync */
59*7c478bd9Sstevel@tonic-gate
60*7c478bd9Sstevel@tonic-gate #define AUTH_PRIVATE(auth) (struct ad_private *)auth->ah_private
61*7c478bd9Sstevel@tonic-gate #define ALLOC(object_type) (object_type *) mem_alloc(sizeof (object_type))
62*7c478bd9Sstevel@tonic-gate #define FREE(ptr, size) mem_free((char *)(ptr), (int)size)
63*7c478bd9Sstevel@tonic-gate #define ATTEMPT(xdr_op) if (!(xdr_op))\
64*7c478bd9Sstevel@tonic-gate return (FALSE)
65*7c478bd9Sstevel@tonic-gate
66*7c478bd9Sstevel@tonic-gate #define gettimeofday(tvp, tzp) uniqtime(tvp)
67*7c478bd9Sstevel@tonic-gate
68*7c478bd9Sstevel@tonic-gate static void authdes_nextverf(AUTH *);
69*7c478bd9Sstevel@tonic-gate static bool_t authdes_marshal(AUTH *, XDR *, struct cred *);
70*7c478bd9Sstevel@tonic-gate static bool_t authdes_validate(AUTH *, struct opaque_auth *);
71*7c478bd9Sstevel@tonic-gate static bool_t authdes_refresh(AUTH *, struct rpc_msg *, cred_t *);
72*7c478bd9Sstevel@tonic-gate static void authdes_destroy(AUTH *);
73*7c478bd9Sstevel@tonic-gate static bool_t synchronize(struct knetconfig *, struct netbuf *,
74*7c478bd9Sstevel@tonic-gate int, struct timeval *);
75*7c478bd9Sstevel@tonic-gate
76*7c478bd9Sstevel@tonic-gate static struct auth_ops *authdes_ops(void);
77*7c478bd9Sstevel@tonic-gate
78*7c478bd9Sstevel@tonic-gate /*
79*7c478bd9Sstevel@tonic-gate * This struct is pointed to by the ah_private field of an "AUTH *"
80*7c478bd9Sstevel@tonic-gate */
81*7c478bd9Sstevel@tonic-gate struct ad_private {
82*7c478bd9Sstevel@tonic-gate char *ad_fullname; /* client's full name */
83*7c478bd9Sstevel@tonic-gate uint_t ad_fullnamelen; /* length of name, rounded up */
84*7c478bd9Sstevel@tonic-gate char *ad_servername; /* server's full name */
85*7c478bd9Sstevel@tonic-gate uint_t ad_servernamelen; /* length of name, rounded up */
86*7c478bd9Sstevel@tonic-gate uint_t ad_window; /* client specified window */
87*7c478bd9Sstevel@tonic-gate bool_t ad_dosync; /* synchronize? */
88*7c478bd9Sstevel@tonic-gate struct netbuf ad_syncaddr; /* remote host to synch with */
89*7c478bd9Sstevel@tonic-gate struct knetconfig ad_synconfig; /* netconfig for the synch host */
90*7c478bd9Sstevel@tonic-gate int ad_calltype; /* use rpc or straight call for sync */
91*7c478bd9Sstevel@tonic-gate struct timeval ad_timediff; /* server's time - client's time */
92*7c478bd9Sstevel@tonic-gate uint32_t ad_nickname; /* server's nickname for client */
93*7c478bd9Sstevel@tonic-gate struct authdes_cred ad_cred; /* storage for credential */
94*7c478bd9Sstevel@tonic-gate struct authdes_verf ad_verf; /* storage for verifier */
95*7c478bd9Sstevel@tonic-gate struct timeval ad_timestamp; /* timestamp sent */
96*7c478bd9Sstevel@tonic-gate des_block ad_xkey; /* encrypted conversation key */
97*7c478bd9Sstevel@tonic-gate };
98*7c478bd9Sstevel@tonic-gate
99*7c478bd9Sstevel@tonic-gate
100*7c478bd9Sstevel@tonic-gate /*
101*7c478bd9Sstevel@tonic-gate * Create the client des authentication object
102*7c478bd9Sstevel@tonic-gate */
103*7c478bd9Sstevel@tonic-gate /* ARGSUSED */
104*7c478bd9Sstevel@tonic-gate int
authdes_create(char * servername,uint_t window,struct netbuf * syncaddr,struct knetconfig * synconfig,des_block * ckey,int calltype,AUTH ** retauth)105*7c478bd9Sstevel@tonic-gate authdes_create(char *servername, uint_t window, struct netbuf *syncaddr,
106*7c478bd9Sstevel@tonic-gate struct knetconfig *synconfig, des_block *ckey, int calltype,
107*7c478bd9Sstevel@tonic-gate AUTH **retauth)
108*7c478bd9Sstevel@tonic-gate {
109*7c478bd9Sstevel@tonic-gate AUTH *auth;
110*7c478bd9Sstevel@tonic-gate struct ad_private *ad;
111*7c478bd9Sstevel@tonic-gate char namebuf[MAXNETNAMELEN+1];
112*7c478bd9Sstevel@tonic-gate int error = 0;
113*7c478bd9Sstevel@tonic-gate enum clnt_stat stat;
114*7c478bd9Sstevel@tonic-gate
115*7c478bd9Sstevel@tonic-gate if (retauth == NULL)
116*7c478bd9Sstevel@tonic-gate return (EINVAL);
117*7c478bd9Sstevel@tonic-gate
118*7c478bd9Sstevel@tonic-gate *retauth = NULL;
119*7c478bd9Sstevel@tonic-gate
120*7c478bd9Sstevel@tonic-gate /*
121*7c478bd9Sstevel@tonic-gate * Allocate everything now
122*7c478bd9Sstevel@tonic-gate */
123*7c478bd9Sstevel@tonic-gate auth = ALLOC(AUTH);
124*7c478bd9Sstevel@tonic-gate ad = ALLOC(struct ad_private);
125*7c478bd9Sstevel@tonic-gate bzero(ad, sizeof (struct ad_private));
126*7c478bd9Sstevel@tonic-gate if ((stat = kgetnetname(namebuf)) != 0) {
127*7c478bd9Sstevel@tonic-gate cmn_err(CE_NOTE,
128*7c478bd9Sstevel@tonic-gate "authdes_create: unable to get client's netname: %s (error %d)",
129*7c478bd9Sstevel@tonic-gate clnt_sperrno(stat), stat);
130*7c478bd9Sstevel@tonic-gate goto failed;
131*7c478bd9Sstevel@tonic-gate }
132*7c478bd9Sstevel@tonic-gate
133*7c478bd9Sstevel@tonic-gate ad->ad_fullnamelen = (uint_t)RNDUP(strlen(namebuf));
134*7c478bd9Sstevel@tonic-gate ad->ad_fullname = mem_alloc(ad->ad_fullnamelen + 1);
135*7c478bd9Sstevel@tonic-gate
136*7c478bd9Sstevel@tonic-gate ad->ad_servernamelen = (uint_t)strlen(servername);
137*7c478bd9Sstevel@tonic-gate ad->ad_servername = mem_alloc(ad->ad_servernamelen + 1);
138*7c478bd9Sstevel@tonic-gate
139*7c478bd9Sstevel@tonic-gate if (auth == NULL || ad == NULL || ad->ad_fullname == NULL ||
140*7c478bd9Sstevel@tonic-gate ad->ad_servername == NULL) {
141*7c478bd9Sstevel@tonic-gate cmn_err(CE_NOTE, "authdes_create: out of memory");
142*7c478bd9Sstevel@tonic-gate error = ENOMEM;
143*7c478bd9Sstevel@tonic-gate goto failed;
144*7c478bd9Sstevel@tonic-gate }
145*7c478bd9Sstevel@tonic-gate
146*7c478bd9Sstevel@tonic-gate /*
147*7c478bd9Sstevel@tonic-gate * Set up private data
148*7c478bd9Sstevel@tonic-gate */
149*7c478bd9Sstevel@tonic-gate bcopy(namebuf, ad->ad_fullname, ad->ad_fullnamelen + 1);
150*7c478bd9Sstevel@tonic-gate bcopy(servername, ad->ad_servername, ad->ad_servernamelen + 1);
151*7c478bd9Sstevel@tonic-gate if (syncaddr != NULL) {
152*7c478bd9Sstevel@tonic-gate ad->ad_syncaddr = *syncaddr;
153*7c478bd9Sstevel@tonic-gate ad->ad_synconfig = *synconfig;
154*7c478bd9Sstevel@tonic-gate ad->ad_dosync = TRUE;
155*7c478bd9Sstevel@tonic-gate ad->ad_calltype = calltype;
156*7c478bd9Sstevel@tonic-gate } else {
157*7c478bd9Sstevel@tonic-gate ad->ad_timediff.tv_sec = 0;
158*7c478bd9Sstevel@tonic-gate ad->ad_timediff.tv_usec = 0;
159*7c478bd9Sstevel@tonic-gate ad->ad_dosync = FALSE;
160*7c478bd9Sstevel@tonic-gate }
161*7c478bd9Sstevel@tonic-gate ad->ad_window = window;
162*7c478bd9Sstevel@tonic-gate if (ckey == NULL) {
163*7c478bd9Sstevel@tonic-gate if ((stat = key_gendes(&auth->ah_key)) != RPC_SUCCESS) {
164*7c478bd9Sstevel@tonic-gate cmn_err(CE_NOTE,
165*7c478bd9Sstevel@tonic-gate "authdes_create: unable to gen conversation key: %s (error %d)",
166*7c478bd9Sstevel@tonic-gate clnt_sperrno(stat), stat);
167*7c478bd9Sstevel@tonic-gate if (stat == RPC_INTR)
168*7c478bd9Sstevel@tonic-gate error = EINTR;
169*7c478bd9Sstevel@tonic-gate else if (stat == RPC_TIMEDOUT)
170*7c478bd9Sstevel@tonic-gate error = ETIMEDOUT;
171*7c478bd9Sstevel@tonic-gate else
172*7c478bd9Sstevel@tonic-gate error = EINVAL; /* XXX */
173*7c478bd9Sstevel@tonic-gate goto failed;
174*7c478bd9Sstevel@tonic-gate }
175*7c478bd9Sstevel@tonic-gate } else
176*7c478bd9Sstevel@tonic-gate auth->ah_key = *ckey;
177*7c478bd9Sstevel@tonic-gate
178*7c478bd9Sstevel@tonic-gate /*
179*7c478bd9Sstevel@tonic-gate * Set up auth handle
180*7c478bd9Sstevel@tonic-gate */
181*7c478bd9Sstevel@tonic-gate auth->ah_cred.oa_flavor = AUTH_DES;
182*7c478bd9Sstevel@tonic-gate auth->ah_verf.oa_flavor = AUTH_DES;
183*7c478bd9Sstevel@tonic-gate auth->ah_ops = authdes_ops();
184*7c478bd9Sstevel@tonic-gate auth->ah_private = (caddr_t)ad;
185*7c478bd9Sstevel@tonic-gate
186*7c478bd9Sstevel@tonic-gate if (!authdes_refresh(auth, NULL, CRED()))
187*7c478bd9Sstevel@tonic-gate goto failed;
188*7c478bd9Sstevel@tonic-gate
189*7c478bd9Sstevel@tonic-gate *retauth = auth;
190*7c478bd9Sstevel@tonic-gate return (0);
191*7c478bd9Sstevel@tonic-gate
192*7c478bd9Sstevel@tonic-gate failed:
193*7c478bd9Sstevel@tonic-gate if (ad != NULL && ad->ad_fullname != NULL)
194*7c478bd9Sstevel@tonic-gate FREE(ad->ad_fullname, ad->ad_fullnamelen + 1);
195*7c478bd9Sstevel@tonic-gate if (ad != NULL && ad->ad_servername != NULL)
196*7c478bd9Sstevel@tonic-gate FREE(ad->ad_servername, ad->ad_servernamelen + 1);
197*7c478bd9Sstevel@tonic-gate if (ad != NULL)
198*7c478bd9Sstevel@tonic-gate FREE(ad, sizeof (struct ad_private));
199*7c478bd9Sstevel@tonic-gate if (auth != NULL)
200*7c478bd9Sstevel@tonic-gate FREE(auth, sizeof (AUTH));
201*7c478bd9Sstevel@tonic-gate return ((error == 0) ? EINVAL : error); /* XXX */
202*7c478bd9Sstevel@tonic-gate }
203*7c478bd9Sstevel@tonic-gate
204*7c478bd9Sstevel@tonic-gate /*
205*7c478bd9Sstevel@tonic-gate * Implement the five authentication operations
206*7c478bd9Sstevel@tonic-gate */
207*7c478bd9Sstevel@tonic-gate
208*7c478bd9Sstevel@tonic-gate /*
209*7c478bd9Sstevel@tonic-gate * 1. Next Verifier
210*7c478bd9Sstevel@tonic-gate */
211*7c478bd9Sstevel@tonic-gate /* ARGSUSED */
212*7c478bd9Sstevel@tonic-gate static void
authdes_nextverf(AUTH * auth)213*7c478bd9Sstevel@tonic-gate authdes_nextverf(AUTH *auth)
214*7c478bd9Sstevel@tonic-gate {
215*7c478bd9Sstevel@tonic-gate /* what the heck am I supposed to do??? */
216*7c478bd9Sstevel@tonic-gate }
217*7c478bd9Sstevel@tonic-gate
218*7c478bd9Sstevel@tonic-gate /*
219*7c478bd9Sstevel@tonic-gate * 2. Marshal
220*7c478bd9Sstevel@tonic-gate */
221*7c478bd9Sstevel@tonic-gate /* ARGSUSED */
222*7c478bd9Sstevel@tonic-gate static bool_t
authdes_marshal(AUTH * auth,XDR * xdrs,struct cred * cr)223*7c478bd9Sstevel@tonic-gate authdes_marshal(AUTH *auth, XDR *xdrs, struct cred *cr)
224*7c478bd9Sstevel@tonic-gate {
225*7c478bd9Sstevel@tonic-gate /* LINTED pointer alignment */
226*7c478bd9Sstevel@tonic-gate struct ad_private *ad = AUTH_PRIVATE(auth);
227*7c478bd9Sstevel@tonic-gate struct authdes_cred *cred = &ad->ad_cred;
228*7c478bd9Sstevel@tonic-gate struct authdes_verf *verf = &ad->ad_verf;
229*7c478bd9Sstevel@tonic-gate des_block cryptbuf[2];
230*7c478bd9Sstevel@tonic-gate des_block ivec;
231*7c478bd9Sstevel@tonic-gate int status;
232*7c478bd9Sstevel@tonic-gate int len;
233*7c478bd9Sstevel@tonic-gate int32_t *ixdr;
234*7c478bd9Sstevel@tonic-gate
235*7c478bd9Sstevel@tonic-gate /*
236*7c478bd9Sstevel@tonic-gate * Figure out the "time", accounting for any time difference
237*7c478bd9Sstevel@tonic-gate * with the server if necessary.
238*7c478bd9Sstevel@tonic-gate */
239*7c478bd9Sstevel@tonic-gate (void) gettimeofday(&ad->ad_timestamp, (struct timezone *)NULL);
240*7c478bd9Sstevel@tonic-gate ad->ad_timestamp.tv_sec += ad->ad_timediff.tv_sec;
241*7c478bd9Sstevel@tonic-gate ad->ad_timestamp.tv_usec += ad->ad_timediff.tv_usec;
242*7c478bd9Sstevel@tonic-gate if (ad->ad_timestamp.tv_usec >= MILLION) {
243*7c478bd9Sstevel@tonic-gate ad->ad_timestamp.tv_usec -= MILLION;
244*7c478bd9Sstevel@tonic-gate ad->ad_timestamp.tv_sec += 1;
245*7c478bd9Sstevel@tonic-gate }
246*7c478bd9Sstevel@tonic-gate
247*7c478bd9Sstevel@tonic-gate /*
248*7c478bd9Sstevel@tonic-gate * XDR the timestamp and possibly some other things, then
249*7c478bd9Sstevel@tonic-gate * encrypt them.
250*7c478bd9Sstevel@tonic-gate */
251*7c478bd9Sstevel@tonic-gate ixdr = (int32_t *)cryptbuf;
252*7c478bd9Sstevel@tonic-gate IXDR_PUT_INT32(ixdr, ad->ad_timestamp.tv_sec);
253*7c478bd9Sstevel@tonic-gate IXDR_PUT_INT32(ixdr, ad->ad_timestamp.tv_usec);
254*7c478bd9Sstevel@tonic-gate if (ad->ad_cred.adc_namekind == ADN_FULLNAME) {
255*7c478bd9Sstevel@tonic-gate IXDR_PUT_U_INT32(ixdr, ad->ad_window);
256*7c478bd9Sstevel@tonic-gate IXDR_PUT_U_INT32(ixdr, ad->ad_window - 1);
257*7c478bd9Sstevel@tonic-gate ivec.key.high = ivec.key.low = 0;
258*7c478bd9Sstevel@tonic-gate status = cbc_crypt((char *)&auth->ah_key, (char *)cryptbuf,
259*7c478bd9Sstevel@tonic-gate 2 * sizeof (des_block), DES_ENCRYPT, (char *)&ivec);
260*7c478bd9Sstevel@tonic-gate } else {
261*7c478bd9Sstevel@tonic-gate status = ecb_crypt((char *)&auth->ah_key, (char *)cryptbuf,
262*7c478bd9Sstevel@tonic-gate sizeof (des_block), DES_ENCRYPT);
263*7c478bd9Sstevel@tonic-gate }
264*7c478bd9Sstevel@tonic-gate if (DES_FAILED(status)) {
265*7c478bd9Sstevel@tonic-gate cmn_err(CE_NOTE, "authdes_marshal: DES encryption failure");
266*7c478bd9Sstevel@tonic-gate return (FALSE);
267*7c478bd9Sstevel@tonic-gate }
268*7c478bd9Sstevel@tonic-gate ad->ad_verf.adv_xtimestamp = cryptbuf[0];
269*7c478bd9Sstevel@tonic-gate if (ad->ad_cred.adc_namekind == ADN_FULLNAME) {
270*7c478bd9Sstevel@tonic-gate ad->ad_cred.adc_fullname.window = cryptbuf[1].key.high;
271*7c478bd9Sstevel@tonic-gate ad->ad_verf.adv_winverf = cryptbuf[1].key.low;
272*7c478bd9Sstevel@tonic-gate } else {
273*7c478bd9Sstevel@tonic-gate ad->ad_cred.adc_nickname = ad->ad_nickname;
274*7c478bd9Sstevel@tonic-gate ad->ad_verf.adv_winverf = 0;
275*7c478bd9Sstevel@tonic-gate }
276*7c478bd9Sstevel@tonic-gate
277*7c478bd9Sstevel@tonic-gate /*
278*7c478bd9Sstevel@tonic-gate * Serialize the credential and verifier into opaque
279*7c478bd9Sstevel@tonic-gate * authentication data.
280*7c478bd9Sstevel@tonic-gate */
281*7c478bd9Sstevel@tonic-gate if (ad->ad_cred.adc_namekind == ADN_FULLNAME) {
282*7c478bd9Sstevel@tonic-gate len = ((1 + 1 + 2 + 1) * BYTES_PER_XDR_UNIT +
283*7c478bd9Sstevel@tonic-gate ad->ad_fullnamelen);
284*7c478bd9Sstevel@tonic-gate } else
285*7c478bd9Sstevel@tonic-gate len = (1 + 1) * BYTES_PER_XDR_UNIT;
286*7c478bd9Sstevel@tonic-gate
287*7c478bd9Sstevel@tonic-gate if (ixdr = xdr_inline(xdrs, 2 * BYTES_PER_XDR_UNIT)) {
288*7c478bd9Sstevel@tonic-gate IXDR_PUT_INT32(ixdr, AUTH_DES);
289*7c478bd9Sstevel@tonic-gate IXDR_PUT_INT32(ixdr, len);
290*7c478bd9Sstevel@tonic-gate } else {
291*7c478bd9Sstevel@tonic-gate ATTEMPT(xdr_putint32(xdrs,
292*7c478bd9Sstevel@tonic-gate (int32_t *)&auth->ah_cred.oa_flavor));
293*7c478bd9Sstevel@tonic-gate ATTEMPT(xdr_putint32(xdrs, (int32_t *)&len));
294*7c478bd9Sstevel@tonic-gate }
295*7c478bd9Sstevel@tonic-gate ATTEMPT(xdr_authdes_cred(xdrs, cred));
296*7c478bd9Sstevel@tonic-gate
297*7c478bd9Sstevel@tonic-gate len = (2 + 1) * BYTES_PER_XDR_UNIT;
298*7c478bd9Sstevel@tonic-gate if (ixdr = xdr_inline(xdrs, 2 * BYTES_PER_XDR_UNIT)) {
299*7c478bd9Sstevel@tonic-gate IXDR_PUT_INT32(ixdr, AUTH_DES);
300*7c478bd9Sstevel@tonic-gate IXDR_PUT_INT32(ixdr, len);
301*7c478bd9Sstevel@tonic-gate } else {
302*7c478bd9Sstevel@tonic-gate ATTEMPT(xdr_putint32(xdrs,
303*7c478bd9Sstevel@tonic-gate (int32_t *)&auth->ah_verf.oa_flavor));
304*7c478bd9Sstevel@tonic-gate ATTEMPT(xdr_putint32(xdrs, (int32_t *)&len));
305*7c478bd9Sstevel@tonic-gate }
306*7c478bd9Sstevel@tonic-gate ATTEMPT(xdr_authdes_verf(xdrs, verf));
307*7c478bd9Sstevel@tonic-gate return (TRUE);
308*7c478bd9Sstevel@tonic-gate }
309*7c478bd9Sstevel@tonic-gate
310*7c478bd9Sstevel@tonic-gate /*
311*7c478bd9Sstevel@tonic-gate * 3. Validate
312*7c478bd9Sstevel@tonic-gate */
313*7c478bd9Sstevel@tonic-gate static bool_t
authdes_validate(AUTH * auth,struct opaque_auth * rverf)314*7c478bd9Sstevel@tonic-gate authdes_validate(AUTH *auth, struct opaque_auth *rverf)
315*7c478bd9Sstevel@tonic-gate {
316*7c478bd9Sstevel@tonic-gate /* LINTED pointer alignment */
317*7c478bd9Sstevel@tonic-gate struct ad_private *ad = AUTH_PRIVATE(auth);
318*7c478bd9Sstevel@tonic-gate struct authdes_verf verf;
319*7c478bd9Sstevel@tonic-gate int status;
320*7c478bd9Sstevel@tonic-gate uint32_t *ixdr;
321*7c478bd9Sstevel@tonic-gate des_block buf;
322*7c478bd9Sstevel@tonic-gate
323*7c478bd9Sstevel@tonic-gate if (rverf->oa_length != (2 + 1) * BYTES_PER_XDR_UNIT)
324*7c478bd9Sstevel@tonic-gate return (FALSE);
325*7c478bd9Sstevel@tonic-gate
326*7c478bd9Sstevel@tonic-gate /* LINTED pointer alignment */
327*7c478bd9Sstevel@tonic-gate ixdr = (uint32_t *)rverf->oa_base;
328*7c478bd9Sstevel@tonic-gate buf.key.high = (uint32_t)*ixdr++;
329*7c478bd9Sstevel@tonic-gate buf.key.low = (uint32_t)*ixdr++;
330*7c478bd9Sstevel@tonic-gate verf.adv_int_u = IXDR_GET_U_INT32(ixdr);
331*7c478bd9Sstevel@tonic-gate
332*7c478bd9Sstevel@tonic-gate /*
333*7c478bd9Sstevel@tonic-gate * Decrypt the timestamp
334*7c478bd9Sstevel@tonic-gate */
335*7c478bd9Sstevel@tonic-gate status = ecb_crypt((char *)&auth->ah_key, (char *)&buf,
336*7c478bd9Sstevel@tonic-gate sizeof (des_block), DES_DECRYPT);
337*7c478bd9Sstevel@tonic-gate
338*7c478bd9Sstevel@tonic-gate if (DES_FAILED(status)) {
339*7c478bd9Sstevel@tonic-gate cmn_err(CE_NOTE, "authdes_validate: DES decryption failure");
340*7c478bd9Sstevel@tonic-gate return (FALSE);
341*7c478bd9Sstevel@tonic-gate }
342*7c478bd9Sstevel@tonic-gate
343*7c478bd9Sstevel@tonic-gate /*
344*7c478bd9Sstevel@tonic-gate * xdr the decrypted timestamp
345*7c478bd9Sstevel@tonic-gate */
346*7c478bd9Sstevel@tonic-gate /* LINTED pointer alignment */
347*7c478bd9Sstevel@tonic-gate ixdr = (uint32_t *)buf.c;
348*7c478bd9Sstevel@tonic-gate verf.adv_timestamp.tv_sec = IXDR_GET_INT32(ixdr) + 1;
349*7c478bd9Sstevel@tonic-gate verf.adv_timestamp.tv_usec = IXDR_GET_INT32(ixdr);
350*7c478bd9Sstevel@tonic-gate
351*7c478bd9Sstevel@tonic-gate /*
352*7c478bd9Sstevel@tonic-gate * validate
353*7c478bd9Sstevel@tonic-gate */
354*7c478bd9Sstevel@tonic-gate if (bcmp((char *)&ad->ad_timestamp, (char *)&verf.adv_timestamp,
355*7c478bd9Sstevel@tonic-gate sizeof (struct timeval)) != 0) {
356*7c478bd9Sstevel@tonic-gate cmn_err(CE_NOTE, "authdes_validate: verifier mismatch");
357*7c478bd9Sstevel@tonic-gate return (FALSE);
358*7c478bd9Sstevel@tonic-gate }
359*7c478bd9Sstevel@tonic-gate
360*7c478bd9Sstevel@tonic-gate /*
361*7c478bd9Sstevel@tonic-gate * We have a nickname now, let's use it
362*7c478bd9Sstevel@tonic-gate */
363*7c478bd9Sstevel@tonic-gate ad->ad_nickname = verf.adv_nickname;
364*7c478bd9Sstevel@tonic-gate ad->ad_cred.adc_namekind = ADN_NICKNAME;
365*7c478bd9Sstevel@tonic-gate return (TRUE);
366*7c478bd9Sstevel@tonic-gate }
367*7c478bd9Sstevel@tonic-gate
368*7c478bd9Sstevel@tonic-gate /*
369*7c478bd9Sstevel@tonic-gate * 4. Refresh
370*7c478bd9Sstevel@tonic-gate *
371*7c478bd9Sstevel@tonic-gate * msg is a dummy argument here.
372*7c478bd9Sstevel@tonic-gate */
373*7c478bd9Sstevel@tonic-gate /* ARGSUSED */
374*7c478bd9Sstevel@tonic-gate static bool_t
authdes_refresh(AUTH * auth,struct rpc_msg * msg,cred_t * cr)375*7c478bd9Sstevel@tonic-gate authdes_refresh(AUTH *auth, struct rpc_msg *msg, cred_t *cr)
376*7c478bd9Sstevel@tonic-gate {
377*7c478bd9Sstevel@tonic-gate /* LINTED pointer alignment */
378*7c478bd9Sstevel@tonic-gate struct ad_private *ad = AUTH_PRIVATE(auth);
379*7c478bd9Sstevel@tonic-gate struct authdes_cred *cred = &ad->ad_cred;
380*7c478bd9Sstevel@tonic-gate enum clnt_stat stat;
381*7c478bd9Sstevel@tonic-gate
382*7c478bd9Sstevel@tonic-gate if (ad->ad_dosync &&
383*7c478bd9Sstevel@tonic-gate !synchronize(&ad->ad_synconfig, &ad->ad_syncaddr,
384*7c478bd9Sstevel@tonic-gate ad->ad_calltype, &ad->ad_timediff)) {
385*7c478bd9Sstevel@tonic-gate /*
386*7c478bd9Sstevel@tonic-gate * Hope the clocks are synced!
387*7c478bd9Sstevel@tonic-gate */
388*7c478bd9Sstevel@tonic-gate timerclear(&ad->ad_timediff);
389*7c478bd9Sstevel@tonic-gate cmn_err(CE_NOTE,
390*7c478bd9Sstevel@tonic-gate "authdes_refresh: unable to synchronize with server %s", ad->ad_servername);
391*7c478bd9Sstevel@tonic-gate }
392*7c478bd9Sstevel@tonic-gate ad->ad_xkey = auth->ah_key;
393*7c478bd9Sstevel@tonic-gate if ((stat = key_encryptsession(ad->ad_servername, &ad->ad_xkey, cr)) !=
394*7c478bd9Sstevel@tonic-gate RPC_SUCCESS) {
395*7c478bd9Sstevel@tonic-gate cmn_err(CE_NOTE,
396*7c478bd9Sstevel@tonic-gate "authdes_refresh: unable to encrypt conversation key for user (uid %d): "
397*7c478bd9Sstevel@tonic-gate "%s (error %d)",
398*7c478bd9Sstevel@tonic-gate (int)crgetuid(cr), clnt_sperrno(stat), stat);
399*7c478bd9Sstevel@tonic-gate return (FALSE);
400*7c478bd9Sstevel@tonic-gate }
401*7c478bd9Sstevel@tonic-gate cred->adc_fullname.key = ad->ad_xkey;
402*7c478bd9Sstevel@tonic-gate cred->adc_namekind = ADN_FULLNAME;
403*7c478bd9Sstevel@tonic-gate cred->adc_fullname.name = ad->ad_fullname;
404*7c478bd9Sstevel@tonic-gate return (TRUE);
405*7c478bd9Sstevel@tonic-gate }
406*7c478bd9Sstevel@tonic-gate
407*7c478bd9Sstevel@tonic-gate /*
408*7c478bd9Sstevel@tonic-gate * 5. Destroy
409*7c478bd9Sstevel@tonic-gate */
410*7c478bd9Sstevel@tonic-gate static void
authdes_destroy(AUTH * auth)411*7c478bd9Sstevel@tonic-gate authdes_destroy(AUTH *auth)
412*7c478bd9Sstevel@tonic-gate {
413*7c478bd9Sstevel@tonic-gate /* LINTED pointer alignment */
414*7c478bd9Sstevel@tonic-gate struct ad_private *ad = AUTH_PRIVATE(auth);
415*7c478bd9Sstevel@tonic-gate
416*7c478bd9Sstevel@tonic-gate FREE(ad->ad_fullname, ad->ad_fullnamelen + 1);
417*7c478bd9Sstevel@tonic-gate FREE(ad->ad_servername, ad->ad_servernamelen + 1);
418*7c478bd9Sstevel@tonic-gate FREE(ad, sizeof (struct ad_private));
419*7c478bd9Sstevel@tonic-gate FREE(auth, sizeof (AUTH));
420*7c478bd9Sstevel@tonic-gate }
421*7c478bd9Sstevel@tonic-gate
422*7c478bd9Sstevel@tonic-gate
423*7c478bd9Sstevel@tonic-gate /*
424*7c478bd9Sstevel@tonic-gate * Synchronize with the server at the given address, that is,
425*7c478bd9Sstevel@tonic-gate * adjust timep to reflect the delta between our clocks
426*7c478bd9Sstevel@tonic-gate */
427*7c478bd9Sstevel@tonic-gate static bool_t
synchronize(struct knetconfig * synconfig,struct netbuf * syncaddr,int calltype,struct timeval * timep)428*7c478bd9Sstevel@tonic-gate synchronize(struct knetconfig *synconfig, struct netbuf *syncaddr, int calltype,
429*7c478bd9Sstevel@tonic-gate struct timeval *timep)
430*7c478bd9Sstevel@tonic-gate {
431*7c478bd9Sstevel@tonic-gate struct timeval mytime;
432*7c478bd9Sstevel@tonic-gate struct timeval timout;
433*7c478bd9Sstevel@tonic-gate
434*7c478bd9Sstevel@tonic-gate timout.tv_sec = RTIME_TIMEOUT;
435*7c478bd9Sstevel@tonic-gate timout.tv_usec = 0;
436*7c478bd9Sstevel@tonic-gate if (rtime(synconfig, syncaddr, calltype, timep, &timout) < 0)
437*7c478bd9Sstevel@tonic-gate return (FALSE);
438*7c478bd9Sstevel@tonic-gate (void) gettimeofday(&mytime, (struct timezone *)NULL);
439*7c478bd9Sstevel@tonic-gate timep->tv_sec -= mytime.tv_sec;
440*7c478bd9Sstevel@tonic-gate if (mytime.tv_usec > timep->tv_usec) {
441*7c478bd9Sstevel@tonic-gate timep->tv_sec -= 1;
442*7c478bd9Sstevel@tonic-gate timep->tv_usec += MILLION;
443*7c478bd9Sstevel@tonic-gate }
444*7c478bd9Sstevel@tonic-gate timep->tv_usec -= mytime.tv_usec;
445*7c478bd9Sstevel@tonic-gate return (TRUE);
446*7c478bd9Sstevel@tonic-gate }
447*7c478bd9Sstevel@tonic-gate
448*7c478bd9Sstevel@tonic-gate static struct auth_ops *
authdes_ops(void)449*7c478bd9Sstevel@tonic-gate authdes_ops(void)
450*7c478bd9Sstevel@tonic-gate {
451*7c478bd9Sstevel@tonic-gate static struct auth_ops ops;
452*7c478bd9Sstevel@tonic-gate
453*7c478bd9Sstevel@tonic-gate mutex_enter(&authdes_ops_lock);
454*7c478bd9Sstevel@tonic-gate if (ops.ah_nextverf == NULL) {
455*7c478bd9Sstevel@tonic-gate ops.ah_nextverf = authdes_nextverf;
456*7c478bd9Sstevel@tonic-gate ops.ah_marshal = authdes_marshal;
457*7c478bd9Sstevel@tonic-gate ops.ah_validate = authdes_validate;
458*7c478bd9Sstevel@tonic-gate ops.ah_refresh = authdes_refresh;
459*7c478bd9Sstevel@tonic-gate ops.ah_destroy = authdes_destroy;
460*7c478bd9Sstevel@tonic-gate ops.ah_wrap = authany_wrap;
461*7c478bd9Sstevel@tonic-gate ops.ah_unwrap = authany_unwrap;
462*7c478bd9Sstevel@tonic-gate }
463*7c478bd9Sstevel@tonic-gate mutex_exit(&authdes_ops_lock);
464*7c478bd9Sstevel@tonic-gate return (&ops);
465*7c478bd9Sstevel@tonic-gate }
466