Major overhaul. Now uses DSA signatures rather than the bogus symmetric

[become] / src / check.c

/* -*-c-*-
 *
 * $Id: check.c,v 1.11 2003/10/12 00:14:55 mdw Exp $
 *
 * Check validity of requests
 *
 * (c) 1998 EBI
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of `become'
 *
 * `Become' is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * `Become' is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with `become'; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/*----- Revision history --------------------------------------------------*
 *
 * $Log: check.c,v $
 * Revision 1.11  2003/10/12 00:14:55  mdw
 * Major overhaul.  Now uses DSA signatures rather than the bogus symmetric
 * encrypt-and-hope thing.  Integrated with mLib and Catacomb.
 *
 * Revision 1.10  1999/05/04 16:17:12  mdw
 * Change to header file name for parser.  See log for `parse.h' for
 * details.
 *
 * Revision 1.9  1998/06/19  13:48:16  mdw
 * Set close-on-exec flag for UDP socket.
 *
 * Revision 1.8  1998/06/18 15:10:44  mdw
 * SECURITY HOLE: the file descriptor for the secret key was left open and
 * inherited by the target process.  This is now fixed.  Also set
 * close-on-exec flags on key file, close config file carefully, and close
 * UDP socket after receiving reply from server.
 *
 * Revision 1.7  1998/04/23 13:22:08  mdw
 * Support no-network configuration option, and new interface to
 * configuration file parser.
 *
 * Revision 1.6  1998/01/12 16:45:47  mdw
 * Fix copyright date.
 *
 * Revision 1.5  1997/09/26 09:14:58  mdw
 * Merged blowfish branch into trunk.
 *
 * Revision 1.4.2.1  1997/09/26 09:08:01  mdw
 * Use the Blowfish encryption algorithm instead of IDEA.  This is partly
 * because I prefer Blowfish (without any particularly strong evidence) but
 * mainly because IDEA is patented and Blowfish isn't.
 *
 * Revision 1.4  1997/08/07 09:52:05  mdw
 * (Log entry for previous version is bogus.)  Added support for multiple
 * servers.
 *
 * Revision 1.2  1997/08/04 10:24:20  mdw
 * Sources placed under CVS control.
 *
 * Revision 1.1  1997/07/21  13:47:53  mdw
 * Initial revision
 *
 */

/*----- Header files ------------------------------------------------------*/

/* --- ANSI headers --- */

#include <ctype.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

/* --- Unix headers --- */

#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <fcntl.h>
#include <netdb.h>
#include <unistd.h>

/* --- mLib headers --- */

#include <mLib/alloc.h>
#include <mLib/quis.h>
#include <mLib/report.h>
#include <mLib/sym.h>
#include <mLib/trace.h>

/* --- Catacomb headers --- */

#include <catacomb/buf.h>
#include <catacomb/dsa.h>
#include <catacomb/key.h>
#include <catacomb/mp.h>
#include <catacomb/noise.h>
#include <catacomb/rand.h>
#include <catacomb/sha.h>

/* --- Local headers --- */

#include "become.h"
#include "config.h"
#include "lexer.h"
#include "name.h"
#include "netg.h"
#include "rule.h"
#include "parse.h"
#include "userdb.h"

/*----- Client-end network support ----------------------------------------*/

#ifndef NONETWORK

/* --- @check__send@ --- *
 *
 * Arguments:	@char *buf@ = pointer to encrypted request
 *		@size_t sz@ = size of request
 *		@int fd@ = socket to send from
 *		@struct sockaddr_in *serv@ = pointer to table of servers
 *		@size_t n_serv@ = number of servers
 *
 * Returns:	---
 *
 * Use:		Sends the request packet to the list of servers.  If the
 *		message couldn't be sent to any of them, an error is
 *		reported.
 */

static void check__send(char *buf, size_t sz, int fd,
			struct sockaddr_in *serv, size_t n_serv)
{
  size_t i;
  int ok = 0;
  int err = 0;

  for (i = 0; i < n_serv; i++) {
    if (sendto(fd, buf, sz, 0,
	       (struct sockaddr *)(serv + i), sizeof(serv[i])) < 0) {
      T( trace(TRACE_CLIENT, "client: send to %s failed: %s",
	       inet_ntoa(serv[i].sin_addr), strerror(errno)); )
      err = errno;
    } else
      ok = 1;
  }

  if (!ok)
    die(1, "couldn't send request to server: %s", strerror(err));
}

/* --- @check__ask@ --- *
 *
 * Arguments:	@request *rq@ = pointer to request buffer
 *		@struct sockaddr_in *serv@ = pointer to table of servers
 *		@size_t n_serv@ = number of servers
 *
 * Returns:	Nonzero if OK, zero if forbidden
 *
 * Use:		Contacts a number of servers to decide whether the request
 *		is OK.
 */

static int check__ask(request *rq, struct sockaddr_in *serv, size_t n_serv)
{
  static int tbl[] = { 0, 5, 10, 20, -1 };

  char buff[2048], rbuff[2048];
  size_t rqlen;
  octet hmsg[SHA_HASHSZ];
  octet h[SHA_HASHSZ];
  key_packstruct kps[DSA_PUBFETCHSZ];
  key_packdef *kp;
  dsa_pub kpub;
  buf b;
  sha_ctx hc;
  int fd;
  struct sockaddr_in sin;
  socklen_t slen;
  ssize_t sz;
  int ans;
  fd_set fds;
  struct timeval start, now, tv;
  mp *m, *r, *s;
  key_file f;
  key *k;
  key_iter ki;
  int ind;
  size_t i;

  /* --- Open the public keyring --- */

  if ((key_open(&f, file_PUBKEY, KOPEN_READ, key_moan, 0)) != 0)
    die(1, "couldn't open public keyring");
  kp = key_fetchinit(dsa_pubfetch, kps, &kpub);

  /* --- Build the request packet --- */

  rand_noisesrc(RAND_GLOBAL, &noise_source);
  rand_seed(RAND_GLOBAL, 160);
  buf_init(&b, buff, sizeof(buff));
  rand_get(RAND_GLOBAL, buf_get(&b, SHA_HASHSZ), SHA_HASHSZ);
  buf_putu32(&b, rq->from);
  buf_putu32(&b, rq->to);
  buf_putu16(&b, strlen(rq->cmd));
  buf_put(&b, rq->cmd, strlen(rq->cmd));
  rqlen = BLEN(&b);
  sha_init(&hc);
  sha_hash(&hc, buff, rqlen);
  sha_done(&hc, hmsg);

  /* --- Create my socket --- */

  if ((fd = socket(PF_INET, SOCK_DGRAM, 0)) < 0)
    die(1, "couldn't create socket: %s", strerror(errno));
  if (fcntl(fd, F_SETFD, 1) < 0)
    die(1, "couldn't set close-on-exec flag for socket: %s", strerror(errno));

  /* --- Bind myself to some address --- */

  sin.sin_family = AF_INET;
  sin.sin_port = 0;
  sin.sin_addr.s_addr = htonl(INADDR_ANY);

  if (bind(fd, (struct sockaddr *)&sin, sizeof(sin)) < 0)
    die(1, "couldn't bind socket to address: %s", strerror(errno));

  /* --- Find out when we are --- */

  gettimeofday(&start, 0);
  ind = 0;

  /* --- Now loop until everything's done --- */

  for (;;) {
    gettimeofday(&now, 0);

    /* --- If the current timer has expired, find one that hasn't --- *
     *
     * Also resend the request after I've found a timer which is still
     * extant.  If there aren't any, report an error.
     */

    if (now.tv_sec >= start.tv_sec + tbl[ind] &&
	now.tv_usec >= start.tv_usec) {
      do {
	ind++;
	if (tbl[ind] < 0)
	  die(1, "no reply from servers");
      } while (now.tv_sec >= start.tv_sec + tbl[ind] &&
	       now.tv_usec >= start.tv_usec);
      check__send(buff, rqlen, fd, serv, n_serv);
      T( trace(TRACE_CLIENT, "client: send request to servers"); )
    }

    /* --- Now wait for a packet to arrive --- */

    if (now.tv_usec > start.tv_usec) {
      now.tv_usec -= 1000000;
      now.tv_sec += 1;
    }
    tv.tv_sec = start.tv_sec + tbl[ind] - now.tv_sec;
    tv.tv_usec = start.tv_usec - now.tv_usec;

    /* --- Sort out file descriptors to watch --- */

    FD_ZERO(&fds);
    FD_SET(fd, &fds);

    /* --- Wait for them --- */

    i = select(FD_SETSIZE, &fds, 0, 0, &tv);
    if (i == 0 || (i < 0 && errno == EINTR))
      continue;
    if (i < 0)
      die(1, "error waiting for reply: %s", strerror(errno));

    /* --- Read the reply data --- */

    slen = sizeof(sin);
    if ((sz = recvfrom(fd, (char *)rbuff, sizeof(rbuff), 0,
		       (struct sockaddr *)&sin, &slen)) < 0)
      die(1, "error reading server's reply: %s", strerror(errno));

    IF_TRACING(TRACE_CLIENT, {
      struct hostent *h = gethostbyaddr((char *)&sin.sin_addr,
					sizeof(sin.sin_addr), AF_INET);
      trace(TRACE_CLIENT, "client: reply received from %s port %i",
	    h ? h->h_name : inet_ntoa(sin.sin_addr),
	    ntohs(sin.sin_port));
    })

    /* --- Verify the sender --- *
     *
     * This is more to avoid confusion than for security: an active
     * attacker is quite capable of forging the source address.  We rely
     * on the signature in the reply packet for authentication.
     */

    for (i = 0; i < n_serv; i++) {
      if (sin.sin_addr.s_addr == serv[i].sin_addr.s_addr &&
	  sin.sin_port == serv[i].sin_port)
	break;
    }
    if (i >= n_serv) {
      T( trace(TRACE_CLIENT, "client: reply from unknown host"); )
      continue;
    }

    /* --- Unpack and verify the response --- */

    buf_init(&b, rbuff, sz);
    if (buf_ensure(&b, sizeof(hmsg))) goto bad;
    if (memcmp(BCUR(&b), hmsg, sizeof(hmsg)) != 0) goto bad;
    BSTEP(&b, sizeof(hmsg));
    if ((ans = buf_getbyte(&b)) < 0) goto bad;

    sha_init(&hc);
    sha_hash(&hc, BBASE(&b), BLEN(&b));
    sha_done(&hc, h);
    if ((r = buf_getmp(&b)) == 0 || (s = buf_getmp(&b)) == 0) goto bad;
    m = mp_loadb(MP_NEW, h, sizeof(h));

    key_mkiter(&ki, &f);
    while ((k = key_next(&ki)) != 0) {
      if (key_expired(k)) continue;
      if (strcmp(k->type, "become-dsa") != 0) continue;
      if (key_fetch(kp, k)) continue;
      i = dsa_vrfy(&kpub.dp, kpub.y, m, r, s);
      dsa_pubfree(&kpub);
      if (i) {
	key_fetchdone(kp);
	key_close(&f);
	close(fd);
	mp_drop(m);
	mp_drop(r);
	mp_drop(s);
	return (ans);
      }
    }
    
  bad:
    T( trace(TRACE_CLIENT,
	     "client: invalid or corrupt reply packet"); )
  }

  die(1, "internal error: can't get here in check__ask");
  return (0);
}

/* --- @check__client@ --- *
 *
 * Arguments:	@request *rq@ = pointer to a request block
 *		@FILE *fp@ = file containing server configuration
 *
 * Returns:	Nonzero if OK, zero if forbidden
 *
 * Use:		Asks one or several servers whether a request is acceptable.
 */

int check__client(request *rq, FILE *fp)
{
  /* --- Format of the file --- *
   *
   * The `servers' file contains entries of the form
   *
   *    %%\syntax{<host> [`:' <port>]}%%
   *
   * separates by whitespace.  I build them all into an array of socket
   * addresses and pass the whole lot to another function.
   */

  struct sockaddr_in *serv;		/* Array of servers */
  size_t n_serv, max_serv;		/* Number and maximum number */

  /* --- Initialise the server array --- */

  T( trace(TRACE_CLIENT, "client: reading server definitions"); )
  n_serv = 0; max_serv = 4;		/* Four seems reasonable */
  serv = xmalloc(sizeof(*serv) * max_serv);

  /* --- Start reading the file --- */

  {
    char buff[256], *p, *l;		/* A buffer and pointers for it */
    int port;				/* Default port for servers */
    int state;				/* Current parser state */
    struct in_addr t_host;		/* Temp place for an address*/
    int t_port;				/* Temp place for a port */
    int ch;				/* The current character */

    /* --- Parser states --- */

    enum {
      st_start,				/* Waiting to begin */
      st_host,				/* Reading a new hostname */
      st_colon,				/* Expecting a colon, maybe */
      st_preport,			/* Waiting before reading port */
      st_port,				/* Reading a port number */
      st_commit,			/* Commit a newly read server */
      st_done				/* Finished reading the file */
    };

    /* --- Find a default port --- */

    {
      struct servent *s = getservbyname(quis(), "udp");
      port = (s ? s->s_port : -1);
    }

    /* --- Initialise for scanning the file --- */

    state = st_host;
    p = buff;
    l = buff + sizeof(buff);
    t_port = port;
    ch = getc(fp);

    /* --- Go for it --- */

    while (state != st_done) {
      switch (state) {

	/* --- Initial whitespace before hostname --- */

	case st_start:
	  if (ch == EOF)
	    state = st_done;
	  else if (isspace((unsigned char)ch))
	    ch = getc(fp);
	  else
	    state = st_host;
	  break;

	/* --- Read a host name --- */

	case st_host:
	  if (p == l)
	    die(1, "string too long in `" file_SERVER "'");
	  if (ch != EOF && !isspace((unsigned char)ch) && ch != ':') {
	    *p++ = ch;
	    ch = getc(fp);
	  } else {
	    struct hostent *h;

	    *p++ = 0;
	    if ((h = gethostbyname(buff)) == 0)
	      die(1, "unknown host `%s' in `" file_SERVER "'", buff);
	    memcpy(&t_host, h->h_addr, sizeof(t_host));
	    state = st_colon;
	  }
	  break;

	/* --- Waiting for a colon coming up --- */

	case st_colon:
	  if (ch == EOF)
	    state = st_commit;
	  else if (isspace((unsigned char)ch))
	    ch = getc(fp);
	  else if (ch == ':') {
	    state = st_preport;
	    ch = getc(fp);
	  }
	  else
	    state = st_commit;
	  break;

	/* --- Clearing whitespace before a port number --- */

	case st_preport:
	  if (ch == EOF)
	    state = st_commit;
	  else if (isspace((unsigned char)ch))
	    ch = getc(fp);
	  else {
	    state = st_port;
	    p = buff;
	  }
	  break;

	/* --- Read a port number --- */

	case st_port:
	  if (p == l)
	    die(1, "string too long in `" file_SERVER "'");
	  if (ch != EOF && !isspace((unsigned char)ch) && ch != ':') {
	    *p++ = ch;
	    ch = getc(fp);
	  } else {
	    struct servent *s;

	    *p++ = 0;
	    s = getservbyname(buff, "udp");
	    if (!s && isdigit((unsigned char)buff[0]))
	      t_port = htons(atoi(buff));
	    else if (!s)
	      die(1, "unknown service `%s' in `" file_SERVER "'", buff);
	    else
	      t_port = s->s_port;
	    state = st_commit;
	  }
	  break;

	/* --- A server has been read successfully --- */

	case st_commit:
	  if (n_serv == max_serv) {
	    max_serv *= 2;
	    serv = xrealloc(serv, n_serv * sizeof(*serv),
			    max_serv * sizeof(*serv));
	  }
	  serv[n_serv].sin_family = AF_INET;
	  serv[n_serv].sin_addr = t_host;
	  serv[n_serv].sin_port = t_port;
	  n_serv++;
	  state = st_start;
	  p = buff;
	  t_port = port;
	  break;

	/* --- A safety net for a broken parser --- */

	default:
	  die(1, "internal error: can't get here in check__client");
	  break;	  
      }
    }
  }

  fclose(fp);

  /* --- Now start sending requests --- */

  if (!n_serv)
    die(1, "no servers specified in `" file_SERVER "'");

  IF_TRACING(TRACE_CLIENT, {
    size_t i;

    for (i = 0; i < n_serv; i++) {
      trace(TRACE_CLIENT, "client: server %s port %i",
	    inet_ntoa(serv[i].sin_addr), ntohs(serv[i].sin_port));
    }
  })
  return (check__ask(rq, serv, n_serv));
}

#endif

/*----- Main checking function --------------------------------------------*/

/* --- @check@ --- *
 *
 * Arguments:	@request *rq@ = pointer to request buffer
 *
 * Returns:	Nonzero if OK, zero if forbidden
 *
 * Use:		Checks to see if the request is acceptable.
 */

int check(request *rq)
{
  FILE *fp;

  /* --- Check if we need to talk to a server --- */

#ifndef NONETWORK
  if ((fp = fopen(file_SERVER, "r")) != 0)
    return (check__client(rq, fp));
#endif

  /* --- Otherwise do this all the old-fashioned way --- */

  if ((fp = fopen(file_RULES, "r")) == 0) {
    die(1, "couldn't read configuration file `%s': %s",
	file_RULES, strerror(errno));
  }

  userdb_init();
  userdb_local();
  userdb_yp();
  netg_init();
  name_init();
  rule_init();
  lexer_scan(fp);
  parse();
  fclose(fp);

  return (rule_check(rq));
}

/*----- That's all, folks -------------------------------------------------*/