17c478bd9Sstevel@tonic-gate /* 2cc35afbcSMark Phalan * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved. 37c478bd9Sstevel@tonic-gate */ 47c478bd9Sstevel@tonic-gate 5ba7b222eSGlenn Barry #include "mglueP.h" 6*5e01956fSGlenn Barry #include "gssapiP_generic.h" 77c478bd9Sstevel@tonic-gate #include <stdio.h> 8ba7b222eSGlenn Barry #ifdef HAVE_STDLIB_H 97c478bd9Sstevel@tonic-gate #include <stdlib.h> 10ba7b222eSGlenn Barry #endif 11ba7b222eSGlenn Barry #include <string.h> 127c478bd9Sstevel@tonic-gate #include <errno.h> 137c478bd9Sstevel@tonic-gate 14ba7b222eSGlenn Barry #include "k5-platform-store_32.h" 15ba7b222eSGlenn Barry #include "k5-platform-store_16.h" 16ba7b222eSGlenn Barry /* 17ba7b222eSGlenn Barry * SUNW17PACresync 18ba7b222eSGlenn Barry * MIT has diff names for these GSS utilities. Solaris needs to change 19ba7b222eSGlenn Barry * them globally to get in sync w/MIT. 20ba7b222eSGlenn Barry * Revisit for full 1.7 resync. 21ba7b222eSGlenn Barry */ 22ba7b222eSGlenn Barry #define gssint_get_modOptions __gss_get_modOptions 23ba7b222eSGlenn Barry #define gssint_der_length_size der_length_size 24ba7b222eSGlenn Barry #define gssint_get_der_length get_der_length 25ba7b222eSGlenn Barry #define gssint_put_der_length put_der_length 26ba7b222eSGlenn Barry #define gssint_get_mechanism __gss_get_mechanism 27ba7b222eSGlenn Barry #define gssint_get_mechanism_cred __gss_get_mechanism_cred 28ba7b222eSGlenn Barry #define gssint_copy_oid_set gss_copy_oid_set 29ba7b222eSGlenn Barry #define gssint_get_mech_type __gss_get_mech_type 30ba7b222eSGlenn Barry #define gssint_export_internal_name __gss_export_internal_name 31ba7b222eSGlenn Barry #define gssint_release_internal_name __gss_release_internal_name 32ba7b222eSGlenn Barry #define gssint_convert_name_to_union_name __gss_convert_name_to_union_name 33ba7b222eSGlenn Barry #define gssint_import_internal_name __gss_import_internal_name 34ba7b222eSGlenn Barry #define gssint_display_internal_name __gss_display_internal_name 35ba7b222eSGlenn Barry 36ba7b222eSGlenn Barry 377c478bd9Sstevel@tonic-gate #define MSO_BIT (8*(sizeof (int) - 1)) /* Most significant octet bit */ 387c478bd9Sstevel@tonic-gate 39ba7b222eSGlenn Barry extern gss_mechanism *gssint_mechs_array; 40ba7b222eSGlenn Barry 417c478bd9Sstevel@tonic-gate /* 427c478bd9Sstevel@tonic-gate * This file contains the support routines for the glue layer. 437c478bd9Sstevel@tonic-gate */ 447c478bd9Sstevel@tonic-gate 457c478bd9Sstevel@tonic-gate /* 467c478bd9Sstevel@tonic-gate * get_der_length: Givin a pointer to a buffer that contains a DER encoded 477c478bd9Sstevel@tonic-gate * length, decode the length updating the buffer to point to the character 487c478bd9Sstevel@tonic-gate * after the DER encoding. The parameter bytes will point to the number of 497c478bd9Sstevel@tonic-gate * bytes that made up the DER encoding of the length originally pointed to 507c478bd9Sstevel@tonic-gate * by the buffer. Note we return -1 on error. 517c478bd9Sstevel@tonic-gate */ 527c478bd9Sstevel@tonic-gate int 53ba7b222eSGlenn Barry gssint_get_der_length(unsigned char **buf, unsigned int buf_len, unsigned int *bytes) 547c478bd9Sstevel@tonic-gate { 55ba7b222eSGlenn Barry /* p points to the beginning of the buffer */ 56ba7b222eSGlenn Barry unsigned char *p = *buf; 57ba7b222eSGlenn Barry int length, new_length; 58ba7b222eSGlenn Barry unsigned int octets; 59ba7b222eSGlenn Barry 60ba7b222eSGlenn Barry if (buf_len < 1) 61ba7b222eSGlenn Barry return (-1); 62ba7b222eSGlenn Barry 63ba7b222eSGlenn Barry /* We should have at least one byte */ 64ba7b222eSGlenn Barry *bytes = 1; 65ba7b222eSGlenn Barry 66ba7b222eSGlenn Barry /* 67ba7b222eSGlenn Barry * If the High order bit is not set then the length is just the value 68ba7b222eSGlenn Barry * of *p. 69ba7b222eSGlenn Barry */ 70ba7b222eSGlenn Barry if (*p < 128) { 71ba7b222eSGlenn Barry *buf = p+1; /* Advance the buffer */ 727c478bd9Sstevel@tonic-gate return (*p); /* return the length */ 73ba7b222eSGlenn Barry } 74ba7b222eSGlenn Barry 75ba7b222eSGlenn Barry /* 76ba7b222eSGlenn Barry * if the High order bit is set, then the low order bits represent 77ba7b222eSGlenn Barry * the number of bytes that contain the DER encoding of the length. 78ba7b222eSGlenn Barry */ 79ba7b222eSGlenn Barry 80ba7b222eSGlenn Barry octets = *p++ & 0x7f; 81ba7b222eSGlenn Barry *bytes += octets; 82ba7b222eSGlenn Barry 83ba7b222eSGlenn Barry /* See if the supplied buffer contains enough bytes for the length. */ 84ba7b222eSGlenn Barry if (octets > buf_len - 1) 85ba7b222eSGlenn Barry return (-1); 86ba7b222eSGlenn Barry 87ba7b222eSGlenn Barry /* 88ba7b222eSGlenn Barry * Calculate a multibyte length. The length is encoded as an 89ba7b222eSGlenn Barry * unsigned integer base 256. 90ba7b222eSGlenn Barry */ 91ba7b222eSGlenn Barry for (length = 0; octets; octets--) { 92ba7b222eSGlenn Barry new_length = (length << 8) + *p++; 93ba7b222eSGlenn Barry if (new_length < length) /* overflow */ 94ba7b222eSGlenn Barry return (-1); 95ba7b222eSGlenn Barry length = new_length; 96ba7b222eSGlenn Barry } 97ba7b222eSGlenn Barry 98ba7b222eSGlenn Barry *buf = p; /* Advance the buffer */ 99ba7b222eSGlenn Barry 100ba7b222eSGlenn Barry return (length); 1017c478bd9Sstevel@tonic-gate } 1027c478bd9Sstevel@tonic-gate 1037c478bd9Sstevel@tonic-gate /* 1047c478bd9Sstevel@tonic-gate * der_length_size: Return the number of bytes to encode a given length. 1057c478bd9Sstevel@tonic-gate */ 1067c478bd9Sstevel@tonic-gate unsigned int 107ba7b222eSGlenn Barry gssint_der_length_size(unsigned int len) 1087c478bd9Sstevel@tonic-gate { 109ba7b222eSGlenn Barry int i; 1107c478bd9Sstevel@tonic-gate 111ba7b222eSGlenn Barry if (len < 128) 112ba7b222eSGlenn Barry return (1); 1137c478bd9Sstevel@tonic-gate 114ba7b222eSGlenn Barry for (i = 0; len; i++) { 115ba7b222eSGlenn Barry len >>= 8; 116ba7b222eSGlenn Barry } 1177c478bd9Sstevel@tonic-gate 118ba7b222eSGlenn Barry return (i+1); 1197c478bd9Sstevel@tonic-gate } 1207c478bd9Sstevel@tonic-gate 1217c478bd9Sstevel@tonic-gate /* 1227c478bd9Sstevel@tonic-gate * put_der_length: Encode the supplied length into the buffer pointed to 1237c478bd9Sstevel@tonic-gate * by buf. max_length represents the maximum length of the buffer pointed 1247c478bd9Sstevel@tonic-gate * to by buff. We will advance buf to point to the character after the newly 1257c478bd9Sstevel@tonic-gate * DER encoded length. We return 0 on success or -l it the length cannot 1267c478bd9Sstevel@tonic-gate * be encoded in max_len characters. 1277c478bd9Sstevel@tonic-gate */ 1287c478bd9Sstevel@tonic-gate int 129ba7b222eSGlenn Barry gssint_put_der_length(unsigned int length, unsigned char **buf, unsigned int max_len) 1307c478bd9Sstevel@tonic-gate { 131ba7b222eSGlenn Barry unsigned char *s, *p; 132ba7b222eSGlenn Barry unsigned int buf_len = 0; 133ba7b222eSGlenn Barry int i, first; 1347c478bd9Sstevel@tonic-gate 135ba7b222eSGlenn Barry /* Oops */ 136ba7b222eSGlenn Barry if (buf == 0 || max_len < 1) 137ba7b222eSGlenn Barry return (-1); 1387c478bd9Sstevel@tonic-gate 139ba7b222eSGlenn Barry s = *buf; 1407c478bd9Sstevel@tonic-gate 141ba7b222eSGlenn Barry /* Single byte is the length */ 142ba7b222eSGlenn Barry if (length < 128) { 143ba7b222eSGlenn Barry *s++ = length; 144ba7b222eSGlenn Barry *buf = s; 1457c478bd9Sstevel@tonic-gate return (0); 146ba7b222eSGlenn Barry } 147ba7b222eSGlenn Barry 148ba7b222eSGlenn Barry /* First byte contains the number of octets */ 149ba7b222eSGlenn Barry p = s + 1; 150ba7b222eSGlenn Barry 151ba7b222eSGlenn Barry /* Running total of the DER encoding length */ 152ba7b222eSGlenn Barry buf_len = 0; 153ba7b222eSGlenn Barry 154ba7b222eSGlenn Barry /* 155ba7b222eSGlenn Barry * Encode MSB first. We do the encoding by setting a shift 156ba7b222eSGlenn Barry * factor to MSO_BIT (24 for 32 bit words) and then shifting the length 157ba7b222eSGlenn Barry * by the factor. We then encode the resulting low order byte. 158ba7b222eSGlenn Barry * We subtract 8 from the shift factor and repeat to ecnode the next 159ba7b222eSGlenn Barry * byte. We stop when the shift factor is zero or we've run out of 160ba7b222eSGlenn Barry * buffer to encode into. 161ba7b222eSGlenn Barry */ 162ba7b222eSGlenn Barry first = 0; 163ba7b222eSGlenn Barry for (i = MSO_BIT; i >= 0 && buf_len <= max_len; i -= 8) { 164ba7b222eSGlenn Barry unsigned int v; 165ba7b222eSGlenn Barry v = (length >> i) & 0xff; 166ba7b222eSGlenn Barry if ((v) || first) { 167ba7b222eSGlenn Barry buf_len += 1; 168ba7b222eSGlenn Barry *p++ = v; 169ba7b222eSGlenn Barry first = 1; 170ba7b222eSGlenn Barry } 171ba7b222eSGlenn Barry } 172ba7b222eSGlenn Barry if (i >= 0) /* buffer overflow */ 173ba7b222eSGlenn Barry return (-1); 174ba7b222eSGlenn Barry 175ba7b222eSGlenn Barry /* 176ba7b222eSGlenn Barry * We go back now and set the first byte to be the length with 177ba7b222eSGlenn Barry * the high order bit set. 178ba7b222eSGlenn Barry */ 179ba7b222eSGlenn Barry *s = buf_len | 0x80; 180ba7b222eSGlenn Barry *buf = p; 181ba7b222eSGlenn Barry 182ba7b222eSGlenn Barry return (0); 1837c478bd9Sstevel@tonic-gate } 1847c478bd9Sstevel@tonic-gate 1857c478bd9Sstevel@tonic-gate 1867c478bd9Sstevel@tonic-gate /* 1877c478bd9Sstevel@tonic-gate * glue routine for get_mech_type 1887c478bd9Sstevel@tonic-gate * 1897c478bd9Sstevel@tonic-gate */ 1907c478bd9Sstevel@tonic-gate 191ba7b222eSGlenn Barry OM_uint32 gssint_get_mech_type_oid(OID, token) 192ba7b222eSGlenn Barry gss_OID OID; 193ba7b222eSGlenn Barry gss_buffer_t token; 194ba7b222eSGlenn Barry { 195ba7b222eSGlenn Barry unsigned char * buffer_ptr; 196ba7b222eSGlenn Barry int length; 197ba7b222eSGlenn Barry 198ba7b222eSGlenn Barry /* 199ba7b222eSGlenn Barry * This routine reads the prefix of "token" in order to determine 200ba7b222eSGlenn Barry * its mechanism type. It assumes the encoding suggested in 201ba7b222eSGlenn Barry * Appendix B of RFC 1508. This format starts out as follows : 202ba7b222eSGlenn Barry * 203ba7b222eSGlenn Barry * tag for APPLICATION 0, Sequence[constructed, definite length] 204ba7b222eSGlenn Barry * length of remainder of token 205ba7b222eSGlenn Barry * tag of OBJECT IDENTIFIER 206ba7b222eSGlenn Barry * length of mechanism OID 207ba7b222eSGlenn Barry * encoding of mechanism OID 208ba7b222eSGlenn Barry * <the rest of the token> 209ba7b222eSGlenn Barry * 210ba7b222eSGlenn Barry * Numerically, this looks like : 211ba7b222eSGlenn Barry * 212ba7b222eSGlenn Barry * 0x60 213ba7b222eSGlenn Barry * <length> - could be multiple bytes 214ba7b222eSGlenn Barry * 0x06 215ba7b222eSGlenn Barry * <length> - assume only one byte, hence OID length < 127 216ba7b222eSGlenn Barry * <mech OID bytes> 217ba7b222eSGlenn Barry * 218ba7b222eSGlenn Barry * The routine fills in the OID value and returns an error as necessary. 219ba7b222eSGlenn Barry */ 220ba7b222eSGlenn Barry 2217c478bd9Sstevel@tonic-gate if (OID == NULL) 2227c478bd9Sstevel@tonic-gate return (GSS_S_CALL_INACCESSIBLE_WRITE); 2237c478bd9Sstevel@tonic-gate 2247c478bd9Sstevel@tonic-gate if ((token == NULL) || (token->value == NULL)) 225ba7b222eSGlenn Barry return (GSS_S_DEFECTIVE_TOKEN); 226ba7b222eSGlenn Barry 227ba7b222eSGlenn Barry /* Skip past the APP/Sequnce byte and the token length */ 228ba7b222eSGlenn Barry 229ba7b222eSGlenn Barry buffer_ptr = (unsigned char *) token->value; 2307c478bd9Sstevel@tonic-gate 231ba7b222eSGlenn Barry if (*(buffer_ptr++) != 0x60) 232ba7b222eSGlenn Barry return (GSS_S_DEFECTIVE_TOKEN); 233ba7b222eSGlenn Barry length = *buffer_ptr++; 2347c478bd9Sstevel@tonic-gate 2357c478bd9Sstevel@tonic-gate /* check if token length is null */ 2367c478bd9Sstevel@tonic-gate if (length == 0) 2377c478bd9Sstevel@tonic-gate return (GSS_S_DEFECTIVE_TOKEN); 2387c478bd9Sstevel@tonic-gate 239ba7b222eSGlenn Barry if (length & 0x80) { 240ba7b222eSGlenn Barry if ((length & 0x7f) > 4) 241ba7b222eSGlenn Barry return (GSS_S_DEFECTIVE_TOKEN); 242ba7b222eSGlenn Barry buffer_ptr += length & 0x7f; 243ba7b222eSGlenn Barry } 244ba7b222eSGlenn Barry 245ba7b222eSGlenn Barry if (*(buffer_ptr++) != 0x06) 246ba7b222eSGlenn Barry return (GSS_S_DEFECTIVE_TOKEN); 247ba7b222eSGlenn Barry 248ba7b222eSGlenn Barry OID->length = (OM_uint32) *(buffer_ptr++); 249ba7b222eSGlenn Barry OID->elements = (void *) buffer_ptr; 250ba7b222eSGlenn Barry return (GSS_S_COMPLETE); 251ba7b222eSGlenn Barry } 2527c478bd9Sstevel@tonic-gate 253ba7b222eSGlenn Barry /* 254ba7b222eSGlenn Barry * The following mechanisms do not always identify themselves 255ba7b222eSGlenn Barry * per the GSS-API specification, when interoperating with MS 256ba7b222eSGlenn Barry * peers. We include the OIDs here so we do not have to link 257ba7b222eSGlenn Barry * with the mechanism. 258ba7b222eSGlenn Barry */ 259ba7b222eSGlenn Barry static gss_OID_desc gss_ntlm_mechanism_oid_desc = 260ba7b222eSGlenn Barry {10, (void *)"\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"}; 261ba7b222eSGlenn Barry static gss_OID_desc gss_spnego_mechanism_oid_desc = 262ba7b222eSGlenn Barry {6, (void *)"\x2b\x06\x01\x05\x05\x02"}; 263ba7b222eSGlenn Barry static gss_OID_desc gss_krb5_mechanism_oid_desc = 264ba7b222eSGlenn Barry {9, (void *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"}; 265ba7b222eSGlenn Barry 266ba7b222eSGlenn Barry #define NTLMSSP_SIGNATURE "NTLMSSP" 267ba7b222eSGlenn Barry 268ba7b222eSGlenn Barry OM_uint32 gssint_get_mech_type(OID, token) 269ba7b222eSGlenn Barry gss_OID OID; 270ba7b222eSGlenn Barry gss_buffer_t token; 271ba7b222eSGlenn Barry { 272ba7b222eSGlenn Barry /* Check for interoperability exceptions */ 273ba7b222eSGlenn Barry if (token->length >= sizeof(NTLMSSP_SIGNATURE) && 274ba7b222eSGlenn Barry memcmp(token->value, NTLMSSP_SIGNATURE, 275ba7b222eSGlenn Barry sizeof(NTLMSSP_SIGNATURE)) == 0) { 276ba7b222eSGlenn Barry *OID = gss_ntlm_mechanism_oid_desc; 277ba7b222eSGlenn Barry } else if (token->length != 0 && 278ba7b222eSGlenn Barry ((char *)token->value)[0] == 0x6E) { 279ba7b222eSGlenn Barry /* Could be a raw AP-REQ (check for APPLICATION tag) */ 280ba7b222eSGlenn Barry *OID = gss_krb5_mechanism_oid_desc; 281ba7b222eSGlenn Barry } else if (token->length == 0) { 282ba7b222eSGlenn Barry *OID = gss_spnego_mechanism_oid_desc; 283ba7b222eSGlenn Barry } else { 284ba7b222eSGlenn Barry return gssint_get_mech_type_oid(OID, token); 285ba7b222eSGlenn Barry } 286ba7b222eSGlenn Barry 287ba7b222eSGlenn Barry return (GSS_S_COMPLETE); 2887c478bd9Sstevel@tonic-gate } 2897c478bd9Sstevel@tonic-gate 2907c478bd9Sstevel@tonic-gate 2917c478bd9Sstevel@tonic-gate /* 2927c478bd9Sstevel@tonic-gate * Internal routines to get and release an internal mechanism name 2937c478bd9Sstevel@tonic-gate */ 294ba7b222eSGlenn Barry 295ba7b222eSGlenn Barry #if 0 /* SUNW17PACresync */ 296ba7b222eSGlenn Barry #include "mglueP.h" 297ba7b222eSGlenn Barry #endif 298ba7b222eSGlenn Barry 299ba7b222eSGlenn Barry OM_uint32 gssint_import_internal_name (minor_status, mech_type, union_name, 300ba7b222eSGlenn Barry internal_name) 3017c478bd9Sstevel@tonic-gate OM_uint32 *minor_status; 302ba7b222eSGlenn Barry gss_OID mech_type; 3037c478bd9Sstevel@tonic-gate gss_union_name_t union_name; 3047c478bd9Sstevel@tonic-gate gss_name_t *internal_name; 3057c478bd9Sstevel@tonic-gate { 306ba7b222eSGlenn Barry OM_uint32 status; 307ba7b222eSGlenn Barry gss_mechanism mech; 308ba7b222eSGlenn Barry 309ba7b222eSGlenn Barry mech = gssint_get_mechanism (mech_type); 310ba7b222eSGlenn Barry if (mech) { 311ba7b222eSGlenn Barry if (mech->gss_import_name) { 312ba7b222eSGlenn Barry status = mech->gss_import_name ( 313ba7b222eSGlenn Barry mech->context, /* SUNW17PACresync */ 314ba7b222eSGlenn Barry minor_status, 315ba7b222eSGlenn Barry union_name->external_name, 316ba7b222eSGlenn Barry union_name->name_type, 317ba7b222eSGlenn Barry internal_name); 318ba7b222eSGlenn Barry if (status != GSS_S_COMPLETE) 319ba7b222eSGlenn Barry map_error(minor_status, mech); 320ba7b222eSGlenn Barry } else 321ba7b222eSGlenn Barry status = GSS_S_UNAVAILABLE; 322ba7b222eSGlenn Barry 323ba7b222eSGlenn Barry return (status); 324ba7b222eSGlenn Barry } 325ba7b222eSGlenn Barry 326ba7b222eSGlenn Barry return (GSS_S_BAD_MECH); 3277c478bd9Sstevel@tonic-gate } 3287c478bd9Sstevel@tonic-gate 329ba7b222eSGlenn Barry OM_uint32 gssint_export_internal_name(minor_status, mech_type, 330ba7b222eSGlenn Barry internal_name, name_buf) 331ba7b222eSGlenn Barry OM_uint32 *minor_status; 332ba7b222eSGlenn Barry const gss_OID mech_type; 333ba7b222eSGlenn Barry const gss_name_t internal_name; 334ba7b222eSGlenn Barry gss_buffer_t name_buf; 3357c478bd9Sstevel@tonic-gate { 336ba7b222eSGlenn Barry OM_uint32 status; 337ba7b222eSGlenn Barry gss_mechanism mech; 338ba7b222eSGlenn Barry gss_buffer_desc dispName; 339ba7b222eSGlenn Barry gss_OID nameOid; 340ba7b222eSGlenn Barry unsigned char *buf = NULL; 341ba7b222eSGlenn Barry const unsigned char tokId[] = "\x04\x01"; 342ba7b222eSGlenn Barry const unsigned int tokIdLen = 2; 343ba7b222eSGlenn Barry const int mechOidLenLen = 2, mechOidTagLen = 1, nameLenLen = 4; 344ba7b222eSGlenn Barry int mechOidDERLen = 0; 345ba7b222eSGlenn Barry int mechOidLen = 0; 346ba7b222eSGlenn Barry 347ba7b222eSGlenn Barry mech = gssint_get_mechanism(mech_type); 348ba7b222eSGlenn Barry if (!mech) 349ba7b222eSGlenn Barry return (GSS_S_BAD_MECH); 3507c478bd9Sstevel@tonic-gate 351ba7b222eSGlenn Barry if (mech->gss_export_name) { 352ba7b222eSGlenn Barry status = mech->gss_export_name( 353ba7b222eSGlenn Barry mech->context, /* SUNW17PACresync */ 354ba7b222eSGlenn Barry minor_status, 355ba7b222eSGlenn Barry internal_name, 356ba7b222eSGlenn Barry name_buf); 357ba7b222eSGlenn Barry if (status != GSS_S_COMPLETE) 358ba7b222eSGlenn Barry map_error(minor_status, mech); 359ba7b222eSGlenn Barry return status; 360ba7b222eSGlenn Barry } 361ba7b222eSGlenn Barry 362ba7b222eSGlenn Barry /* 363ba7b222eSGlenn Barry * if we are here it is because the mechanism does not provide 364ba7b222eSGlenn Barry * a gss_export_name so we will use our implementation. We 365ba7b222eSGlenn Barry * do required that the mechanism define a gss_display_name. 366ba7b222eSGlenn Barry */ 367ba7b222eSGlenn Barry if (!mech->gss_display_name) 368ba7b222eSGlenn Barry return (GSS_S_UNAVAILABLE); 369ba7b222eSGlenn Barry 370ba7b222eSGlenn Barry /* 371ba7b222eSGlenn Barry * NOTE: RFC2743 (section 3.2) governs the format of the outer 372ba7b222eSGlenn Barry * wrapper of exported names; the mechanisms' specs govern 373ba7b222eSGlenn Barry * the format of the inner portion of the exported name 374ba7b222eSGlenn Barry * and, for some (e.g., RFC1964, the Kerberos V mech), a 375ba7b222eSGlenn Barry * generic default as implemented here will do. 376ba7b222eSGlenn Barry * 377ba7b222eSGlenn Barry * The outer wrapper of an exported MN is: 2-octet tok Id 378ba7b222eSGlenn Barry * (0x0401) + 2-octet network-byte order mech OID length + mech 379ba7b222eSGlenn Barry * oid (in DER format, including DER tag and DER length) + 380ba7b222eSGlenn Barry * 4-octet network-byte order length of inner portion + inner 381ba7b222eSGlenn Barry * portion. 382ba7b222eSGlenn Barry * 383ba7b222eSGlenn Barry * For the Kerberos V mechanism the inner portion of an exported 384ba7b222eSGlenn Barry * MN is the display name string and ignores the name type OID 385ba7b222eSGlenn Barry * altogether. And we hope this will be so for any future 386ba7b222eSGlenn Barry * mechanisms also, so that factoring name export/import out of 387ba7b222eSGlenn Barry * the mech and into libgss pays off. 388ba7b222eSGlenn Barry */ 389ba7b222eSGlenn Barry if ((status = mech->gss_display_name( 390ba7b222eSGlenn Barry mech->context, 391ba7b222eSGlenn Barry minor_status, 392ba7b222eSGlenn Barry internal_name, 393ba7b222eSGlenn Barry &dispName, 394ba7b222eSGlenn Barry &nameOid)) 395ba7b222eSGlenn Barry != GSS_S_COMPLETE) { 396ba7b222eSGlenn Barry map_error(minor_status, mech); 397ba7b222eSGlenn Barry return (status); 398ba7b222eSGlenn Barry } 399ba7b222eSGlenn Barry 400ba7b222eSGlenn Barry /* determine the size of the buffer needed */ 401ba7b222eSGlenn Barry mechOidDERLen = gssint_der_length_size(mech_type->length); 402ba7b222eSGlenn Barry name_buf->length = tokIdLen + mechOidLenLen + 403ba7b222eSGlenn Barry mechOidTagLen + mechOidDERLen + 404ba7b222eSGlenn Barry mech_type->length + 405ba7b222eSGlenn Barry nameLenLen + dispName.length; 406ba7b222eSGlenn Barry if ((name_buf->value = (void*)malloc(name_buf->length)) == 407ba7b222eSGlenn Barry (void*)NULL) { 408ba7b222eSGlenn Barry name_buf->length = 0; 409ba7b222eSGlenn Barry (void) gss_release_buffer(&status, &dispName); 410ba7b222eSGlenn Barry return (GSS_S_FAILURE); 411ba7b222eSGlenn Barry } 412ba7b222eSGlenn Barry 413ba7b222eSGlenn Barry /* now create the name ..... */ 414ba7b222eSGlenn Barry buf = (unsigned char *)name_buf->value; 415ba7b222eSGlenn Barry (void) memset(name_buf->value, 0, name_buf->length); 416ba7b222eSGlenn Barry (void) memcpy(buf, tokId, tokIdLen); 417ba7b222eSGlenn Barry buf += tokIdLen; 418ba7b222eSGlenn Barry 419ba7b222eSGlenn Barry /* spec allows only 2 bytes for the mech oid length */ 420ba7b222eSGlenn Barry mechOidLen = mechOidDERLen + mechOidTagLen + mech_type->length; 421ba7b222eSGlenn Barry store_16_be(mechOidLen, buf); 422ba7b222eSGlenn Barry buf += 2; 423ba7b222eSGlenn Barry 424ba7b222eSGlenn Barry /* 425ba7b222eSGlenn Barry * DER Encoding of mech OID contains OID Tag (0x06), length and 426ba7b222eSGlenn Barry * mech OID value 427ba7b222eSGlenn Barry */ 428ba7b222eSGlenn Barry *buf++ = 0x06; 429ba7b222eSGlenn Barry if (gssint_put_der_length(mech_type->length, &buf, 430ba7b222eSGlenn Barry (name_buf->length - tokIdLen -2)) != 0) { 431ba7b222eSGlenn Barry name_buf->length = 0; 432ba7b222eSGlenn Barry free(name_buf->value); 433ba7b222eSGlenn Barry (void) gss_release_buffer(&status, &dispName); 434ba7b222eSGlenn Barry return (GSS_S_FAILURE); 435ba7b222eSGlenn Barry } 436ba7b222eSGlenn Barry 437ba7b222eSGlenn Barry (void) memcpy(buf, mech_type->elements, mech_type->length); 438ba7b222eSGlenn Barry buf += mech_type->length; 439ba7b222eSGlenn Barry 440ba7b222eSGlenn Barry /* spec designates the next 4 bytes for the name length */ 441ba7b222eSGlenn Barry store_32_be(dispName.length, buf); 442ba7b222eSGlenn Barry buf += 4; 443ba7b222eSGlenn Barry 444ba7b222eSGlenn Barry /* for the final ingredient - add the name from gss_display_name */ 445ba7b222eSGlenn Barry (void) memcpy(buf, dispName.value, dispName.length); 446ba7b222eSGlenn Barry 447ba7b222eSGlenn Barry /* release the buffer obtained from gss_display_name */ 448ba7b222eSGlenn Barry (void) gss_release_buffer(minor_status, &dispName); 449ba7b222eSGlenn Barry return (GSS_S_COMPLETE); 450ba7b222eSGlenn Barry } /* gssint_export_internal_name */ 451ba7b222eSGlenn Barry 452ba7b222eSGlenn Barry OM_uint32 gssint_display_internal_name (minor_status, mech_type, internal_name, 453ba7b222eSGlenn Barry external_name, name_type) 454ba7b222eSGlenn Barry OM_uint32 *minor_status; 455ba7b222eSGlenn Barry gss_OID mech_type; 456ba7b222eSGlenn Barry gss_name_t internal_name; 457ba7b222eSGlenn Barry gss_buffer_t external_name; 458ba7b222eSGlenn Barry gss_OID *name_type; 4597c478bd9Sstevel@tonic-gate { 460ba7b222eSGlenn Barry OM_uint32 status; 461ba7b222eSGlenn Barry gss_mechanism mech; 462ba7b222eSGlenn Barry 463ba7b222eSGlenn Barry mech = gssint_get_mechanism (mech_type); 464ba7b222eSGlenn Barry if (mech) { 465ba7b222eSGlenn Barry if (mech->gss_display_name) { 466ba7b222eSGlenn Barry status = mech->gss_display_name ( 467ba7b222eSGlenn Barry mech->context, 468ba7b222eSGlenn Barry minor_status, 469ba7b222eSGlenn Barry internal_name, 470ba7b222eSGlenn Barry external_name, 471ba7b222eSGlenn Barry name_type); 472ba7b222eSGlenn Barry if (status != GSS_S_COMPLETE) 473ba7b222eSGlenn Barry map_error(minor_status, mech); 474ba7b222eSGlenn Barry } else 475ba7b222eSGlenn Barry status = GSS_S_UNAVAILABLE; 476ba7b222eSGlenn Barry 477ba7b222eSGlenn Barry return (status); 478ba7b222eSGlenn Barry } 479ba7b222eSGlenn Barry 480ba7b222eSGlenn Barry return (GSS_S_BAD_MECH); 481ba7b222eSGlenn Barry } 4827c478bd9Sstevel@tonic-gate 483ba7b222eSGlenn Barry OM_uint32 gssint_release_internal_name (minor_status, mech_type, internal_name) 484ba7b222eSGlenn Barry OM_uint32 *minor_status; 485ba7b222eSGlenn Barry gss_OID mech_type; 486ba7b222eSGlenn Barry gss_name_t *internal_name; 487ba7b222eSGlenn Barry { 488ba7b222eSGlenn Barry OM_uint32 status; 489ba7b222eSGlenn Barry gss_mechanism mech; 490ba7b222eSGlenn Barry 491ba7b222eSGlenn Barry mech = gssint_get_mechanism (mech_type); 492ba7b222eSGlenn Barry if (mech) { 493ba7b222eSGlenn Barry if (mech->gss_release_name) { 494ba7b222eSGlenn Barry status = mech->gss_release_name ( 495ba7b222eSGlenn Barry mech->context, 496ba7b222eSGlenn Barry minor_status, 497ba7b222eSGlenn Barry internal_name); 498ba7b222eSGlenn Barry if (status != GSS_S_COMPLETE) 499ba7b222eSGlenn Barry map_error(minor_status, mech); 500ba7b222eSGlenn Barry } else 501ba7b222eSGlenn Barry status = GSS_S_UNAVAILABLE; 502ba7b222eSGlenn Barry 503ba7b222eSGlenn Barry return (status); 504ba7b222eSGlenn Barry } 505ba7b222eSGlenn Barry 506ba7b222eSGlenn Barry return (GSS_S_BAD_MECH); 5077c478bd9Sstevel@tonic-gate } 5087c478bd9Sstevel@tonic-gate 509ba7b222eSGlenn Barry OM_uint32 gssint_delete_internal_sec_context (minor_status, 510ba7b222eSGlenn Barry mech_type, 511ba7b222eSGlenn Barry internal_ctx, 512ba7b222eSGlenn Barry output_token) 513ba7b222eSGlenn Barry OM_uint32 *minor_status; 514ba7b222eSGlenn Barry gss_OID mech_type; 515ba7b222eSGlenn Barry gss_ctx_id_t *internal_ctx; 516ba7b222eSGlenn Barry gss_buffer_t output_token; 5177c478bd9Sstevel@tonic-gate { 518ba7b222eSGlenn Barry OM_uint32 status; 519ba7b222eSGlenn Barry gss_mechanism mech; 520ba7b222eSGlenn Barry 521ba7b222eSGlenn Barry mech = gssint_get_mechanism (mech_type); 522ba7b222eSGlenn Barry if (mech) { 523ba7b222eSGlenn Barry if (mech->gss_delete_sec_context) 524ba7b222eSGlenn Barry status = mech->gss_delete_sec_context ( 525ba7b222eSGlenn Barry mech->context, /* SUNW17PACresync */ 526ba7b222eSGlenn Barry minor_status, 527ba7b222eSGlenn Barry internal_ctx, 528ba7b222eSGlenn Barry output_token); 529ba7b222eSGlenn Barry else 530ba7b222eSGlenn Barry /* SUNW17PACresync - map error here? */ 531ba7b222eSGlenn Barry status = GSS_S_UNAVAILABLE; 5327c478bd9Sstevel@tonic-gate 533ba7b222eSGlenn Barry return (status); 534ba7b222eSGlenn Barry } 5357c478bd9Sstevel@tonic-gate 536ba7b222eSGlenn Barry return (GSS_S_BAD_MECH); 537ba7b222eSGlenn Barry } 5387c478bd9Sstevel@tonic-gate 5397c478bd9Sstevel@tonic-gate /* 5407c478bd9Sstevel@tonic-gate * This function converts an internal gssapi name to a union gssapi 5417c478bd9Sstevel@tonic-gate * name. Note that internal_name should be considered "consumed" by 5427c478bd9Sstevel@tonic-gate * this call, whether or not we return an error. 5437c478bd9Sstevel@tonic-gate */ 544ba7b222eSGlenn Barry OM_uint32 gssint_convert_name_to_union_name(minor_status, mech, 545ba7b222eSGlenn Barry internal_name, external_name) 546ba7b222eSGlenn Barry OM_uint32 *minor_status; 547ba7b222eSGlenn Barry gss_mechanism mech; 548ba7b222eSGlenn Barry gss_name_t internal_name; 549ba7b222eSGlenn Barry gss_name_t *external_name; 5507c478bd9Sstevel@tonic-gate { 551ba7b222eSGlenn Barry OM_uint32 major_status,tmp; 552ba7b222eSGlenn Barry gss_union_name_t union_name; 553ba7b222eSGlenn Barry 554ba7b222eSGlenn Barry union_name = (gss_union_name_t) malloc (sizeof(gss_union_name_desc)); 555ba7b222eSGlenn Barry if (!union_name) { 556ba7b222eSGlenn Barry major_status = GSS_S_FAILURE; 557ba7b222eSGlenn Barry *minor_status = ENOMEM; 558ba7b222eSGlenn Barry map_errcode(minor_status); 559ba7b222eSGlenn Barry goto allocation_failure; 560ba7b222eSGlenn Barry } 561ba7b222eSGlenn Barry union_name->mech_type = 0; 562ba7b222eSGlenn Barry union_name->mech_name = internal_name; 563ba7b222eSGlenn Barry union_name->name_type = 0; 564ba7b222eSGlenn Barry union_name->external_name = 0; 565ba7b222eSGlenn Barry 566ba7b222eSGlenn Barry major_status = generic_gss_copy_oid(minor_status, &mech->mech_type, 567ba7b222eSGlenn Barry &union_name->mech_type); 568ba7b222eSGlenn Barry if (major_status != GSS_S_COMPLETE) { 569ba7b222eSGlenn Barry map_errcode(minor_status); 570ba7b222eSGlenn Barry goto allocation_failure; 571ba7b222eSGlenn Barry } 572ba7b222eSGlenn Barry 573ba7b222eSGlenn Barry union_name->external_name = 574ba7b222eSGlenn Barry (gss_buffer_t) malloc(sizeof(gss_buffer_desc)); 575ba7b222eSGlenn Barry if (!union_name->external_name) { 576ba7b222eSGlenn Barry major_status = GSS_S_FAILURE; 577ba7b222eSGlenn Barry *minor_status = ENOMEM; 578ba7b222eSGlenn Barry goto allocation_failure; 579ba7b222eSGlenn Barry } 580ba7b222eSGlenn Barry 581cc35afbcSMark Phalan union_name->external_name->length = 0; 582cc35afbcSMark Phalan union_name->external_name->value = 0; 583cc35afbcSMark Phalan 584ba7b222eSGlenn Barry major_status = mech->gss_display_name( 585ba7b222eSGlenn Barry mech->context, /* SUNW17PACresync */ 586ba7b222eSGlenn Barry minor_status, 587ba7b222eSGlenn Barry internal_name, 588ba7b222eSGlenn Barry union_name->external_name, 589ba7b222eSGlenn Barry &union_name->name_type); 590ba7b222eSGlenn Barry if (major_status != GSS_S_COMPLETE) { 591ba7b222eSGlenn Barry map_error(minor_status, mech); 592ba7b222eSGlenn Barry goto allocation_failure; 593ba7b222eSGlenn Barry } 594ba7b222eSGlenn Barry 595ba7b222eSGlenn Barry union_name->loopback = union_name; 596ba7b222eSGlenn Barry *external_name = (gss_name_t) union_name; 597ba7b222eSGlenn Barry return (GSS_S_COMPLETE); 5987c478bd9Sstevel@tonic-gate 5997c478bd9Sstevel@tonic-gate allocation_failure: 600ba7b222eSGlenn Barry if (union_name) { 601ba7b222eSGlenn Barry if (union_name->external_name) { 602ba7b222eSGlenn Barry if (union_name->external_name->value) 603ba7b222eSGlenn Barry free(union_name->external_name->value); 604ba7b222eSGlenn Barry free(union_name->external_name); 6057c478bd9Sstevel@tonic-gate } 606ba7b222eSGlenn Barry if (union_name->name_type) 607ba7b222eSGlenn Barry (void) gss_release_oid(&tmp, &union_name->name_type); 608ba7b222eSGlenn Barry if (union_name->mech_type) 609ba7b222eSGlenn Barry (void) gss_release_oid(&tmp, &union_name->mech_type); 610ba7b222eSGlenn Barry free(union_name); 611ba7b222eSGlenn Barry } 612ba7b222eSGlenn Barry /* 613ba7b222eSGlenn Barry * do as the top comment says - since we are now owners of 614ba7b222eSGlenn Barry * internal_name, we must clean it up 615ba7b222eSGlenn Barry */ 616ba7b222eSGlenn Barry if (internal_name) 617ba7b222eSGlenn Barry (void) gssint_release_internal_name(&tmp, &mech->mech_type, 618ba7b222eSGlenn Barry &internal_name); 619ba7b222eSGlenn Barry return (major_status); 6207c478bd9Sstevel@tonic-gate } 6217c478bd9Sstevel@tonic-gate 6227c478bd9Sstevel@tonic-gate /* 6237c478bd9Sstevel@tonic-gate * Glue routine for returning the mechanism-specific credential from a 6247c478bd9Sstevel@tonic-gate * external union credential. 6257c478bd9Sstevel@tonic-gate */ 6267c478bd9Sstevel@tonic-gate gss_cred_id_t 627ba7b222eSGlenn Barry gssint_get_mechanism_cred(union_cred, mech_type) 628ba7b222eSGlenn Barry gss_union_cred_t union_cred; 629ba7b222eSGlenn Barry gss_OID mech_type; 6307c478bd9Sstevel@tonic-gate { 631ba7b222eSGlenn Barry int i; 632ba7b222eSGlenn Barry 633ba7b222eSGlenn Barry if (union_cred == (gss_union_cred_t) GSS_C_NO_CREDENTIAL) 634ba7b222eSGlenn Barry return GSS_C_NO_CREDENTIAL; 635ba7b222eSGlenn Barry 636ba7b222eSGlenn Barry /* 637ba7b222eSGlenn Barry * SUNW17PACresync 638ba7b222eSGlenn Barry * Disable this block as it causes problems for gss_add_cred 639ba7b222eSGlenn Barry * for HTTP SSO (and also probably causes STC gss.13 to fail too). 640ba7b222eSGlenn Barry */ 641ba7b222eSGlenn Barry #if 0 642ba7b222eSGlenn Barry /* SPNEGO mechanism will again call into GSSAPI */ 643ba7b222eSGlenn Barry if (g_OID_equal(&gss_spnego_mechanism_oid_desc, mech_type)) 644ba7b222eSGlenn Barry return (gss_cred_id_t)union_cred; 645ba7b222eSGlenn Barry #endif 646ba7b222eSGlenn Barry 647ba7b222eSGlenn Barry for (i=0; i < union_cred->count; i++) { 648ba7b222eSGlenn Barry if (g_OID_equal(mech_type, &union_cred->mechs_array[i])) 649ba7b222eSGlenn Barry return union_cred->cred_array[i]; 650ba7b222eSGlenn Barry 651ba7b222eSGlenn Barry /* for SPNEGO, check the next-lower set of creds */ 652ba7b222eSGlenn Barry if (g_OID_equal(&gss_spnego_mechanism_oid_desc, &union_cred->mechs_array[i])) { 653ba7b222eSGlenn Barry gss_union_cred_t candidate_cred; 654ba7b222eSGlenn Barry gss_cred_id_t sub_cred; 655ba7b222eSGlenn Barry 656ba7b222eSGlenn Barry candidate_cred = (gss_union_cred_t)union_cred->cred_array[i]; 657ba7b222eSGlenn Barry sub_cred = gssint_get_mechanism_cred(candidate_cred, mech_type); 658ba7b222eSGlenn Barry 659ba7b222eSGlenn Barry if(sub_cred != GSS_C_NO_CREDENTIAL) 660ba7b222eSGlenn Barry return sub_cred; 6617c478bd9Sstevel@tonic-gate } 662ba7b222eSGlenn Barry } 6637c478bd9Sstevel@tonic-gate 664ba7b222eSGlenn Barry return GSS_C_NO_CREDENTIAL; 665ba7b222eSGlenn Barry } 6667c478bd9Sstevel@tonic-gate 6677c478bd9Sstevel@tonic-gate /* 6687c478bd9Sstevel@tonic-gate * Routine to create and copy the gss_buffer_desc structure. 6697c478bd9Sstevel@tonic-gate * Both space for the structure and the data is allocated. 6707c478bd9Sstevel@tonic-gate */ 6717c478bd9Sstevel@tonic-gate OM_uint32 672ab9b2e15Sgtb gssint_create_copy_buffer(srcBuf, destBuf, addNullChar) 673ba7b222eSGlenn Barry const gss_buffer_t srcBuf; 674ba7b222eSGlenn Barry gss_buffer_t *destBuf; 675ba7b222eSGlenn Barry int addNullChar; 6767c478bd9Sstevel@tonic-gate { 677ba7b222eSGlenn Barry gss_buffer_t aBuf; 678ba7b222eSGlenn Barry unsigned int len; 6797c478bd9Sstevel@tonic-gate 680ba7b222eSGlenn Barry if (destBuf == NULL) 681ba7b222eSGlenn Barry return (GSS_S_CALL_INACCESSIBLE_WRITE); 6827c478bd9Sstevel@tonic-gate 683ba7b222eSGlenn Barry *destBuf = 0; 6847c478bd9Sstevel@tonic-gate 685ba7b222eSGlenn Barry aBuf = (gss_buffer_t)malloc(sizeof (gss_buffer_desc)); 686ba7b222eSGlenn Barry if (!aBuf) 687ba7b222eSGlenn Barry return (GSS_S_FAILURE); 6887c478bd9Sstevel@tonic-gate 689ba7b222eSGlenn Barry if (addNullChar) 690ba7b222eSGlenn Barry len = srcBuf->length + 1; 691ba7b222eSGlenn Barry else 692ba7b222eSGlenn Barry len = srcBuf->length; 693ba7b222eSGlenn Barry 694ba7b222eSGlenn Barry if (!(aBuf->value = (void*)malloc(len))) { 695ba7b222eSGlenn Barry free(aBuf); 696ba7b222eSGlenn Barry return (GSS_S_FAILURE); 697ba7b222eSGlenn Barry } 6987c478bd9Sstevel@tonic-gate 6997c478bd9Sstevel@tonic-gate 700ba7b222eSGlenn Barry (void) memcpy(aBuf->value, srcBuf->value, srcBuf->length); 701ba7b222eSGlenn Barry aBuf->length = srcBuf->length; 702ba7b222eSGlenn Barry *destBuf = aBuf; 7037c478bd9Sstevel@tonic-gate 704ba7b222eSGlenn Barry /* optionally add a NULL character */ 705ba7b222eSGlenn Barry if (addNullChar) 706ba7b222eSGlenn Barry ((char *)aBuf->value)[aBuf->length] = '\0'; 7077c478bd9Sstevel@tonic-gate 708ba7b222eSGlenn Barry return (GSS_S_COMPLETE); 709ba7b222eSGlenn Barry } /* ****** gssint_create_copy_buffer ****** */ 7107c478bd9Sstevel@tonic-gate 711