[u/mdw/putty] / unix / uxgss.c

#include <string.h>
#include <gssapi/gssapi.h>
#include "putty.h"
#include "sshgss.h"
#include "misc.h"

#ifndef NO_GSSAPI

static gss_OID_desc gss_mech_krb5_desc =
    { 9, (void *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
static gss_OID const gss_mech_krb5 = &gss_mech_krb5_desc;

typedef struct uxSsh_gss_ctx {
    OM_uint32 maj_stat;
    OM_uint32 min_stat;
    gss_ctx_id_t ctx;
} uxSsh_gss_ctx;

int ssh_gss_init(void)
{
    /* On Windows this tries to load the SSPI library functions.  On
       Unix we assume we have GSSAPI at runtime if we were linked with
       it at compile time */
    return 1;
}

Ssh_gss_stat ssh_gss_indicate_mech(Ssh_gss_buf *mech)
{
    /* Copy constant into mech */
    mech->len  = gss_mech_krb5->length;
    mech->data = gss_mech_krb5->elements;

    return SSH_GSS_OK;
}

Ssh_gss_stat ssh_gss_import_name(char *host,
                                 Ssh_gss_name *srv_name)
{
    OM_uint32 min_stat,maj_stat;
    gss_buffer_desc host_buf;
    char *pStr;

    pStr = dupcat("host@", host, NULL);

    host_buf.value = pStr;
    host_buf.length = strlen(pStr);

    maj_stat = gss_import_name(&min_stat, &host_buf,
			       GSS_C_NT_HOSTBASED_SERVICE,
			       (gss_name_t *)srv_name);
    /* Release buffer */
    sfree(pStr);
    if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
    return SSH_GSS_FAILURE;
}

Ssh_gss_stat ssh_gss_acquire_cred(Ssh_gss_ctx *ctx)
{
    uxSsh_gss_ctx *uxctx = snew(uxSsh_gss_ctx);

    uxctx->maj_stat =  uxctx->min_stat = GSS_S_COMPLETE;
    uxctx->ctx = GSS_C_NO_CONTEXT;
    *ctx = (Ssh_gss_ctx) uxctx;

    return SSH_GSS_OK;
}

Ssh_gss_stat ssh_gss_init_sec_context(Ssh_gss_ctx *ctx,
                                      Ssh_gss_name srv_name,
                                      int to_deleg,
				      Ssh_gss_buf *recv_tok,
				      Ssh_gss_buf *send_tok)
{
    uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx*) *ctx;
    OM_uint32 ret_flags;

    if (to_deleg) to_deleg = GSS_C_DELEG_FLAG;
    uxctx->maj_stat = gss_init_sec_context(&uxctx->min_stat,
					   GSS_C_NO_CREDENTIAL,
					   &uxctx->ctx,
					   (gss_name_t) srv_name,
					   (gss_OID) gss_mech_krb5,
					   GSS_C_MUTUAL_FLAG |
					   GSS_C_INTEG_FLAG | to_deleg,
					   0,
					   NULL,   /* no channel bindings */
					   (gss_buffer_desc *)recv_tok,
					   NULL,   /* ignore mech type */
					   (gss_buffer_desc *)send_tok,
					   &ret_flags,
					   NULL);  /* ignore time_rec */
  
    if (uxctx->maj_stat == GSS_S_COMPLETE) return SSH_GSS_S_COMPLETE;
    if (uxctx->maj_stat == GSS_S_CONTINUE_NEEDED) return SSH_GSS_S_CONTINUE_NEEDED;
    return SSH_GSS_FAILURE;
}

Ssh_gss_stat ssh_gss_display_status(Ssh_gss_ctx ctx, Ssh_gss_buf *buf)
{
    uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx *) ctx;
    OM_uint32 lmin,lmax;
    OM_uint32 ccc;
    gss_buffer_desc msg_maj=GSS_C_EMPTY_BUFFER;
    gss_buffer_desc msg_min=GSS_C_EMPTY_BUFFER;

    /* Return empty buffer in case of failure */
    SSH_GSS_CLEAR_BUF(buf);

    /* get first mesg from GSS */
    ccc=0;
    lmax=gss_display_status(&lmin,uxctx->maj_stat,GSS_C_GSS_CODE,(gss_OID) gss_mech_krb5,&ccc,&msg_maj);

    if (lmax != GSS_S_COMPLETE) return SSH_GSS_FAILURE;

    /* get first mesg from Kerberos */
    ccc=0;
    lmax=gss_display_status(&lmin,uxctx->min_stat,GSS_C_MECH_CODE,(gss_OID) gss_mech_krb5,&ccc,&msg_min);

    if (lmax != GSS_S_COMPLETE) {
	gss_release_buffer(&lmin, &msg_maj);
	return SSH_GSS_FAILURE;
    }

    /* copy data into buffer */
    buf->len = msg_maj.length + msg_min.length + 1;
    buf->data = snewn(buf->len + 1, char);
  
    /* copy mem */
    memcpy(buf->data, msg_maj.value, msg_maj.length);
    buf->data[msg_maj.length] = ' ';
    memcpy(buf->data + msg_maj.length + 1, msg_min.value, msg_min.length);
    buf->data[buf->len] = 0;
    /* free mem & exit */
    gss_release_buffer(&lmin, &msg_maj);
    gss_release_buffer(&lmin, &msg_min);
    return SSH_GSS_OK;
}

Ssh_gss_stat ssh_gss_free_tok(Ssh_gss_buf *send_tok)
{
    OM_uint32 min_stat,maj_stat;
    maj_stat = gss_release_buffer(&min_stat, (gss_buffer_desc *)send_tok);
  
    if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
    return SSH_GSS_FAILURE;
}

Ssh_gss_stat ssh_gss_release_cred(Ssh_gss_ctx *ctx)
{
    uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx *) *ctx;
    OM_uint32 min_stat;
    OM_uint32 maj_stat=GSS_S_COMPLETE;
  
    if (uxctx == NULL) return SSH_GSS_FAILURE;
    if (uxctx->ctx != GSS_C_NO_CONTEXT)
	maj_stat = gss_delete_sec_context(&min_stat,&uxctx->ctx,GSS_C_NO_BUFFER);
    sfree(uxctx);
  
    if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
    return SSH_GSS_FAILURE;
}


Ssh_gss_stat ssh_gss_release_name(Ssh_gss_name *srv_name)
{
    OM_uint32 min_stat,maj_stat;
    maj_stat = gss_release_name(&min_stat, (gss_name_t *) srv_name);
  
    if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
    return SSH_GSS_FAILURE;
}

Ssh_gss_stat ssh_gss_get_mic(Ssh_gss_ctx ctx, Ssh_gss_buf *buf,
			     Ssh_gss_buf *hash) 
{
    uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx *) ctx;
    if (uxctx == NULL) return SSH_GSS_FAILURE;
    return gss_get_mic(&(uxctx->min_stat),
		       uxctx->ctx,
		       0,
		       (gss_buffer_desc *)buf,
		       (gss_buffer_desc *)hash);
}

Ssh_gss_stat ssh_gss_free_mic(Ssh_gss_buf *hash)
{
    /* On Unix this is the same freeing process as ssh_gss_free_tok. */
    return ssh_gss_free_tok(hash);
}

#else

/* Dummy function so this source file defines something if NO_GSSAPI
   is defined. */

int ssh_gss_init(void)
{
    return 1;
}

#endif
Commit	Line	Data
42af6a67	1	#include <string.h>
2dc6481f	2	#include <gssapi/gssapi.h>
95aec249	3	#include "putty.h"
42af6a67	4	#include "sshgss.h"
	5	#include "misc.h"
	6
95aec249	7	#ifndef NO_GSSAPI
95aec249	8
2dc6481f	9	static gss_OID_desc gss_mech_krb5_desc =
	10	{ 9, (void *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
	11	static gss_OID const gss_mech_krb5 = &gss_mech_krb5_desc;
	12
42af6a67	13	typedef struct uxSsh_gss_ctx {
	14	OM_uint32 maj_stat;
	15	OM_uint32 min_stat;
	16	gss_ctx_id_t ctx;
	17	} uxSsh_gss_ctx;
	18
	19	int ssh_gss_init(void)
	20	{
	21	/* On Windows this tries to load the SSPI library functions. On
	22	Unix we assume we have GSSAPI at runtime if we were linked with
	23	it at compile time */
	24	return 1;
	25	}
	26
	27	Ssh_gss_stat ssh_gss_indicate_mech(Ssh_gss_buf *mech)
	28	{
	29	/* Copy constant into mech */
	30	mech->len = gss_mech_krb5->length;
	31	mech->data = gss_mech_krb5->elements;
	32
	33	return SSH_GSS_OK;
	34	}
	35
	36	Ssh_gss_stat ssh_gss_import_name(char *host,
	37	Ssh_gss_name *srv_name)
	38	{
	39	OM_uint32 min_stat,maj_stat;
	40	gss_buffer_desc host_buf;
	41	char *pStr;
	42
	43	pStr = dupcat("host@", host, NULL);
	44
	45	host_buf.value = pStr;
	46	host_buf.length = strlen(pStr);
	47
	48	maj_stat = gss_import_name(&min_stat, &host_buf,
	49	GSS_C_NT_HOSTBASED_SERVICE,
	50	(gss_name_t *)srv_name);
	51	/* Release buffer */
	52	sfree(pStr);
	53	if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
	54	return SSH_GSS_FAILURE;
	55	}
	56
	57	Ssh_gss_stat ssh_gss_acquire_cred(Ssh_gss_ctx *ctx)
	58	{
	59	uxSsh_gss_ctx *uxctx = snew(uxSsh_gss_ctx);
	60
	61	uxctx->maj_stat = uxctx->min_stat = GSS_S_COMPLETE;
	62	uxctx->ctx = GSS_C_NO_CONTEXT;
	63	*ctx = (Ssh_gss_ctx) uxctx;
	64
	65	return SSH_GSS_OK;
	66	}
	67
	68	Ssh_gss_stat ssh_gss_init_sec_context(Ssh_gss_ctx *ctx,
	69	Ssh_gss_name srv_name,
	70	int to_deleg,
	71	Ssh_gss_buf *recv_tok,
	72	Ssh_gss_buf *send_tok)
	73	{
	74	uxSsh_gss_ctx uxctx = (uxSsh_gss_ctx) *ctx;
	75	OM_uint32 ret_flags;
	76
77	if (to_deleg) to_deleg = GSS_C_DELEG_FLAG;
78	uxctx->maj_stat = gss_init_sec_context(&uxctx->min_stat,
79	GSS_C_NO_CREDENTIAL,
80	&uxctx->ctx,
81	(gss_name_t) srv_name,
82	(gss_OID) gss_mech_krb5,
83	GSS_C_MUTUAL_FLAG \|
84	GSS_C_INTEG_FLAG \| to_deleg,
85	0,
86	NULL, /* no channel bindings */
87	(gss_buffer_desc *)recv_tok,
88	NULL, /* ignore mech type */
89	(gss_buffer_desc *)send_tok,
90	&ret_flags,
91	NULL); /* ignore time_rec */
92
93	if (uxctx->maj_stat == GSS_S_COMPLETE) return SSH_GSS_S_COMPLETE;
94	if (uxctx->maj_stat == GSS_S_CONTINUE_NEEDED) return SSH_GSS_S_CONTINUE_NEEDED;
95	return SSH_GSS_FAILURE;
96	}
97
98	Ssh_gss_stat ssh_gss_display_status(Ssh_gss_ctx ctx, Ssh_gss_buf *buf)
99	{
100	uxSsh_gss_ctx uxctx = (uxSsh_gss_ctx ) ctx;
101	OM_uint32 lmin,lmax;
102	OM_uint32 ccc;
103	gss_buffer_desc msg_maj=GSS_C_EMPTY_BUFFER;
104	gss_buffer_desc msg_min=GSS_C_EMPTY_BUFFER;
105
106	/* Return empty buffer in case of failure */
107	SSH_GSS_CLEAR_BUF(buf);
108
109	/* get first mesg from GSS */
110	ccc=0;
111	lmax=gss_display_status(&lmin,uxctx->maj_stat,GSS_C_GSS_CODE,(gss_OID) gss_mech_krb5,&ccc,&msg_maj);
112
113	if (lmax != GSS_S_COMPLETE) return SSH_GSS_FAILURE;
114
115	/* get first mesg from Kerberos */
116	ccc=0;
117	lmax=gss_display_status(&lmin,uxctx->min_stat,GSS_C_MECH_CODE,(gss_OID) gss_mech_krb5,&ccc,&msg_min);
118
119	if (lmax != GSS_S_COMPLETE) {
120	gss_release_buffer(&lmin, &msg_maj);
121	return SSH_GSS_FAILURE;
122	}
123
124	/* copy data into buffer */
125	buf->len = msg_maj.length + msg_min.length + 1;
126	buf->data = snewn(buf->len + 1, char);
127
128	/* copy mem */
129	memcpy(buf->data, msg_maj.value, msg_maj.length);
130	buf->data[msg_maj.length] = ' ';
131	memcpy(buf->data + msg_maj.length + 1, msg_min.value, msg_min.length);
132	buf->data[buf->len] = 0;
133	/* free mem & exit */
134	gss_release_buffer(&lmin, &msg_maj);
135	gss_release_buffer(&lmin, &msg_min);
136	return SSH_GSS_OK;
137	}
138
139	Ssh_gss_stat ssh_gss_free_tok(Ssh_gss_buf *send_tok)
140	{
141	OM_uint32 min_stat,maj_stat;
142	maj_stat = gss_release_buffer(&min_stat, (gss_buffer_desc *)send_tok);
143
144	if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
145	return SSH_GSS_FAILURE;
146	}
147
148	Ssh_gss_stat ssh_gss_release_cred(Ssh_gss_ctx *ctx)
149	{
150	uxSsh_gss_ctx uxctx = (uxSsh_gss_ctx ) *ctx;
151	OM_uint32 min_stat;
152	OM_uint32 maj_stat=GSS_S_COMPLETE;
153
154	if (uxctx == NULL) return SSH_GSS_FAILURE;
155	if (uxctx->ctx != GSS_C_NO_CONTEXT)
156	maj_stat = gss_delete_sec_context(&min_stat,&uxctx->ctx,GSS_C_NO_BUFFER);
157	sfree(uxctx);
158
159	if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
160	return SSH_GSS_FAILURE;
161	}
162
163
164	Ssh_gss_stat ssh_gss_release_name(Ssh_gss_name *srv_name)
165	{
166	OM_uint32 min_stat,maj_stat;
5de9b45d	167	maj_stat = gss_release_name(&min_stat, (gss_name_t *) srv_name);
42af6a67	168
	169	if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
	170	return SSH_GSS_FAILURE;
	171	}
	172
	173	Ssh_gss_stat ssh_gss_get_mic(Ssh_gss_ctx ctx, Ssh_gss_buf *buf,
	174	Ssh_gss_buf *hash)
	175	{
	176	uxSsh_gss_ctx uxctx = (uxSsh_gss_ctx ) ctx;
	177	if (uxctx == NULL) return SSH_GSS_FAILURE;
	178	return gss_get_mic(&(uxctx->min_stat),
	179	uxctx->ctx,
	180	0,
	181	(gss_buffer_desc *)buf,
	182	(gss_buffer_desc *)hash);
	183	}
	184
	185	Ssh_gss_stat ssh_gss_free_mic(Ssh_gss_buf *hash)
	186	{
	187	/* On Unix this is the same freeing process as ssh_gss_free_tok. */
	188	return ssh_gss_free_tok(hash);
	189	}
	190
	191	#else
	192
	193	/* Dummy function so this source file defines something if NO_GSSAPI
	194	is defined. */
	195
	196	int ssh_gss_init(void)
	197	{
	198	return 1;
	199	}
	200
	201	#endif