6 #include <gssapi/gssapi.h>
10 static gss_OID_desc putty_gss_mech_krb5_desc
=
11 { 9, (void *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
12 static gss_OID
const putty_gss_mech_krb5
= &putty_gss_mech_krb5_desc
;
14 typedef struct uxSsh_gss_ctx
{
20 int ssh_gss_init(void)
22 /* On Windows this tries to load the SSPI library functions. On
23 Unix we assume we have GSSAPI at runtime if we were linked with
28 Ssh_gss_stat
ssh_gss_indicate_mech(Ssh_gss_buf
*mech
)
30 /* Copy constant into mech */
31 mech
->length
= putty_gss_mech_krb5
->length
;
32 mech
->value
= putty_gss_mech_krb5
->elements
;
37 Ssh_gss_stat
ssh_gss_import_name(char *host
,
38 Ssh_gss_name
*srv_name
)
40 OM_uint32 min_stat
,maj_stat
;
41 gss_buffer_desc host_buf
;
44 pStr
= dupcat("host@", host
, NULL
);
46 host_buf
.value
= pStr
;
47 host_buf
.length
= strlen(pStr
);
49 maj_stat
= gss_import_name(&min_stat
, &host_buf
,
50 GSS_C_NT_HOSTBASED_SERVICE
, srv_name
);
53 if (maj_stat
== GSS_S_COMPLETE
) return SSH_GSS_OK
;
54 return SSH_GSS_FAILURE
;
57 Ssh_gss_stat
ssh_gss_acquire_cred(Ssh_gss_ctx
*ctx
)
59 uxSsh_gss_ctx
*uxctx
= snew(uxSsh_gss_ctx
);
61 uxctx
->maj_stat
= uxctx
->min_stat
= GSS_S_COMPLETE
;
62 uxctx
->ctx
= GSS_C_NO_CONTEXT
;
63 *ctx
= (Ssh_gss_ctx
) uxctx
;
68 Ssh_gss_stat
ssh_gss_init_sec_context(Ssh_gss_ctx
*ctx
,
69 Ssh_gss_name srv_name
,
71 Ssh_gss_buf
*recv_tok
,
72 Ssh_gss_buf
*send_tok
)
74 uxSsh_gss_ctx
*uxctx
= (uxSsh_gss_ctx
*) *ctx
;
77 if (to_deleg
) to_deleg
= GSS_C_DELEG_FLAG
;
78 uxctx
->maj_stat
= gss_init_sec_context(&uxctx
->min_stat
,
82 (gss_OID
) putty_gss_mech_krb5
,
84 GSS_C_INTEG_FLAG
| to_deleg
,
86 GSS_C_NO_CHANNEL_BINDINGS
,
88 NULL
, /* ignore mech type */
91 NULL
); /* ignore time_rec */
93 if (uxctx
->maj_stat
== GSS_S_COMPLETE
) return SSH_GSS_S_COMPLETE
;
94 if (uxctx
->maj_stat
== GSS_S_CONTINUE_NEEDED
) return SSH_GSS_S_CONTINUE_NEEDED
;
95 return SSH_GSS_FAILURE
;
98 Ssh_gss_stat
ssh_gss_display_status(Ssh_gss_ctx ctx
, Ssh_gss_buf
*buf
)
100 uxSsh_gss_ctx
*uxctx
= (uxSsh_gss_ctx
*) ctx
;
103 gss_buffer_desc msg_maj
=GSS_C_EMPTY_BUFFER
;
104 gss_buffer_desc msg_min
=GSS_C_EMPTY_BUFFER
;
106 /* Return empty buffer in case of failure */
107 SSH_GSS_CLEAR_BUF(buf
);
109 /* get first mesg from GSS */
111 lmax
=gss_display_status(&lmin
,uxctx
->maj_stat
,GSS_C_GSS_CODE
,(gss_OID
) putty_gss_mech_krb5
,&ccc
,&msg_maj
);
113 if (lmax
!= GSS_S_COMPLETE
) return SSH_GSS_FAILURE
;
115 /* get first mesg from Kerberos */
117 lmax
=gss_display_status(&lmin
,uxctx
->min_stat
,GSS_C_MECH_CODE
,(gss_OID
) putty_gss_mech_krb5
,&ccc
,&msg_min
);
119 if (lmax
!= GSS_S_COMPLETE
) {
120 gss_release_buffer(&lmin
, &msg_maj
);
121 return SSH_GSS_FAILURE
;
124 /* copy data into buffer */
125 buf
->length
= msg_maj
.length
+ msg_min
.length
+ 1;
126 buf
->value
= snewn(buf
->length
+ 1, char);
129 memcpy((char *)buf
->value
, msg_maj
.value
, msg_maj
.length
);
130 ((char *)buf
->value
)[msg_maj
.length
] = ' ';
131 memcpy((char *)buf
->value
+ msg_maj
.length
+ 1, msg_min
.value
, msg_min
.length
);
132 ((char *)buf
->value
)[buf
->length
] = 0;
133 /* free mem & exit */
134 gss_release_buffer(&lmin
, &msg_maj
);
135 gss_release_buffer(&lmin
, &msg_min
);
139 Ssh_gss_stat
ssh_gss_free_tok(Ssh_gss_buf
*send_tok
)
141 OM_uint32 min_stat
,maj_stat
;
142 maj_stat
= gss_release_buffer(&min_stat
, send_tok
);
144 if (maj_stat
== GSS_S_COMPLETE
) return SSH_GSS_OK
;
145 return SSH_GSS_FAILURE
;
148 Ssh_gss_stat
ssh_gss_release_cred(Ssh_gss_ctx
*ctx
)
150 uxSsh_gss_ctx
*uxctx
= (uxSsh_gss_ctx
*) *ctx
;
152 OM_uint32 maj_stat
=GSS_S_COMPLETE
;
154 if (uxctx
== NULL
) return SSH_GSS_FAILURE
;
155 if (uxctx
->ctx
!= GSS_C_NO_CONTEXT
)
156 maj_stat
= gss_delete_sec_context(&min_stat
,&uxctx
->ctx
,GSS_C_NO_BUFFER
);
159 if (maj_stat
== GSS_S_COMPLETE
) return SSH_GSS_OK
;
160 return SSH_GSS_FAILURE
;
164 Ssh_gss_stat
ssh_gss_release_name(Ssh_gss_name
*srv_name
)
166 OM_uint32 min_stat
,maj_stat
;
167 maj_stat
= gss_release_name(&min_stat
, srv_name
);
169 if (maj_stat
== GSS_S_COMPLETE
) return SSH_GSS_OK
;
170 return SSH_GSS_FAILURE
;
173 Ssh_gss_stat
ssh_gss_get_mic(Ssh_gss_ctx ctx
, Ssh_gss_buf
*buf
,
176 uxSsh_gss_ctx
*uxctx
= (uxSsh_gss_ctx
*) ctx
;
177 if (uxctx
== NULL
) return SSH_GSS_FAILURE
;
178 return gss_get_mic(&(uxctx
->min_stat
), uxctx
->ctx
, 0, buf
, hash
);
181 Ssh_gss_stat
ssh_gss_free_mic(Ssh_gss_buf
*hash
)
183 /* On Unix this is the same freeing process as ssh_gss_free_tok. */
184 return ssh_gss_free_tok(hash
);
189 /* Dummy function so this source file defines something if NO_GSSAPI
192 int ssh_gss_init(void)