git.distorted.org.uk Git - u/mdw/putty/blob - unix/uxgss.c

   1 #ifndef NO_GSSAPI
   2
   3 #include <string.h>
   4 #include <gssapi/gssapi.h>
   5 #include "sshgss.h"
   6 #include "misc.h"
   7
   8 static gss_OID_desc gss_mech_krb5_desc =
   9     { 9, (void *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
  10 static gss_OID const gss_mech_krb5 = &gss_mech_krb5_desc;
  11
  12 typedef struct uxSsh_gss_ctx {
  13     OM_uint32 maj_stat;
  14     OM_uint32 min_stat;
  15     gss_ctx_id_t ctx;
  16 } uxSsh_gss_ctx;
  17
  18 int ssh_gss_init(void)
  19 {
  20     /* On Windows this tries to load the SSPI library functions.  On
  21        Unix we assume we have GSSAPI at runtime if we were linked with
  22        it at compile time */
  23     return 1;
  24 }
  25
  26 Ssh_gss_stat ssh_gss_indicate_mech(Ssh_gss_buf *mech)
  27 {
  28     /* Copy constant into mech */
  29     mech->len  = gss_mech_krb5->length;
  30     mech->data = gss_mech_krb5->elements;
  31
  32     return SSH_GSS_OK;
  33 }
  34
  35 Ssh_gss_stat ssh_gss_import_name(char *host,
  36                                  Ssh_gss_name *srv_name)
  37 {
  38     OM_uint32 min_stat,maj_stat;
  39     gss_buffer_desc host_buf;
  40     char *pStr;
  41
  42     pStr = dupcat("host@", host, NULL);
  43
  44     host_buf.value = pStr;
  45     host_buf.length = strlen(pStr);
  46
  47     maj_stat = gss_import_name(&min_stat, &host_buf,
  48                                GSS_C_NT_HOSTBASED_SERVICE,
  49                                (gss_name_t *)srv_name);
  50     /* Release buffer */
  51     sfree(pStr);
  52     if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
  53     return SSH_GSS_FAILURE;
  54 }
  55
  56 Ssh_gss_stat ssh_gss_acquire_cred(Ssh_gss_ctx *ctx)
  57 {
  58     uxSsh_gss_ctx *uxctx = snew(uxSsh_gss_ctx);
  59
  60     uxctx->maj_stat =  uxctx->min_stat = GSS_S_COMPLETE;
  61     uxctx->ctx = GSS_C_NO_CONTEXT;
  62     *ctx = (Ssh_gss_ctx) uxctx;
  63
  64     return SSH_GSS_OK;
  65 }
  66
  67 Ssh_gss_stat ssh_gss_init_sec_context(Ssh_gss_ctx *ctx,
  68                                       Ssh_gss_name srv_name,
  69                                       int to_deleg,
  70                                       Ssh_gss_buf *recv_tok,
  71                                       Ssh_gss_buf *send_tok)
  72 {
  73     uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx*) *ctx;
  74     OM_uint32 ret_flags;
  75
  76     if (to_deleg) to_deleg = GSS_C_DELEG_FLAG;
  77     uxctx->maj_stat = gss_init_sec_context(&uxctx->min_stat,
  78                                            GSS_C_NO_CREDENTIAL,
  79                                            &uxctx->ctx,
  80                                            (gss_name_t) srv_name,
  81                                            (gss_OID) gss_mech_krb5,
  82                                            GSS_C_MUTUAL_FLAG |
  83                                            GSS_C_INTEG_FLAG | to_deleg,
  84                                            0,
  85                                            NULL,   /* no channel bindings */
  86                                            (gss_buffer_desc *)recv_tok,
  87                                            NULL,   /* ignore mech type */
  88                                            (gss_buffer_desc *)send_tok,
  89                                            &ret_flags,
  90                                            NULL);  /* ignore time_rec */
  91
  92     if (uxctx->maj_stat == GSS_S_COMPLETE) return SSH_GSS_S_COMPLETE;
  93     if (uxctx->maj_stat == GSS_S_CONTINUE_NEEDED) return SSH_GSS_S_CONTINUE_NEEDED;
  94     return SSH_GSS_FAILURE;
  95 }
  96
  97 Ssh_gss_stat ssh_gss_display_status(Ssh_gss_ctx ctx, Ssh_gss_buf *buf)
  98 {
  99     uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx *) ctx;
 100     OM_uint32 lmin,lmax;
 101     OM_uint32 ccc;
 102     gss_buffer_desc msg_maj=GSS_C_EMPTY_BUFFER;
 103     gss_buffer_desc msg_min=GSS_C_EMPTY_BUFFER;
 104
 105     /* Return empty buffer in case of failure */
 106     SSH_GSS_CLEAR_BUF(buf);
 107
 108     /* get first mesg from GSS */
 109     ccc=0;
 110     lmax=gss_display_status(&lmin,uxctx->maj_stat,GSS_C_GSS_CODE,(gss_OID) gss_mech_krb5,&ccc,&msg_maj);
 111
 112     if (lmax != GSS_S_COMPLETE) return SSH_GSS_FAILURE;
 113
 114     /* get first mesg from Kerberos */
 115     ccc=0;
 116     lmax=gss_display_status(&lmin,uxctx->min_stat,GSS_C_MECH_CODE,(gss_OID) gss_mech_krb5,&ccc,&msg_min);
 117
 118     if (lmax != GSS_S_COMPLETE) {
 119         gss_release_buffer(&lmin, &msg_maj);
 120         return SSH_GSS_FAILURE;
 121     }
 122
 123     /* copy data into buffer */
 124     buf->len = msg_maj.length + msg_min.length + 1;
 125     buf->data = snewn(buf->len + 1, char);
 126
 127     /* copy mem */
 128     memcpy(buf->data, msg_maj.value, msg_maj.length);
 129     buf->data[msg_maj.length] = ' ';
 130     memcpy(buf->data + msg_maj.length + 1, msg_min.value, msg_min.length);
 131     buf->data[buf->len] = 0;
 132     /* free mem & exit */
 133     gss_release_buffer(&lmin, &msg_maj);
 134     gss_release_buffer(&lmin, &msg_min);
 135     return SSH_GSS_OK;
 136 }
 137
 138 Ssh_gss_stat ssh_gss_free_tok(Ssh_gss_buf *send_tok)
 139 {
 140     OM_uint32 min_stat,maj_stat;
 141     maj_stat = gss_release_buffer(&min_stat, (gss_buffer_desc *)send_tok);
 142
 143     if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
 144     return SSH_GSS_FAILURE;
 145 }
 146
 147 Ssh_gss_stat ssh_gss_release_cred(Ssh_gss_ctx *ctx)
 148 {
 149     uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx *) *ctx;
 150     OM_uint32 min_stat;
 151     OM_uint32 maj_stat=GSS_S_COMPLETE;
 152
 153     if (uxctx == NULL) return SSH_GSS_FAILURE;
 154     if (uxctx->ctx != GSS_C_NO_CONTEXT)
 155         maj_stat = gss_delete_sec_context(&min_stat,&uxctx->ctx,GSS_C_NO_BUFFER);
 156     sfree(uxctx);
 157
 158     if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
 159     return SSH_GSS_FAILURE;
 160 }
 161
 162
 163 Ssh_gss_stat ssh_gss_release_name(Ssh_gss_name *srv_name)
 164 {
 165     OM_uint32 min_stat,maj_stat;
 166     maj_stat = gss_release_name(&min_stat, (gss_name_t *) srv_name);
 167
 168     if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
 169     return SSH_GSS_FAILURE;
 170 }
 171
 172 Ssh_gss_stat ssh_gss_get_mic(Ssh_gss_ctx ctx, Ssh_gss_buf *buf,
 173                              Ssh_gss_buf *hash)
 174 {
 175     uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx *) ctx;
 176     if (uxctx == NULL) return SSH_GSS_FAILURE;
 177     return gss_get_mic(&(uxctx->min_stat),
 178                        uxctx->ctx,
 179                        0,
 180                        (gss_buffer_desc *)buf,
 181                        (gss_buffer_desc *)hash);
 182 }
 183
 184 Ssh_gss_stat ssh_gss_free_mic(Ssh_gss_buf *hash)
 185 {
 186     /* On Unix this is the same freeing process as ssh_gss_free_tok. */
 187     return ssh_gss_free_tok(hash);
 188 }
 189
 190 #else
 191
 192 /* Dummy function so this source file defines something if NO_GSSAPI
 193    is defined. */
 194
 195 int ssh_gss_init(void)
 196 {
 197     return 1;
 198 }
 199
 200 #endif