4 #include <gssapi/gssapi_krb5.h>
8 typedef struct uxSsh_gss_ctx
{
14 int ssh_gss_init(void)
16 /* On Windows this tries to load the SSPI library functions. On
17 Unix we assume we have GSSAPI at runtime if we were linked with
22 Ssh_gss_stat
ssh_gss_indicate_mech(Ssh_gss_buf
*mech
)
24 /* Copy constant into mech */
25 mech
->len
= gss_mech_krb5
->length
;
26 mech
->data
= gss_mech_krb5
->elements
;
31 Ssh_gss_stat
ssh_gss_import_name(char *host
,
32 Ssh_gss_name
*srv_name
)
34 OM_uint32 min_stat
,maj_stat
;
35 gss_buffer_desc host_buf
;
38 pStr
= dupcat("host@", host
, NULL
);
40 host_buf
.value
= pStr
;
41 host_buf
.length
= strlen(pStr
);
43 maj_stat
= gss_import_name(&min_stat
, &host_buf
,
44 GSS_C_NT_HOSTBASED_SERVICE
,
45 (gss_name_t
*)srv_name
);
48 if (maj_stat
== GSS_S_COMPLETE
) return SSH_GSS_OK
;
49 return SSH_GSS_FAILURE
;
52 Ssh_gss_stat
ssh_gss_acquire_cred(Ssh_gss_ctx
*ctx
)
54 uxSsh_gss_ctx
*uxctx
= snew(uxSsh_gss_ctx
);
56 uxctx
->maj_stat
= uxctx
->min_stat
= GSS_S_COMPLETE
;
57 uxctx
->ctx
= GSS_C_NO_CONTEXT
;
58 *ctx
= (Ssh_gss_ctx
) uxctx
;
63 Ssh_gss_stat
ssh_gss_init_sec_context(Ssh_gss_ctx
*ctx
,
64 Ssh_gss_name srv_name
,
66 Ssh_gss_buf
*recv_tok
,
67 Ssh_gss_buf
*send_tok
)
69 uxSsh_gss_ctx
*uxctx
= (uxSsh_gss_ctx
*) *ctx
;
72 if (to_deleg
) to_deleg
= GSS_C_DELEG_FLAG
;
73 uxctx
->maj_stat
= gss_init_sec_context(&uxctx
->min_stat
,
76 (gss_name_t
) srv_name
,
77 (gss_OID
) gss_mech_krb5
,
79 GSS_C_INTEG_FLAG
| to_deleg
,
81 NULL
, /* no channel bindings */
82 (gss_buffer_desc
*)recv_tok
,
83 NULL
, /* ignore mech type */
84 (gss_buffer_desc
*)send_tok
,
86 NULL
); /* ignore time_rec */
88 if (uxctx
->maj_stat
== GSS_S_COMPLETE
) return SSH_GSS_S_COMPLETE
;
89 if (uxctx
->maj_stat
== GSS_S_CONTINUE_NEEDED
) return SSH_GSS_S_CONTINUE_NEEDED
;
90 return SSH_GSS_FAILURE
;
93 Ssh_gss_stat
ssh_gss_display_status(Ssh_gss_ctx ctx
, Ssh_gss_buf
*buf
)
95 uxSsh_gss_ctx
*uxctx
= (uxSsh_gss_ctx
*) ctx
;
98 gss_buffer_desc msg_maj
=GSS_C_EMPTY_BUFFER
;
99 gss_buffer_desc msg_min
=GSS_C_EMPTY_BUFFER
;
101 /* Return empty buffer in case of failure */
102 SSH_GSS_CLEAR_BUF(buf
);
104 /* get first mesg from GSS */
106 lmax
=gss_display_status(&lmin
,uxctx
->maj_stat
,GSS_C_GSS_CODE
,(gss_OID
) gss_mech_krb5
,&ccc
,&msg_maj
);
108 if (lmax
!= GSS_S_COMPLETE
) return SSH_GSS_FAILURE
;
110 /* get first mesg from Kerberos */
112 lmax
=gss_display_status(&lmin
,uxctx
->min_stat
,GSS_C_MECH_CODE
,(gss_OID
) gss_mech_krb5
,&ccc
,&msg_min
);
114 if (lmax
!= GSS_S_COMPLETE
) {
115 gss_release_buffer(&lmin
, &msg_maj
);
116 return SSH_GSS_FAILURE
;
119 /* copy data into buffer */
120 buf
->len
= msg_maj
.length
+ msg_min
.length
+ 1;
121 buf
->data
= snewn(buf
->len
+ 1, char);
124 memcpy(buf
->data
, msg_maj
.value
, msg_maj
.length
);
125 buf
->data
[msg_maj
.length
] = ' ';
126 memcpy(buf
->data
+ msg_maj
.length
+ 1, msg_min
.value
, msg_min
.length
);
127 buf
->data
[buf
->len
] = 0;
128 /* free mem & exit */
129 gss_release_buffer(&lmin
, &msg_maj
);
130 gss_release_buffer(&lmin
, &msg_min
);
134 Ssh_gss_stat
ssh_gss_free_tok(Ssh_gss_buf
*send_tok
)
136 OM_uint32 min_stat
,maj_stat
;
137 maj_stat
= gss_release_buffer(&min_stat
, (gss_buffer_desc
*)send_tok
);
139 if (maj_stat
== GSS_S_COMPLETE
) return SSH_GSS_OK
;
140 return SSH_GSS_FAILURE
;
143 Ssh_gss_stat
ssh_gss_release_cred(Ssh_gss_ctx
*ctx
)
145 uxSsh_gss_ctx
*uxctx
= (uxSsh_gss_ctx
*) *ctx
;
147 OM_uint32 maj_stat
=GSS_S_COMPLETE
;
149 if (uxctx
== NULL
) return SSH_GSS_FAILURE
;
150 if (uxctx
->ctx
!= GSS_C_NO_CONTEXT
)
151 maj_stat
= gss_delete_sec_context(&min_stat
,&uxctx
->ctx
,GSS_C_NO_BUFFER
);
154 if (maj_stat
== GSS_S_COMPLETE
) return SSH_GSS_OK
;
155 return SSH_GSS_FAILURE
;
159 Ssh_gss_stat
ssh_gss_release_name(Ssh_gss_name
*srv_name
)
161 OM_uint32 min_stat
,maj_stat
;
162 maj_stat
= gss_release_name(&min_stat
, (gss_name_t
) srv_name
);
164 if (maj_stat
== GSS_S_COMPLETE
) return SSH_GSS_OK
;
165 return SSH_GSS_FAILURE
;
168 Ssh_gss_stat
ssh_gss_get_mic(Ssh_gss_ctx ctx
, Ssh_gss_buf
*buf
,
171 uxSsh_gss_ctx
*uxctx
= (uxSsh_gss_ctx
*) ctx
;
172 if (uxctx
== NULL
) return SSH_GSS_FAILURE
;
173 return gss_get_mic(&(uxctx
->min_stat
),
176 (gss_buffer_desc
*)buf
,
177 (gss_buffer_desc
*)hash
);
180 Ssh_gss_stat
ssh_gss_free_mic(Ssh_gss_buf
*hash
)
182 /* On Unix this is the same freeing process as ssh_gss_free_tok. */
183 return ssh_gss_free_tok(hash
);
188 /* Dummy function so this source file defines something if NO_GSSAPI
191 int ssh_gss_init(void)