1 /* -*- mode: c; indent-tabs-mode: nil -*- */
2 /*
3 * Copyright 2000, 2008 by the Massachusetts Institute of Technology.
4 * All Rights Reserved.
5 *
6 * Export of this software from the United States of America may
7 * require a specific license from the United States Government.
8 * It is the responsibility of any person or organization contemplating
9 * export to obtain such a license before exporting.
10 *
11 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
12 * distribute this software and its documentation for any purpose and
13 * without fee is hereby granted, provided that the above copyright
14 * notice appear in all copies and that both that copyright notice and
15 * this permission notice appear in supporting documentation, and that
16 * the name of M.I.T. not be used in advertising or publicity pertaining
17 * to distribution of the software without specific, written prior
18 * permission. Furthermore if you modify this software you must label
19 * your software as modified software and not distribute it in such a
20 * fashion that it might be confused with the original M.I.T. software.
21 * M.I.T. makes no representations about the suitability of
22 * this software for any purpose. It is provided "as is" without express
23 * or implied warranty.
24 *
25 */
26 /*
27 * Copyright 1993 by OpenVision Technologies, Inc.
28 *
29 * Permission to use, copy, modify, distribute, and sell this software
30 * and its documentation for any purpose is hereby granted without fee,
31 * provided that the above copyright notice appears in all copies and
32 * that both that copyright notice and this permission notice appear in
33 * supporting documentation, and that the name of OpenVision not be used
34 * in advertising or publicity pertaining to distribution of the software
35 * without specific, written prior permission. OpenVision makes no
36 * representations about the suitability of this software for any
37 * purpose. It is provided "as is" without express or implied warranty.
38 *
39 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
40 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
41 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
42 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
43 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
44 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
45 * PERFORMANCE OF THIS SOFTWARE.
46 */
47
48 #ifndef _GSSAPIP_KRB5_H_
49 #define _GSSAPIP_KRB5_H_
50
51 #include <k5-int.h>
52
53 #ifdef HAVE_MEMORY_H
54 #include <memory.h>
55 #endif
56
57 /* work around sunos braindamage */
58 #ifdef major
59 #undef major
60 #endif
61 #ifdef minor
62 #undef minor
63 #endif
64
65 #include "gssapiP_generic.h"
66
67 /* The include of gssapi_krb5.h will dtrt with the above #defines in
68 * effect.
69 */
70 #include "gssapi_krb5.h"
71 #include "gssapi_err_krb5.h"
72 #include "gssapi_ext.h"
73
74 /* for debugging */
75 #undef CFX_EXERCISE
76
77 /** constants **/
78
79 #define GSS_MECH_KRB5_OID_LENGTH 9
80 #define GSS_MECH_KRB5_OID "\052\206\110\206\367\022\001\002\002"
81
82 #define GSS_MECH_KRB5_OLD_OID_LENGTH 5
83 #define GSS_MECH_KRB5_OLD_OID "\053\005\001\005\002"
84
85 /* Incorrect krb5 mech OID emitted by MS. */
86 #define GSS_MECH_KRB5_WRONG_OID_LENGTH 9
87 #define GSS_MECH_KRB5_WRONG_OID "\052\206\110\202\367\022\001\002\002"
88
89 /* IAKERB variant */
90 #define GSS_MECH_IAKERB_OID_LENGTH 6
91 #define GSS_MECH_IAKERB_OID "\053\006\001\005\002\005"
92
93 extern const gss_OID_set kg_all_mechs;
94
95 #define CKSUMTYPE_KG_CB 0x8003
96
97 #define KG_TOK_CTX_AP_REQ 0x0100
98 #define KG_TOK_CTX_AP_REP 0x0200
99 #define KG_TOK_CTX_ERROR 0x0300
100 #define KG_TOK_SIGN_MSG 0x0101
101 #define KG_TOK_SEAL_MSG 0x0201
102 #define KG_TOK_MIC_MSG 0x0101
103 #define KG_TOK_WRAP_MSG 0x0201
104 #define KG_TOK_DEL_CTX 0x0102
105 #define KG2_TOK_MIC_MSG 0x0404
106 #define KG2_TOK_WRAP_MSG 0x0504
107 #define KG2_TOK_DEL_CTX 0x0405
108 #define IAKERB_TOK_PROXY 0x0501
109
110 #define KRB5_GSS_FOR_CREDS_OPTION 1
111
112 #define KG2_RESP_FLAG_ERROR 0x0001
113 #define KG2_RESP_FLAG_DELEG_OK 0x0002
114
115 /** CFX flags **/
116 #define FLAG_SENDER_IS_ACCEPTOR 0x01
117 #define FLAG_WRAP_CONFIDENTIAL 0x02
118 #define FLAG_ACCEPTOR_SUBKEY 0x04
119
120 /* These are to be stored in little-endian order, i.e., des-mac is
121 stored as 02 00. */
122 enum sgn_alg {
123 /* SGN_ALG_DES_MAC_MD5 = 0x0000, */
124 /* SGN_ALG_MD2_5 = 0x0001, */
125 /* SGN_ALG_DES_MAC = 0x0002, */
126 /* SGN_ALG_3 = 0x0003, /\* not published *\/ */
127 SGN_ALG_HMAC_MD5 = 0x0011, /* microsoft w2k; */
128 SGN_ALG_HMAC_SHA1_DES3_KD = 0x0004
129 };
130 enum seal_alg {
131 SEAL_ALG_NONE = 0xffff,
132 /* SEAL_ALG_DES = 0x0000, */
133 /* SEAL_ALG_1 = 0x0001, /\* not published *\/ */
134 SEAL_ALG_MICROSOFT_RC4 = 0x0010, /* microsoft w2k; */
135 SEAL_ALG_DES3KD = 0x0002
136 };
137
138 /* for 3DES */
139 #define KG_USAGE_SEAL 22
140 #define KG_USAGE_SIGN 23
141 #define KG_USAGE_SEQ 24
142
143 /* for draft-ietf-krb-wg-gssapi-cfx-01 */
144 #define KG_USAGE_ACCEPTOR_SEAL 22
145 #define KG_USAGE_ACCEPTOR_SIGN 23
146 #define KG_USAGE_INITIATOR_SEAL 24
147 #define KG_USAGE_INITIATOR_SIGN 25
148
149 enum qop {
150 /* GSS_KRB5_INTEG_C_QOP_MD5 = 0x0001, */
151 /* GSS_KRB5_INTEG_C_QOP_DES_MD5 = 0x0002, */
152 /* GSS_KRB5_INTEG_C_QOP_DES_MAC = 0x0003, */
153 GSS_KRB5_INTEG_C_QOP_HMAC_SHA1 = 0x0004,
154 GSS_KRB5_INTEG_C_QOP_MASK = 0x00ff,
155 /* GSS_KRB5_CONF_C_QOP_DES = 0x0100, */
156 GSS_KRB5_CONF_C_QOP_DES3_KD = 0x0200,
157 GSS_KRB5_CONF_C_QOP_MASK = 0xff00
158 };
159
160 /** internal types **/
161
162 typedef struct _krb5_gss_name_rec {
163 krb5_principal princ; /* immutable */
164 char *service; /* immutable */
165 char *host; /* immutable */
166 int is_cert; /* immutable */
167 k5_mutex_t lock; /* protects ad_context only for now */
168 krb5_authdata_context ad_context;
169 } krb5_gss_name_rec, *krb5_gss_name_t;
170
171 typedef struct _krb5_gss_cred_id_rec {
172 /* protect against simultaneous accesses */
173 k5_mutex_t lock;
174
175 /* name/type of credential */
176 gss_cred_usage_t usage;
177 krb5_gss_name_t name;
178 krb5_principal acceptor_mprinc;
179 krb5_principal impersonator;
180 unsigned int default_identity : 1;
181 unsigned int iakerb_mech : 1;
182 unsigned int destroy_ccache : 1;
183 unsigned int suppress_ci_flags : 1;
184
185 /* keytab (accept) data */
186 krb5_keytab keytab;
187 krb5_rcache rcache;
188
189 /* ccache (init) data */
190 krb5_ccache ccache;
191 krb5_keytab client_keytab;
192 krb5_boolean have_tgt;
193 krb5_timestamp expire;
194 krb5_timestamp refresh_time;
195 krb5_enctype *req_enctypes; /* limit negotiated enctypes to this list */
196 char *password;
197 } krb5_gss_cred_id_rec, *krb5_gss_cred_id_t;
198
199 typedef struct _krb5_gss_ctx_ext_rec {
200 struct {
201 krb5_data *conv;
202 int verified;
203 } iakerb;
204 } krb5_gss_ctx_ext_rec, *krb5_gss_ctx_ext_t;
205
206 typedef struct _krb5_gss_ctx_id_rec {
207 krb5_magic magic;
208 unsigned int initiate : 1; /* nonzero if initiating, zero if accepting */
209 unsigned int established : 1;
210 unsigned int have_acceptor_subkey : 1;
211 unsigned int seed_init : 1; /* XXX tested but never actually set */
212 unsigned int terminated : 1;
213 OM_uint32 gss_flags;
214 unsigned char seed[16];
215 krb5_gss_name_t here;
216 krb5_gss_name_t there;
217 krb5_key subkey; /* One of two potential keys to use with RFC 4121
218 * packets; this key must always be set. */
219 int signalg;
220 size_t cksum_size;
221 int sealalg;
222 krb5_key enc; /* RFC 1964 encryption key; seq xored with a constant
223 * for DES, seq for other RFC 1964 enctypes */
224 krb5_key seq; /* RFC 1964 sequencing key */
225 krb5_ticket_times krb_times;
226 krb5_flags krb_flags;
227 /* XXX these used to be signed. the old spec is inspecific, and
228 the new spec specifies unsigned. I don't believe that the change
229 affects the wire encoding. */
230 uint64_t seq_send;
231 uint64_t seq_recv;
232 g_seqnum_state seqstate;
233 krb5_context k5_context;
234 krb5_auth_context auth_context;
235 gss_OID_desc *mech_used;
236 /* Protocol spec revision for sending packets
237 0 => RFC 1964 with 3DES and RC4 enhancements
238 1 => RFC 4121
239 No others defined so far. It is always permitted to receive
240 tokens in RFC 4121 format. If enc is non-null, receiving RFC
241 1964 tokens is permitted.*/
242 int proto;
243 krb5_cksumtype cksumtype; /* for "main" subkey */
244 krb5_key acceptor_subkey; /* CFX only */
245 krb5_cksumtype acceptor_subkey_cksumtype;
246 int cred_rcache; /* did we get rcache from creds? */
247 krb5_authdata **authdata;
248 } krb5_gss_ctx_id_rec, *krb5_gss_ctx_id_t;
249
250 #ifndef LEAN_CLIENT
251 extern k5_mutex_t gssint_krb5_keytab_lock;
252 #endif /* LEAN_CLIENT */
253
254 /** helper functions **/
255
256 OM_uint32 kg_get_defcred
257 (OM_uint32 *minor_status,
258 gss_cred_id_t *cred);
259
260 krb5_error_code kg_checksum_channel_bindings
261 (krb5_context context, gss_channel_bindings_t cb,
262 krb5_checksum *cksum);
263
264 krb5_error_code kg_make_seq_num (krb5_context context,
265 krb5_key key,
266 int direction, krb5_ui_4 seqnum, unsigned char *cksum,
267 unsigned char *buf);
268
269 krb5_error_code kg_get_seq_num (krb5_context context, krb5_key key,
270 const uint8_t *cksum, const uint8_t *buf,
271 int *direction, krb5_ui_4 *seqnum);
272
273 krb5_error_code kg_make_seed (krb5_context context,
274 krb5_key key,
275 unsigned char *seed);
276
277 krb5_error_code
278 kg_setup_keys(krb5_context context,
279 krb5_gss_ctx_id_rec *ctx,
280 krb5_key subkey,
281 krb5_cksumtype *cksumtype);
282
283 int kg_confounder_size (krb5_context context, krb5_enctype enctype);
284
285 krb5_error_code kg_make_confounder (krb5_context context,
286 krb5_enctype enctype, unsigned char *buf);
287
288 krb5_error_code kg_encrypt (krb5_context context,
289 krb5_key key, int usage,
290 krb5_pointer iv,
291 krb5_const_pointer in,
292 krb5_pointer out,
293 unsigned int length);
294
295 /* Encrypt length bytes at ptr in place, with the given key and usage. If
296 * iv is not NULL, use it as the cipher state. */
297 krb5_error_code kg_encrypt_inplace(krb5_context context, krb5_key key,
298 int usage, krb5_pointer iv,
299 krb5_pointer ptr, unsigned int length);
300
301 krb5_error_code kg_encrypt_iov (krb5_context context,
302 int proto, int dce_style,
303 size_t ec, size_t rrc,
304 krb5_key key, int usage,
305 krb5_pointer iv,
306 gss_iov_buffer_desc *iov,
307 int iov_count);
308
309 krb5_error_code
310 kg_arcfour_docrypt (const krb5_keyblock *keyblock, int usage,
311 const unsigned char *kd_data, size_t kd_data_len,
312 const unsigned char *input_buf, size_t input_len,
313 unsigned char *output_buf);
314
315 krb5_error_code
316 kg_arcfour_docrypt_iov (krb5_context context,
317 const krb5_keyblock *keyblock, int usage,
318 const unsigned char *kd_data, size_t kd_data_len,
319 gss_iov_buffer_desc *iov,
320 int iov_count);
321
322 krb5_error_code kg_decrypt (krb5_context context, krb5_key key, int usage,
323 const uint8_t *iv, const uint8_t *in, uint8_t *out,
324 unsigned int length);
325
326 krb5_boolean
327 kg_verify_checksum_v1(krb5_context context, uint16_t signalg, krb5_key key,
328 krb5_keyusage usage, const uint8_t *header,
329 const uint8_t *data, size_t data_len,
330 const uint8_t *cksum, size_t cksum_len);
331
332 krb5_boolean
333 kg_verify_checksum_v3(krb5_context context, krb5_key key, krb5_keyusage usage,
334 krb5_cksumtype cksumtype,
335 uint16_t toktype, uint8_t flags, uint64_t seqnum,
336 const uint8_t *data, size_t data_len,
337 const uint8_t *cksum, size_t cksum_len);
338
339 krb5_error_code kg_decrypt_iov (krb5_context context,
340 int proto, int dce_style,
341 size_t ec, size_t rrc,
342 krb5_key key, int usage,
343 krb5_pointer iv,
344 gss_iov_buffer_desc *iov,
345 int iov_count);
346
347 OM_uint32
348 kg_verify_mic_v1(krb5_context context, OM_uint32 *minor_status,
349 krb5_gss_ctx_id_rec *ctx, uint16_t exp_toktype,
350 struct k5input *in, gss_buffer_t message);
351
352 OM_uint32 kg_seal (OM_uint32 *minor_status,
353 gss_ctx_id_t context_handle,
354 int conf_req_flag,
355 gss_qop_t qop_req,
356 gss_buffer_t input_message_buffer,
357 int *conf_state,
358 gss_buffer_t output_message_buffer,
359 int toktype);
360
361 OM_uint32 kg_seal_size (OM_uint32 *minor_status,
362 gss_ctx_id_t context_handle,
363 int conf_req_flag,
364 gss_qop_t qop_req,
365 OM_uint32 output_size,
366 OM_uint32 *input_size);
367
368 krb5_error_code kg_ctx_size (krb5_context kcontext,
369 krb5_gss_ctx_id_t ctx,
370 size_t *sizep);
371
372 krb5_error_code kg_ctx_externalize (krb5_context kcontext,
373 krb5_gss_ctx_id_t ctx,
374 krb5_octet **buffer,
375 size_t *lenremain);
376
377 krb5_error_code kg_ctx_internalize (krb5_context kcontext,
378 krb5_gss_ctx_id_t *argp,
379 krb5_octet **buffer,
380 size_t *lenremain);
381
382 OM_uint32 kg_sync_ccache_name (krb5_context context, OM_uint32 *minor_status);
383
384 OM_uint32 kg_caller_provided_ccache_name (OM_uint32 *minor_status,
385 int *out_caller_provided_name);
386
387 OM_uint32 kg_get_ccache_name (OM_uint32 *minor_status, char **out_name);
388
389 OM_uint32 kg_set_ccache_name (OM_uint32 *minor_status,
390 const char *name);
391
392 /* AEAD */
393
394 krb5_error_code gss_krb5int_make_seal_token_v3_iov(krb5_context context,
395 krb5_gss_ctx_id_rec *ctx,
396 int conf_req_flag,
397 int *conf_state,
398 gss_iov_buffer_desc *iov,
399 int iov_count,
400 int toktype);
401
402 OM_uint32 gss_krb5int_unseal_v3_iov(krb5_context context,
403 OM_uint32 *minor_status,
404 krb5_gss_ctx_id_rec *ctx,
405 gss_iov_buffer_desc *iov,
406 int iov_count,
407 int *conf_state,
408 gss_qop_t *qop_state,
409 int toktype);
410
411 gss_iov_buffer_t kg_locate_iov (gss_iov_buffer_desc *iov,
412 int iov_count,
413 OM_uint32 type);
414
415 gss_iov_buffer_t kg_locate_header_iov(gss_iov_buffer_desc *iov, int iov_count,
416 int toktype);
417
418 void kg_iov_msglen(gss_iov_buffer_desc *iov,
419 int iov_count,
420 size_t *data_length,
421 size_t *assoc_data_length);
422
423 void kg_release_iov(gss_iov_buffer_desc *iov,
424 int iov_count);
425
426 krb5_error_code kg_make_checksum_iov_v1(krb5_context context,
427 krb5_cksumtype type,
428 size_t token_cksum_len,
429 krb5_key seq,
430 krb5_key enc, /* for conf len */
431 krb5_keyusage sign_usage,
432 gss_iov_buffer_desc *iov,
433 int iov_count,
434 int toktype,
435 krb5_checksum *checksum);
436
437 krb5_error_code kg_make_checksum_iov_v3(krb5_context context,
438 krb5_cksumtype type,
439 size_t rrc,
440 krb5_key key,
441 krb5_keyusage sign_usage,
442 gss_iov_buffer_desc *iov,
443 int iov_count,
444 int toktype);
445
446 krb5_error_code kg_verify_checksum_iov_v3(krb5_context context,
447 krb5_cksumtype type,
448 size_t rrc,
449 krb5_key key,
450 krb5_keyusage sign_usage,
451 gss_iov_buffer_desc *iov,
452 int iov_count,
453 int toktype,
454 krb5_boolean *valid);
455
456 OM_uint32 kg_seal_iov (OM_uint32 *minor_status,
457 gss_ctx_id_t context_handle,
458 int conf_req_flag,
459 gss_qop_t qop_req,
460 int *conf_state,
461 gss_iov_buffer_desc *iov,
462 int iov_count,
463 int toktype);
464
465 OM_uint32 kg_unseal_iov (OM_uint32 *minor_status,
466 gss_ctx_id_t context_handle,
467 int *conf_state,
468 gss_qop_t *qop_state,
469 gss_iov_buffer_desc *iov,
470 int iov_count,
471 int toktype);
472
473 OM_uint32 kg_seal_iov_length(OM_uint32 *minor_status,
474 gss_ctx_id_t context_handle,
475 int conf_req_flag,
476 gss_qop_t qop_req,
477 int *conf_state,
478 gss_iov_buffer_desc *iov,
479 int iov_count,
480 int toktype);
481
482 krb5_cryptotype kg_translate_flag_iov(OM_uint32 type);
483
484 OM_uint32 kg_fixup_padding_iov(OM_uint32 *minor_status,
485 gss_iov_buffer_desc *iov,
486 int iov_count);
487
488 krb5_boolean kg_integ_only_iov(gss_iov_buffer_desc *iov, int iov_count);
489
490 krb5_error_code kg_allocate_iov(gss_iov_buffer_t iov, size_t size);
491
492 krb5_error_code
493 krb5_to_gss_cred(krb5_context context,
494 krb5_creds *creds,
495 krb5_gss_cred_id_t *out_cred);
496
497 krb5_boolean
498 kg_cred_time_to_refresh(krb5_context context, krb5_gss_cred_id_rec *cred);
499
500 void
501 kg_cred_set_initial_refresh(krb5_context context, krb5_gss_cred_id_rec *cred,
502 krb5_ticket_times *times);
503
504 OM_uint32
505 kg_cred_resolve(OM_uint32 *minor_status, krb5_context context,
506 gss_cred_id_t cred_handle, gss_name_t target_name);
507
508 /** declarations of internal name mechanism functions **/
509
510 OM_uint32 KRB5_CALLCONV krb5_gss_acquire_cred
511 (OM_uint32*, /* minor_status */
512 gss_name_t, /* desired_name */
513 OM_uint32, /* time_req */
514 gss_OID_set, /* desired_mechs */
515 gss_cred_usage_t, /* cred_usage */
516 gss_cred_id_t*, /* output_cred_handle */
517 gss_OID_set*, /* actual_mechs */
518 OM_uint32* /* time_rec */
519 );
520
521 OM_uint32 KRB5_CALLCONV iakerb_gss_acquire_cred
522 (OM_uint32*, /* minor_status */
523 gss_name_t, /* desired_name */
524 OM_uint32, /* time_req */
525 gss_OID_set, /* desired_mechs */
526 gss_cred_usage_t, /* cred_usage */
527 gss_cred_id_t*, /* output_cred_handle */
528 gss_OID_set*, /* actual_mechs */
529 OM_uint32* /* time_rec */
530 );
531
532 OM_uint32 KRB5_CALLCONV
533 krb5_gss_acquire_cred_with_password(
534 OM_uint32 *minor_status,
535 const gss_name_t desired_name,
536 const gss_buffer_t password,
537 OM_uint32 time_req,
538 const gss_OID_set desired_mechs,
539 int cred_usage,
540 gss_cred_id_t *output_cred_handle,
541 gss_OID_set *actual_mechs,
542 OM_uint32 *time_rec);
543
544 OM_uint32 KRB5_CALLCONV
545 iakerb_gss_acquire_cred_with_password(
546 OM_uint32 *minor_status,
547 const gss_name_t desired_name,
548 const gss_buffer_t password,
549 OM_uint32 time_req,
550 const gss_OID_set desired_mechs,
551 int cred_usage,
552 gss_cred_id_t *output_cred_handle,
553 gss_OID_set *actual_mechs,
554 OM_uint32 *time_rec);
555
556 OM_uint32 KRB5_CALLCONV
557 iakerb_gss_acquire_cred_from(OM_uint32 *minor_status,
558 const gss_name_t desired_name,
559 OM_uint32 time_req,
560 const gss_OID_set desired_mechs,
561 gss_cred_usage_t cred_usage,
562 gss_const_key_value_set_t cred_store,
563 gss_cred_id_t *output_cred_handle,
564 gss_OID_set *actual_mechs,
565 OM_uint32 *time_rec);
566
567 OM_uint32 KRB5_CALLCONV krb5_gss_release_cred
568 (OM_uint32*, /* minor_status */
569 gss_cred_id_t* /* cred_handle */
570 );
571
572 OM_uint32 KRB5_CALLCONV krb5_gss_init_sec_context
573 (OM_uint32*, /* minor_status */
574 gss_cred_id_t, /* claimant_cred_handle */
575 gss_ctx_id_t*, /* context_handle */
576 gss_name_t, /* target_name */
577 gss_OID, /* mech_type */
578 OM_uint32, /* req_flags */
579 OM_uint32, /* time_req */
580 gss_channel_bindings_t,
581 /* input_chan_bindings */
582 gss_buffer_t, /* input_token */
583 gss_OID*, /* actual_mech_type */
584 gss_buffer_t, /* output_token */
585 OM_uint32*, /* ret_flags */
586 OM_uint32* /* time_rec */
587 );
588
589 OM_uint32 krb5_gss_init_sec_context_ext
590 (OM_uint32*, /* minor_status */
591 gss_cred_id_t, /* claimant_cred_handle */
592 gss_ctx_id_t*, /* context_handle */
593 gss_name_t, /* target_name */
594 gss_OID, /* mech_type */
595 OM_uint32, /* req_flags */
596 OM_uint32, /* time_req */
597 gss_channel_bindings_t,
598 /* input_chan_bindings */
599 gss_buffer_t, /* input_token */
600 gss_OID*, /* actual_mech_type */
601 gss_buffer_t, /* output_token */
602 OM_uint32*, /* ret_flags */
603 OM_uint32*, /* time_rec */
604 krb5_gss_ctx_ext_t /* exts */
605 );
606
607 #ifndef LEAN_CLIENT
608 OM_uint32 KRB5_CALLCONV krb5_gss_accept_sec_context
609 (OM_uint32*, /* minor_status */
610 gss_ctx_id_t*, /* context_handle */
611 gss_cred_id_t, /* verifier_cred_handle */
612 gss_buffer_t, /* input_token_buffer */
613 gss_channel_bindings_t,
614 /* input_chan_bindings */
615 gss_name_t*, /* src_name */
616 gss_OID*, /* mech_type */
617 gss_buffer_t, /* output_token */
618 OM_uint32*, /* ret_flags */
619 OM_uint32*, /* time_rec */
620 gss_cred_id_t* /* delegated_cred_handle */
621 );
622
623 OM_uint32 KRB5_CALLCONV krb5_gss_accept_sec_context_ext
624 (OM_uint32*, /* minor_status */
625 gss_ctx_id_t*, /* context_handle */
626 gss_cred_id_t, /* verifier_cred_handle */
627 gss_buffer_t, /* input_token_buffer */
628 gss_channel_bindings_t,
629 /* input_chan_bindings */
630 gss_name_t*, /* src_name */
631 gss_OID*, /* mech_type */
632 gss_buffer_t, /* output_token */
633 OM_uint32*, /* ret_flags */
634 OM_uint32*, /* time_rec */
635 gss_cred_id_t*, /* delegated_cred_handle */
636 krb5_gss_ctx_ext_t/*exts */
637 );
638 #endif /* LEAN_CLIENT */
639
640 OM_uint32 KRB5_CALLCONV krb5_gss_inquire_sec_context_by_oid
641 (OM_uint32*, /* minor_status */
642 const gss_ctx_id_t,
643 /* context_handle */
644 const gss_OID, /* desired_object */
645 gss_buffer_set_t* /* data_set */
646 );
647
648 OM_uint32 KRB5_CALLCONV krb5_gss_set_sec_context_option
649 (OM_uint32*, /* minor_status */
650 gss_ctx_id_t*, /* context_handle */
651 const gss_OID, /* desired_object */
652 const gss_buffer_t/* value */
653 );
654
655 OM_uint32 KRB5_CALLCONV krb5_gss_process_context_token
656 (OM_uint32*, /* minor_status */
657 gss_ctx_id_t, /* context_handle */
658 gss_buffer_t /* token_buffer */
659 );
660
661 OM_uint32 KRB5_CALLCONV krb5_gss_delete_sec_context
662 (OM_uint32*, /* minor_status */
663 gss_ctx_id_t*, /* context_handle */
664 gss_buffer_t /* output_token */
665 );
666
667 OM_uint32 KRB5_CALLCONV krb5_gss_context_time
668 (OM_uint32*, /* minor_status */
669 gss_ctx_id_t, /* context_handle */
670 OM_uint32* /* time_rec */
671 );
672
673 OM_uint32 KRB5_CALLCONV krb5_gss_display_status
674 (OM_uint32*, /* minor_status */
675 OM_uint32, /* status_value */
676 int, /* status_type */
677 gss_OID, /* mech_type */
678 OM_uint32*, /* message_context */
679 gss_buffer_t /* status_string */
680 );
681
682 OM_uint32 KRB5_CALLCONV krb5_gss_indicate_mechs
683 (OM_uint32*, /* minor_status */
684 gss_OID_set* /* mech_set */
685 );
686
687 OM_uint32 KRB5_CALLCONV krb5_gss_compare_name
688 (OM_uint32*, /* minor_status */
689 gss_name_t, /* name1 */
690 gss_name_t, /* name2 */
691 int* /* name_equal */
692 );
693
694 OM_uint32 KRB5_CALLCONV krb5_gss_display_name
695 (OM_uint32*, /* minor_status */
696 gss_name_t, /* input_name */
697 gss_buffer_t, /* output_name_buffer */
698 gss_OID* /* output_name_type */
699 );
700
701
702 OM_uint32 KRB5_CALLCONV krb5_gss_import_name
703 (OM_uint32*, /* minor_status */
704 gss_buffer_t, /* input_name_buffer */
705 gss_OID, /* input_name_type */
706 gss_name_t* /* output_name */
707 );
708
709 OM_uint32 KRB5_CALLCONV iakerb_gss_import_name
710 (OM_uint32*, /* minor_status */
711 gss_buffer_t, /* input_name_buffer */
712 gss_OID, /* input_name_type */
713 gss_name_t* /* output_name */
714 );
715
716 OM_uint32 KRB5_CALLCONV krb5_gss_release_name
717 (OM_uint32*, /* minor_status */
718 gss_name_t* /* input_name */
719 );
720
721 OM_uint32 KRB5_CALLCONV krb5_gss_inquire_cred
722 (OM_uint32 *, /* minor_status */
723 gss_cred_id_t, /* cred_handle */
724 gss_name_t *, /* name */
725 OM_uint32 *, /* lifetime */
726 gss_cred_usage_t*,/* cred_usage */
727 gss_OID_set * /* mechanisms */
728 );
729
730 OM_uint32 KRB5_CALLCONV krb5_gss_inquire_context
731 (OM_uint32*, /* minor_status */
732 gss_ctx_id_t, /* context_handle */
733 gss_name_t*, /* initiator_name */
734 gss_name_t*, /* acceptor_name */
735 OM_uint32*, /* lifetime_rec */
736 gss_OID*, /* mech_type */
737 OM_uint32*, /* ret_flags */
738 int*, /* locally_initiated */
739 int* /* open */
740 );
741
742 /* New V2 entry points */
743 OM_uint32 KRB5_CALLCONV krb5_gss_get_mic
744 (OM_uint32 *, /* minor_status */
745 gss_ctx_id_t, /* context_handle */
746 gss_qop_t, /* qop_req */
747 gss_buffer_t, /* message_buffer */
748 gss_buffer_t /* message_token */
749 );
750
751 OM_uint32 KRB5_CALLCONV krb5_gss_get_mic_iov
752 (OM_uint32 *, /* minor_status */
753 gss_ctx_id_t, /* context_handle */
754 gss_qop_t, /* qop_req */
755 gss_iov_buffer_desc *, /* iov */
756 int /* iov_count */
757 );
758
759 OM_uint32 KRB5_CALLCONV krb5_gss_get_mic_iov_length
760 (OM_uint32 *, /* minor_status */
761 gss_ctx_id_t, /* context_handle */
762 gss_qop_t, /* qop_req */
763 gss_iov_buffer_desc *, /* iov */
764 int /* iov_count */
765 );
766
767 OM_uint32 KRB5_CALLCONV krb5_gss_verify_mic
768 (OM_uint32 *, /* minor_status */
769 gss_ctx_id_t, /* context_handle */
770 gss_buffer_t, /* message_buffer */
771 gss_buffer_t, /* message_token */
772 gss_qop_t * /* qop_state */
773 );
774
775 OM_uint32 KRB5_CALLCONV krb5_gss_verify_mic_iov
776 (OM_uint32 *, /* minor_status */
777 gss_ctx_id_t, /* context_handle */
778 gss_qop_t *, /* qop_state */
779 gss_iov_buffer_desc *, /* iov */
780 int /* iov_count */
781 );
782
783 OM_uint32 KRB5_CALLCONV krb5_gss_wrap
784 (OM_uint32 *, /* minor_status */
785 gss_ctx_id_t, /* context_handle */
786 int, /* conf_req_flag */
787 gss_qop_t, /* qop_req */
788 gss_buffer_t, /* input_message_buffer */
789 int *, /* conf_state */
790 gss_buffer_t /* output_message_buffer */
791 );
792
793 OM_uint32 KRB5_CALLCONV krb5_gss_wrap_iov
794 (OM_uint32 *, /* minor_status */
795 gss_ctx_id_t, /* context_handle */
796 int, /* conf_req_flag */
797 gss_qop_t, /* qop_req */
798 int *, /* conf_state */
799 gss_iov_buffer_desc *, /* iov */
800 int /* iov_count */
801 );
802
803 OM_uint32 KRB5_CALLCONV krb5_gss_wrap_iov_length
804 (OM_uint32 *, /* minor_status */
805 gss_ctx_id_t, /* context_handle */
806 int, /* conf_req_flag */
807 gss_qop_t, /* qop_req */
808 int *, /* conf_state */
809 gss_iov_buffer_desc *, /* iov */
810 int /* iov_count */
811 );
812
813 OM_uint32 KRB5_CALLCONV krb5_gss_unwrap
814 (OM_uint32 *, /* minor_status */
815 gss_ctx_id_t, /* context_handle */
816 gss_buffer_t, /* input_message_buffer */
817 gss_buffer_t, /* output_message_buffer */
818 int *, /* conf_state */
819 gss_qop_t * /* qop_state */
820 );
821
822 OM_uint32 KRB5_CALLCONV krb5_gss_unwrap_iov
823 (OM_uint32 *, /* minor_status */
824 gss_ctx_id_t, /* context_handle */
825 int *, /* conf_state */
826 gss_qop_t *, /* qop_state */
827 gss_iov_buffer_desc *, /* iov */
828 int /* iov_count */
829 );
830
831 OM_uint32 KRB5_CALLCONV krb5_gss_wrap_size_limit
832 (OM_uint32 *, /* minor_status */
833 gss_ctx_id_t, /* context_handle */
834 int, /* conf_req_flag */
835 gss_qop_t, /* qop_req */
836 OM_uint32, /* req_output_size */
837 OM_uint32 * /* max_input_size */
838 );
839
840 OM_uint32 KRB5_CALLCONV krb5_gss_import_name_object
841 (OM_uint32 *, /* minor_status */
842 void *, /* input_name */
843 gss_OID, /* input_name_type */
844 gss_name_t * /* output_name */
845 );
846
847 OM_uint32 KRB5_CALLCONV krb5_gss_export_name_object
848 (OM_uint32 *, /* minor_status */
849 gss_name_t, /* input_name */
850 gss_OID, /* desired_name_type */
851 void * * /* output_name */
852 );
853
854 OM_uint32 KRB5_CALLCONV krb5_gss_inquire_cred_by_mech
855 (OM_uint32 *, /* minor_status */
856 gss_cred_id_t, /* cred_handle */
857 gss_OID, /* mech_type */
858 gss_name_t *, /* name */
859 OM_uint32 *, /* initiator_lifetime */
860 OM_uint32 *, /* acceptor_lifetime */
861 gss_cred_usage_t * /* cred_usage */
862 );
863 #ifndef LEAN_CLIENT
864 OM_uint32 KRB5_CALLCONV krb5_gss_export_sec_context
865 (OM_uint32 *, /* minor_status */
866 gss_ctx_id_t *, /* context_handle */
867 gss_buffer_t /* interprocess_token */
868 );
869
870 OM_uint32 KRB5_CALLCONV krb5_gss_import_sec_context
871 (OM_uint32 *, /* minor_status */
872 gss_buffer_t, /* interprocess_token */
873 gss_ctx_id_t * /* context_handle */
874 );
875 #endif /* LEAN_CLIENT */
876
877 OM_uint32 krb5_gss_release_oid
878 (OM_uint32 *, /* minor_status */
879 gss_OID * /* oid */
880 );
881
882 OM_uint32 KRB5_CALLCONV krb5_gss_internal_release_oid
883 (OM_uint32 *, /* minor_status */
884 gss_OID * /* oid */
885 );
886
887 OM_uint32 KRB5_CALLCONV krb5_gss_inquire_names_for_mech
888 (OM_uint32 *, /* minor_status */
889 gss_OID, /* mechanism */
890 gss_OID_set * /* name_types */
891 );
892
893 OM_uint32 krb5_gss_canonicalize_name
894 (OM_uint32 *, /* minor_status */
895 const gss_name_t, /* input_name */
896 const gss_OID, /* mech_type */
897 gss_name_t * /* output_name */
898 );
899
900 OM_uint32 KRB5_CALLCONV krb5_gss_export_name
901 (OM_uint32 *, /* minor_status */
902 const gss_name_t, /* input_name */
903 gss_buffer_t /* exported_name */
904 );
905
906 OM_uint32 KRB5_CALLCONV krb5_gss_duplicate_name
907 (OM_uint32 *, /* minor_status */
908 const gss_name_t, /* input_name */
909 gss_name_t * /* dest_name */
910 );
911
912 OM_uint32 krb5_gss_validate_cred
913 (OM_uint32 *, /* minor_status */
914 gss_cred_id_t /* cred */
915 );
916
917 OM_uint32 KRB5_CALLCONV krb5_gss_acquire_cred_impersonate_name(
918 OM_uint32 *, /* minor_status */
919 const gss_cred_id_t, /* impersonator_cred_handle */
920 const gss_name_t, /* desired_name */
921 OM_uint32, /* time_req */
922 const gss_OID_set, /* desired_mechs */
923 gss_cred_usage_t, /* cred_usage */
924 gss_cred_id_t *, /* output_cred_handle */
925 gss_OID_set *, /* actual_mechs */
926 OM_uint32 *); /* time_rec */
927
928 OM_uint32
929 krb5_gss_validate_cred_1(OM_uint32 * /* minor_status */,
930 gss_cred_id_t /* cred_handle */,
931 krb5_context /* context */);
932
933 gss_OID krb5_gss_convert_static_mech_oid(gss_OID oid);
934
935 krb5_error_code gss_krb5int_make_seal_token_v3(krb5_context,
936 krb5_gss_ctx_id_rec *,
937 const gss_buffer_desc *,
938 gss_buffer_t,
939 int, int);
940
941 int gss_krb5int_rotate_left (void *ptr, size_t bufsiz, size_t rc);
942
943 /* naming_exts.c */
944 #define KG_INIT_NAME_NO_COPY 0x1
945
946 krb5_error_code
947 kg_init_name(krb5_context context, krb5_principal principal,
948 char *service, char *host, krb5_authdata_context ad_context,
949 krb5_flags flags, krb5_gss_name_t *name);
950
951 krb5_error_code
952 kg_release_name(krb5_context context, krb5_gss_name_t *name);
953
954 krb5_error_code
955 kg_duplicate_name(krb5_context context, const krb5_gss_name_t src,
956 krb5_gss_name_t *dst);
957
958 krb5_boolean
959 kg_compare_name(krb5_context context,
960 krb5_gss_name_t name1,
961 krb5_gss_name_t name2);
962
963 krb5_boolean
964 kg_acceptor_princ(krb5_context context, krb5_gss_name_t name,
965 krb5_principal *princ_out);
966
967 OM_uint32 KRB5_CALLCONV
968 krb5_gss_display_name_ext(OM_uint32 *minor_status,
969 gss_name_t name,
970 gss_OID display_as_name_type,
971 gss_buffer_t display_name);
972
973 OM_uint32 KRB5_CALLCONV
974 krb5_gss_inquire_name(OM_uint32 *minor_status,
975 gss_name_t name,
976 int *name_is_MN,
977 gss_OID *MN_mech,
978 gss_buffer_set_t *attrs);
979
980 OM_uint32 KRB5_CALLCONV
981 krb5_gss_get_name_attribute(OM_uint32 *minor_status,
982 gss_name_t name,
983 gss_buffer_t attr,
984 int *authenticated,
985 int *complete,
986 gss_buffer_t value,
987 gss_buffer_t display_value,
988 int *more);
989
990 OM_uint32 KRB5_CALLCONV
991 krb5_gss_set_name_attribute(OM_uint32 *minor_status,
992 gss_name_t name,
993 int complete,
994 gss_buffer_t attr,
995 gss_buffer_t value);
996
997 OM_uint32 KRB5_CALLCONV
998 krb5_gss_delete_name_attribute(OM_uint32 *minor_status,
999 gss_name_t name,
1000 gss_buffer_t attr);
1001
1002 OM_uint32 KRB5_CALLCONV
1003 krb5_gss_export_name_composite(OM_uint32 *minor_status,
1004 gss_name_t name,
1005 gss_buffer_t exp_composite_name);
1006
1007 OM_uint32 KRB5_CALLCONV
1008 krb5_gss_map_name_to_any(OM_uint32 *minor_status,
1009 gss_name_t name,
1010 int authenticated,
1011 gss_buffer_t type_id,
1012 gss_any_t *output);
1013
1014 OM_uint32 KRB5_CALLCONV
1015 krb5_gss_release_any_name_mapping(OM_uint32 *minor_status,
1016 gss_name_t name,
1017 gss_buffer_t type_id,
1018 gss_any_t *input);
1019
1020 OM_uint32 KRB5_CALLCONV
1021 krb5_gss_pseudo_random(OM_uint32 *minor_status,
1022 gss_ctx_id_t context,
1023 int prf_key,
1024 const gss_buffer_t prf_in,
1025 ssize_t desired_output_len,
1026 gss_buffer_t prf_out);
1027
1028 OM_uint32 KRB5_CALLCONV
1029 krb5_gss_store_cred(OM_uint32 *minor_status,
1030 gss_cred_id_t input_cred_handle,
1031 gss_cred_usage_t cred_usage,
1032 const gss_OID desired_mech,
1033 OM_uint32 overwrite_cred,
1034 OM_uint32 default_cred,
1035 gss_OID_set *elements_stored,
1036 gss_cred_usage_t *cred_usage_stored);
1037
1038 /* s4u_gss_glue.c */
1039 OM_uint32
1040 kg_compose_deleg_cred(OM_uint32 *minor_status,
1041 krb5_gss_cred_id_t impersonator_cred,
1042 krb5_creds *subject_creds,
1043 OM_uint32 time_req,
1044 krb5_gss_cred_id_t *output_cred,
1045 OM_uint32 *time_rec,
1046 krb5_context context);
1047
1048 /*
1049 * These take unglued krb5-mech-specific contexts.
1050 */
1051
1052 #define GSS_KRB5_GET_TKT_FLAGS_OID_LENGTH 11
1053 #define GSS_KRB5_GET_TKT_FLAGS_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x01"
1054
1055 OM_uint32 gss_krb5int_get_tkt_flags
1056 (OM_uint32 *minor_status,
1057 const gss_ctx_id_t context_handle,
1058 const gss_OID desired_object,
1059 gss_buffer_set_t *data_set);
1060
1061 #define GSS_KRB5_COPY_CCACHE_OID_LENGTH 11
1062 #define GSS_KRB5_COPY_CCACHE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x02"
1063
1064 OM_uint32 gss_krb5int_copy_ccache
1065 (OM_uint32 *minor_status,
1066 gss_cred_id_t *cred_handle,
1067 const gss_OID desired_oid,
1068 const gss_buffer_t value);
1069
1070 #define GSS_KRB5_CCACHE_NAME_OID_LENGTH 11
1071 #define GSS_KRB5_CCACHE_NAME_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x03"
1072
1073 struct krb5_gss_ccache_name_req {
1074 const char *name;
1075 const char **out_name;
1076 };
1077
1078 OM_uint32
1079 gss_krb5int_ccache_name(OM_uint32 *minor_status, const gss_OID, const gss_OID,
1080 const gss_buffer_t);
1081
1082 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11
1083 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05"
1084 #define GSS_KRB5_INQ_ODBC_SESSION_KEY_OID_LENGTH 11
1085 #define GSS_KRB5_INQ_ODBC_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x13"
1086
1087 OM_uint32
1088 gss_krb5int_inq_sspi_session_key(OM_uint32 *, const gss_ctx_id_t, const gss_OID, gss_buffer_set_t *);
1089 OM_uint32
1090 gss_krb5int_inq_odbc_session_key(OM_uint32 *, const gss_ctx_id_t, const gss_OID, gss_buffer_set_t *);
1091
1092 #define GSS_KRB5_SET_ALLOWABLE_ENCTYPES_OID_LENGTH 11
1093 #define GSS_KRB5_SET_ALLOWABLE_ENCTYPES_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x04"
1094
1095 struct krb5_gss_set_allowable_enctypes_req {
1096 OM_uint32 num_ktypes;
1097 krb5_enctype *ktypes;
1098 };
1099
1100 OM_uint32
1101 gss_krb5int_set_allowable_enctypes(OM_uint32 *minor_status,
1102 gss_cred_id_t *cred,
1103 const gss_OID desired_oid,
1104 const gss_buffer_t value);
1105
1106 #define GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID_LENGTH 11
1107 #define GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x06"
1108
1109 OM_uint32
1110 gss_krb5int_export_lucid_sec_context(OM_uint32 *minor_status,
1111 const gss_ctx_id_t context_handle,
1112 const gss_OID desired_object,
1113 gss_buffer_set_t *data_set);
1114
1115 #define GSS_KRB5_FREE_LUCID_SEC_CONTEXT_OID_LENGTH 11
1116 #define GSS_KRB5_FREE_LUCID_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x07"
1117
1118 OM_uint32
1119 gss_krb5int_free_lucid_sec_context(OM_uint32 *, const gss_OID,
1120 const gss_OID, gss_buffer_t);
1121
1122 extern k5_mutex_t kg_kdc_flag_mutex;
1123 krb5_error_code krb5_gss_init_context (krb5_context *ctxp);
1124
1125 #define GSS_KRB5_USE_KDC_CONTEXT_OID_LENGTH 11
1126 #define GSS_KRB5_USE_KDC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x08"
1127
1128 OM_uint32 krb5int_gss_use_kdc_context(OM_uint32 *, const gss_OID,
1129 const gss_OID, gss_buffer_t);
1130
1131 krb5_error_code krb5_gss_use_kdc_context(void);
1132
1133 #define GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_OID_LENGTH 11
1134 #define GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x09"
1135
1136 OM_uint32
1137 gss_krb5int_register_acceptor_identity(OM_uint32 *, const gss_OID, const gss_OID, gss_buffer_t);
1138
1139 #define GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_OID_LENGTH 11
1140 #define GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a"
1141
1142 OM_uint32
1143 gss_krb5int_extract_authz_data_from_sec_context(OM_uint32 *minor_status,
1144 const gss_ctx_id_t context_handle,
1145 const gss_OID desired_object,
1146 gss_buffer_set_t *ad_data);
1147
1148 #define GSS_KRB5_SET_CRED_RCACHE_OID_LENGTH 11
1149 #define GSS_KRB5_SET_CRED_RCACHE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0b"
1150
1151 OM_uint32
1152 gss_krb5int_set_cred_rcache(OM_uint32 *, gss_cred_id_t *, const gss_OID, const gss_buffer_t);
1153
1154 #define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11
1155 #define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c"
1156
1157 OM_uint32
1158 gss_krb5int_extract_authtime_from_sec_context(OM_uint32 *,
1159 const gss_ctx_id_t,
1160 const gss_OID,
1161 gss_buffer_set_t *);
1162
1163 #define GET_SEC_CONTEXT_SASL_SSF_OID_LENGTH 11
1164 #define GET_SEC_CONTEXT_SASL_SSF_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0f"
1165 OM_uint32
1166 gss_krb5int_sec_context_sasl_ssf(OM_uint32 *, const gss_ctx_id_t,
1167 const gss_OID, gss_buffer_set_t *);
1168
1169 #define GSS_KRB5_IMPORT_CRED_OID_LENGTH 11
1170 #define GSS_KRB5_IMPORT_CRED_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0d"
1171
1172 struct krb5_gss_import_cred_req {
1173 krb5_ccache id;
1174 krb5_principal keytab_principal;
1175 krb5_keytab keytab;
1176 };
1177
1178 OM_uint32
1179 gss_krb5int_import_cred(OM_uint32 *minor_status,
1180 gss_cred_id_t *cred,
1181 const gss_OID desired_oid,
1182 const gss_buffer_t value);
1183
1184 #ifdef _GSS_STATIC_LINK
1185 int gss_krb5int_lib_init(void);
1186 void gss_krb5int_lib_fini(void);
1187 #endif /* _GSS_STATIC_LINK */
1188
1189 OM_uint32 gss_krb5int_initialize_library(void);
1190 void gss_krb5int_cleanup_library(void);
1191
1192 /* For error message handling. */
1193 /* Returns a shared string, not a private copy! */
1194 extern char *
1195 krb5_gss_get_error_message(OM_uint32 minor_code);
1196 extern void
1197 krb5_gss_save_error_string(OM_uint32 minor_code, char *msg);
1198 extern void
1199 krb5_gss_save_error_message(OM_uint32 minor_code, const char *format, ...)
1200 #if !defined(__cplusplus) && (__GNUC__ > 2)
1201 __attribute__((__format__(__printf__, 2, 3)))
1202 #endif
1203 ;
1204 extern void
1205 krb5_gss_save_error_info(OM_uint32 minor_code, krb5_context ctx);
1206 #define get_error_message krb5_gss_get_error_message
1207 #define save_error_string krb5_gss_save_error_string
1208 #define save_error_message krb5_gss_save_error_message
1209 #ifdef KRB5_KERNEL
1210 /* Error messages aren't needed in the kernel, so reduce dependencies. */
1211 #define save_error_info(x,y)
1212 #else
1213 #define save_error_info krb5_gss_save_error_info
1214 #endif
1215 extern void krb5_gss_delete_error_info(void *p);
1216
1217 /* Prefix concatenated with Kerberos encryption type */
1218 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10
1219 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04"
1220
1221 /* IAKERB */
1222
1223 OM_uint32 KRB5_CALLCONV
1224 iakerb_gss_init_sec_context(OM_uint32 *minor_status,
1225 gss_cred_id_t claimant_cred_handle,
1226 gss_ctx_id_t *context_handle,
1227 gss_name_t target_name,
1228 gss_OID mech_type,
1229 OM_uint32 req_flags,
1230 OM_uint32 time_req,
1231 gss_channel_bindings_t input_chan_bindings,
1232 gss_buffer_t input_token,
1233 gss_OID *actual_mech_type,
1234 gss_buffer_t output_token,
1235 OM_uint32 *ret_flags,
1236 OM_uint32 *time_rec);
1237
1238 OM_uint32 KRB5_CALLCONV
1239 iakerb_gss_accept_sec_context(OM_uint32 *minor_status,
1240 gss_ctx_id_t *context_handler,
1241 gss_cred_id_t verifier_cred_handle,
1242 gss_buffer_t input_token,
1243 gss_channel_bindings_t input_chan_bindings,
1244 gss_name_t *src_name,
1245 gss_OID *mech_type,
1246 gss_buffer_t output_token,
1247 OM_uint32 *ret_flags,
1248 OM_uint32 *time_rec,
1249 gss_cred_id_t *delegated_cred_handle);
1250
1251 OM_uint32 KRB5_CALLCONV
1252 iakerb_gss_delete_sec_context(OM_uint32 *minor_status,
1253 gss_ctx_id_t *context_handle,
1254 gss_buffer_t output_token);
1255
1256 krb5_error_code
1257 iakerb_make_finished(krb5_context context,
1258 krb5_key key,
1259 const krb5_data *conv,
1260 krb5_data **finished);
1261
1262 krb5_error_code
1263 iakerb_verify_finished(krb5_context context,
1264 krb5_key key,
1265 const krb5_data *conv,
1266 const krb5_data *finished);
1267
1268 /*
1269 * Transfer contents of a krb5_data to a gss_buffer and invalidate the source
1270 * On unix, this is a simple pointer copy
1271 * On windows, memory is reallocated and copied.
1272 */
1273 static inline krb5_error_code
data_to_gss(krb5_data * input_k5data,gss_buffer_t output_buffer)1274 data_to_gss(krb5_data *input_k5data, gss_buffer_t output_buffer)
1275 {
1276 krb5_error_code code = 0;
1277 output_buffer->length = input_k5data->length;
1278 #if defined(_WIN32) || defined(DEBUG_GSSALLOC)
1279 if (output_buffer->length > 0) {
1280 output_buffer->value = gssalloc_malloc(output_buffer->length);
1281 if (output_buffer->value)
1282 memcpy(output_buffer->value, input_k5data->data, output_buffer->length);
1283 else
1284 code = ENOMEM;
1285 } else {
1286 output_buffer->value = NULL;
1287 }
1288 free(input_k5data->data);
1289 #else
1290 output_buffer->value = input_k5data->data;
1291 #endif
1292 *input_k5data = empty_data();
1293 return code;
1294 }
1295
1296 #define GSS_EXTS_FINISHED 2
1297
1298
1299 /* Credential store extensions */
1300
1301 #define KRB5_CS_CLI_KEYTAB_URN "client_keytab"
1302 #define KRB5_CS_KEYTAB_URN "keytab"
1303 #define KRB5_CS_CCACHE_URN "ccache"
1304 #define KRB5_CS_RCACHE_URN "rcache"
1305 #define KRB5_CS_PASSWORD_URN "password"
1306 #define KRB5_CS_VERIFY_URN "verify"
1307
1308 OM_uint32
1309 kg_value_from_cred_store(gss_const_key_value_set_t cred_store,
1310 const char *type, const char **value);
1311
1312 OM_uint32 KRB5_CALLCONV
1313 krb5_gss_acquire_cred_from(
1314 OM_uint32 *, /* minor_status */
1315 const gss_name_t, /* desired_name */
1316 OM_uint32, /* time_req */
1317 const gss_OID_set, /* desired_mechs */
1318 gss_cred_usage_t, /* cred_usage */
1319 gss_const_key_value_set_t, /* cred_store */
1320 gss_cred_id_t *, /* output_cred_handle */
1321 gss_OID_set *, /* actual_mechs */
1322 OM_uint32 *); /* time_rec */
1323
1324 OM_uint32 KRB5_CALLCONV
1325 krb5_gss_store_cred_into(
1326 OM_uint32 *, /* minor_status */
1327 gss_cred_id_t, /* input_cred_handle */
1328 gss_cred_usage_t, /* input_usage */
1329 const gss_OID, /* desired_mech */
1330 OM_uint32, /* overwrite_cred */
1331 OM_uint32, /* default_cred */
1332 gss_const_key_value_set_t, /* cred_store */
1333 gss_OID_set *, /* elements_stored */
1334 gss_cred_usage_t *); /* cred_usage_stored */
1335
1336 OM_uint32 KRB5_CALLCONV
1337 krb5_gss_export_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
1338 gss_buffer_t token);
1339
1340 OM_uint32 KRB5_CALLCONV
1341 krb5_gss_import_cred(OM_uint32 *minor_status, gss_buffer_t token,
1342 gss_cred_id_t *cred_handle);
1343
1344 OM_uint32 KRB5_CALLCONV
1345 iakerb_gss_process_context_token(OM_uint32 *minor_status,
1346 const gss_ctx_id_t context_handle,
1347 const gss_buffer_t token_buffer);
1348
1349 OM_uint32 KRB5_CALLCONV
1350 iakerb_gss_context_time(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
1351 OM_uint32 *time_rec);
1352
1353 OM_uint32 KRB5_CALLCONV
1354 iakerb_gss_inquire_context(OM_uint32 *minor_status,
1355 gss_ctx_id_t context_handle, gss_name_t *src_name,
1356 gss_name_t *targ_name, OM_uint32 *lifetime_rec,
1357 gss_OID *mech_type, OM_uint32 *ctx_flags,
1358 int *locally_initiated, int *opened);
1359
1360 OM_uint32 KRB5_CALLCONV
1361 iakerb_gss_get_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
1362 gss_qop_t qop_req, gss_buffer_t message_buffer,
1363 gss_buffer_t message_token);
1364
1365 OM_uint32 KRB5_CALLCONV
1366 iakerb_gss_get_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
1367 gss_qop_t qop_req, gss_iov_buffer_desc *iov,
1368 int iov_count);
1369
1370 OM_uint32 KRB5_CALLCONV
1371 iakerb_gss_get_mic_iov_length(OM_uint32 *minor_status,
1372 gss_ctx_id_t context_handle, gss_qop_t qop_req,
1373 gss_iov_buffer_desc *iov, int iov_count);
1374
1375 OM_uint32 KRB5_CALLCONV
1376 iakerb_gss_verify_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
1377 gss_buffer_t msg_buffer, gss_buffer_t token_buffer,
1378 gss_qop_t *qop_state);
1379
1380 OM_uint32 KRB5_CALLCONV
1381 iakerb_gss_verify_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
1382 gss_qop_t *qop_state, gss_iov_buffer_desc *iov,
1383 int iov_count);
1384
1385 OM_uint32 KRB5_CALLCONV
1386 iakerb_gss_wrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
1387 int conf_req_flag, gss_qop_t qop_req,
1388 gss_buffer_t input_message_buffer, int *conf_state,
1389 gss_buffer_t output_message_buffer);
1390
1391 OM_uint32 KRB5_CALLCONV
1392 iakerb_gss_wrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
1393 int conf_req_flag, gss_qop_t qop_req, int *conf_state,
1394 gss_iov_buffer_desc *iov, int iov_count);
1395
1396 OM_uint32 KRB5_CALLCONV
1397 iakerb_gss_wrap_iov_length(OM_uint32 *minor_status,
1398 gss_ctx_id_t context_handle, int conf_req_flag,
1399 gss_qop_t qop_req, int *conf_state,
1400 gss_iov_buffer_desc *iov, int iov_count);
1401
1402 OM_uint32 KRB5_CALLCONV
1403 iakerb_gss_unwrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
1404 gss_buffer_t input_message_buffer,
1405 gss_buffer_t output_message_buffer, int *conf_state,
1406 gss_qop_t *qop_state);
1407
1408 OM_uint32 KRB5_CALLCONV
1409 iakerb_gss_unwrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
1410 int *conf_state, gss_qop_t *qop_state,
1411 gss_iov_buffer_desc *iov, int iov_count);
1412
1413 OM_uint32 KRB5_CALLCONV
1414 iakerb_gss_wrap_size_limit(OM_uint32 *minor_status,
1415 gss_ctx_id_t context_handle, int conf_req_flag,
1416 gss_qop_t qop_req, OM_uint32 req_output_size,
1417 OM_uint32 *max_input_size);
1418
1419 #ifndef LEAN_CLIENT
1420 OM_uint32 KRB5_CALLCONV
1421 iakerb_gss_export_sec_context(OM_uint32 *minor_status,
1422 gss_ctx_id_t *context_handle,
1423 gss_buffer_t interprocess_token);
1424
1425 OM_uint32 KRB5_CALLCONV
1426 iakerb_gss_import_sec_context(OM_uint32 *minor_status,
1427 const gss_buffer_t interprocess_token,
1428 gss_ctx_id_t *context_handle);
1429 #endif /* LEAN_CLIENT */
1430
1431 OM_uint32 KRB5_CALLCONV
1432 iakerb_gss_inquire_sec_context_by_oid(OM_uint32 *minor_status,
1433 const gss_ctx_id_t context_handle,
1434 const gss_OID desired_object,
1435 gss_buffer_set_t *data_set);
1436
1437 OM_uint32 KRB5_CALLCONV
1438 iakerb_gss_set_sec_context_option(OM_uint32 *minor_status,
1439 gss_ctx_id_t *context_handle,
1440 const gss_OID desired_object,
1441 const gss_buffer_t value);
1442
1443 OM_uint32 KRB5_CALLCONV
1444 iakerb_gss_pseudo_random(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
1445 int prf_key, const gss_buffer_t prf_in,
1446 ssize_t desired_output_len, gss_buffer_t prf_out);
1447
1448 /* Magic string to identify exported krb5 GSS credentials. Increment this if
1449 * the format changes. */
1450 #define CRED_EXPORT_MAGIC "K5C1"
1451
1452 OM_uint32
1453 gss_krb5int_get_cred_impersonator(OM_uint32 *minor_status,
1454 const gss_cred_id_t cred_handle,
1455 const gss_OID desired_object,
1456 gss_buffer_set_t *data_set);
1457
1458 #endif /* _GSSAPIP_KRB5_H_ */
1459