1 /*
2 * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
3 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
4 */
5
6 #include "mglueP.h"
7 #include "gssapiP_generic.h"
8 #include <stdio.h>
9 #ifdef HAVE_STDLIB_H
10 #include <stdlib.h>
11 #endif
12 #include <string.h>
13 #include <errno.h>
14
15 #include "k5-platform-store_32.h"
16 #include "k5-platform-store_16.h"
17 /*
18 * SUNW17PACresync
19 * MIT has diff names for these GSS utilities. Solaris needs to change
20 * them globally to get in sync w/MIT.
21 * Revisit for full 1.7 resync.
22 */
23 #define gssint_get_modOptions __gss_get_modOptions
24 #define gssint_der_length_size der_length_size
25 #define gssint_get_der_length get_der_length
26 #define gssint_put_der_length put_der_length
27 #define gssint_get_mechanism __gss_get_mechanism
28 #define gssint_get_mechanism_cred __gss_get_mechanism_cred
29 #define gssint_copy_oid_set gss_copy_oid_set
30 #define gssint_get_mech_type __gss_get_mech_type
31 #define gssint_export_internal_name __gss_export_internal_name
32 #define gssint_release_internal_name __gss_release_internal_name
33 #define gssint_convert_name_to_union_name __gss_convert_name_to_union_name
34 #define gssint_import_internal_name __gss_import_internal_name
35 #define gssint_display_internal_name __gss_display_internal_name
36
37
38 #define MSO_BIT (8*(sizeof (int) - 1)) /* Most significant octet bit */
39
40 extern gss_mechanism *gssint_mechs_array;
41
42 /*
43 * This file contains the support routines for the glue layer.
44 */
45
46 /*
47 * get_der_length: Givin a pointer to a buffer that contains a DER encoded
48 * length, decode the length updating the buffer to point to the character
49 * after the DER encoding. The parameter bytes will point to the number of
50 * bytes that made up the DER encoding of the length originally pointed to
51 * by the buffer. Note we return -1 on error.
52 */
53 int
gssint_get_der_length(unsigned char ** buf,unsigned int buf_len,unsigned int * bytes)54 gssint_get_der_length(unsigned char **buf, unsigned int buf_len, unsigned int *bytes)
55 {
56 /* p points to the beginning of the buffer */
57 unsigned char *p = *buf;
58 int length, new_length;
59 unsigned int octets;
60
61 if (buf_len < 1)
62 return (-1);
63
64 /* We should have at least one byte */
65 *bytes = 1;
66
67 /*
68 * If the High order bit is not set then the length is just the value
69 * of *p.
70 */
71 if (*p < 128) {
72 *buf = p+1; /* Advance the buffer */
73 return (*p); /* return the length */
74 }
75
76 /*
77 * if the High order bit is set, then the low order bits represent
78 * the number of bytes that contain the DER encoding of the length.
79 */
80
81 octets = *p++ & 0x7f;
82 *bytes += octets;
83
84 /* See if the supplied buffer contains enough bytes for the length. */
85 if (octets > buf_len - 1)
86 return (-1);
87
88 /*
89 * Calculate a multibyte length. The length is encoded as an
90 * unsigned integer base 256.
91 */
92 for (length = 0; octets; octets--) {
93 new_length = (length << 8) + *p++;
94 if (new_length < length) /* overflow */
95 return (-1);
96 length = new_length;
97 }
98
99 *buf = p; /* Advance the buffer */
100
101 return (length);
102 }
103
104 /*
105 * der_length_size: Return the number of bytes to encode a given length.
106 */
107 unsigned int
gssint_der_length_size(unsigned int len)108 gssint_der_length_size(unsigned int len)
109 {
110 int i;
111
112 if (len < 128)
113 return (1);
114
115 for (i = 0; len; i++) {
116 len >>= 8;
117 }
118
119 return (i+1);
120 }
121
122 /*
123 * put_der_length: Encode the supplied length into the buffer pointed to
124 * by buf. max_length represents the maximum length of the buffer pointed
125 * to by buff. We will advance buf to point to the character after the newly
126 * DER encoded length. We return 0 on success or -l it the length cannot
127 * be encoded in max_len characters.
128 */
129 int
gssint_put_der_length(unsigned int length,unsigned char ** buf,unsigned int max_len)130 gssint_put_der_length(unsigned int length, unsigned char **buf, unsigned int max_len)
131 {
132 unsigned char *s, *p;
133 unsigned int buf_len = 0;
134 int i, first;
135
136 /* Oops */
137 if (buf == 0 || max_len < 1)
138 return (-1);
139
140 s = *buf;
141
142 /* Single byte is the length */
143 if (length < 128) {
144 *s++ = length;
145 *buf = s;
146 return (0);
147 }
148
149 /* First byte contains the number of octets */
150 p = s + 1;
151
152 /* Running total of the DER encoding length */
153 buf_len = 0;
154
155 /*
156 * Encode MSB first. We do the encoding by setting a shift
157 * factor to MSO_BIT (24 for 32 bit words) and then shifting the length
158 * by the factor. We then encode the resulting low order byte.
159 * We subtract 8 from the shift factor and repeat to ecnode the next
160 * byte. We stop when the shift factor is zero or we've run out of
161 * buffer to encode into.
162 */
163 first = 0;
164 for (i = MSO_BIT; i >= 0 && buf_len <= max_len; i -= 8) {
165 unsigned int v;
166 v = (length >> i) & 0xff;
167 if ((v) || first) {
168 buf_len += 1;
169 *p++ = v;
170 first = 1;
171 }
172 }
173 if (i >= 0) /* buffer overflow */
174 return (-1);
175
176 /*
177 * We go back now and set the first byte to be the length with
178 * the high order bit set.
179 */
180 *s = buf_len | 0x80;
181 *buf = p;
182
183 return (0);
184 }
185
186
187 /*
188 * glue routine for get_mech_type
189 *
190 */
191
gssint_get_mech_type_oid(OID,token)192 OM_uint32 gssint_get_mech_type_oid(OID, token)
193 gss_OID OID;
194 gss_buffer_t token;
195 {
196 unsigned char * buffer_ptr;
197 int length;
198
199 /*
200 * This routine reads the prefix of "token" in order to determine
201 * its mechanism type. It assumes the encoding suggested in
202 * Appendix B of RFC 1508. This format starts out as follows :
203 *
204 * tag for APPLICATION 0, Sequence[constructed, definite length]
205 * length of remainder of token
206 * tag of OBJECT IDENTIFIER
207 * length of mechanism OID
208 * encoding of mechanism OID
209 * <the rest of the token>
210 *
211 * Numerically, this looks like :
212 *
213 * 0x60
214 * <length> - could be multiple bytes
215 * 0x06
216 * <length> - assume only one byte, hence OID length < 127
217 * <mech OID bytes>
218 *
219 * The routine fills in the OID value and returns an error as necessary.
220 */
221
222 if (OID == NULL)
223 return (GSS_S_CALL_INACCESSIBLE_WRITE);
224
225 if ((token == NULL) || (token->value == NULL))
226 return (GSS_S_DEFECTIVE_TOKEN);
227
228 /* Skip past the APP/Sequnce byte and the token length */
229
230 buffer_ptr = (unsigned char *) token->value;
231
232 if (*(buffer_ptr++) != 0x60)
233 return (GSS_S_DEFECTIVE_TOKEN);
234 length = *buffer_ptr++;
235
236 /* check if token length is null */
237 if (length == 0)
238 return (GSS_S_DEFECTIVE_TOKEN);
239
240 if (length & 0x80) {
241 if ((length & 0x7f) > 4)
242 return (GSS_S_DEFECTIVE_TOKEN);
243 buffer_ptr += length & 0x7f;
244 }
245
246 if (*(buffer_ptr++) != 0x06)
247 return (GSS_S_DEFECTIVE_TOKEN);
248
249 OID->length = (OM_uint32) *(buffer_ptr++);
250 OID->elements = (void *) buffer_ptr;
251 return (GSS_S_COMPLETE);
252 }
253
254 /*
255 * The following mechanisms do not always identify themselves
256 * per the GSS-API specification, when interoperating with MS
257 * peers. We include the OIDs here so we do not have to link
258 * with the mechanism.
259 */
260 static const gss_OID_desc gss_ntlm_mechanism_oid_desc =
261 {10, "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"};
262 static const gss_OID_desc gss_spnego_mechanism_oid_desc =
263 {6, "\x2b\x06\x01\x05\x05\x02"};
264 static const gss_OID_desc gss_krb5_mechanism_oid_desc =
265 {9, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"};
266 const gss_OID_desc * const gss_mech_krb5 =
267 &gss_krb5_mechanism_oid_desc;
268
269 #define NTLMSSP_SIGNATURE "NTLMSSP"
270
gssint_get_mech_type(OID,token)271 OM_uint32 gssint_get_mech_type(OID, token)
272 gss_OID OID;
273 gss_buffer_t token;
274 {
275 /* Check for interoperability exceptions */
276 if (token->length >= sizeof(NTLMSSP_SIGNATURE) &&
277 memcmp(token->value, NTLMSSP_SIGNATURE,
278 sizeof(NTLMSSP_SIGNATURE)) == 0) {
279 *OID = gss_ntlm_mechanism_oid_desc;
280 } else if (token->length != 0 &&
281 ((char *)token->value)[0] == 0x6E) {
282 /* Could be a raw AP-REQ (check for APPLICATION tag) */
283 *OID = gss_krb5_mechanism_oid_desc;
284 } else if (token->length == 0) {
285 *OID = gss_spnego_mechanism_oid_desc;
286 } else {
287 return gssint_get_mech_type_oid(OID, token);
288 }
289
290 return (GSS_S_COMPLETE);
291 }
292
293
294 /*
295 * Internal routines to get and release an internal mechanism name
296 */
297
298 #if 0 /* SUNW17PACresync */
299 #include "mglueP.h"
300 #endif
301
gssint_import_internal_name(minor_status,mech_type,union_name,internal_name)302 OM_uint32 gssint_import_internal_name (minor_status, mech_type, union_name,
303 internal_name)
304 OM_uint32 *minor_status;
305 gss_OID mech_type;
306 gss_union_name_t union_name;
307 gss_name_t *internal_name;
308 {
309 OM_uint32 status;
310 gss_mechanism mech;
311
312 mech = gssint_get_mechanism (mech_type);
313 if (mech) {
314 if (mech->gss_import_name) {
315 status = mech->gss_import_name (
316 mech->context, /* SUNW17PACresync */
317 minor_status,
318 union_name->external_name,
319 union_name->name_type,
320 internal_name);
321 if (status != GSS_S_COMPLETE)
322 map_error(minor_status, mech);
323 } else
324 status = GSS_S_UNAVAILABLE;
325
326 return (status);
327 }
328
329 return (GSS_S_BAD_MECH);
330 }
331
gssint_export_internal_name(minor_status,mech_type,internal_name,name_buf)332 OM_uint32 gssint_export_internal_name(minor_status, mech_type,
333 internal_name, name_buf)
334 OM_uint32 *minor_status;
335 const gss_OID mech_type;
336 const gss_name_t internal_name;
337 gss_buffer_t name_buf;
338 {
339 OM_uint32 status;
340 gss_mechanism mech;
341 gss_buffer_desc dispName;
342 gss_OID nameOid;
343 unsigned char *buf = NULL;
344 const unsigned char tokId[] = "\x04\x01";
345 const unsigned int tokIdLen = 2;
346 const int mechOidLenLen = 2, mechOidTagLen = 1, nameLenLen = 4;
347 int mechOidDERLen = 0;
348 int mechOidLen = 0;
349
350 mech = gssint_get_mechanism(mech_type);
351 if (!mech)
352 return (GSS_S_BAD_MECH);
353
354 if (mech->gss_export_name) {
355 status = mech->gss_export_name(
356 mech->context, /* SUNW17PACresync */
357 minor_status,
358 internal_name,
359 name_buf);
360 if (status != GSS_S_COMPLETE)
361 map_error(minor_status, mech);
362 return status;
363 }
364
365 /*
366 * if we are here it is because the mechanism does not provide
367 * a gss_export_name so we will use our implementation. We
368 * do required that the mechanism define a gss_display_name.
369 */
370 if (!mech->gss_display_name)
371 return (GSS_S_UNAVAILABLE);
372
373 /*
374 * NOTE: RFC2743 (section 3.2) governs the format of the outer
375 * wrapper of exported names; the mechanisms' specs govern
376 * the format of the inner portion of the exported name
377 * and, for some (e.g., RFC1964, the Kerberos V mech), a
378 * generic default as implemented here will do.
379 *
380 * The outer wrapper of an exported MN is: 2-octet tok Id
381 * (0x0401) + 2-octet network-byte order mech OID length + mech
382 * oid (in DER format, including DER tag and DER length) +
383 * 4-octet network-byte order length of inner portion + inner
384 * portion.
385 *
386 * For the Kerberos V mechanism the inner portion of an exported
387 * MN is the display name string and ignores the name type OID
388 * altogether. And we hope this will be so for any future
389 * mechanisms also, so that factoring name export/import out of
390 * the mech and into libgss pays off.
391 */
392 if ((status = mech->gss_display_name(
393 mech->context,
394 minor_status,
395 internal_name,
396 &dispName,
397 &nameOid))
398 != GSS_S_COMPLETE) {
399 map_error(minor_status, mech);
400 return (status);
401 }
402
403 /* determine the size of the buffer needed */
404 mechOidDERLen = gssint_der_length_size(mech_type->length);
405 name_buf->length = tokIdLen + mechOidLenLen +
406 mechOidTagLen + mechOidDERLen +
407 mech_type->length +
408 nameLenLen + dispName.length;
409 if ((name_buf->value = (void*)malloc(name_buf->length)) ==
410 (void*)NULL) {
411 name_buf->length = 0;
412 (void) gss_release_buffer(&status, &dispName);
413 return (GSS_S_FAILURE);
414 }
415
416 /* now create the name ..... */
417 buf = (unsigned char *)name_buf->value;
418 (void) memset(name_buf->value, 0, name_buf->length);
419 (void) memcpy(buf, tokId, tokIdLen);
420 buf += tokIdLen;
421
422 /* spec allows only 2 bytes for the mech oid length */
423 mechOidLen = mechOidDERLen + mechOidTagLen + mech_type->length;
424 store_16_be(mechOidLen, buf);
425 buf += 2;
426
427 /*
428 * DER Encoding of mech OID contains OID Tag (0x06), length and
429 * mech OID value
430 */
431 *buf++ = 0x06;
432 if (gssint_put_der_length(mech_type->length, &buf,
433 (name_buf->length - tokIdLen -2)) != 0) {
434 name_buf->length = 0;
435 free(name_buf->value);
436 (void) gss_release_buffer(&status, &dispName);
437 return (GSS_S_FAILURE);
438 }
439
440 (void) memcpy(buf, mech_type->elements, mech_type->length);
441 buf += mech_type->length;
442
443 /* spec designates the next 4 bytes for the name length */
444 store_32_be(dispName.length, buf);
445 buf += 4;
446
447 /* for the final ingredient - add the name from gss_display_name */
448 (void) memcpy(buf, dispName.value, dispName.length);
449
450 /* release the buffer obtained from gss_display_name */
451 (void) gss_release_buffer(minor_status, &dispName);
452 return (GSS_S_COMPLETE);
453 } /* gssint_export_internal_name */
454
gssint_display_internal_name(minor_status,mech_type,internal_name,external_name,name_type)455 OM_uint32 gssint_display_internal_name (minor_status, mech_type, internal_name,
456 external_name, name_type)
457 OM_uint32 *minor_status;
458 gss_OID mech_type;
459 gss_name_t internal_name;
460 gss_buffer_t external_name;
461 gss_OID *name_type;
462 {
463 OM_uint32 status;
464 gss_mechanism mech;
465
466 mech = gssint_get_mechanism (mech_type);
467 if (mech) {
468 if (mech->gss_display_name) {
469 status = mech->gss_display_name (
470 mech->context,
471 minor_status,
472 internal_name,
473 external_name,
474 name_type);
475 if (status != GSS_S_COMPLETE)
476 map_error(minor_status, mech);
477 } else
478 status = GSS_S_UNAVAILABLE;
479
480 return (status);
481 }
482
483 return (GSS_S_BAD_MECH);
484 }
485
gssint_release_internal_name(minor_status,mech_type,internal_name)486 OM_uint32 gssint_release_internal_name (minor_status, mech_type, internal_name)
487 OM_uint32 *minor_status;
488 gss_OID mech_type;
489 gss_name_t *internal_name;
490 {
491 OM_uint32 status;
492 gss_mechanism mech;
493
494 mech = gssint_get_mechanism (mech_type);
495 if (mech) {
496 if (mech->gss_release_name) {
497 status = mech->gss_release_name (
498 mech->context,
499 minor_status,
500 internal_name);
501 if (status != GSS_S_COMPLETE)
502 map_error(minor_status, mech);
503 } else
504 status = GSS_S_UNAVAILABLE;
505
506 return (status);
507 }
508
509 return (GSS_S_BAD_MECH);
510 }
511
gssint_delete_internal_sec_context(minor_status,mech_type,internal_ctx,output_token)512 OM_uint32 gssint_delete_internal_sec_context (minor_status,
513 mech_type,
514 internal_ctx,
515 output_token)
516 OM_uint32 *minor_status;
517 gss_OID mech_type;
518 gss_ctx_id_t *internal_ctx;
519 gss_buffer_t output_token;
520 {
521 OM_uint32 status;
522 gss_mechanism mech;
523
524 mech = gssint_get_mechanism (mech_type);
525 if (mech) {
526 if (mech->gss_delete_sec_context)
527 status = mech->gss_delete_sec_context (
528 mech->context, /* SUNW17PACresync */
529 minor_status,
530 internal_ctx,
531 output_token);
532 else
533 /* SUNW17PACresync - map error here? */
534 status = GSS_S_UNAVAILABLE;
535
536 return (status);
537 }
538
539 return (GSS_S_BAD_MECH);
540 }
541
542 /*
543 * This function converts an internal gssapi name to a union gssapi
544 * name. Note that internal_name should be considered "consumed" by
545 * this call, whether or not we return an error.
546 */
gssint_convert_name_to_union_name(minor_status,mech,internal_name,external_name)547 OM_uint32 gssint_convert_name_to_union_name(minor_status, mech,
548 internal_name, external_name)
549 OM_uint32 *minor_status;
550 gss_mechanism mech;
551 gss_name_t internal_name;
552 gss_name_t *external_name;
553 {
554 OM_uint32 major_status,tmp;
555 gss_union_name_t union_name;
556
557 union_name = (gss_union_name_t) malloc (sizeof(gss_union_name_desc));
558 if (!union_name) {
559 major_status = GSS_S_FAILURE;
560 *minor_status = ENOMEM;
561 map_errcode(minor_status);
562 goto allocation_failure;
563 }
564 union_name->mech_type = 0;
565 union_name->mech_name = internal_name;
566 union_name->name_type = 0;
567 union_name->external_name = 0;
568
569 major_status = generic_gss_copy_oid(minor_status, &mech->mech_type,
570 &union_name->mech_type);
571 if (major_status != GSS_S_COMPLETE) {
572 map_errcode(minor_status);
573 goto allocation_failure;
574 }
575
576 union_name->external_name =
577 (gss_buffer_t) malloc(sizeof(gss_buffer_desc));
578 if (!union_name->external_name) {
579 major_status = GSS_S_FAILURE;
580 *minor_status = ENOMEM;
581 goto allocation_failure;
582 }
583
584 union_name->external_name->length = 0;
585 union_name->external_name->value = 0;
586
587 major_status = mech->gss_display_name(
588 mech->context, /* SUNW17PACresync */
589 minor_status,
590 internal_name,
591 union_name->external_name,
592 &union_name->name_type);
593 if (major_status != GSS_S_COMPLETE) {
594 map_error(minor_status, mech);
595 goto allocation_failure;
596 }
597
598 union_name->loopback = union_name;
599 *external_name = (gss_name_t) union_name;
600 return (GSS_S_COMPLETE);
601
602 allocation_failure:
603 if (union_name) {
604 if (union_name->external_name) {
605 if (union_name->external_name->value)
606 free(union_name->external_name->value);
607 free(union_name->external_name);
608 }
609 if (union_name->name_type)
610 (void) gss_release_oid(&tmp, &union_name->name_type);
611 if (union_name->mech_type)
612 (void) gss_release_oid(&tmp, &union_name->mech_type);
613 free(union_name);
614 }
615 /*
616 * do as the top comment says - since we are now owners of
617 * internal_name, we must clean it up
618 */
619 if (internal_name)
620 (void) gssint_release_internal_name(&tmp, &mech->mech_type,
621 &internal_name);
622 return (major_status);
623 }
624
625 /*
626 * Glue routine for returning the mechanism-specific credential from a
627 * external union credential.
628 */
629 gss_cred_id_t
gssint_get_mechanism_cred(union_cred,mech_type)630 gssint_get_mechanism_cred(union_cred, mech_type)
631 gss_union_cred_t union_cred;
632 gss_OID mech_type;
633 {
634 int i;
635
636 if (union_cred == (gss_union_cred_t) GSS_C_NO_CREDENTIAL)
637 return GSS_C_NO_CREDENTIAL;
638
639 /*
640 * SUNW17PACresync
641 * Disable this block as it causes problems for gss_add_cred
642 * for HTTP SSO (and also probably causes STC gss.13 to fail too).
643 */
644 #if 0
645 /* SPNEGO mechanism will again call into GSSAPI */
646 if (g_OID_equal(&gss_spnego_mechanism_oid_desc, mech_type))
647 return (gss_cred_id_t)union_cred;
648 #endif
649
650 for (i=0; i < union_cred->count; i++) {
651 if (g_OID_equal(mech_type, &union_cred->mechs_array[i]))
652 return union_cred->cred_array[i];
653
654 /* for SPNEGO, check the next-lower set of creds */
655 if (g_OID_equal(&gss_spnego_mechanism_oid_desc, &union_cred->mechs_array[i])) {
656 gss_union_cred_t candidate_cred;
657 gss_cred_id_t sub_cred;
658
659 candidate_cred = (gss_union_cred_t)union_cred->cred_array[i];
660 sub_cred = gssint_get_mechanism_cred(candidate_cred, mech_type);
661
662 if(sub_cred != GSS_C_NO_CREDENTIAL)
663 return sub_cred;
664 }
665 }
666
667 return GSS_C_NO_CREDENTIAL;
668 }
669
670 /*
671 * Routine to create and copy the gss_buffer_desc structure.
672 * Both space for the structure and the data is allocated.
673 */
674 OM_uint32
gssint_create_copy_buffer(srcBuf,destBuf,addNullChar)675 gssint_create_copy_buffer(srcBuf, destBuf, addNullChar)
676 const gss_buffer_t srcBuf;
677 gss_buffer_t *destBuf;
678 int addNullChar;
679 {
680 gss_buffer_t aBuf;
681 unsigned int len;
682
683 if (destBuf == NULL)
684 return (GSS_S_CALL_INACCESSIBLE_WRITE);
685
686 *destBuf = 0;
687
688 aBuf = (gss_buffer_t)malloc(sizeof (gss_buffer_desc));
689 if (!aBuf)
690 return (GSS_S_FAILURE);
691
692 if (addNullChar)
693 len = srcBuf->length + 1;
694 else
695 len = srcBuf->length;
696
697 if (!(aBuf->value = (void*)malloc(len))) {
698 free(aBuf);
699 return (GSS_S_FAILURE);
700 }
701
702
703 (void) memcpy(aBuf->value, srcBuf->value, srcBuf->length);
704 aBuf->length = srcBuf->length;
705 *destBuf = aBuf;
706
707 /* optionally add a NULL character */
708 if (addNullChar)
709 ((char *)aBuf->value)[aBuf->length] = '\0';
710
711 return (GSS_S_COMPLETE);
712 } /* ****** gssint_create_copy_buffer ****** */
713
714