1 /*
2 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
3 * Use is subject to license terms.
4 */
5 /* -*- mode: c; indent-tabs-mode: nil -*- */
6 /*
7 * lib/gssapi/krb5/lucid_context.c
8 *
9 * Copyright 2004, 2008 by the Massachusetts Institute of Technology.
10 * All Rights Reserved.
11 *
12 * Export of this software from the United States of America may
13 * require a specific license from the United States Government.
14 * It is the responsibility of any person or organization contemplating
15 * export to obtain such a license before exporting.
16 *
17 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
18 * distribute this software and its documentation for any purpose and
19 * without fee is hereby granted, provided that the above copyright
20 * notice appear in all copies and that both that copyright notice and
21 * this permission notice appear in supporting documentation, and that
22 * the name of M.I.T. not be used in advertising or publicity pertaining
23 * to distribution of the software without specific, written prior
24 * permission. Furthermore if you modify this software you must label
25 * your software as modified software and not distribute it in such a
26 * fashion that it might be confused with the original M.I.T. software.
27 * M.I.T. makes no representations about the suitability of
28 * this software for any purpose. It is provided "as is" without express
29 * or implied warranty.
30 *
31 */
32
33 /*
34 * lucid_context.c - Externalize a "lucid" security
35 * context from a krb5_gss_ctx_id_rec structure.
36 */
37 #include "gssapiP_krb5.h"
38 #include "gssapi_krb5.h"
39 #include "mechglueP.h" /* SUNW17PACresync */
40
41 /*
42 * Local routine prototypes
43 */
44 static void
45 free_external_lucid_ctx_v1(
46 gss_krb5_lucid_context_v1_t *ctx);
47
48 static void
49 free_lucid_key_data(
50 gss_krb5_lucid_key_t *key);
51
52 static krb5_error_code
53 copy_keyblock_to_lucid_key(
54 krb5_keyblock *k5key,
55 gss_krb5_lucid_key_t *lkey);
56
57 static krb5_error_code
58 make_external_lucid_ctx_v1(
59 krb5_gss_ctx_id_rec * gctx,
60 int version,
61 void **out_ptr);
62
63
64 /*
65 * Exported routines
66 */
67
68 OM_uint32 KRB5_CALLCONV
gss_krb5int_export_lucid_sec_context(OM_uint32 * minor_status,gss_ctx_id_t context_handle,const gss_OID desired_object,gss_buffer_set_t * data_set)69 gss_krb5int_export_lucid_sec_context(
70 OM_uint32 *minor_status,
71 gss_ctx_id_t context_handle,
72 const gss_OID desired_object,
73 gss_buffer_set_t *data_set)
74 {
75 krb5_error_code kret = 0;
76 OM_uint32 retval;
77 krb5_gss_ctx_id_t ctx = (krb5_gss_ctx_id_t)context_handle;
78 void *lctx = NULL;
79 int version = 0;
80 gss_buffer_desc rep;
81
82 /* Assume failure */
83 retval = GSS_S_FAILURE;
84 *minor_status = 0;
85 *data_set = GSS_C_NO_BUFFER_SET;
86
87 retval = generic_gss_oid_decompose(minor_status,
88 GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID,
89 GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID_LENGTH,
90 desired_object,
91 &version);
92 if (GSS_ERROR(retval))
93 return retval;
94
95 /* Externalize a structure of the right version */
96 switch (version) {
97 case 1:
98 kret = make_external_lucid_ctx_v1((krb5_pointer)ctx,
99 version, &lctx);
100 break;
101 default:
102 kret = (OM_uint32) KG_LUCID_VERSION;
103 break;
104 }
105
106 if (kret)
107 goto error_out;
108
109 /* Success! Record the context and return the buffer */
110 if (! kg_save_lucidctx_id((void *)lctx)) {
111 kret = G_VALIDATE_FAILED;
112 goto error_out;
113 }
114
115 rep.value = &lctx;
116 rep.length = sizeof(lctx);
117
118 retval = generic_gss_add_buffer_set_member(minor_status, &rep, data_set);
119 if (GSS_ERROR(retval))
120 goto error_out;
121
122 error_out:
123 if (*minor_status == 0)
124 *minor_status = (OM_uint32) kret;
125 return(retval);
126 }
127
128 /*
129 * Frees the storage associated with an
130 * exported lucid context structure.
131 */
132 OM_uint32
gss_krb5int_free_lucid_sec_context(OM_uint32 * minor_status,const gss_OID desired_mech,const gss_OID desired_object,gss_buffer_t value)133 gss_krb5int_free_lucid_sec_context(
134 OM_uint32 *minor_status,
135 const gss_OID desired_mech,
136 const gss_OID desired_object,
137 gss_buffer_t value)
138 {
139 OM_uint32 retval;
140 krb5_error_code kret = 0;
141 int version;
142 void *kctx;
143
144 /* Assume failure */
145 retval = GSS_S_FAILURE;
146 *minor_status = 0;
147
148 kctx = value->value;
149 if (!kctx) {
150 kret = EINVAL;
151 goto error_out;
152 }
153
154 /* Verify pointer is valid lucid context */
155 if (! kg_validate_lucidctx_id(kctx)) {
156 kret = G_VALIDATE_FAILED;
157 goto error_out;
158 }
159
160 /* Determine version and call correct free routine */
161 version = ((gss_krb5_lucid_context_version_t *)kctx)->version;
162 switch (version) {
163 case 1:
164 (void)kg_delete_lucidctx_id(kctx);
165 free_external_lucid_ctx_v1((gss_krb5_lucid_context_v1_t*) kctx);
166 break;
167 default:
168 kret = EINVAL;
169 break;
170 }
171
172 if (kret)
173 goto error_out;
174
175 /* Success! */
176 *minor_status = 0;
177 retval = GSS_S_COMPLETE;
178
179 return (retval);
180
181 error_out:
182 if (*minor_status == 0)
183 *minor_status = (OM_uint32) kret;
184 return(retval);
185 }
186
187 /*
188 * Local routines
189 */
190
191 static krb5_error_code
make_external_lucid_ctx_v1(krb5_gss_ctx_id_rec * gctx,int version,void ** out_ptr)192 make_external_lucid_ctx_v1(
193 krb5_gss_ctx_id_rec * gctx,
194 int version,
195 void **out_ptr)
196 {
197 gss_krb5_lucid_context_v1_t *lctx = NULL;
198 unsigned int bufsize = sizeof(gss_krb5_lucid_context_v1_t);
199 krb5_error_code retval;
200
201 /* Allocate the structure */
202 if ((lctx = xmalloc(bufsize)) == NULL) {
203 retval = ENOMEM;
204 goto error_out;
205 }
206
207 memset(lctx, 0, bufsize);
208
209 lctx->version = 1;
210 lctx->initiate = gctx->initiate ? 1 : 0;
211 lctx->endtime = gctx->krb_times.endtime;
212 lctx->send_seq = gctx->seq_send;
213 lctx->recv_seq = gctx->seq_recv;
214 lctx->protocol = gctx->proto;
215 /* gctx->proto == 0 ==> rfc1964-style key information
216 gctx->proto == 1 ==> cfx-style (draft-ietf-krb-wg-gssapi-cfx-07) keys */
217 if (gctx->proto == 0) {
218 lctx->rfc1964_kd.sign_alg = gctx->signalg;
219 lctx->rfc1964_kd.seal_alg = gctx->sealalg;
220 /* Copy key */
221 if ((retval = copy_keyblock_to_lucid_key(gctx->seq,
222 &lctx->rfc1964_kd.ctx_key)))
223 goto error_out;
224 }
225 else if (gctx->proto == 1) {
226 /* Copy keys */
227 /* (subkey is always present, either a copy of the kerberos
228 session key or a subkey) */
229 if ((retval = copy_keyblock_to_lucid_key(gctx->subkey,
230 &lctx->cfx_kd.ctx_key)))
231 goto error_out;
232 if (gctx->have_acceptor_subkey) {
233 if ((retval = copy_keyblock_to_lucid_key(gctx->acceptor_subkey,
234 &lctx->cfx_kd.acceptor_subkey)))
235 goto error_out;
236 lctx->cfx_kd.have_acceptor_subkey = 1;
237 }
238 }
239 else {
240 return EINVAL; /* XXX better error code? */
241 }
242
243 /* Success! */
244 *out_ptr = lctx;
245 return 0;
246
247 error_out:
248 if (lctx) {
249 free_external_lucid_ctx_v1(lctx);
250 }
251 return retval;
252
253 }
254
255 /* Copy the contents of a krb5_keyblock to a gss_krb5_lucid_key_t structure */
256 static krb5_error_code
copy_keyblock_to_lucid_key(krb5_keyblock * k5key,gss_krb5_lucid_key_t * lkey)257 copy_keyblock_to_lucid_key(
258 krb5_keyblock *k5key,
259 gss_krb5_lucid_key_t *lkey)
260 {
261 if (!k5key || !k5key->contents || k5key->length == 0)
262 return EINVAL;
263
264 memset(lkey, 0, sizeof(gss_krb5_lucid_key_t));
265
266 /* Allocate storage for the key data */
267 if ((lkey->data = xmalloc(k5key->length)) == NULL) {
268 return ENOMEM;
269 }
270 memcpy(lkey->data, k5key->contents, k5key->length);
271 lkey->length = k5key->length;
272 lkey->type = k5key->enctype;
273
274 return 0;
275 }
276
277
278 /* Free any storage associated with a gss_krb5_lucid_key_t structure */
279 static void
free_lucid_key_data(gss_krb5_lucid_key_t * key)280 free_lucid_key_data(
281 gss_krb5_lucid_key_t *key)
282 {
283 if (key) {
284 if (key->data && key->length) {
285 memset(key->data, 0, key->length);
286 xfree(key->data);
287 memset(key, 0, sizeof(gss_krb5_lucid_key_t));
288 }
289 }
290 }
291 /* Free any storage associated with a gss_krb5_lucid_context_v1 structure */
292 static void
free_external_lucid_ctx_v1(gss_krb5_lucid_context_v1_t * ctx)293 free_external_lucid_ctx_v1(
294 gss_krb5_lucid_context_v1_t *ctx)
295 {
296 if (ctx) {
297 if (ctx->protocol == 0) {
298 free_lucid_key_data(&ctx->rfc1964_kd.ctx_key);
299 }
300 if (ctx->protocol == 1) {
301 free_lucid_key_data(&ctx->cfx_kd.ctx_key);
302 if (ctx->cfx_kd.have_acceptor_subkey)
303 free_lucid_key_data(&ctx->cfx_kd.acceptor_subkey);
304 }
305 xfree(ctx);
306 ctx = NULL;
307 }
308 }
309