1 /* 2 * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved. 3 * Copyright 2011 Nexenta Systems, Inc. All rights reserved. 4 */ 5 6 #include "mglueP.h" 7 #include "gssapiP_generic.h" 8 #include <stdio.h> 9 #ifdef HAVE_STDLIB_H 10 #include <stdlib.h> 11 #endif 12 #include <string.h> 13 #include <errno.h> 14 15 #include "k5-platform-store_32.h" 16 #include "k5-platform-store_16.h" 17 /* 18 * SUNW17PACresync 19 * MIT has diff names for these GSS utilities. Solaris needs to change 20 * them globally to get in sync w/MIT. 21 * Revisit for full 1.7 resync. 22 */ 23 #define gssint_get_modOptions __gss_get_modOptions 24 #define gssint_der_length_size der_length_size 25 #define gssint_get_der_length get_der_length 26 #define gssint_put_der_length put_der_length 27 #define gssint_get_mechanism __gss_get_mechanism 28 #define gssint_get_mechanism_cred __gss_get_mechanism_cred 29 #define gssint_copy_oid_set gss_copy_oid_set 30 #define gssint_get_mech_type __gss_get_mech_type 31 #define gssint_export_internal_name __gss_export_internal_name 32 #define gssint_release_internal_name __gss_release_internal_name 33 #define gssint_convert_name_to_union_name __gss_convert_name_to_union_name 34 #define gssint_import_internal_name __gss_import_internal_name 35 #define gssint_display_internal_name __gss_display_internal_name 36 37 38 #define MSO_BIT (8*(sizeof (int) - 1)) /* Most significant octet bit */ 39 40 extern gss_mechanism *gssint_mechs_array; 41 42 /* 43 * This file contains the support routines for the glue layer. 44 */ 45 46 /* 47 * get_der_length: Givin a pointer to a buffer that contains a DER encoded 48 * length, decode the length updating the buffer to point to the character 49 * after the DER encoding. The parameter bytes will point to the number of 50 * bytes that made up the DER encoding of the length originally pointed to 51 * by the buffer. Note we return -1 on error. 52 */ 53 int 54 gssint_get_der_length(unsigned char **buf, unsigned int buf_len, unsigned int *bytes) 55 { 56 /* p points to the beginning of the buffer */ 57 unsigned char *p = *buf; 58 int length, new_length; 59 unsigned int octets; 60 61 if (buf_len < 1) 62 return (-1); 63 64 /* We should have at least one byte */ 65 *bytes = 1; 66 67 /* 68 * If the High order bit is not set then the length is just the value 69 * of *p. 70 */ 71 if (*p < 128) { 72 *buf = p+1; /* Advance the buffer */ 73 return (*p); /* return the length */ 74 } 75 76 /* 77 * if the High order bit is set, then the low order bits represent 78 * the number of bytes that contain the DER encoding of the length. 79 */ 80 81 octets = *p++ & 0x7f; 82 *bytes += octets; 83 84 /* See if the supplied buffer contains enough bytes for the length. */ 85 if (octets > buf_len - 1) 86 return (-1); 87 88 /* 89 * Calculate a multibyte length. The length is encoded as an 90 * unsigned integer base 256. 91 */ 92 for (length = 0; octets; octets--) { 93 new_length = (length << 8) + *p++; 94 if (new_length < length) /* overflow */ 95 return (-1); 96 length = new_length; 97 } 98 99 *buf = p; /* Advance the buffer */ 100 101 return (length); 102 } 103 104 /* 105 * der_length_size: Return the number of bytes to encode a given length. 106 */ 107 unsigned int 108 gssint_der_length_size(unsigned int len) 109 { 110 int i; 111 112 if (len < 128) 113 return (1); 114 115 for (i = 0; len; i++) { 116 len >>= 8; 117 } 118 119 return (i+1); 120 } 121 122 /* 123 * put_der_length: Encode the supplied length into the buffer pointed to 124 * by buf. max_length represents the maximum length of the buffer pointed 125 * to by buff. We will advance buf to point to the character after the newly 126 * DER encoded length. We return 0 on success or -l it the length cannot 127 * be encoded in max_len characters. 128 */ 129 int 130 gssint_put_der_length(unsigned int length, unsigned char **buf, unsigned int max_len) 131 { 132 unsigned char *s, *p; 133 unsigned int buf_len = 0; 134 int i, first; 135 136 /* Oops */ 137 if (buf == 0 || max_len < 1) 138 return (-1); 139 140 s = *buf; 141 142 /* Single byte is the length */ 143 if (length < 128) { 144 *s++ = length; 145 *buf = s; 146 return (0); 147 } 148 149 /* First byte contains the number of octets */ 150 p = s + 1; 151 152 /* Running total of the DER encoding length */ 153 buf_len = 0; 154 155 /* 156 * Encode MSB first. We do the encoding by setting a shift 157 * factor to MSO_BIT (24 for 32 bit words) and then shifting the length 158 * by the factor. We then encode the resulting low order byte. 159 * We subtract 8 from the shift factor and repeat to ecnode the next 160 * byte. We stop when the shift factor is zero or we've run out of 161 * buffer to encode into. 162 */ 163 first = 0; 164 for (i = MSO_BIT; i >= 0 && buf_len <= max_len; i -= 8) { 165 unsigned int v; 166 v = (length >> i) & 0xff; 167 if ((v) || first) { 168 buf_len += 1; 169 *p++ = v; 170 first = 1; 171 } 172 } 173 if (i >= 0) /* buffer overflow */ 174 return (-1); 175 176 /* 177 * We go back now and set the first byte to be the length with 178 * the high order bit set. 179 */ 180 *s = buf_len | 0x80; 181 *buf = p; 182 183 return (0); 184 } 185 186 187 /* 188 * glue routine for get_mech_type 189 * 190 */ 191 192 OM_uint32 gssint_get_mech_type_oid(OID, token) 193 gss_OID OID; 194 gss_buffer_t token; 195 { 196 unsigned char * buffer_ptr; 197 int length; 198 199 /* 200 * This routine reads the prefix of "token" in order to determine 201 * its mechanism type. It assumes the encoding suggested in 202 * Appendix B of RFC 1508. This format starts out as follows : 203 * 204 * tag for APPLICATION 0, Sequence[constructed, definite length] 205 * length of remainder of token 206 * tag of OBJECT IDENTIFIER 207 * length of mechanism OID 208 * encoding of mechanism OID 209 * <the rest of the token> 210 * 211 * Numerically, this looks like : 212 * 213 * 0x60 214 * <length> - could be multiple bytes 215 * 0x06 216 * <length> - assume only one byte, hence OID length < 127 217 * <mech OID bytes> 218 * 219 * The routine fills in the OID value and returns an error as necessary. 220 */ 221 222 if (OID == NULL) 223 return (GSS_S_CALL_INACCESSIBLE_WRITE); 224 225 if ((token == NULL) || (token->value == NULL)) 226 return (GSS_S_DEFECTIVE_TOKEN); 227 228 /* Skip past the APP/Sequnce byte and the token length */ 229 230 buffer_ptr = (unsigned char *) token->value; 231 232 if (*(buffer_ptr++) != 0x60) 233 return (GSS_S_DEFECTIVE_TOKEN); 234 length = *buffer_ptr++; 235 236 /* check if token length is null */ 237 if (length == 0) 238 return (GSS_S_DEFECTIVE_TOKEN); 239 240 if (length & 0x80) { 241 if ((length & 0x7f) > 4) 242 return (GSS_S_DEFECTIVE_TOKEN); 243 buffer_ptr += length & 0x7f; 244 } 245 246 if (*(buffer_ptr++) != 0x06) 247 return (GSS_S_DEFECTIVE_TOKEN); 248 249 OID->length = (OM_uint32) *(buffer_ptr++); 250 OID->elements = (void *) buffer_ptr; 251 return (GSS_S_COMPLETE); 252 } 253 254 /* 255 * The following mechanisms do not always identify themselves 256 * per the GSS-API specification, when interoperating with MS 257 * peers. We include the OIDs here so we do not have to link 258 * with the mechanism. 259 */ 260 static const gss_OID_desc gss_ntlm_mechanism_oid_desc = 261 {10, "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"}; 262 static const gss_OID_desc gss_spnego_mechanism_oid_desc = 263 {6, "\x2b\x06\x01\x05\x05\x02"}; 264 static const gss_OID_desc gss_krb5_mechanism_oid_desc = 265 {9, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"}; 266 const gss_OID_desc * const gss_mech_krb5 = 267 &gss_krb5_mechanism_oid_desc; 268 269 #define NTLMSSP_SIGNATURE "NTLMSSP" 270 271 OM_uint32 gssint_get_mech_type(OID, token) 272 gss_OID OID; 273 gss_buffer_t token; 274 { 275 /* Check for interoperability exceptions */ 276 if (token->length >= sizeof(NTLMSSP_SIGNATURE) && 277 memcmp(token->value, NTLMSSP_SIGNATURE, 278 sizeof(NTLMSSP_SIGNATURE)) == 0) { 279 *OID = gss_ntlm_mechanism_oid_desc; 280 } else if (token->length != 0 && 281 ((char *)token->value)[0] == 0x6E) { 282 /* Could be a raw AP-REQ (check for APPLICATION tag) */ 283 *OID = gss_krb5_mechanism_oid_desc; 284 } else if (token->length == 0) { 285 *OID = gss_spnego_mechanism_oid_desc; 286 } else { 287 return gssint_get_mech_type_oid(OID, token); 288 } 289 290 return (GSS_S_COMPLETE); 291 } 292 293 294 /* 295 * Internal routines to get and release an internal mechanism name 296 */ 297 298 #if 0 /* SUNW17PACresync */ 299 #include "mglueP.h" 300 #endif 301 302 OM_uint32 gssint_import_internal_name (minor_status, mech_type, union_name, 303 internal_name) 304 OM_uint32 *minor_status; 305 gss_OID mech_type; 306 gss_union_name_t union_name; 307 gss_name_t *internal_name; 308 { 309 OM_uint32 status; 310 gss_mechanism mech; 311 312 mech = gssint_get_mechanism (mech_type); 313 if (mech) { 314 if (mech->gss_import_name) { 315 status = mech->gss_import_name ( 316 mech->context, /* SUNW17PACresync */ 317 minor_status, 318 union_name->external_name, 319 union_name->name_type, 320 internal_name); 321 if (status != GSS_S_COMPLETE) 322 map_error(minor_status, mech); 323 } else 324 status = GSS_S_UNAVAILABLE; 325 326 return (status); 327 } 328 329 return (GSS_S_BAD_MECH); 330 } 331 332 OM_uint32 gssint_export_internal_name(minor_status, mech_type, 333 internal_name, name_buf) 334 OM_uint32 *minor_status; 335 const gss_OID mech_type; 336 const gss_name_t internal_name; 337 gss_buffer_t name_buf; 338 { 339 OM_uint32 status; 340 gss_mechanism mech; 341 gss_buffer_desc dispName; 342 gss_OID nameOid; 343 unsigned char *buf = NULL; 344 const unsigned char tokId[] = "\x04\x01"; 345 const unsigned int tokIdLen = 2; 346 const int mechOidLenLen = 2, mechOidTagLen = 1, nameLenLen = 4; 347 int mechOidDERLen = 0; 348 int mechOidLen = 0; 349 350 mech = gssint_get_mechanism(mech_type); 351 if (!mech) 352 return (GSS_S_BAD_MECH); 353 354 if (mech->gss_export_name) { 355 status = mech->gss_export_name( 356 mech->context, /* SUNW17PACresync */ 357 minor_status, 358 internal_name, 359 name_buf); 360 if (status != GSS_S_COMPLETE) 361 map_error(minor_status, mech); 362 return status; 363 } 364 365 /* 366 * if we are here it is because the mechanism does not provide 367 * a gss_export_name so we will use our implementation. We 368 * do required that the mechanism define a gss_display_name. 369 */ 370 if (!mech->gss_display_name) 371 return (GSS_S_UNAVAILABLE); 372 373 /* 374 * NOTE: RFC2743 (section 3.2) governs the format of the outer 375 * wrapper of exported names; the mechanisms' specs govern 376 * the format of the inner portion of the exported name 377 * and, for some (e.g., RFC1964, the Kerberos V mech), a 378 * generic default as implemented here will do. 379 * 380 * The outer wrapper of an exported MN is: 2-octet tok Id 381 * (0x0401) + 2-octet network-byte order mech OID length + mech 382 * oid (in DER format, including DER tag and DER length) + 383 * 4-octet network-byte order length of inner portion + inner 384 * portion. 385 * 386 * For the Kerberos V mechanism the inner portion of an exported 387 * MN is the display name string and ignores the name type OID 388 * altogether. And we hope this will be so for any future 389 * mechanisms also, so that factoring name export/import out of 390 * the mech and into libgss pays off. 391 */ 392 if ((status = mech->gss_display_name( 393 mech->context, 394 minor_status, 395 internal_name, 396 &dispName, 397 &nameOid)) 398 != GSS_S_COMPLETE) { 399 map_error(minor_status, mech); 400 return (status); 401 } 402 403 /* determine the size of the buffer needed */ 404 mechOidDERLen = gssint_der_length_size(mech_type->length); 405 name_buf->length = tokIdLen + mechOidLenLen + 406 mechOidTagLen + mechOidDERLen + 407 mech_type->length + 408 nameLenLen + dispName.length; 409 if ((name_buf->value = (void*)malloc(name_buf->length)) == 410 (void*)NULL) { 411 name_buf->length = 0; 412 (void) gss_release_buffer(&status, &dispName); 413 return (GSS_S_FAILURE); 414 } 415 416 /* now create the name ..... */ 417 buf = (unsigned char *)name_buf->value; 418 (void) memset(name_buf->value, 0, name_buf->length); 419 (void) memcpy(buf, tokId, tokIdLen); 420 buf += tokIdLen; 421 422 /* spec allows only 2 bytes for the mech oid length */ 423 mechOidLen = mechOidDERLen + mechOidTagLen + mech_type->length; 424 store_16_be(mechOidLen, buf); 425 buf += 2; 426 427 /* 428 * DER Encoding of mech OID contains OID Tag (0x06), length and 429 * mech OID value 430 */ 431 *buf++ = 0x06; 432 if (gssint_put_der_length(mech_type->length, &buf, 433 (name_buf->length - tokIdLen -2)) != 0) { 434 name_buf->length = 0; 435 free(name_buf->value); 436 (void) gss_release_buffer(&status, &dispName); 437 return (GSS_S_FAILURE); 438 } 439 440 (void) memcpy(buf, mech_type->elements, mech_type->length); 441 buf += mech_type->length; 442 443 /* spec designates the next 4 bytes for the name length */ 444 store_32_be(dispName.length, buf); 445 buf += 4; 446 447 /* for the final ingredient - add the name from gss_display_name */ 448 (void) memcpy(buf, dispName.value, dispName.length); 449 450 /* release the buffer obtained from gss_display_name */ 451 (void) gss_release_buffer(minor_status, &dispName); 452 return (GSS_S_COMPLETE); 453 } /* gssint_export_internal_name */ 454 455 OM_uint32 gssint_display_internal_name (minor_status, mech_type, internal_name, 456 external_name, name_type) 457 OM_uint32 *minor_status; 458 gss_OID mech_type; 459 gss_name_t internal_name; 460 gss_buffer_t external_name; 461 gss_OID *name_type; 462 { 463 OM_uint32 status; 464 gss_mechanism mech; 465 466 mech = gssint_get_mechanism (mech_type); 467 if (mech) { 468 if (mech->gss_display_name) { 469 status = mech->gss_display_name ( 470 mech->context, 471 minor_status, 472 internal_name, 473 external_name, 474 name_type); 475 if (status != GSS_S_COMPLETE) 476 map_error(minor_status, mech); 477 } else 478 status = GSS_S_UNAVAILABLE; 479 480 return (status); 481 } 482 483 return (GSS_S_BAD_MECH); 484 } 485 486 OM_uint32 gssint_release_internal_name (minor_status, mech_type, internal_name) 487 OM_uint32 *minor_status; 488 gss_OID mech_type; 489 gss_name_t *internal_name; 490 { 491 OM_uint32 status; 492 gss_mechanism mech; 493 494 mech = gssint_get_mechanism (mech_type); 495 if (mech) { 496 if (mech->gss_release_name) { 497 status = mech->gss_release_name ( 498 mech->context, 499 minor_status, 500 internal_name); 501 if (status != GSS_S_COMPLETE) 502 map_error(minor_status, mech); 503 } else 504 status = GSS_S_UNAVAILABLE; 505 506 return (status); 507 } 508 509 return (GSS_S_BAD_MECH); 510 } 511 512 OM_uint32 gssint_delete_internal_sec_context (minor_status, 513 mech_type, 514 internal_ctx, 515 output_token) 516 OM_uint32 *minor_status; 517 gss_OID mech_type; 518 gss_ctx_id_t *internal_ctx; 519 gss_buffer_t output_token; 520 { 521 OM_uint32 status; 522 gss_mechanism mech; 523 524 mech = gssint_get_mechanism (mech_type); 525 if (mech) { 526 if (mech->gss_delete_sec_context) 527 status = mech->gss_delete_sec_context ( 528 mech->context, /* SUNW17PACresync */ 529 minor_status, 530 internal_ctx, 531 output_token); 532 else 533 /* SUNW17PACresync - map error here? */ 534 status = GSS_S_UNAVAILABLE; 535 536 return (status); 537 } 538 539 return (GSS_S_BAD_MECH); 540 } 541 542 /* 543 * This function converts an internal gssapi name to a union gssapi 544 * name. Note that internal_name should be considered "consumed" by 545 * this call, whether or not we return an error. 546 */ 547 OM_uint32 gssint_convert_name_to_union_name(minor_status, mech, 548 internal_name, external_name) 549 OM_uint32 *minor_status; 550 gss_mechanism mech; 551 gss_name_t internal_name; 552 gss_name_t *external_name; 553 { 554 OM_uint32 major_status,tmp; 555 gss_union_name_t union_name; 556 557 union_name = (gss_union_name_t) malloc (sizeof(gss_union_name_desc)); 558 if (!union_name) { 559 major_status = GSS_S_FAILURE; 560 *minor_status = ENOMEM; 561 map_errcode(minor_status); 562 goto allocation_failure; 563 } 564 union_name->mech_type = 0; 565 union_name->mech_name = internal_name; 566 union_name->name_type = 0; 567 union_name->external_name = 0; 568 569 major_status = generic_gss_copy_oid(minor_status, &mech->mech_type, 570 &union_name->mech_type); 571 if (major_status != GSS_S_COMPLETE) { 572 map_errcode(minor_status); 573 goto allocation_failure; 574 } 575 576 union_name->external_name = 577 (gss_buffer_t) malloc(sizeof(gss_buffer_desc)); 578 if (!union_name->external_name) { 579 major_status = GSS_S_FAILURE; 580 *minor_status = ENOMEM; 581 goto allocation_failure; 582 } 583 584 union_name->external_name->length = 0; 585 union_name->external_name->value = 0; 586 587 major_status = mech->gss_display_name( 588 mech->context, /* SUNW17PACresync */ 589 minor_status, 590 internal_name, 591 union_name->external_name, 592 &union_name->name_type); 593 if (major_status != GSS_S_COMPLETE) { 594 map_error(minor_status, mech); 595 goto allocation_failure; 596 } 597 598 union_name->loopback = union_name; 599 *external_name = (gss_name_t) union_name; 600 return (GSS_S_COMPLETE); 601 602 allocation_failure: 603 if (union_name) { 604 if (union_name->external_name) { 605 if (union_name->external_name->value) 606 free(union_name->external_name->value); 607 free(union_name->external_name); 608 } 609 if (union_name->name_type) 610 (void) gss_release_oid(&tmp, &union_name->name_type); 611 if (union_name->mech_type) 612 (void) gss_release_oid(&tmp, &union_name->mech_type); 613 free(union_name); 614 } 615 /* 616 * do as the top comment says - since we are now owners of 617 * internal_name, we must clean it up 618 */ 619 if (internal_name) 620 (void) gssint_release_internal_name(&tmp, &mech->mech_type, 621 &internal_name); 622 return (major_status); 623 } 624 625 /* 626 * Glue routine for returning the mechanism-specific credential from a 627 * external union credential. 628 */ 629 gss_cred_id_t 630 gssint_get_mechanism_cred(union_cred, mech_type) 631 gss_union_cred_t union_cred; 632 gss_OID mech_type; 633 { 634 int i; 635 636 if (union_cred == (gss_union_cred_t) GSS_C_NO_CREDENTIAL) 637 return GSS_C_NO_CREDENTIAL; 638 639 /* 640 * SUNW17PACresync 641 * Disable this block as it causes problems for gss_add_cred 642 * for HTTP SSO (and also probably causes STC gss.13 to fail too). 643 */ 644 #if 0 645 /* SPNEGO mechanism will again call into GSSAPI */ 646 if (g_OID_equal(&gss_spnego_mechanism_oid_desc, mech_type)) 647 return (gss_cred_id_t)union_cred; 648 #endif 649 650 for (i=0; i < union_cred->count; i++) { 651 if (g_OID_equal(mech_type, &union_cred->mechs_array[i])) 652 return union_cred->cred_array[i]; 653 654 /* for SPNEGO, check the next-lower set of creds */ 655 if (g_OID_equal(&gss_spnego_mechanism_oid_desc, &union_cred->mechs_array[i])) { 656 gss_union_cred_t candidate_cred; 657 gss_cred_id_t sub_cred; 658 659 candidate_cred = (gss_union_cred_t)union_cred->cred_array[i]; 660 sub_cred = gssint_get_mechanism_cred(candidate_cred, mech_type); 661 662 if(sub_cred != GSS_C_NO_CREDENTIAL) 663 return sub_cred; 664 } 665 } 666 667 return GSS_C_NO_CREDENTIAL; 668 } 669 670 /* 671 * Routine to create and copy the gss_buffer_desc structure. 672 * Both space for the structure and the data is allocated. 673 */ 674 OM_uint32 675 gssint_create_copy_buffer(srcBuf, destBuf, addNullChar) 676 const gss_buffer_t srcBuf; 677 gss_buffer_t *destBuf; 678 int addNullChar; 679 { 680 gss_buffer_t aBuf; 681 unsigned int len; 682 683 if (destBuf == NULL) 684 return (GSS_S_CALL_INACCESSIBLE_WRITE); 685 686 *destBuf = 0; 687 688 aBuf = (gss_buffer_t)malloc(sizeof (gss_buffer_desc)); 689 if (!aBuf) 690 return (GSS_S_FAILURE); 691 692 if (addNullChar) 693 len = srcBuf->length + 1; 694 else 695 len = srcBuf->length; 696 697 if (!(aBuf->value = (void*)malloc(len))) { 698 free(aBuf); 699 return (GSS_S_FAILURE); 700 } 701 702 703 (void) memcpy(aBuf->value, srcBuf->value, srcBuf->length); 704 aBuf->length = srcBuf->length; 705 *destBuf = aBuf; 706 707 /* optionally add a NULL character */ 708 if (addNullChar) 709 ((char *)aBuf->value)[aBuf->length] = '\0'; 710 711 return (GSS_S_COMPLETE); 712 } /* ****** gssint_create_copy_buffer ****** */ 713 714