1 /* 2 * Copyright (c) 1997 - 2000 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include "krb5/gsskrb5_locl.h" 35 #include <gssapi_mech.h> 36 37 RCSID("$Id: external.c 22128 2007-12-04 00:56:55Z lha $"); 38 39 /* 40 * The implementation must reserve static storage for a 41 * gss_OID_desc object containing the value 42 * {10, (void *)"\x2a\x86\x48\x86\xf7\x12" 43 * "\x01\x02\x01\x01"}, 44 * corresponding to an object-identifier value of 45 * {iso(1) member-body(2) United States(840) mit(113554) 46 * infosys(1) gssapi(2) generic(1) user_name(1)}. The constant 47 * GSS_C_NT_USER_NAME should be initialized to point 48 * to that gss_OID_desc. 49 */ 50 51 static gss_OID_desc gss_c_nt_user_name_oid_desc = 52 {10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x01")}; 53 54 gss_OID GSS_C_NT_USER_NAME = &gss_c_nt_user_name_oid_desc; 55 56 /* 57 * The implementation must reserve static storage for a 58 * gss_OID_desc object containing the value 59 * {10, (void *)"\x2a\x86\x48\x86\xf7\x12" 60 * "\x01\x02\x01\x02"}, 61 * corresponding to an object-identifier value of 62 * {iso(1) member-body(2) United States(840) mit(113554) 63 * infosys(1) gssapi(2) generic(1) machine_uid_name(2)}. 64 * The constant GSS_C_NT_MACHINE_UID_NAME should be 65 * initialized to point to that gss_OID_desc. 66 */ 67 68 static gss_OID_desc gss_c_nt_machine_uid_name_oid_desc = 69 {10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x02")}; 70 71 gss_OID GSS_C_NT_MACHINE_UID_NAME = &gss_c_nt_machine_uid_name_oid_desc; 72 73 /* 74 * The implementation must reserve static storage for a 75 * gss_OID_desc object containing the value 76 * {10, (void *)"\x2a\x86\x48\x86\xf7\x12" 77 * "\x01\x02\x01\x03"}, 78 * corresponding to an object-identifier value of 79 * {iso(1) member-body(2) United States(840) mit(113554) 80 * infosys(1) gssapi(2) generic(1) string_uid_name(3)}. 81 * The constant GSS_C_NT_STRING_UID_NAME should be 82 * initialized to point to that gss_OID_desc. 83 */ 84 85 static gss_OID_desc gss_c_nt_string_uid_name_oid_desc = 86 {10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x03")}; 87 88 gss_OID GSS_C_NT_STRING_UID_NAME = &gss_c_nt_string_uid_name_oid_desc; 89 90 /* 91 * The implementation must reserve static storage for a 92 * gss_OID_desc object containing the value 93 * {6, (void *)"\x2b\x06\x01\x05\x06\x02"}, 94 * corresponding to an object-identifier value of 95 * {iso(1) org(3) dod(6) internet(1) security(5) 96 * nametypes(6) gss-host-based-services(2)). The constant 97 * GSS_C_NT_HOSTBASED_SERVICE_X should be initialized to point 98 * to that gss_OID_desc. This is a deprecated OID value, and 99 * implementations wishing to support hostbased-service names 100 * should instead use the GSS_C_NT_HOSTBASED_SERVICE OID, 101 * defined below, to identify such names; 102 * GSS_C_NT_HOSTBASED_SERVICE_X should be accepted a synonym 103 * for GSS_C_NT_HOSTBASED_SERVICE when presented as an input 104 * parameter, but should not be emitted by GSS-API 105 * implementations 106 */ 107 108 static gss_OID_desc gss_c_nt_hostbased_service_x_oid_desc = 109 {6, rk_UNCONST("\x2b\x06\x01\x05\x06\x02")}; 110 111 gss_OID GSS_C_NT_HOSTBASED_SERVICE_X = &gss_c_nt_hostbased_service_x_oid_desc; 112 113 /* 114 * The implementation must reserve static storage for a 115 * gss_OID_desc object containing the value 116 * {10, (void *)"\x2a\x86\x48\x86\xf7\x12" 117 * "\x01\x02\x01\x04"}, corresponding to an 118 * object-identifier value of {iso(1) member-body(2) 119 * Unites States(840) mit(113554) infosys(1) gssapi(2) 120 * generic(1) service_name(4)}. The constant 121 * GSS_C_NT_HOSTBASED_SERVICE should be initialized 122 * to point to that gss_OID_desc. 123 */ 124 static gss_OID_desc gss_c_nt_hostbased_service_oid_desc = 125 {10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x04")}; 126 127 gss_OID GSS_C_NT_HOSTBASED_SERVICE = &gss_c_nt_hostbased_service_oid_desc; 128 129 /* 130 * The implementation must reserve static storage for a 131 * gss_OID_desc object containing the value 132 * {6, (void *)"\x2b\x06\01\x05\x06\x03"}, 133 * corresponding to an object identifier value of 134 * {1(iso), 3(org), 6(dod), 1(internet), 5(security), 135 * 6(nametypes), 3(gss-anonymous-name)}. The constant 136 * and GSS_C_NT_ANONYMOUS should be initialized to point 137 * to that gss_OID_desc. 138 */ 139 140 static gss_OID_desc gss_c_nt_anonymous_oid_desc = 141 {6, rk_UNCONST("\x2b\x06\01\x05\x06\x03")}; 142 143 gss_OID GSS_C_NT_ANONYMOUS = &gss_c_nt_anonymous_oid_desc; 144 145 /* 146 * The implementation must reserve static storage for a 147 * gss_OID_desc object containing the value 148 * {6, (void *)"\x2b\x06\x01\x05\x06\x04"}, 149 * corresponding to an object-identifier value of 150 * {1(iso), 3(org), 6(dod), 1(internet), 5(security), 151 * 6(nametypes), 4(gss-api-exported-name)}. The constant 152 * GSS_C_NT_EXPORT_NAME should be initialized to point 153 * to that gss_OID_desc. 154 */ 155 156 static gss_OID_desc gss_c_nt_export_name_oid_desc = 157 {6, rk_UNCONST("\x2b\x06\x01\x05\x06\x04") }; 158 159 gss_OID GSS_C_NT_EXPORT_NAME = &gss_c_nt_export_name_oid_desc; 160 161 /* 162 * This name form shall be represented by the Object Identifier {iso(1) 163 * member-body(2) United States(840) mit(113554) infosys(1) gssapi(2) 164 * krb5(2) krb5_name(1)}. The recommended symbolic name for this type 165 * is "GSS_KRB5_NT_PRINCIPAL_NAME". 166 */ 167 168 static gss_OID_desc gss_krb5_nt_principal_name_oid_desc = 169 {10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x01") }; 170 171 gss_OID GSS_KRB5_NT_PRINCIPAL_NAME = &gss_krb5_nt_principal_name_oid_desc; 172 173 /* 174 * This name form shall be represented by the Object Identifier {iso(1) 175 * member-body(2) United States(840) mit(113554) infosys(1) gssapi(2) 176 * generic(1) user_name(1)}. The recommended symbolic name for this 177 * type is "GSS_KRB5_NT_USER_NAME". 178 */ 179 180 gss_OID GSS_KRB5_NT_USER_NAME = &gss_c_nt_user_name_oid_desc; 181 182 /* 183 * This name form shall be represented by the Object Identifier {iso(1) 184 * member-body(2) United States(840) mit(113554) infosys(1) gssapi(2) 185 * generic(1) machine_uid_name(2)}. The recommended symbolic name for 186 * this type is "GSS_KRB5_NT_MACHINE_UID_NAME". 187 */ 188 189 gss_OID GSS_KRB5_NT_MACHINE_UID_NAME = &gss_c_nt_machine_uid_name_oid_desc; 190 191 /* 192 * This name form shall be represented by the Object Identifier {iso(1) 193 * member-body(2) United States(840) mit(113554) infosys(1) gssapi(2) 194 * generic(1) string_uid_name(3)}. The recommended symbolic name for 195 * this type is "GSS_KRB5_NT_STRING_UID_NAME". 196 */ 197 198 gss_OID GSS_KRB5_NT_STRING_UID_NAME = &gss_c_nt_string_uid_name_oid_desc; 199 200 /* 201 * To support ongoing experimentation, testing, and evolution of the 202 * specification, the Kerberos V5 GSS-API mechanism as defined in this 203 * and any successor memos will be identified with the following Object 204 * Identifier, as defined in RFC-1510, until the specification is 205 * advanced to the level of Proposed Standard RFC: 206 * 207 * {iso(1), org(3), dod(5), internet(1), security(5), kerberosv5(2)} 208 * 209 * Upon advancement to the level of Proposed Standard RFC, the Kerberos 210 * V5 GSS-API mechanism will be identified by an Object Identifier 211 * having the value: 212 * 213 * {iso(1) member-body(2) United States(840) mit(113554) infosys(1) 214 * gssapi(2) krb5(2)} 215 */ 216 217 #if 0 /* This is the old OID */ 218 219 static gss_OID_desc gss_krb5_mechanism_oid_desc = 220 {5, rk_UNCONST("\x2b\x05\x01\x05\x02")}; 221 222 #endif 223 224 static gss_OID_desc gss_krb5_mechanism_oid_desc = 225 {9, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02") }; 226 227 gss_OID GSS_KRB5_MECHANISM = &gss_krb5_mechanism_oid_desc; 228 229 /* 230 * draft-ietf-cat-iakerb-09, IAKERB: 231 * The mechanism ID for IAKERB proxy GSS-API Kerberos, in accordance 232 * with the mechanism proposed by SPNEGO [7] for negotiating protocol 233 * variations, is: {iso(1) org(3) dod(6) internet(1) security(5) 234 * mechanisms(5) iakerb(10) iakerbProxyProtocol(1)}. The proposed 235 * mechanism ID for IAKERB minimum messages GSS-API Kerberos, in 236 * accordance with the mechanism proposed by SPNEGO for negotiating 237 * protocol variations, is: {iso(1) org(3) dod(6) internet(1) 238 * security(5) mechanisms(5) iakerb(10) 239 * iakerbMinimumMessagesProtocol(2)}. 240 */ 241 242 static gss_OID_desc gss_iakerb_proxy_mechanism_oid_desc = 243 {7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0a\x01")}; 244 245 gss_OID GSS_IAKERB_PROXY_MECHANISM = &gss_iakerb_proxy_mechanism_oid_desc; 246 247 static gss_OID_desc gss_iakerb_min_msg_mechanism_oid_desc = 248 {7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0a\x02") }; 249 250 gss_OID GSS_IAKERB_MIN_MSG_MECHANISM = &gss_iakerb_min_msg_mechanism_oid_desc; 251 252 /* 253 * 254 */ 255 256 static gss_OID_desc gss_c_peer_has_updated_spnego_oid_desc = 257 {9, (void *)"\x2b\x06\x01\x04\x01\xa9\x4a\x13\x05"}; 258 259 gss_OID GSS_C_PEER_HAS_UPDATED_SPNEGO = &gss_c_peer_has_updated_spnego_oid_desc; 260 261 /* 262 * 1.2.752.43.13 Heimdal GSS-API Extentions 263 */ 264 265 /* 1.2.752.43.13.1 */ 266 static gss_OID_desc gss_krb5_copy_ccache_x_oid_desc = 267 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x01")}; 268 269 gss_OID GSS_KRB5_COPY_CCACHE_X = &gss_krb5_copy_ccache_x_oid_desc; 270 271 /* 1.2.752.43.13.2 */ 272 static gss_OID_desc gss_krb5_get_tkt_flags_x_oid_desc = 273 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x02")}; 274 275 gss_OID GSS_KRB5_GET_TKT_FLAGS_X = &gss_krb5_get_tkt_flags_x_oid_desc; 276 277 /* 1.2.752.43.13.3 */ 278 static gss_OID_desc gss_krb5_extract_authz_data_from_sec_context_x_oid_desc = 279 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x03")}; 280 281 gss_OID GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_X = &gss_krb5_extract_authz_data_from_sec_context_x_oid_desc; 282 283 /* 1.2.752.43.13.4 */ 284 static gss_OID_desc gss_krb5_compat_des3_mic_x_oid_desc = 285 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x04")}; 286 287 gss_OID GSS_KRB5_COMPAT_DES3_MIC_X = &gss_krb5_compat_des3_mic_x_oid_desc; 288 289 /* 1.2.752.43.13.5 */ 290 static gss_OID_desc gss_krb5_register_acceptor_identity_x_desc = 291 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x05")}; 292 293 gss_OID GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X = &gss_krb5_register_acceptor_identity_x_desc; 294 295 /* 1.2.752.43.13.6 */ 296 static gss_OID_desc gss_krb5_export_lucid_context_x_desc = 297 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x06")}; 298 299 gss_OID GSS_KRB5_EXPORT_LUCID_CONTEXT_X = &gss_krb5_export_lucid_context_x_desc; 300 301 /* 1.2.752.43.13.6.1 */ 302 static gss_OID_desc gss_krb5_export_lucid_context_v1_x_desc = 303 {7, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x06\x01")}; 304 305 gss_OID GSS_KRB5_EXPORT_LUCID_CONTEXT_V1_X = &gss_krb5_export_lucid_context_v1_x_desc; 306 307 /* 1.2.752.43.13.7 */ 308 static gss_OID_desc gss_krb5_set_dns_canonicalize_x_desc = 309 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x07")}; 310 311 gss_OID GSS_KRB5_SET_DNS_CANONICALIZE_X = &gss_krb5_set_dns_canonicalize_x_desc; 312 313 /* 1.2.752.43.13.8 */ 314 static gss_OID_desc gss_krb5_get_subkey_x_desc = 315 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x08")}; 316 317 gss_OID GSS_KRB5_GET_SUBKEY_X = &gss_krb5_get_subkey_x_desc; 318 319 /* 1.2.752.43.13.9 */ 320 static gss_OID_desc gss_krb5_get_initiator_subkey_x_desc = 321 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x09")}; 322 323 gss_OID GSS_KRB5_GET_INITIATOR_SUBKEY_X = &gss_krb5_get_initiator_subkey_x_desc; 324 325 /* 1.2.752.43.13.10 */ 326 static gss_OID_desc gss_krb5_get_acceptor_subkey_x_desc = 327 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0a")}; 328 329 gss_OID GSS_KRB5_GET_ACCEPTOR_SUBKEY_X = &gss_krb5_get_acceptor_subkey_x_desc; 330 331 /* 1.2.752.43.13.11 */ 332 static gss_OID_desc gss_krb5_send_to_kdc_x_desc = 333 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0b")}; 334 335 gss_OID GSS_KRB5_SEND_TO_KDC_X = &gss_krb5_send_to_kdc_x_desc; 336 337 /* 1.2.752.43.13.12 */ 338 static gss_OID_desc gss_krb5_get_authtime_x_desc = 339 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0c")}; 340 341 gss_OID GSS_KRB5_GET_AUTHTIME_X = &gss_krb5_get_authtime_x_desc; 342 343 /* 1.2.752.43.13.13 */ 344 static gss_OID_desc gss_krb5_get_service_keyblock_x_desc = 345 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0d")}; 346 347 gss_OID GSS_KRB5_GET_SERVICE_KEYBLOCK_X = &gss_krb5_get_service_keyblock_x_desc; 348 349 /* 1.2.752.43.13.14 */ 350 static gss_OID_desc gss_krb5_set_allowable_enctypes_x_desc = 351 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0e")}; 352 353 gss_OID GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X = &gss_krb5_set_allowable_enctypes_x_desc; 354 355 /* 1.2.752.43.13.15 */ 356 static gss_OID_desc gss_krb5_set_default_realm_x_desc = 357 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0f")}; 358 359 gss_OID GSS_KRB5_SET_DEFAULT_REALM_X = &gss_krb5_set_default_realm_x_desc; 360 361 /* 1.2.752.43.13.16 */ 362 static gss_OID_desc gss_krb5_ccache_name_x_desc = 363 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x10")}; 364 365 gss_OID GSS_KRB5_CCACHE_NAME_X = &gss_krb5_ccache_name_x_desc; 366 367 /* 1.2.752.43.14.1 */ 368 static gss_OID_desc gss_sasl_digest_md5_mechanism_desc = 369 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0e\x01") }; 370 371 gss_OID GSS_SASL_DIGEST_MD5_MECHANISM = &gss_sasl_digest_md5_mechanism_desc; 372 373 /* 374 * Context for krb5 calls. 375 */ 376 377 /* 378 * 379 */ 380 381 static gssapi_mech_interface_desc krb5_mech = { 382 GMI_VERSION, 383 "kerberos 5", 384 {9, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" }, 385 _gsskrb5_acquire_cred, 386 _gsskrb5_release_cred, 387 _gsskrb5_init_sec_context, 388 _gsskrb5_accept_sec_context, 389 _gsskrb5_process_context_token, 390 _gsskrb5_delete_sec_context, 391 _gsskrb5_context_time, 392 _gsskrb5_get_mic, 393 _gsskrb5_verify_mic, 394 _gsskrb5_wrap, 395 _gsskrb5_unwrap, 396 _gsskrb5_display_status, 397 _gsskrb5_indicate_mechs, 398 _gsskrb5_compare_name, 399 _gsskrb5_display_name, 400 _gsskrb5_import_name, 401 _gsskrb5_export_name, 402 _gsskrb5_release_name, 403 _gsskrb5_inquire_cred, 404 _gsskrb5_inquire_context, 405 _gsskrb5_wrap_size_limit, 406 _gsskrb5_add_cred, 407 _gsskrb5_inquire_cred_by_mech, 408 _gsskrb5_export_sec_context, 409 _gsskrb5_import_sec_context, 410 _gsskrb5_inquire_names_for_mech, 411 _gsskrb5_inquire_mechs_for_name, 412 _gsskrb5_canonicalize_name, 413 _gsskrb5_duplicate_name, 414 _gsskrb5_inquire_sec_context_by_oid, 415 _gsskrb5_inquire_cred_by_oid, 416 _gsskrb5_set_sec_context_option, 417 _gsskrb5_set_cred_option, 418 _gsskrb5_pseudo_random 419 }; 420 421 gssapi_mech_interface 422 __gss_krb5_initialize(void) 423 { 424 return &krb5_mech; 425 } 426