xref: /titanic_50/usr/src/uts/common/gssapi/mechs/krb5/krb5mech.c (revision 8a16d130bdea488abf40f6692135d3c5b462fda4)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  * Copyright (c) 2011 Bayard G. Bell. All rights reserved.
25  *
26  * A module for Kerberos V5  security mechanism.
27  *
28  */
29 
30 #include <sys/types.h>
31 #include <sys/modctl.h>
32 #include <sys/errno.h>
33 #include <mechglueP.h>
34 #include <gssapiP_krb5.h>
35 #include <gssapi_err_generic.h>
36 #include <gssapi/kgssapi_defs.h>
37 #include <sys/debug.h>
38 #include <k5-int.h>
39 
40 /* mechglue wrappers */
41 
42 static OM_uint32 k5glue_delete_sec_context
43 	(void *, OM_uint32 *,	/* minor_status */
44 	gss_ctx_id_t *,	/* context_handle */
45 	gss_buffer_t,	/* output_token */
46 	OM_uint32);
47 
48 static OM_uint32 k5glue_sign
49 	(void *, OM_uint32 *,	/* minor_status */
50 	gss_ctx_id_t,	/* context_handle */
51 	int,		/* qop_req */
52 	gss_buffer_t,	/* message_buffer */
53 	gss_buffer_t,	/* message_token */
54 	OM_uint32);
55 
56 static OM_uint32 k5glue_verify
57 	(void *, OM_uint32 *,	/* minor_status */
58 	gss_ctx_id_t,	/* context_handle */
59 	gss_buffer_t,	/* message_buffer */
60 	gss_buffer_t,	/* token_buffer */
61 	int *,	/* qop_state */
62 	OM_uint32);
63 
64 static OM_uint32 k5glue_seal
65 	(void *, OM_uint32 *,	/* minor_status */
66 	gss_ctx_id_t,		/* context_handle */
67 	int,			/* conf_req_flag */
68 	int,			/* qop_req */
69 	gss_buffer_t,		/* input_message_buffer */
70 	int *,			/* conf_state */
71 	gss_buffer_t,		/* output_message_buffer */
72 	OM_uint32);
73 
74 static OM_uint32 k5glue_unseal
75 	(void *, OM_uint32 *,	/* minor_status */
76 	gss_ctx_id_t,		/* context_handle */
77 	gss_buffer_t,		/* input_message_buffer */
78 	gss_buffer_t,		/* output_message_buffer */
79 	int *,			/* conf_state */
80 	int *,			/* qop_state */
81 	OM_uint32);
82 
83 static OM_uint32 k5glue_import_sec_context
84 	(void *, OM_uint32 *,		/* minor_status */
85 	gss_buffer_t,			/* interprocess_token */
86 	gss_ctx_id_t *);		/* context_handle */
87 
88 
89 
90 static	struct	gss_config krb5_mechanism =
91 	{{9, "\052\206\110\206\367\022\001\002\002"},
92 	NULL,	/* context */
93 	NULL,	/* next */
94 	TRUE,	/* uses_kmod */
95 	k5glue_unseal,
96 	k5glue_delete_sec_context,
97 	k5glue_seal,
98 	k5glue_import_sec_context,
99 	k5glue_sign,
100 	k5glue_verify,
101 	};
102 
103 static gss_mechanism
104 	gss_mech_initialize()
105 {
106 	return (&krb5_mechanism);
107 }
108 
109 
110 /*
111  * Module linkage information for the kernel.
112  */
113 extern struct mod_ops mod_miscops;
114 
115 static struct modlmisc modlmisc = {
116 	&mod_miscops, "Krb5 GSS mechanism"
117 };
118 
119 static struct modlinkage modlinkage = {
120 	MODREV_1,
121 	(void *)&modlmisc,
122 	NULL
123 };
124 
125 
126 static int krb5_fini_code = EBUSY;
127 
128 int
129 _init()
130 {
131 	int retval;
132 	gss_mechanism mech, tmp;
133 
134 	if ((retval = mod_install(&modlinkage)) != 0)
135 		return (retval);
136 
137 	mech = gss_mech_initialize();
138 
139 	mutex_enter(&__kgss_mech_lock);
140 	tmp = __kgss_get_mechanism(&mech->mech_type);
141 	if (tmp != NULL) {
142 
143 		KRB5_LOG0(KRB5_INFO,
144 		    "KRB5 GSS mechanism: mechanism already in table.\n");
145 
146 		if (tmp->uses_kmod == TRUE) {
147 			KRB5_LOG0(KRB5_INFO, "KRB5 GSS mechanism: mechanism "
148 			    "table supports kernel operations!\n");
149 		}
150 		/*
151 		 * keep us loaded, but let us be unloadable. This
152 		 * will give the developer time to trouble shoot
153 		 */
154 		krb5_fini_code = 0;
155 	} else {
156 		__kgss_add_mechanism(mech);
157 		ASSERT(__kgss_get_mechanism(&mech->mech_type) == mech);
158 	}
159 	mutex_exit(&__kgss_mech_lock);
160 
161 	return (0);
162 }
163 
164 int
165 _fini()
166 {
167 	int ret = krb5_fini_code;
168 
169 	if (ret == 0) {
170 		ret = (mod_remove(&modlinkage));
171 	}
172 	return (ret);
173 }
174 
175 int
176 _info(struct modinfo *modinfop)
177 {
178 	return (mod_info(&modlinkage, modinfop));
179 }
180 
181 /* ARGSUSED */
182 static OM_uint32
183 k5glue_delete_sec_context(ctx, minor_status, context_handle, output_token,
184 	gssd_ctx_verifier)
185 	void *ctx;
186 	OM_uint32 *minor_status;
187 	gss_ctx_id_t *context_handle;
188 	gss_buffer_t output_token;
189 	OM_uint32 gssd_ctx_verifier;
190 {
191 	return (krb5_gss_delete_sec_context(minor_status,
192 				    context_handle, output_token,
193 				    gssd_ctx_verifier));
194 }
195 
196 /* V2 */
197 /* ARGSUSED */
198 static OM_uint32
199 k5glue_import_sec_context(ctx, minor_status, interprocess_token, context_handle)
200 	void *ctx;
201 	OM_uint32 *minor_status;
202 	gss_buffer_t	interprocess_token;
203 	gss_ctx_id_t	 *context_handle;
204 {
205 	return (krb5_gss_import_sec_context(minor_status,
206 			interprocess_token,
207 			context_handle));
208 }
209 
210 /* V1 only */
211 /* ARGSUSED */
212 static OM_uint32
213 k5glue_seal(ctx, minor_status, context_handle, conf_req_flag, qop_req,
214 	    input_message_buffer, conf_state, output_message_buffer,
215 	    gssd_ctx_verifier)
216 	void *ctx;
217 	OM_uint32 *minor_status;
218 	gss_ctx_id_t context_handle;
219 	int conf_req_flag;
220 	int qop_req;
221 	gss_buffer_t input_message_buffer;
222 	int *conf_state;
223 	gss_buffer_t output_message_buffer;
224 	OM_uint32 gssd_ctx_verifier;
225 {
226 	return (krb5_gss_seal(minor_status, context_handle,
227 			conf_req_flag, qop_req, input_message_buffer,
228 			conf_state, output_message_buffer, gssd_ctx_verifier));
229 }
230 
231 /* ARGSUSED */
232 static OM_uint32
233 k5glue_sign(ctx, minor_status, context_handle,
234 		qop_req, message_buffer,
235 		message_token, gssd_ctx_verifier)
236 	void *ctx;
237 	OM_uint32 *minor_status;
238 	gss_ctx_id_t context_handle;
239 	int qop_req;
240 	gss_buffer_t message_buffer;
241 	gss_buffer_t message_token;
242 	OM_uint32 gssd_ctx_verifier;
243 {
244 	return (krb5_gss_sign(minor_status, context_handle,
245 		qop_req, message_buffer, message_token, gssd_ctx_verifier));
246 }
247 
248 /* ARGSUSED */
249 static OM_uint32
250 k5glue_unseal(ctx, minor_status, context_handle, input_message_buffer,
251 	    output_message_buffer, conf_state, qop_state, gssd_ctx_verifier)
252 	void *ctx;
253 	OM_uint32 *minor_status;
254 	gss_ctx_id_t context_handle;
255 	gss_buffer_t input_message_buffer;
256 	gss_buffer_t output_message_buffer;
257 	int *conf_state;
258 	int *qop_state;
259 	OM_uint32 gssd_ctx_verifier;
260 {
261 	return (krb5_gss_unseal(minor_status, context_handle,
262 				input_message_buffer, output_message_buffer,
263 				conf_state, qop_state, gssd_ctx_verifier));
264 }
265 
266 /* V1 only */
267 /* ARGSUSED */
268 static OM_uint32
269 k5glue_verify(ctx, minor_status, context_handle, message_buffer,
270 	    token_buffer, qop_state, gssd_ctx_verifier)
271 	void *ctx;
272 	OM_uint32 *minor_status;
273 	gss_ctx_id_t context_handle;
274 	gss_buffer_t message_buffer;
275 	gss_buffer_t token_buffer;
276 	int *qop_state;
277 	OM_uint32 gssd_ctx_verifier;
278 {
279 	return (krb5_gss_verify(minor_status,
280 				context_handle,
281 				message_buffer,
282 				token_buffer,
283 				qop_state, gssd_ctx_verifier));
284 }
285