1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 /* 27 * glue routine gss_import_name 28 * 29 */ 30 31 #include <mechglueP.h> 32 #include <stdio.h> 33 #ifdef HAVE_STDLIB_H 34 #include <stdlib.h> 35 #endif 36 #include <string.h> 37 #include <errno.h> 38 39 extern int 40 get_der_length(unsigned char **, unsigned int, unsigned int *); 41 42 /* local function to import GSS_C_EXPORT_NAME names */ 43 static OM_uint32 importExportName(OM_uint32 *, gss_union_name_t); 44 45 static OM_uint32 46 val_imp_name_args( 47 OM_uint32 *minor_status, 48 gss_buffer_t input_name_buffer, 49 gss_name_t *output_name) 50 { 51 52 /* Initialize outputs. */ 53 54 if (minor_status != NULL) 55 *minor_status = 0; 56 57 if (output_name != NULL) 58 *output_name = GSS_C_NO_NAME; 59 60 /* Validate arguments. */ 61 62 if (minor_status == NULL) 63 return (GSS_S_CALL_INACCESSIBLE_WRITE); 64 65 if (output_name == NULL) 66 return (GSS_S_CALL_INACCESSIBLE_WRITE); 67 68 if (input_name_buffer == GSS_C_NO_BUFFER) 69 return (GSS_S_CALL_INACCESSIBLE_READ | GSS_S_BAD_NAME); 70 71 if (GSS_EMPTY_BUFFER(input_name_buffer)) 72 return (GSS_S_CALL_INACCESSIBLE_READ | GSS_S_BAD_NAME); 73 74 return (GSS_S_COMPLETE); 75 } 76 77 OM_uint32 78 gss_import_name(minor_status, 79 input_name_buffer, 80 input_name_type, 81 output_name) 82 83 OM_uint32 *minor_status; 84 const gss_buffer_t input_name_buffer; 85 const gss_OID input_name_type; 86 gss_name_t *output_name; 87 { 88 gss_union_name_t union_name; 89 OM_uint32 major_status = GSS_S_FAILURE, tmp; 90 91 major_status = val_imp_name_args(minor_status, 92 input_name_buffer, 93 output_name); 94 if (major_status != GSS_S_COMPLETE) 95 return (major_status); 96 97 /* 98 * First create the union name struct that will hold the external 99 * name and the name type. 100 */ 101 union_name = (gss_union_name_t)malloc(sizeof (gss_union_name_desc)); 102 if (!union_name) 103 return (GSS_S_FAILURE); 104 105 union_name->mech_type = 0; 106 union_name->mech_name = 0; 107 union_name->name_type = 0; 108 union_name->external_name = 0; 109 110 /* 111 * All we do here is record the external name and name_type. 112 * When the name is actually used, the underlying gss_import_name() 113 * is called for the appropriate mechanism. The exception to this 114 * rule is when the name of GSS_C_NT_EXPORT_NAME type. If that is 115 * the case, then we make it MN in this call. 116 */ 117 major_status = gssint_create_copy_buffer(input_name_buffer, 118 &union_name->external_name, 0); 119 if (major_status != GSS_S_COMPLETE) { 120 free(union_name); 121 return (major_status); 122 } 123 124 if (input_name_type != GSS_C_NULL_OID) { 125 major_status = generic_gss_copy_oid(minor_status, 126 input_name_type, 127 &union_name->name_type); 128 if (major_status != GSS_S_COMPLETE) 129 goto allocation_failure; 130 } 131 132 /* 133 * In MIT Distribution the mechanism is determined from the nametype; 134 * This is not a good idea - first mechanism that supports a given 135 * name type is picked up; later on the caller can request a 136 * different mechanism. So we don't determine the mechanism here. Now 137 * the user level and kernel level import_name routine looks similar 138 * except the kernel routine makes a copy of the nametype structure. We 139 * do however make this an MN for names of GSS_C_NT_EXPORT_NAME type. 140 */ 141 if (input_name_type != GSS_C_NULL_OID && 142 g_OID_equal(input_name_type, GSS_C_NT_EXPORT_NAME)) { 143 major_status = importExportName(minor_status, union_name); 144 if (major_status != GSS_S_COMPLETE) 145 goto allocation_failure; 146 } 147 148 *output_name = (gss_name_t)union_name; 149 return (GSS_S_COMPLETE); 150 151 allocation_failure: 152 if (union_name) { 153 if (union_name->external_name) { 154 if (union_name->external_name->value) 155 free(union_name->external_name->value); 156 free(union_name->external_name); 157 } 158 if (union_name->name_type) 159 (void) generic_gss_release_oid(&tmp, 160 &union_name->name_type); 161 if (union_name->mech_name) 162 (void) __gss_release_internal_name(minor_status, 163 union_name->mech_type, 164 &union_name->mech_name); 165 if (union_name->mech_type) 166 (void) generic_gss_release_oid(&tmp, 167 &union_name->mech_type); 168 free(union_name); 169 } 170 return (major_status); 171 } 172 173 174 /* 175 * GSS export name constants 176 */ 177 static const char *expNameTokId = "\x04\x01"; 178 static const int expNameTokIdLen = 2; 179 static const int mechOidLenLen = 2; 180 static const int nameTypeLenLen = 2; 181 182 static OM_uint32 183 importExportName(minor, unionName) 184 OM_uint32 *minor; 185 gss_union_name_t unionName; 186 { 187 gss_OID_desc mechOid; 188 gss_buffer_desc expName; 189 unsigned char *buf; 190 gss_mechanism mech; 191 OM_uint32 major, mechOidLen, nameLen, curLength; 192 unsigned int bytes; 193 194 expName.value = unionName->external_name->value; 195 expName.length = unionName->external_name->length; 196 197 curLength = expNameTokIdLen + mechOidLenLen; 198 if (expName.length < curLength) 199 return (GSS_S_DEFECTIVE_TOKEN); 200 201 buf = (unsigned char *)expName.value; 202 if (memcmp(expNameTokId, buf, expNameTokIdLen) != 0) 203 return (GSS_S_DEFECTIVE_TOKEN); 204 205 buf += expNameTokIdLen; 206 207 /* extract the mechanism oid length */ 208 mechOidLen = (*buf++ << 8); 209 mechOidLen |= (*buf++); 210 curLength += mechOidLen; 211 if (expName.length < curLength) 212 return (GSS_S_DEFECTIVE_TOKEN); 213 /* 214 * The mechOid itself is encoded in DER format, OID Tag (0x06) 215 * length and the value of mech_OID 216 */ 217 if (*buf++ != 0x06) 218 return (GSS_S_DEFECTIVE_TOKEN); 219 220 /* 221 * mechoid Length is encoded twice; once in 2 bytes as 222 * explained in RFC2743 (under mechanism independent exported 223 * name object format) and once using DER encoding 224 * 225 * We verify both lengths. 226 */ 227 228 mechOid.length = get_der_length(&buf, 229 (expName.length - curLength), &bytes); 230 mechOid.elements = (void *)buf; 231 232 /* 233 * 'bytes' is the length of the DER length, '1' is for the DER 234 * tag for OID 235 */ 236 if ((bytes + mechOid.length + 1) != mechOidLen) 237 return (GSS_S_DEFECTIVE_TOKEN); 238 239 buf += mechOid.length; 240 if ((mech = __gss_get_mechanism(&mechOid)) == NULL) 241 return (GSS_S_BAD_MECH); 242 243 if (mech->gss_import_name == NULL) 244 return (GSS_S_UNAVAILABLE); 245 246 /* 247 * we must now determine if we should unwrap the name ourselves 248 * or make the mechanism do it - we should only unwrap it 249 * if we create it; so if mech->gss_export_name == NULL, we must 250 * have created it. 251 */ 252 if (mech->gss_export_name) { 253 if ((major = mech->gss_import_name(mech->context, minor, 254 &expName, (gss_OID)GSS_C_NT_EXPORT_NAME, 255 &unionName->mech_name)) != GSS_S_COMPLETE || 256 (major = generic_gss_copy_oid(minor, &mechOid, 257 &unionName->mech_type)) != 258 GSS_S_COMPLETE) { 259 return (major); 260 } 261 return (major); 262 } 263 /* 264 * we must have exported the name - so we now need to reconstruct it 265 * and call the mechanism to create it 266 * 267 * WARNING: Older versions of __gss_export_internal_name() did 268 * not export names correctly, but now it does. In 269 * order to stay compatible with existing exported 270 * names we must support names exported the broken 271 * way. 272 * 273 * Specifically, __gss_export_internal_name() used to include 274 * the name type OID in the encoding of the exported MN. 275 * Additionally, the Kerberos V mech used to make display names 276 * that included a null terminator which was counted in the 277 * display name gss_buffer_desc. 278 */ 279 curLength += 4; /* 4 bytes for name len */ 280 if (expName.length < curLength) 281 return (GSS_S_DEFECTIVE_TOKEN); 282 283 /* next 4 bytes in the name are the name length */ 284 nameLen = (*buf++) << 24; 285 nameLen |= (*buf++ << 16); 286 nameLen |= (*buf++ << 8); 287 nameLen |= (*buf++); 288 289 /* 290 * we use < here because bad code in rpcsec_gss rounds up exported 291 * name token lengths and pads with nulls, otherwise != would be 292 * appropriate 293 */ 294 curLength += nameLen; /* this is the total length */ 295 if (expName.length < curLength) 296 return (GSS_S_DEFECTIVE_TOKEN); 297 298 /* 299 * We detect broken exported names here: they always start with 300 * a two-octet network-byte order OID length, which is always 301 * less than 256 bytes, so the first octet of the length is 302 * always '\0', which is not allowed in GSS-API display names 303 * (or never occurs in them anyways). Of course, the OID 304 * shouldn't be there, but it is. After the OID (sans DER tag 305 * and length) there's the name itself, though null-terminated; 306 * this null terminator should also not be there, but it is. 307 */ 308 if (nameLen > 0 && *buf == '\0') { 309 OM_uint32 nameTypeLen; 310 /* next two bytes are the name oid */ 311 if (nameLen < nameTypeLenLen) 312 return (GSS_S_DEFECTIVE_TOKEN); 313 314 nameLen -= nameTypeLenLen; 315 316 nameTypeLen = (*buf++) << 8; 317 nameTypeLen |= (*buf++); 318 319 if (nameLen < nameTypeLen) 320 return (GSS_S_DEFECTIVE_TOKEN); 321 322 buf += nameTypeLen; 323 nameLen -= nameTypeLen; 324 325 /* 326 * adjust for expected null terminator that should 327 * really not be there 328 */ 329 if (nameLen > 0 && *(buf + nameLen - 1) == '\0') 330 nameLen--; 331 } 332 333 /* 334 * Can a name be null? Let the mech decide. 335 * 336 * NOTE: We use GSS_C_NULL_OID as the name type when importing 337 * the unwrapped name. Presumably the exported name had, 338 * prior to being exported been obtained in such a way 339 * that it has been properly perpared ("canonicalized," in 340 * GSS-API terms) accroding to some name type; we cannot 341 * tell what that name type was now, but the name should 342 * need no further preparation other than the lowest 343 * common denominator afforded by the mech to names 344 * imported with GSS_C_NULL_OID. For the Kerberos V mech 345 * this means doing less busywork too (particularly once 346 * IDN is thrown in with Kerberos V extensions). 347 */ 348 expName.length = nameLen; 349 expName.value = nameLen ? (void *)buf : NULL; 350 major = mech->gss_import_name(mech->context, minor, &expName, 351 GSS_C_NULL_OID, &unionName->mech_name); 352 if (major != GSS_S_COMPLETE) 353 return (major); 354 355 return (generic_gss_copy_oid(minor, &mechOid, &unionName->mech_type)); 356 } /* importExportName */ 357