source4/heimdal/lib/gssapi/sanon/negoex.c

   1 /*
   2  * Copyright (c) 2019-2020, AuriStor, Inc.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * - Redistributions of source code must retain the above copyright
  10  *   notice, this list of conditions and the following disclaimer.
  11  *
  12  * - Redistributions in binary form must reproduce the above copyright
  13  *   notice, this list of conditions and the following disclaimer in
  14  *   the documentation and/or other materials provided with the
  15  *   distribution.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  18  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  19  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  20  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  21  * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
  22  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  23  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  24  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  26  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  28  * OF THE POSSIBILITY OF SUCH DAMAGE.
  29  *
  30  */
  31
  32 #include "sanon_locl.h"
  33
  34 OM_uint32 GSSAPI_CALLCONV
  35 _gssspi_sanon_query_mechanism_info(OM_uint32 *minor,
  36                                    gss_const_OID mech_oid,
  37                                    unsigned char auth_scheme[16])
  38 {
  39     heim_assert(gss_oid_equal(mech_oid, GSS_SANON_X25519_MECHANISM),
  40                 "Invalid mechanism OID passed to query_mechanism_info");
  41
  42     *minor = 0;
  43
  44     /* {DEE384FF-1086-4E86-BE78-B94170BFD376} */
  45     memcpy(auth_scheme,
  46            "\xff\x84\xe3\xde\x86\x10\x86\x4e\xbe\x78\xb9\x41\x70\xbf\xd3\x76", 16);
  47
  48     return GSS_S_COMPLETE;
  49 }
  50
  51 OM_uint32
  52 _gss_sanon_inquire_negoex_key(OM_uint32 *minor,
  53                               const sanon_ctx sc,
  54                               gss_const_OID desired_object,
  55                               gss_buffer_set_t *data_set)
  56 {
  57     OM_uint32 major, tmpMinor;
  58     int initiator_key;
  59     uint8_t typebytes[4];
  60     gss_buffer_desc salt, keyvalue = GSS_C_EMPTY_BUFFER, keytype;
  61
  62     if (sc->rfc4121 == GSS_C_NO_CONTEXT) {
  63         *minor = KRB5KRB_AP_ERR_NOKEY;
  64         return GSS_S_UNAVAILABLE;
  65     }
  66
  67     initiator_key = !!(sc->is_initiator);
  68
  69     if (gss_oid_equal(desired_object, GSS_C_INQ_NEGOEX_VERIFY_KEY))
  70         initiator_key ^= 1;
  71     else if (!gss_oid_equal(desired_object, GSS_C_INQ_NEGOEX_KEY))
  72         return GSS_S_UNAVAILABLE;
  73
  74     if (initiator_key) {
  75         salt.length = sizeof("sanon-x25519-initiator-negoex-key") - 1;
  76         salt.value  = "sanon-x25519-initiator-negoex-key";
  77     } else {
  78         salt.length = sizeof("sanon-x25519-acceptor-negoex-key") - 1;
  79         salt.value  = "sanon-x25519-acceptor-negoex-key";
  80     }
  81
  82     _gss_mg_encode_le_uint32(KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128, typebytes);
  83
  84     keytype.length = sizeof(typebytes);
  85     keytype.value = typebytes;
  86
  87     major = gss_pseudo_random(minor, sc->rfc4121,
  88                               GSS_C_PRF_KEY_FULL, &salt,
  89                               16, &keyvalue);
  90     if (major == GSS_S_COMPLETE)
  91         major = gss_add_buffer_set_member(minor, &keyvalue, data_set);
  92     if (major == GSS_S_COMPLETE)
  93         major = gss_add_buffer_set_member(minor, &keytype, data_set);
  94
  95     _gss_secure_release_buffer(&tmpMinor, &keyvalue);
  96
  97     return major;
  98 }
  99
 100 OM_uint32 GSSAPI_CALLCONV
 101 _gssspi_sanon_query_meta_data(OM_uint32 *minor,
 102                               gss_const_OID mech_oid,
 103                               gss_cred_id_t cred_handle,
 104                               gss_ctx_id_t *context_handle,
 105                               gss_const_name_t targ_name,
 106                               OM_uint32 req_flags,
 107                               gss_buffer_t meta_data)
 108 {
 109     int is_initiator = (targ_name != GSS_C_NO_NAME);
 110
 111     *minor = 0;
 112
 113     if (is_initiator &&
 114         !_gss_sanon_available_p(cred_handle, targ_name, req_flags))
 115         return GSS_S_UNAVAILABLE;
 116
 117     return GSS_S_COMPLETE;
 118 }
 119
 120 OM_uint32 GSSAPI_CALLCONV
 121 _gssspi_sanon_exchange_meta_data(OM_uint32 *minor,
 122                                  gss_const_OID mech_oid,
 123                                  gss_cred_id_t cred_handle,
 124                                  gss_ctx_id_t *context_handle,
 125                                  gss_const_name_t targ_name,
 126                                  OM_uint32 req_flags,
 127                                  gss_const_buffer_t meta_data)
 128 {
 129     *minor = 0;
 130     return GSS_S_COMPLETE;
 131 }