2 * Copyright (c) 2005 Doug Rabson
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 #include <gssapi/gssapi.h>
34 #include "mech_switch.h"
41 parse_header(const gss_buffer_t input_token
, gss_OID mech_oid
)
43 unsigned char *p
= input_token
->value
;
44 size_t len
= input_token
->length
;
48 * Token must start with [APPLICATION 0] SEQUENCE.
49 * But if it doesn't assume it is DCE-STYLE Kerberos!
52 return (GSS_S_DEFECTIVE_TOKEN
);
58 * Decode the length and make sure it agrees with the
62 return (GSS_S_DEFECTIVE_TOKEN
);
63 if ((*p
& 0x80) == 0) {
72 return (GSS_S_DEFECTIVE_TOKEN
);
82 return (GSS_S_DEFECTIVE_TOKEN
);
85 * Decode the OID for the mechanism. Simplify life by
86 * assuming that the OID length is less than 128 bytes.
88 if (len
< 2 || *p
!= 0x06)
89 return (GSS_S_DEFECTIVE_TOKEN
);
90 if ((p
[1] & 0x80) || p
[1] > (len
- 2))
91 return (GSS_S_DEFECTIVE_TOKEN
);
92 mech_oid
->length
= p
[1];
95 mech_oid
->elements
= p
;
97 return (GSS_S_COMPLETE
);
100 static gss_OID_desc krb5_mechanism
=
101 {9, (void *)(uintptr_t) "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"};
102 static gss_OID_desc ntlm_mechanism
=
103 {10, (void *)(uintptr_t) "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"};
104 static gss_OID_desc spnego_mechanism
=
105 {6, (void *)(uintptr_t) "\x2b\x06\x01\x05\x05\x02"};
108 choose_mech(const gss_buffer_t input
, gss_OID mech_oid
)
113 * First try to parse the gssapi token header and see if it's a
114 * correct header, use that in the first hand.
117 status
= parse_header(input
, mech_oid
);
118 if (status
== GSS_S_COMPLETE
)
119 return (GSS_S_COMPLETE
);
122 * Lets guess what mech is really is, callback function to mech ??
125 if (input
->length
> 8 &&
126 memcmp((const char *)input
->value
, "NTLMSSP\x00", 8) == 0)
128 *mech_oid
= ntlm_mechanism
;
129 return (GSS_S_COMPLETE
);
130 } else if (input
->length
!= 0 &&
131 ((const char *)input
->value
)[0] == 0x6E)
133 /* Could be a raw AP-REQ (check for APPLICATION tag) */
134 *mech_oid
= krb5_mechanism
;
135 return (GSS_S_COMPLETE
);
136 } else if (input
->length
== 0) {
138 * There is the a wierd mode of SPNEGO (in CIFS and
139 * SASL GSS-SPENGO where the first token is zero
140 * length and the acceptor returns a mech_list, lets
141 * hope that is what is happening now.
143 *mech_oid
= spnego_mechanism
;
144 return (GSS_S_COMPLETE
);
149 OM_uint32
gss_accept_sec_context(OM_uint32
*minor_status
,
150 gss_ctx_id_t
*context_handle
,
151 const gss_cred_id_t acceptor_cred_handle
,
152 const gss_buffer_t input_token
,
153 const gss_channel_bindings_t input_chan_bindings
,
154 gss_name_t
*src_name
,
156 gss_buffer_t output_token
,
157 OM_uint32
*ret_flags
,
159 gss_cred_id_t
*delegated_cred_handle
)
161 OM_uint32 major_status
, mech_ret_flags
;
162 struct _gss_mech_switch
*m
;
163 struct _gss_context
*ctx
= (struct _gss_context
*) *context_handle
;
164 struct _gss_cred
*cred
= (struct _gss_cred
*) acceptor_cred_handle
;
165 struct _gss_mechanism_cred
*mc
;
166 gss_cred_id_t acceptor_mc
, delegated_mc
;
171 *src_name
= GSS_C_NO_NAME
;
173 *mech_type
= GSS_C_NO_OID
;
178 if (delegated_cred_handle
)
179 *delegated_cred_handle
= GSS_C_NO_CREDENTIAL
;
180 _gss_buffer_zero(output_token
);
183 * If this is the first call (*context_handle is NULL), we must
184 * parse the input token to figure out the mechanism to use.
186 if (*context_handle
== GSS_C_NO_CONTEXT
) {
187 gss_OID_desc mech_oid
;
189 major_status
= choose_mech(input_token
, &mech_oid
);
190 if (major_status
!= GSS_S_COMPLETE
)
191 return (major_status
);
194 * Now that we have a mechanism, we can find the
197 ctx
= malloc(sizeof(struct _gss_context
));
199 *minor_status
= ENOMEM
;
200 return (GSS_S_DEFECTIVE_TOKEN
);
202 memset(ctx
, 0, sizeof(struct _gss_context
));
203 m
= ctx
->gc_mech
= _gss_find_mech_switch(&mech_oid
);
206 return (GSS_S_BAD_MECH
);
212 SLIST_FOREACH(mc
, &cred
->gc_mc
, gmc_link
)
213 if (mc
->gmc_mech
== m
)
216 return (GSS_S_BAD_MECH
);
217 acceptor_mc
= mc
->gmc_cred
;
219 acceptor_mc
= GSS_C_NO_CREDENTIAL
;
221 delegated_mc
= GSS_C_NO_CREDENTIAL
;
224 major_status
= m
->gm_accept_sec_context(minor_status
,
235 if (major_status
!= GSS_S_COMPLETE
&&
236 major_status
!= GSS_S_CONTINUE_NEEDED
) {
237 _gss_mg_error(m
, major_status
, *minor_status
);
238 return (major_status
);
241 if (src_name
&& src_mn
) {
243 * Make a new name and mark it as an MN.
245 struct _gss_name
*name
= _gss_make_name(m
, src_mn
);
248 m
->gm_release_name(minor_status
, &src_mn
);
249 return (GSS_S_FAILURE
);
251 *src_name
= (gss_name_t
) name
;
253 m
->gm_release_name(minor_status
, &src_mn
);
256 if (delegated_mc
== GSS_C_NO_CREDENTIAL
)
257 mech_ret_flags
&= ~GSS_C_DELEG_FLAG
;
259 if (mech_ret_flags
& GSS_C_DELEG_FLAG
) {
260 if (!delegated_cred_handle
) {
261 m
->gm_release_cred(minor_status
, &delegated_mc
);
262 mech_ret_flags
&= ~GSS_C_DELEG_FLAG
;
264 struct _gss_cred
*dcred
;
265 struct _gss_mechanism_cred
*dmc
;
267 dcred
= malloc(sizeof(struct _gss_cred
));
269 *minor_status
= ENOMEM
;
270 return (GSS_S_FAILURE
);
272 SLIST_INIT(&dcred
->gc_mc
);
273 dmc
= malloc(sizeof(struct _gss_mechanism_cred
));
276 *minor_status
= ENOMEM
;
277 return (GSS_S_FAILURE
);
280 dmc
->gmc_mech_oid
= &m
->gm_mech_oid
;
281 dmc
->gmc_cred
= delegated_mc
;
282 SLIST_INSERT_HEAD(&dcred
->gc_mc
, dmc
, gmc_link
);
284 *delegated_cred_handle
= (gss_cred_id_t
) dcred
;
289 *ret_flags
= mech_ret_flags
;
290 *context_handle
= (gss_ctx_id_t
) ctx
;
291 return (major_status
);