external.c revision 178825 
1/*
2 * Copyright (c) 1997 - 2000 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "krb5/gsskrb5_locl.h"
35#include <gssapi_mech.h>
36
37RCSID("$Id: external.c 22128 2007-12-04 00:56:55Z lha $");
38
39/*
40 * The implementation must reserve static storage for a
41 * gss_OID_desc object containing the value
42 * {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
43 *              "\x01\x02\x01\x01"},
44 * corresponding to an object-identifier value of
45 * {iso(1) member-body(2) United States(840) mit(113554)
46 *  infosys(1) gssapi(2) generic(1) user_name(1)}.  The constant
47 * GSS_C_NT_USER_NAME should be initialized to point
48 * to that gss_OID_desc.
49 */
50
51static gss_OID_desc gss_c_nt_user_name_oid_desc =
52{10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x01")};
53
54gss_OID GSS_C_NT_USER_NAME = &gss_c_nt_user_name_oid_desc;
55
56/*
57 * The implementation must reserve static storage for a
58 * gss_OID_desc object containing the value
59 * {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
60 *              "\x01\x02\x01\x02"},
61 * corresponding to an object-identifier value of
62 * {iso(1) member-body(2) United States(840) mit(113554)
63 *  infosys(1) gssapi(2) generic(1) machine_uid_name(2)}.
64 * The constant GSS_C_NT_MACHINE_UID_NAME should be
65 * initialized to point to that gss_OID_desc.
66 */
67
68static gss_OID_desc gss_c_nt_machine_uid_name_oid_desc =
69{10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x02")};
70
71gss_OID GSS_C_NT_MACHINE_UID_NAME = &gss_c_nt_machine_uid_name_oid_desc;
72
73/*
74 * The implementation must reserve static storage for a
75 * gss_OID_desc object containing the value
76 * {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
77 *              "\x01\x02\x01\x03"},
78 * corresponding to an object-identifier value of
79 * {iso(1) member-body(2) United States(840) mit(113554)
80 *  infosys(1) gssapi(2) generic(1) string_uid_name(3)}.
81 * The constant GSS_C_NT_STRING_UID_NAME should be
82 * initialized to point to that gss_OID_desc.
83 */
84
85static gss_OID_desc gss_c_nt_string_uid_name_oid_desc =
86{10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x03")};
87
88gss_OID GSS_C_NT_STRING_UID_NAME = &gss_c_nt_string_uid_name_oid_desc;
89
90/*
91 * The implementation must reserve static storage for a
92 * gss_OID_desc object containing the value
93 * {6, (void *)"\x2b\x06\x01\x05\x06\x02"},
94 * corresponding to an object-identifier value of
95 * {iso(1) org(3) dod(6) internet(1) security(5)
96 * nametypes(6) gss-host-based-services(2)).  The constant
97 * GSS_C_NT_HOSTBASED_SERVICE_X should be initialized to point
98 * to that gss_OID_desc.  This is a deprecated OID value, and
99 * implementations wishing to support hostbased-service names
100 * should instead use the GSS_C_NT_HOSTBASED_SERVICE OID,
101 * defined below, to identify such names;
102 * GSS_C_NT_HOSTBASED_SERVICE_X should be accepted a synonym
103 * for GSS_C_NT_HOSTBASED_SERVICE when presented as an input
104 * parameter, but should not be emitted by GSS-API
105 * implementations
106 */
107
108static gss_OID_desc gss_c_nt_hostbased_service_x_oid_desc =
109{6, rk_UNCONST("\x2b\x06\x01\x05\x06\x02")};
110
111gss_OID GSS_C_NT_HOSTBASED_SERVICE_X = &gss_c_nt_hostbased_service_x_oid_desc;
112
113/*
114 * The implementation must reserve static storage for a
115 * gss_OID_desc object containing the value
116 * {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
117 *              "\x01\x02\x01\x04"}, corresponding to an
118 * object-identifier value of {iso(1) member-body(2)
119 * Unites States(840) mit(113554) infosys(1) gssapi(2)
120 * generic(1) service_name(4)}.  The constant
121 * GSS_C_NT_HOSTBASED_SERVICE should be initialized
122 * to point to that gss_OID_desc.
123 */
124static gss_OID_desc gss_c_nt_hostbased_service_oid_desc =
125{10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x04")};
126
127gss_OID GSS_C_NT_HOSTBASED_SERVICE = &gss_c_nt_hostbased_service_oid_desc;
128
129/*
130 * The implementation must reserve static storage for a
131 * gss_OID_desc object containing the value
132 * {6, (void *)"\x2b\x06\01\x05\x06\x03"},
133 * corresponding to an object identifier value of
134 * {1(iso), 3(org), 6(dod), 1(internet), 5(security),
135 * 6(nametypes), 3(gss-anonymous-name)}.  The constant
136 * and GSS_C_NT_ANONYMOUS should be initialized to point
137 * to that gss_OID_desc.
138 */
139
140static gss_OID_desc gss_c_nt_anonymous_oid_desc =
141{6, rk_UNCONST("\x2b\x06\01\x05\x06\x03")};
142
143gss_OID GSS_C_NT_ANONYMOUS = &gss_c_nt_anonymous_oid_desc;
144
145/*
146 * The implementation must reserve static storage for a
147 * gss_OID_desc object containing the value
148 * {6, (void *)"\x2b\x06\x01\x05\x06\x04"},
149 * corresponding to an object-identifier value of
150 * {1(iso), 3(org), 6(dod), 1(internet), 5(security),
151 * 6(nametypes), 4(gss-api-exported-name)}.  The constant
152 * GSS_C_NT_EXPORT_NAME should be initialized to point
153 * to that gss_OID_desc.
154 */
155
156static gss_OID_desc gss_c_nt_export_name_oid_desc =
157{6, rk_UNCONST("\x2b\x06\x01\x05\x06\x04") };
158
159gss_OID GSS_C_NT_EXPORT_NAME = &gss_c_nt_export_name_oid_desc;
160
161/*
162 *   This name form shall be represented by the Object Identifier {iso(1)
163 *   member-body(2) United States(840) mit(113554) infosys(1) gssapi(2)
164 *   krb5(2) krb5_name(1)}.  The recommended symbolic name for this type
165 *   is "GSS_KRB5_NT_PRINCIPAL_NAME".
166 */
167
168static gss_OID_desc gss_krb5_nt_principal_name_oid_desc =
169{10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x01") };
170
171gss_OID GSS_KRB5_NT_PRINCIPAL_NAME = &gss_krb5_nt_principal_name_oid_desc;
172
173/*
174 *   This name form shall be represented by the Object Identifier {iso(1)
175 *   member-body(2) United States(840) mit(113554) infosys(1) gssapi(2)
176 *   generic(1) user_name(1)}.  The recommended symbolic name for this
177 *   type is "GSS_KRB5_NT_USER_NAME".
178 */
179
180gss_OID GSS_KRB5_NT_USER_NAME = &gss_c_nt_user_name_oid_desc;
181
182/*
183 *   This name form shall be represented by the Object Identifier {iso(1)
184 *   member-body(2) United States(840) mit(113554) infosys(1) gssapi(2)
185 *   generic(1) machine_uid_name(2)}.  The recommended symbolic name for
186 *   this type is "GSS_KRB5_NT_MACHINE_UID_NAME".
187 */
188
189gss_OID GSS_KRB5_NT_MACHINE_UID_NAME = &gss_c_nt_machine_uid_name_oid_desc;
190
191/*
192 *   This name form shall be represented by the Object Identifier {iso(1)
193 *   member-body(2) United States(840) mit(113554) infosys(1) gssapi(2)
194 *   generic(1) string_uid_name(3)}.  The recommended symbolic name for
195 *   this type is "GSS_KRB5_NT_STRING_UID_NAME".
196 */
197
198gss_OID GSS_KRB5_NT_STRING_UID_NAME = &gss_c_nt_string_uid_name_oid_desc;
199
200/*
201 *   To support ongoing experimentation, testing, and evolution of the
202 *   specification, the Kerberos V5 GSS-API mechanism as defined in this
203 *   and any successor memos will be identified with the following Object
204 *   Identifier, as defined in RFC-1510, until the specification is
205 *   advanced to the level of Proposed Standard RFC:
206 *
207 *   {iso(1), org(3), dod(5), internet(1), security(5), kerberosv5(2)}
208 *
209 *   Upon advancement to the level of Proposed Standard RFC, the Kerberos
210 *   V5 GSS-API mechanism will be identified by an Object Identifier
211 *   having the value:
212 *
213 *   {iso(1) member-body(2) United States(840) mit(113554) infosys(1)
214 *   gssapi(2) krb5(2)}
215 */
216
217#if 0 /* This is the old OID */
218
219static gss_OID_desc gss_krb5_mechanism_oid_desc =
220{5, rk_UNCONST("\x2b\x05\x01\x05\x02")};
221
222#endif
223
224static gss_OID_desc gss_krb5_mechanism_oid_desc =
225{9, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02") };
226
227gss_OID GSS_KRB5_MECHANISM = &gss_krb5_mechanism_oid_desc;
228
229/*
230 * draft-ietf-cat-iakerb-09, IAKERB:
231 *   The mechanism ID for IAKERB proxy GSS-API Kerberos, in accordance
232 *   with the mechanism proposed by SPNEGO [7] for negotiating protocol
233 *   variations, is:  {iso(1) org(3) dod(6) internet(1) security(5)
234 *   mechanisms(5) iakerb(10) iakerbProxyProtocol(1)}.  The proposed
235 *   mechanism ID for IAKERB minimum messages GSS-API Kerberos, in
236 *   accordance with the mechanism proposed by SPNEGO for negotiating
237 *   protocol variations, is: {iso(1) org(3) dod(6) internet(1)
238 *   security(5) mechanisms(5) iakerb(10)
239 *   iakerbMinimumMessagesProtocol(2)}.
240 */
241
242static gss_OID_desc gss_iakerb_proxy_mechanism_oid_desc =
243{7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0a\x01")};
244
245gss_OID GSS_IAKERB_PROXY_MECHANISM = &gss_iakerb_proxy_mechanism_oid_desc;
246
247static gss_OID_desc gss_iakerb_min_msg_mechanism_oid_desc =
248{7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0a\x02") };
249
250gss_OID GSS_IAKERB_MIN_MSG_MECHANISM = &gss_iakerb_min_msg_mechanism_oid_desc;
251
252/*
253 *
254 */
255
256static gss_OID_desc gss_c_peer_has_updated_spnego_oid_desc =
257{9, (void *)"\x2b\x06\x01\x04\x01\xa9\x4a\x13\x05"};
258
259gss_OID GSS_C_PEER_HAS_UPDATED_SPNEGO = &gss_c_peer_has_updated_spnego_oid_desc;
260
261/*
262 * 1.2.752.43.13 Heimdal GSS-API Extentions
263 */
264
265/* 1.2.752.43.13.1 */
266static gss_OID_desc gss_krb5_copy_ccache_x_oid_desc =
267{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x01")};
268
269gss_OID GSS_KRB5_COPY_CCACHE_X = &gss_krb5_copy_ccache_x_oid_desc;
270
271/* 1.2.752.43.13.2 */
272static gss_OID_desc gss_krb5_get_tkt_flags_x_oid_desc =
273{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x02")};
274
275gss_OID GSS_KRB5_GET_TKT_FLAGS_X = &gss_krb5_get_tkt_flags_x_oid_desc;
276
277/* 1.2.752.43.13.3 */
278static gss_OID_desc gss_krb5_extract_authz_data_from_sec_context_x_oid_desc =
279{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x03")};
280
281gss_OID GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_X = &gss_krb5_extract_authz_data_from_sec_context_x_oid_desc;
282
283/* 1.2.752.43.13.4 */
284static gss_OID_desc gss_krb5_compat_des3_mic_x_oid_desc =
285{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x04")};
286
287gss_OID GSS_KRB5_COMPAT_DES3_MIC_X = &gss_krb5_compat_des3_mic_x_oid_desc;
288
289/* 1.2.752.43.13.5 */
290static gss_OID_desc gss_krb5_register_acceptor_identity_x_desc =
291{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x05")};
292
293gss_OID GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X = &gss_krb5_register_acceptor_identity_x_desc;
294
295/* 1.2.752.43.13.6 */
296static gss_OID_desc gss_krb5_export_lucid_context_x_desc =
297{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x06")};
298
299gss_OID GSS_KRB5_EXPORT_LUCID_CONTEXT_X = &gss_krb5_export_lucid_context_x_desc;
300
301/* 1.2.752.43.13.6.1 */
302static gss_OID_desc gss_krb5_export_lucid_context_v1_x_desc =
303{7, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x06\x01")};
304
305gss_OID GSS_KRB5_EXPORT_LUCID_CONTEXT_V1_X = &gss_krb5_export_lucid_context_v1_x_desc;
306
307/* 1.2.752.43.13.7 */
308static gss_OID_desc gss_krb5_set_dns_canonicalize_x_desc =
309{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x07")};
310
311gss_OID GSS_KRB5_SET_DNS_CANONICALIZE_X = &gss_krb5_set_dns_canonicalize_x_desc;
312
313/* 1.2.752.43.13.8 */
314static gss_OID_desc gss_krb5_get_subkey_x_desc =
315{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x08")};
316
317gss_OID GSS_KRB5_GET_SUBKEY_X = &gss_krb5_get_subkey_x_desc;
318
319/* 1.2.752.43.13.9 */
320static gss_OID_desc gss_krb5_get_initiator_subkey_x_desc =
321{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x09")};
322
323gss_OID GSS_KRB5_GET_INITIATOR_SUBKEY_X = &gss_krb5_get_initiator_subkey_x_desc;
324
325/* 1.2.752.43.13.10 */
326static gss_OID_desc gss_krb5_get_acceptor_subkey_x_desc =
327{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0a")};
328
329gss_OID GSS_KRB5_GET_ACCEPTOR_SUBKEY_X = &gss_krb5_get_acceptor_subkey_x_desc;
330
331/* 1.2.752.43.13.11 */
332static gss_OID_desc gss_krb5_send_to_kdc_x_desc =
333{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0b")};
334
335gss_OID GSS_KRB5_SEND_TO_KDC_X = &gss_krb5_send_to_kdc_x_desc;
336
337/* 1.2.752.43.13.12 */
338static gss_OID_desc gss_krb5_get_authtime_x_desc =
339{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0c")};
340
341gss_OID GSS_KRB5_GET_AUTHTIME_X = &gss_krb5_get_authtime_x_desc;
342
343/* 1.2.752.43.13.13 */
344static gss_OID_desc gss_krb5_get_service_keyblock_x_desc =
345{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0d")};
346
347gss_OID GSS_KRB5_GET_SERVICE_KEYBLOCK_X = &gss_krb5_get_service_keyblock_x_desc;
348
349/* 1.2.752.43.13.14 */
350static gss_OID_desc gss_krb5_set_allowable_enctypes_x_desc =
351{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0e")};
352
353gss_OID GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X = &gss_krb5_set_allowable_enctypes_x_desc;
354
355/* 1.2.752.43.13.15 */
356static gss_OID_desc gss_krb5_set_default_realm_x_desc =
357{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0f")};
358
359gss_OID GSS_KRB5_SET_DEFAULT_REALM_X = &gss_krb5_set_default_realm_x_desc;
360
361/* 1.2.752.43.13.16 */
362static gss_OID_desc gss_krb5_ccache_name_x_desc =
363{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x10")};
364
365gss_OID GSS_KRB5_CCACHE_NAME_X = &gss_krb5_ccache_name_x_desc;
366
367/* 1.2.752.43.14.1 */
368static gss_OID_desc gss_sasl_digest_md5_mechanism_desc =
369{6, rk_UNCONST("\x2a\x85\x70\x2b\x0e\x01") };
370
371gss_OID GSS_SASL_DIGEST_MD5_MECHANISM = &gss_sasl_digest_md5_mechanism_desc;
372
373/*
374 * Context for krb5 calls.
375 */
376
377/*
378 *
379 */
380
381static gssapi_mech_interface_desc krb5_mech = {
382    GMI_VERSION,
383    "kerberos 5",
384    {9, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" },
385    _gsskrb5_acquire_cred,
386    _gsskrb5_release_cred,
387    _gsskrb5_init_sec_context,
388    _gsskrb5_accept_sec_context,
389    _gsskrb5_process_context_token,
390    _gsskrb5_delete_sec_context,
391    _gsskrb5_context_time,
392    _gsskrb5_get_mic,
393    _gsskrb5_verify_mic,
394    _gsskrb5_wrap,
395    _gsskrb5_unwrap,
396    _gsskrb5_display_status,
397    _gsskrb5_indicate_mechs,
398    _gsskrb5_compare_name,
399    _gsskrb5_display_name,
400    _gsskrb5_import_name,
401    _gsskrb5_export_name,
402    _gsskrb5_release_name,
403    _gsskrb5_inquire_cred,
404    _gsskrb5_inquire_context,
405    _gsskrb5_wrap_size_limit,
406    _gsskrb5_add_cred,
407    _gsskrb5_inquire_cred_by_mech,
408    _gsskrb5_export_sec_context,
409    _gsskrb5_import_sec_context,
410    _gsskrb5_inquire_names_for_mech,
411    _gsskrb5_inquire_mechs_for_name,
412    _gsskrb5_canonicalize_name,
413    _gsskrb5_duplicate_name,
414    _gsskrb5_inquire_sec_context_by_oid,
415    _gsskrb5_inquire_cred_by_oid,
416    _gsskrb5_set_sec_context_option,
417    _gsskrb5_set_cred_option,
418    _gsskrb5_pseudo_random
419};
420
421gssapi_mech_interface
422__gss_krb5_initialize(void)
423{
424    return &krb5_mech;
425}
426