1/*	$NetBSD: ssh-gss.h,v 1.10 2021/03/05 17:47:16 christos Exp $	*/
2/* $OpenBSD: ssh-gss.h,v 1.15 2021/01/27 10:05:28 djm Exp $ */
3
4/*
5 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28#ifndef _SSH_GSS_H
29#define _SSH_GSS_H
30
31#ifdef GSSAPI
32
33#include <gssapi.h>
34
35/* draft-ietf-secsh-gsskeyex-06 */
36#define SSH2_MSG_USERAUTH_GSSAPI_RESPONSE		60
37#define SSH2_MSG_USERAUTH_GSSAPI_TOKEN			61
38#define SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE	63
39#define SSH2_MSG_USERAUTH_GSSAPI_ERROR			64
40#define SSH2_MSG_USERAUTH_GSSAPI_ERRTOK			65
41#define SSH2_MSG_USERAUTH_GSSAPI_MIC			66
42
43#define SSH_GSS_OIDTYPE 0x06
44
45typedef struct {
46	char *filename;
47	char *envvar;
48	char *envval;
49	void *data;
50} ssh_gssapi_ccache;
51
52typedef struct {
53	gss_buffer_desc displayname;
54	gss_buffer_desc exportedname;
55	gss_cred_id_t creds;
56	struct ssh_gssapi_mech_struct *mech;
57	ssh_gssapi_ccache store;
58} ssh_gssapi_client;
59
60typedef struct ssh_gssapi_mech_struct {
61	const char *enc_name;
62	const char *name;
63	gss_OID_desc oid;
64	int (*dochild) (ssh_gssapi_client *);
65	int (*userok) (ssh_gssapi_client *, char *);
66	int (*localname) (ssh_gssapi_client *, char **);
67	void (*storecreds) (ssh_gssapi_client *);
68} ssh_gssapi_mech;
69
70typedef struct {
71	OM_uint32	major; /* both */
72	OM_uint32	minor; /* both */
73	gss_ctx_id_t	context; /* both */
74	gss_name_t	name; /* both */
75	gss_OID		oid; /* client */
76	gss_cred_id_t	creds; /* server */
77	gss_name_t	client; /* server */
78	gss_cred_id_t	client_creds; /* server */
79} Gssctxt;
80
81extern ssh_gssapi_mech *supported_mechs[];
82
83int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
84void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
85void ssh_gssapi_set_oid(Gssctxt *, gss_OID);
86void ssh_gssapi_supported_oids(gss_OID_set *);
87ssh_gssapi_mech *ssh_gssapi_get_ctype(Gssctxt *);
88void ssh_gssapi_prepare_supported_oids(void);
89OM_uint32 ssh_gssapi_test_oid_supported(OM_uint32 *, gss_OID, int *);
90
91struct sshbuf;
92int ssh_gssapi_get_buffer_desc(struct sshbuf *, gss_buffer_desc *);
93
94OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *);
95OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int,
96    gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
97OM_uint32 ssh_gssapi_accept_ctx(Gssctxt *,
98    gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
99OM_uint32 ssh_gssapi_getclient(Gssctxt *, ssh_gssapi_client *);
100void ssh_gssapi_error(Gssctxt *);
101char *ssh_gssapi_last_error(Gssctxt *, OM_uint32 *, OM_uint32 *);
102void ssh_gssapi_build_ctx(Gssctxt **);
103void ssh_gssapi_delete_ctx(Gssctxt **);
104OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
105void ssh_gssapi_buildmic(struct sshbuf *, const char *,
106    const char *, const char *, const struct sshbuf *);
107int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *);
108
109/* In the server */
110OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
111int ssh_gssapi_userok(char *name);
112OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
113void ssh_gssapi_do_child(char ***, u_int *);
114void ssh_gssapi_cleanup_creds(void);
115void ssh_gssapi_storecreds(void);
116const char *ssh_gssapi_displayname(void);
117
118#endif /* GSSAPI */
119
120#endif /* _SSH_GSS_H */
121