crypto/heimdal/lib/gssapi/krb5/external.c

   1 /*
   2  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5/gsskrb5_locl.h"
  35 #include <gssapi_mech.h>
  36
  37 RCSID("$Id: external.c 22128 2007-12-04 00:56:55Z lha $");
  38
  39 /*
  40  * The implementation must reserve static storage for a
  41  * gss_OID_desc object containing the value
  42  * {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
  43  *              "\x01\x02\x01\x01"},
  44  * corresponding to an object-identifier value of
  45  * {iso(1) member-body(2) United States(840) mit(113554)
  46  *  infosys(1) gssapi(2) generic(1) user_name(1)}.  The constant
  47  * GSS_C_NT_USER_NAME should be initialized to point
  48  * to that gss_OID_desc.
  49  */
  50
  51 static gss_OID_desc gss_c_nt_user_name_oid_desc =
  52 {10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x01")};
  53
  54 gss_OID GSS_C_NT_USER_NAME = &gss_c_nt_user_name_oid_desc;
  55
  56 /*
  57  * The implementation must reserve static storage for a
  58  * gss_OID_desc object containing the value
  59  * {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
  60  *              "\x01\x02\x01\x02"},
  61  * corresponding to an object-identifier value of
  62  * {iso(1) member-body(2) United States(840) mit(113554)
  63  *  infosys(1) gssapi(2) generic(1) machine_uid_name(2)}.
  64  * The constant GSS_C_NT_MACHINE_UID_NAME should be
  65  * initialized to point to that gss_OID_desc.
  66  */
  67
  68 static gss_OID_desc gss_c_nt_machine_uid_name_oid_desc =
  69 {10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x02")};
  70
  71 gss_OID GSS_C_NT_MACHINE_UID_NAME = &gss_c_nt_machine_uid_name_oid_desc;
  72
  73 /*
  74  * The implementation must reserve static storage for a
  75  * gss_OID_desc object containing the value
  76  * {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
  77  *              "\x01\x02\x01\x03"},
  78  * corresponding to an object-identifier value of
  79  * {iso(1) member-body(2) United States(840) mit(113554)
  80  *  infosys(1) gssapi(2) generic(1) string_uid_name(3)}.
  81  * The constant GSS_C_NT_STRING_UID_NAME should be
  82  * initialized to point to that gss_OID_desc.
  83  */
  84
  85 static gss_OID_desc gss_c_nt_string_uid_name_oid_desc =
  86 {10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x03")};
  87
  88 gss_OID GSS_C_NT_STRING_UID_NAME = &gss_c_nt_string_uid_name_oid_desc;
  89
  90 /*
  91  * The implementation must reserve static storage for a
  92  * gss_OID_desc object containing the value
  93  * {6, (void *)"\x2b\x06\x01\x05\x06\x02"},
  94  * corresponding to an object-identifier value of
  95  * {iso(1) org(3) dod(6) internet(1) security(5)
  96  * nametypes(6) gss-host-based-services(2)).  The constant
  97  * GSS_C_NT_HOSTBASED_SERVICE_X should be initialized to point
  98  * to that gss_OID_desc.  This is a deprecated OID value, and
  99  * implementations wishing to support hostbased-service names
 100  * should instead use the GSS_C_NT_HOSTBASED_SERVICE OID,
 101  * defined below, to identify such names;
 102  * GSS_C_NT_HOSTBASED_SERVICE_X should be accepted a synonym
 103  * for GSS_C_NT_HOSTBASED_SERVICE when presented as an input
 104  * parameter, but should not be emitted by GSS-API
 105  * implementations
 106  */
 107
 108 static gss_OID_desc gss_c_nt_hostbased_service_x_oid_desc =
 109 {6, rk_UNCONST("\x2b\x06\x01\x05\x06\x02")};
 110
 111 gss_OID GSS_C_NT_HOSTBASED_SERVICE_X = &gss_c_nt_hostbased_service_x_oid_desc;
 112
 113 /*
 114  * The implementation must reserve static storage for a
 115  * gss_OID_desc object containing the value
 116  * {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
 117  *              "\x01\x02\x01\x04"}, corresponding to an
 118  * object-identifier value of {iso(1) member-body(2)
 119  * Unites States(840) mit(113554) infosys(1) gssapi(2)
 120  * generic(1) service_name(4)}.  The constant
 121  * GSS_C_NT_HOSTBASED_SERVICE should be initialized
 122  * to point to that gss_OID_desc.
 123  */
 124 static gss_OID_desc gss_c_nt_hostbased_service_oid_desc =
 125 {10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x04")};
 126
 127 gss_OID GSS_C_NT_HOSTBASED_SERVICE = &gss_c_nt_hostbased_service_oid_desc;
 128
 129 /*
 130  * The implementation must reserve static storage for a
 131  * gss_OID_desc object containing the value
 132  * {6, (void *)"\x2b\x06\01\x05\x06\x03"},
 133  * corresponding to an object identifier value of
 134  * {1(iso), 3(org), 6(dod), 1(internet), 5(security),
 135  * 6(nametypes), 3(gss-anonymous-name)}.  The constant
 136  * and GSS_C_NT_ANONYMOUS should be initialized to point
 137  * to that gss_OID_desc.
 138  */
 139
 140 static gss_OID_desc gss_c_nt_anonymous_oid_desc =
 141 {6, rk_UNCONST("\x2b\x06\01\x05\x06\x03")};
 142
 143 gss_OID GSS_C_NT_ANONYMOUS = &gss_c_nt_anonymous_oid_desc;
 144
 145 /*
 146  * The implementation must reserve static storage for a
 147  * gss_OID_desc object containing the value
 148  * {6, (void *)"\x2b\x06\x01\x05\x06\x04"},
 149  * corresponding to an object-identifier value of
 150  * {1(iso), 3(org), 6(dod), 1(internet), 5(security),
 151  * 6(nametypes), 4(gss-api-exported-name)}.  The constant
 152  * GSS_C_NT_EXPORT_NAME should be initialized to point
 153  * to that gss_OID_desc.
 154  */
 155
 156 static gss_OID_desc gss_c_nt_export_name_oid_desc =
 157 {6, rk_UNCONST("\x2b\x06\x01\x05\x06\x04") };
 158
 159 gss_OID GSS_C_NT_EXPORT_NAME = &gss_c_nt_export_name_oid_desc;
 160
 161 /*
 162  *   This name form shall be represented by the Object Identifier {iso(1)
 163  *   member-body(2) United States(840) mit(113554) infosys(1) gssapi(2)
 164  *   krb5(2) krb5_name(1)}.  The recommended symbolic name for this type
 165  *   is "GSS_KRB5_NT_PRINCIPAL_NAME".
 166  */
 167
 168 static gss_OID_desc gss_krb5_nt_principal_name_oid_desc =
 169 {10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x01") };
 170
 171 gss_OID GSS_KRB5_NT_PRINCIPAL_NAME = &gss_krb5_nt_principal_name_oid_desc;
 172
 173 /*
 174  *   This name form shall be represented by the Object Identifier {iso(1)
 175  *   member-body(2) United States(840) mit(113554) infosys(1) gssapi(2)
 176  *   generic(1) user_name(1)}.  The recommended symbolic name for this
 177  *   type is "GSS_KRB5_NT_USER_NAME".
 178  */
 179
 180 gss_OID GSS_KRB5_NT_USER_NAME = &gss_c_nt_user_name_oid_desc;
 181
 182 /*
 183  *   This name form shall be represented by the Object Identifier {iso(1)
 184  *   member-body(2) United States(840) mit(113554) infosys(1) gssapi(2)
 185  *   generic(1) machine_uid_name(2)}.  The recommended symbolic name for
 186  *   this type is "GSS_KRB5_NT_MACHINE_UID_NAME".
 187  */
 188
 189 gss_OID GSS_KRB5_NT_MACHINE_UID_NAME = &gss_c_nt_machine_uid_name_oid_desc;
 190
 191 /*
 192  *   This name form shall be represented by the Object Identifier {iso(1)
 193  *   member-body(2) United States(840) mit(113554) infosys(1) gssapi(2)
 194  *   generic(1) string_uid_name(3)}.  The recommended symbolic name for
 195  *   this type is "GSS_KRB5_NT_STRING_UID_NAME".
 196  */
 197
 198 gss_OID GSS_KRB5_NT_STRING_UID_NAME = &gss_c_nt_string_uid_name_oid_desc;
 199
 200 /*
 201  *   To support ongoing experimentation, testing, and evolution of the
 202  *   specification, the Kerberos V5 GSS-API mechanism as defined in this
 203  *   and any successor memos will be identified with the following Object
 204  *   Identifier, as defined in RFC-1510, until the specification is
 205  *   advanced to the level of Proposed Standard RFC:
 206  *
 207  *   {iso(1), org(3), dod(5), internet(1), security(5), kerberosv5(2)}
 208  *
 209  *   Upon advancement to the level of Proposed Standard RFC, the Kerberos
 210  *   V5 GSS-API mechanism will be identified by an Object Identifier
 211  *   having the value:
 212  *
 213  *   {iso(1) member-body(2) United States(840) mit(113554) infosys(1)
 214  *   gssapi(2) krb5(2)}
 215  */
 216
 217 #if 0 /* This is the old OID */
 218
 219 static gss_OID_desc gss_krb5_mechanism_oid_desc =
 220 {5, rk_UNCONST("\x2b\x05\x01\x05\x02")};
 221
 222 #endif
 223
 224 static gss_OID_desc gss_krb5_mechanism_oid_desc =
 225 {9, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02") };
 226
 227 gss_OID GSS_KRB5_MECHANISM = &gss_krb5_mechanism_oid_desc;
 228
 229 /*
 230  * draft-ietf-cat-iakerb-09, IAKERB:
 231  *   The mechanism ID for IAKERB proxy GSS-API Kerberos, in accordance
 232  *   with the mechanism proposed by SPNEGO [7] for negotiating protocol
 233  *   variations, is:  {iso(1) org(3) dod(6) internet(1) security(5)
 234  *   mechanisms(5) iakerb(10) iakerbProxyProtocol(1)}.  The proposed
 235  *   mechanism ID for IAKERB minimum messages GSS-API Kerberos, in
 236  *   accordance with the mechanism proposed by SPNEGO for negotiating
 237  *   protocol variations, is: {iso(1) org(3) dod(6) internet(1)
 238  *   security(5) mechanisms(5) iakerb(10)
 239  *   iakerbMinimumMessagesProtocol(2)}.
 240  */
 241
 242 static gss_OID_desc gss_iakerb_proxy_mechanism_oid_desc =
 243 {7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0a\x01")};
 244
 245 gss_OID GSS_IAKERB_PROXY_MECHANISM = &gss_iakerb_proxy_mechanism_oid_desc;
 246
 247 static gss_OID_desc gss_iakerb_min_msg_mechanism_oid_desc =
 248 {7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0a\x02") };
 249
 250 gss_OID GSS_IAKERB_MIN_MSG_MECHANISM = &gss_iakerb_min_msg_mechanism_oid_desc;
 251
 252 /*
 253  *
 254  */
 255
 256 static gss_OID_desc gss_c_peer_has_updated_spnego_oid_desc =
 257 {9, (void *)"\x2b\x06\x01\x04\x01\xa9\x4a\x13\x05"};
 258
 259 gss_OID GSS_C_PEER_HAS_UPDATED_SPNEGO = &gss_c_peer_has_updated_spnego_oid_desc;
 260
 261 /*
 262  * 1.2.752.43.13 Heimdal GSS-API Extentions
 263  */
 264
 265 /* 1.2.752.43.13.1 */
 266 static gss_OID_desc gss_krb5_copy_ccache_x_oid_desc =
 267 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x01")};
 268
 269 gss_OID GSS_KRB5_COPY_CCACHE_X = &gss_krb5_copy_ccache_x_oid_desc;
 270
 271 /* 1.2.752.43.13.2 */
 272 static gss_OID_desc gss_krb5_get_tkt_flags_x_oid_desc =
 273 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x02")};
 274
 275 gss_OID GSS_KRB5_GET_TKT_FLAGS_X = &gss_krb5_get_tkt_flags_x_oid_desc;
 276
 277 /* 1.2.752.43.13.3 */
 278 static gss_OID_desc gss_krb5_extract_authz_data_from_sec_context_x_oid_desc =
 279 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x03")};
 280
 281 gss_OID GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_X = &gss_krb5_extract_authz_data_from_sec_context_x_oid_desc;
 282
 283 /* 1.2.752.43.13.4 */
 284 static gss_OID_desc gss_krb5_compat_des3_mic_x_oid_desc =
 285 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x04")};
 286
 287 gss_OID GSS_KRB5_COMPAT_DES3_MIC_X = &gss_krb5_compat_des3_mic_x_oid_desc;
 288
 289 /* 1.2.752.43.13.5 */
 290 static gss_OID_desc gss_krb5_register_acceptor_identity_x_desc =
 291 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x05")};
 292
 293 gss_OID GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X = &gss_krb5_register_acceptor_identity_x_desc;
 294
 295 /* 1.2.752.43.13.6 */
 296 static gss_OID_desc gss_krb5_export_lucid_context_x_desc =
 297 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x06")};
 298
 299 gss_OID GSS_KRB5_EXPORT_LUCID_CONTEXT_X = &gss_krb5_export_lucid_context_x_desc;
 300
 301 /* 1.2.752.43.13.6.1 */
 302 static gss_OID_desc gss_krb5_export_lucid_context_v1_x_desc =
 303 {7, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x06\x01")};
 304
 305 gss_OID GSS_KRB5_EXPORT_LUCID_CONTEXT_V1_X = &gss_krb5_export_lucid_context_v1_x_desc;
 306
 307 /* 1.2.752.43.13.7 */
 308 static gss_OID_desc gss_krb5_set_dns_canonicalize_x_desc =
 309 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x07")};
 310
 311 gss_OID GSS_KRB5_SET_DNS_CANONICALIZE_X = &gss_krb5_set_dns_canonicalize_x_desc;
 312
 313 /* 1.2.752.43.13.8 */
 314 static gss_OID_desc gss_krb5_get_subkey_x_desc =
 315 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x08")};
 316
 317 gss_OID GSS_KRB5_GET_SUBKEY_X = &gss_krb5_get_subkey_x_desc;
 318
 319 /* 1.2.752.43.13.9 */
 320 static gss_OID_desc gss_krb5_get_initiator_subkey_x_desc =
 321 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x09")};
 322
 323 gss_OID GSS_KRB5_GET_INITIATOR_SUBKEY_X = &gss_krb5_get_initiator_subkey_x_desc;
 324
 325 /* 1.2.752.43.13.10 */
 326 static gss_OID_desc gss_krb5_get_acceptor_subkey_x_desc =
 327 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0a")};
 328
 329 gss_OID GSS_KRB5_GET_ACCEPTOR_SUBKEY_X = &gss_krb5_get_acceptor_subkey_x_desc;
 330
 331 /* 1.2.752.43.13.11 */
 332 static gss_OID_desc gss_krb5_send_to_kdc_x_desc =
 333 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0b")};
 334
 335 gss_OID GSS_KRB5_SEND_TO_KDC_X = &gss_krb5_send_to_kdc_x_desc;
 336
 337 /* 1.2.752.43.13.12 */
 338 static gss_OID_desc gss_krb5_get_authtime_x_desc =
 339 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0c")};
 340
 341 gss_OID GSS_KRB5_GET_AUTHTIME_X = &gss_krb5_get_authtime_x_desc;
 342
 343 /* 1.2.752.43.13.13 */
 344 static gss_OID_desc gss_krb5_get_service_keyblock_x_desc =
 345 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0d")};
 346
 347 gss_OID GSS_KRB5_GET_SERVICE_KEYBLOCK_X = &gss_krb5_get_service_keyblock_x_desc;
 348
 349 /* 1.2.752.43.13.14 */
 350 static gss_OID_desc gss_krb5_set_allowable_enctypes_x_desc =
 351 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0e")};
 352
 353 gss_OID GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X = &gss_krb5_set_allowable_enctypes_x_desc;
 354
 355 /* 1.2.752.43.13.15 */
 356 static gss_OID_desc gss_krb5_set_default_realm_x_desc =
 357 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x0f")};
 358
 359 gss_OID GSS_KRB5_SET_DEFAULT_REALM_X = &gss_krb5_set_default_realm_x_desc;
 360
 361 /* 1.2.752.43.13.16 */
 362 static gss_OID_desc gss_krb5_ccache_name_x_desc =
 363 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x10")};
 364
 365 gss_OID GSS_KRB5_CCACHE_NAME_X = &gss_krb5_ccache_name_x_desc;
 366
 367 /* 1.2.752.43.14.1 */
 368 static gss_OID_desc gss_sasl_digest_md5_mechanism_desc =
 369 {6, rk_UNCONST("\x2a\x85\x70\x2b\x0e\x01") };
 370
 371 gss_OID GSS_SASL_DIGEST_MD5_MECHANISM = &gss_sasl_digest_md5_mechanism_desc;
 372
 373 /*
 374  * Context for krb5 calls.
 375  */
 376
 377 /*
 378  *
 379  */
 380
 381 static gssapi_mech_interface_desc krb5_mech = {
 382     GMI_VERSION,
 383     "kerberos 5",
 384     {9, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" },
 385     _gsskrb5_acquire_cred,
 386     _gsskrb5_release_cred,
 387     _gsskrb5_init_sec_context,
 388     _gsskrb5_accept_sec_context,
 389     _gsskrb5_process_context_token,
 390     _gsskrb5_delete_sec_context,
 391     _gsskrb5_context_time,
 392     _gsskrb5_get_mic,
 393     _gsskrb5_verify_mic,
 394     _gsskrb5_wrap,
 395     _gsskrb5_unwrap,
 396     _gsskrb5_display_status,
 397     _gsskrb5_indicate_mechs,
 398     _gsskrb5_compare_name,
 399     _gsskrb5_display_name,
 400     _gsskrb5_import_name,
 401     _gsskrb5_export_name,
 402     _gsskrb5_release_name,
 403     _gsskrb5_inquire_cred,
 404     _gsskrb5_inquire_context,
 405     _gsskrb5_wrap_size_limit,
 406     _gsskrb5_add_cred,
 407     _gsskrb5_inquire_cred_by_mech,
 408     _gsskrb5_export_sec_context,
 409     _gsskrb5_import_sec_context,
 410     _gsskrb5_inquire_names_for_mech,
 411     _gsskrb5_inquire_mechs_for_name,
 412     _gsskrb5_canonicalize_name,
 413     _gsskrb5_duplicate_name,
 414     _gsskrb5_inquire_sec_context_by_oid,
 415     _gsskrb5_inquire_cred_by_oid,
 416     _gsskrb5_set_sec_context_option,
 417     _gsskrb5_set_cred_option,
 418     _gsskrb5_pseudo_random
 419 };
 420
 421 gssapi_mech_interface
 422 __gss_krb5_initialize(void)
 423 {
 424     return &krb5_mech;
 425 }