mech_eap/util.h

   1 /*
   2  * Copyright (c) 2011, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32 /*
  33  * Portions Copyright 2003-2010 Massachusetts Institute of Technology.
  34  * All Rights Reserved.
  35  *
  36  * Export of this software from the United States of America may
  37  *   require a specific license from the United States Government.
  38  *   It is the responsibility of any person or organization contemplating
  39  *   export to obtain such a license before exporting.
  40  *
  41  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
  42  * distribute this software and its documentation for any purpose and
  43  * without fee is hereby granted, provided that the above copyright
  44  * notice appear in all copies and that both that copyright notice and
  45  * this permission notice appear in supporting documentation, and that
  46  * the name of M.I.T. not be used in advertising or publicity pertaining
  47  * to distribution of the software without specific, written prior
  48  * permission.  Furthermore if you modify this software you must label
  49  * your software as modified software and not distribute it in such a
  50  * fashion that it might be confused with the original M.I.T. software.
  51  * M.I.T. makes no representations about the suitability of
  52  * this software for any purpose.  It is provided "as is" without express
  53  * or implied warranty.
  54  *
  55  */
  56
  57 /*
  58  * Utility functions.
  59  */
  60
  61 #ifndef _UTIL_H_
  62 #define _UTIL_H_ 1
  63
  64 #ifdef HAVE_SYS_PARAM_H
  65 #include <sys/param.h>
  66 #endif
  67 #ifdef HAVE_STDINT_H
  68 #include <stdint.h>
  69 #endif
  70 #include <string.h>
  71 #include <errno.h>
  72
  73 #include <krb5.h>
  74 #include "gssapi_headerfix.h"
  75
  76 #ifdef WIN32
  77 # ifndef __cplusplus
  78 # define inline __inline
  79 # endif
  80 #define snprintf _snprintf
  81 #endif
  82
  83 #ifdef __cplusplus
  84 extern "C" {
  85 #endif
  86
  87 #ifndef MIN
  88 #define MIN(_a,_b)  ((_a)<(_b)?(_a):(_b))
  89 #endif
  90
  91 #if !defined(WIN32) && !(defined(__cplusplus)) || (__GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4))
  92 #define GSSEAP_UNUSED __attribute__ ((__unused__))
  93 #else
  94 #define GSSEAP_UNUSED
  95 #endif
  96
  97 /* util_buffer.c */
  98 OM_uint32
  99 makeStringBuffer(OM_uint32 *minor,
 100                  const char *string,
 101                  gss_buffer_t buffer);
 102
 103 #define makeStringBufferOrCleanup(src, dst)             \
 104     do {                                                \
 105         major = makeStringBuffer((minor), (src), (dst));\
 106         if (GSS_ERROR(major))                           \
 107             goto cleanup;                               \
 108     } while (0)
 109
 110 OM_uint32
 111 bufferToString(OM_uint32 *minor,
 112                const gss_buffer_t buffer,
 113                char **pString);
 114
 115 OM_uint32
 116 duplicateBuffer(OM_uint32 *minor,
 117                 const gss_buffer_t src,
 118                 gss_buffer_t dst);
 119
 120 #define duplicateBufferOrCleanup(src, dst)              \
 121     do {                                                \
 122         major = duplicateBuffer((minor), (src), (dst)); \
 123         if (GSS_ERROR(major))                           \
 124             goto cleanup;                               \
 125     } while (0)
 126
 127 static inline int
 128 bufferEqual(const gss_buffer_t b1, const gss_buffer_t b2)
 129 {
 130     return (b1->length == b2->length &&
 131             memcmp(b1->value, b2->value, b2->length) == 0);
 132 }
 133
 134 static inline int
 135 bufferEqualString(const gss_buffer_t b1, const char *s)
 136 {
 137     gss_buffer_desc b2;
 138
 139     b2.length = strlen(s);
 140     b2.value = (char *)s;
 141
 142     return bufferEqual(b1, &b2);
 143 }
 144
 145 /* util_cksum.c */
 146 enum gss_eap_token_type {
 147     TOK_TYPE_NONE                    = 0x0000,  /* no token */
 148     TOK_TYPE_MIC                     = 0x0404,  /* RFC 4121 MIC token */
 149     TOK_TYPE_WRAP                    = 0x0504,  /* RFC 4121 wrap token */
 150     TOK_TYPE_EXPORT_NAME             = 0x0401,  /* RFC 2743 exported name */
 151     TOK_TYPE_EXPORT_NAME_COMPOSITE   = 0x0402,  /* exported composite name */
 152     TOK_TYPE_DELETE_CONTEXT          = 0x0405,  /* RFC 2743 delete context */
 153     TOK_TYPE_INITIATOR_CONTEXT       = 0x0601,  /* initiator-sent context token */
 154     TOK_TYPE_ACCEPTOR_CONTEXT        = 0x0602,  /* acceptor-sent context token */
 155 };
 156
 157 int
 158 gssEapSign(krb5_context context,
 159            krb5_cksumtype type,
 160            size_t rrc,
 161 #ifdef HAVE_HEIMDAL_VERSION
 162            krb5_crypto crypto,
 163 #else
 164            krb5_keyblock *key,
 165 #endif
 166            krb5_keyusage sign_usage,
 167            gss_iov_buffer_desc *iov,
 168            int iov_count,
 169            enum gss_eap_token_type toktype);
 170
 171 int
 172 gssEapVerify(krb5_context context,
 173              krb5_cksumtype type,
 174              size_t rrc,
 175 #ifdef HAVE_HEIMDAL_VERSION
 176              krb5_crypto crypto,
 177 #else
 178              krb5_keyblock *key,
 179 #endif
 180              krb5_keyusage sign_usage,
 181              gss_iov_buffer_desc *iov,
 182              int iov_count,
 183              enum gss_eap_token_type toktype,
 184              int *valid);
 185
 186 #if 0
 187 OM_uint32
 188 gssEapEncodeGssChannelBindings(OM_uint32 *minor,
 189                                gss_channel_bindings_t chanBindings,
 190                                gss_buffer_t encodedBindings);
 191 #endif
 192
 193 /* util_context.c */
 194 #define EAP_EXPORT_CONTEXT_V1           1
 195
 196 /* inner token types and flags */
 197 #define ITOK_TYPE_NONE                  0x00000000
 198 #define ITOK_TYPE_CONTEXT_ERR           0x00000001 /* critical */
 199 #define ITOK_TYPE_ACCEPTOR_NAME_REQ     0x00000002 /* TBD */
 200 #define ITOK_TYPE_ACCEPTOR_NAME_RESP    0x00000003 /* TBD */
 201 #define ITOK_TYPE_EAP_RESP              0x00000004 /* critical, required, if not reauth */
 202 #define ITOK_TYPE_EAP_REQ               0x00000005 /* critical, required, if not reauth */
 203 #define ITOK_TYPE_GSS_CHANNEL_BINDINGS  0x00000006 /* critical, required, if not reauth */
 204 #define ITOK_TYPE_REAUTH_CREDS          0x00000007 /* optional */
 205 #define ITOK_TYPE_REAUTH_REQ            0x00000008 /* optional */
 206 #define ITOK_TYPE_REAUTH_RESP           0x00000009 /* optional */
 207 #define ITOK_TYPE_VERSION_INFO          0x0000000A /* optional */
 208 #define ITOK_TYPE_VENDOR_INFO           0x0000000B /* optional */
 209 #define ITOK_TYPE_GSS_FLAGS             0x0000000C /* optional */
 210 #define ITOK_TYPE_INITIATOR_MIC         0x0000000D /* critical, required, if not reauth */
 211 #define ITOK_TYPE_ACCEPTOR_MIC          0x0000000E /* TBD */
 212
 213 #define ITOK_FLAG_CRITICAL              0x80000000  /* critical, wire flag */
 214 #define ITOK_FLAG_VERIFIED              0x40000000  /* verified, API flag */
 215
 216 #define ITOK_TYPE_MASK                  (~(ITOK_FLAG_CRITICAL | ITOK_FLAG_VERIFIED))
 217
 218 #define GSSEAP_WIRE_FLAGS_MASK          ( GSS_C_MUTUAL_FLAG             | \
 219                                           GSS_C_DCE_STYLE               | \
 220                                           GSS_C_IDENTIFY_FLAG           | \
 221                                           GSS_C_EXTENDED_ERROR_FLAG       )
 222
 223 OM_uint32 gssEapAllocContext(OM_uint32 *minor, gss_ctx_id_t *pCtx);
 224 OM_uint32 gssEapReleaseContext(OM_uint32 *minor, gss_ctx_id_t *pCtx);
 225
 226 OM_uint32
 227 gssEapMakeToken(OM_uint32 *minor,
 228                 gss_ctx_id_t ctx,
 229                 const gss_buffer_t innerToken,
 230                 enum gss_eap_token_type tokenType,
 231                 gss_buffer_t outputToken);
 232
 233 OM_uint32
 234 gssEapVerifyToken(OM_uint32 *minor,
 235                   gss_ctx_id_t ctx,
 236                   const gss_buffer_t inputToken,
 237                   enum gss_eap_token_type *tokenType,
 238                   gss_buffer_t innerInputToken);
 239
 240 OM_uint32
 241 gssEapContextTime(OM_uint32 *minor,
 242                   gss_const_ctx_id_t context_handle,
 243                   OM_uint32 *time_rec);
 244
 245 OM_uint32
 246 gssEapMakeTokenMIC(OM_uint32 *minor,
 247                    gss_ctx_id_t ctx,
 248                    gss_buffer_t tokenMIC);
 249
 250 OM_uint32
 251 gssEapVerifyTokenMIC(OM_uint32 *minor,
 252                      gss_ctx_id_t ctx,
 253                      const gss_buffer_t tokenMIC);
 254
 255 /* util_cred.c */
 256 OM_uint32 gssEapAllocCred(OM_uint32 *minor, gss_cred_id_t *pCred);
 257 OM_uint32 gssEapReleaseCred(OM_uint32 *minor, gss_cred_id_t *pCred);
 258
 259 gss_OID
 260 gssEapPrimaryMechForCred(gss_cred_id_t cred);
 261
 262 OM_uint32
 263 gssEapAcquireCred(OM_uint32 *minor,
 264                   gss_const_name_t desiredName,
 265                   OM_uint32 timeReq,
 266                   const gss_OID_set desiredMechs,
 267                   int cred_usage,
 268                   gss_cred_id_t *pCred,
 269                   gss_OID_set *pActualMechs,
 270                   OM_uint32 *timeRec);
 271
 272 OM_uint32
 273 gssEapSetCredPassword(OM_uint32 *minor,
 274                       gss_cred_id_t cred,
 275                       const gss_buffer_t password);
 276
 277 OM_uint32
 278 gssEapSetCredClientCertificate(OM_uint32 *minor,
 279                                gss_cred_id_t cred,
 280                                const gss_buffer_t clientCert,
 281                                const gss_buffer_t privateKey);
 282
 283 OM_uint32
 284 gssEapSetCredService(OM_uint32 *minor,
 285                      gss_cred_id_t cred,
 286                      gss_const_name_t target);
 287
 288 OM_uint32
 289 gssEapResolveInitiatorCred(OM_uint32 *minor,
 290                            const gss_cred_id_t cred,
 291                            gss_const_name_t target,
 292                            gss_cred_id_t *resolvedCred);
 293
 294 int gssEapCredAvailable(gss_const_cred_id_t cred, gss_OID mech);
 295
 296 OM_uint32
 297 gssEapInquireCred(OM_uint32 *minor,
 298                   gss_cred_id_t cred,
 299                   gss_name_t *name,
 300                   OM_uint32 *pLifetime,
 301                   gss_cred_usage_t *cred_usage,
 302                   gss_OID_set *mechanisms);
 303
 304 /* util_crypt.c */
 305 int
 306 gssEapEncrypt(krb5_context context, int dce_style, size_t ec,
 307               size_t rrc,
 308 #ifdef HAVE_HEIMDAL_VERSION
 309               krb5_crypto crypto,
 310 #else
 311               krb5_keyblock *key,
 312 #endif
 313               int usage,
 314               gss_iov_buffer_desc *iov, int iov_count);
 315
 316 int
 317 gssEapDecrypt(krb5_context context, int dce_style, size_t ec,
 318               size_t rrc,
 319 #ifdef HAVE_HEIMDAL_VERSION
 320               krb5_crypto crypto,
 321 #else
 322               krb5_keyblock *key,
 323 #endif
 324               int usage,
 325               gss_iov_buffer_desc *iov, int iov_count);
 326
 327 int
 328 gssEapMapCryptoFlag(OM_uint32 type);
 329
 330 gss_iov_buffer_t
 331 gssEapLocateIov(gss_iov_buffer_desc *iov,
 332                 int iov_count,
 333                 OM_uint32 type);
 334
 335 gss_iov_buffer_t
 336 gssEapLocateHeaderIov(gss_iov_buffer_desc *iov,
 337                       int iov_count,
 338                       enum gss_eap_token_type toktype);
 339
 340 void
 341 gssEapIovMessageLength(gss_iov_buffer_desc *iov,
 342                        int iov_count,
 343                        size_t *data_length,
 344                        size_t *assoc_data_length);
 345
 346 void
 347 gssEapReleaseIov(gss_iov_buffer_desc *iov, int iov_count);
 348
 349 int
 350 gssEapIsIntegrityOnly(gss_iov_buffer_desc *iov, int iov_count);
 351
 352 int
 353 gssEapAllocIov(gss_iov_buffer_t iov, size_t size);
 354
 355 OM_uint32
 356 gssEapDeriveRfc3961Key(OM_uint32 *minor,
 357                        const unsigned char *key,
 358                        size_t keyLength,
 359                        krb5_enctype enctype,
 360                        krb5_keyblock *pKey);
 361
 362 /* util_krb.c */
 363
 364 #ifndef KRB_MALLOC
 365 /*
 366  * If your Kerberos library uses a different allocator to your
 367  * GSS mechanism glue, then you might wish to define these in
 368  * config.h or elsewhere. This should eventually go away when
 369  * we no longer need to allocate memory that is freed by the
 370  * Kerberos library.
 371  */
 372 #define KRB_CALLOC                      calloc
 373 #define KRB_MALLOC                      malloc
 374 #define KRB_FREE                        free
 375 #define KRB_REALLOC                     realloc
 376 #endif /* KRB_MALLOC */
 377
 378 #ifdef HAVE_HEIMDAL_VERSION
 379
 380 #include <der.h>
 381
 382 #define KRB_TIME_FOREVER        ((time_t)~0L)
 383
 384 #define KRB_KEY_TYPE(key)       ((key)->keytype)
 385 #define KRB_KEY_DATA(key)       ((key)->keyvalue.data)
 386 #define KRB_KEY_LENGTH(key)     ((key)->keyvalue.length)
 387
 388 #define KRB_PRINC_LENGTH(princ) ((princ)->name.name_string.len)
 389 #define KRB_PRINC_TYPE(princ)   ((princ)->name.name_type)
 390 #define KRB_PRINC_NAME(princ)   ((princ)->name.name_string.val)
 391 #define KRB_PRINC_REALM(princ)  ((princ)->realm)
 392
 393 #define KRB_KT_ENT_KEYBLOCK(e)  (&(e)->keyblock)
 394 #define KRB_KT_ENT_FREE(c, e)   krb5_kt_free_entry((c), (e))
 395
 396 #define KRB_CRYPTO_CONTEXT(ctx) (krbCrypto)
 397
 398 #define KRB_DATA_INIT(d)        krb5_data_zero((d))
 399
 400 #define KRB_CHECKSUM_TYPE(c)    ((c)->cksumtype)
 401 #define KRB_CHECKSUM_LENGTH(c)  ((c)->checksum.length)
 402 #define KRB_CHECKSUM_DATA(c)    ((c)->checksum.data)
 403
 404 #define KRB_CHECKSUM_INIT(cksum, type, d)      do { \
 405         (cksum)->cksumtype = (type);                \
 406         (cksum)->checksum.length = (d)->length;     \
 407         (cksum)->checksum.data = (d)->value;        \
 408     } while (0)
 409
 410 #define KRB_CHECKSUM_FREE(ctx, cksum)          do { \
 411         der_free_octet_string(&(cksum)->checksum);  \
 412         memset((cksum), 0, sizeof(*(cksum)));       \
 413     } while (0)
 414
 415 #else
 416
 417 #define KRB_TIME_FOREVER        KRB5_INT32_MAX
 418
 419 #define KRB_KEY_TYPE(key)       ((key)->enctype)
 420 #define KRB_KEY_DATA(key)       ((key)->contents)
 421 #define KRB_KEY_LENGTH(key)     ((key)->length)
 422
 423 #define KRB_PRINC_LENGTH(princ) (krb5_princ_size(NULL, (princ)))
 424 #define KRB_PRINC_TYPE(princ)   (krb5_princ_type(NULL, (princ)))
 425 #define KRB_PRINC_NAME(princ)   (krb5_princ_name(NULL, (princ)))
 426 #define KRB_PRINC_REALM(princ)  (krb5_princ_realm(NULL, (princ)))
 427 #define KRB_PRINC_COMPONENT(princ, component) \
 428         (krb5_princ_component(NULL, (princ), (component)))
 429
 430 #define KRB_KT_ENT_KEYBLOCK(e)  (&(e)->key)
 431 #define KRB_KT_ENT_FREE(c, e)   krb5_free_keytab_entry_contents((c), (e))
 432
 433 #define KRB_CRYPTO_CONTEXT(ctx) (&(ctx)->rfc3961Key)
 434
 435 #define KRB_DATA_INIT(d)        do {        \
 436         (d)->magic = KV5M_DATA;             \
 437         (d)->length = 0;                    \
 438         (d)->data = NULL;                   \
 439     } while (0)
 440
 441 #define KRB_CHECKSUM_TYPE(c)    ((c)->checksum_type)
 442 #define KRB_CHECKSUM_LENGTH(c)  ((c)->length)
 443 #define KRB_CHECKSUM_DATA(c)    ((c)->contents)
 444
 445 #define KRB_CHECKSUM_INIT(cksum, type, d)      do { \
 446         (cksum)->checksum_type = (type);            \
 447         (cksum)->length = (d)->length;              \
 448         (cksum)->contents = (d)->value;             \
 449     } while (0)
 450
 451 #define KRB_CHECKSUM_FREE(ctx, cksum) krb5_free_checksum_contents((ctx), (cksum))
 452
 453 #endif /* HAVE_HEIMDAL_VERSION */
 454
 455 #define KRB_KEY_INIT(key)       do {        \
 456         KRB_KEY_TYPE(key) = ENCTYPE_NULL;   \
 457         KRB_KEY_DATA(key) = NULL;           \
 458         KRB_KEY_LENGTH(key) = 0;            \
 459     } while (0)
 460
 461 #define GSSEAP_KRB_INIT(ctx) do {                   \
 462         OM_uint32 tmpMajor;                         \
 463                                                     \
 464         tmpMajor  = gssEapKerberosInit(minor, ctx); \
 465         if (GSS_ERROR(tmpMajor)) {                  \
 466             return tmpMajor;                        \
 467         }                                           \
 468     } while (0)
 469
 470 OM_uint32
 471 gssEapKerberosInit(OM_uint32 *minor, krb5_context *context);
 472
 473 OM_uint32
 474 rfc3961ChecksumTypeForKey(OM_uint32 *minor,
 475                           krb5_keyblock *key,
 476                           krb5_cksumtype *cksumtype);
 477
 478 krb5_error_code
 479 krbCryptoLength(krb5_context krbContext,
 480 #ifdef HAVE_HEIMDAL_VERSION
 481                 krb5_crypto krbCrypto,
 482 #else
 483                 const krb5_keyblock *key,
 484 #endif
 485                 int type,
 486                 size_t *length);
 487
 488 krb5_error_code
 489 krbPaddingLength(krb5_context krbContext,
 490 #ifdef HAVE_HEIMDAL_VERSION
 491                  krb5_crypto krbCrypto,
 492 #else
 493                  const krb5_keyblock *key,
 494 #endif
 495                  size_t dataLength,
 496                  size_t *padLength);
 497
 498 krb5_error_code
 499 krbBlockSize(krb5_context krbContext,
 500 #ifdef HAVE_HEIMDAL_VERSION
 501                  krb5_crypto krbCrypto,
 502 #else
 503                  const krb5_keyblock *key,
 504 #endif
 505                  size_t *blockSize);
 506
 507 krb5_error_code
 508 krbEnctypeToString(krb5_context krbContext,
 509                    krb5_enctype enctype,
 510                    const char *prefix,
 511                    gss_buffer_t string);
 512
 513 krb5_error_code
 514 krbMakeAuthDataKdcIssued(krb5_context context,
 515                          const krb5_keyblock *key,
 516                          krb5_const_principal issuer,
 517 #ifdef HAVE_HEIMDAL_VERSION
 518                          const AuthorizationData *authdata,
 519                          AuthorizationData *adKdcIssued
 520 #else
 521                          krb5_authdata *const *authdata,
 522                          krb5_authdata ***adKdcIssued
 523 #endif
 524                          );
 525
 526 krb5_error_code
 527 krbMakeCred(krb5_context context,
 528             krb5_auth_context authcontext,
 529             krb5_creds *creds,
 530             krb5_data *data);
 531
 532 /* util_lucid.c */
 533 OM_uint32
 534 gssEapExportLucidSecContext(OM_uint32 *minor,
 535                             gss_const_ctx_id_t ctx,
 536                             const gss_OID desiredObject,
 537                             gss_buffer_set_t *data_set);
 538
 539 /* util_mech.c */
 540 extern gss_OID GSS_EAP_MECHANISM;
 541
 542 #define OID_FLAG_NULL_VALID                 0x00000001
 543 #define OID_FLAG_FAMILY_MECH_VALID          0x00000002
 544 #define OID_FLAG_MAP_NULL_TO_DEFAULT_MECH   0x00000004
 545 #define OID_FLAG_MAP_FAMILY_MECH_TO_NULL    0x00000008
 546
 547 OM_uint32
 548 gssEapCanonicalizeOid(OM_uint32 *minor,
 549                       const gss_OID oid,
 550                       OM_uint32 flags,
 551                       gss_OID *pOid);
 552
 553 OM_uint32
 554 gssEapReleaseOid(OM_uint32 *minor, gss_OID *oid);
 555
 556 OM_uint32
 557 gssEapDefaultMech(OM_uint32 *minor,
 558                   gss_OID *oid);
 559
 560 OM_uint32
 561 gssEapIndicateMechs(OM_uint32 *minor,
 562                     gss_OID_set *mechs);
 563
 564 OM_uint32
 565 gssEapEnctypeToOid(OM_uint32 *minor,
 566                    krb5_enctype enctype,
 567                    gss_OID *pOid);
 568
 569 OM_uint32
 570 gssEapOidToEnctype(OM_uint32 *minor,
 571                    const gss_OID oid,
 572                    krb5_enctype *enctype);
 573
 574 int
 575 gssEapIsMechanismOid(const gss_OID oid);
 576
 577 int
 578 gssEapIsConcreteMechanismOid(const gss_OID oid);
 579
 580 OM_uint32
 581 gssEapValidateMechs(OM_uint32 *minor,
 582                    const gss_OID_set mechs);
 583
 584 gss_buffer_t
 585 gssEapOidToSaslName(const gss_OID oid);
 586
 587 gss_OID
 588 gssEapSaslNameToOid(const gss_buffer_t name);
 589
 590 /* util_moonshot.c */
 591 OM_uint32
 592 libMoonshotResolveDefaultIdentity(OM_uint32 *minor,
 593                                   const gss_cred_id_t cred,
 594                                   gss_name_t *pName);
 595
 596 OM_uint32
 597 libMoonshotResolveInitiatorCred(OM_uint32 *minor,
 598                                 gss_cred_id_t cred,
 599                                 gss_const_name_t targetName);
 600
 601 /* util_name.c */
 602 #define EXPORT_NAME_FLAG_OID                    0x1
 603 #define EXPORT_NAME_FLAG_COMPOSITE              0x2
 604 #define EXPORT_NAME_FLAG_ALLOW_COMPOSITE        0x4
 605
 606 OM_uint32 gssEapAllocName(OM_uint32 *minor, gss_name_t *pName);
 607 OM_uint32 gssEapReleaseName(OM_uint32 *minor, gss_name_t *pName);
 608 OM_uint32 gssEapExportName(OM_uint32 *minor,
 609                            gss_const_name_t name,
 610                            gss_buffer_t exportedName);
 611 OM_uint32 gssEapExportNameInternal(OM_uint32 *minor,
 612                                    gss_const_name_t name,
 613                                    gss_buffer_t exportedName,
 614                                    OM_uint32 flags);
 615 OM_uint32 gssEapImportName(OM_uint32 *minor,
 616                            const gss_buffer_t input_name_buffer,
 617                            const gss_OID input_name_type,
 618                            const gss_OID input_mech_type,
 619                            gss_name_t *output_name);
 620 OM_uint32 gssEapImportNameInternal(OM_uint32 *minor,
 621                                    const gss_buffer_t input_name_buffer,
 622                                    gss_name_t *output_name,
 623                                    OM_uint32 flags);
 624 OM_uint32
 625 gssEapDuplicateName(OM_uint32 *minor,
 626                     gss_const_name_t input_name,
 627                     gss_name_t *dest_name);
 628
 629 OM_uint32
 630 gssEapCanonicalizeName(OM_uint32 *minor,
 631                        gss_const_name_t input_name,
 632                        const gss_OID mech_type,
 633                        gss_name_t *dest_name);
 634
 635 OM_uint32
 636 gssEapDisplayName(OM_uint32 *minor,
 637                   gss_const_name_t name,
 638                   gss_buffer_t output_name_buffer,
 639                   gss_OID *output_name_type);
 640
 641 #define COMPARE_NAME_FLAG_IGNORE_EMPTY_REALMS   0x1
 642
 643 OM_uint32
 644 gssEapCompareName(OM_uint32 *minor,
 645                   gss_const_name_t name1,
 646                   gss_const_name_t name2,
 647                   OM_uint32 flags,
 648                   int *name_equal);
 649
 650 /* util_oid.c */
 651 OM_uint32
 652 composeOid(OM_uint32 *minor_status,
 653            const char *prefix,
 654            size_t prefix_len,
 655            int suffix,
 656            gss_OID_desc *oid);
 657
 658 OM_uint32
 659 decomposeOid(OM_uint32 *minor_status,
 660              const char *prefix,
 661              size_t prefix_len,
 662              gss_OID_desc *oid,
 663              int *suffix) ;
 664
 665 OM_uint32
 666 duplicateOid(OM_uint32 *minor_status,
 667              const gss_OID_desc * const oid,
 668              gss_OID *new_oid);
 669
 670 OM_uint32
 671 duplicateOidSet(OM_uint32 *minor,
 672                 const gss_OID_set src,
 673                 gss_OID_set *dst);
 674
 675 extern int
 676 oidEqual(const gss_OID_desc *o1, const gss_OID_desc *o2);
 677
 678 /* util_ordering.c */
 679 OM_uint32
 680 sequenceInternalize(OM_uint32 *minor,
 681                     void **vqueue,
 682                     unsigned char **buf,
 683                     size_t *lenremain);
 684
 685 OM_uint32
 686 sequenceExternalize(OM_uint32 *minor,
 687                     void *vqueue,
 688                     unsigned char **buf,
 689                     size_t *lenremain);
 690
 691 size_t
 692 sequenceSize(void *vqueue);
 693
 694 OM_uint32
 695 sequenceFree(OM_uint32 *minor, void **vqueue);
 696
 697 OM_uint32
 698 sequenceCheck(OM_uint32 *minor, void **vqueue, uint64_t seqnum);
 699
 700 OM_uint32
 701 sequenceInit(OM_uint32 *minor, void **vqueue, uint64_t seqnum,
 702              int do_replay, int do_sequence, int wide_nums);
 703
 704 /* util_sm.c */
 705 enum gss_eap_state {
 706     GSSEAP_STATE_INITIAL        = 0x01,     /* initial state */
 707     GSSEAP_STATE_AUTHENTICATE   = 0x02,     /* exchange EAP messages */
 708     GSSEAP_STATE_INITIATOR_EXTS = 0x04,     /* initiator extensions */
 709     GSSEAP_STATE_ACCEPTOR_EXTS  = 0x08,     /* acceptor extensions */
 710 #ifdef GSSEAP_ENABLE_REAUTH
 711     GSSEAP_STATE_REAUTHENTICATE = 0x10,     /* GSS reauthentication messages */
 712 #endif
 713     GSSEAP_STATE_ESTABLISHED    = 0x20,     /* context established */
 714     GSSEAP_STATE_ALL            = 0x3F
 715 };
 716
 717 #define GSSEAP_STATE_NEXT(s)    ((s) << 1)
 718
 719 #define GSSEAP_SM_STATE(ctx)                ((ctx)->state)
 720
 721 #ifdef GSSEAP_DEBUG
 722 void gssEapSmTransition(gss_ctx_id_t ctx, enum gss_eap_state state);
 723 #define GSSEAP_SM_TRANSITION(ctx, state)    gssEapSmTransition((ctx), (state))
 724 #else
 725 #define GSSEAP_SM_TRANSITION(ctx, newstate)    do { (ctx)->state = (newstate); } while (0)
 726 #endif
 727
 728 #define GSSEAP_SM_TRANSITION_NEXT(ctx)      GSSEAP_SM_TRANSITION((ctx), GSSEAP_STATE_NEXT(GSSEAP_SM_STATE((ctx))))
 729
 730 /* state machine entry */
 731 struct gss_eap_sm {
 732     OM_uint32 inputTokenType;
 733     OM_uint32 outputTokenType;
 734     enum gss_eap_state validStates;
 735     OM_uint32 itokFlags;
 736     OM_uint32 (*processToken)(OM_uint32 *,
 737                               gss_cred_id_t,
 738                               gss_ctx_id_t,
 739                               gss_const_name_t,
 740                               gss_OID,
 741                               OM_uint32,
 742                               OM_uint32,
 743                               gss_channel_bindings_t,
 744                               gss_buffer_t,
 745                               gss_buffer_t,
 746                               OM_uint32 *);
 747 };
 748
 749 /* state machine flags, set by handler */
 750 #define SM_FLAG_FORCE_SEND_TOKEN            0x00000001  /* send token even if no inner tokens */
 751 #define SM_FLAG_OUTPUT_TOKEN_CRITICAL       0x00000002  /* output token is critical */
 752
 753 /* state machine flags, set by state machine */
 754 #define SM_FLAG_INPUT_TOKEN_CRITICAL        0x10000000  /* input token was critical */
 755
 756 #define SM_ITOK_FLAG_REQUIRED               0x00000001  /* received tokens must be present */
 757
 758 OM_uint32
 759 gssEapSmStep(OM_uint32 *minor,
 760              gss_cred_id_t cred,
 761              gss_ctx_id_t ctx,
 762              gss_const_name_t target,
 763              gss_OID mech,
 764              OM_uint32 reqFlags,
 765              OM_uint32 timeReq,
 766              gss_channel_bindings_t chanBindings,
 767              gss_buffer_t inputToken,
 768              gss_buffer_t outputToken,
 769              struct gss_eap_sm *sm,
 770              size_t smCount);
 771
 772 void
 773 gssEapSmTransition(gss_ctx_id_t ctx, enum gss_eap_state state);
 774
 775 /* util_token.c */
 776 struct gss_eap_token_buffer_set {
 777     gss_buffer_set_desc buffers; /* pointers only */
 778     OM_uint32 *types;
 779 };
 780
 781 OM_uint32
 782 gssEapEncodeInnerTokens(OM_uint32 *minor,
 783                         struct gss_eap_token_buffer_set *tokens,
 784                         gss_buffer_t buffer);
 785 OM_uint32
 786 gssEapDecodeInnerTokens(OM_uint32 *minor,
 787                         const gss_buffer_t buffer,
 788                         struct gss_eap_token_buffer_set *tokens);
 789
 790 OM_uint32
 791 gssEapReleaseInnerTokens(OM_uint32 *minor,
 792                          struct gss_eap_token_buffer_set *tokens,
 793                          int freeBuffers);
 794
 795 OM_uint32
 796 gssEapAllocInnerTokens(OM_uint32 *minor,
 797                        size_t count,
 798                        struct gss_eap_token_buffer_set *tokens);
 799
 800 size_t
 801 tokenSize(const gss_OID_desc *mech, size_t body_size);
 802
 803 void
 804 makeTokenHeader(const gss_OID_desc *mech,
 805                 size_t body_size,
 806                 unsigned char **buf,
 807                 enum gss_eap_token_type tok_type);
 808
 809 OM_uint32
 810 verifyTokenHeader(OM_uint32 *minor,
 811                   gss_OID mech,
 812                   size_t *body_size,
 813                   unsigned char **buf_in,
 814                   size_t toksize_in,
 815                   enum gss_eap_token_type *ret_tok_type);
 816
 817 /* Helper macros */
 818 #ifndef GSSEAP_MALLOC
 819 #if _WIN32
 820 #include <gssapi/gssapi_alloc.h>
 821 #define GSSEAP_MALLOC                   gssalloc_malloc
 822 #define GSSEAP_CALLOC                   gssalloc_calloc
 823 #define GSSEAP_FREE                     gssalloc_free
 824 #define GSSEAP_REALLOC                  gssalloc_realloc
 825 #else
 826 #define GSSEAP_CALLOC                   calloc
 827 #define GSSEAP_MALLOC                   malloc
 828 #define GSSEAP_FREE                     free
 829 #define GSSEAP_REALLOC                  realloc
 830 #endif /* _WIN32 */
 831 #endif /* !GSSEAP_MALLOC */
 832
 833 #ifndef GSSAPI_CALLCONV
 834 #define GSSAPI_CALLCONV                 KRB5_CALLCONV
 835 #endif
 836
 837 #ifndef GSSEAP_ASSERT
 838 #include <assert.h>
 839 #define GSSEAP_ASSERT(x)                assert((x))
 840 #endif /* !GSSEAP_ASSERT */
 841
 842 #ifdef WIN32
 843 #define GSSEAP_CONSTRUCTOR
 844 #define GSSEAP_DESTRUCTOR
 845 #else
 846 #define GSSEAP_CONSTRUCTOR              __attribute__((constructor))
 847 #define GSSEAP_DESTRUCTOR               __attribute__((destructor))
 848 #endif
 849
 850 #define GSSEAP_NOT_IMPLEMENTED          do {            \
 851         GSSEAP_ASSERT(0 && "not implemented");          \
 852         *minor = ENOSYS;                                \
 853         return GSS_S_FAILURE;                           \
 854     } while (0)
 855
 856 #ifdef WIN32
 857
 858 #include <winbase.h>
 859
 860 #define GSSEAP_GET_LAST_ERROR()         (GetLastError()) /* XXX FIXME */
 861
 862 #define GSSEAP_MUTEX                    CRITICAL_SECTION
 863 #define GSSEAP_MUTEX_INIT(m)            (InitializeCriticalSection((m)), 0)
 864 #define GSSEAP_MUTEX_DESTROY(m)         DeleteCriticalSection((m))
 865 #define GSSEAP_MUTEX_LOCK(m)            EnterCriticalSection((m))
 866 #define GSSEAP_MUTEX_UNLOCK(m)          LeaveCriticalSection((m))
 867 #define GSSEAP_ONCE_LEAVE               do { return TRUE; } while (0)
 868
 869 /* Thread-local is handled separately */
 870
 871 #define GSSEAP_THREAD_ONCE              INIT_ONCE
 872 #define GSSEAP_ONCE_CALLBACK(cb)        BOOL CALLBACK cb(PINIT_ONCE InitOnce, PVOID Parameter, PVOID *Context)
 873 #define GSSEAP_ONCE(o, i)               InitOnceExecuteOnce((o), (i), NULL, NULL)
 874 #define GSSEAP_ONCE_INITIALIZER         INIT_ONCE_STATIC_INIT
 875
 876 #else
 877
 878 #include <pthread.h>
 879
 880 #define GSSEAP_GET_LAST_ERROR()         (errno)
 881
 882 #define GSSEAP_MUTEX                    pthread_mutex_t
 883 #define GSSEAP_MUTEX_INIT(m)            pthread_mutex_init((m), NULL)
 884 #define GSSEAP_MUTEX_DESTROY(m)         pthread_mutex_destroy((m))
 885 #define GSSEAP_MUTEX_LOCK(m)            pthread_mutex_lock((m))
 886 #define GSSEAP_MUTEX_UNLOCK(m)          pthread_mutex_unlock((m))
 887
 888 #define GSSEAP_THREAD_KEY               pthread_key_t
 889 #define GSSEAP_KEY_CREATE(k, d)         pthread_key_create((k), (d))
 890 #define GSSEAP_GETSPECIFIC(k)           pthread_getspecific((k))
 891 #define GSSEAP_SETSPECIFIC(k, d)        pthread_setspecific((k), (d))
 892
 893 #define GSSEAP_THREAD_ONCE              pthread_once_t
 894 #define GSSEAP_ONCE_CALLBACK(cb)        void cb(void)
 895 #define GSSEAP_ONCE(o, i)               pthread_once((o), (i))
 896 #define GSSEAP_ONCE_INITIALIZER         PTHREAD_ONCE_INIT
 897 #define GSSEAP_ONCE_LEAVE               do { } while (0)
 898
 899 #endif /* WIN32 */
 900
 901 /* Helper functions */
 902 static inline void
 903 store_uint16_be(uint16_t val, void *vp)
 904 {
 905     unsigned char *p = (unsigned char *)vp;
 906
 907     p[0] = (val >>  8) & 0xff;
 908     p[1] = (val      ) & 0xff;
 909 }
 910
 911 static inline uint16_t
 912 load_uint16_be(const void *cvp)
 913 {
 914     const unsigned char *p = (const unsigned char *)cvp;
 915
 916     return (p[1] | (p[0] << 8));
 917 }
 918
 919 static inline void
 920 store_uint32_be(uint32_t val, void *vp)
 921 {
 922     unsigned char *p = (unsigned char *)vp;
 923
 924     p[0] = (val >> 24) & 0xff;
 925     p[1] = (val >> 16) & 0xff;
 926     p[2] = (val >>  8) & 0xff;
 927     p[3] = (val      ) & 0xff;
 928 }
 929
 930 static inline uint32_t
 931 load_uint32_be(const void *cvp)
 932 {
 933     const unsigned char *p = (const unsigned char *)cvp;
 934
 935     return (p[3] | (p[2] << 8)
 936             | ((uint32_t) p[1] << 16)
 937             | ((uint32_t) p[0] << 24));
 938 }
 939
 940 static inline void
 941 store_uint64_be(uint64_t val, void *vp)
 942 {
 943     unsigned char *p = (unsigned char *)vp;
 944
 945     p[0] = (unsigned char)((val >> 56) & 0xff);
 946     p[1] = (unsigned char)((val >> 48) & 0xff);
 947     p[2] = (unsigned char)((val >> 40) & 0xff);
 948     p[3] = (unsigned char)((val >> 32) & 0xff);
 949     p[4] = (unsigned char)((val >> 24) & 0xff);
 950     p[5] = (unsigned char)((val >> 16) & 0xff);
 951     p[6] = (unsigned char)((val >>  8) & 0xff);
 952     p[7] = (unsigned char)((val      ) & 0xff);
 953 }
 954
 955 static inline uint64_t
 956 load_uint64_be(const void *cvp)
 957 {
 958     const unsigned char *p = (const unsigned char *)cvp;
 959
 960     return ((uint64_t)load_uint32_be(p) << 32) | load_uint32_be(p + 4);
 961 }
 962
 963 static inline unsigned char *
 964 store_buffer(gss_buffer_t buffer, void *vp, int wide_nums)
 965 {
 966     unsigned char *p = (unsigned char *)vp;
 967
 968     if (wide_nums) {
 969         store_uint64_be(buffer->length, p);
 970         p += 8;
 971     } else {
 972         store_uint32_be(buffer->length, p);
 973         p += 4;
 974     }
 975
 976     if (buffer->value != NULL) {
 977         memcpy(p, buffer->value, buffer->length);
 978         p += buffer->length;
 979     }
 980
 981     return p;
 982 }
 983
 984 static inline unsigned char *
 985 load_buffer(const void *cvp, size_t length, gss_buffer_t buffer)
 986 {
 987     buffer->length = 0;
 988     buffer->value = GSSEAP_MALLOC(length);
 989     if (buffer->value == NULL)
 990         return NULL;
 991     buffer->length = length;
 992     memcpy(buffer->value, cvp, length);
 993     return (unsigned char *)cvp + length;
 994 }
 995
 996 static inline unsigned char *
 997 store_oid(gss_OID oid, void *vp)
 998 {
 999     gss_buffer_desc buf;
1000
1001     if (oid != GSS_C_NO_OID) {
1002         buf.length = oid->length;
1003         buf.value = oid->elements;
1004     } else {
1005         buf.length = 0;
1006         buf.value = NULL;
1007     }
1008
1009     return store_buffer(&buf, vp, FALSE);
1010 }
1011
1012 static inline void
1013 krbDataToGssBuffer(krb5_data *data, gss_buffer_t buffer)
1014 {
1015     buffer->value = (void *)data->data;
1016     buffer->length = data->length;
1017 }
1018
1019 static inline void
1020 krbPrincComponentToGssBuffer(krb5_principal krbPrinc,
1021                              int index, gss_buffer_t buffer)
1022 {
1023     if (KRB_PRINC_LENGTH(krbPrinc) <= index) {
1024         buffer->value = NULL;
1025         buffer->length = 0;
1026     } else {
1027 #ifdef HAVE_HEIMDAL_VERSION
1028         buffer->value = (void *)KRB_PRINC_NAME(krbPrinc)[index];
1029         buffer->length = strlen((char *)buffer->value);
1030 #else
1031         buffer->value = (void *)krb5_princ_component(NULL, krbPrinc, index)->data;
1032         buffer->length = krb5_princ_component(NULL, krbPrinc, index)->length;
1033 #endif /* HAVE_HEIMDAL_VERSION */
1034     }
1035 }
1036
1037 static inline krb5_error_code
1038 krbPrincUnparseServiceSpecifics(krb5_context krbContext, krb5_principal krbPrinc,
1039                                 gss_buffer_t nameBuf)
1040 {
1041     krb5_error_code result = 0;
1042     if (KRB_PRINC_LENGTH(krbPrinc) > 2) {
1043         /* Acceptor-Service-Specific */
1044         krb5_principal_data ssiPrinc = *krbPrinc;
1045         char *ssi;
1046
1047         KRB_PRINC_LENGTH(&ssiPrinc) -= 2;
1048         KRB_PRINC_NAME(&ssiPrinc) += 2;
1049
1050         result = krb5_unparse_name_flags(krbContext, &ssiPrinc,
1051                                          KRB5_PRINCIPAL_UNPARSE_NO_REALM, &ssi);
1052         if (result != 0)
1053             return result;
1054
1055         nameBuf->value = ssi;
1056         nameBuf->length = strlen(ssi);
1057     } else {
1058         nameBuf->value = NULL;
1059         nameBuf->length = 0;
1060     }
1061
1062     return result;
1063 }
1064
1065 static inline void
1066 krbFreeUnparsedName(krb5_context krbContext GSSEAP_UNUSED, gss_buffer_t nameBuf)
1067 {
1068 #ifdef HAVE_HEIMDAL_VERSION
1069     krb5_xfree((char *) nameBuf->value);
1070 #else
1071     krb5_free_unparsed_name(krbContext, (char *)(nameBuf->value));
1072 #endif
1073     nameBuf->value = NULL;
1074     nameBuf->length = 0;
1075 }
1076
1077 static inline void
1078 krbPrincRealmToGssBuffer(krb5_principal krbPrinc, gss_buffer_t buffer)
1079 {
1080 #ifdef HAVE_HEIMDAL_VERSION
1081     buffer->value = (void *)KRB_PRINC_REALM(krbPrinc);
1082     buffer->length = strlen((char *)buffer->value);
1083 #else
1084     krbDataToGssBuffer(KRB_PRINC_REALM(krbPrinc), buffer);
1085 #endif
1086 }
1087
1088 static inline void
1089 gssBufferToKrbData(gss_buffer_t buffer, krb5_data *data)
1090 {
1091     data->data = (char *)buffer->value;
1092     data->length = buffer->length;
1093 }
1094
1095 /* util_tld.c */
1096 struct gss_eap_status_info;
1097
1098 struct gss_eap_thread_local_data {
1099     krb5_context krbContext;
1100     struct gss_eap_status_info *statusInfo;
1101 };
1102
1103 struct gss_eap_thread_local_data *
1104 gssEapGetThreadLocalData(void);
1105
1106 void
1107 gssEapDestroyStatusInfo(struct gss_eap_status_info *status);
1108
1109 void
1110 gssEapDestroyKrbContext(krb5_context context);
1111
1112 #ifdef __cplusplus
1113 }
1114 #endif
1115
1116 #ifdef GSSEAP_ENABLE_ACCEPTOR
1117 #include "util_json.h"
1118 #include "util_attr.h"
1119 #include "util_base64.h"
1120 #endif /* GSSEAP_ENABLE_ACCEPTOR */
1121 #ifdef GSSEAP_ENABLE_REAUTH
1122 #include "util_reauth.h"
1123 #endif
1124
1125 #endif /* _UTIL_H_ */