mech_eap/util_mech.c

   1 /*
   2  * Copyright (c) 2011, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 /*
  34  * General mechanism utility routines.
  35  */
  36
  37 #include "gssapiP_eap.h"
  38
  39 /*
  40  * Mechanism and name types are taken from 1.3.6.1.5.5(mechanisms)
  41  * assigned at http://www.iana.org/assignments/smi-numbers
  42  *
  43  *      abfab(15)
  44  *       mechanisms(1)
  45  *        eap-aes128-cts-hmac-sha1-96(17)
  46  *        eap-aes256-cts-hmac-sha1-96(18)
  47  *       nameTypes(2)
  48  *        eap-name(1)
  49  *
  50  * Implementation-internal OIDs are taken from 1.3.6.1.4.1.5322(padl)
  51  *      gssEap(22)
  52  *       apiExtensions(3)
  53  *        inquireSecContextByOid(1)
  54  *        inquireCredByOid(2)
  55  *        setSecContextOption(3)
  56  *        setCredOption(4)
  57  *        mechInvoke(5)
  58  */
  59
  60 /*
  61  * Note: the enctype-less OID is used as the mechanism OID in non-
  62  * canonicalized exported names.
  63  */
  64 static gss_OID_desc gssEapMechOids[] = {
  65     /* 1.3.6.1.5.5.15.1.1  */
  66     { 8, "\x2B\x06\x01\x05\x05\x0f\x01\x01" },
  67     /* 1.3.6.1.5.5.15.1.1.17  */
  68     { 9, "\x2B\x06\x01\x05\x05\x0f\x01\x01\x11" },
  69     /* 1.3.6.1.5.5.15.1.1.18  */
  70     { 9, "\x2B\x06\x01\x05\x05\x0f\x01\x01\x12" },
  71 };
  72
  73 gss_OID GSS_EAP_MECHANISM                            = &gssEapMechOids[0];
  74 gss_OID GSS_EAP_AES128_CTS_HMAC_SHA1_96_MECHANISM    = &gssEapMechOids[1];
  75 gss_OID GSS_EAP_AES256_CTS_HMAC_SHA1_96_MECHANISM    = &gssEapMechOids[2];
  76
  77 static int
  78 internalizeOid(const gss_OID oid,
  79                gss_OID *const pInternalizedOid);
  80
  81 /*
  82  * Returns TRUE is the OID is a concrete mechanism OID, that is, one
  83  * with a Kerberos enctype as the last element.
  84  */
  85 int
  86 gssEapIsConcreteMechanismOid(const gss_OID oid)
  87 {
  88     return oid->length > GSS_EAP_MECHANISM->length &&
  89            memcmp(oid->elements, GSS_EAP_MECHANISM->elements,
  90                   GSS_EAP_MECHANISM->length) == 0;
  91 }
  92
  93 int
  94 gssEapIsMechanismOid(const gss_OID oid)
  95 {
  96     return oid == GSS_C_NO_OID ||
  97            oidEqual(oid, GSS_EAP_MECHANISM) ||
  98            gssEapIsConcreteMechanismOid(oid);
  99 }
 100
 101 /*
 102  * Validate that all elements are concrete mechanism OIDs.
 103  */
 104 OM_uint32
 105 gssEapValidateMechs(OM_uint32 *minor,
 106                     const gss_OID_set mechs)
 107 {
 108     int i;
 109
 110     *minor = 0;
 111
 112     if (mechs == GSS_C_NO_OID_SET) {
 113         return GSS_S_COMPLETE;
 114     }
 115
 116     for (i = 0; i < mechs->count; i++) {
 117         gss_OID oid = &mechs->elements[i];
 118
 119         if (!gssEapIsConcreteMechanismOid(oid)) {
 120             *minor = GSSEAP_WRONG_MECH;
 121             return GSS_S_BAD_MECH;
 122         }
 123     }
 124
 125     return GSS_S_COMPLETE;
 126 }
 127
 128 OM_uint32
 129 gssEapOidToEnctype(OM_uint32 *minor,
 130                    const gss_OID oid,
 131                    krb5_enctype *enctype)
 132 {
 133     OM_uint32 major;
 134     int suffix;
 135
 136     major = decomposeOid(minor,
 137                          GSS_EAP_MECHANISM->elements,
 138                          GSS_EAP_MECHANISM->length,
 139                          oid,
 140                          &suffix);
 141     if (major == GSS_S_COMPLETE)
 142         *enctype = suffix;
 143
 144     return major;
 145 }
 146
 147 OM_uint32
 148 gssEapEnctypeToOid(OM_uint32 *minor,
 149                    krb5_enctype enctype,
 150                    gss_OID *pOid)
 151 {
 152     OM_uint32 major;
 153     gss_OID oid;
 154
 155     *pOid = NULL;
 156
 157     oid = (gss_OID)GSSEAP_MALLOC(sizeof(*oid));
 158     if (oid == NULL) {
 159         *minor = ENOMEM;
 160         return GSS_S_FAILURE;
 161     }
 162
 163     oid->length = GSS_EAP_MECHANISM->length + 1;
 164     oid->elements = GSSEAP_MALLOC(oid->length);
 165     if (oid->elements == NULL) {
 166         *minor = ENOMEM;
 167         GSSEAP_FREE(oid);
 168         return GSS_S_FAILURE;
 169     }
 170
 171     major = composeOid(minor,
 172                        GSS_EAP_MECHANISM->elements,
 173                        GSS_EAP_MECHANISM->length,
 174                        enctype,
 175                        oid);
 176     if (major == GSS_S_COMPLETE) {
 177         internalizeOid(oid, pOid);
 178         *pOid = oid;
 179     } else {
 180         GSSEAP_FREE(oid->elements);
 181         GSSEAP_FREE(oid);
 182     }
 183
 184     return major;
 185 }
 186
 187 OM_uint32
 188 gssEapIndicateMechs(OM_uint32 *minor,
 189                     gss_OID_set *mechs)
 190 {
 191     krb5_context krbContext;
 192     OM_uint32 major;
 193     krb5_enctype *etypes;
 194     int i;
 195
 196     GSSEAP_KRB_INIT(&krbContext);
 197
 198     *minor = krb5_get_permitted_enctypes(krbContext, &etypes);
 199     if (*minor != 0) {
 200         return GSS_S_FAILURE;
 201     }
 202
 203     major = gss_create_empty_oid_set(minor, mechs);
 204     if (GSS_ERROR(major)) {
 205         GSSEAP_FREE(etypes);
 206         return major;
 207     }
 208
 209     for (i = 0; etypes[i] != ENCTYPE_NULL; i++) {
 210         gss_OID mechOid;
 211 #ifndef HAVE_HEIMDAL_VERSION
 212         OM_uint32 tmpMinor;
 213 #endif
 214
 215         /* XXX currently we aren't equipped to encode these enctypes */
 216         if (etypes[i] < 0 || etypes[i] > 127)
 217             continue;
 218
 219         major = gssEapEnctypeToOid(minor, etypes[i], &mechOid);
 220         if (GSS_ERROR(major))
 221             break;
 222
 223         major = gss_add_oid_set_member(minor, mechOid, mechs);
 224         if (GSS_ERROR(major))
 225             break;
 226
 227 #ifndef HAVE_HEIMDAL_VERSION
 228         gss_release_oid(&tmpMinor, &mechOid);
 229 #endif
 230     }
 231
 232     GSSEAP_FREE(etypes);
 233
 234     *minor = 0;
 235     return major;
 236 }
 237
 238 OM_uint32
 239 gssEapDefaultMech(OM_uint32 *minor,
 240                   gss_OID *oid)
 241 {
 242     gss_OID_set mechs;
 243     OM_uint32 major, tmpMinor;
 244
 245     major = gssEapIndicateMechs(minor, &mechs);
 246     if (GSS_ERROR(major)) {
 247         return major;
 248     }
 249
 250     if (mechs->count == 0) {
 251         gss_release_oid_set(&tmpMinor, &mechs);
 252         return GSS_S_BAD_MECH;
 253     }
 254
 255     if (!internalizeOid(&mechs->elements[0], oid)) {
 256         /* don't double-free if we didn't internalize it */
 257         mechs->elements[0].length = 0;
 258         mechs->elements[0].elements = NULL;
 259     }
 260
 261     gss_release_oid_set(&tmpMinor, &mechs);
 262
 263     *minor = 0;
 264     return GSS_S_COMPLETE;
 265 }
 266
 267 static int
 268 internalizeOid(const gss_OID oid,
 269                gss_OID *const pInternalizedOid)
 270 {
 271     int i;
 272
 273     *pInternalizedOid = GSS_C_NO_OID;
 274
 275     for (i = 0;
 276          i < sizeof(gssEapMechOids) / sizeof(gssEapMechOids[0]);
 277          i++) {
 278         if (oidEqual(oid, &gssEapMechOids[i])) {
 279             *pInternalizedOid = (const gss_OID)&gssEapMechOids[i];
 280             break;
 281         }
 282     }
 283
 284     if (*pInternalizedOid == GSS_C_NO_OID) {
 285         if (oidEqual(oid, GSS_EAP_NT_EAP_NAME))
 286             *pInternalizedOid = (const gss_OID)GSS_EAP_NT_EAP_NAME;
 287     }
 288
 289     if (*pInternalizedOid == GSS_C_NO_OID) {
 290         *pInternalizedOid = oid;
 291         return 0;
 292     }
 293
 294     return 1;
 295 }
 296
 297 OM_uint32
 298 gssEapReleaseOid(OM_uint32 *minor, gss_OID *oid)
 299 {
 300     gss_OID internalizedOid = GSS_C_NO_OID;
 301
 302     *minor = 0;
 303
 304     if (internalizeOid(*oid, &internalizedOid)) {
 305         /* OID was internalized, so we can mark it as "freed" */
 306         *oid = GSS_C_NO_OID;
 307         return GSS_S_COMPLETE;
 308     }
 309
 310     /* we don't know about this OID */
 311     return GSS_S_CONTINUE_NEEDED;
 312 }
 313
 314 OM_uint32
 315 gssEapCanonicalizeOid(OM_uint32 *minor,
 316                       const gss_OID oid,
 317                       OM_uint32 flags,
 318                       gss_OID *pOid)
 319 {
 320     OM_uint32 major;
 321     int mapToNull = 0;
 322
 323     major = GSS_S_COMPLETE;
 324     *minor = 0;
 325     *pOid = GSS_C_NULL_OID;
 326
 327     if (oid == GSS_C_NULL_OID) {
 328         if ((flags & OID_FLAG_NULL_VALID) == 0) {
 329             *minor = GSSEAP_WRONG_MECH;
 330             return GSS_S_BAD_MECH;
 331         } else if (flags & OID_FLAG_MAP_NULL_TO_DEFAULT_MECH) {
 332             return gssEapDefaultMech(minor, pOid);
 333         } else {
 334             mapToNull = 1;
 335         }
 336     } else if (oidEqual(oid, GSS_EAP_MECHANISM)) {
 337         if ((flags & OID_FLAG_FAMILY_MECH_VALID) == 0) {
 338             *minor = GSSEAP_WRONG_MECH;
 339             return GSS_S_BAD_MECH;
 340         } else if (flags & OID_FLAG_MAP_FAMILY_MECH_TO_NULL) {
 341             mapToNull = 1;
 342         }
 343     } else if (!gssEapIsConcreteMechanismOid(oid)) {
 344         *minor = GSSEAP_WRONG_MECH;
 345         return GSS_S_BAD_MECH;
 346     }
 347
 348     if (!mapToNull) {
 349         if (!internalizeOid(oid, pOid))
 350             major = duplicateOid(minor, oid, pOid);
 351     }
 352
 353     return major;
 354 }
 355
 356 static gss_buffer_desc gssEapSaslMechs[] = {
 357     { sizeof("EAP") - 1,        "EAP",       }, /* not used */
 358     { sizeof("EAP-AES128") - 1, "EAP-AES128" },
 359     { sizeof("EAP-AES256") - 1, "EAP-AES256" },
 360 };
 361
 362 gss_buffer_t
 363 gssEapOidToSaslName(const gss_OID oid)
 364 {
 365     size_t i;
 366
 367     for (i = 1; i < sizeof(gssEapMechOids)/sizeof(gssEapMechOids[0]); i++) {
 368         if (oidEqual(&gssEapMechOids[i], oid))
 369             return &gssEapSaslMechs[i];
 370     }
 371
 372     return GSS_C_NO_BUFFER;
 373 }
 374
 375 gss_OID
 376 gssEapSaslNameToOid(const gss_buffer_t name)
 377 {
 378     size_t i;
 379
 380     for (i = 1; i < sizeof(gssEapSaslMechs)/sizeof(gssEapSaslMechs[0]); i++) {
 381         if (bufferEqual(&gssEapSaslMechs[i], name))
 382             return &gssEapMechOids[i];
 383     }
 384
 385     return GSS_C_NO_OID;
 386 }