util_attr.h

   1 /*
   2  * Copyright (c) 2010, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 #ifndef _UTIL_ATTR_H_
  34 #define _UTIL_ATTR_H_ 1
  35
  36 #ifdef __cplusplus
  37 #include <string>
  38
  39 struct gss_eap_attr_provider;
  40 struct gss_eap_attr_ctx;
  41
  42 typedef bool
  43 (*gss_eap_attr_enumeration_cb)(const gss_eap_attr_provider *source,
  44                                const gss_buffer_t attribute,
  45                                void *data);
  46
  47 #define ATTR_TYPE_RADIUS            0U                  /* RADIUS AVPs */
  48 #define ATTR_TYPE_SAML_ASSERTION    1U                  /* SAML assertion */
  49 #define ATTR_TYPE_SAML              2U                  /* SAML attributes */
  50 #define ATTR_TYPE_LOCAL             3U                  /* Local attributes */
  51 #define ATTR_TYPE_MIN               ATTR_TYPE_RADIUS
  52 #define ATTR_TYPE_MAX               ATTR_TYPE_LOCAL
  53
  54 #define ATTR_FLAG_DISABLE_LOCAL     0x00000001
  55
  56 /*
  57  * Attribute provider: this represents a source of attributes derived
  58  * from the security context.
  59  */
  60 struct gss_eap_attr_provider
  61 {
  62 public:
  63     gss_eap_attr_provider(void) {}
  64     virtual ~gss_eap_attr_provider(void) {}
  65
  66     bool initWithManager(const gss_eap_attr_ctx *manager)
  67     {
  68         m_manager = manager;
  69         return true;
  70     }
  71
  72     virtual bool initFromExistingContext(const gss_eap_attr_ctx *manager,
  73                                          const gss_eap_attr_provider *ctx)
  74     {
  75         return initWithManager(manager);
  76     }
  77
  78     virtual bool initFromGssContext(const gss_eap_attr_ctx *manager,
  79                                     const gss_cred_id_t cred,
  80                                     const gss_ctx_id_t ctx)
  81     {
  82         return initWithManager(manager);
  83     }
  84
  85     virtual bool getAttributeTypes(gss_eap_attr_enumeration_cb, void *data) const
  86     {
  87         return false;
  88     }
  89
  90     virtual void setAttribute(int complete,
  91                               const gss_buffer_t attr,
  92                               const gss_buffer_t value) {}
  93     virtual void deleteAttribute(const gss_buffer_t value) {}
  94     virtual bool getAttribute(const gss_buffer_t attr,
  95                               int *authenticated,
  96                               int *complete,
  97                               gss_buffer_t value,
  98                               gss_buffer_t display_value,
  99                               int *more) const { return false; }
 100
 101     virtual gss_any_t mapToAny(int authenticated,
 102                                gss_buffer_t type_id) const { return NULL; }
 103     virtual void releaseAnyNameMapping(gss_buffer_t type_id,
 104                                        gss_any_t input) const {}
 105
 106     virtual void exportToBuffer(gss_buffer_t buffer) const {}
 107     virtual bool initFromBuffer(const gss_eap_attr_ctx *manager,
 108                                 const gss_buffer_t buffer)
 109     {
 110         return initWithManager(manager);
 111     }
 112
 113     virtual time_t getExpiryTime(void) const { return 0; }
 114
 115     static bool init(void) { return true; }
 116     static void finalize(void) {}
 117
 118     static gss_eap_attr_provider *createAttrContext(void) { return NULL; }
 119
 120 protected:
 121     const gss_eap_attr_ctx *m_manager;
 122
 123 private:
 124     /* make non-copyable */
 125     gss_eap_attr_provider(const gss_eap_attr_provider&);
 126     gss_eap_attr_provider& operator=(const gss_eap_attr_provider&);
 127 };
 128
 129 typedef gss_eap_attr_provider *(*gss_eap_attr_create_provider)(void);
 130
 131 /*
 132  * Attribute context: this manages a set of providers for a given
 133  * security context.
 134  */
 135 struct gss_eap_attr_ctx
 136 {
 137 public:
 138     gss_eap_attr_ctx(void);
 139     ~gss_eap_attr_ctx(void);
 140
 141     bool initFromExistingContext(const gss_eap_attr_ctx *manager);
 142     bool initFromGssContext(const gss_cred_id_t cred,
 143                             const gss_ctx_id_t ctx);
 144
 145     bool getAttributeTypes(gss_eap_attr_enumeration_cb, void *data) const;
 146     bool getAttributeTypes(gss_buffer_set_t *attrs);
 147
 148     void setAttribute(int complete,
 149                       const gss_buffer_t attr,
 150                       const gss_buffer_t value);
 151     void deleteAttribute(const gss_buffer_t value);
 152     bool getAttribute(const gss_buffer_t attr,
 153                       int *authenticated,
 154                       int *complete,
 155                       gss_buffer_t value,
 156                       gss_buffer_t display_value,
 157                       int *more) const;
 158     gss_any_t mapToAny(int authenticated,
 159                        gss_buffer_t type_id) const;
 160     void releaseAnyNameMapping(gss_buffer_t type_id,
 161                                gss_any_t input) const;
 162
 163     void exportToBuffer(gss_buffer_t buffer) const;
 164     bool initFromBuffer(const gss_buffer_t buffer);
 165
 166     static unsigned int
 167     attributePrefixToType(const gss_buffer_t prefix);
 168
 169     static const gss_buffer_t
 170     attributeTypeToPrefix(unsigned int type);
 171
 172     static void
 173     decomposeAttributeName(const gss_buffer_t attribute,
 174                            gss_buffer_t prefix,
 175                            gss_buffer_t suffix);
 176     static void
 177     composeAttributeName(const gss_buffer_t prefix,
 178                          const gss_buffer_t suffix,
 179                          gss_buffer_t attribute);
 180     static void
 181     decomposeAttributeName(const gss_buffer_t attribute,
 182                            unsigned int *type,
 183                            gss_buffer_t suffix);
 184     static void
 185     composeAttributeName(unsigned int type,
 186                          const gss_buffer_t suffix,
 187                          gss_buffer_t attribute);
 188
 189     static std::string
 190     composeAttributeName(const gss_buffer_t prefix,
 191                          const gss_buffer_t suffix);
 192     static std::string
 193     composeAttributeName(unsigned int type,
 194                          const gss_buffer_t suffix);
 195
 196     gss_eap_attr_provider *getProvider(unsigned int type) const;
 197     gss_eap_attr_provider *getProvider(const gss_buffer_t prefix) const;
 198
 199     static void
 200     registerProvider(unsigned int type,
 201                      const char *prefix,
 202                      gss_eap_attr_create_provider factory);
 203     static void
 204     unregisterProvider(unsigned int type);
 205
 206     time_t getExpiryTime(void) const;
 207
 208 private:
 209     bool providerEnabled(unsigned int type) const;
 210     void releaseProvider(unsigned int type);
 211
 212     gss_eap_attr_provider *getPrimaryProvider(void) const;
 213
 214     /* make non-copyable */
 215     gss_eap_attr_ctx(const gss_eap_attr_ctx&);
 216     gss_eap_attr_ctx& operator=(const gss_eap_attr_ctx&);
 217
 218     uint32_t m_flags;
 219     gss_eap_attr_provider *m_providers[ATTR_TYPE_MAX + 1];
 220 };
 221
 222 #endif /* __cplusplus */
 223
 224 #include "util_radius.h"
 225 #include "util_saml.h"
 226 #include "util_shib.h"
 227
 228 #ifdef __cplusplus
 229
 230 #include <string>
 231 #include <new>
 232
 233 static inline void
 234 duplicateBuffer(gss_buffer_desc &src, gss_buffer_t dst)
 235 {
 236     OM_uint32 minor;
 237
 238     if (GSS_ERROR(duplicateBuffer(&minor, &src, dst)))
 239         throw new std::bad_alloc();
 240 }
 241
 242 static inline void
 243 duplicateBuffer(std::string &str, gss_buffer_t buffer)
 244 {
 245     gss_buffer_desc tmp;
 246
 247     tmp.length = str.length();
 248     tmp.value = (char *)str.c_str();
 249
 250     duplicateBuffer(tmp, buffer);
 251 }
 252
 253 #else
 254 struct gss_eap_attr_ctx;
 255 #endif
 256
 257 #ifdef __cplusplus
 258 extern "C" {
 259 #endif
 260
 261 /*
 262  * C wrappers for attribute context functions. These match their
 263  * GSS naming extension equivalents. The caller is required to
 264  * obtain the name mutex.
 265  */
 266
 267 struct gss_eap_attr_ctx *
 268 gssEapCreateAttrContext(gss_cred_id_t acceptorCred,
 269                         gss_ctx_id_t acceptorCtx);
 270
 271 OM_uint32
 272 gssEapInquireName(OM_uint32 *minor,
 273                   gss_name_t name,
 274                   int *name_is_MN,
 275                   gss_OID *MN_mech,
 276                   gss_buffer_set_t *attrs);
 277
 278 OM_uint32
 279 gssEapGetNameAttribute(OM_uint32 *minor,
 280                        gss_name_t name,
 281                        gss_buffer_t attr,
 282                        int *authenticated,
 283                        int *complete,
 284                        gss_buffer_t value,
 285                        gss_buffer_t display_value,
 286                        int *more);
 287
 288 OM_uint32
 289 gssEapDeleteNameAttribute(OM_uint32 *minor,
 290                           gss_name_t name,
 291                           gss_buffer_t attr);
 292
 293 OM_uint32
 294 gssEapSetNameAttribute(OM_uint32 *minor,
 295                        gss_name_t name,
 296                        int complete,
 297                        gss_buffer_t attr,
 298                        gss_buffer_t value);
 299
 300 OM_uint32
 301 gssEapExportAttrContext(OM_uint32 *minor,
 302                         gss_name_t name,
 303                         gss_buffer_t buffer);
 304
 305 OM_uint32
 306 gssEapImportAttrContext(OM_uint32 *minor,
 307                         gss_buffer_t buffer,
 308                         gss_name_t name);
 309
 310 OM_uint32
 311 gssEapDuplicateAttrContext(OM_uint32 *minor,
 312                            gss_name_t in,
 313                            gss_name_t out);
 314
 315 OM_uint32
 316 gssEapMapNameToAny(OM_uint32 *minor,
 317                    gss_name_t name,
 318                    int authenticated,
 319                    gss_buffer_t type_id,
 320                    gss_any_t *output);
 321
 322 OM_uint32
 323 gssEapReleaseAnyNameMapping(OM_uint32 *minor,
 324                             gss_name_t name,
 325                             gss_buffer_t type_id,
 326                             gss_any_t *input);
 327
 328 OM_uint32
 329 gssEapReleaseAttrContext(OM_uint32 *minor,
 330                          gss_name_t name);
 331
 332 OM_uint32
 333 gssEapAttrProvidersFinalize(OM_uint32 *minor);
 334
 335 #ifdef __cplusplus
 336 }
 337 #endif
 338
 339 #endif /* _UTIL_ATTR_H_ */