| | 1 | /* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */ |
| | 2 | /* |
| | 3 | * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. |
| | 4 | * |
| | 5 | * Redistribution and use in source and binary forms, with or without |
| | 6 | * modification, are permitted provided that the following conditions |
| | 7 | * are met: |
| | 8 | * 1. Redistributions of source code must retain the above copyright |
| | 9 | * notice, this list of conditions and the following disclaimer. |
| | 10 | * 2. Redistributions in binary form must reproduce the above copyright |
| | 11 | * notice, this list of conditions and the following disclaimer in the |
| | 12 | * documentation and/or other materials provided with the distribution. |
| | 13 | * |
| | 14 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR |
| | 15 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
| | 16 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
| | 17 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
| | 18 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| | 19 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| | 20 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| | 21 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| | 22 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| | 23 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| | 24 | */ |
| | 25 | |
| | 26 | #ifndef _SSH_GSS_H |
| | 27 | #define _SSH_GSS_H |
| | 28 | |
| | 29 | #ifdef GSSAPI |
| | 30 | |
| | 31 | #ifdef HAVE_GSSAPI_H |
| | 32 | #include <gssapi.h> |
| | 33 | #elif defined(HAVE_GSSAPI_GSSAPI_H) |
| | 34 | #include <gssapi/gssapi.h> |
| | 35 | #endif |
| | 36 | |
| | 37 | #ifndef MECHGLUE |
| | 38 | #ifdef KRB5 |
| | 39 | # ifndef HEIMDAL |
| | 40 | # ifdef HAVE_GSSAPI_GENERIC_H |
| | 41 | # include <gssapi_generic.h> |
| | 42 | # elif defined(HAVE_GSSAPI_GSSAPI_GENERIC_H) |
| | 43 | # include <gssapi/gssapi_generic.h> |
| | 44 | # endif |
| | 45 | |
| | 46 | /* MIT Kerberos doesn't seem to define GSS_NT_HOSTBASED_SERVICE */ |
| | 47 | |
| | 48 | #ifndef GSS_C_NT_HOSTBASED_SERVICE |
| | 49 | #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name |
| | 50 | #endif /* GSS_C_NT_... */ |
| | 51 | #endif /* !HEIMDAL */ |
| | 52 | #endif /* KRB5 */ |
| | 53 | #endif /* !MECHGLUE */ |
| | 54 | |
| | 55 | /* draft-ietf-secsh-gsskeyex-06 */ |
| | 56 | #define SSH2_MSG_USERAUTH_GSSAPI_RESPONSE 60 |
| | 57 | #define SSH2_MSG_USERAUTH_GSSAPI_TOKEN 61 |
| | 58 | #define SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE 63 |
| | 59 | #define SSH2_MSG_USERAUTH_GSSAPI_ERROR 64 |
| | 60 | #define SSH2_MSG_USERAUTH_GSSAPI_ERRTOK 65 |
| | 61 | #define SSH2_MSG_USERAUTH_GSSAPI_MIC 66 |
| | 62 | |
| | 63 | #define SSH_GSS_OIDTYPE 0x06 |
| | 64 | |
| | 65 | #define SSH2_MSG_KEXGSS_INIT 30 |
| | 66 | #define SSH2_MSG_KEXGSS_CONTINUE 31 |
| | 67 | #define SSH2_MSG_KEXGSS_COMPLETE 32 |
| | 68 | #define SSH2_MSG_KEXGSS_HOSTKEY 33 |
| | 69 | #define SSH2_MSG_KEXGSS_ERROR 34 |
| | 70 | #define SSH2_MSG_KEXGSS_GROUPREQ 40 |
| | 71 | #define SSH2_MSG_KEXGSS_GROUP 41 |
| | 72 | #define KEX_GSS_GRP1_SHA1_ID "gss-group1-sha1-" |
| | 73 | #define KEX_GSS_GRP14_SHA1_ID "gss-group14-sha1-" |
| | 74 | #define KEX_GSS_GEX_SHA1_ID "gss-gex-sha1-" |
| | 75 | |
| | 76 | typedef struct { |
| | 77 | char *filename; |
| | 78 | char *envvar; |
| | 79 | char *envval; |
| | 80 | struct passwd *owner; |
| | 81 | void *data; |
| | 82 | } ssh_gssapi_ccache; |
| | 83 | |
| | 84 | typedef struct { |
| | 85 | gss_buffer_desc displayname; |
| | 86 | gss_buffer_desc exportedname; |
| | 87 | gss_cred_id_t creds; |
| | 88 | gss_name_t name; |
| | 89 | struct ssh_gssapi_mech_struct *mech; |
| | 90 | ssh_gssapi_ccache store; |
| | 91 | gss_ctx_id_t context; |
| | 92 | int used; |
| | 93 | int updated; |
| | 94 | } ssh_gssapi_client; |
| | 95 | |
| | 96 | typedef struct ssh_gssapi_mech_struct { |
| | 97 | char *enc_name; |
| | 98 | char *name; |
| | 99 | gss_OID_desc oid; |
| | 100 | int (*dochild) (ssh_gssapi_client *); |
| | 101 | int (*userok) (ssh_gssapi_client *, char *); |
| | 102 | int (*localname) (ssh_gssapi_client *, char **); |
| | 103 | void (*storecreds) (ssh_gssapi_client *); |
| | 104 | int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *); |
| | 105 | } ssh_gssapi_mech; |
| | 106 | |
| | 107 | typedef struct { |
| | 108 | OM_uint32 major; /* both */ |
| | 109 | OM_uint32 minor; /* both */ |
| | 110 | gss_ctx_id_t context; /* both */ |
| | 111 | gss_name_t name; /* both */ |
| | 112 | gss_OID oid; /* both */ |
| | 113 | gss_cred_id_t creds; /* server */ |
| | 114 | gss_name_t client; /* server */ |
| | 115 | gss_cred_id_t client_creds; /* both */ |
| | 116 | } Gssctxt; |
| | 117 | |
| | 118 | extern ssh_gssapi_mech *supported_mechs[]; |
| | 119 | extern Gssctxt *gss_kex_context; |
| | 120 | |
| | 121 | int ssh_gssapi_check_oid(Gssctxt *, void *, size_t); |
| | 122 | void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t); |
| | 123 | void ssh_gssapi_set_oid(Gssctxt *, gss_OID); |
| | 124 | void ssh_gssapi_supported_oids(gss_OID_set *); |
| | 125 | ssh_gssapi_mech *ssh_gssapi_get_ctype(Gssctxt *); |
| | 126 | |
| | 127 | OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *); |
| | 128 | OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int, |
| | 129 | gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *); |
| | 130 | OM_uint32 ssh_gssapi_accept_ctx(Gssctxt *, |
| | 131 | gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *); |
| | 132 | OM_uint32 ssh_gssapi_getclient(Gssctxt *, ssh_gssapi_client *); |
| | 133 | void ssh_gssapi_error(Gssctxt *); |
| | 134 | char *ssh_gssapi_last_error(Gssctxt *, OM_uint32 *, OM_uint32 *); |
| | 135 | void ssh_gssapi_build_ctx(Gssctxt **); |
| | 136 | void ssh_gssapi_delete_ctx(Gssctxt **); |
| | 137 | OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t); |
| | 138 | void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *); |
| | 139 | int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *, const char *); |
| | 140 | OM_uint32 ssh_gssapi_client_identity(Gssctxt *, const char *); |
| | 141 | int ssh_gssapi_credentials_updated(Gssctxt *); |
| | 142 | |
| | 143 | int ssh_gssapi_localname(char **name); |
| | 144 | void ssh_gssapi_rekey_creds(); |
| | 145 | |
| | 146 | /* In the server */ |
| | 147 | typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *, |
| | 148 | const char *); |
| | 149 | char *ssh_gssapi_client_mechanisms(const char *, const char *); |
| | 150 | char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *, |
| | 151 | const char *); |
| | 152 | gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int); |
| | 153 | int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *, |
| | 154 | const char *); |
| | 155 | OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID); |
| | 156 | int ssh_gssapi_userok(char *name, struct passwd *); |
| | 157 | OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t); |
| | 158 | void ssh_gssapi_do_child(char ***, u_int *); |
| | 159 | void ssh_gssapi_cleanup_creds(void); |
| | 160 | void ssh_gssapi_storecreds(void); |
| | 161 | |
| | 162 | #ifdef MECHGLUE |
| | 163 | gss_cred_id_t __gss_get_mechanism_cred |
| | 164 | (gss_cred_id_t, /* union_cred */ |
| | 165 | gss_OID /* mech_type */ |
| | 166 | ); |
| | 167 | #endif |
| | 168 | |
| | 169 | char *ssh_gssapi_server_mechanisms(void); |
| | 170 | int ssh_gssapi_oid_table_ok(); |
| | 171 | |
| | 172 | int ssh_gssapi_update_creds(ssh_gssapi_ccache *store); |
| | 173 | #endif /* GSSAPI */ |
| | 174 | |
| | 175 | #endif /* _SSH_GSS_H */ |
andersk / gssapi-openssh.git / blame_incremental