1 /* $NetBSD: gssapi.h,v 1.1.1.1 2018/08/12 12:08:20 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * This Source Code Form is subject to the terms of the Mozilla Public 7 * License, v. 2.0. If a copy of the MPL was not distributed with this 8 * file, You can obtain one at http://mozilla.org/MPL/2.0/. 9 * 10 * See the COPYRIGHT file distributed with this work for additional 11 * information regarding copyright ownership. 12 */ 13 14 15 #ifndef DST_GSSAPI_H 16 #define DST_GSSAPI_H 1 17 18 /*! \file dst/gssapi.h */ 19 20 #include <isc/formatcheck.h> 21 #include <isc/lang.h> 22 #include <isc/platform.h> 23 #include <isc/types.h> 24 #include <dns/types.h> 25 26 #ifdef GSSAPI 27 #ifdef WIN32 28 /* 29 * MSVC does not like macros in #include lines. 30 */ 31 #include <gssapi/gssapi.h> 32 #include <gssapi/gssapi_krb5.h> 33 #else 34 #include ISC_PLATFORM_GSSAPIHEADER 35 #ifdef ISC_PLATFORM_GSSAPI_KRB5_HEADER 36 #include ISC_PLATFORM_GSSAPI_KRB5_HEADER 37 #endif 38 #endif 39 #ifndef GSS_SPNEGO_MECHANISM 40 #define GSS_SPNEGO_MECHANISM ((void*)0) 41 #endif 42 #endif 43 44 ISC_LANG_BEGINDECLS 45 46 /*** 47 *** Types 48 ***/ 49 50 /*** 51 *** Functions 52 ***/ 53 54 isc_result_t 55 dst_gssapi_acquirecred(const dns_name_t *name, isc_boolean_t initiate, 56 gss_cred_id_t *cred); 57 /* 58 * Acquires GSS credentials. 59 * 60 * Requires: 61 * 'name' is a valid name, preferably one known by the GSS provider 62 * 'initiate' indicates whether the credentials are for initiating or 63 * accepting contexts 64 * 'cred' is a pointer to NULL, which will be allocated with the 65 * credential handle. Call dst_gssapi_releasecred to free 66 * the memory. 67 * 68 * Returns: 69 * ISC_R_SUCCESS msg was successfully updated to include the 70 * query to be sent 71 * other an error occurred while building the message 72 */ 73 74 isc_result_t 75 dst_gssapi_releasecred(gss_cred_id_t *cred); 76 /* 77 * Releases GSS credentials. Calling this function does release the 78 * memory allocated for the credential in dst_gssapi_acquirecred() 79 * 80 * Requires: 81 * 'mctx' is a valid memory context 82 * 'cred' is a pointer to the credential to be released 83 * 84 * Returns: 85 * ISC_R_SUCCESS credential was released successfully 86 * other an error occurred while releaseing 87 * the credential 88 */ 89 90 isc_result_t 91 dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken, 92 isc_buffer_t *outtoken, gss_ctx_id_t *gssctx, 93 isc_mem_t *mctx, char **err_message); 94 /* 95 * Initiates a GSS context. 96 * 97 * Requires: 98 * 'name' is a valid name, preferably one known by the GSS 99 * provider 100 * 'intoken' is a token received from the acceptor, or NULL if 101 * there isn't one 102 * 'outtoken' is a buffer to receive the token generated by 103 * gss_init_sec_context() to be sent to the acceptor 104 * 'context' is a pointer to a valid gss_ctx_id_t 105 * (which may have the value GSS_C_NO_CONTEXT) 106 * 107 * Returns: 108 * ISC_R_SUCCESS msg was successfully updated to include the 109 * query to be sent 110 * other an error occurred while building the message 111 * *err_message optional error message 112 */ 113 114 isc_result_t 115 dst_gssapi_acceptctx(gss_cred_id_t cred, 116 const char *gssapi_keytab, 117 isc_region_t *intoken, isc_buffer_t **outtoken, 118 gss_ctx_id_t *context, dns_name_t *principal, 119 isc_mem_t *mctx); 120 /* 121 * Accepts a GSS context. 122 * 123 * Requires: 124 * 'mctx' is a valid memory context 125 * 'cred' is the acceptor's valid GSS credential handle 126 * 'intoken' is a token received from the initiator 127 * 'outtoken' is a pointer a buffer pointer used to return the token 128 * generated by gss_accept_sec_context() to be sent to the 129 * initiator 130 * 'context' is a valid pointer to receive the generated context handle. 131 * On the initial call, it should be a pointer to NULL, which 132 * will be allocated as a gss_ctx_id_t. Subsequent calls 133 * should pass in the handle generated on the first call. 134 * Call dst_gssapi_releasecred to delete the context and free 135 * the memory. 136 * 137 * Requires: 138 * 'outtoken' to != NULL && *outtoken == NULL. 139 * 140 * Returns: 141 * ISC_R_SUCCESS msg was successfully updated to include the 142 * query to be sent 143 * DNS_R_CONTINUE transaction still in progress 144 * other an error occurred while building the message 145 */ 146 147 isc_result_t 148 dst_gssapi_deletectx(isc_mem_t *mctx, gss_ctx_id_t *gssctx); 149 /* 150 * Destroys a GSS context. This function deletes the context from the GSS 151 * provider and then frees the memory used by the context pointer. 152 * 153 * Requires: 154 * 'mctx' is a valid memory context 155 * 'context' is a valid GSS context 156 * 157 * Returns: 158 * ISC_R_SUCCESS 159 */ 160 161 162 void 163 gss_log(int level, const char *fmt, ...) 164 ISC_FORMAT_PRINTF(2, 3); 165 /* 166 * Logging function for GSS. 167 * 168 * Requires 169 * 'level' is the log level to be used, as an integer 170 * 'fmt' is a printf format specifier 171 */ 172 173 char * 174 gss_error_tostring(isc_uint32_t major, isc_uint32_t minor, 175 char *buf, size_t buflen); 176 /* 177 * Render a GSS major status/minor status pair into a string 178 * 179 * Requires: 180 * 'major' is a GSS major status code 181 * 'minor' is a GSS minor status code 182 * 183 * Returns: 184 * A string containing the text representation of the error codes. 185 * Users should copy the string if they wish to keep it. 186 */ 187 188 isc_boolean_t 189 dst_gssapi_identitymatchesrealmkrb5(const dns_name_t *signer, 190 const dns_name_t *name, 191 const dns_name_t *realm); 192 /* 193 * Compare a "signer" (in the format of a Kerberos-format Kerberos5 194 * principal: host/example.com@EXAMPLE.COM) to the realm name stored 195 * in "name" (which represents the realm name). 196 * 197 */ 198 199 isc_boolean_t 200 dst_gssapi_identitymatchesrealmms(const dns_name_t *signer, 201 const dns_name_t *name, 202 const dns_name_t *realm); 203 /* 204 * Compare a "signer" (in the format of a Kerberos-format Kerberos5 205 * principal: host/example.com@EXAMPLE.COM) to the realm name stored 206 * in "name" (which represents the realm name). 207 * 208 */ 209 210 ISC_LANG_ENDDECLS 211 212 #endif /* DST_GSSAPI_H */ 213