1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * CDDL HEADER START
3*0Sstevel@tonic-gate *
4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*0Sstevel@tonic-gate * with the License.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*0Sstevel@tonic-gate * See the License for the specific language governing permissions
12*0Sstevel@tonic-gate * and limitations under the License.
13*0Sstevel@tonic-gate *
14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*0Sstevel@tonic-gate *
20*0Sstevel@tonic-gate * CDDL HEADER END
21*0Sstevel@tonic-gate */
22*0Sstevel@tonic-gate /*
23*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved.
24*0Sstevel@tonic-gate * Use is subject to license terms.
25*0Sstevel@tonic-gate */
26*0Sstevel@tonic-gate
27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
28*0Sstevel@tonic-gate
29*0Sstevel@tonic-gate /*
30*0Sstevel@tonic-gate *
31*0Sstevel@tonic-gate * gsscred utility
32*0Sstevel@tonic-gate * Manages mapping between a security principal name and unix uid
33*0Sstevel@tonic-gate */
34*0Sstevel@tonic-gate
35*0Sstevel@tonic-gate #include <stdio.h>
36*0Sstevel@tonic-gate #include <stdlib.h>
37*0Sstevel@tonic-gate #include <string.h>
38*0Sstevel@tonic-gate #include <errno.h>
39*0Sstevel@tonic-gate #include <ctype.h>
40*0Sstevel@tonic-gate #include "gsscred.h"
41*0Sstevel@tonic-gate
42*0Sstevel@tonic-gate /* From g_glue.c */
43*0Sstevel@tonic-gate
44*0Sstevel@tonic-gate extern int
45*0Sstevel@tonic-gate get_der_length(unsigned char **, unsigned int, unsigned int *);
46*0Sstevel@tonic-gate
47*0Sstevel@tonic-gate extern unsigned int
48*0Sstevel@tonic-gate der_length_size(unsigned int);
49*0Sstevel@tonic-gate
50*0Sstevel@tonic-gate extern int
51*0Sstevel@tonic-gate put_der_length(unsigned int, unsigned char **, unsigned int);
52*0Sstevel@tonic-gate
53*0Sstevel@tonic-gate
54*0Sstevel@tonic-gate
55*0Sstevel@tonic-gate /*
56*0Sstevel@tonic-gate * GSS export name constants
57*0Sstevel@tonic-gate */
58*0Sstevel@tonic-gate static const char *expNameTokId = "\x04\x01";
59*0Sstevel@tonic-gate static const int expNameTokIdLen = 2;
60*0Sstevel@tonic-gate static const int mechOidLenLen = 2;
61*0Sstevel@tonic-gate static const int mechOidTagLen = 1;
62*0Sstevel@tonic-gate
63*0Sstevel@tonic-gate
64*0Sstevel@tonic-gate /*
65*0Sstevel@tonic-gate * Internal utility routines.
66*0Sstevel@tonic-gate */
67*0Sstevel@tonic-gate
68*0Sstevel@tonic-gate /*
69*0Sstevel@tonic-gate * gsscred_read_config_file
70*0Sstevel@tonic-gate *
71*0Sstevel@tonic-gate * function to read the optional gsscred configuration file
72*0Sstevel@tonic-gate * which specifies which backend to use to store the gsscred
73*0Sstevel@tonic-gate * table.
74*0Sstevel@tonic-gate *
75*0Sstevel@tonic-gate * we now only support flat files (btw, this file for backend is Obsoleted
76*0Sstevel@tonic-gate * by PSARC)
77*0Sstevel@tonic-gate */
78*0Sstevel@tonic-gate int
gsscred_read_config_file(void)79*0Sstevel@tonic-gate gsscred_read_config_file(void)
80*0Sstevel@tonic-gate {
81*0Sstevel@tonic-gate return (GSSCRED_FLAT_FILE);
82*0Sstevel@tonic-gate } /* gsscred_read_config_file */
83*0Sstevel@tonic-gate
84*0Sstevel@tonic-gate
85*0Sstevel@tonic-gate /*
86*0Sstevel@tonic-gate * gsscred_MakeName
87*0Sstevel@tonic-gate *
88*0Sstevel@tonic-gate * construct a principal name in the GSS_C_NT_EXPORT_NAME format.
89*0Sstevel@tonic-gate */
gsscred_MakeName(const gss_OID mechOid,const char * name,const char * nameOidStr,gss_buffer_t nameOut)90*0Sstevel@tonic-gate int gsscred_MakeName(const gss_OID mechOid, const char *name,
91*0Sstevel@tonic-gate const char *nameOidStr, gss_buffer_t nameOut)
92*0Sstevel@tonic-gate {
93*0Sstevel@tonic-gate gss_OID nameOid;
94*0Sstevel@tonic-gate gss_name_t intName;
95*0Sstevel@tonic-gate OM_uint32 minor, major;
96*0Sstevel@tonic-gate gss_buffer_desc aName = GSS_C_EMPTY_BUFFER, oidStr;
97*0Sstevel@tonic-gate
98*0Sstevel@tonic-gate nameOut->length = 0;
99*0Sstevel@tonic-gate nameOut->value = NULL;
100*0Sstevel@tonic-gate
101*0Sstevel@tonic-gate /* we need to import the name, then canonicalize it, then export it */
102*0Sstevel@tonic-gate if (nameOidStr == NULL)
103*0Sstevel@tonic-gate nameOid = (gss_OID)GSS_C_NT_USER_NAME;
104*0Sstevel@tonic-gate else {
105*0Sstevel@tonic-gate oidStr.length = strlen(nameOidStr);
106*0Sstevel@tonic-gate oidStr.value = (void *)nameOidStr;
107*0Sstevel@tonic-gate if (gss_str_to_oid(&minor, &oidStr, &nameOid) !=
108*0Sstevel@tonic-gate GSS_S_COMPLETE) {
109*0Sstevel@tonic-gate (void) fprintf(stderr,
110*0Sstevel@tonic-gate gettext("\nInvalid name oid supplied [%s].\n"),
111*0Sstevel@tonic-gate nameOidStr);
112*0Sstevel@tonic-gate return (0);
113*0Sstevel@tonic-gate }
114*0Sstevel@tonic-gate }
115*0Sstevel@tonic-gate
116*0Sstevel@tonic-gate /* first import the name */
117*0Sstevel@tonic-gate aName.length = strlen(name);
118*0Sstevel@tonic-gate aName.value = (void*)name;
119*0Sstevel@tonic-gate major = gss_import_name(&minor, &aName, nameOid, &intName);
120*0Sstevel@tonic-gate if (nameOidStr != NULL) {
121*0Sstevel@tonic-gate free(nameOid->elements);
122*0Sstevel@tonic-gate free(nameOid);
123*0Sstevel@tonic-gate }
124*0Sstevel@tonic-gate
125*0Sstevel@tonic-gate if (major != GSS_S_COMPLETE) {
126*0Sstevel@tonic-gate (void) fprintf(stderr,
127*0Sstevel@tonic-gate gettext("\nInternal error importing name [%s].\n"),
128*0Sstevel@tonic-gate name);
129*0Sstevel@tonic-gate return (0);
130*0Sstevel@tonic-gate }
131*0Sstevel@tonic-gate
132*0Sstevel@tonic-gate /* now canonicalize the name */
133*0Sstevel@tonic-gate if (gss_canonicalize_name(&minor, intName, mechOid, NULL)
134*0Sstevel@tonic-gate != GSS_S_COMPLETE) {
135*0Sstevel@tonic-gate (void) fprintf(stderr,
136*0Sstevel@tonic-gate gettext("\nInternal error canonicalizing name"
137*0Sstevel@tonic-gate " [%s].\n"),
138*0Sstevel@tonic-gate name);
139*0Sstevel@tonic-gate (void) gss_release_name(&minor, &intName);
140*0Sstevel@tonic-gate return (0);
141*0Sstevel@tonic-gate }
142*0Sstevel@tonic-gate
143*0Sstevel@tonic-gate /* now convert to export format */
144*0Sstevel@tonic-gate if (gss_export_name(&minor, intName, nameOut) != GSS_S_COMPLETE) {
145*0Sstevel@tonic-gate (void) fprintf(stderr,
146*0Sstevel@tonic-gate gettext("\nInternal error exporting name [%s].\n"),
147*0Sstevel@tonic-gate name);
148*0Sstevel@tonic-gate (void) gss_release_name(&minor, &intName);
149*0Sstevel@tonic-gate return (0);
150*0Sstevel@tonic-gate }
151*0Sstevel@tonic-gate
152*0Sstevel@tonic-gate (void) gss_release_name(&minor, &intName);
153*0Sstevel@tonic-gate return (1);
154*0Sstevel@tonic-gate } /* ******* makeName ****** */
155*0Sstevel@tonic-gate
156*0Sstevel@tonic-gate
157*0Sstevel@tonic-gate /*
158*0Sstevel@tonic-gate * Constructs a part of the GSS_NT_EXPORT_NAME
159*0Sstevel@tonic-gate * Only the mechanism independent name part is created.
160*0Sstevel@tonic-gate */
161*0Sstevel@tonic-gate int
gsscred_MakeNameHeader(const gss_OID mechOid,gss_buffer_t outNameHdr)162*0Sstevel@tonic-gate gsscred_MakeNameHeader(const gss_OID mechOid, gss_buffer_t outNameHdr)
163*0Sstevel@tonic-gate {
164*0Sstevel@tonic-gate unsigned char *buf = NULL;
165*0Sstevel@tonic-gate int mechOidDERLength, mechOidLength;
166*0Sstevel@tonic-gate
167*0Sstevel@tonic-gate /* determine the length of buffer needed */
168*0Sstevel@tonic-gate mechOidDERLength = der_length_size(mechOid->length);
169*0Sstevel@tonic-gate outNameHdr->length = mechOidLenLen + mechOidTagLen +
170*0Sstevel@tonic-gate mechOidDERLength + expNameTokIdLen + mechOid->length;
171*0Sstevel@tonic-gate if ((outNameHdr->value = (void*)malloc(outNameHdr->length)) == NULL) {
172*0Sstevel@tonic-gate outNameHdr->length = 0;
173*0Sstevel@tonic-gate return (0);
174*0Sstevel@tonic-gate }
175*0Sstevel@tonic-gate
176*0Sstevel@tonic-gate /* start by putting the token id */
177*0Sstevel@tonic-gate buf = (unsigned char *) outNameHdr->value;
178*0Sstevel@tonic-gate (void) memset(outNameHdr->value, '\0', outNameHdr->length);
179*0Sstevel@tonic-gate (void) memcpy(buf, expNameTokId, expNameTokIdLen);
180*0Sstevel@tonic-gate buf += expNameTokIdLen;
181*0Sstevel@tonic-gate
182*0Sstevel@tonic-gate /*
183*0Sstevel@tonic-gate * next 2 bytes contain the mech oid length (includes
184*0Sstevel@tonic-gate * DER encoding)
185*0Sstevel@tonic-gate */
186*0Sstevel@tonic-gate mechOidLength = mechOidTagLen + mechOidDERLength +
187*0Sstevel@tonic-gate mechOid->length;
188*0Sstevel@tonic-gate
189*0Sstevel@tonic-gate *buf++ = (mechOidLength & 0xFF00) >> 8;
190*0Sstevel@tonic-gate *buf++ = (mechOidLength & 0x00FF);
191*0Sstevel@tonic-gate *buf++ = 0x06;
192*0Sstevel@tonic-gate if (put_der_length(mechOid->length, &buf,
193*0Sstevel@tonic-gate mechOidDERLength) != 0) {
194*0Sstevel@tonic-gate /* free the buffer */
195*0Sstevel@tonic-gate free(outNameHdr->value);
196*0Sstevel@tonic-gate return (0);
197*0Sstevel@tonic-gate }
198*0Sstevel@tonic-gate
199*0Sstevel@tonic-gate /* now add the mechanism oid */
200*0Sstevel@tonic-gate (void) memcpy(buf, mechOid->elements, mechOid->length);
201*0Sstevel@tonic-gate
202*0Sstevel@tonic-gate /* we stop here because the rest is mechanism specific */
203*0Sstevel@tonic-gate return (1);
204*0Sstevel@tonic-gate } /* gsscred_MakeNameHeader */
205*0Sstevel@tonic-gate
206*0Sstevel@tonic-gate
207*0Sstevel@tonic-gate /*
208*0Sstevel@tonic-gate * Converts the supplied string to HEX.
209*0Sstevel@tonic-gate * The passed in buffer must be twice as long as the input buffer.
210*0Sstevel@tonic-gate * Long form is used (i.e. '\0' will become '00'). This is needed
211*0Sstevel@tonic-gate * to enable proper re-parsing of names.
212*0Sstevel@tonic-gate */
213*0Sstevel@tonic-gate int
gsscred_AsHex(gss_buffer_t dataIn,gss_buffer_t dataOut)214*0Sstevel@tonic-gate gsscred_AsHex(gss_buffer_t dataIn, gss_buffer_t dataOut)
215*0Sstevel@tonic-gate {
216*0Sstevel@tonic-gate int i;
217*0Sstevel@tonic-gate char *out, *in;
218*0Sstevel@tonic-gate unsigned int tmp;
219*0Sstevel@tonic-gate
220*0Sstevel@tonic-gate if (dataOut->length < ((dataIn->length *2) + 1))
221*0Sstevel@tonic-gate return (0);
222*0Sstevel@tonic-gate
223*0Sstevel@tonic-gate out = (char *)dataOut->value;
224*0Sstevel@tonic-gate in = (char *)dataIn->value;
225*0Sstevel@tonic-gate dataOut->length = 0;
226*0Sstevel@tonic-gate
227*0Sstevel@tonic-gate for (i = 0; i < dataIn->length; i++) {
228*0Sstevel@tonic-gate tmp = (unsigned int)(*in++)&0xff;
229*0Sstevel@tonic-gate (void) sprintf(out, "%02X", tmp);
230*0Sstevel@tonic-gate out++;
231*0Sstevel@tonic-gate out++;
232*0Sstevel@tonic-gate }
233*0Sstevel@tonic-gate dataOut->length = out - (char *)dataOut->value;
234*0Sstevel@tonic-gate *out = '\0';
235*0Sstevel@tonic-gate
236*0Sstevel@tonic-gate return (1);
237*0Sstevel@tonic-gate } /* ******* gsscred_AsHex ******* */
238*0Sstevel@tonic-gate
239*0Sstevel@tonic-gate
240*0Sstevel@tonic-gate /*
241*0Sstevel@tonic-gate * GSS entry point for retrieving user uid mappings.
242*0Sstevel@tonic-gate * The name buffer contains a principal name in exported format.
243*0Sstevel@tonic-gate */
244*0Sstevel@tonic-gate int
gss_getGssCredEntry(const gss_buffer_t expName,uid_t * uid)245*0Sstevel@tonic-gate gss_getGssCredEntry(const gss_buffer_t expName, uid_t *uid)
246*0Sstevel@tonic-gate {
247*0Sstevel@tonic-gate int tableSource;
248*0Sstevel@tonic-gate unsigned char *buf;
249*0Sstevel@tonic-gate gss_buffer_desc mechOidDesc = GSS_C_EMPTY_BUFFER,
250*0Sstevel@tonic-gate mechHexOidDesc = GSS_C_EMPTY_BUFFER,
251*0Sstevel@tonic-gate expNameHexDesc = GSS_C_EMPTY_BUFFER;
252*0Sstevel@tonic-gate char oidHexBuf[256], expNameHexBuf[1024];
253*0Sstevel@tonic-gate unsigned int dummy;
254*0Sstevel@tonic-gate int len;
255*0Sstevel@tonic-gate
256*0Sstevel@tonic-gate tableSource = gsscred_read_config_file();
257*0Sstevel@tonic-gate
258*0Sstevel@tonic-gate /*
259*0Sstevel@tonic-gate * for xfn (ldap?), we must first construct, a hex mechansim oid string
260*0Sstevel@tonic-gate */
261*0Sstevel@tonic-gate if (expName->length < (expNameTokIdLen + mechOidLenLen +
262*0Sstevel@tonic-gate mechOidTagLen))
263*0Sstevel@tonic-gate return (0);
264*0Sstevel@tonic-gate
265*0Sstevel@tonic-gate buf = (unsigned char *)expName->value;
266*0Sstevel@tonic-gate buf += expNameTokIdLen;
267*0Sstevel@tonic-gate
268*0Sstevel@tonic-gate /* skip oid length - get to der */
269*0Sstevel@tonic-gate buf++;
270*0Sstevel@tonic-gate buf++;
271*0Sstevel@tonic-gate
272*0Sstevel@tonic-gate /* skip oid tag */
273*0Sstevel@tonic-gate buf++;
274*0Sstevel@tonic-gate
275*0Sstevel@tonic-gate /* get oid length */
276*0Sstevel@tonic-gate len = get_der_length(&buf,
277*0Sstevel@tonic-gate (expName->length - expNameTokIdLen
278*0Sstevel@tonic-gate - mechOidLenLen - mechOidTagLen), &dummy);
279*0Sstevel@tonic-gate if (len == -1)
280*0Sstevel@tonic-gate return (0);
281*0Sstevel@tonic-gate else
282*0Sstevel@tonic-gate mechOidDesc.length = len;
283*0Sstevel@tonic-gate
284*0Sstevel@tonic-gate if (expName->length <
285*0Sstevel@tonic-gate (expNameTokIdLen + mechOidLenLen + mechOidDesc.length
286*0Sstevel@tonic-gate + dummy+ mechOidTagLen))
287*0Sstevel@tonic-gate return (0);
288*0Sstevel@tonic-gate
289*0Sstevel@tonic-gate mechOidDesc.value = (void *)buf;
290*0Sstevel@tonic-gate
291*0Sstevel@tonic-gate /* convert the oid buffer to hex */
292*0Sstevel@tonic-gate mechHexOidDesc.value = (void*) oidHexBuf;
293*0Sstevel@tonic-gate mechHexOidDesc.length = sizeof (oidHexBuf);
294*0Sstevel@tonic-gate if (!gsscred_AsHex(&mechOidDesc, &mechHexOidDesc))
295*0Sstevel@tonic-gate return (0);
296*0Sstevel@tonic-gate
297*0Sstevel@tonic-gate /* also need to convert the name buffer into hex */
298*0Sstevel@tonic-gate expNameHexDesc.value = expNameHexBuf;
299*0Sstevel@tonic-gate expNameHexDesc.length = sizeof (expNameHexBuf);
300*0Sstevel@tonic-gate if (!gsscred_AsHex(expName, &expNameHexDesc))
301*0Sstevel@tonic-gate return (0);
302*0Sstevel@tonic-gate
303*0Sstevel@tonic-gate if (tableSource == GSSCRED_FLAT_FILE)
304*0Sstevel@tonic-gate return (file_getGssCredUid(&expNameHexDesc, uid));
305*0Sstevel@tonic-gate
306*0Sstevel@tonic-gate return (0); /* XXX for new backends (ldap, dss), 0->1 probably */
307*0Sstevel@tonic-gate } /* gss_getGssCredEntry */
308