Print this page
first pass
Split |
Close |
Expand all |
Collapse all |
--- old/usr/src/uts/common/gssapi/mechs/dummy/dmech.c
+++ new/usr/src/uts/common/gssapi/mechs/dummy/dmech.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License, Version 1.0 only
6 6 * (the "License"). You may not use this file except in compliance
7 7 * with the License.
8 8 *
9 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10 10 * or http://www.opensolaris.org/os/licensing.
11 11 * See the License for the specific language governing permissions
12 12 * and limitations under the License.
13 13 *
14 14 * When distributing Covered Code, include this CDDL HEADER in each
15 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16 16 * If applicable, add the following below this CDDL HEADER, with the
17 17 * fields enclosed by brackets "[]" replaced with your own identifying
18 18 * information: Portions Copyright [yyyy] [name of copyright owner]
19 19 *
20 20 * CDDL HEADER END
21 21 */
22 22 /*
23 23 * Copyright 2004 Sun Microsystems, Inc. All rights reserved.
24 24 * Use is subject to license terms.
25 25 * Copyright (c) 2011 Bayard G. Bell. All rights reserved.
26 26 */
27 27
28 28 /*
29 29 * A module that implements a dummy security mechanism.
30 30 * It's mainly used to test GSS-API application. Multiple tokens
31 31 * exchanged during security context establishment can be
32 32 * specified through dummy_mech.conf located in /etc.
33 33 */
34 34
35 35 #include <sys/types.h>
36 36 #include <sys/modctl.h>
37 37 #include <sys/errno.h>
38 38 #include <gssapiP_dummy.h>
39 39 #include <gssapi_err_generic.h>
40 40 #include <mechglueP.h>
41 41 #include <gssapi/kgssapi_defs.h>
42 42 #include <sys/debug.h>
43 43
44 44 #ifdef DUMMY_MECH_DEBUG
45 45 /*
46 46 * Kernel kgssd module debugging aid. The global variable "dummy_mech_log"
47 47 * is a bit mask which allows various types of debugging messages
48 48 * to be printed out.
49 49 *
50 50 * dummy_mech_log & 1 will cause actual failures to be printed.
51 51 * dummy_mech_log & 2 will cause informational messages to be
52 52 * printed on the client side of kgssd.
53 53 * dummy_mech_log & 4 will cause informational messages to be
54 54 * printed on the server side of kgssd.
55 55 * dummy_mech_log & 8 will cause informational messages to be
56 56 * printed on both client and server side of kgssd.
57 57 */
58 58
59 59 uint_t dummy_mech_log = 1;
60 60 #endif
61 61
62 62 /* Local defines */
63 63 #define MAGIC_TOKEN_NUMBER 12345
64 64 /* private routines for dummy_mechanism */
65 65 static gss_buffer_desc make_dummy_token_msg(void *data, int datalen);
66 66
67 67 static int der_length_size(int);
68 68
69 69 static void der_write_length(unsigned char **, int);
70 70 static int der_read_length(unsigned char **, int *);
71 71 static int g_token_size(gss_OID mech, unsigned int body_size);
72 72 static void g_make_token_header(gss_OID mech, int body_size,
73 73 unsigned char **buf, int tok_type);
74 74 static int g_verify_token_header(gss_OID mech, int *body_size,
75 75 unsigned char **buf_in, int tok_type,
76 76 int toksize);
77 77
78 78 /* private global variables */
79 79 static int dummy_token_nums;
80 80
81 81 /*
↓ open down ↓ |
81 lines elided |
↑ open up ↑ |
82 82 * This OID:
83 83 * { iso(1) org(3) internet(6) dod(1) private(4) enterprises(1) sun(42)
84 84 * products(2) gssapi(26) mechtypes(1) dummy(2) }
85 85 */
86 86
87 87 static struct gss_config dummy_mechanism =
88 88 {{10, "\053\006\001\004\001\052\002\032\001\002"},
89 89 NULL, /* context */
90 90 NULL, /* next */
91 91 TRUE, /* uses_kmod */
92 -/* EXPORT DELETE START */ /* CRYPT DELETE START */
93 92 dummy_gss_unseal,
94 -/* EXPORT DELETE END */ /* CRYPT DELETE END */
95 93 dummy_gss_delete_sec_context,
96 -/* EXPORT DELETE START */ /* CRYPT DELETE START */
97 94 dummy_gss_seal,
98 -/* EXPORT DELETE END */ /* CRYPT DELETE END */
99 95 dummy_gss_import_sec_context,
100 -/* EXPORT DELETE START */
101 -/* CRYPT DELETE START */
102 -#if 0
103 -/* CRYPT DELETE END */
104 - dummy_gss_seal,
105 - dummy_gss_unseal,
106 -/* CRYPT DELETE START */
107 -#endif
108 -/* CRYPT DELETE END */
109 -/* EXPORT DELETE END */
110 96 dummy_gss_sign,
111 97 dummy_gss_verify
112 98 };
113 99
114 100 static gss_mechanism
115 101 gss_mech_initialize()
116 102 {
117 103 dprintf("Entering gss_mech_initialize\n");
118 104
119 105 if (dummy_token_nums == 0)
120 106 dummy_token_nums = 1;
121 107
122 108 dprintf("Leaving gss_mech_initialize\n");
123 109 return (&dummy_mechanism);
124 110 }
125 111
126 112 /*
127 113 * Clean up after a failed mod_install()
128 114 */
129 115 static void
130 116 gss_mech_fini()
131 117 {
132 118 /* Nothing to do */
133 119 }
134 120
135 121
136 122 /*
137 123 * Module linkage information for the kernel.
138 124 */
139 125 extern struct mod_ops mod_miscops;
140 126
141 127 static struct modlmisc modlmisc = {
142 128 &mod_miscops, "in-kernel dummy GSS mechanism"
143 129 };
144 130
145 131 static struct modlinkage modlinkage = {
146 132 MODREV_1,
147 133 (void *)&modlmisc,
148 134 NULL
149 135 };
150 136
151 137 static int dummy_fini_code = EBUSY;
152 138
153 139 int
154 140 _init()
155 141 {
156 142 int retval;
157 143 gss_mechanism mech, tmp;
158 144
159 145 mech = gss_mech_initialize();
160 146
161 147 mutex_enter(&__kgss_mech_lock);
162 148 tmp = __kgss_get_mechanism(&mech->mech_type);
163 149 if (tmp != NULL) {
164 150 DUMMY_MECH_LOG0(8,
165 151 "dummy GSS mechanism: mechanism already in table.\n");
166 152 if (tmp->uses_kmod == TRUE) {
167 153 DUMMY_MECH_LOG0(8, "dummy GSS mechanism: mechanism "
168 154 "table supports kernel operations!\n");
169 155 }
170 156 /*
171 157 * keep us loaded, but let us be unloadable. This
172 158 * will give the developer time to trouble shoot
173 159 */
174 160 dummy_fini_code = 0;
175 161 } else {
176 162 __kgss_add_mechanism(mech);
177 163 ASSERT(__kgss_get_mechanism(&mech->mech_type) == mech);
178 164 }
179 165 mutex_exit(&__kgss_mech_lock);
180 166
181 167 if ((retval = mod_install(&modlinkage)) != 0)
182 168 gss_mech_fini(); /* clean up */
183 169
184 170 return (retval);
185 171 }
186 172
187 173 int
188 174 _fini()
189 175 {
190 176 int ret = dummy_fini_code;
191 177
192 178 if (ret == 0) {
193 179 ret = (mod_remove(&modlinkage));
194 180 }
195 181 return (ret);
196 182 }
197 183
198 184 int
199 185 _info(struct modinfo *modinfop)
200 186 {
201 187 return (mod_info(&modlinkage, modinfop));
202 188 }
203 189
204 190
205 191 /*ARGSUSED*/
206 192 static OM_uint32
207 193 dummy_gss_sign(context, minor_status, context_handle,
208 194 qop_req, message_buffer, message_token,
209 195 gssd_ctx_verifier)
210 196 void *context;
211 197 OM_uint32 *minor_status;
212 198 gss_ctx_id_t context_handle;
213 199 int qop_req;
214 200 gss_buffer_t message_buffer;
215 201 gss_buffer_t message_token;
216 202 OM_uint32 gssd_ctx_verifier;
217 203 {
218 204 dummy_gss_ctx_id_rec *ctx;
219 205 char token_string[] = "dummy_gss_sign";
220 206
221 207 dprintf("Entering gss_sign\n");
222 208
223 209 if (context_handle == GSS_C_NO_CONTEXT)
224 210 return (GSS_S_NO_CONTEXT);
225 211 ctx = (dummy_gss_ctx_id_rec *) context_handle;
226 212 ASSERT(ctx->established == 1);
227 213 ASSERT(ctx->token_number == MAGIC_TOKEN_NUMBER);
228 214
229 215 *message_token = make_dummy_token_msg(
230 216 token_string, strlen(token_string));
231 217
232 218 dprintf("Leaving gss_sign\n");
233 219 return (GSS_S_COMPLETE);
234 220 }
235 221
236 222 /*ARGSUSED*/
237 223 static OM_uint32
238 224 dummy_gss_verify(context, minor_status, context_handle,
239 225 message_buffer, token_buffer, qop_state,
240 226 gssd_ctx_verifier)
241 227 void *context;
242 228 OM_uint32 *minor_status;
243 229 gss_ctx_id_t context_handle;
244 230 gss_buffer_t message_buffer;
245 231 gss_buffer_t token_buffer;
246 232 int *qop_state;
247 233 OM_uint32 gssd_ctx_verifier;
248 234 {
249 235 unsigned char *ptr;
250 236 int bodysize;
251 237 int err;
252 238 dummy_gss_ctx_id_rec *ctx;
253 239
254 240 dprintf("Entering gss_verify\n");
255 241
256 242 if (context_handle == GSS_C_NO_CONTEXT)
257 243 return (GSS_S_NO_CONTEXT);
258 244
259 245 ctx = (dummy_gss_ctx_id_rec *) context_handle;
260 246 ASSERT(ctx->established == 1);
261 247 ASSERT(ctx->token_number == MAGIC_TOKEN_NUMBER);
262 248 /* Check for defective input token. */
263 249
264 250 ptr = (unsigned char *) token_buffer->value;
265 251 if (err = g_verify_token_header((gss_OID)gss_mech_dummy, &bodysize,
266 252 &ptr, 0,
267 253 token_buffer->length)) {
↓ open down ↓ |
148 lines elided |
↑ open up ↑ |
268 254 *minor_status = err;
269 255 return (GSS_S_DEFECTIVE_TOKEN);
270 256 }
271 257
272 258 *qop_state = GSS_C_QOP_DEFAULT;
273 259
274 260 dprintf("Leaving gss_verify\n");
275 261 return (GSS_S_COMPLETE);
276 262 }
277 263
278 -/* EXPORT DELETE START */
279 264 /*ARGSUSED*/
280 265 static OM_uint32
281 266 dummy_gss_seal(context, minor_status, context_handle, conf_req_flag,
282 267 qop_req, input_message_buffer, conf_state,
283 268 output_message_buffer, gssd_ctx_verifier)
284 269 void *context;
285 270 OM_uint32 *minor_status;
286 271 gss_ctx_id_t context_handle;
287 272 int conf_req_flag;
288 273 int qop_req;
289 274 gss_buffer_t input_message_buffer;
290 275 int *conf_state;
291 276 gss_buffer_t output_message_buffer;
292 277 OM_uint32 gssd_ctx_verifier;
293 278 {
294 279 gss_buffer_desc output;
295 280 dummy_gss_ctx_id_rec *ctx;
296 281 dprintf("Entering gss_seal\n");
297 282
298 283 if (context_handle == GSS_C_NO_CONTEXT)
299 284 return (GSS_S_NO_CONTEXT);
300 285 ctx = (dummy_gss_ctx_id_rec *) context_handle;
301 286 ASSERT(ctx->established == 1);
302 287 ASSERT(ctx->token_number == MAGIC_TOKEN_NUMBER);
303 288 /* Copy the input message to output message */
304 289 output = make_dummy_token_msg(
305 290 input_message_buffer->value, input_message_buffer->length);
306 291
307 292 if (conf_state)
308 293 *conf_state = 1;
309 294
310 295 *output_message_buffer = output;
311 296
312 297 dprintf("Leaving gss_seal\n");
313 298 return (GSS_S_COMPLETE);
314 299 }
315 300
316 301 /*ARGSUSED*/
317 302 static OM_uint32
318 303 dummy_gss_unseal(context, minor_status, context_handle,
319 304 input_message_buffer, output_message_buffer,
320 305 conf_state, qop_state, gssd_ctx_verifier)
321 306 void *context;
322 307 OM_uint32 *minor_status;
323 308 gss_ctx_id_t context_handle;
324 309 gss_buffer_t input_message_buffer;
325 310 gss_buffer_t output_message_buffer;
326 311 int *conf_state;
327 312 int *qop_state;
328 313 OM_uint32 gssd_ctx_verifier;
329 314 {
330 315 gss_buffer_desc output;
331 316 dummy_gss_ctx_id_rec *ctx;
332 317 unsigned char *ptr;
333 318 int bodysize;
334 319 int err;
335 320
336 321 dprintf("Entering gss_unseal\n");
337 322
338 323 if (context_handle == GSS_C_NO_CONTEXT)
339 324 return (GSS_S_NO_CONTEXT);
340 325
341 326 ctx = (dummy_gss_ctx_id_rec *) context_handle;
342 327 ASSERT(ctx->established == 1);
343 328 ASSERT(ctx->token_number == MAGIC_TOKEN_NUMBER);
344 329
345 330 ptr = (unsigned char *) input_message_buffer->value;
346 331 if (err = g_verify_token_header((gss_OID)gss_mech_dummy, &bodysize,
347 332 &ptr, 0,
348 333 input_message_buffer->length)) {
349 334 *minor_status = err;
350 335 return (GSS_S_DEFECTIVE_TOKEN);
351 336 }
352 337 output.length = bodysize;
353 338 output.value = (void *)MALLOC(output.length);
354 339 (void) memcpy(output.value, ptr, output.length);
355 340
↓ open down ↓ |
67 lines elided |
↑ open up ↑ |
356 341 *output_message_buffer = output;
357 342 *qop_state = GSS_C_QOP_DEFAULT;
358 343
359 344 if (conf_state)
360 345 *conf_state = 1;
361 346
362 347 dprintf("Leaving gss_unseal\n");
363 348 return (GSS_S_COMPLETE);
364 349 }
365 350
366 -/* EXPORT DELETE END */
367 -
368 351 /*ARGSUSED*/
369 352 OM_uint32
370 353 dummy_gss_import_sec_context(ct, minor_status, interprocess_token,
371 354 context_handle)
372 355 void *ct;
373 356 OM_uint32 *minor_status;
374 357 gss_buffer_t interprocess_token;
375 358 gss_ctx_id_t *context_handle;
376 359 {
377 360 unsigned char *ptr;
378 361 int bodysize;
379 362 int err;
380 363
381 364 /* Assume that we got ctx from the interprocess token. */
382 365 dummy_gss_ctx_id_t ctx;
383 366
384 367 dprintf("Entering import_sec_context\n");
385 368 ptr = (unsigned char *) interprocess_token->value;
386 369 if (err = g_verify_token_header((gss_OID)gss_mech_dummy, &bodysize,
387 370 &ptr, 0,
388 371 interprocess_token->length)) {
389 372 *minor_status = err;
390 373 return (GSS_S_DEFECTIVE_TOKEN);
391 374 }
392 375 ctx = (dummy_gss_ctx_id_t)MALLOC(sizeof (dummy_gss_ctx_id_rec));
393 376 ctx->token_number = MAGIC_TOKEN_NUMBER;
394 377 ctx->established = 1;
395 378
396 379 *context_handle = (gss_ctx_id_t)ctx;
397 380
398 381 dprintf("Leaving import_sec_context\n");
399 382 return (GSS_S_COMPLETE);
400 383 }
401 384
402 385 /*ARGSUSED*/
403 386 static OM_uint32
404 387 dummy_gss_delete_sec_context(ct, minor_status,
405 388 context_handle, output_token,
406 389 gssd_ctx_verifier)
407 390 void *ct;
408 391 OM_uint32 *minor_status;
409 392 gss_ctx_id_t *context_handle;
410 393 gss_buffer_t output_token;
411 394 OM_uint32 gssd_ctx_verifier;
412 395 {
413 396 dummy_gss_ctx_id_t ctx;
414 397
415 398 dprintf("Entering delete_sec_context\n");
416 399
417 400 /* Make the length to 0, so the output token is not sent to peer */
418 401 if (output_token) {
419 402 output_token->length = 0;
420 403 output_token->value = NULL;
421 404 }
422 405
423 406 if (*context_handle == GSS_C_NO_CONTEXT) {
424 407 *minor_status = 0;
425 408 return (GSS_S_COMPLETE);
426 409 }
427 410
428 411 ctx = (dummy_gss_ctx_id_rec *) *context_handle;
429 412 ASSERT(ctx->established == 1);
430 413 ASSERT(ctx->token_number == MAGIC_TOKEN_NUMBER);
431 414
432 415 FREE(ctx, sizeof (dummy_gss_ctx_id_rec));
433 416 *context_handle = GSS_C_NO_CONTEXT;
434 417
435 418 dprintf("Leaving delete_sec_context\n");
436 419 return (GSS_S_COMPLETE);
437 420 }
438 421
439 422 static int
440 423 der_length_size(int length)
441 424 {
442 425 if (length < (1<<7))
443 426 return (1);
444 427 else if (length < (1<<8))
445 428 return (2);
446 429 else if (length < (1<<16))
447 430 return (3);
448 431 else if (length < (1<<24))
449 432 return (4);
450 433 else
451 434 return (5);
452 435 }
453 436
454 437 static void
455 438 der_write_length(unsigned char ** buf, int length)
456 439 {
457 440 if (length < (1<<7)) {
458 441 *(*buf)++ = (unsigned char) length;
459 442 } else {
460 443 *(*buf)++ = (unsigned char) (der_length_size(length)+127);
461 444 if (length >= (1<<24))
462 445 *(*buf)++ = (unsigned char) (length>>24);
463 446 if (length >= (1<<16))
464 447 *(*buf)++ = (unsigned char) ((length>>16)&0xff);
465 448 if (length >= (1<<8))
466 449 *(*buf)++ = (unsigned char) ((length>>8)&0xff);
467 450 *(*buf)++ = (unsigned char) (length&0xff);
468 451 }
469 452 }
470 453
471 454 static int
472 455 der_read_length(buf, bufsize)
473 456 unsigned char **buf;
474 457 int *bufsize;
475 458 {
476 459 unsigned char sf;
477 460 int ret;
478 461
479 462 if (*bufsize < 1)
480 463 return (-1);
481 464 sf = *(*buf)++;
482 465 (*bufsize)--;
483 466 if (sf & 0x80) {
484 467 if ((sf &= 0x7f) > ((*bufsize)-1))
485 468 return (-1);
486 469 if (sf > DUMMY_SIZE_OF_INT)
487 470 return (-1);
488 471 ret = 0;
489 472 for (; sf; sf--) {
490 473 ret = (ret<<8) + (*(*buf)++);
491 474 (*bufsize)--;
492 475 }
493 476 } else {
494 477 ret = sf;
495 478 }
496 479
497 480 return (ret);
498 481 }
499 482
500 483 static int
501 484 g_token_size(mech, body_size)
502 485 gss_OID mech;
503 486 unsigned int body_size;
504 487 {
505 488 /* set body_size to sequence contents size */
506 489 body_size += 4 + (int)mech->length; /* NEED overflow check */
507 490 return (1 + der_length_size(body_size) + body_size);
508 491 }
509 492
510 493 static void
511 494 g_make_token_header(mech, body_size, buf, tok_type)
512 495 gss_OID mech;
513 496 int body_size;
514 497 unsigned char **buf;
515 498 int tok_type;
516 499 {
517 500 *(*buf)++ = 0x60;
518 501 der_write_length(buf, 4 + mech->length + body_size);
519 502 *(*buf)++ = 0x06;
520 503 *(*buf)++ = (unsigned char) mech->length;
521 504 TWRITE_STR(*buf, mech->elements, ((int)mech->length));
522 505 *(*buf)++ = (unsigned char) ((tok_type>>8)&0xff);
523 506 *(*buf)++ = (unsigned char) (tok_type&0xff);
524 507 }
525 508
526 509 static int
527 510 g_verify_token_header(mech, body_size, buf_in, tok_type, toksize)
528 511 gss_OID mech;
529 512 int *body_size;
530 513 unsigned char **buf_in;
531 514 int tok_type;
532 515 int toksize;
533 516 {
534 517 unsigned char *buf = *buf_in;
535 518 int seqsize;
536 519 gss_OID_desc toid;
537 520 int ret = 0;
538 521
539 522 if ((toksize -= 1) < 0)
540 523 return (G_BAD_TOK_HEADER);
541 524 if (*buf++ != 0x60)
542 525 return (G_BAD_TOK_HEADER);
543 526
544 527 if ((seqsize = der_read_length(&buf, &toksize)) < 0)
545 528 return (G_BAD_TOK_HEADER);
546 529
547 530 if (seqsize != toksize)
548 531 return (G_BAD_TOK_HEADER);
549 532
550 533 if ((toksize -= 1) < 0)
551 534 return (G_BAD_TOK_HEADER);
552 535 if (*buf++ != 0x06)
553 536 return (G_BAD_TOK_HEADER);
554 537
555 538 if ((toksize -= 1) < 0)
556 539 return (G_BAD_TOK_HEADER);
557 540 toid.length = *buf++;
558 541
559 542 if ((toksize -= toid.length) < 0)
560 543 return (G_BAD_TOK_HEADER);
561 544 toid.elements = buf;
562 545 buf += toid.length;
563 546
564 547 if (! g_OID_equal(&toid, mech))
565 548 ret = G_WRONG_MECH;
566 549
567 550 /*
568 551 * G_WRONG_MECH is not returned immediately because it's more important
569 552 * to return G_BAD_TOK_HEADER if the token header is in fact bad
570 553 */
571 554
572 555 if ((toksize -= 2) < 0)
573 556 return (G_BAD_TOK_HEADER);
574 557
575 558 if ((*buf++ != ((tok_type>>8)&0xff)) ||
576 559 (*buf++ != (tok_type&0xff)))
577 560 return (G_BAD_TOK_HEADER);
578 561
579 562 if (!ret) {
580 563 *buf_in = buf;
581 564 *body_size = toksize;
582 565 }
583 566
584 567 return (ret);
585 568 }
586 569
587 570 static gss_buffer_desc
588 571 make_dummy_token_msg(void *data, int dataLen)
589 572 {
590 573 gss_buffer_desc buffer;
591 574 int tlen;
592 575 unsigned char *t;
593 576 unsigned char *ptr;
594 577
595 578 if (data == NULL) {
596 579 buffer.length = 0;
597 580 buffer.value = NULL;
598 581 return (buffer);
599 582 }
600 583
601 584 tlen = g_token_size((gss_OID)gss_mech_dummy, dataLen);
602 585 t = (unsigned char *) MALLOC(tlen);
603 586 ptr = t;
604 587
605 588 g_make_token_header((gss_OID)gss_mech_dummy, dataLen, &ptr, 0);
606 589 (void) memcpy(ptr, data, dataLen);
607 590
608 591 buffer.length = tlen;
609 592 buffer.value = (void *) t;
610 593 return (buffer);
611 594 }
↓ open down ↓ |
234 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX