globus_gssapi_gsi  13.5
 All Files Functions Variables Enumerations Groups Pages
gssapi_openssl.h
Go to the documentation of this file.
1 /*
2  * Copyright 1999-2006 University of Chicago
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef GSSAPI_OPENSSL_H
18 #define GSSAPI_OPENSSL_H
19 
26 #include "globus_config.h"
27 #include "globus_common.h"
28 
29 #include "gssapi.h"
31 
32 #include "globus_gsi_callback.h"
33 #include "globus_gsi_proxy.h"
34 #include "globus_gsi_credential.h"
35 
36 #include <stdio.h>
37 #include "openssl/ssl.h"
38 #include "openssl/err.h"
39 #include "openssl/bio.h"
40 #include "openssl/pem.h"
41 #include "openssl/x509.h"
42 #include "openssl/x509v3.h"
43 #include "openssl/stack.h"
44 
45 #define GLOBUS_I_GSI_GSSAPI_IMPL_VERSION 1
46 
47 #define GSS_I_CTX_INITIALIZED 1
48 #define GSS_I_DISALLOW_ENCRYPTION 2
49 #define GSS_I_PROTECTION_FAIL_ON_CONTEXT_EXPIRATION 4
50 #define GSS_I_APPLICATION_WILL_HANDLE_EXTENSIONS 8
51 
52 #define GSS_C_QOP_GLOBUS_GSSAPI_OPENSSL_BIG 1
53 
54 /*
55  * we need to distinguish between a token
56  * created by us using get_mic vs one using
57  * the SSL application data
58  * We use this in wrap and unwrap
59  * Future versions of SSL may use this
60  *
61  * Our wrapped buffer (integrity only) has
62  *
63  * byte type[1] = SSL3_RT_GSSAPI_OPENSSL
64  * byte version_major[1] = 0x03
65  * byte version_minor[1] = 0
66  * byte mic_length[2] = 2 byte length of following mic
67  *
68  * byte mic_seq[8] = 8 byte sequence number
69  * byte mic_data_length[4] = 4 byte length of data
70  * byte hash[*] = the hash of variable length
71  *
72  * byte data[*] = the data being wrapped.
73  */
74 
75 #define SSL3_RT_GSSAPI_OPENSSL 26
76 
77 /* These conversions macros are taken from SSL */
78 
79 #define L2N(LONG_VAL, CHAR_ARRAY) \
80  { \
81  unsigned char * _char_array_ = CHAR_ARRAY; \
82  *(_char_array_++) = (unsigned char) (((LONG_VAL) >> 24) & 0xff); \
83  *(_char_array_++) = (unsigned char) (((LONG_VAL) >> 16) & 0xff); \
84  *(_char_array_++) = (unsigned char) (((LONG_VAL) >> 8) & 0xff); \
85  *(_char_array_++) = (unsigned char) (((LONG_VAL)) & 0xff); \
86  }
87 
88 #define N2L(CHAR_ARRAY, LONG_VAL) \
89  { \
90  const unsigned char * _char_array_ = CHAR_ARRAY; \
91  (LONG_VAL) = ((*(_char_array_++)) << 24) & 0xff000000; \
92  (LONG_VAL) |= ((*(_char_array_++)) << 16) & 0xff0000; \
93  (LONG_VAL) |= ((*(_char_array_++)) << 8) & 0xff00; \
94  (LONG_VAL) |= ((*(_char_array_++)) & 0xff); \
95  }
96 
97 #define N2S(CHAR_ARRAY, SHORT) \
98  { \
99  char * _char_array_ = CHAR_ARRAY; \
100  (SHORT) = ((unsigned int) (*(_char_array_++))) << 8; \
101  (SHORT) |= ((unsigned int) (*(_char_array_++))); \
102  }
103 
104 #define S2N(SHORT, CHAR_ARRAY) \
105  { \
106  char * _char_array_ = CHAR_ARRAY; \
107  *(_char_array_++) = (unsigned char) (((SHORT) >> 8) & 0xff); \
108  *(_char_array_++) = (unsigned char) ((SHORT) & 0xff); \
109  }
110 
111 #define U642N(U64VAL, CHAR_ARRAY) \
112  { \
113  unsigned char * _char_array_ = CHAR_ARRAY; \
114  *(_char_array_++) = (unsigned char) (((U64VAL) >> 56) & 0xff); \
115  *(_char_array_++) = (unsigned char) (((U64VAL) >> 48) & 0xff); \
116  *(_char_array_++) = (unsigned char) (((U64VAL) >> 40) & 0xff); \
117  *(_char_array_++) = (unsigned char) (((U64VAL) >> 32) & 0xff); \
118  *(_char_array_++) = (unsigned char) (((U64VAL) >> 24) & 0xff); \
119  *(_char_array_++) = (unsigned char) (((U64VAL) >> 16) & 0xff); \
120  *(_char_array_++) = (unsigned char) (((U64VAL) >> 8) & 0xff); \
121  *(_char_array_++) = (unsigned char) (((U64VAL) ) & 0xff); \
122  }
123 
124 #define N2U64(CHAR_ARRAY, U64VAL) \
125  { \
126  const unsigned char * _char_array_ = CHAR_ARRAY; \
127  uint64_t _u64val_ = 0; \
128  _u64val_ = (((uint64_t)(*(_char_array_++))) << 56) & 0xff00000000000000; \
129  _u64val_ = (((uint64_t)(*(_char_array_++))) << 48) & 0xff000000000000; \
130  _u64val_ = (((uint64_t)(*(_char_array_++))) << 40) & 0xff0000000000; \
131  _u64val_ = (((uint64_t)(*(_char_array_++))) << 32) & 0xff00000000; \
132  _u64val_ = (((uint64_t)(*(_char_array_++))) << 24) & 0xff000000; \
133  _u64val_ = (((uint64_t)(*(_char_array_++))) << 16) & 0xff0000; \
134  _u64val_ = (((uint64_t)(*(_char_array_++))) << 8) & 0xff00; \
135  _u64val_ = (((uint64_t)(*(_char_array_++))) ) & 0xff; \
136  (U64VAL) = _u64val_; \
137  }
138 /* Compare OIDs */
139 
140 #define g_OID_equal(o1, o2) \
141  (((o1) == (o2)) || \
142  ((o1) && (o2) && \
143  ((o1)->length == (o2)->length) && \
144  (memcmp((o1)->elements,(o2)->elements,(int) (o1)->length) == 0)))
145 
146 typedef struct gss_name_desc_struct {
147  /* gss_buffer_desc name_buffer ; */
148  gss_OID name_oid;
149 
150  X509_NAME * x509n;
151  char * x509n_oneline;
152  GENERAL_NAMES * subjectAltNames;
153  char * user_name;
154  char * service_name;
155  char * host_name;
156  char * ip_address;
157  char * ip_name;
158 } gss_name_desc;
159 
160 
161 typedef struct gss_cred_id_desc_struct {
162  globus_gsi_cred_handle_t cred_handle;
163  gss_name_desc * globusid;
164  gss_cred_usage_t cred_usage;
165  SSL_CTX * ssl_context;
166  gss_OID mech;
167 } gss_cred_id_desc;
168 
169 typedef struct gss_ctx_id_desc_struct{
170  globus_mutex_t mutex;
171  globus_gsi_callback_data_t callback_data;
172  gss_cred_id_desc * peer_cred_handle;
173  gss_cred_id_desc * cred_handle;
174  gss_cred_id_desc * deleg_cred_handle;
175  globus_gsi_proxy_handle_t proxy_handle;
176  OM_uint32 ret_flags;
177  OM_uint32 req_flags;
178  OM_uint32 ctx_flags;
179  int cred_obtained;
180  gss_OID mech;
181 #if OPENSSL_VERSION_NUMBER >= 0x10000100L
182 
183  uint64_t mac_read_sequence;
185  uint64_t mac_write_sequence;
187  unsigned char * mac_key;
192  unsigned char * mac_iv_fixed;
193 #endif
194  SSL * gss_ssl;
195  BIO * gss_rbio;
196  BIO * gss_wbio;
197  BIO * gss_sslbio;
198  gss_con_st_t gss_state;
199  int locally_initiated;
200  gss_delegation_state_t delegation_state;
201  gss_OID_set extension_oids;
202  gss_cred_id_t *sni_credentials;
203  size_t sni_credentials_count;
204  char *sni_servername;
205  unsigned char *alpn;
206  size_t alpn_length;
207 } gss_ctx_id_desc;
208 
209 extern
210 const gss_OID_desc * const gss_mech_globus_gssapi_openssl;
211 
212 extern
213 const gss_OID_desc * const gss_mech_globus_gssapi_openssl_micv2;
214 
215 extern
216 const gss_OID_desc * const gss_proxycertinfo_extension;
217 
218 extern
219 gss_OID_desc * gss_nt_host_ip;
220 
221 extern
222 gss_OID_desc * gss_nt_x509;
223 
224 extern
225 const gss_OID_desc * const gss_ext_server_name_oid;
226 
227 extern
228 const gss_OID_desc * const gss_ext_alpn_oid;
229 
230 
231 extern
232 globus_bool_t globus_i_backward_compatible_mic;
233 extern
234 globus_bool_t globus_i_accept_backward_compatible_mic;
235 
236 #define GLOBUS_GSS_C_NT_HOST_IP gss_nt_host_ip
237 #define GLOBUS_GSS_C_NT_X509 gss_nt_x509
238 
239 extern
240 globus_thread_once_t once_control;
241 
242 void
243 globus_l_gsi_gssapi_activate_once(void);
244 
245 OM_uint32
247  OM_uint32 *minor_status,
248  const gss_ctx_id_t context_handle,
249  const EVP_MD ** hash,
250  const EVP_CIPHER ** cipher);
251 
252 
253 OM_uint32
254 globus_i_gssapi_gsi_gmac(
255  OM_uint32 * minor_status,
256  const EVP_CIPHER * evp_cipher,
257  const unsigned char * iv,
258  const unsigned char * key,
259  const gss_buffer_desc *message_buffer,
260  unsigned char tag[static 16]);
261 
262 #endif /* GSSAPI_OPENSSL_H */
gss_delegation_state_t
Delegation State Type.
Definition: globus_gsi_gss_constants.h:110
globus_thread_once_t once_control
Definition: module.c:115
gss_con_st_t
Connection State Type.
Definition: globus_gsi_gss_constants.h:98
Globus GSI GSS constants.
OM_uint32 globus_i_gss_get_hash(OM_uint32 *minor_status, const gss_ctx_id_t context_handle, const EVP_MD **hash, const EVP_CIPHER **cipher)
Find the hash and cipher functions used by a context.
Definition: get_hash.c:24