2 #include <gssapi/gssapi.h>
9 static gss_OID_desc putty_gss_mech_krb5_desc =
10 { 9, (void *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
11 static gss_OID const putty_gss_mech_krb5 = &putty_gss_mech_krb5_desc;
13 typedef struct uxSsh_gss_ctx {
19 int ssh_gss_init(void)
21 /* On Windows this tries to load the SSPI library functions. On
22 Unix we assume we have GSSAPI at runtime if we were linked with
27 Ssh_gss_stat ssh_gss_indicate_mech(Ssh_gss_buf *mech)
29 /* Copy constant into mech */
30 mech->length = putty_gss_mech_krb5->length;
31 mech->value = putty_gss_mech_krb5->elements;
36 Ssh_gss_stat ssh_gss_import_name(char *host,
37 Ssh_gss_name *srv_name)
39 OM_uint32 min_stat,maj_stat;
40 gss_buffer_desc host_buf;
43 pStr = dupcat("host@", host, NULL);
45 host_buf.value = pStr;
46 host_buf.length = strlen(pStr);
48 maj_stat = gss_import_name(&min_stat, &host_buf,
49 GSS_C_NT_HOSTBASED_SERVICE,
50 (gss_name_t *)srv_name);
53 if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
54 return SSH_GSS_FAILURE;
57 Ssh_gss_stat ssh_gss_acquire_cred(Ssh_gss_ctx *ctx)
59 uxSsh_gss_ctx *uxctx = snew(uxSsh_gss_ctx);
61 uxctx->maj_stat = uxctx->min_stat = GSS_S_COMPLETE;
62 uxctx->ctx = GSS_C_NO_CONTEXT;
63 *ctx = (Ssh_gss_ctx) uxctx;
68 Ssh_gss_stat ssh_gss_init_sec_context(Ssh_gss_ctx *ctx,
69 Ssh_gss_name srv_name,
71 Ssh_gss_buf *recv_tok,
72 Ssh_gss_buf *send_tok)
74 uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx*) *ctx;
77 if (to_deleg) to_deleg = GSS_C_DELEG_FLAG;
78 uxctx->maj_stat = gss_init_sec_context(&uxctx->min_stat,
81 (gss_name_t) srv_name,
82 (gss_OID) putty_gss_mech_krb5,
84 GSS_C_INTEG_FLAG | to_deleg,
86 GSS_C_NO_CHANNEL_BINDINGS,
88 NULL, /* ignore mech type */
91 NULL); /* ignore time_rec */
93 if (uxctx->maj_stat == GSS_S_COMPLETE) return SSH_GSS_S_COMPLETE;
94 if (uxctx->maj_stat == GSS_S_CONTINUE_NEEDED) return SSH_GSS_S_CONTINUE_NEEDED;
95 return SSH_GSS_FAILURE;
98 Ssh_gss_stat ssh_gss_display_status(Ssh_gss_ctx ctx, Ssh_gss_buf *buf)
100 uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx *) ctx;
103 gss_buffer_desc msg_maj=GSS_C_EMPTY_BUFFER;
104 gss_buffer_desc msg_min=GSS_C_EMPTY_BUFFER;
106 /* Return empty buffer in case of failure */
107 SSH_GSS_CLEAR_BUF(buf);
109 /* get first mesg from GSS */
111 lmax=gss_display_status(&lmin,uxctx->maj_stat,GSS_C_GSS_CODE,(gss_OID) putty_gss_mech_krb5,&ccc,&msg_maj);
113 if (lmax != GSS_S_COMPLETE) return SSH_GSS_FAILURE;
115 /* get first mesg from Kerberos */
117 lmax=gss_display_status(&lmin,uxctx->min_stat,GSS_C_MECH_CODE,(gss_OID) putty_gss_mech_krb5,&ccc,&msg_min);
119 if (lmax != GSS_S_COMPLETE) {
120 gss_release_buffer(&lmin, &msg_maj);
121 return SSH_GSS_FAILURE;
124 /* copy data into buffer */
125 buf->length = msg_maj.length + msg_min.length + 1;
126 buf->value = snewn(buf->length + 1, char);
129 memcpy((char *)buf->value, msg_maj.value, msg_maj.length);
130 ((char *)buf->value)[msg_maj.length] = ' ';
131 memcpy((char *)buf->value + msg_maj.length + 1, msg_min.value, msg_min.length);
132 ((char *)buf->value)[buf->length] = 0;
133 /* free mem & exit */
134 gss_release_buffer(&lmin, &msg_maj);
135 gss_release_buffer(&lmin, &msg_min);
139 Ssh_gss_stat ssh_gss_free_tok(Ssh_gss_buf *send_tok)
141 OM_uint32 min_stat,maj_stat;
142 maj_stat = gss_release_buffer(&min_stat, send_tok);
144 if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
145 return SSH_GSS_FAILURE;
148 Ssh_gss_stat ssh_gss_release_cred(Ssh_gss_ctx *ctx)
150 uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx *) *ctx;
152 OM_uint32 maj_stat=GSS_S_COMPLETE;
154 if (uxctx == NULL) return SSH_GSS_FAILURE;
155 if (uxctx->ctx != GSS_C_NO_CONTEXT)
156 maj_stat = gss_delete_sec_context(&min_stat,&uxctx->ctx,GSS_C_NO_BUFFER);
159 if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
160 return SSH_GSS_FAILURE;
164 Ssh_gss_stat ssh_gss_release_name(Ssh_gss_name *srv_name)
166 OM_uint32 min_stat,maj_stat;
167 maj_stat = gss_release_name(&min_stat, (gss_name_t *) srv_name);
169 if (maj_stat == GSS_S_COMPLETE) return SSH_GSS_OK;
170 return SSH_GSS_FAILURE;
173 Ssh_gss_stat ssh_gss_get_mic(Ssh_gss_ctx ctx, Ssh_gss_buf *buf,
176 uxSsh_gss_ctx *uxctx = (uxSsh_gss_ctx *) ctx;
177 if (uxctx == NULL) return SSH_GSS_FAILURE;
178 return gss_get_mic(&(uxctx->min_stat), uxctx->ctx, 0, buf, hash);
181 Ssh_gss_stat ssh_gss_free_mic(Ssh_gss_buf *hash)
183 /* On Unix this is the same freeing process as ssh_gss_free_tok. */
184 return ssh_gss_free_tok(hash);
189 /* Dummy function so this source file defines something if NO_GSSAPI
192 int ssh_gss_init(void)