globus_gssapi_gsi  13.19
 All Files Functions Variables Enumerations Groups Pages
gssapi_openssl.h
Go to the documentation of this file.
1 
2 #ifndef GSSAPI_OPENSSL_H
3 #define GSSAPI_OPENSSL_H
4 
11 #include <stdbool.h>
12 
13 #include "globus_config.h"
14 #include "globus_common.h"
15 
16 #include "gssapi.h"
18 
19 #include "globus_gsi_callback.h"
20 #include "globus_gsi_proxy.h"
21 #include "globus_gsi_credential.h"
22 
23 #include <stdio.h>
24 #include "openssl/ssl.h"
25 #include "openssl/err.h"
26 #include "openssl/bio.h"
27 #include "openssl/pem.h"
28 #include "openssl/x509.h"
29 #include "openssl/x509v3.h"
30 #include "openssl/stack.h"
31 
32 #define GLOBUS_I_GSI_GSSAPI_IMPL_VERSION 1
33 
34 #define GSS_I_CTX_INITIALIZED 1
35 #define GSS_I_DISALLOW_ENCRYPTION 2
36 #define GSS_I_PROTECTION_FAIL_ON_CONTEXT_EXPIRATION 4
37 #define GSS_I_APPLICATION_WILL_HANDLE_EXTENSIONS 8
38 
39 #define GSS_C_QOP_GLOBUS_GSSAPI_OPENSSL_BIG 1
40 
41 /*
42  * we need to distinguish between a token
43  * created by us using get_mic vs one using
44  * the SSL application data
45  * We use this in wrap and unwrap
46  * Future versions of SSL may use this
47  *
48  * Our wrapped buffer (integrity only) has
49  *
50  * byte type[1] = SSL3_RT_GSSAPI_OPENSSL
51  * byte version_major[1] = 0x03
52  * byte version_minor[1] = 0
53  * byte mic_length[2] = 2 byte length of following mic
54  *
55  * byte mic_seq[8] = 8 byte sequence number
56  * byte mic_data_length[4] = 4 byte length of data
57  * byte hash[*] = the hash of variable length
58  *
59  * byte data[*] = the data being wrapped.
60  */
61 
62 #define SSL3_RT_GSSAPI_OPENSSL 26
63 
64 /* These conversions macros are taken from SSL */
65 
66 #define L2N(LONG_VAL, CHAR_ARRAY) \
67  { \
68  unsigned char * _char_array_ = CHAR_ARRAY; \
69  *(_char_array_++) = (unsigned char) (((LONG_VAL) >> 24) & 0xff); \
70  *(_char_array_++) = (unsigned char) (((LONG_VAL) >> 16) & 0xff); \
71  *(_char_array_++) = (unsigned char) (((LONG_VAL) >> 8) & 0xff); \
72  *(_char_array_++) = (unsigned char) (((LONG_VAL)) & 0xff); \
73  }
74 
75 #define N2L(CHAR_ARRAY, LONG_VAL) \
76  { \
77  const unsigned char * _char_array_ = CHAR_ARRAY; \
78  (LONG_VAL) = ((*(_char_array_++)) << 24) & 0xff000000; \
79  (LONG_VAL) |= ((*(_char_array_++)) << 16) & 0xff0000; \
80  (LONG_VAL) |= ((*(_char_array_++)) << 8) & 0xff00; \
81  (LONG_VAL) |= ((*(_char_array_++)) & 0xff); \
82  }
83 
84 #define N2S(CHAR_ARRAY, SHORT) \
85  { \
86  char * _char_array_ = CHAR_ARRAY; \
87  (SHORT) = ((unsigned int) (*(_char_array_++))) << 8; \
88  (SHORT) |= ((unsigned int) (*(_char_array_++))); \
89  }
90 
91 #define S2N(SHORT, CHAR_ARRAY) \
92  { \
93  char * _char_array_ = CHAR_ARRAY; \
94  *(_char_array_++) = (unsigned char) (((SHORT) >> 8) & 0xff); \
95  *(_char_array_++) = (unsigned char) ((SHORT) & 0xff); \
96  }
97 
98 #define U642N(U64VAL, CHAR_ARRAY) \
99  { \
100  unsigned char * _char_array_ = CHAR_ARRAY; \
101  *(_char_array_++) = (unsigned char) (((U64VAL) >> 56) & 0xff); \
102  *(_char_array_++) = (unsigned char) (((U64VAL) >> 48) & 0xff); \
103  *(_char_array_++) = (unsigned char) (((U64VAL) >> 40) & 0xff); \
104  *(_char_array_++) = (unsigned char) (((U64VAL) >> 32) & 0xff); \
105  *(_char_array_++) = (unsigned char) (((U64VAL) >> 24) & 0xff); \
106  *(_char_array_++) = (unsigned char) (((U64VAL) >> 16) & 0xff); \
107  *(_char_array_++) = (unsigned char) (((U64VAL) >> 8) & 0xff); \
108  *(_char_array_++) = (unsigned char) (((U64VAL) ) & 0xff); \
109  }
110 
111 #define N2U64(CHAR_ARRAY, U64VAL) \
112  { \
113  const unsigned char * _char_array_ = CHAR_ARRAY; \
114  uint64_t _u64val_ = 0; \
115  _u64val_ = (((uint64_t)(*(_char_array_++))) << 56) & 0xff00000000000000; \
116  _u64val_ = (((uint64_t)(*(_char_array_++))) << 48) & 0xff000000000000; \
117  _u64val_ = (((uint64_t)(*(_char_array_++))) << 40) & 0xff0000000000; \
118  _u64val_ = (((uint64_t)(*(_char_array_++))) << 32) & 0xff00000000; \
119  _u64val_ = (((uint64_t)(*(_char_array_++))) << 24) & 0xff000000; \
120  _u64val_ = (((uint64_t)(*(_char_array_++))) << 16) & 0xff0000; \
121  _u64val_ = (((uint64_t)(*(_char_array_++))) << 8) & 0xff00; \
122  _u64val_ = (((uint64_t)(*(_char_array_++))) ) & 0xff; \
123  (U64VAL) = _u64val_; \
124  }
125 /* Compare OIDs */
126 
127 #define g_OID_equal(o1, o2) \
128  (((o1) == (o2)) || \
129  ((o1) && (o2) && \
130  ((o1)->length == (o2)->length) && \
131  (memcmp((o1)->elements,(o2)->elements,(int) (o1)->length) == 0)))
132 
133 typedef struct gss_name_desc_struct {
134  /* gss_buffer_desc name_buffer ; */
135  gss_OID name_oid;
136 
137  X509_NAME * x509n;
138  char * x509n_oneline;
139  GENERAL_NAMES * subjectAltNames;
140  char * user_name;
141  char * service_name;
142  char * host_name;
143  char * ip_address;
144  char * ip_name;
145 } gss_name_desc;
146 
147 
148 typedef struct gss_cred_id_desc_struct {
149  globus_gsi_cred_handle_t cred_handle;
150  gss_name_desc * globusid;
151  gss_cred_usage_t cred_usage;
152  SSL_CTX * ssl_context;
153  gss_OID mech;
154 } gss_cred_id_desc;
155 
156 typedef struct gss_ctx_id_desc_struct{
157  globus_mutex_t mutex;
158  globus_gsi_callback_data_t callback_data;
159  gss_cred_id_desc * peer_cred_handle;
160  gss_cred_id_desc * cred_handle;
161  gss_cred_id_desc * deleg_cred_handle;
162  globus_gsi_proxy_handle_t proxy_handle;
163  OM_uint32 ret_flags;
164  OM_uint32 req_flags;
165  OM_uint32 ctx_flags;
166  int cred_obtained;
167  gss_OID mech;
168 #if OPENSSL_VERSION_NUMBER >= 0x10000100L
169 
170  uint64_t mac_read_sequence;
172  uint64_t mac_write_sequence;
174  unsigned char * mac_key;
179  unsigned char * mac_iv_fixed;
180 #endif
181  SSL * gss_ssl;
182  BIO * gss_rbio;
183  BIO * gss_wbio;
184  BIO * gss_sslbio;
185  gss_con_st_t gss_state;
186  int locally_initiated;
187  gss_delegation_state_t delegation_state;
188  gss_OID_set extension_oids;
189  gss_cred_id_t *sni_credentials;
190  bool sni_credentials_obtained;
191  size_t sni_credentials_count;
192  char *sni_servername;
193  unsigned char *alpn;
194  size_t alpn_length;
195 } gss_ctx_id_desc;
196 
197 extern
198 const gss_OID_desc * const gss_mech_globus_gssapi_openssl;
199 
200 extern
201 const gss_OID_desc * const gss_mech_globus_gssapi_openssl_micv2;
202 
203 extern
204 const gss_OID_desc * const gss_proxycertinfo_extension;
205 
206 extern
207 gss_OID_desc * gss_nt_host_ip;
208 
209 extern
210 gss_OID_desc * gss_nt_x509;
211 
212 extern
213 const gss_OID_desc * const gss_ext_server_name_oid;
214 
215 extern
216 const gss_OID_desc * const gss_ext_alpn_oid;
217 
218 extern
219 const gss_OID_desc * const gss_ext_tls_version_oid;
220 
221 extern
222 const gss_OID_desc * const gss_ext_tls_cipher_oid;
223 
224 extern
225 globus_bool_t globus_i_backward_compatible_mic;
226 extern
227 globus_bool_t globus_i_accept_backward_compatible_mic;
228 
229 #define GLOBUS_GSS_C_NT_HOST_IP gss_nt_host_ip
230 #define GLOBUS_GSS_C_NT_X509 gss_nt_x509
231 
232 extern
233 globus_thread_once_t once_control;
234 
235 void
236 globus_l_gsi_gssapi_activate_once(void);
237 
238 OM_uint32
240  OM_uint32 *minor_status,
241  const gss_ctx_id_t context_handle,
242  const EVP_MD ** hash,
243  const EVP_CIPHER ** cipher);
244 
245 
246 OM_uint32
247 globus_i_gssapi_gsi_gmac(
248  OM_uint32 * minor_status,
249  const EVP_CIPHER * evp_cipher,
250  const unsigned char * iv,
251  const unsigned char * key,
252  const gss_buffer_desc *message_buffer,
253  unsigned char tag[static 16]);
254 
255 #endif /* GSSAPI_OPENSSL_H */
gss_delegation_state_t
Delegation State Type.
Definition: globus_gsi_gss_constants.h:95
globus_thread_once_t once_control
Definition: module.c:100
gss_con_st_t
Connection State Type.
Definition: globus_gsi_gss_constants.h:83
Globus GSI GSS constants.
OM_uint32 globus_i_gss_get_hash(OM_uint32 *minor_status, const gss_ctx_id_t context_handle, const EVP_MD **hash, const EVP_CIPHER **cipher)
Find the hash and cipher functions used by a context.
Definition: get_hash.c:8