gssapi_link.c revision ec5347e2c775f027573ce5648b910361aa926c01
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Copyright (C) 2000-2002 Internet Software Consortium.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Permission to use, copy, modify, and/or distribute this software for any
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * purpose with or without fee is hereby granted, provided that the above
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * copyright notice and this permission notice appear in all copies.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * PERFORMANCE OF THIS SOFTWARE.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * $Id: gssapi_link.c,v 1.6 2007/06/18 23:47:40 tbox Exp $
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Allocate a temporary "context" for use in gathering data for signing
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * or verifying.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrewsgssapi_create_signverify_ctx(dst_key_t *key, dst_context_t *dctx) {
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews ctx = isc_mem_get(dctx->mctx, sizeof(dst_gssapi_signverifyctx_t));
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews result = isc_buffer_allocate(dctx->mctx, &ctx->buffer,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews isc_mem_put(dctx->mctx, ctx, sizeof(dst_gssapi_signverifyctx_t));
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Destroy the temporary sign/verify context.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrewsgssapi_destroy_signverify_ctx(dst_context_t *dctx) {
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews dst_gssapi_signverifyctx_t *ctx = dctx->ctxdata.gssctx;
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews isc_mem_put(dctx->mctx, ctx, sizeof(dst_gssapi_signverifyctx_t));
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Add data to our running buffer of data we will be signing or verifying.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * This code will see if the new data will fit in our existing buffer, and
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * copy it in if it will. If not, it will attempt to allocate a larger
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * buffer and copy old+new into it, and free the old buffer.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrewsgssapi_adddata(dst_context_t *dctx, const isc_region_t *data) {
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews dst_gssapi_signverifyctx_t *ctx = dctx->ctxdata.gssctx;
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews unsigned int length;
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews result = isc_buffer_copyregion(ctx->buffer, data);
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews length = isc_buffer_length(ctx->buffer) + data->length + BUFFER_EXTRA;
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews result = isc_buffer_allocate(dctx->mctx, &newbuffer, length);
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrewsgssapi_sign(dst_context_t *dctx, isc_buffer_t *sig) {
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews dst_gssapi_signverifyctx_t *ctx = dctx->ctxdata.gssctx;
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews gss_ctx_id_t gssctx = dctx->key->keydata.gssctx;
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Convert the data we wish to sign into a structure gssapi can
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * understand.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Generate the signature.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews gret = gss_get_mic(&minor, gssctx, GSS_C_QOP_DEFAULT, &gmessage,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * If it did not complete, we log the result and return a generic
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * failure code.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews gss_error_tostring(gret, minor, buf, sizeof(buf)));
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * If it will not fit in our allocated buffer, return that we need
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * more space.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews if (gsig.length > isc_buffer_availablelength(sig)) {
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Copy the output into our buffer space, and release the gssapi
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * allocated space.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews isc_buffer_putmem(sig, gsig.value, gsig.length);
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrewsgssapi_verify(dst_context_t *dctx, const isc_region_t *sig) {
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews dst_gssapi_signverifyctx_t *ctx = dctx->ctxdata.gssctx;
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews gss_ctx_id_t gssctx = dctx->key->keydata.gssctx;
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews unsigned char *buf;
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Convert the data we wish to sign into a structure gssapi can
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * understand.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * It seem that gss_verify_mic() modifies the signature buffer,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * at least on Heimdal's implementation. Copy it here to an allocated
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews buf = isc_mem_allocate(dst__memory_pool, sig->length);
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Verify the data.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews gret = gss_verify_mic(&minor, gssctx, &gmessage, &gsig, NULL);
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews * Convert return codes into something useful to us.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews gss_error_tostring(gret, minor, err, sizeof(err)));
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrewsgssapi_compare(const dst_key_t *key1, const dst_key_t *key2) {
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews /* No idea */
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews /* No idea */