mech_dummy/mech/dmech.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 1995, 2011, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * A module that implements a dummy security mechanism.
 * It's mainly used to test GSS-API application. Multiple tokens
 * exchanged during security context establishment can be
 * specified through dummy_mech.conf located in /etc.
 *
 */
/* EXPORT DELETE START */ /* CRYPT DELETE START */
#ifndef lint
#define dummy_gss_accept_sec_context \
        dummy_867227349
#define dummy_gss_acquire_cred \
        dummy_352458907
#define dummy_gss_add_cred \
        dummy_911432290
#define dummy_gss_compare_name \
        dummy_396663848
#define dummy_gss_context_time \
        dummy_955669998
#define dummy_gss_delete_sec_context \
        dummy_440868788
#define dummy_gss_display_name \
        dummy_999874939
#define dummy_gss_display_status \
        dummy_485073729
#define dummy_gss_export_sec_context \
        dummy_1044079879
#define dummy_gss_import_name \
        dummy_529311438
#define dummy_gss_import_sec_context \
        dummy_14542996
#define dummy_gss_indicate_mechs \
        dummy_573516378
#define dummy_gss_init_sec_context \
        dummy_58780705
#define dummy_gss_inquire_context \
        dummy_617721319
#define dummy_gss_inquire_cred \
        dummy_102985645
#define dummy_gss_inquire_cred_by_mech \
        dummy_661926260
#define dummy_gss_inquire_names_for_mech \
        dummy_147190586
#define dummy_gss_internal_release_oid \
        dummy_706163968
#define dummy_gss_process_context_token \
        dummy_191395526
#define dummy_gss_release_cred \
        dummy_750368909
#define dummy_gss_release_name \
        dummy_235600467
#define dummy_gss_seal \
        dummy_794573849
#define dummy_gss_sign \
        dummy_279838176
#define dummy_gss_unseal \
        dummy_838778790
#define dummy_gss_verify \
        dummy_324010348
#define dummy_gss_wrap_size_limit \
        dummy_882983731
#define dummy_pname_to_uid \
        dummy_345475423
#endif
/* EXPORT DELETE END */ /* CRYPT DELETE END */

#include <stdio.h>
#include <stdlib.h>
#include <gssapiP_dummy.h>
#include <mglueP.h>
#include <gssapiP_generic.h>
#include <gssapi_err_generic.h>

/*
 * Solaris Kerberos: XXX this should be cleaned up along with gssapiP_generic.h
 */
#undef g_token_size
#undef g_verify_token_header
#undef g_make_token_header

#define dummy_context_name_len  19
/* private routines for dummy_mechanism */
static dummy_token_t make_dummy_token(char *name);
static void free_dummy_token(dummy_token_t *token);
static gss_buffer_desc make_dummy_token_buffer(char *name);
static gss_buffer_desc make_dummy_token_msg(void *data, int datalen);
static int der_length_size(int length);
static void der_write_length(unsigned char ** buf, int length);
static int der_read_length(unsigned char **buf, int *bufsize);
static int g_token_size(gss_OID mech, unsigned int body_size);
static void g_make_token_header(gss_OID mech, int body_size,
                unsigned char **buf, int tok_type);
static int g_verify_token_header(gss_OID mech, int *body_size,
                unsigned char **buf_in, int tok_type,
                int toksize);


/* private global variables */
static char dummy_srcname[] = "dummy source";
static OM_uint32 dummy_flags;
static int token_nums;

/*
 * The Mech OID:
 * { iso(1) org(3) internet(6) dod(1) private(4) enterprises(1) sun(42)
 *  products(2) gssapi(26) mechtypes(1) dummy(2) }
 */
static struct gss_config dummy_mechanism =
    {{10, "\053\006\001\004\001\052\002\032\001\002"},
    NULL, /* context */
    dummy_gss_acquire_cred,
    dummy_gss_release_cred,
    dummy_gss_init_sec_context,
    dummy_gss_accept_sec_context,
    dummy_gss_process_context_token,
    dummy_gss_delete_sec_context,
    dummy_gss_context_time,
    NULL, /* gss_get_mic */
    NULL, /* gss_verify_mic */
/* EXPORT DELETE START */ /* CRYPT DELETE START */
    dummy_gss_seal,
    dummy_gss_unseal,
/* EXPORT DELETE END */ /* CRYPT DELETE END */
    dummy_gss_display_status,
    dummy_gss_indicate_mechs,
    dummy_gss_compare_name,
    dummy_gss_display_name,
    dummy_gss_import_name,
    dummy_gss_release_name,
    dummy_gss_inquire_cred,
    dummy_gss_add_cred,
    dummy_gss_export_sec_context,
    dummy_gss_import_sec_context,
    dummy_gss_inquire_cred_by_mech,
    dummy_gss_inquire_names_for_mech,
    dummy_gss_inquire_context,
    dummy_gss_internal_release_oid,
    dummy_gss_wrap_size_limit,
    dummy_pname_to_uid,
    NULL,   /* __gss_userok */
    NULL,   /* _export name */
/* EXPORT DELETE START */
/* CRYPT DELETE START */
#if 0
/* CRYPT DELETE END */
    dummy_gss_seal,
    dummy_gss_unseal,
/* CRYPT DELETE START */
#endif
/* CRYPT DELETE END */
/* EXPORT DELETE END */
    dummy_gss_sign,
    dummy_gss_verify,
    NULL,   /* _store_cred */
    NULL, /* gss_inquire_sec_context_by_oid */
    NULL, /* gss_inquire_cred_by_oid */
    NULL, /* gss_set_sec_context_option */
    NULL, /* gssspi_set_cred_option */
    NULL, /* gssspi_mech_invoke */
/* EXPORT DELETE START */ /* CRYPT DELETE START */
    NULL, /* wrap_aead */
    NULL, /* unwrap_aead */
    NULL, /* Solaris Kerberos: no gss_wrap_iov */
    NULL, /* Solaris Kerberos: no gss_unwrap_iov */
    NULL, /* Solaris Kerberos: no gss_wrap_iov_length */
/* EXPORT DELETE END */ /* CRYPT DELETE END */
    NULL, /* complete_auth_token */
    NULL, /* gss_acquire_cred_impersonate_name */
    NULL, /* krb5_gss_add_cred_impersonate_name */
    NULL, /* display_name_ext */
    NULL, /* gss_inquire_name */
    NULL, /* gss_get_name_attribute */
    NULL, /* gss_set_name_attribute */
    NULL, /* gss_delete_name_attribute */
    NULL, /* gss_export_name_composite */
    NULL, /* gss_map_name_to_any */
    NULL, /* gss_release_any_name_mapping */
    NULL, /* Solaris Kerberos no gss_pseudo_random */
    NULL, /* set_neg_mechs */
};

gss_mechanism
gss_mech_initialize(oid)
const gss_OID oid;
{
    FILE *fp;

    dprintf("Entering gss_mech_initialize\n");

    if (oid == NULL ||
        !g_OID_equal(oid, &dummy_mechanism.mech_type)) {
        fprintf(stderr, "invalid dummy mechanism oid.\n");
        return (NULL);
    }

    fp = fopen("/etc/dummy_mech_token.conf", "rF");
    if (fp == NULL) {
        fprintf(stderr, "dummy_mech.conf is not found.\n");
        fprintf(stderr, "Setting number tokens exchanged to 1\n");
        token_nums = 1;
    } else {
        fscanf(fp, "%d", &token_nums);
        fclose(fp);
        dprintf("dummy_mech.conf is found.\n");
        dprintf1("Setting number tokens exchanged to %d\n", token_nums);
    }

    if (token_nums == 1)
        dummy_flags = GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG;
    else
        dummy_flags = GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG
                | GSS_C_MUTUAL_FLAG;

    dprintf("Leaving gss_mech_initialize\n");
    return (&dummy_mechanism);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_acquire_cred(minor_status, desired_name, time_req, desired_mechs,
            cred_usage, output_cred_handle,
            actual_mechs, time_rec)
    OM_uint32 *minor_status;
    gss_name_t desired_name;
    OM_uint32 time_req;
    gss_OID_set desired_mechs;
    gss_cred_usage_t cred_usage;
    gss_cred_id_t *output_cred_handle;
    gss_OID_set *actual_mechs;
    OM_uint32 *time_rec;
{
    dprintf("Entering dummy_gss_acquire_cred\n");

    if (actual_mechs)
        *actual_mechs = NULL;
    if (time_rec)
        *time_rec = 0;

    *output_cred_handle = (gss_cred_id_t)
                make_dummy_token("dummy_gss_acquire_cred");
    if (time_rec)  /* user may pass a null pointer */
        *time_rec = GSS_C_INDEFINITE;
    if (actual_mechs) {
        if (gssint_copy_oid_set(minor_status, gss_mech_set_dummy,
                actual_mechs) == GSS_S_FAILURE) {
            return (GSS_S_FAILURE);
        }
    }

    dprintf("Leaving dummy_gss_acquire_cred\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_release_cred(minor_status, cred_handle)
    OM_uint32 *minor_status;
    gss_cred_id_t *cred_handle;
{
    dprintf("Entering dummy_gss_release_cred\n");

    free_dummy_token((dummy_token_t *)(cred_handle));
    *cred_handle = NULL;

    dprintf("Leaving dummy_gss_release_cred\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_init_sec_context(minor_status, claimant_cred_handle,
                context_handle, target_name, mech_type,
                req_flags, time_req, input_chan_bindings,
                input_token, actual_mech_type, output_token,
                ret_flags, time_rec)
    OM_uint32 *minor_status;
    gss_cred_id_t claimant_cred_handle;
    gss_ctx_id_t *context_handle;
    gss_name_t target_name;
    gss_OID mech_type;
    OM_uint32 req_flags;
    OM_uint32 time_req;
    gss_channel_bindings_t input_chan_bindings;
    gss_buffer_t input_token;
    gss_OID *actual_mech_type;
    gss_buffer_t output_token;
    OM_uint32 *ret_flags;
    OM_uint32 *time_rec;
{
    dummy_gss_ctx_id_t ctx;
    char token_string[64];
    OM_uint32 ret;
    OM_uint32 aret;
    int send_token = 0;

    dprintf("Entering init_sec_context\n");

    output_token->length = 0;
    output_token->value = NULL;
    if (actual_mech_type)
        *actual_mech_type = NULL;

    if (*context_handle == GSS_C_NO_CONTEXT) {

        if (input_token != NULL && input_token->value != NULL)
            return (GSS_S_FAILURE);

        ctx = (dummy_gss_ctx_id_t)malloc(sizeof (dummy_gss_ctx_id_rec));
        ctx->established = 0;
        ctx->last_stat = 0xffffffff;
        *context_handle = (gss_ctx_id_t)ctx;
        /*
         * Initiator interpretation of config file. If 2 or more
         * the client returns CONTINUE_NNED on the first call.
         */
        if (token_nums >= 2) {
            ret = GSS_S_CONTINUE_NEEDED;
        } else {
            ret = GSS_S_COMPLETE;
        }
        send_token = 1;
    } else {
        unsigned char *ptr;
        int bodysize;
        int err;

        if (input_token == NULL || input_token->value == NULL) {
            ctx->last_stat = GSS_S_FAILURE;
            return (GSS_S_FAILURE);
        }

        ctx = (dummy_gss_ctx_id_t)(*context_handle);


        ptr = (unsigned char *) input_token->value;
        if (err = g_verify_token_header((gss_OID)gss_mech_dummy,
            &bodysize, &ptr, 0, input_token->length)) {

            *minor_status = err;
            ctx->last_stat = GSS_S_DEFECTIVE_TOKEN;
            return (GSS_S_DEFECTIVE_TOKEN);
        }

        if (sscanf((char *)ptr, "%d", &aret) < 1) {
            *minor_status = 1;
            ctx->last_stat = GSS_S_DEFECTIVE_TOKEN;
            return (GSS_S_DEFECTIVE_TOKEN);
        }

        if (aret == GSS_S_CONTINUE_NEEDED) {
            if (ctx->last_stat == GSS_S_COMPLETE) {
                /*
                 * RFC 2078, page 36, under GSS_S_COMPLETE
                 * says that acceptor (target) has sufficient
                 * information to perform per-message
                 * processing. So if initiator previously
                 * returned GSS_S_COMPLETE, and acceptor
                 * says he needs more, then we have
                 * a problem.
                 */
                ctx->last_stat = GSS_S_FAILURE;
                return (GSS_S_FAILURE);
            }
            ret = GSS_S_CONTINUE_NEEDED;
            send_token = 1;
        } else {
            ret = GSS_S_COMPLETE;
            send_token = 0;
        }
    }
    if (ret_flags)  /* user may pass a null pointer */
        *ret_flags = dummy_flags;
    if (time_rec)  /* user may pass a null pointer */
        *time_rec = GSS_C_INDEFINITE;
    if (actual_mech_type)
        *actual_mech_type = (gss_OID) gss_mech_dummy;

    if (send_token == 1) {
        sprintf(token_string, "%d", ret);

        *output_token = make_dummy_token_msg(
                token_string, strlen(token_string) + 1);
    } else {
        *output_token = make_dummy_token_msg(NULL, 0);
    }

    if (ret == GSS_S_COMPLETE)
        ctx->established = 1;

    ctx->last_stat = ret;
    return (ret);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_accept_sec_context(minor_status, context_handle,
                verifier_cred_handle, input_token,
                input_chan_bindings, src_name, mech_type,
                output_token, ret_flags, time_rec,
                delegated_cred_handle)
    OM_uint32 *minor_status;
    gss_ctx_id_t *context_handle;
    gss_cred_id_t verifier_cred_handle;
    gss_buffer_t input_token;
    gss_channel_bindings_t input_chan_bindings;
    gss_name_t *src_name;
    gss_OID *mech_type;
    gss_buffer_t output_token;
    OM_uint32 *ret_flags;
    OM_uint32 *time_rec;
    gss_cred_id_t *delegated_cred_handle;
{
    dummy_gss_ctx_id_t ctx;
    char token_string[64];
    gss_buffer_desc name;
    OM_uint32 status;
    gss_name_t temp;
    unsigned char *ptr;
    int bodysize;
    int err;
    OM_uint32 iret;
    int return_token = 0;

    dprintf("Entering accept_sec_context\n");

    if (src_name)
        *src_name = (gss_name_t)NULL;
    output_token->length = 0;
    output_token->value = NULL;
    if (mech_type)
        *mech_type = GSS_C_NULL_OID;
    /* return a bogus cred handle */
    if (delegated_cred_handle)
        *delegated_cred_handle = GSS_C_NO_CREDENTIAL;

    /* Check for defective input token. */
    ptr = (unsigned char *) input_token->value;
    if (err = g_verify_token_header((gss_OID)gss_mech_dummy, &bodysize,
                    &ptr, 0,
                    input_token->length)) {
        *minor_status = err;
        return (GSS_S_DEFECTIVE_TOKEN);
    }

    if (sscanf((char *)ptr, "%d", &iret) < 1) {
        *minor_status = 1;
        return (GSS_S_DEFECTIVE_TOKEN);
    }

    if (*context_handle == GSS_C_NO_CONTEXT) {
        ctx = (dummy_gss_ctx_id_t)malloc(sizeof (dummy_gss_ctx_id_rec));
        ctx->token_number = token_nums;
        ctx->established = 0;
        *context_handle = (gss_ctx_id_t)ctx;
    } else {
        ctx = (dummy_gss_ctx_id_t)(*context_handle);
    }

    if (ret_flags)  /* user may pass a null pointer */
        *ret_flags = dummy_flags;
    if (time_rec)  /* user may pass a null pointer */
        *time_rec = GSS_C_INDEFINITE;
    if (mech_type)
        *mech_type = (gss_OID)gss_mech_dummy;

    /*
     * RFC 2078, page 36, under GSS_S_COMPLETE, GSS_S_CONTINUE_NEEDED
     * tells us whether to return a token or not.
     */

    if (iret == GSS_S_CONTINUE_NEEDED)
        return_token = 1;
    else
        return_token = 0;


    if (ctx->token_number > 1) {
        /*
         * RFC 2078, page 36, under GSS_S_COMPLETE, says that if
         * initiator is done, the target (us) has what it needs, so
         * it must return GSS_S_COMPLETE;
         */
        if (iret == GSS_S_CONTINUE_NEEDED)
            status = GSS_S_CONTINUE_NEEDED;
        else
            status = GSS_S_COMPLETE;

    } else
        status = GSS_S_COMPLETE;

    /* source name is ready at GSS_S_COMPLELE */
    if ((status == GSS_S_COMPLETE) && src_name) {
        name.length = strlen(dummy_srcname);
        name.value = dummy_srcname;
        status = dummy_gss_import_name(minor_status, &name,
                (gss_OID)GSS_C_NT_USER_NAME, &temp);
        if (status != GSS_S_COMPLETE) {
            free(*context_handle);
            *context_handle = GSS_C_NO_CONTEXT;
            return (status);
        }
        *src_name = temp;
    }

    if (status == GSS_S_COMPLETE) {
        ctx->established = 1;
    }

    if (return_token == 1) {
        sprintf(token_string, "%d", status);

        *output_token = make_dummy_token_msg(
                token_string, strlen(token_string) + 1);
    } else {
        *output_token = make_dummy_token_msg(NULL, 0);
    }

    if (ctx->token_number > 0)
        ctx->token_number--;

    return (status);
}


/*ARGSUSED*/
OM_uint32
dummy_gss_process_context_token(minor_status, context_handle, token_buffer)
    OM_uint32 *minor_status;
    gss_ctx_id_t context_handle;
    gss_buffer_t token_buffer;
{
    dprintf("In process_sec_context\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_delete_sec_context(minor_status, context_handle, output_token)
    OM_uint32 *minor_status;
    gss_ctx_id_t *context_handle;
    gss_buffer_t output_token;
{
    dummy_gss_ctx_id_t ctx;

    dprintf("Entering delete_sec_context\n");

    /* Make the length to 0, so the output token is not sent to peer */
    if (output_token) {
        output_token->length = 0;
        output_token->value = NULL;
    }

    if (*context_handle == GSS_C_NO_CONTEXT) {
        *minor_status = 0;
        return (GSS_S_COMPLETE);
    }

    ctx = (dummy_gss_ctx_id_t)*context_handle;
    free(ctx);
    *context_handle = GSS_C_NO_CONTEXT;

    dprintf("Leaving delete_sec_context\n");
    return (GSS_S_COMPLETE);
}


/*ARGSUSED*/
OM_uint32
dummy_gss_context_time(minor_status, context_handle, time_rec)
    OM_uint32 *minor_status;
    gss_ctx_id_t context_handle;
    OM_uint32 *time_rec;
{
    dprintf("In context_time\n");
    if (time_rec)  /* user may pass a null pointer */
        return (GSS_S_FAILURE);
    else
        *time_rec = GSS_C_INDEFINITE;
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_sign(minor_status, context_handle,
        qop_req, message_buffer, message_token)
    OM_uint32 *minor_status;
    gss_ctx_id_t context_handle;
    int qop_req;
    gss_buffer_t message_buffer;
    gss_buffer_t message_token;
{
    char token_string[] = "dummy_gss_sign";
    dummy_gss_ctx_id_t context;

    dprintf("Entering gss_sign\n");

    context = (dummy_gss_ctx_id_t)(context_handle);
    if (context_handle == GSS_C_NO_CONTEXT)
        return (GSS_S_NO_CONTEXT);
    if (!context->established)
        return (GSS_S_NO_CONTEXT);

    *message_token = make_dummy_token_msg(
            token_string, strlen(token_string));

    dprintf("Leaving gss_sign\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_verify(minor_status, context_handle,
        message_buffer, token_buffer, qop_state)
    OM_uint32 *minor_status;
    gss_ctx_id_t context_handle;
    gss_buffer_t message_buffer;
    gss_buffer_t token_buffer;
    int *qop_state;
{
    unsigned char *ptr;
    int bodysize;
    int err;
    dummy_gss_ctx_id_t context;

    dprintf("Entering gss_verify\n");

    context = (dummy_gss_ctx_id_t)(context_handle);
    if (context_handle == GSS_C_NO_CONTEXT)
        return (GSS_S_NO_CONTEXT);
    if (!context->established)
        return (GSS_S_NO_CONTEXT);

    /* Check for defective input token. */
    ptr = (unsigned char *) token_buffer->value;
    if (err = g_verify_token_header((gss_OID)gss_mech_dummy, &bodysize,
                    &ptr, 0,
                    token_buffer->length)) {
        *minor_status = err;
        return (GSS_S_DEFECTIVE_TOKEN);
    }

    if (qop_state)
        *qop_state = GSS_C_QOP_DEFAULT;

    dprintf("Leaving gss_verify\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_seal(minor_status, context_handle, conf_req_flag,
        qop_req, input_message_buffer, conf_state,
        output_message_buffer)
    OM_uint32 *minor_status;
    gss_ctx_id_t context_handle;
    int conf_req_flag;
    int qop_req;
    gss_buffer_t input_message_buffer;
    int *conf_state;
    gss_buffer_t output_message_buffer;
{
    gss_buffer_desc output;
    dummy_gss_ctx_id_t context;

    dprintf("Entering gss_seal\n");

    context = (dummy_gss_ctx_id_t)(context_handle);
    if (context_handle == GSS_C_NO_CONTEXT)
        return (GSS_S_NO_CONTEXT);
    if (!context->established)
        return (GSS_S_NO_CONTEXT);

    /* Copy the input message to output message */
    output = make_dummy_token_msg(
        input_message_buffer->value, input_message_buffer->length);

    if (conf_state)
        *conf_state = 1;

    *output_message_buffer = output;

    dprintf("Leaving gss_seal\n");
    return (GSS_S_COMPLETE);
}


/*ARGSUSED*/
OM_uint32
dummy_gss_unseal(minor_status, context_handle,
        input_message_buffer, output_message_buffer,
        conf_state, qop_state)
    OM_uint32 *minor_status;
    gss_ctx_id_t context_handle;
    gss_buffer_t input_message_buffer;
    gss_buffer_t output_message_buffer;
    int *conf_state;
    int *qop_state;
{
    gss_buffer_desc output;
    unsigned char *ptr;
    int bodysize;
    int err;
    dummy_gss_ctx_id_t context;

    dprintf("Entering gss_unseal\n");

    context = (dummy_gss_ctx_id_t)(context_handle);
    if (context_handle == GSS_C_NO_CONTEXT)
        return (GSS_S_NO_CONTEXT);
    if (!context->established)
        return (GSS_S_NO_CONTEXT);

    ptr = (unsigned char *) input_message_buffer->value;
    if (err = g_verify_token_header((gss_OID)gss_mech_dummy, &bodysize,
                    &ptr, 0,
                    input_message_buffer->length)) {
        *minor_status = err;
        return (GSS_S_DEFECTIVE_TOKEN);
    }
    output.length = bodysize;
    output.value = (void *)malloc(output.length);
    memcpy(output.value, ptr, output.length);

    *output_message_buffer = output;
    if (qop_state)
        *qop_state = GSS_C_QOP_DEFAULT;
    if (conf_state)
        *conf_state = 1;

    dprintf("Leaving gss_unseal\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_display_status(minor_status, status_value, status_type,
            mech_type, message_context, status_string)
    OM_uint32 *minor_status;
    OM_uint32 status_value;
    int status_type;
    gss_OID mech_type;
    OM_uint32 *message_context;
    gss_buffer_t status_string;
{
    dprintf("Entering display_status\n");

    *message_context = 0;
    *status_string = make_dummy_token_buffer("dummy_gss_display_status");

    dprintf("Leaving display_status\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_indicate_mechs(minor_status, mech_set)
    OM_uint32 *minor_status;
    gss_OID_set *mech_set;
{
    dprintf("Entering indicate_mechs\n");

    *minor_status = 0;
    if (mech_set) {
        if (gssint_copy_oid_set(minor_status, gss_mech_set_dummy,
                mech_set) == GSS_S_FAILURE) {
            return (GSS_S_FAILURE);
        }
    }

    dprintf("Leaving indicate_mechs\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_compare_name(minor_status, name1, name2, name_equal)
    OM_uint32 *minor_status;
    gss_name_t name1;
    gss_name_t name2;
    int *name_equal;
{
    dummy_name_t name_1 = (dummy_name_t)name1;
    dummy_name_t name_2 = (dummy_name_t)name2;

    dprintf("Entering compare_name\n");

    if (g_OID_equal(name_1->type, name_2->type) &&
    (name_1->buffer->length == name_2->buffer->length) &&
    !memcmp(name_1->buffer->value, name_2->buffer->value,
    name_1->buffer->length))
        *name_equal = 1;
    else
        *name_equal = 0;

    dprintf("Leaving compare_name\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_display_name(minor_status, input_name, output_name_buffer,
            output_name_type)
    OM_uint32 *minor_status;
    gss_name_t input_name;
    gss_buffer_t output_name_buffer;
    gss_OID *output_name_type;
{
    OM_uint32 status = GSS_S_COMPLETE;
    dummy_name_t name = (dummy_name_t)input_name;

    dprintf("Entering display_name\n");

    if (g_OID_equal(name->type, GSS_C_NT_USER_NAME) ||
    g_OID_equal(name->type, GSS_C_NT_MACHINE_UID_NAME) ||
    g_OID_equal(name->type, GSS_C_NT_STRING_UID_NAME) ||
    g_OID_equal(name->type, GSS_C_NT_HOSTBASED_SERVICE)) {
/*
 *      output_name_buffer = (gss_buffer_t)
 *                  malloc(sizeof (gss_buffer_desc));
 */
        if (output_name_buffer == NULL)
            return (GSS_S_FAILURE);

        output_name_buffer->length = name->buffer->length;
        output_name_buffer->value = (void *)
                        malloc(name->buffer->length);
        if (output_name_buffer->value == NULL)
            return (GSS_S_FAILURE);

        memcpy(output_name_buffer->value, name->buffer->value,
            name->buffer->length);
        if (output_name_type)
            *output_name_type = name->type;

        dprintf("Leaving display_name\n");
        return (status);
    }

    dprintf("Leaving display_name\n");
    return (GSS_S_BAD_NAMETYPE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_import_name(minor_status, input_name_buffer,
            input_name_type, output_name)
    OM_uint32 *minor_status;
    gss_buffer_t input_name_buffer;
    gss_OID input_name_type;
    gss_name_t *output_name;
{
    OM_uint32 status;

    dprintf("Entering import_name\n");

    *output_name = NULL;
    *minor_status = 0;

    if (input_name_type == GSS_C_NULL_OID)
        return (GSS_S_BAD_NAMETYPE);

    if (g_OID_equal(input_name_type, GSS_C_NT_USER_NAME) ||
    g_OID_equal(input_name_type, GSS_C_NT_MACHINE_UID_NAME) ||
    g_OID_equal(input_name_type, GSS_C_NT_STRING_UID_NAME) ||
    g_OID_equal(input_name_type, GSS_C_NT_HOSTBASED_SERVICE)) {
        dummy_name_t name = (dummy_name_t)
                    malloc(sizeof (dummy_name_desc));
        name->buffer = (gss_buffer_t)malloc(sizeof (gss_buffer_desc));
        name->buffer->length = input_name_buffer->length;
        name->buffer->value = (void *)malloc(input_name_buffer->length);
        if (name->buffer->value == NULL)
            return (GSS_S_FAILURE);

        memcpy(name->buffer->value, input_name_buffer->value,
                input_name_buffer->length);

        status = generic_gss_copy_oid(minor_status,
        input_name_type, &(name->type));
        *output_name = (gss_name_t)name;
        dprintf("Leaving import_name\n");
        return (status);
    }
    dprintf("Leaving import_name\n");
    return (GSS_S_BAD_NAMETYPE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_release_name(minor_status, input_name)
    OM_uint32 *minor_status;
    gss_name_t *input_name;
{
    dummy_name_t name = (dummy_name_t)*input_name;

    dprintf("Entering release_name\n");
    free(name->buffer->value);
    generic_gss_release_oid(minor_status, &(name->type));
    free(name->buffer);
    free(name);
    dprintf("Leaving release_name\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
            cred_usage, mechanisms)
    OM_uint32 *minor_status;
    gss_cred_id_t cred_handle;
    gss_name_t *name;
    OM_uint32 *lifetime_ret;
    gss_cred_usage_t *cred_usage;
    gss_OID_set *mechanisms;
{
    dprintf("Entering inquire_cred\n");
    if (name)
        *name = (gss_name_t)make_dummy_token
                ("dummy gss credential");
    if (lifetime_ret)
        *lifetime_ret = GSS_C_INDEFINITE;
    if (cred_usage)
        *cred_usage = GSS_C_BOTH;
    if (mechanisms) {
        if (gssint_copy_oid_set(minor_status, gss_mech_set_dummy,
                mechanisms) == GSS_S_FAILURE)
            return (GSS_S_FAILURE);
    }

    dprintf("Leaving inquire_cred\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_add_cred(minor_status, input_cred_handle,
            desired_name, desired_mech, cred_usage,
            initiator_time_req, acceptor_time_req,
            output_cred_handle, actual_mechs,
            initiator_time_rec, acceptor_time_rec)
    OM_uint32 *minor_status;
    gss_cred_id_t input_cred_handle;
    gss_name_t desired_name;
    gss_OID desired_mech;
    gss_cred_usage_t cred_usage;
    OM_uint32 initiator_time_req;
    OM_uint32 acceptor_time_req;
    gss_cred_id_t *output_cred_handle;
    gss_OID_set *actual_mechs;
    OM_uint32 *initiator_time_rec;
    OM_uint32 *acceptor_time_rec;
{
    dprintf("Entering add_cred\n");

    if ((desired_mech != GSS_C_NULL_OID) &&
    (g_OID_equal(desired_mech, gss_mech_dummy)))
        return (GSS_S_BAD_MECH);
    *minor_status = 0;

    dprintf("Leaving add_cred\n");

    /* This routine likes in kerberos V5 is never be used / called by */
    /* the GSS_API. It simply returns GSS_S_DUPLICATE_ELEMENT to indicate */
    /* this error */

    return (GSS_S_DUPLICATE_ELEMENT);
}

/* Should I add the token structure to deal with import/export */
/* of sec_context. For now, I just create dummy interprocess token, and when */
/* the peer accept it, it calls the import_sec_context.The import_sec_context */
/* creates new sec_context with status established. (rather than get it */
/* from interprocess token. it can be done because the sec context in dummy */
/* mechanism is very simple (contains only status if it's established). */
/*ARGSUSED*/
OM_uint32
dummy_gss_export_sec_context(minor_status, context_handle,
                interprocess_token)
    OM_uint32 *minor_status;
    gss_ctx_id_t *context_handle;
    gss_buffer_t interprocess_token;
{
    char str[] = "dummy_gss_export_sec_context";

    dprintf("Entering export_sec_context\n");

    *interprocess_token = make_dummy_token_msg(str, strlen(str));
    free(*context_handle);
    *context_handle = GSS_C_NO_CONTEXT;

    dprintf("Leaving export_sec_context\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_import_sec_context(minor_status, interprocess_token,
                context_handle)
OM_uint32 *minor_status;
gss_buffer_t interprocess_token;
gss_ctx_id_t *context_handle;
{
    /* Assume that we got ctx from the interprocess token. */
    dummy_gss_ctx_id_t ctx;

    dprintf("Entering import_sec_context\n");

    ctx = (dummy_gss_ctx_id_t)malloc(sizeof (dummy_gss_ctx_id_rec));
    ctx->token_number = 0;
    ctx->established = 1;

    *context_handle = (gss_ctx_id_t)ctx;

    dprintf("Leaving import_sec_context\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_inquire_cred_by_mech(minor_status, cred_handle,
                mech_type, name, initiator_lifetime,
                acceptor_lifetime, cred_usage)
    OM_uint32 *minor_status;
    gss_cred_id_t cred_handle;
    gss_OID mech_type;
    gss_name_t *name;
    OM_uint32 *initiator_lifetime;
    OM_uint32 *acceptor_lifetime;
    gss_cred_usage_t *cred_usage;
{
    dprintf("Entering inquire_cred_by_mech\n");
    if (name)
        *name = (gss_name_t)make_dummy_token("dummy credential name");
    if (initiator_lifetime)
        *initiator_lifetime = GSS_C_INDEFINITE;
    if (acceptor_lifetime)
        *acceptor_lifetime = GSS_C_INDEFINITE;
    if (cred_usage)
        *cred_usage = GSS_C_BOTH;

    dprintf("Leaving inquire_cred_by_mech\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_inquire_names_for_mech(minor_status, mechanism, name_types)
    OM_uint32   *minor_status;
    gss_OID     mechanism;
    gss_OID_set *name_types;
{
    OM_uint32   major, minor;

    dprintf("Entering inquire_names_for_mech\n");
    /*
     * We only know how to handle our own mechanism.
     */
    if ((mechanism != GSS_C_NULL_OID) &&
    !g_OID_equal(gss_mech_dummy, mechanism)) {
        *minor_status = 0;
        return (GSS_S_FAILURE);
    }

    major = gss_create_empty_oid_set(minor_status, name_types);
    if (major == GSS_S_COMPLETE) {
        /* Now add our members. */
        if (((major = gss_add_oid_set_member(minor_status,
            (gss_OID) GSS_C_NT_USER_NAME, name_types))
        == GSS_S_COMPLETE) &&
        ((major = gss_add_oid_set_member(minor_status,
            (gss_OID) GSS_C_NT_MACHINE_UID_NAME, name_types))
        == GSS_S_COMPLETE) &&
        ((major = gss_add_oid_set_member(minor_status,
            (gss_OID) GSS_C_NT_STRING_UID_NAME, name_types))
        == GSS_S_COMPLETE)) {
            major = gss_add_oid_set_member(minor_status,
            (gss_OID) GSS_C_NT_HOSTBASED_SERVICE, name_types);
        }

        if (major != GSS_S_COMPLETE)
            (void) gss_release_oid_set(&minor, name_types);
    }

    dprintf("Leaving inquire_names_for_mech\n");
    return (major);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_inquire_context(minor_status, context_handle, initiator_name,
            acceptor_name, lifetime_rec, mech_type, ret_flags,
            locally_initiated, open)
    OM_uint32 *minor_status;
    gss_ctx_id_t context_handle;
    gss_name_t *initiator_name;
    gss_name_t *acceptor_name;
    OM_uint32 *lifetime_rec;
    gss_OID *mech_type;
    OM_uint32 *ret_flags;
    int *locally_initiated;
    int *open;
{
    dummy_gss_ctx_id_t ctx;
    dummy_name_t name1, name2;
    OM_uint32 status;

    dprintf("Entering inquire_context\n");

    ctx = (dummy_gss_ctx_id_t)(context_handle);
    name1 = (dummy_name_t)
                malloc(sizeof (dummy_name_desc));
    name1->buffer = (gss_buffer_t)malloc(sizeof (gss_buffer_desc));
    name1->buffer->length = dummy_context_name_len;
    name1->buffer->value = make_dummy_token("dummy context name");
    status = generic_gss_copy_oid(minor_status,
        (gss_OID) GSS_C_NT_USER_NAME, &(name1->type));
    if (status != GSS_S_COMPLETE)
        return (status);
    if (initiator_name)
        *initiator_name = (gss_name_t)name1;

    name2 = (dummy_name_t)
                malloc(sizeof (dummy_name_desc));
    name2->buffer = (gss_buffer_t)malloc(sizeof (gss_buffer_desc));
    name2->buffer->length = dummy_context_name_len;
    name2->buffer->value = make_dummy_token("dummy context name");
    status = generic_gss_copy_oid(minor_status,
        (gss_OID) GSS_C_NT_USER_NAME, &(name2->type));
    if (status != GSS_S_COMPLETE)
        return (status);
    if (acceptor_name)
        *acceptor_name = (gss_name_t)name2;

    if (lifetime_rec)  /* user may pass a null pointer */
        *lifetime_rec = GSS_C_INDEFINITE;
    if (mech_type)
        *mech_type = (gss_OID)gss_mech_dummy;
    if (ret_flags)
        *ret_flags = dummy_flags;
    if (open)
    *open = ctx->established;

    dprintf("Leaving inquire_context\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_internal_release_oid(minor_status, oid)
    OM_uint32   *minor_status;
    gss_OID     *oid;
{
    dprintf("Entering internal_release_oid\n");

    /* Similar to krb5_gss_internal_release_oid */

    if (*oid != gss_mech_dummy)
        return (GSS_S_CONTINUE_NEEDED); /* We don't know this oid */

    *minor_status = 0;
    *oid = GSS_C_NO_OID;

    dprintf("Leaving internal_release_oid\n");
    return (GSS_S_COMPLETE);
}

/*ARGSUSED*/
OM_uint32
dummy_gss_wrap_size_limit(minor_status, context_handle, conf_req_flag,
                qop_req, req_output_size, max_input_size)
    OM_uint32   *minor_status;
    gss_ctx_id_t    context_handle;
    int     conf_req_flag;
    gss_qop_t   qop_req;
    OM_uint32   req_output_size;
    OM_uint32   *max_input_size;
{
    dprintf("Entering wrap_size_limit\n");
    *max_input_size = req_output_size;
    dprintf("Leaving wrap_size_limit\n");
    return (GSS_S_COMPLETE);
}

/* ARGSUSED */
OM_uint32
dummy_pname_to_uid(minor_status, name, uidOut)
    OM_uint32 *minor_status;
    const gss_name_t name;
    uid_t *uidOut;
{
    dprintf("Entering pname_to_uid\n");
    *minor_status = 0;
    *uidOut = 60001;
    dprintf("Leaving pname_to_uid\n");
    return (GSS_S_COMPLETE);
}

static dummy_token_t
make_dummy_token(char *name)
{
    dummy_token_t token;

    token = (dummy_token_t)malloc(strlen(name)+1);
    strcpy(token, name);
    return (token);
}

static void
free_dummy_token(dummy_token_t *token)
{
    free(*token);
    *token = NULL;
}

static gss_buffer_desc
make_dummy_token_buffer(char *name)
{
    gss_buffer_desc buffer;

    if (name == NULL) {
        buffer.length = 0;
        buffer.value = NULL;
    } else {
        buffer.length = strlen(name)+1;
        buffer.value = make_dummy_token(name);
    }
    return (buffer);
}

static gss_buffer_desc
make_dummy_token_msg(void *data, int dataLen)
{
    gss_buffer_desc buffer;
    int tlen;
    unsigned char *t;
    unsigned char *ptr;

    if (data == NULL) {
        buffer.length = 0;
        buffer.value = NULL;
        return (buffer);
    }

    tlen = g_token_size((gss_OID)gss_mech_dummy, dataLen);
    t = (unsigned char *) malloc(tlen);
    ptr = t;

    g_make_token_header((gss_OID)gss_mech_dummy, dataLen, &ptr, 0);
    memcpy(ptr, data, dataLen);

    buffer.length = tlen;
    buffer.value = (void *) t;
    return (buffer);
}

static int
der_length_size(length)
    int length;
{
    if (length < (1<<7))
        return (1);
    else if (length < (1<<8))
        return (2);
    else if (length < (1<<16))
        return (3);
    else if (length < (1<<24))
        return (4);
    else
        return (5);
}

static void
der_write_length(buf, length)
    unsigned char **buf;
    int length;
{
    if (length < (1<<7)) {
        *(*buf)++ = (unsigned char) length;
    } else {
        *(*buf)++ = (unsigned char) (der_length_size(length)+127);
        if (length >= (1<<24))
            *(*buf)++ = (unsigned char) (length>>24);
        if (length >= (1<<16))
            *(*buf)++ = (unsigned char) ((length>>16)&0xff);
        if (length >= (1<<8))
            *(*buf)++ = (unsigned char) ((length>>8)&0xff);
        *(*buf)++ = (unsigned char) (length&0xff);
    }
}

static int
der_read_length(buf, bufsize)
unsigned char **buf;
int *bufsize;
{
    unsigned char sf;
    int ret;

    if (*bufsize < 1)
        return (-1);

    sf = *(*buf)++;
    (*bufsize)--;
    if (sf & 0x80) {
        if ((sf &= 0x7f) > ((*bufsize)-1))
            return (-1);

        if (sf > DUMMY_SIZE_OF_INT)
            return (-1);
        ret = 0;
        for (; sf; sf--) {
        ret = (ret<<8) + (*(*buf)++);
        (*bufsize)--;
    }
    } else {
        ret = sf;
    }

    return (ret);
}

static int
g_token_size(mech, body_size)
    gss_OID mech;
    unsigned int body_size;
{
    /* set body_size to sequence contents size */
    body_size += 4 + (int)mech->length; /* NEED overflow check */
    return (1 + der_length_size(body_size) + body_size);
}

static void
g_make_token_header(mech, body_size, buf, tok_type)
    gss_OID mech;
    int body_size;
    unsigned char **buf;
    int tok_type;
{
    *(*buf)++ = 0x60;
    der_write_length(buf, 4 + mech->length + body_size);
    *(*buf)++ = 0x06;
    *(*buf)++ = (unsigned char) mech->length;
    TWRITE_STR(*buf, mech->elements, ((int)mech->length));
    *(*buf)++ = (unsigned char) ((tok_type>>8)&0xff);
    *(*buf)++ = (unsigned char) (tok_type&0xff);
}

static int
g_verify_token_header(mech, body_size, buf_in, tok_type, toksize)
gss_OID mech;
int *body_size;
unsigned char **buf_in;
int tok_type;
int toksize;
{
    unsigned char *buf = *buf_in;
    int seqsize;
    gss_OID_desc toid;
    int ret = 0;

    if ((toksize -= 1) < 0)
        return (G_BAD_TOK_HEADER);
    if (*buf++ != 0x60)
        return (G_BAD_TOK_HEADER);

    if ((seqsize = der_read_length(&buf, &toksize)) < 0)
        return (G_BAD_TOK_HEADER);

    if (seqsize != toksize)
        return (G_BAD_TOK_HEADER);

    if ((toksize -= 1) < 0)
        return (G_BAD_TOK_HEADER);
    if (*buf++ != 0x06)
        return (G_BAD_TOK_HEADER);

    if ((toksize -= 1) < 0)
        return (G_BAD_TOK_HEADER);
    toid.length = *buf++;

    if ((toksize -= toid.length) < 0)
        return (G_BAD_TOK_HEADER);
    toid.elements = buf;
    buf += toid.length;

    if (!g_OID_equal(&toid, mech))
        ret = G_WRONG_MECH;

    /*
     * G_WRONG_MECH is not returned immediately because it's more important
     * to return G_BAD_TOK_HEADER if the token header is in fact bad
     */

    if ((toksize -= 2) < 0)
        return (G_BAD_TOK_HEADER);

    if ((*buf++ != ((tok_type>>8)&0xff)) ||
        (*buf++ != (tok_type&0xff)))
        return (G_BAD_TOK_HEADER);

    if (!ret) {
        *buf_in = buf;
        *body_size = toksize;
    }

    return (ret);
}