Loading...
Searching...
No Matches
gssapi_openssl.h
Go to the documentation of this file.
/*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef GSSAPI_OPENSSL_H
#define GSSAPI_OPENSSL_H
#include <stdbool.h>
#include "globus_config.h"
#include "globus_common.h"
#include "gssapi.h"
#include "globus_gsi_gss_constants.h"
#include "globus_gsi_callback.h"
#include "globus_gsi_proxy.h"
#include "globus_gsi_credential.h"
#include <stdio.h>
#include "openssl/ssl.h"
#include "openssl/err.h"
#include "openssl/bio.h"
#include "openssl/pem.h"
#include "openssl/x509.h"
#include "openssl/x509v3.h"
#include "openssl/stack.h"
#define GLOBUS_I_GSI_GSSAPI_IMPL_VERSION 1
#define GSS_I_CTX_INITIALIZED 1
#define GSS_I_DISALLOW_ENCRYPTION 2
#define GSS_I_PROTECTION_FAIL_ON_CONTEXT_EXPIRATION 4
#define GSS_I_APPLICATION_WILL_HANDLE_EXTENSIONS 8
#define GSS_C_QOP_GLOBUS_GSSAPI_OPENSSL_BIG 1
/*
* we need to distinguish between a token
* created by us using get_mic vs one using
* the SSL application data
* We use this in wrap and unwrap
* Future versions of SSL may use this
*
* Our wrapped buffer (integrity only) has
*
* byte type[1] = SSL3_RT_GSSAPI_OPENSSL
* byte version_major[1] = 0x03
* byte version_minor[1] = 0
* byte mic_length[2] = 2 byte length of following mic
*
* byte mic_seq[8] = 8 byte sequence number
* byte mic_data_length[4] = 4 byte length of data
* byte hash[*] = the hash of variable length
*
* byte data[*] = the data being wrapped.
*/
#define SSL3_RT_GSSAPI_OPENSSL 26
/* These conversions macros are taken from SSL */
#define L2N(LONG_VAL, CHAR_ARRAY) \
{ \
unsigned char * _char_array_ = CHAR_ARRAY; \
*(_char_array_++) = (unsigned char) (((LONG_VAL) >> 24) & 0xff); \
*(_char_array_++) = (unsigned char) (((LONG_VAL) >> 16) & 0xff); \
*(_char_array_++) = (unsigned char) (((LONG_VAL) >> 8) & 0xff); \
*(_char_array_++) = (unsigned char) (((LONG_VAL)) & 0xff); \
}
#define N2L(CHAR_ARRAY, LONG_VAL) \
{ \
const unsigned char * _char_array_ = CHAR_ARRAY; \
(LONG_VAL) = ((*(_char_array_++)) << 24) & 0xff000000; \
(LONG_VAL) |= ((*(_char_array_++)) << 16) & 0xff0000; \
(LONG_VAL) |= ((*(_char_array_++)) << 8) & 0xff00; \
(LONG_VAL) |= ((*(_char_array_++)) & 0xff); \
}
#define N2S(CHAR_ARRAY, SHORT) \
{ \
char * _char_array_ = CHAR_ARRAY; \
(SHORT) = ((unsigned int) (*(_char_array_++))) << 8; \
(SHORT) |= ((unsigned int) (*(_char_array_++))); \
}
#define S2N(SHORT, CHAR_ARRAY) \
{ \
char * _char_array_ = CHAR_ARRAY; \
*(_char_array_++) = (unsigned char) (((SHORT) >> 8) & 0xff); \
*(_char_array_++) = (unsigned char) ((SHORT) & 0xff); \
}
#define U642N(U64VAL, CHAR_ARRAY) \
{ \
unsigned char * _char_array_ = CHAR_ARRAY; \
*(_char_array_++) = (unsigned char) (((U64VAL) >> 56) & 0xff); \
*(_char_array_++) = (unsigned char) (((U64VAL) >> 48) & 0xff); \
*(_char_array_++) = (unsigned char) (((U64VAL) >> 40) & 0xff); \
*(_char_array_++) = (unsigned char) (((U64VAL) >> 32) & 0xff); \
*(_char_array_++) = (unsigned char) (((U64VAL) >> 24) & 0xff); \
*(_char_array_++) = (unsigned char) (((U64VAL) >> 16) & 0xff); \
*(_char_array_++) = (unsigned char) (((U64VAL) >> 8) & 0xff); \
*(_char_array_++) = (unsigned char) (((U64VAL) ) & 0xff); \
}
#define N2U64(CHAR_ARRAY, U64VAL) \
{ \
const unsigned char * _char_array_ = CHAR_ARRAY; \
uint64_t _u64val_ = 0; \
_u64val_ = (((uint64_t)(*(_char_array_++))) << 56) & 0xff00000000000000; \
_u64val_ = (((uint64_t)(*(_char_array_++))) << 48) & 0xff000000000000; \
_u64val_ = (((uint64_t)(*(_char_array_++))) << 40) & 0xff0000000000; \
_u64val_ = (((uint64_t)(*(_char_array_++))) << 32) & 0xff00000000; \
_u64val_ = (((uint64_t)(*(_char_array_++))) << 24) & 0xff000000; \
_u64val_ = (((uint64_t)(*(_char_array_++))) << 16) & 0xff0000; \
_u64val_ = (((uint64_t)(*(_char_array_++))) << 8) & 0xff00; \
_u64val_ = (((uint64_t)(*(_char_array_++))) ) & 0xff; \
(U64VAL) = _u64val_; \
}
/* Compare OIDs */
#define g_OID_equal(o1, o2) \
(((o1) == (o2)) || \
((o1) && (o2) && \
((o1)->length == (o2)->length) && \
(memcmp((o1)->elements,(o2)->elements,(int) (o1)->length) == 0)))
typedef struct gss_name_desc_struct {
/* gss_buffer_desc name_buffer ; */
gss_OID name_oid;
X509_NAME * x509n;
char * x509n_oneline;
GENERAL_NAMES * subjectAltNames;
char * user_name;
char * service_name;
char * host_name;
char * ip_address;
char * ip_name;
} gss_name_desc;
typedef struct gss_cred_id_desc_struct {
globus_gsi_cred_handle_t cred_handle;
gss_name_desc * globusid;
gss_cred_usage_t cred_usage;
SSL_CTX * ssl_context;
gss_OID mech;
} gss_cred_id_desc;
typedef struct gss_ctx_id_desc_struct{
globus_mutex_t mutex;
globus_gsi_callback_data_t callback_data;
gss_cred_id_desc * peer_cred_handle;
gss_cred_id_desc * cred_handle;
gss_cred_id_desc * deleg_cred_handle;
globus_gsi_proxy_handle_t proxy_handle;
OM_uint32 ret_flags;
OM_uint32 req_flags;
OM_uint32 ctx_flags;
int cred_obtained;
gss_OID mech;
#if OPENSSL_VERSION_NUMBER >= 0x10000100L
uint64_t mac_read_sequence;
uint64_t mac_write_sequence;
unsigned char * mac_key;
unsigned char * mac_iv_fixed;
#endif
SSL * gss_ssl;
BIO * gss_rbio;
BIO * gss_wbio;
BIO * gss_sslbio;
gss_con_st_t gss_state;
int locally_initiated;
gss_delegation_state_t delegation_state;
gss_OID_set extension_oids;
gss_cred_id_t *sni_credentials;
bool sni_credentials_obtained;
size_t sni_credentials_count;
char *sni_servername;
unsigned char *alpn;
size_t alpn_length;
} gss_ctx_id_desc;
extern
const gss_OID_desc * const gss_mech_globus_gssapi_openssl;
extern
const gss_OID_desc * const gss_mech_globus_gssapi_openssl_micv2;
extern
const gss_OID_desc * const gss_proxycertinfo_extension;
extern
gss_OID_desc * gss_nt_host_ip;
extern
gss_OID_desc * gss_nt_x509;
extern
const gss_OID_desc * const gss_ext_server_name_oid;
extern
const gss_OID_desc * const gss_ext_alpn_oid;
extern
const gss_OID_desc * const gss_ext_tls_version_oid;
extern
const gss_OID_desc * const gss_ext_tls_cipher_oid;
extern
globus_bool_t globus_i_backward_compatible_mic;
extern
globus_bool_t globus_i_accept_backward_compatible_mic;
#define GLOBUS_GSS_C_NT_HOST_IP gss_nt_host_ip
#define GLOBUS_GSS_C_NT_X509 gss_nt_x509
extern
globus_thread_once_t once_control;
void
globus_l_gsi_gssapi_activate_once(void);
OM_uint32
globus_i_gss_get_hash(
OM_uint32 *minor_status,
const gss_ctx_id_t context_handle,
const EVP_MD ** hash,
const EVP_CIPHER ** cipher);
OM_uint32
globus_i_gssapi_gsi_gmac(
OM_uint32 * minor_status,
const EVP_CIPHER * evp_cipher,
const unsigned char * iv,
const unsigned char * key,
const gss_buffer_desc *message_buffer,
unsigned char tag[static 16]);
#endif /* GSSAPI_OPENSSL_H */
globus_gsi_gss_constants.h
Globus GSI GSS constants.
gss_con_st_t
gss_con_st_t
Connection State Type.
Definition globus_gsi_gss_constants.h:98
gss_delegation_state_t
gss_delegation_state_t
Delegation State Type.
Definition globus_gsi_gss_constants.h:111
globus_i_gss_get_hash
OM_uint32 globus_i_gss_get_hash(OM_uint32 *minor_status, const gss_ctx_id_t context_handle, const EVP_MD **hash, const EVP_CIPHER **cipher)
Find the hash and cipher functions used by a context.
Definition get_hash.c:24
once_control
globus_thread_once_t once_control
Definition module.c:121