openvas-krb5.h File Reference

#include <stdbool.h>
#include <stddef.h>

Include dependency graph for openvas-krb5.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures
struct	OKrb5Slice
struct	OKrb5User
struct	OKrb5Target
struct	OKrb5Credential

Macros
#define	OPENVAS_KRB5_CACHED   1
#define	okrb5_slice_from_str(str)
#define	okrb5_set_slice_from_str(slice, str)

Typedefs
typedef struct OKrb5GSSContext	OKrb5GSSContext

Enumerations
enum	OKrb5ErrorCode {   O_KRB5_SUCCESS , O_KRB5_CONF_NOT_FOUND , O_KRB5_CONF_NOT_CREATED , O_KRB5_TMP_CONF_NOT_CREATED ,   O_KRB5_TMP_CONF_NOT_MOVED , O_KRB5_REALM_NOT_FOUND , O_KRB5_EXPECTED_NULL , O_KRB5_EXPECTED_NOT_NULL ,   O_KRB5_UNABLE_TO_WRITE , O_KRB5_NOMEM , O_KRB5_ERROR }

Functions
OKrb5ErrorCode	o_krb5_find_kdc (const OKrb5Credential *creds, char **kdc)
OKrb5ErrorCode	o_krb5_add_realm (const OKrb5Credential *creds, const char *kdc)
OKrb5ErrorCode	o_krb5_gss_session_key_context (struct OKrb5GSSContext *gss_context, struct OKrb5Slice **out)
struct OKrb5GSSContext *	okrb5_gss_init_context (void)
void	okrb5_gss_free_context (struct OKrb5GSSContext *context)
OKrb5ErrorCode	o_krb5_gss_prepare_context (const OKrb5Credential *creds, struct OKrb5GSSContext *gss_context)
OKrb5ErrorCode	o_krb5_gss_update_context (struct OKrb5GSSContext *gss_context, const struct OKrb5Slice *in_data, struct OKrb5Slice **out_data, bool *more)
char *	okrb5_error_code_to_string (const OKrb5ErrorCode code)

Macro Definition Documentation

okrb5_set_slice_from_str

#define okrb5_set_slice_from_str	(		slice,
			str )

Value:

  do                                              \
    {                                             \
      slice.data = (void *) str;                  \
      slice.len = str == NULL ? 0 : strlen (str); \
    }                                             \
  while (0)

Definition at line 86 of file openvas-krb5.h.

#define okrb5_set_slice_from_str(slice, str)      \
  do                                              \
    {                                             \
      slice.data = (void *) str;                  \
      slice.len = str == NULL ? 0 : strlen (str); \
    }                                             \
  while (0)

Referenced by build_krb5_credential().

okrb5_slice_from_str

#define okrb5_slice_from_str

(

str

)

Value:

  (struct OKrb5Slice)                                           \
  {                                                             \
    .data = (void *) str, .len = str == NULL ? 0 : strlen (str) \
  }

Definition at line 80 of file openvas-krb5.h.

#define okrb5_slice_from_str(str)                               \
  (struct OKrb5Slice)                                           \
  {                                                             \
    .data = (void *) str, .len = str == NULL ? 0 : strlen (str) \
  }

OPENVAS_KRB5_CACHED

#define OPENVAS_KRB5_CACHED   1

Definition at line 14 of file openvas-krb5.h.

Typedef Documentation

OKrb5GSSContext

typedef struct OKrb5GSSContext OKrb5GSSContext

Definition at line 94 of file openvas-krb5.h.

Enumeration Type Documentation

OKrb5ErrorCode

enum OKrb5ErrorCode

Enumerator
O_KRB5_SUCCESS
O_KRB5_CONF_NOT_FOUND
O_KRB5_CONF_NOT_CREATED
O_KRB5_TMP_CONF_NOT_CREATED
O_KRB5_TMP_CONF_NOT_MOVED
O_KRB5_REALM_NOT_FOUND
O_KRB5_EXPECTED_NULL
O_KRB5_EXPECTED_NOT_NULL
O_KRB5_UNABLE_TO_WRITE
O_KRB5_NOMEM
O_KRB5_ERROR

Definition at line 16 of file openvas-krb5.h.

{
  O_KRB5_SUCCESS,
  // Is returned when the krb5.conf was not found
  O_KRB5_CONF_NOT_FOUND,
  O_KRB5_CONF_NOT_CREATED,
  O_KRB5_TMP_CONF_NOT_CREATED,
  O_KRB5_TMP_CONF_NOT_MOVED,
  O_KRB5_REALM_NOT_FOUND,
  O_KRB5_EXPECTED_NULL,
  O_KRB5_EXPECTED_NOT_NULL,
  O_KRB5_UNABLE_TO_WRITE,
  // can only happen when GFP_ATOMIC is set on the kernel.
  O_KRB5_NOMEM,
 
  // Is an transitive error code to indicate an error originating from the
  // underlying krb5 implementation. It must be last and can not check by equals
  // operation as each krb5 error return will be added with that number
  // representation,
  O_KRB5_ERROR,
} OKrb5ErrorCode;

Function Documentation

o_krb5_add_realm()

OKrb5ErrorCode o_krb5_add_realm	(	const OKrb5Credential *	creds,
		const char *	kdc )

Definition at line 247 of file openvas-krb5.c.

{
  OKrb5ErrorCode result = O_KRB5_SUCCESS;
  FILE *file = NULL, *tmp = NULL;
  char line[MAX_LINE_LENGTH] = {0};
  char tmpfn[MAX_LINE_LENGTH] = {0};
  int state, i;
  char *cp = (char *) creds->config_path.data;
 
  if ((file = fopen (cp, "r")) == NULL)
    {
      if ((file = fopen (cp, "w")) == NULL)
        {
          result = O_KRB5_CONF_NOT_CREATED;
          goto result;
        }
      CHECK_FPRINT (result, file, "[realms]\n");
      o_krb5_write_realm (file, creds, kdc);
      goto result;
    }
  snprintf (tmpfn, MAX_LINE_LENGTH, "%s.tmp", cp);
  if ((tmp = fopen (tmpfn, "w")) == NULL)
    {
      result = O_KRB5_TMP_CONF_NOT_CREATED;
      goto result;
    }
  state = 0;
  while (fgets (line, MAX_LINE_LENGTH, file))
    {
      fputs (line, tmp);
      if (state == 0)
        {
          SKIP_WS (line, MAX_LINE_LENGTH, 0, i);
          if (IS_STR_EQUAL (line, MAX_LINE_LENGTH, i, "[realms]", 8) == 1)
            {
              o_krb5_write_realm (file, creds, kdc);
 
              state = 1;
            }
        }
    }
 
  if (rename (tmpfn, cp) != 0)
    {
      result = O_KRB5_TMP_CONF_NOT_MOVED;
    }
 
result:
  if (tmp != NULL)
    fclose (tmp);
  if (file != NULL)
    fclose (file);
  return result;
}

References CHECK_FPRINT, OKrb5Credential::config_path, OKrb5Slice::data, IS_STR_EQUAL, MAX_LINE_LENGTH, O_KRB5_CONF_NOT_CREATED, O_KRB5_SUCCESS, O_KRB5_TMP_CONF_NOT_CREATED, O_KRB5_TMP_CONF_NOT_MOVED, o_krb5_write_realm(), and SKIP_WS.

Referenced by build_krb5_credential(), and nasl_okrb5_add_realm().

Here is the call graph for this function:

Here is the caller graph for this function:

o_krb5_find_kdc()

OKrb5ErrorCode o_krb5_find_kdc	(	const OKrb5Credential *	creds,
		char **	kdc )

Definition at line 85 of file openvas-krb5.c.

{
  OKrb5ErrorCode result = O_KRB5_REALM_NOT_FOUND;
  char line[MAX_LINE_LENGTH];
  int state = 0;
  size_t last_element;
  size_t i, j;
  FILE *file = NULL;
 
  // we don't know if we should free it or just override it.
  // aborting instead.
  GUARD_NULL (*kdc, result);
  if ((file = fopen ((char *) creds->config_path.data, "r")) == NULL)
    {
      result = O_KRB5_CONF_NOT_FOUND;
      goto result;
    }
 
  while (fgets (line, MAX_LINE_LENGTH, file))
    {
      line[strcspn (line, "\n")] = 0;
      last_element = strlen (line) - 1;
      SKIP_WS (line, last_element, 0, i);
      if (line[i] == '[' && line[last_element] == ']')
        {
          if (state != 0)
            {
              result = O_KRB5_REALM_NOT_FOUND;
              goto result;
            }
          if (IS_STR_EQUAL (line, last_element + 1, i, "[realms]", 8) == 1)
            {
              state = 1;
            }
        }
      else
        {
          if (line[i] == '}' || line[last_element] == '}')
            {
              state = 1;
            }
          else if (state == 1)
            {
              for (j = i; j <= last_element; j++)
                {
                  if (line[j] != ((char *) creds->realm.data)[j - i])
                    {
                      state = 2;
                      break;
                    }
                  if (j - i >= creds->realm.len)
                    {
                      break;
                    }
                }
              if (j - i == creds->realm.len)
                {
                  state = 3;
                }
            }
          else if (state == 3)
            {
              if (IS_STR_EQUAL (line, last_element + 1, i, "kdc", 3))
                {
                  SKIP_WS (line, last_element, i + 3, i);
                  if (line[i] == '=')
                    {
                      SKIP_WS (line, last_element, i + 1, i);
                      ALLOCATE_AND_CHECK (*kdc, char, (last_element - i) + 1,
                                          result);
                      for (j = i; j <= last_element; j++)
                        {
                          (*kdc)[j - i] = line[j];
                        }
 
                      result = O_KRB5_SUCCESS;
                      goto result;
                    }
                }
            }
        }
    }
 
result:
  if (file != NULL)
    {
      fclose (file);
    }
  return result;
}

References ALLOCATE_AND_CHECK, OKrb5Credential::config_path, OKrb5Slice::data, GUARD_NULL, IS_STR_EQUAL, OKrb5Slice::len, MAX_LINE_LENGTH, O_KRB5_CONF_NOT_FOUND, O_KRB5_REALM_NOT_FOUND, O_KRB5_SUCCESS, OKrb5Credential::realm, and SKIP_WS.

Referenced by build_krb5_credential(), and nasl_okrb5_find_kdc().

Here is the caller graph for this function:

o_krb5_gss_prepare_context()

OKrb5ErrorCode o_krb5_gss_prepare_context	(	const OKrb5Credential *	creds,
		struct OKrb5GSSContext *	gss_context )

Definition at line 445 of file openvas-krb5.c.

{
  char *target_principal_str = NULL;
  OKrb5ErrorCode result = O_KRB5_SUCCESS;
 
  gss_name_t gss_target = GSS_C_NO_NAME;
  OM_uint32 maj_stat;
  OM_uint32 min_stat;
  gss_buffer_desc targetbuf = GSS_C_EMPTY_BUFFER;
  const struct OKrb5Target *target = &creds->target;
 
  if (gss_context->gss_creds == GSS_C_NO_CREDENTIAL)
    {
      if ((result = okrb5_gss_authenticate (creds, gss_context)))
        {
          goto result;
        }
    }
 
  if (target->domain.len != 0)
    {
      ALLOCATE_AND_CHECK (target_principal_str, char,
                          target->host_name.len + target->domain.len
                            + target->service.len + creds->realm.len + 4,
                          result);
      sprintf (target_principal_str, "%s/%s/%s@%s",
               (char *) target->service.data, (char *) target->host_name.data,
               (char *) target->domain.data, (char *) creds->realm.data);
    }
  else
    {
      ALLOCATE_AND_CHECK (target_principal_str, char,
                          target->host_name.len + target->service.len
                            + creds->realm.len + 3,
                          result);
      sprintf (target_principal_str, "%s/%s@%s", (char *) target->service.data,
               (char *) target->host_name.data, (char *) creds->realm.data);
    }
 
  targetbuf = (gss_buffer_desc){
    .value = target_principal_str,
    .length = strlen (target_principal_str),
  };
 
  maj_stat = gss_import_name (&min_stat, &targetbuf,
                              // might also be GSS_C_NT_HOSTBASED_SERVICE,
                              // but samba uses GSS_C_NT_USER_NAME
                              GSS_C_NT_USER_NAME, &gss_target);
  if (maj_stat != GSS_S_COMPLETE)
    {
      result = O_KRB5_ERROR + maj_stat;
      goto result;
    }
 
  gss_context->gss_target = gss_target;
  // gss_set_neg_mechs() already specified that we want gss_mech_krb5
  // and/or gss_mech_iakerb
  // so we use spnego to do the negotiation
  gss_context->gss_mech = gss_mech_spnego;
  gss_context->gss_want_flags = GSS_C_MUTUAL_FLAG | GSS_C_DELEG_POLICY_FLAG
                                | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG
                                | GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG;
  gss_context->gss_got_flags = 0;
  gss_context->gss_channel_bindings = GSS_C_NO_CHANNEL_BINDINGS;
  gss_context->gss_time_req = 0;
  gss_context->gss_time_rec = 0;
  gss_context->gss_actual_mech_type = NULL;
result:
  if (target_principal_str != NULL)
    free (target_principal_str);
 
  return result;
}

References ALLOCATE_AND_CHECK, OKrb5Slice::data, OKrb5Target::domain, free(), OKrb5GSSContext::gss_actual_mech_type, OKrb5GSSContext::gss_channel_bindings, OKrb5GSSContext::gss_creds, OKrb5GSSContext::gss_got_flags, OKrb5GSSContext::gss_mech, gss_mech_spnego, OKrb5GSSContext::gss_target, OKrb5GSSContext::gss_time_rec, OKrb5GSSContext::gss_time_req, OKrb5GSSContext::gss_want_flags, OKrb5Target::host_name, OKrb5Slice::len, O_KRB5_ERROR, O_KRB5_SUCCESS, okrb5_gss_authenticate(), OKrb5Credential::realm, OKrb5Target::service, and OKrb5Credential::target.

Referenced by nasl_okrb5_gss_prepare_context().

Here is the call graph for this function:

Here is the caller graph for this function:

o_krb5_gss_session_key_context()

OKrb5ErrorCode o_krb5_gss_session_key_context	(	struct OKrb5GSSContext *	gss_context,
		struct OKrb5Slice **	out )

Definition at line 563 of file openvas-krb5.c.

{
  OM_uint32 maj_stat;
  OM_uint32 min_stat;
  OKrb5ErrorCode result = O_KRB5_SUCCESS;
  gss_OID_desc gse_sesskey_inq_oid = {
    GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH,
    (void *) GSS_KRB5_INQ_SSPI_SESSION_KEY_OID,
  };
  gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
 
  maj_stat = gss_inquire_sec_context_by_oid (&min_stat, gss_context->gss_ctx,
                                             &gse_sesskey_inq_oid, &set);
  if (maj_stat != GSS_S_COMPLETE)
    {
      result = O_KRB5_ERROR + maj_stat;
      goto result;
    }
 
  if ((set == GSS_C_NO_BUFFER_SET) || (set->count == 0)
      || (set->elements[0].length == 0))
    {
      result = O_KRB5_ERROR + GSS_S_BAD_SIG;
      goto result;
    }
 
  *out = calloc (1, sizeof (struct OKrb5Slice));
  (*out)->data = malloc (set->elements[0].length);
  memcpy ((*out)->data, set->elements[0].value, set->elements[0].length);
  (*out)->len = set->elements[0].length;
  gss_release_buffer_set (&min_stat, &set);
result:
  return result;
}

References OKrb5GSSContext::gss_ctx, GSS_KRB5_INQ_SSPI_SESSION_KEY_OID, GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH, malloc(), O_KRB5_ERROR, and O_KRB5_SUCCESS.

Referenced by nasl_okrb5_gss_session_key_context().

Here is the call graph for this function:

Here is the caller graph for this function:

o_krb5_gss_update_context()

OKrb5ErrorCode o_krb5_gss_update_context	(	struct OKrb5GSSContext *	gss_context,
		const struct OKrb5Slice *	in_data,
		struct OKrb5Slice **	out_data,
		bool *	more )

Definition at line 521 of file openvas-krb5.c.

{
  OM_uint32 maj_stat;
  OM_uint32 min_stat;
  OKrb5ErrorCode result = O_KRB5_SUCCESS;
  gss_buffer_desc in_buf = {
    .length = in_data->len,
    .value = in_data->data,
  };
  gss_buffer_desc out_buf = GSS_C_EMPTY_BUFFER;
 
  maj_stat = gss_init_sec_context (
    &min_stat, gss_context->gss_creds, &gss_context->gss_ctx,
    gss_context->gss_target, gss_context->gss_mech, gss_context->gss_want_flags,
    gss_context->gss_time_req, gss_context->gss_channel_bindings, &in_buf,
    &gss_context->gss_actual_mech_type, &out_buf, &gss_context->gss_got_flags,
    &gss_context->gss_time_rec);
  if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED)
    {
      result = O_KRB5_ERROR + maj_stat;
      goto result;
    }
  if ((*out_data = malloc (sizeof (struct OKrb5Slice))) == NULL)
    {
      result = O_KRB5_NOMEM;
      gss_release_buffer (&min_stat, &out_buf);
      goto result;
    }
  // transfers ownership of out_buf.value into out_data->data.
  // This simplifies the code as we don't have to alloc and check if the system
  // had sufficient memory and don't have to memcpy.
  (*out_data)->data = out_buf.value;
  (*out_data)->len = out_buf.length;
 
  *more = maj_stat == GSS_S_CONTINUE_NEEDED;
result:
  return result;
}

References OKrb5Slice::data, OKrb5GSSContext::gss_actual_mech_type, OKrb5GSSContext::gss_channel_bindings, OKrb5GSSContext::gss_creds, OKrb5GSSContext::gss_ctx, OKrb5GSSContext::gss_got_flags, OKrb5GSSContext::gss_mech, OKrb5GSSContext::gss_target, OKrb5GSSContext::gss_time_rec, OKrb5GSSContext::gss_time_req, OKrb5GSSContext::gss_want_flags, OKrb5Slice::len, malloc(), O_KRB5_ERROR, O_KRB5_NOMEM, and O_KRB5_SUCCESS.

Referenced by nasl_okrb5_gss_update_context().

Here is the call graph for this function:

Here is the caller graph for this function:

okrb5_error_code_to_string()

char * okrb5_error_code_to_string

(

const OKrb5ErrorCode

code

)

Definition at line 600 of file openvas-krb5.c.

{
#define HEAP_STRING(var, s)              \
  do                                     \
    {                                    \
      var = calloc (1, strlen (s) + 1);  \
      snprintf (var, strlen (s) + 1, s); \
      goto result;                       \
    }                                    \
  while (0)
 
  char *result = NULL;
  switch (code)
    {
    case O_KRB5_SUCCESS:
      HEAP_STRING (result, "success");
    case O_KRB5_CONF_NOT_FOUND:
      HEAP_STRING (result, "krb5.conf not found");
    case O_KRB5_CONF_NOT_CREATED:
      HEAP_STRING (result, "krb5.conf not created");
    case O_KRB5_TMP_CONF_NOT_CREATED:
      HEAP_STRING (result, "tmp krb5.conf not created");
    case O_KRB5_TMP_CONF_NOT_MOVED:
      HEAP_STRING (result, "tmp krb5.conf not moved");
    case O_KRB5_REALM_NOT_FOUND:
      HEAP_STRING (result, "realm not found");
    case O_KRB5_EXPECTED_NULL:
      HEAP_STRING (result, "expected null");
    case O_KRB5_EXPECTED_NOT_NULL:
      HEAP_STRING (result, "expected not null");
    case O_KRB5_UNABLE_TO_WRITE:
      HEAP_STRING (result, "unable to write");
    case O_KRB5_NOMEM:
      HEAP_STRING (result, "no memory");
    default:
      if (code >= O_KRB5_ERROR)
        {
          int maj_stat = code - O_KRB5_ERROR;
          OM_uint32 min_stat;
          gss_buffer_desc msg;
          OM_uint32 msg_ctx = 0;
 
          (void) gss_display_status (&min_stat, maj_stat, GSS_C_GSS_CODE,
                                     GSS_C_NULL_OID, &msg_ctx, &msg);
          // Instead of calling gss_release_buffer, we transfer ownership of
          // msg.value (a heap-allocated string) directly to result.
          // The caller is responsible for freeing result later, this conforms
          // to other values as well.
          //
          // msg itself is stack-allocated, but msg.value is dynamically
          // allocated, so we must not call gss_release_buffer on msg after
          // ownership transfer.
          result = msg.value;
        }
      else
        {
          goto result;
        }
    }
result:
  return result;
}

References code, HEAP_STRING, O_KRB5_CONF_NOT_CREATED, O_KRB5_CONF_NOT_FOUND, O_KRB5_ERROR, O_KRB5_EXPECTED_NOT_NULL, O_KRB5_EXPECTED_NULL, O_KRB5_NOMEM, O_KRB5_REALM_NOT_FOUND, O_KRB5_SUCCESS, O_KRB5_TMP_CONF_NOT_CREATED, O_KRB5_TMP_CONF_NOT_MOVED, and O_KRB5_UNABLE_TO_WRITE.

Referenced by nasl_okrb5_error_code_to_string().

Here is the caller graph for this function:

okrb5_gss_free_context()

void okrb5_gss_free_context

(

struct OKrb5GSSContext *

context

)

Definition at line 405 of file openvas-krb5.c.

{
  OM_uint32 min_stat;
  if (context != NULL)
    {
      if (context->gss_creds != GSS_C_NO_CREDENTIAL)
        {
          gss_release_cred (&min_stat, &context->gss_creds);
        }
      if (context->gss_ctx != GSS_C_NO_CONTEXT)
        {
          gss_delete_sec_context (&min_stat, &context->gss_ctx, GSS_C_NO_BUFFER);
        }
      if (context->gss_target != GSS_C_NO_NAME)
        {
          gss_release_name (&min_stat, &context->gss_target);
        }
      if (context->gss_mech != NULL)
        {
          gss_release_oid (&min_stat, &context->gss_mech);
        }
      if (context->gss_channel_bindings != GSS_C_NO_CHANNEL_BINDINGS)
        {
          gss_release_buffer (
            NULL, &context->gss_channel_bindings->initiator_address);
          gss_release_buffer (&min_stat,
                              &context->gss_channel_bindings->acceptor_address);
          gss_release_buffer (&min_stat,
                              &context->gss_channel_bindings->application_data);
          free (context->gss_channel_bindings);
        }
      if (context->gss_actual_mech_type != NULL)
        {
          gss_release_oid (&min_stat, &context->gss_actual_mech_type);
        }
      free (context);
    }
}

References free(), OKrb5GSSContext::gss_actual_mech_type, OKrb5GSSContext::gss_channel_bindings, OKrb5GSSContext::gss_creds, OKrb5GSSContext::gss_ctx, OKrb5GSSContext::gss_mech, and OKrb5GSSContext::gss_target.

Referenced by nasl_okrb5_clean().

Here is the call graph for this function:

Here is the caller graph for this function:

okrb5_gss_init_context()

struct OKrb5GSSContext * okrb5_gss_init_context

(

void

)

Definition at line 392 of file openvas-krb5.c.

{
  struct OKrb5GSSContext *context = calloc (1, sizeof (struct OKrb5GSSContext));
  if (context == NULL)
    {
      return NULL;
    }
  context->gss_creds = GSS_C_NO_CREDENTIAL;
  context->gss_ctx = GSS_C_NO_CONTEXT;
  return context;
}

References OKrb5GSSContext::gss_creds, and OKrb5GSSContext::gss_ctx.

Referenced by nasl_okrb5_gss_init(), and nasl_okrb5_gss_prepare_context().

Here is the caller graph for this function: