pdns/gss_context.hh

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22 #ifndef GSS_CONTEXT_HH
  23 #define GSS_CONTEXT_HH
  24 #pragma once
  25
  26 #ifdef ENABLE_GSS_TSIG
  27 #include <gssapi/gssapi.h>
  28 #include <gssapi/gssapi_krb5.h>
  29 #include <gssapi/gssapi_ext.h>
  30 #endif
  31
  32 //! Generic errors
  33 enum GssContextError {
  34   GSS_CONTEXT_NO_ERROR,
  35   GSS_CONTEXT_UNSUPPORTED,
  36   GSS_CONTEXT_NOT_FOUND,
  37   GSS_CONTEXT_NOT_INITIALIZED,
  38   GSS_CONTEXT_INVALID,
  39   GSS_CONTEXT_EXPIRED,
  40   GSS_CONTEXT_ALREADY_INITIALIZED
  41 };
  42
  43 //! GSS context types
  44 enum GssContextType {
  45   GSS_CONTEXT_NONE,
  46   GSS_CONTEXT_INIT,
  47   GSS_CONTEXT_ACCEPT
  48 };
  49
  50 class GssSecContext;
  51
  52 /*! Class for representing GSS names, such as host/host.domain.com@REALM.
  53 */
  54 class GssName {
  55 public:
  56   //! Initialize to empty name
  57   GssName() {
  58     setName("");
  59   };
  60
  61   //! Initialize using specific name
  62   GssName(const std::string& name) {
  63     setName(name);
  64   };
  65
  66   //! Parse name into native representation
  67   bool setName(const std::string& name) {
  68 #ifdef ENABLE_GSS_TSIG
  69     gss_buffer_desc buffer;
  70     d_name = GSS_C_NO_NAME;
  71
  72     if (!name.empty()) {
  73       buffer.length = name.size();
  74       buffer.value = (void*)name.c_str();
  75       d_maj = gss_import_name(&d_min, &buffer, (gss_OID)GSS_KRB5_NT_PRINCIPAL_NAME, &d_name);
  76       return d_maj == GSS_S_COMPLETE;
  77     }
  78
  79     return true;
  80 #endif
  81     return false;
  82   };
  83
  84   ~GssName() {
  85 #ifdef ENABLE_GSS_TSIG
  86      if (d_name != GSS_C_NO_NAME)
  87        gss_release_name(&d_min, &d_name);
  88 #endif
  89   };
  90
  91   //! Compare two Gss Names, if no gss support is compiled in, returns false always
  92   //! This is not necessarily same as string comparison between two non-parsed names
  93   bool operator==(const GssName& rhs) {
  94 #ifdef ENABLE_GSS_TSIG
  95     OM_uint32 maj,min;
  96     int result;
  97     maj = gss_compare_name(&min, d_name, rhs.d_name, &result);
  98     return (maj == GSS_S_COMPLETE && result != 0);
  99 #endif
 100     return false;
 101   }
 102
 103   //! Compare two Gss Names, if no gss support is compiled in, returns false always
 104   //! This is not necessarily same as string comparison between two non-parsed names
 105   bool match(const std::string& name) {
 106 #ifdef ENABLE_GSS_TSIG
 107     OM_uint32 maj,min;
 108     int result;
 109     gss_name_t comp;
 110     gss_buffer_desc buffer;
 111     buffer.length = name.size();
 112     buffer.value = (void*)name.c_str();
 113     maj = gss_import_name(&min, &buffer, (gss_OID)GSS_KRB5_NT_PRINCIPAL_NAME, &comp);
 114     if (maj != GSS_S_COMPLETE)
 115       throw PDNSException("Could not import " + name + ": " + std::to_string(maj) + string(",") + std::to_string(min));
 116     // do comparison
 117     maj = gss_compare_name(&min, d_name, comp, &result);
 118     gss_release_name(&min, &comp);
 119     return (maj == GSS_S_COMPLETE && result != 0);
 120 #else
 121    return false;
 122 #endif
 123   };
 124
 125   //! Check if GSS name was parsed successfully.
 126   bool valid() {
 127 #ifdef ENABLE_GSS_TSIG
 128     return d_maj == GSS_S_COMPLETE;
 129 #else
 130     return false;
 131 #endif
 132   }
 133 private:
 134 #ifdef ENABLE_GSS_TSIG
 135   OM_uint32 d_maj,d_min;
 136   gss_name_t d_name;
 137 #endif
 138 };
 139
 140 class GssContext {
 141 public:
 142   static bool supported(); //<! Returns true if GSS is supported in the first place
 143   GssContext(); //<! Construct new GSS context with random name
 144   GssContext(const DNSName& label); //<! Create or open existing named context
 145
 146   void setLocalPrincipal(const std::string& name); //<! Set our gss name
 147   bool getLocalPrincipal(std::string& name); //<! Get our name
 148   void setPeerPrincipal(const std::string& name); //<! Set remote name (do not use after negotiation)
 149   bool getPeerPrincipal(std::string &name); //<! Return remote name, returns actual name after negotiation
 150
 151   void generateLabel(const std::string& suffix); //<! Generate random context name using suffix (such as mydomain.com)
 152   void setLabel(const DNSName& label); //<! Set context name to this label
 153   const DNSName& getLabel() { return d_label; } //<! Return context name
 154
 155   bool init(const std::string &input, std::string& output); //<! Perform GSS Initiate Security Context handshake
 156   bool accept(const std::string &input, std::string& output); //<! Perform GSS Accept Security Context handshake
 157   bool destroy(); //<! Release the cached context
 158   bool expired(); //<! Check if context is expired
 159   bool valid(); //<! Check if context is valid
 160
 161   bool sign(const std::string &input, std::string& output); //<! Sign something using gss
 162   bool verify(const std::string &input, const std::string &signature); //<! Validate gss signature with something
 163
 164   GssContextError getError(); //<! Get error
 165   const std::vector<std::string> getErrorStrings() { return d_gss_errors; } //<! Get native error texts
 166  private:
 167   void release(); //<! Release context
 168   void initialize(); //<! Initialize context
 169 #ifdef ENABLE_GSS_TSIG
 170   void processError(const string& method, OM_uint32 maj, OM_uint32 min); //<! Process and fill error text vector
 171 #endif
 172   DNSName d_label; //<! Context name
 173   std::string d_peerPrincipal; //<! Remote name
 174   std::string d_localPrincipal; //<! Our name
 175   GssContextError d_error; //<! Context error
 176   GssContextType d_type; //<! Context type
 177   std::vector<std::string> d_gss_errors; //<! Native error string(s)
 178   boost::shared_ptr<GssSecContext> d_ctx; //<! Attached security context
 179 };
 180
 181 bool gss_add_signature(const DNSName& context, const std::string& message, std::string& mac); //<! Create signature
 182 bool gss_verify_signature(const DNSName& context, const std::string& message, const std::string& mac); //<! Validate signature
 183
 184 #endif