Importing crypto libraries
- crypto/external/bsd/heimdal - crypto/external/bsd/libsaslc - crypto/external/bsd/netpgp - crypto/external/bsd/openssl Change-Id: I91dbf05f33e637edf5b9bb408d5baddd7ba8cf75
This commit is contained in:
+2970
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,345 @@
|
||||
# Id
|
||||
|
||||
include $(top_srcdir)/Makefile.am.common
|
||||
|
||||
AUTOMAKE_OPTIONS = subdir-objects
|
||||
|
||||
AM_CPPFLAGS += \
|
||||
-I$(srcdir)/../krb5 \
|
||||
-I$(srcdir) \
|
||||
-I$(srcdir)/gssapi \
|
||||
-I$(srcdir)/mech \
|
||||
-I$(srcdir)/ntlm \
|
||||
-I$(srcdir)/krb5 \
|
||||
-I$(srcdir)/spnego \
|
||||
$(INCLUDE_libintl) \
|
||||
$(INCLUDE_hcrypto) \
|
||||
$(INCLUDE_krb4)
|
||||
|
||||
lib_LTLIBRARIES = libgssapi.la
|
||||
|
||||
krb5src = \
|
||||
krb5/8003.c \
|
||||
krb5/accept_sec_context.c \
|
||||
krb5/acquire_cred.c \
|
||||
krb5/add_cred.c \
|
||||
krb5/address_to_krb5addr.c \
|
||||
krb5/aeap.c \
|
||||
krb5/arcfour.c \
|
||||
krb5/canonicalize_name.c \
|
||||
krb5/creds.c \
|
||||
krb5/ccache_name.c \
|
||||
krb5/cfx.c \
|
||||
krb5/cfx.h \
|
||||
krb5/compare_name.c \
|
||||
krb5/compat.c \
|
||||
krb5/context_time.c \
|
||||
krb5/copy_ccache.c \
|
||||
krb5/decapsulate.c \
|
||||
krb5/delete_sec_context.c \
|
||||
krb5/display_name.c \
|
||||
krb5/display_status.c \
|
||||
krb5/duplicate_name.c \
|
||||
krb5/encapsulate.c \
|
||||
krb5/export_name.c \
|
||||
krb5/export_sec_context.c \
|
||||
krb5/external.c \
|
||||
krb5/get_mic.c \
|
||||
krb5/gsskrb5_locl.h \
|
||||
krb5/gsskrb5-private.h \
|
||||
krb5/import_name.c \
|
||||
krb5/import_sec_context.c \
|
||||
krb5/indicate_mechs.c \
|
||||
krb5/init.c \
|
||||
krb5/init_sec_context.c \
|
||||
krb5/inquire_context.c \
|
||||
krb5/inquire_cred.c \
|
||||
krb5/inquire_cred_by_mech.c \
|
||||
krb5/inquire_cred_by_oid.c \
|
||||
krb5/inquire_mechs_for_name.c \
|
||||
krb5/inquire_names_for_mech.c \
|
||||
krb5/inquire_sec_context_by_oid.c \
|
||||
krb5/process_context_token.c \
|
||||
krb5/prf.c \
|
||||
krb5/release_buffer.c \
|
||||
krb5/release_cred.c \
|
||||
krb5/release_name.c \
|
||||
krb5/sequence.c \
|
||||
krb5/store_cred.c \
|
||||
krb5/set_cred_option.c \
|
||||
krb5/set_sec_context_option.c \
|
||||
krb5/ticket_flags.c \
|
||||
krb5/unwrap.c \
|
||||
krb5/verify_mic.c \
|
||||
krb5/wrap.c
|
||||
|
||||
mechsrc = \
|
||||
mech/context.h \
|
||||
mech/context.c \
|
||||
mech/cred.h \
|
||||
mech/doxygen.c \
|
||||
mech/gss_accept_sec_context.c \
|
||||
mech/gss_acquire_cred.c \
|
||||
mech/gss_add_cred.c \
|
||||
mech/gss_add_oid_set_member.c \
|
||||
mech/gss_aeap.c \
|
||||
mech/gss_buffer_set.c \
|
||||
mech/gss_canonicalize_name.c \
|
||||
mech/gss_compare_name.c \
|
||||
mech/gss_context_time.c \
|
||||
mech/gss_create_empty_oid_set.c \
|
||||
mech/gss_cred.c \
|
||||
mech/gss_decapsulate_token.c \
|
||||
mech/gss_delete_name_attribute.c \
|
||||
mech/gss_delete_sec_context.c \
|
||||
mech/gss_display_name.c \
|
||||
mech/gss_display_name_ext.c \
|
||||
mech/gss_display_status.c \
|
||||
mech/gss_duplicate_name.c \
|
||||
mech/gss_duplicate_oid.c \
|
||||
mech/gss_encapsulate_token.c \
|
||||
mech/gss_export_name.c \
|
||||
mech/gss_export_name_composite.c \
|
||||
mech/gss_export_sec_context.c \
|
||||
mech/gss_get_mic.c \
|
||||
mech/gss_get_name_attribute.c \
|
||||
mech/gss_import_name.c \
|
||||
mech/gss_import_sec_context.c \
|
||||
mech/gss_indicate_mechs.c \
|
||||
mech/gss_init_sec_context.c \
|
||||
mech/gss_inquire_context.c \
|
||||
mech/gss_inquire_cred.c \
|
||||
mech/gss_inquire_cred_by_mech.c \
|
||||
mech/gss_inquire_cred_by_oid.c \
|
||||
mech/gss_inquire_mechs_for_name.c \
|
||||
mech/gss_inquire_name.c \
|
||||
mech/gss_inquire_names_for_mech.c \
|
||||
mech/gss_krb5.c \
|
||||
mech/gss_mech_switch.c \
|
||||
mech/gss_mo.c \
|
||||
mech/gss_names.c \
|
||||
mech/gss_oid.c \
|
||||
mech/gss_oid_equal.c \
|
||||
mech/gss_oid_to_str.c \
|
||||
mech/gss_process_context_token.c \
|
||||
mech/gss_pseudo_random.c \
|
||||
mech/gss_release_buffer.c \
|
||||
mech/gss_release_cred.c \
|
||||
mech/gss_release_name.c \
|
||||
mech/gss_release_oid.c \
|
||||
mech/gss_release_oid_set.c \
|
||||
mech/gss_seal.c \
|
||||
mech/gss_set_cred_option.c \
|
||||
mech/gss_set_name_attribute.c \
|
||||
mech/gss_set_sec_context_option.c \
|
||||
mech/gss_sign.c \
|
||||
mech/gss_store_cred.c \
|
||||
mech/gss_test_oid_set_member.c \
|
||||
mech/gss_unseal.c \
|
||||
mech/gss_unwrap.c \
|
||||
mech/gss_utils.c \
|
||||
mech/gss_verify.c \
|
||||
mech/gss_verify_mic.c \
|
||||
mech/gss_wrap.c \
|
||||
mech/gss_wrap_size_limit.c \
|
||||
mech/gss_inquire_sec_context_by_oid.c \
|
||||
mech/mech_switch.h \
|
||||
mech/mechqueue.h \
|
||||
mech/mech_locl.h \
|
||||
mech/name.h \
|
||||
mech/utils.h
|
||||
|
||||
spnegosrc = \
|
||||
spnego/accept_sec_context.c \
|
||||
spnego/compat.c \
|
||||
spnego/context_stubs.c \
|
||||
spnego/cred_stubs.c \
|
||||
spnego/external.c \
|
||||
spnego/init_sec_context.c \
|
||||
spnego/spnego_locl.h \
|
||||
spnego/spnego-private.h
|
||||
|
||||
ntlmsrc = \
|
||||
ntlm/accept_sec_context.c \
|
||||
ntlm/acquire_cred.c \
|
||||
ntlm/add_cred.c \
|
||||
ntlm/canonicalize_name.c \
|
||||
ntlm/compare_name.c \
|
||||
ntlm/context_time.c \
|
||||
ntlm/creds.c \
|
||||
ntlm/crypto.c \
|
||||
ntlm/delete_sec_context.c \
|
||||
ntlm/display_name.c \
|
||||
ntlm/display_status.c \
|
||||
ntlm/duplicate_name.c \
|
||||
ntlm/export_name.c \
|
||||
ntlm/export_sec_context.c \
|
||||
ntlm/external.c \
|
||||
ntlm/ntlm.h \
|
||||
ntlm/ntlm-private.h \
|
||||
ntlm/import_name.c \
|
||||
ntlm/import_sec_context.c \
|
||||
ntlm/indicate_mechs.c \
|
||||
ntlm/init_sec_context.c \
|
||||
ntlm/inquire_context.c \
|
||||
ntlm/inquire_cred_by_mech.c \
|
||||
ntlm/inquire_mechs_for_name.c \
|
||||
ntlm/inquire_names_for_mech.c \
|
||||
ntlm/inquire_sec_context_by_oid.c \
|
||||
ntlm/iter_cred.c \
|
||||
ntlm/process_context_token.c \
|
||||
ntlm/release_cred.c \
|
||||
ntlm/release_name.c \
|
||||
ntlm/kdc.c
|
||||
|
||||
$(srcdir)/ntlm/ntlm-private.h:
|
||||
cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p ntlm/ntlm-private.h $(ntlmsrc) || rm -f ntlm/ntlm-private.h
|
||||
|
||||
dist_libgssapi_la_SOURCES = \
|
||||
$(krb5src) \
|
||||
$(mechsrc) \
|
||||
$(ntlmsrc) \
|
||||
$(spnegosrc)
|
||||
|
||||
nodist_libgssapi_la_SOURCES = \
|
||||
gkrb5_err.c \
|
||||
gkrb5_err.h \
|
||||
$(BUILT_SOURCES)
|
||||
|
||||
libgssapi_la_LDFLAGS = -version-info 3:0:0
|
||||
|
||||
if versionscript
|
||||
libgssapi_la_LDFLAGS += $(LDFLAGS_VERSION_SCRIPT)$(srcdir)/version-script.map
|
||||
endif
|
||||
|
||||
libgssapi_la_LIBADD = \
|
||||
$(top_builddir)/lib/ntlm/libheimntlm.la \
|
||||
$(top_builddir)/lib/krb5/libkrb5.la \
|
||||
$(top_builddir)/lib/asn1/libasn1.la \
|
||||
$(LIB_com_err) \
|
||||
$(LIB_hcrypto) \
|
||||
$(LIBADD_roken)
|
||||
|
||||
man_MANS = gssapi.3 gss_acquire_cred.3 mech/mech.5
|
||||
|
||||
include_HEADERS = gssapi.h
|
||||
noinst_HEADERS = \
|
||||
gssapi_mech.h \
|
||||
ntlm/ntlm-private.h \
|
||||
spnego/spnego-private.h \
|
||||
krb5/gsskrb5-private.h
|
||||
|
||||
nobase_include_HEADERS = \
|
||||
gssapi/gssapi.h \
|
||||
gssapi/gssapi_krb5.h \
|
||||
gssapi/gssapi_ntlm.h \
|
||||
gssapi/gssapi_oid.h \
|
||||
gssapi/gssapi_spnego.h
|
||||
|
||||
gssapidir = $(includedir)/gssapi
|
||||
nodist_gssapi_HEADERS = gkrb5_err.h
|
||||
|
||||
gssapi_files = asn1_GSSAPIContextToken.x
|
||||
|
||||
spnego_files = \
|
||||
asn1_ContextFlags.x \
|
||||
asn1_MechType.x \
|
||||
asn1_MechTypeList.x \
|
||||
asn1_NegotiationToken.x \
|
||||
asn1_NegotiationTokenWin.x \
|
||||
asn1_NegHints.x \
|
||||
asn1_NegTokenInit.x \
|
||||
asn1_NegTokenInitWin.x \
|
||||
asn1_NegTokenResp.x
|
||||
|
||||
BUILTHEADERS = \
|
||||
$(srcdir)/krb5/gsskrb5-private.h \
|
||||
$(srcdir)/spnego/spnego-private.h \
|
||||
$(srcdir)/ntlm/ntlm-private.h
|
||||
|
||||
$(libgssapi_la_OBJECTS): $(BUILTHEADERS)
|
||||
$(test_context_OBJECTS): $(BUILTHEADERS)
|
||||
|
||||
$(libgssapi_la_OBJECTS): $(srcdir)/version-script.map
|
||||
|
||||
BUILT_SOURCES = $(spnego_files:.x=.c) $(gssapi_files:.x=.c)
|
||||
|
||||
CLEANFILES = $(BUILT_SOURCES) \
|
||||
gkrb5_err.h gkrb5_err.c \
|
||||
$(spnego_files) spnego_asn1*.h* spnego_asn1_files spnego_asn1-template.c \
|
||||
$(gssapi_files) gssapi_asn1*.h* gssapi_asn1_files gssapi_asn1-template.c \
|
||||
gss-commands.h gss-commands.c
|
||||
|
||||
$(spnego_files) spnego_asn1.hx spnego_asn1-priv.hx: spnego_asn1_files
|
||||
$(gssapi_files) gssapi_asn1.hx gssapi_asn1-priv.hx: gssapi_asn1_files
|
||||
|
||||
spnego_asn1_files: $(ASN1_COMPILE_DEP) $(srcdir)/spnego/spnego.asn1 $(srcdir)/spnego/spnego.opt
|
||||
$(ASN1_COMPILE) --option-file=$(srcdir)/spnego/spnego.opt $(srcdir)/spnego/spnego.asn1 spnego_asn1
|
||||
|
||||
gssapi_asn1_files: $(ASN1_COMPILE_DEP) $(srcdir)/mech/gssapi.asn1
|
||||
$(ASN1_COMPILE) $(srcdir)/mech/gssapi.asn1 gssapi_asn1
|
||||
|
||||
$(srcdir)/krb5/gsskrb5-private.h:
|
||||
cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p krb5/gsskrb5-private.h $(krb5src) || rm -f krb5/gsskrb5-private.h
|
||||
|
||||
$(srcdir)/spnego/spnego-private.h:
|
||||
cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p spnego/spnego-private.h $(spnegosrc) || rm -f spnego/spnego-private.h
|
||||
|
||||
|
||||
TESTS = test_oid test_names test_cfx
|
||||
# test_sequence
|
||||
|
||||
test_cfx_SOURCES = krb5/test_cfx.c
|
||||
|
||||
check_PROGRAMS = test_acquire_cred $(TESTS)
|
||||
|
||||
bin_PROGRAMS = gsstool
|
||||
noinst_PROGRAMS = test_cred test_kcred test_context test_ntlm
|
||||
|
||||
test_context_SOURCES = test_context.c test_common.c test_common.h
|
||||
test_ntlm_SOURCES = test_ntlm.c test_common.c test_common.h
|
||||
test_acquire_cred_SOURCES = test_acquire_cred.c test_common.c test_common.h
|
||||
|
||||
test_ntlm_LDADD = \
|
||||
$(top_builddir)/lib/ntlm/libheimntlm.la \
|
||||
$(LDADD)
|
||||
|
||||
LDADD = libgssapi.la \
|
||||
$(top_builddir)/lib/krb5/libkrb5.la \
|
||||
$(LIB_roken)
|
||||
|
||||
# gss
|
||||
|
||||
dist_gsstool_SOURCES = gsstool.c
|
||||
nodist_gsstool_SOURCES = gss-commands.c gss-commands.h
|
||||
|
||||
gsstool_LDADD = libgssapi.la \
|
||||
$(top_builddir)/lib/sl/libsl.la \
|
||||
$(top_builddir)/lib/krb5/libkrb5.la \
|
||||
$(LIB_readline) \
|
||||
$(LIB_roken)
|
||||
|
||||
gss-commands.c gss-commands.h: gss-commands.in
|
||||
$(SLC) $(srcdir)/gss-commands.in
|
||||
|
||||
$(gsstool_OBJECTS): gss-commands.h
|
||||
|
||||
EXTRA_DIST = \
|
||||
$(man_MANS) \
|
||||
krb5/gkrb5_err.et \
|
||||
mech/gssapi.asn1 \
|
||||
spnego/spnego.asn1 \
|
||||
spnego/spnego.opt \
|
||||
version-script.map \
|
||||
gss-commands.in
|
||||
|
||||
$(libgssapi_la_OBJECTS): gkrb5_err.h gssapi_asn1.h gssapi_asn1-priv.h
|
||||
$(libgssapi_la_OBJECTS): spnego_asn1.h spnego_asn1-priv.h
|
||||
$(libgssapi_la_OBJECTS): $(srcdir)/gssapi/gssapi_oid.h
|
||||
|
||||
gkrb5_err.h gkrb5_err.c: $(srcdir)/krb5/gkrb5_err.et
|
||||
$(COMPILE_ET) $(srcdir)/krb5/gkrb5_err.et
|
||||
|
||||
$(srcdir)/gssapi/gssapi_oid.h $(srcdir)/mech/gss_oid.c:
|
||||
perl $(srcdir)/gen-oid.pl -b base -h $(srcdir)/oid.txt > $(srcdir)/gssapi/gssapi_oid.h
|
||||
perl $(srcdir)/gen-oid.pl -b base $(srcdir)/oid.txt > $(srcdir)/mech/gss_oid.c
|
||||
@@ -0,0 +1,608 @@
|
||||
########################################################################
|
||||
#
|
||||
# Copyright (c) 2009, Secure Endpoints Inc.
|
||||
# All rights reserved.
|
||||
#
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
# modification, are permitted provided that the following conditions
|
||||
# are met:
|
||||
#
|
||||
# - Redistributions of source code must retain the above copyright
|
||||
# notice, this list of conditions and the following disclaimer.
|
||||
#
|
||||
# - Redistributions in binary form must reproduce the above copyright
|
||||
# notice, this list of conditions and the following disclaimer in
|
||||
# the documentation and/or other materials provided with the
|
||||
# distribution.
|
||||
#
|
||||
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
# POSSIBILITY OF SUCH DAMAGE.
|
||||
#
|
||||
|
||||
RELDIR=lib\gssapi
|
||||
|
||||
!include ../../windows/NTMakefile.w32
|
||||
|
||||
krb5src = \
|
||||
krb5/8003.c \
|
||||
krb5/accept_sec_context.c \
|
||||
krb5/acquire_cred.c \
|
||||
krb5/add_cred.c \
|
||||
krb5/address_to_krb5addr.c \
|
||||
krb5/aeap.c \
|
||||
krb5/arcfour.c \
|
||||
krb5/canonicalize_name.c \
|
||||
krb5/creds.c \
|
||||
krb5/ccache_name.c \
|
||||
krb5/cfx.c \
|
||||
krb5/cfx.h \
|
||||
krb5/compare_name.c \
|
||||
krb5/compat.c \
|
||||
krb5/context_time.c \
|
||||
krb5/copy_ccache.c \
|
||||
krb5/decapsulate.c \
|
||||
krb5/delete_sec_context.c \
|
||||
krb5/display_name.c \
|
||||
krb5/display_status.c \
|
||||
krb5/duplicate_name.c \
|
||||
krb5/encapsulate.c \
|
||||
krb5/export_name.c \
|
||||
krb5/export_sec_context.c \
|
||||
krb5/external.c \
|
||||
krb5/get_mic.c \
|
||||
krb5/gsskrb5_locl.h \
|
||||
krb5/import_name.c \
|
||||
krb5/import_sec_context.c \
|
||||
krb5/indicate_mechs.c \
|
||||
krb5/init.c \
|
||||
krb5/init_sec_context.c \
|
||||
krb5/inquire_context.c \
|
||||
krb5/inquire_cred.c \
|
||||
krb5/inquire_cred_by_mech.c \
|
||||
krb5/inquire_cred_by_oid.c \
|
||||
krb5/inquire_mechs_for_name.c \
|
||||
krb5/inquire_names_for_mech.c \
|
||||
krb5/inquire_sec_context_by_oid.c \
|
||||
krb5/process_context_token.c \
|
||||
krb5/prf.c \
|
||||
krb5/release_buffer.c \
|
||||
krb5/release_cred.c \
|
||||
krb5/release_name.c \
|
||||
krb5/sequence.c \
|
||||
krb5/store_cred.c \
|
||||
krb5/set_cred_option.c \
|
||||
krb5/set_sec_context_option.c \
|
||||
krb5/ticket_flags.c \
|
||||
krb5/unwrap.c \
|
||||
krb5/verify_mic.c \
|
||||
krb5/wrap.c
|
||||
|
||||
mechsrc = \
|
||||
mech/context.h \
|
||||
mech/context.c \
|
||||
mech/cred.h \
|
||||
mech/gss_accept_sec_context.c \
|
||||
mech/gss_acquire_cred.c \
|
||||
mech/gss_add_cred.c \
|
||||
mech/gss_add_oid_set_member.c \
|
||||
mech/gss_aeap.c \
|
||||
mech/gss_buffer_set.c \
|
||||
mech/gss_canonicalize_name.c \
|
||||
mech/gss_compare_name.c \
|
||||
mech/gss_context_time.c \
|
||||
mech/gss_create_empty_oid_set.c \
|
||||
mech/gss_cred.c \
|
||||
mech/gss_decapsulate_token.c \
|
||||
mech/gss_delete_sec_context.c \
|
||||
mech/gss_display_name.c \
|
||||
mech/gss_display_status.c \
|
||||
mech/gss_duplicate_name.c \
|
||||
mech/gss_duplicate_oid.c \
|
||||
mech/gss_encapsulate_token.c \
|
||||
mech/gss_export_name.c \
|
||||
mech/gss_export_sec_context.c \
|
||||
mech/gss_get_mic.c \
|
||||
mech/gss_import_name.c \
|
||||
mech/gss_import_sec_context.c \
|
||||
mech/gss_indicate_mechs.c \
|
||||
mech/gss_init_sec_context.c \
|
||||
mech/gss_inquire_context.c \
|
||||
mech/gss_inquire_cred.c \
|
||||
mech/gss_inquire_cred_by_mech.c \
|
||||
mech/gss_inquire_cred_by_oid.c \
|
||||
mech/gss_inquire_mechs_for_name.c \
|
||||
mech/gss_inquire_names_for_mech.c \
|
||||
mech/gss_krb5.c \
|
||||
mech/gss_mech_switch.c \
|
||||
mech/gss_mo.c \
|
||||
mech/gss_names.c \
|
||||
mech/gss_oid.c \
|
||||
mech/gss_oid_equal.c \
|
||||
mech/gss_oid_to_str.c \
|
||||
mech/gss_process_context_token.c \
|
||||
mech/gss_pseudo_random.c \
|
||||
mech/gss_release_buffer.c \
|
||||
mech/gss_release_cred.c \
|
||||
mech/gss_release_name.c \
|
||||
mech/gss_release_oid.c \
|
||||
mech/gss_release_oid_set.c \
|
||||
mech/gss_seal.c \
|
||||
mech/gss_set_cred_option.c \
|
||||
mech/gss_set_sec_context_option.c \
|
||||
mech/gss_sign.c \
|
||||
mech/gss_store_cred.c \
|
||||
mech/gss_test_oid_set_member.c \
|
||||
mech/gss_unseal.c \
|
||||
mech/gss_unwrap.c \
|
||||
mech/gss_utils.c \
|
||||
mech/gss_verify.c \
|
||||
mech/gss_verify_mic.c \
|
||||
mech/gss_wrap.c \
|
||||
mech/gss_wrap_size_limit.c \
|
||||
mech/gss_inquire_sec_context_by_oid.c \
|
||||
mech/mech_switch.h \
|
||||
mech/mechqueue.h \
|
||||
mech/mech_locl.h \
|
||||
mech/name.h \
|
||||
mech/utils.h
|
||||
|
||||
spnegosrc = \
|
||||
spnego/accept_sec_context.c \
|
||||
spnego/compat.c \
|
||||
spnego/context_stubs.c \
|
||||
spnego/cred_stubs.c \
|
||||
spnego/external.c \
|
||||
spnego/init_sec_context.c \
|
||||
spnego/spnego_locl.h
|
||||
|
||||
ntlmsrc = \
|
||||
ntlm/accept_sec_context.c \
|
||||
ntlm/acquire_cred.c \
|
||||
ntlm/add_cred.c \
|
||||
ntlm/canonicalize_name.c \
|
||||
ntlm/compare_name.c \
|
||||
ntlm/context_time.c \
|
||||
ntlm/crypto.c \
|
||||
ntlm/delete_sec_context.c \
|
||||
ntlm/display_name.c \
|
||||
ntlm/display_status.c \
|
||||
ntlm/duplicate_name.c \
|
||||
ntlm/export_name.c \
|
||||
ntlm/export_sec_context.c \
|
||||
ntlm/external.c \
|
||||
ntlm/ntlm.h \
|
||||
ntlm/import_name.c \
|
||||
ntlm/import_sec_context.c \
|
||||
ntlm/indicate_mechs.c \
|
||||
ntlm/init_sec_context.c \
|
||||
ntlm/inquire_context.c \
|
||||
ntlm/inquire_cred.c \
|
||||
ntlm/inquire_cred_by_mech.c \
|
||||
ntlm/inquire_mechs_for_name.c \
|
||||
ntlm/inquire_names_for_mech.c \
|
||||
ntlm/process_context_token.c \
|
||||
ntlm/release_cred.c \
|
||||
ntlm/release_name.c \
|
||||
ntlm/kdc.c
|
||||
|
||||
$(OBJ)\ntlm\ntlm-private.h: $(ntlmsrc)
|
||||
$(PERL) ../../cf/make-proto.pl -q -P remove -p $@ $(ntlmsrc)
|
||||
|
||||
$(OBJ)\krb5\gsskrb5-private.h: $(krb5src)
|
||||
$(PERL) ../../cf/make-proto.pl -q -P remove -p $@ $(krb5src)
|
||||
|
||||
$(OBJ)\spnego\spnego-private.h: $(spnegosrc)
|
||||
$(PERL) ../../cf/make-proto.pl -q -P remove -p $@ $(spnegosrc)
|
||||
|
||||
gssapi_files = $(OBJ)\gssapi\asn1_gssapi_asn1.x
|
||||
|
||||
spnego_files = $(OBJ)\spnego\asn1_spnego_asn1.x
|
||||
|
||||
$(gssapi_files:.x=.c): $$(@R).x
|
||||
|
||||
$(spnego_files:.x=.c): $$(@R).x
|
||||
|
||||
$(gssapi_files) $(OBJ)\gssapi\gssapi_asn1.hx $(OBJ)\gssapi\gssapi_asn1-priv.hx: \
|
||||
$(BINDIR)\asn1_compile.exe mech\gssapi.asn1
|
||||
cd $(OBJ)\gssapi
|
||||
$(BINDIR)\asn1_compile.exe --one-code-file $(SRCDIR)\mech\gssapi.asn1 gssapi_asn1 \
|
||||
|| ( $(RM) $(OBJ)\gssapi\gssapi_asn1.h ; exit /b 1 )
|
||||
cd $(SRCDIR)
|
||||
|
||||
$(spnego_files) $(OBJ)\spnego\spnego_asn1.hx $(OBJ)\spnego\spnego_asn1-priv.hx: \
|
||||
$(BINDIR)\asn1_compile.exe spnego\spnego.asn1
|
||||
cd $(OBJ)\spnego
|
||||
$(BINDIR)\asn1_compile --one-code-file --sequence=MechTypeList \
|
||||
$(SRCDIR)\spnego\spnego.asn1 spnego_asn1 \
|
||||
|| ( $(RM) $(OBJ)\spnego\spnego_asn1.h ; exit /b 1 )
|
||||
cd $(SRCDIR)
|
||||
|
||||
$(OBJ)\gkrb5_err.c $(OBJ)\gkrb5_err.h: krb5\gkrb5_err.et
|
||||
cd $(OBJ)
|
||||
$(BINDIR)\compile_et.exe $(SRCDIR)\krb5\gkrb5_err.et
|
||||
cd $(SRCDIR)
|
||||
|
||||
INCFILES= \
|
||||
$(INCDIR)\gssapi.h \
|
||||
$(INCDIR)\gssapi\gssapi.h \
|
||||
$(INCDIR)\gssapi\gssapi_krb5.h \
|
||||
$(INCDIR)\gssapi\gssapi_oid.h \
|
||||
$(INCDIR)\gssapi\gssapi_ntlm.h \
|
||||
$(INCDIR)\gssapi\gssapi_spnego.h \
|
||||
$(INCDIR)\gssapi\gkrb5_err.h \
|
||||
$(OBJ)\ntlm\ntlm-private.h \
|
||||
$(OBJ)\spnego\spnego-private.h \
|
||||
$(OBJ)\krb5\gsskrb5-private.h \
|
||||
$(OBJ)\gkrb5_err.h \
|
||||
$(OBJ)\gssapi\gssapi_asn1.h \
|
||||
$(OBJ)\gssapi\gssapi_asn1-priv.h \
|
||||
$(OBJ)\spnego\spnego_asn1.h \
|
||||
$(OBJ)\spnego\spnego_asn1-priv.h
|
||||
|
||||
all:: $(INCFILES)
|
||||
|
||||
libgssapi_OBJs = \
|
||||
$(OBJ)\krb5/8003.obj \
|
||||
$(OBJ)\krb5/accept_sec_context.obj \
|
||||
$(OBJ)\krb5/acquire_cred.obj \
|
||||
$(OBJ)\krb5/add_cred.obj \
|
||||
$(OBJ)\krb5/address_to_krb5addr.obj \
|
||||
$(OBJ)\krb5/aeap.obj \
|
||||
$(OBJ)\krb5/arcfour.obj \
|
||||
$(OBJ)\krb5/canonicalize_name.obj \
|
||||
$(OBJ)\krb5/creds.obj \
|
||||
$(OBJ)\krb5/ccache_name.obj \
|
||||
$(OBJ)\krb5/cfx.obj \
|
||||
$(OBJ)\krb5/compare_name.obj \
|
||||
$(OBJ)\krb5/compat.obj \
|
||||
$(OBJ)\krb5/context_time.obj \
|
||||
$(OBJ)\krb5/copy_ccache.obj \
|
||||
$(OBJ)\krb5/decapsulate.obj \
|
||||
$(OBJ)\krb5/delete_sec_context.obj \
|
||||
$(OBJ)\krb5/display_name.obj \
|
||||
$(OBJ)\krb5/display_status.obj \
|
||||
$(OBJ)\krb5/duplicate_name.obj \
|
||||
$(OBJ)\krb5/encapsulate.obj \
|
||||
$(OBJ)\krb5/export_name.obj \
|
||||
$(OBJ)\krb5/export_sec_context.obj \
|
||||
$(OBJ)\krb5/external.obj \
|
||||
$(OBJ)\krb5/get_mic.obj \
|
||||
$(OBJ)\krb5/import_name.obj \
|
||||
$(OBJ)\krb5/import_sec_context.obj \
|
||||
$(OBJ)\krb5/indicate_mechs.obj \
|
||||
$(OBJ)\krb5/init.obj \
|
||||
$(OBJ)\krb5/init_sec_context.obj \
|
||||
$(OBJ)\krb5/inquire_context.obj \
|
||||
$(OBJ)\krb5/inquire_cred.obj \
|
||||
$(OBJ)\krb5/inquire_cred_by_mech.obj \
|
||||
$(OBJ)\krb5/inquire_cred_by_oid.obj \
|
||||
$(OBJ)\krb5/inquire_mechs_for_name.obj \
|
||||
$(OBJ)\krb5/inquire_names_for_mech.obj \
|
||||
$(OBJ)\krb5/inquire_sec_context_by_oid.obj \
|
||||
$(OBJ)\krb5/process_context_token.obj \
|
||||
$(OBJ)\krb5/prf.obj \
|
||||
$(OBJ)\krb5/release_buffer.obj \
|
||||
$(OBJ)\krb5/release_cred.obj \
|
||||
$(OBJ)\krb5/release_name.obj \
|
||||
$(OBJ)\krb5/sequence.obj \
|
||||
$(OBJ)\krb5/store_cred.obj \
|
||||
$(OBJ)\krb5/set_cred_option.obj \
|
||||
$(OBJ)\krb5/set_sec_context_option.obj \
|
||||
$(OBJ)\krb5/ticket_flags.obj \
|
||||
$(OBJ)\krb5/unwrap.obj \
|
||||
$(OBJ)\krb5/verify_mic.obj \
|
||||
$(OBJ)\krb5/wrap.obj \
|
||||
$(OBJ)\mech/context.obj \
|
||||
$(OBJ)\mech/gss_accept_sec_context.obj \
|
||||
$(OBJ)\mech/gss_acquire_cred.obj \
|
||||
$(OBJ)\mech/gss_add_cred.obj \
|
||||
$(OBJ)\mech/gss_add_oid_set_member.obj \
|
||||
$(OBJ)\mech/gss_aeap.obj \
|
||||
$(OBJ)\mech/gss_buffer_set.obj \
|
||||
$(OBJ)\mech/gss_canonicalize_name.obj \
|
||||
$(OBJ)\mech/gss_compare_name.obj \
|
||||
$(OBJ)\mech/gss_context_time.obj \
|
||||
$(OBJ)\mech/gss_create_empty_oid_set.obj \
|
||||
$(OBJ)\mech/gss_cred.obj \
|
||||
$(OBJ)\mech/gss_decapsulate_token.obj \
|
||||
$(OBJ)\mech/gss_delete_sec_context.obj \
|
||||
$(OBJ)\mech/gss_display_name.obj \
|
||||
$(OBJ)\mech/gss_display_status.obj \
|
||||
$(OBJ)\mech/gss_duplicate_name.obj \
|
||||
$(OBJ)\mech/gss_duplicate_oid.obj \
|
||||
$(OBJ)\mech/gss_encapsulate_token.obj \
|
||||
$(OBJ)\mech/gss_export_name.obj \
|
||||
$(OBJ)\mech/gss_export_sec_context.obj \
|
||||
$(OBJ)\mech/gss_get_mic.obj \
|
||||
$(OBJ)\mech/gss_import_name.obj \
|
||||
$(OBJ)\mech/gss_import_sec_context.obj \
|
||||
$(OBJ)\mech/gss_indicate_mechs.obj \
|
||||
$(OBJ)\mech/gss_init_sec_context.obj \
|
||||
$(OBJ)\mech/gss_inquire_context.obj \
|
||||
$(OBJ)\mech/gss_inquire_cred.obj \
|
||||
$(OBJ)\mech/gss_inquire_cred_by_mech.obj \
|
||||
$(OBJ)\mech/gss_inquire_cred_by_oid.obj \
|
||||
$(OBJ)\mech/gss_inquire_mechs_for_name.obj \
|
||||
$(OBJ)\mech/gss_inquire_names_for_mech.obj \
|
||||
$(OBJ)\mech/gss_krb5.obj \
|
||||
$(OBJ)\mech/gss_mech_switch.obj \
|
||||
$(OBJ)\mech/gss_mo.obj \
|
||||
$(OBJ)\mech/gss_names.obj \
|
||||
$(OBJ)\mech/gss_oid.obj \
|
||||
$(OBJ)\mech/gss_oid_equal.obj \
|
||||
$(OBJ)\mech/gss_oid_to_str.obj \
|
||||
$(OBJ)\mech/gss_process_context_token.obj \
|
||||
$(OBJ)\mech/gss_pseudo_random.obj \
|
||||
$(OBJ)\mech/gss_release_buffer.obj \
|
||||
$(OBJ)\mech/gss_release_cred.obj \
|
||||
$(OBJ)\mech/gss_release_name.obj \
|
||||
$(OBJ)\mech/gss_release_oid.obj \
|
||||
$(OBJ)\mech/gss_release_oid_set.obj \
|
||||
$(OBJ)\mech/gss_seal.obj \
|
||||
$(OBJ)\mech/gss_set_cred_option.obj \
|
||||
$(OBJ)\mech/gss_set_sec_context_option.obj \
|
||||
$(OBJ)\mech/gss_sign.obj \
|
||||
$(OBJ)\mech/gss_store_cred.obj \
|
||||
$(OBJ)\mech/gss_test_oid_set_member.obj \
|
||||
$(OBJ)\mech/gss_unseal.obj \
|
||||
$(OBJ)\mech/gss_unwrap.obj \
|
||||
$(OBJ)\mech/gss_utils.obj \
|
||||
$(OBJ)\mech/gss_verify.obj \
|
||||
$(OBJ)\mech/gss_verify_mic.obj \
|
||||
$(OBJ)\mech/gss_wrap.obj \
|
||||
$(OBJ)\mech/gss_wrap_size_limit.obj \
|
||||
$(OBJ)\mech/gss_inquire_sec_context_by_oid.obj \
|
||||
$(OBJ)\spnego/accept_sec_context.obj \
|
||||
$(OBJ)\spnego/compat.obj \
|
||||
$(OBJ)\spnego/context_stubs.obj \
|
||||
$(OBJ)\spnego/cred_stubs.obj \
|
||||
$(OBJ)\spnego/external.obj \
|
||||
$(OBJ)\spnego/init_sec_context.obj \
|
||||
$(OBJ)\ntlm/accept_sec_context.obj \
|
||||
$(OBJ)\ntlm/acquire_cred.obj \
|
||||
$(OBJ)\ntlm/add_cred.obj \
|
||||
$(OBJ)\ntlm/canonicalize_name.obj \
|
||||
$(OBJ)\ntlm/compare_name.obj \
|
||||
$(OBJ)\ntlm/context_time.obj \
|
||||
$(OBJ)\ntlm/crypto.obj \
|
||||
$(OBJ)\ntlm/delete_sec_context.obj \
|
||||
$(OBJ)\ntlm/display_name.obj \
|
||||
$(OBJ)\ntlm/display_status.obj \
|
||||
$(OBJ)\ntlm/duplicate_name.obj \
|
||||
$(OBJ)\ntlm/export_name.obj \
|
||||
$(OBJ)\ntlm/export_sec_context.obj \
|
||||
$(OBJ)\ntlm/external.obj \
|
||||
$(OBJ)\ntlm/import_name.obj \
|
||||
$(OBJ)\ntlm/import_sec_context.obj \
|
||||
$(OBJ)\ntlm/indicate_mechs.obj \
|
||||
$(OBJ)\ntlm/init_sec_context.obj \
|
||||
$(OBJ)\ntlm/inquire_context.obj \
|
||||
$(OBJ)\ntlm/inquire_cred.obj \
|
||||
$(OBJ)\ntlm/inquire_cred_by_mech.obj \
|
||||
$(OBJ)\ntlm/inquire_mechs_for_name.obj \
|
||||
$(OBJ)\ntlm/inquire_names_for_mech.obj \
|
||||
$(OBJ)\ntlm/process_context_token.obj \
|
||||
$(OBJ)\ntlm/release_cred.obj \
|
||||
$(OBJ)\ntlm/release_name.obj \
|
||||
$(OBJ)\ntlm/kdc.obj \
|
||||
$(OBJ)\gkrb5_err.obj \
|
||||
$(spnego_files:.x=.obj) \
|
||||
$(gssapi_files:.x=.obj)
|
||||
|
||||
GCOPTS=-I$(SRCDIR) -I$(OBJ) -Igssapi -DBUILD_GSSAPI_LIB
|
||||
|
||||
{$(OBJ)\krb5}.c{$(OBJ)\krb5}.obj::
|
||||
$(C2OBJ_NP) -Fo$(OBJ)\krb5\ -Fd$(OBJ)\krb5\ -I$(OBJ)\krb5 $(GCOPTS)
|
||||
|
||||
{krb5}.c{$(OBJ)\krb5}.obj::
|
||||
$(C2OBJ_NP) -Fo$(OBJ)\krb5\ -Fd$(OBJ)\krb5\ -I$(OBJ)\krb5 $(GCOPTS) -DASN1_LIB
|
||||
|
||||
{$(OBJ)\mech}.c{$(OBJ)\mech}.obj::
|
||||
$(C2OBJ_NP) -Fo$(OBJ)\mech\ -Fd$(OBJ)\mech\ -I$(OBJ)\mech $(GCOPTS)
|
||||
|
||||
{mech}.c{$(OBJ)\mech}.obj::
|
||||
$(C2OBJ_NP) -Fo$(OBJ)\mech\ -Fd$(OBJ)\mech\ -I$(OBJ)\mech -I$(OBJ)\gssapi $(GCOPTS) -DASN1_LIB
|
||||
|
||||
{$(OBJ)\ntlm}.c{$(OBJ)\ntlm}.obj::
|
||||
$(C2OBJ_NP) -Fo$(OBJ)\ntlm\ -Fd$(OBJ)\ntlm\ -I$(OBJ)\ntlm $(GCOPTS)
|
||||
|
||||
{ntlm}.c{$(OBJ)\ntlm}.obj::
|
||||
$(C2OBJ_NP) -Fo$(OBJ)\ntlm\ -Fd$(OBJ)\ntlm\ -I$(OBJ)\ntlm $(GCOPTS) -DASN1_LIB
|
||||
|
||||
{$(OBJ)\spnego}.c{$(OBJ)\spnego}.obj::
|
||||
$(C2OBJ_NP) -Fo$(OBJ)\spnego\ -Fd$(OBJ)\spnego\ -I$(OBJ)\spnego $(GCOPTS)
|
||||
|
||||
{spnego}.c{$(OBJ)\spnego}.obj::
|
||||
$(C2OBJ_NP) -Fo$(OBJ)\spnego\ -Fd$(OBJ)\spnego\ -I$(OBJ)\spnego -Imech $(GCOPTS) -DASN1_LIB
|
||||
|
||||
{$(OBJ)\gssapi}.c{$(OBJ)\gssapi}.obj::
|
||||
$(C2OBJ_NP) -Fo$(OBJ)\gssapi\ -Fd$(OBJ)\gssapi\ -I$(OBJ)\gssapi $(GCOPTS)
|
||||
|
||||
{$(OBJ)}.c{$(OBJ)}.obj::
|
||||
$(C2OBJ_P) $(GCOPTS)
|
||||
|
||||
{$(OBJ)\spnego}.x{$(OBJ)\spnego}.c:
|
||||
$(CP) $** $@
|
||||
|
||||
{$(OBJ)\gssapi}.x{$(OBJ)\gssapi}.c:
|
||||
$(CP) $** $@
|
||||
|
||||
{gssapi}.h{$(INCDIR)\gssapi}.h:
|
||||
$(CP) $** $@
|
||||
|
||||
{$(OBJ)}.h{$(INCDIR)\gssapi}.h:
|
||||
$(CP) $** $@
|
||||
|
||||
{$(OBJ)\gssapi}.hx{$(OBJ)\gssapi}.h:
|
||||
$(CP) $** $@
|
||||
|
||||
{$(OBJ)\spnego}.hx{$(OBJ)\spnego}.h:
|
||||
$(CP) $** $@
|
||||
|
||||
LIBGSSAPI_LIBS=\
|
||||
$(LIBROKEN) \
|
||||
$(LIBHEIMDAL) \
|
||||
$(LIBHEIMNTLM) \
|
||||
$(LIBCOMERR)
|
||||
|
||||
LIBGSSAPI_SDKLIBS=\
|
||||
$(PTHREAD_LIB)
|
||||
|
||||
!ifndef STATICLIBS
|
||||
|
||||
RES=$(OBJ)\libgssapi-version.res
|
||||
|
||||
$(BINDIR)\gssapi.dll: $(libgssapi_OBJs) $(RES)
|
||||
$(DLLGUILINK_C) -implib:$(LIBGSSAPI) \
|
||||
-out:$(BINDIR)\gssapi.dll \
|
||||
-def:libgssapi-exports.def \
|
||||
$(LIBGSSAPI_LIBS) $(RES) $(LIBGSSAPI_SDKLIBS) @<<
|
||||
$(libgssapi_OBJs: =
|
||||
)
|
||||
<<
|
||||
$(DLLPREP_NODIST)
|
||||
|
||||
$(LIBGSSAPI): $(BINDIR)\gssapi.dll
|
||||
|
||||
clean::
|
||||
-$(RM) $(BINDIR)\gssapi.*
|
||||
|
||||
!else
|
||||
|
||||
$(LIBGSSAPI): $(libgssapi_OBJs)
|
||||
$(LIBCON_C) -OUT:$@ $(LIBGSSAPI_LIBS) $(LIBGSSAPI_SDKLIBS) @<<
|
||||
$(libgssapi_OBJs: =
|
||||
)
|
||||
<<
|
||||
|
||||
!endif
|
||||
|
||||
all:: $(LIBGSSAPI)
|
||||
|
||||
clean::
|
||||
-$(RM) $(LIBGSSAPI)
|
||||
|
||||
prep:: mkdirs-gss
|
||||
|
||||
mkdirs-gss:
|
||||
!if !exist($(OBJ)\ntlm)
|
||||
$(MKDIR) $(OBJ)\ntlm
|
||||
!endif
|
||||
!if !exist($(OBJ)\krb5)
|
||||
$(MKDIR) $(OBJ)\krb5
|
||||
!endif
|
||||
!if !exist($(OBJ)\spnego)
|
||||
$(MKDIR) $(OBJ)\spnego
|
||||
!endif
|
||||
!if !exist($(OBJ)\mech)
|
||||
$(MKDIR) $(OBJ)\mech
|
||||
!endif
|
||||
!if !exist($(OBJ)\gssapi)
|
||||
$(MKDIR) $(OBJ)\gssapi
|
||||
!endif
|
||||
|
||||
clean::
|
||||
-$(RM) $(OBJ)\ntlm\*.*
|
||||
-$(RM) $(OBJ)\krb5\*.*
|
||||
-$(RM) $(OBJ)\spnego\*.*
|
||||
-$(RM) $(OBJ)\mech\*.*
|
||||
-$(RM) $(OBJ)\gssapi\*.*
|
||||
|
||||
all-tools:: $(BINDIR)\gsstool.exe
|
||||
|
||||
$(BINDIR)\gsstool.exe: $(OBJ)\gsstool.obj $(OBJ)\gss-commands.obj $(LIBGSSAPI) $(LIBROKEN) $(LIBSL) $(LIBVERS)
|
||||
$(EXECONLINK)
|
||||
|
||||
$(OBJ)\gss-commands.c $(OBJ)\gss-commands.h: gss-commands.in
|
||||
cd $(OBJ)
|
||||
$(CP) $(SRCDIR)\gss-commands.in gss-commands.in
|
||||
$(BINDIR)\slc.exe gss-commands.in
|
||||
cd $(SRCDIR)
|
||||
|
||||
!ifdef ELISP
|
||||
# This macro invocation is used to update the libgssapi_OBJs
|
||||
# definition below (generate-obj-macro is defined in maint.el):
|
||||
|
||||
(generate-obj-macro "libgssapi_OBJs"
|
||||
(concat "\t$(OBJ)\\gkrb5_err.obj \\\n"
|
||||
"\t$(spnego_files:.x=.obj) \\\n"
|
||||
"\t$(gssapi_files:.x=.obj)")
|
||||
"krb5src" "mechsrc" "spnegosrc" "ntlmsrc")
|
||||
!endif
|
||||
|
||||
test-exports:
|
||||
$(PERL) ..\..\cf\w32-check-exported-symbols.pl --vs version-script.map --def libgssapi-exports.def
|
||||
|
||||
test:: test-exports
|
||||
|
||||
|
||||
TEST_BINARIES=\
|
||||
$(OBJ)\test_oid.exe \
|
||||
$(OBJ)\test_names.exe \
|
||||
$(OBJ)\test_cfx.exe \
|
||||
$(OBJ)\test_acquire_cred.exe \
|
||||
$(OBJ)\test_cred.exe \
|
||||
$(OBJ)\test_kcred.exe \
|
||||
$(OBJ)\test_context.exe \
|
||||
$(OBJ)\test_ntlm.exe
|
||||
|
||||
$(OBJ)\test_oid.exe: $(OBJ)\test_oid.obj $(LIBGSSAPI) $(LIBROKEN)
|
||||
$(EXECONLINK)
|
||||
$(EXEPREP_NODIST)
|
||||
|
||||
$(OBJ)\test_names.exe: $(OBJ)\test_names.obj $(LIBGSSAPI) $(LIBROKEN) $(LIBVERS)
|
||||
$(EXECONLINK)
|
||||
$(EXEPREP_NODIST)
|
||||
|
||||
$(OBJ)\test_cfx.exe: $(OBJ)\krb5\test_cfx.obj $(LIBHEIMDAL) $(LIBGSSAPI) $(LIBROKEN)
|
||||
$(EXECONLINK)
|
||||
$(EXEPREP_NODIST)
|
||||
|
||||
$(OBJ)\test_acquire_cred.exe: $(OBJ)\test_acquire_cred.obj $(OBJ)\test_common.obj \
|
||||
$(LIBGSSAPI) $(LIBROKEN) $(LIBVERS)
|
||||
$(EXECONLINK)
|
||||
$(EXEPREP_NODIST)
|
||||
|
||||
$(OBJ)\test_cred.exe: $(OBJ)\test_cred.obj $(LIBGSSAPI) $(LIBROKEN) $(LIBVERS)
|
||||
$(EXECONLINK)
|
||||
$(EXEPREP_NODIST)
|
||||
|
||||
$(OBJ)\test_kcred.exe: $(OBJ)\test_kcred.obj $(LIBGSSAPI) $(LIBHEIMDAL) \
|
||||
$(LIBROKEN) $(LIBVERS)
|
||||
$(EXECONLINK)
|
||||
$(EXEPREP_NODIST)
|
||||
|
||||
$(OBJ)\test_context.exe: $(OBJ)\test_context.obj $(OBJ)\test_common.obj \
|
||||
$(LIBGSSAPI) $(LIBHEIMDAL) $(LIBROKEN) $(LIBVERS)
|
||||
$(EXECONLINK)
|
||||
$(EXEPREP_NODIST)
|
||||
|
||||
$(OBJ)\test_ntlm.exe: $(OBJ)\test_ntlm.obj $(OBJ)\test_common.obj \
|
||||
$(LIBGSSAPI) $(LIBHEIMNTLM) $(LIBROKEN) $(LIBVERS)
|
||||
$(EXECONLINK)
|
||||
$(EXEPREP_NODIST)
|
||||
|
||||
{}.c{$(OBJ)}.obj::
|
||||
$(C2OBJ_P) -I$(OBJ)\krb5 -I$(OBJ) -I$(SRCDIR) -I$(SRCDIR)\gssapi
|
||||
|
||||
test-binaries: $(LIBGSSAPI) $(TEST_BINARIES)
|
||||
|
||||
run-test:
|
||||
cd $(OBJ)
|
||||
test_oid
|
||||
test_names
|
||||
test_cfx
|
||||
test_kcred
|
||||
cd $(SRCDIR)
|
||||
|
||||
test:: test-binaries run-test
|
||||
@@ -0,0 +1,141 @@
|
||||
#!/usr/bin/perl
|
||||
#
|
||||
# Copyright (c) 2010 Kungliga Tekniska Högskolan
|
||||
# (Royal Institute of Technology, Stockholm, Sweden).
|
||||
# All rights reserved.
|
||||
#
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
# modification, are permitted provided that the following conditions
|
||||
# are met:
|
||||
#
|
||||
# 1. Redistributions of source code must retain the above copyright
|
||||
# notice, this list of conditions and the following disclaimer.
|
||||
#
|
||||
# 2. Redistributions in binary form must reproduce the above copyright
|
||||
# notice, this list of conditions and the following disclaimer in the
|
||||
# documentation and/or other materials provided with the distribution.
|
||||
#
|
||||
# 3. Neither the name of the Institute nor the names of its contributors
|
||||
# may be used to endorse or promote products derived from this software
|
||||
# without specific prior written permission.
|
||||
#
|
||||
# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
# ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
# SUCH DAMAGE.
|
||||
|
||||
require 'getopts.pl';
|
||||
|
||||
my $output;
|
||||
my $CFILE, $HFILE;
|
||||
my $onlybase;
|
||||
my $header = 0;
|
||||
|
||||
Getopts('b:h') || die "foo";
|
||||
|
||||
if($opt_b) {
|
||||
$onlybase = $opt_b;
|
||||
}
|
||||
|
||||
$header = 1 if ($opt_h);
|
||||
|
||||
printf "/* Generated file */\n";
|
||||
if ($header) {
|
||||
printf "#ifndef GSSAPI_GSSAPI_OID\n";
|
||||
printf "#define GSSAPI_GSSAPI_OID 1\n\n";
|
||||
} else {
|
||||
printf "#include \"mech_locl.h\"\n\n";
|
||||
}
|
||||
|
||||
my %tables;
|
||||
my %types;
|
||||
|
||||
while(<>) {
|
||||
|
||||
if (/^\w*#(.*)/) {
|
||||
my $comment = $1;
|
||||
|
||||
if ($header) {
|
||||
printf("$comment\n");
|
||||
}
|
||||
|
||||
} elsif (/^oid\s+([\w\.]+)\s+(\w+)\s+([\w\.]+)/) {
|
||||
my ($base, $name, $oid) = ($1, $2, $3);
|
||||
|
||||
next if (defined $onlybase and $onlybase ne $base);
|
||||
|
||||
my $store = "__" . lc($name) . "_oid_desc";
|
||||
|
||||
# encode oid
|
||||
|
||||
my @array = split(/\./, $oid);
|
||||
my $length = 0;
|
||||
my $data = "";
|
||||
|
||||
my $num;
|
||||
|
||||
$n = $#array;
|
||||
while ($n > 1) {
|
||||
$num = $array[$n];
|
||||
|
||||
my $p = int($num % 128);
|
||||
$data = sprintf("\\x%02x", $p) . $data;
|
||||
|
||||
$num = int($num / 128);
|
||||
|
||||
$length += 1;
|
||||
|
||||
while ($num > 0) {
|
||||
$p = int($num % 128) + 128;
|
||||
$num = int($num / 128);
|
||||
$data = sprintf("\\x%02x", $p) . $data;
|
||||
$length += 1;
|
||||
}
|
||||
$n--;
|
||||
}
|
||||
$num = int($array[0] * 40 + $array[1]);
|
||||
|
||||
$data = sprintf("\\x%x", $num) . $data;
|
||||
$length += 1;
|
||||
|
||||
if ($header) {
|
||||
printf "extern GSSAPI_LIB_VARIABLE gss_OID_desc $store;\n";
|
||||
printf "#define $name (&$store)\n\n";
|
||||
} else {
|
||||
printf "/* $name - $oid */\n";
|
||||
printf "gss_OID_desc GSSAPI_LIB_VARIABLE $store = { $length, \"$data\" };\n\n";
|
||||
}
|
||||
} elsif (/^desc\s+([\w]+)\s+(\w+)\s+(\"[^\"]*\")\s+(\"[^\"]*\")/) {
|
||||
my ($type, $oid, $short, $long) = ($1, $2, $3, $4);
|
||||
my $object = { type=> $type, oid => $oid, short => $short, long => $long };
|
||||
|
||||
$tables{$oid} = \$object;
|
||||
$types{$type} = 1;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
foreach my $k (keys %types) {
|
||||
if (!$header) {
|
||||
print "struct _gss_oid_name_table _gss_ont_" . $k . "[] = {\n";
|
||||
foreach my $m (values %tables) {
|
||||
if ($$m->{type} eq $k) {
|
||||
printf " { %s, \"%s\", %s, %s },\n", $$m->{oid}, $$m->{oid}, $$m->{short}, $$m->{long};
|
||||
}
|
||||
}
|
||||
printf " { NULL }\n";
|
||||
printf "};\n\n";
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
if ($header) {
|
||||
printf "#endif /* GSSAPI_GSSAPI_OID */\n";
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
/*
|
||||
* Copyright (c) 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
/* Id */
|
||||
|
||||
command = {
|
||||
name = "supported-mechanisms"
|
||||
help = "Print the supported mechanisms"
|
||||
}
|
||||
command = {
|
||||
name = "attrs-for-mech"
|
||||
help = "Print the attributes for mechs"
|
||||
option = {
|
||||
long = "all"
|
||||
type = "flag"
|
||||
}
|
||||
option = {
|
||||
long = "mech"
|
||||
type = "string"
|
||||
argument = "mechanism"
|
||||
}
|
||||
}
|
||||
command = {
|
||||
name = "help"
|
||||
name = "?"
|
||||
argument = "[command]"
|
||||
min_args = "0"
|
||||
max_args = "1"
|
||||
help = "Help! I need somebody."
|
||||
}
|
||||
@@ -0,0 +1,690 @@
|
||||
.\" $NetBSD: gss_acquire_cred.3,v 1.2 2011/04/28 14:38:49 wiz Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2003 - 2007 Kungliga Tekniska Högskolan
|
||||
.\" (Royal Institute of Technology, Stockholm, Sweden).
|
||||
.\" All rights reserved.
|
||||
.\"
|
||||
.\" Redistribution and use in source and binary forms, with or without
|
||||
.\" modification, are permitted provided that the following conditions
|
||||
.\" are met:
|
||||
.\"
|
||||
.\" 1. Redistributions of source code must retain the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer.
|
||||
.\"
|
||||
.\" 2. Redistributions in binary form must reproduce the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer in the
|
||||
.\" documentation and/or other materials provided with the distribution.
|
||||
.\"
|
||||
.\" 3. Neither the name of the Institute nor the names of its contributors
|
||||
.\" may be used to endorse or promote products derived from this software
|
||||
.\" without specific prior written permission.
|
||||
.\"
|
||||
.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
.\" SUCH DAMAGE.
|
||||
.\"
|
||||
.\" Id
|
||||
.\"
|
||||
.Dd October 26, 2005
|
||||
.Dt GSS_ACQUIRE_CRED 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm gss_accept_sec_context ,
|
||||
.Nm gss_acquire_cred ,
|
||||
.Nm gss_add_cred ,
|
||||
.Nm gss_add_oid_set_member ,
|
||||
.Nm gss_canonicalize_name ,
|
||||
.Nm gss_compare_name ,
|
||||
.Nm gss_context_time ,
|
||||
.Nm gss_create_empty_oid_set ,
|
||||
.Nm gss_delete_sec_context ,
|
||||
.Nm gss_display_name ,
|
||||
.Nm gss_display_status ,
|
||||
.Nm gss_duplicate_name ,
|
||||
.Nm gss_export_name ,
|
||||
.Nm gss_export_sec_context ,
|
||||
.Nm gss_get_mic ,
|
||||
.Nm gss_import_name ,
|
||||
.Nm gss_import_sec_context ,
|
||||
.Nm gss_indicate_mechs ,
|
||||
.Nm gss_init_sec_context ,
|
||||
.Nm gss_inquire_context ,
|
||||
.Nm gss_inquire_cred ,
|
||||
.Nm gss_inquire_cred_by_mech ,
|
||||
.Nm gss_inquire_mechs_for_name ,
|
||||
.Nm gss_inquire_names_for_mech ,
|
||||
.Nm gss_krb5_ccache_name ,
|
||||
.Nm gss_krb5_compat_des3_mic ,
|
||||
.Nm gss_krb5_copy_ccache ,
|
||||
.Nm gss_krb5_import_cred
|
||||
.Nm gsskrb5_extract_authz_data_from_sec_context ,
|
||||
.Nm gsskrb5_register_acceptor_identity ,
|
||||
.Nm gss_krb5_import_ccache ,
|
||||
.Nm gss_krb5_get_tkt_flags ,
|
||||
.Nm gss_process_context_token ,
|
||||
.Nm gss_release_buffer ,
|
||||
.Nm gss_release_cred ,
|
||||
.Nm gss_release_name ,
|
||||
.Nm gss_release_oid_set ,
|
||||
.Nm gss_seal ,
|
||||
.Nm gss_sign ,
|
||||
.Nm gss_test_oid_set_member ,
|
||||
.Nm gss_unseal ,
|
||||
.Nm gss_unwrap ,
|
||||
.Nm gss_verify ,
|
||||
.Nm gss_verify_mic ,
|
||||
.Nm gss_wrap ,
|
||||
.Nm gss_wrap_size_limit
|
||||
.Nd Generic Security Service Application Program Interface library
|
||||
.Sh LIBRARY
|
||||
GSS-API library (libgssapi, -lgssapi)
|
||||
.Sh SYNOPSIS
|
||||
.In gssapi/gssapi.h
|
||||
.Pp
|
||||
.Ft OM_uint32
|
||||
.Fo gss_accept_sec_context
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_ctx_id_t * context_handle"
|
||||
.Fa "const gss_cred_id_t acceptor_cred_handle"
|
||||
.Fa "const gss_buffer_t input_token_buffer"
|
||||
.Fa "const gss_channel_bindings_t input_chan_bindings"
|
||||
.Fa "gss_name_t * src_name"
|
||||
.Fa "gss_OID * mech_type"
|
||||
.Fa "gss_buffer_t output_token"
|
||||
.Fa "OM_uint32 * ret_flags"
|
||||
.Fa "OM_uint32 * time_rec"
|
||||
.Fa "gss_cred_id_t * delegated_cred_handle"
|
||||
.Fc
|
||||
.Pp
|
||||
.Ft OM_uint32
|
||||
.Fo gss_acquire_cred
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_name_t desired_name"
|
||||
.Fa "OM_uint32 time_req"
|
||||
.Fa "const gss_OID_set desired_mechs"
|
||||
.Fa "gss_cred_usage_t cred_usage"
|
||||
.Fa "gss_cred_id_t * output_cred_handle"
|
||||
.Fa "gss_OID_set * actual_mechs"
|
||||
.Fa "OM_uint32 * time_rec"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_add_cred
|
||||
.Fa "OM_uint32 *minor_status"
|
||||
.Fa "const gss_cred_id_t input_cred_handle"
|
||||
.Fa "const gss_name_t desired_name"
|
||||
.Fa "const gss_OID desired_mech"
|
||||
.Fa "gss_cred_usage_t cred_usage"
|
||||
.Fa "OM_uint32 initiator_time_req"
|
||||
.Fa "OM_uint32 acceptor_time_req"
|
||||
.Fa "gss_cred_id_t *output_cred_handle"
|
||||
.Fa "gss_OID_set *actual_mechs"
|
||||
.Fa "OM_uint32 *initiator_time_rec"
|
||||
.Fa "OM_uint32 *acceptor_time_rec"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_add_oid_set_member
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_OID member_oid"
|
||||
.Fa "gss_OID_set * oid_set"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_canonicalize_name
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_name_t input_name"
|
||||
.Fa "const gss_OID mech_type"
|
||||
.Fa "gss_name_t * output_name"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_compare_name
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_name_t name1"
|
||||
.Fa "const gss_name_t name2"
|
||||
.Fa "int * name_equal"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_context_time
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_ctx_id_t context_handle"
|
||||
.Fa "OM_uint32 * time_rec"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_create_empty_oid_set
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_OID_set * oid_set"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_delete_sec_context
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_ctx_id_t * context_handle"
|
||||
.Fa "gss_buffer_t output_token"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_display_name
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_name_t input_name"
|
||||
.Fa "gss_buffer_t output_name_buffer"
|
||||
.Fa "gss_OID * output_name_type"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_display_status
|
||||
.Fa "OM_uint32 *minor_status"
|
||||
.Fa "OM_uint32 status_value"
|
||||
.Fa "int status_type"
|
||||
.Fa "const gss_OID mech_type"
|
||||
.Fa "OM_uint32 *message_context"
|
||||
.Fa "gss_buffer_t status_string"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_duplicate_name
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_name_t src_name"
|
||||
.Fa "gss_name_t * dest_name"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_export_name
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_name_t input_name"
|
||||
.Fa "gss_buffer_t exported_name"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_export_sec_context
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_ctx_id_t * context_handle"
|
||||
.Fa "gss_buffer_t interprocess_token"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_get_mic
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_ctx_id_t context_handle"
|
||||
.Fa "gss_qop_t qop_req"
|
||||
.Fa "const gss_buffer_t message_buffer"
|
||||
.Fa "gss_buffer_t message_token"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_import_name
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_buffer_t input_name_buffer"
|
||||
.Fa "const gss_OID input_name_type"
|
||||
.Fa "gss_name_t * output_name"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_import_sec_context
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_buffer_t interprocess_token"
|
||||
.Fa "gss_ctx_id_t * context_handle"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_indicate_mechs
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_OID_set * mech_set"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_init_sec_context
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_cred_id_t initiator_cred_handle"
|
||||
.Fa "gss_ctx_id_t * context_handle"
|
||||
.Fa "const gss_name_t target_name"
|
||||
.Fa "const gss_OID mech_type"
|
||||
.Fa "OM_uint32 req_flags"
|
||||
.Fa "OM_uint32 time_req"
|
||||
.Fa "const gss_channel_bindings_t input_chan_bindings"
|
||||
.Fa "const gss_buffer_t input_token"
|
||||
.Fa "gss_OID * actual_mech_type"
|
||||
.Fa "gss_buffer_t output_token"
|
||||
.Fa "OM_uint32 * ret_flags"
|
||||
.Fa "OM_uint32 * time_rec"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_inquire_context
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_ctx_id_t context_handle"
|
||||
.Fa "gss_name_t * src_name"
|
||||
.Fa "gss_name_t * targ_name"
|
||||
.Fa "OM_uint32 * lifetime_rec"
|
||||
.Fa "gss_OID * mech_type"
|
||||
.Fa "OM_uint32 * ctx_flags"
|
||||
.Fa "int * locally_initiated"
|
||||
.Fa "int * open_context"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_inquire_cred
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_cred_id_t cred_handle"
|
||||
.Fa "gss_name_t * name"
|
||||
.Fa "OM_uint32 * lifetime"
|
||||
.Fa "gss_cred_usage_t * cred_usage"
|
||||
.Fa "gss_OID_set * mechanisms"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_inquire_cred_by_mech
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_cred_id_t cred_handle"
|
||||
.Fa "const gss_OID mech_type"
|
||||
.Fa "gss_name_t * name"
|
||||
.Fa "OM_uint32 * initiator_lifetime"
|
||||
.Fa "OM_uint32 * acceptor_lifetime"
|
||||
.Fa "gss_cred_usage_t * cred_usage"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_inquire_mechs_for_name
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_name_t input_name"
|
||||
.Fa "gss_OID_set * mech_types"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_inquire_names_for_mech
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_OID mechanism"
|
||||
.Fa "gss_OID_set * name_types"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_krb5_ccache_name
|
||||
.Fa "OM_uint32 *minor"
|
||||
.Fa "const char *name"
|
||||
.Fa "const char **old_name"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_krb5_copy_ccache
|
||||
.Fa "OM_uint32 *minor"
|
||||
.Fa "gss_cred_id_t cred"
|
||||
.Fa "krb5_ccache out"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_krb5_import_cred
|
||||
.Fa "OM_uint32 *minor_status"
|
||||
.Fa "krb5_ccache id"
|
||||
.Fa "krb5_principal keytab_principal"
|
||||
.Fa "krb5_keytab keytab"
|
||||
.Fa "gss_cred_id_t *cred"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_krb5_compat_des3_mic
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_ctx_id_t context_handle"
|
||||
.Fa "int onoff"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gsskrb5_extract_authz_data_from_sec_context
|
||||
.Fa "OM_uint32 *minor_status"
|
||||
.Fa "gss_ctx_id_t context_handle"
|
||||
.Fa "int ad_type"
|
||||
.Fa "gss_buffer_t ad_data"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gsskrb5_register_acceptor_identity
|
||||
.Fa "const char *identity"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_krb5_import_cache
|
||||
.Fa "OM_uint32 *minor"
|
||||
.Fa "krb5_ccache id"
|
||||
.Fa "krb5_keytab keytab"
|
||||
.Fa "gss_cred_id_t *cred"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_krb5_get_tkt_flags
|
||||
.Fa "OM_uint32 *minor_status"
|
||||
.Fa "gss_ctx_id_t context_handle"
|
||||
.Fa "OM_uint32 *tkt_flags"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_process_context_token
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_ctx_id_t context_handle"
|
||||
.Fa "const gss_buffer_t token_buffer"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_release_buffer
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_buffer_t buffer"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_release_cred
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_cred_id_t * cred_handle"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_release_name
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_name_t * input_name"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_release_oid_set
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_OID_set * set"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_seal
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_ctx_id_t context_handle"
|
||||
.Fa "int conf_req_flag"
|
||||
.Fa "int qop_req"
|
||||
.Fa "gss_buffer_t input_message_buffer"
|
||||
.Fa "int * conf_state"
|
||||
.Fa "gss_buffer_t output_message_buffer"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_sign
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_ctx_id_t context_handle"
|
||||
.Fa "int qop_req"
|
||||
.Fa "gss_buffer_t message_buffer"
|
||||
.Fa "gss_buffer_t message_token"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_test_oid_set_member
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_OID member"
|
||||
.Fa "const gss_OID_set set"
|
||||
.Fa "int * present"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_unseal
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_ctx_id_t context_handle"
|
||||
.Fa "gss_buffer_t input_message_buffer"
|
||||
.Fa "gss_buffer_t output_message_buffer"
|
||||
.Fa "int * conf_state"
|
||||
.Fa "int * qop_state"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_unwrap
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_ctx_id_t context_handle"
|
||||
.Fa "const gss_buffer_t input_message_buffer"
|
||||
.Fa "gss_buffer_t output_message_buffer"
|
||||
.Fa "int * conf_state"
|
||||
.Fa "gss_qop_t * qop_state"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_verify
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "gss_ctx_id_t context_handle"
|
||||
.Fa "gss_buffer_t message_buffer"
|
||||
.Fa "gss_buffer_t token_buffer"
|
||||
.Fa "int * qop_state"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_verify_mic
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_ctx_id_t context_handle"
|
||||
.Fa "const gss_buffer_t message_buffer"
|
||||
.Fa "const gss_buffer_t token_buffer"
|
||||
.Fa "gss_qop_t * qop_state"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_wrap
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_ctx_id_t context_handle"
|
||||
.Fa "int conf_req_flag"
|
||||
.Fa "gss_qop_t qop_req"
|
||||
.Fa "const gss_buffer_t input_message_buffer"
|
||||
.Fa "int * conf_state"
|
||||
.Fa "gss_buffer_t output_message_buffer"
|
||||
.Fc
|
||||
.Ft OM_uint32
|
||||
.Fo gss_wrap_size_limit
|
||||
.Fa "OM_uint32 * minor_status"
|
||||
.Fa "const gss_ctx_id_t context_handle"
|
||||
.Fa "int conf_req_flag"
|
||||
.Fa "gss_qop_t qop_req"
|
||||
.Fa "OM_uint32 req_output_size"
|
||||
.Fa "OM_uint32 * max_input_size"
|
||||
.Fc
|
||||
.Sh DESCRIPTION
|
||||
Generic Security Service API (GSS-API) version 2, and its C binding,
|
||||
is described in
|
||||
.Li RFC2743
|
||||
and
|
||||
.Li RFC2744 .
|
||||
Version 1 (deprecated) of the C binding is described in
|
||||
.Li RFC1509 .
|
||||
.Pp
|
||||
Heimdals GSS-API implementation supports the following mechanisms
|
||||
.Bl -bullet
|
||||
.It
|
||||
.Li GSS_KRB5_MECHANISM
|
||||
.It
|
||||
.Li GSS_SPNEGO_MECHANISM
|
||||
.El
|
||||
.Pp
|
||||
GSS-API have generic name types that all mechanism are supposed to
|
||||
implement (if possible):
|
||||
.Bl -bullet
|
||||
.It
|
||||
.Li GSS_C_NT_USER_NAME
|
||||
.It
|
||||
.Li GSS_C_NT_MACHINE_UID_NAME
|
||||
.It
|
||||
.Li GSS_C_NT_STRING_UID_NAME
|
||||
.It
|
||||
.Li GSS_C_NT_HOSTBASED_SERVICE
|
||||
.It
|
||||
.Li GSS_C_NT_ANONYMOUS
|
||||
.It
|
||||
.Li GSS_C_NT_EXPORT_NAME
|
||||
.El
|
||||
.Pp
|
||||
GSS-API implementations that supports Kerberos 5 have some additional
|
||||
name types:
|
||||
.Bl -bullet
|
||||
.It
|
||||
.Li GSS_KRB5_NT_PRINCIPAL_NAME
|
||||
.It
|
||||
.Li GSS_KRB5_NT_USER_NAME
|
||||
.It
|
||||
.Li GSS_KRB5_NT_MACHINE_UID_NAME
|
||||
.It
|
||||
.Li GSS_KRB5_NT_STRING_UID_NAME
|
||||
.El
|
||||
.Pp
|
||||
In GSS-API, names have two forms, internal names and contiguous string
|
||||
names.
|
||||
.Bl -bullet
|
||||
.It
|
||||
.Li Internal name and mechanism name
|
||||
.Pp
|
||||
Internal names are implementation specific representation of
|
||||
a GSS-API name.
|
||||
.Li Mechanism names
|
||||
special form of internal names corresponds to one and only one mechanism.
|
||||
.Pp
|
||||
In GSS-API an internal name is stored in a
|
||||
.Dv gss_name_t .
|
||||
.It
|
||||
.Li Contiguous string name and exported name
|
||||
.Pp
|
||||
Contiguous string names are gssapi names stored in a
|
||||
.Dv OCTET STRING
|
||||
that together with a name type identifier (OID) uniquely specifies a
|
||||
gss-name.
|
||||
A special form of the contiguous string name is the exported name that
|
||||
have a OID embedded in the string to make it unique.
|
||||
Exported name have the nametype
|
||||
.Dv GSS_C_NT_EXPORT_NAME .
|
||||
.Pp
|
||||
In GSS-API an contiguous string name is stored in a
|
||||
.Dv gss_buffer_t .
|
||||
.Pp
|
||||
Exported names also have the property that they are specified by the
|
||||
mechanism itself and compatible between different GSS-API
|
||||
implementations.
|
||||
.El
|
||||
.Sh ACCESS CONTROL
|
||||
There are two ways of comparing GSS-API names, either comparing two
|
||||
internal names with each other or two contiguous string names with
|
||||
either other.
|
||||
.Pp
|
||||
To compare two internal names with each other, import (if needed) the
|
||||
names with
|
||||
.Fn gss_import_name
|
||||
into the GSS-API implementation and the compare the imported name with
|
||||
.Fn gss_compare_name .
|
||||
.Pp
|
||||
Importing names can be slow, so when its possible to store exported
|
||||
names in the access control list, comparing contiguous string name
|
||||
might be better.
|
||||
.Pp
|
||||
when comparing contiguous string name, first export them into a
|
||||
.Dv GSS_C_NT_EXPORT_NAME
|
||||
name with
|
||||
.Fn gss_export_name
|
||||
and then compare with
|
||||
.Xr memcmp 3 .
|
||||
.Pp
|
||||
Note that there are might be a difference between the two methods of
|
||||
comparing names.
|
||||
The first (using
|
||||
.Fn gss_compare_name )
|
||||
will compare to (unauthenticated) names are the same.
|
||||
The second will compare if a mechanism will authenticate them as the
|
||||
same principal.
|
||||
.Pp
|
||||
For example, if
|
||||
.Fn gss_import_name
|
||||
name was used with
|
||||
.Dv GSS_C_NO_OID
|
||||
the default syntax is used for all mechanism the GSS-API
|
||||
implementation supports.
|
||||
When compare the imported name of
|
||||
.Dv GSS_C_NO_OID
|
||||
it may match serveral mechanism names (MN).
|
||||
.Pp
|
||||
The resulting name from
|
||||
.Fn gss_display_name
|
||||
must not be used for acccess control.
|
||||
.Sh FUNCTIONS
|
||||
.Fn gss_display_name
|
||||
takes the gss name in
|
||||
.Fa input_name
|
||||
and puts a printable form in
|
||||
.Fa output_name_buffer .
|
||||
.Fa output_name_buffer
|
||||
should be freed when done using
|
||||
.Fn gss_release_buffer .
|
||||
.Fa output_name_type
|
||||
can either be
|
||||
.Dv NULL
|
||||
or a pointer to a
|
||||
.Li gss_OID
|
||||
and will in the latter case contain the OID type of the name.
|
||||
The name must only be used for printing.
|
||||
If access control is needed, see section
|
||||
.Sx ACCESS CONTROL .
|
||||
.Pp
|
||||
.Fn gss_inquire_context
|
||||
returns information about the context.
|
||||
Information is available even after the context have expired.
|
||||
.Fa lifetime_rec
|
||||
argument is set to
|
||||
.Dv GSS_C_INDEFINITE
|
||||
(dont expire) or the number of seconds that the context is still valid.
|
||||
A value of 0 means that the context is expired.
|
||||
.Fa mech_type
|
||||
argument should be considered readonly and must not be released.
|
||||
.Fa src_name
|
||||
and
|
||||
.Fn dest_name
|
||||
are both mechanims names and must be released with
|
||||
.Fn gss_release_name
|
||||
when no longer used.
|
||||
.Pp
|
||||
.Nm gss_context_time
|
||||
will return the amount of time (in seconds) of the context is still
|
||||
valid.
|
||||
If its expired
|
||||
.Fa time_rec
|
||||
will be set to 0 and
|
||||
.Dv GSS_S_CONTEXT_EXPIRED
|
||||
returned.
|
||||
.Pp
|
||||
.Fn gss_sign ,
|
||||
.Fn gss_verify ,
|
||||
.Fn gss_seal ,
|
||||
and
|
||||
.Fn gss_unseal
|
||||
are part of the GSS-API V1 interface and are obsolete.
|
||||
The functions should not be used for new applications.
|
||||
They are provided so that version 1 applications can link against the
|
||||
library.
|
||||
.Sh EXTENSIONS
|
||||
.Fn gss_krb5_ccache_name
|
||||
sets the internal kerberos 5 credential cache name to
|
||||
.Fa name .
|
||||
The old name is returned in
|
||||
.Fa old_name ,
|
||||
and must not be freed.
|
||||
The data allocated for
|
||||
.Fa old_name
|
||||
is free upon next call to
|
||||
.Fn gss_krb5_ccache_name .
|
||||
This function is not threadsafe if
|
||||
.Fa old_name
|
||||
argument is used.
|
||||
.Pp
|
||||
.Fn gss_krb5_copy_ccache
|
||||
will extract the krb5 credentials that are transferred from the
|
||||
initiator to the acceptor when using token delegation in the Kerberos
|
||||
mechanism.
|
||||
The acceptor receives the delegated token in the last argument to
|
||||
.Fn gss_accept_sec_context .
|
||||
.Pp
|
||||
.Fn gss_krb5_import_cred
|
||||
will import the krb5 credentials (both keytab and/or credential cache)
|
||||
into gss credential so it can be used withing GSS-API.
|
||||
The
|
||||
.Fa ccache
|
||||
is copied by reference and thus shared, so if the credential is destroyed
|
||||
with
|
||||
.Fa krb5_cc_destroy ,
|
||||
all users of thep
|
||||
.Fa gss_cred_id_t
|
||||
returned by
|
||||
.Fn gss_krb5_import_ccache
|
||||
will fail.
|
||||
.Pp
|
||||
.Fn gsskrb5_register_acceptor_identity
|
||||
sets the Kerberos 5 filebased keytab that the acceptor will use. The
|
||||
.Fa identifier
|
||||
is the file name.
|
||||
.Pp
|
||||
.Fn gsskrb5_extract_authz_data_from_sec_context
|
||||
extracts the Kerberos authorizationdata that may be stored within the
|
||||
context.
|
||||
Tha caller must free the returned buffer
|
||||
.Fa ad_data
|
||||
with
|
||||
.Fn gss_release_buffer
|
||||
upon success.
|
||||
.Pp
|
||||
.Fn gss_krb5_get_tkt_flags
|
||||
return the ticket flags for the kerberos ticket receive when
|
||||
authenticating the initiator.
|
||||
Only valid on the acceptor context.
|
||||
.Pp
|
||||
.Fn gss_krb5_compat_des3_mic
|
||||
turns on or off the compatibility with older version of Heimdal using
|
||||
des3 get and verify mic, this is way to programmatically set the
|
||||
[gssapi]broken_des3_mic and [gssapi]correct_des3_mic flags (see
|
||||
COMPATIBILITY section in
|
||||
.Xr gssapi 3 ) .
|
||||
If the CPP symbol
|
||||
.Dv GSS_C_KRB5_COMPAT_DES3_MIC
|
||||
is present,
|
||||
.Fn gss_krb5_compat_des3_mic
|
||||
exists.
|
||||
.Fn gss_krb5_compat_des3_mic
|
||||
will be removed in a later version of the GSS-API library.
|
||||
.Sh SEE ALSO
|
||||
.Xr gssapi 3 ,
|
||||
.Xr krb5 3 ,
|
||||
.Xr krb5_ccache 3 ,
|
||||
.Xr kerberos 8
|
||||
@@ -0,0 +1,174 @@
|
||||
.\" $NetBSD: gssapi.3,v 1.3 2011/04/28 14:28:47 wiz Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2003 - 2005 Kungliga Tekniska Högskolan
|
||||
.\" (Royal Institute of Technology, Stockholm, Sweden).
|
||||
.\" All rights reserved.
|
||||
.\"
|
||||
.\" Redistribution and use in source and binary forms, with or without
|
||||
.\" modification, are permitted provided that the following conditions
|
||||
.\" are met:
|
||||
.\"
|
||||
.\" 1. Redistributions of source code must retain the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer.
|
||||
.\"
|
||||
.\" 2. Redistributions in binary form must reproduce the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer in the
|
||||
.\" documentation and/or other materials provided with the distribution.
|
||||
.\"
|
||||
.\" 3. Neither the name of the Institute nor the names of its contributors
|
||||
.\" may be used to endorse or promote products derived from this software
|
||||
.\" without specific prior written permission.
|
||||
.\"
|
||||
.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
.\" SUCH DAMAGE.
|
||||
.\"
|
||||
.\" Id
|
||||
.\"
|
||||
.Dd April 20, 2005
|
||||
.Dt GSSAPI 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm gssapi
|
||||
.Nd Generic Security Service Application Program Interface library
|
||||
.Sh LIBRARY
|
||||
GSS-API Library (libgssapi, -lgssapi)
|
||||
.Sh DESCRIPTION
|
||||
The Generic Security Service Application Program Interface (GSS-API)
|
||||
provides security services to callers in a generic fashion,
|
||||
supportable with a range of underlying mechanisms and technologies and
|
||||
hence allowing source-level portability of applications to different
|
||||
environments.
|
||||
.Pp
|
||||
The GSS-API implementation in Heimdal implements the Kerberos 5 and
|
||||
the SPNEGO GSS-API security mechanisms.
|
||||
.Sh LIST OF FUNCTIONS
|
||||
These functions constitute the gssapi library,
|
||||
.Em libgssapi .
|
||||
Declarations for these functions may be obtained from the include file
|
||||
.Pa gssapi/gssapi.h .
|
||||
.Bl -column -compact
|
||||
.It Sy Name/Page
|
||||
.It Xr gss_accept_sec_context 3
|
||||
.It Xr gss_acquire_cred 3
|
||||
.It Xr gss_add_cred 3
|
||||
.It Xr gss_add_oid_set_member 3
|
||||
.It Xr gss_canonicalize_name 3
|
||||
.It Xr gss_compare_name 3
|
||||
.It Xr gss_context_time 3
|
||||
.It Xr gss_create_empty_oid_set 3
|
||||
.It Xr gss_delete_sec_context 3
|
||||
.It Xr gss_display_name 3
|
||||
.It Xr gss_display_status 3
|
||||
.It Xr gss_duplicate_name 3
|
||||
.It Xr gss_export_name 3
|
||||
.It Xr gss_export_sec_context 3
|
||||
.It Xr gss_get_mic 3
|
||||
.It Xr gss_import_name 3
|
||||
.It Xr gss_import_sec_context 3
|
||||
.It Xr gss_indicate_mechs 3
|
||||
.It Xr gss_init_sec_context 3
|
||||
.It Xr gss_inquire_context 3
|
||||
.It Xr gss_inquire_cred 3
|
||||
.It Xr gss_inquire_cred_by_mech 3
|
||||
.It Xr gss_inquire_mechs_for_name 3
|
||||
.It Xr gss_inquire_names_for_mech 3
|
||||
.It Xr gss_krb5_ccache_name 3
|
||||
.It Xr gss_krb5_compat_des3_mic 3
|
||||
.It Xr gss_krb5_copy_ccache 3
|
||||
.It Xr gss_krb5_extract_authz_data_from_sec_context 3
|
||||
.It Xr gss_krb5_import_ccache 3
|
||||
.It Xr gss_process_context_token 3
|
||||
.It Xr gss_release_buffer 3
|
||||
.It Xr gss_release_cred 3
|
||||
.It Xr gss_release_name 3
|
||||
.It Xr gss_release_oid_set 3
|
||||
.It Xr gss_seal 3
|
||||
.It Xr gss_sign 3
|
||||
.It Xr gss_test_oid_set_member 3
|
||||
.It Xr gss_unseal 3
|
||||
.It Xr gss_unwrap 3
|
||||
.It Xr gss_verify 3
|
||||
.It Xr gss_verify_mic 3
|
||||
.It Xr gss_wrap 3
|
||||
.It Xr gss_wrap_size_limit 3
|
||||
.El
|
||||
.Sh COMPATIBILITY
|
||||
The
|
||||
.Nm Heimdal
|
||||
GSS-API implementation had a bug in releases before 0.6 that made it
|
||||
fail to inter-operate when using DES3 with other GSS-API
|
||||
implementations when using
|
||||
.Fn gss_get_mic
|
||||
/
|
||||
.Fn gss_verify_mic .
|
||||
It is possible to modify the behavior of the generator of the MIC with
|
||||
the
|
||||
.Pa krb5.conf
|
||||
configuration file so that old clients/servers will still
|
||||
work.
|
||||
.Pp
|
||||
New clients/servers will try both the old and new MIC in Heimdal 0.6.
|
||||
In 0.7 it will check only if configured - the compatibility code will
|
||||
be removed in 0.8.
|
||||
.Pp
|
||||
Heimdal 0.6 still generates by default the broken GSS-API DES3 mic,
|
||||
this will change in 0.7 to generate correct des3 mic.
|
||||
.Pp
|
||||
To turn on compatibility with older clients and servers, change the
|
||||
.Nm [gssapi]
|
||||
.Ar broken_des3_mic
|
||||
in
|
||||
.Pa krb5.conf
|
||||
that contains a list of globbing expressions that will be matched
|
||||
against the server name.
|
||||
To turn off generation of the old (incompatible) mic of the MIC use
|
||||
.Nm [gssapi]
|
||||
.Ar correct_des3_mic .
|
||||
.Pp
|
||||
If a match for a entry is in both
|
||||
.Nm [gssapi]
|
||||
.Ar correct_des3_mic
|
||||
and
|
||||
.Nm [gssapi]
|
||||
.Ar broken_des3_mic ,
|
||||
the later will override.
|
||||
.Pp
|
||||
This config option modifies behaviour for both clients and servers.
|
||||
.Pp
|
||||
Microsoft implemented SPNEGO to Windows2000, however, they managed to
|
||||
get it wrong, their implementation didn't fill in the MechListMIC in
|
||||
the reply token with the right content.
|
||||
There is a work around for this problem, but not all implementation
|
||||
support it.
|
||||
.Pp
|
||||
Heimdal defaults to correct SPNEGO when the the kerberos
|
||||
implementation uses CFX, or when it is configured by the user.
|
||||
To turn on compatibility with peers, use option
|
||||
.Nm [gssapi]
|
||||
.Ar require_mechlist_mic .
|
||||
.Sh EXAMPLES
|
||||
.Bd -literal -offset indent
|
||||
[gssapi]
|
||||
broken_des3_mic = cvs/*@SU.SE
|
||||
broken_des3_mic = host/*@E.KTH.SE
|
||||
correct_des3_mic = host/*@SU.SE
|
||||
require_mechlist_mic = host/*@SU.SE
|
||||
.Ed
|
||||
.Sh BUGS
|
||||
All of 0.5.x versions of
|
||||
.Nm heimdal
|
||||
had broken token delegations in the client side, the server side was
|
||||
correct.
|
||||
.Sh SEE ALSO
|
||||
.Xr krb5 3 ,
|
||||
.Xr krb5.conf 5 ,
|
||||
.Xr kerberos 8
|
||||
@@ -0,0 +1,43 @@
|
||||
/* $NetBSD: gssapi.h,v 1.1.1.2 2011/04/14 14:08:24 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* Id */
|
||||
|
||||
#ifndef GSSAPI_H_
|
||||
#define GSSAPI_H_
|
||||
|
||||
#include <gssapi/gssapi.h>
|
||||
|
||||
#endif
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,227 @@
|
||||
/* $NetBSD: gssapi_krb5.h,v 1.1.1.2 2011/04/14 14:08:25 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* Id */
|
||||
|
||||
#ifndef GSSAPI_KRB5_H_
|
||||
#define GSSAPI_KRB5_H_
|
||||
|
||||
#include <gssapi/gssapi.h>
|
||||
|
||||
GSSAPI_CPP_START
|
||||
|
||||
#if !defined(__GNUC__) && !defined(__attribute__)
|
||||
#define __attribute__(x)
|
||||
#endif
|
||||
|
||||
#ifndef GSSKRB5_FUNCTION_DEPRECATED
|
||||
#define GSSKRB5_FUNCTION_DEPRECATED __attribute__((deprecated))
|
||||
#endif
|
||||
|
||||
|
||||
/*
|
||||
* This is for kerberos5 names.
|
||||
*/
|
||||
|
||||
extern gss_OID_desc GSSAPI_LIB_VARIABLE __gss_krb5_nt_principal_name_oid_desc;
|
||||
#define GSS_KRB5_NT_PRINCIPAL_NAME (&__gss_krb5_nt_principal_name_oid_desc)
|
||||
|
||||
#define GSS_KRB5_NT_USER_NAME (&__gss_c_nt_user_name_oid_desc)
|
||||
#define GSS_KRB5_NT_MACHINE_UID_NAME (&__gss_c_nt_machine_uid_name_oid_desc)
|
||||
#define GSS_KRB5_NT_STRING_UID_NAME (&__gss_c_nt_string_uid_name_oid_desc)
|
||||
|
||||
extern gss_OID_desc GSSAPI_LIB_VARIABLE __gss_krb5_mechanism_oid_desc;
|
||||
#define GSS_KRB5_MECHANISM (&__gss_krb5_mechanism_oid_desc)
|
||||
|
||||
/* for compatibility with MIT api */
|
||||
|
||||
#define gss_mech_krb5 GSS_KRB5_MECHANISM
|
||||
#define gss_krb5_nt_general_name GSS_KRB5_NT_PRINCIPAL_NAME
|
||||
|
||||
/*
|
||||
* kerberos mechanism specific functions
|
||||
*/
|
||||
|
||||
struct krb5_keytab_data;
|
||||
struct krb5_ccache_data;
|
||||
struct Principal;
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_krb5_ccache_name(OM_uint32 * /*minor_status*/,
|
||||
const char * /*name */,
|
||||
const char ** /*out_name */);
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gsskrb5_register_acceptor_identity
|
||||
(const char * /*identity*/);
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL krb5_gss_register_acceptor_identity
|
||||
(const char * /*identity*/);
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_krb5_copy_ccache
|
||||
(OM_uint32 * /*minor*/,
|
||||
gss_cred_id_t /*cred*/,
|
||||
struct krb5_ccache_data * /*out*/);
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_krb5_import_cred(OM_uint32 * /*minor*/,
|
||||
struct krb5_ccache_data * /*in*/,
|
||||
struct Principal * /*keytab_principal*/,
|
||||
struct krb5_keytab_data * /*keytab*/,
|
||||
gss_cred_id_t * /*out*/);
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_krb5_get_tkt_flags
|
||||
(OM_uint32 * /*minor*/,
|
||||
gss_ctx_id_t /*context_handle*/,
|
||||
OM_uint32 * /*tkt_flags*/);
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gsskrb5_extract_authz_data_from_sec_context
|
||||
(OM_uint32 * /*minor_status*/,
|
||||
gss_ctx_id_t /*context_handle*/,
|
||||
int /*ad_type*/,
|
||||
gss_buffer_t /*ad_data*/);
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gsskrb5_set_dns_canonicalize(int);
|
||||
|
||||
struct gsskrb5_send_to_kdc {
|
||||
void *func;
|
||||
void *ptr;
|
||||
};
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gsskrb5_set_send_to_kdc(struct gsskrb5_send_to_kdc *)
|
||||
GSSKRB5_FUNCTION_DEPRECATED;
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gsskrb5_set_default_realm(const char *);
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gsskrb5_extract_authtime_from_sec_context(OM_uint32 *, gss_ctx_id_t, time_t *);
|
||||
|
||||
struct EncryptionKey;
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gsskrb5_extract_service_keyblock(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
struct EncryptionKey **out);
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gsskrb5_get_initiator_subkey(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
struct EncryptionKey **out);
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gsskrb5_get_subkey(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
struct EncryptionKey **out);
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gsskrb5_set_time_offset(int);
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gsskrb5_get_time_offset(int *);
|
||||
|
||||
struct gsskrb5_krb5_plugin {
|
||||
int type;
|
||||
char *name;
|
||||
void *symbol;
|
||||
};
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gsskrb5_plugin_register(struct gsskrb5_krb5_plugin *);
|
||||
|
||||
|
||||
/*
|
||||
* Lucid - NFSv4 interface to GSS-API KRB5 to expose key material to
|
||||
* do GSS content token handling in-kernel.
|
||||
*/
|
||||
|
||||
typedef struct gss_krb5_lucid_key {
|
||||
OM_uint32 type;
|
||||
OM_uint32 length;
|
||||
void * data;
|
||||
} gss_krb5_lucid_key_t;
|
||||
|
||||
typedef struct gss_krb5_rfc1964_keydata {
|
||||
OM_uint32 sign_alg;
|
||||
OM_uint32 seal_alg;
|
||||
gss_krb5_lucid_key_t ctx_key;
|
||||
} gss_krb5_rfc1964_keydata_t;
|
||||
|
||||
typedef struct gss_krb5_cfx_keydata {
|
||||
OM_uint32 have_acceptor_subkey;
|
||||
gss_krb5_lucid_key_t ctx_key;
|
||||
gss_krb5_lucid_key_t acceptor_subkey;
|
||||
} gss_krb5_cfx_keydata_t;
|
||||
|
||||
typedef struct gss_krb5_lucid_context_v1 {
|
||||
OM_uint32 version;
|
||||
OM_uint32 initiate;
|
||||
OM_uint32 endtime;
|
||||
OM_uint64 send_seq;
|
||||
OM_uint64 recv_seq;
|
||||
OM_uint32 protocol;
|
||||
gss_krb5_rfc1964_keydata_t rfc1964_kd;
|
||||
gss_krb5_cfx_keydata_t cfx_kd;
|
||||
} gss_krb5_lucid_context_v1_t;
|
||||
|
||||
typedef struct gss_krb5_lucid_context_version {
|
||||
OM_uint32 version; /* Structure version number */
|
||||
} gss_krb5_lucid_context_version_t;
|
||||
|
||||
/*
|
||||
* Function declarations
|
||||
*/
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_krb5_export_lucid_sec_context(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t *context_handle,
|
||||
OM_uint32 version,
|
||||
void **kctx);
|
||||
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_krb5_free_lucid_sec_context(OM_uint32 *minor_status,
|
||||
void *kctx);
|
||||
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_krb5_set_allowable_enctypes(OM_uint32 *minor_status,
|
||||
gss_cred_id_t cred,
|
||||
OM_uint32 num_enctypes,
|
||||
int32_t *enctypes);
|
||||
|
||||
GSSAPI_CPP_END
|
||||
|
||||
#endif /* GSSAPI_SPNEGO_H_ */
|
||||
@@ -0,0 +1,52 @@
|
||||
/* $NetBSD: gssapi_netlogon.h,v 1.1.1.2 2011/04/14 14:08:25 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2006 - 2009 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* Id */
|
||||
|
||||
#ifndef GSSAPI_NETLOGON_H_
|
||||
#define GSSAPI_NETLOGON_H_
|
||||
|
||||
#include <gssapi/gssapi.h>
|
||||
|
||||
GSSAPI_CPP_START
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID GSS_NETLOGON_MECHANISM;
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID GSS_NETLOGON_NT_NETBIOS_DNS_NAME;
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID GSS_NETLOGON_SET_SESSION_KEY_X;
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID GSS_NETLOGON_SET_SIGN_ALGORITHM_X;
|
||||
|
||||
GSSAPI_CPP_END
|
||||
|
||||
#endif /* GSSAPI_NETLOGON_H_ */
|
||||
@@ -0,0 +1,43 @@
|
||||
/* $NetBSD: gssapi_ntlm.h,v 1.1.1.2 2011/04/14 14:08:25 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2006 - 2009 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* Id */
|
||||
|
||||
#ifndef GSSAPI_NTLM_H_
|
||||
#define GSSAPI_NTLM_H_
|
||||
|
||||
#include <gssapi/gssapi.h>
|
||||
|
||||
#endif /* GSSAPI_NTLM_H_ */
|
||||
@@ -0,0 +1,240 @@
|
||||
/* $NetBSD: gssapi_oid.h,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/* Generated file */
|
||||
#ifndef GSSAPI_GSSAPI_OID
|
||||
#define GSSAPI_GSSAPI_OID 1
|
||||
|
||||
/* contact Love Hörnquist Åstrand <lha@h5l.org> for new oid arcs */
|
||||
/*
|
||||
* 1.2.752.43.13 Heimdal GSS-API Extentions
|
||||
*/
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_copy_ccache_x_oid_desc;
|
||||
#define GSS_KRB5_COPY_CCACHE_X (&__gss_krb5_copy_ccache_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_get_tkt_flags_x_oid_desc;
|
||||
#define GSS_KRB5_GET_TKT_FLAGS_X (&__gss_krb5_get_tkt_flags_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_extract_authz_data_from_sec_context_x_oid_desc;
|
||||
#define GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_X (&__gss_krb5_extract_authz_data_from_sec_context_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_compat_des3_mic_x_oid_desc;
|
||||
#define GSS_KRB5_COMPAT_DES3_MIC_X (&__gss_krb5_compat_des3_mic_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_register_acceptor_identity_x_oid_desc;
|
||||
#define GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X (&__gss_krb5_register_acceptor_identity_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_export_lucid_context_x_oid_desc;
|
||||
#define GSS_KRB5_EXPORT_LUCID_CONTEXT_X (&__gss_krb5_export_lucid_context_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_export_lucid_context_v1_x_oid_desc;
|
||||
#define GSS_KRB5_EXPORT_LUCID_CONTEXT_V1_X (&__gss_krb5_export_lucid_context_v1_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_set_dns_canonicalize_x_oid_desc;
|
||||
#define GSS_KRB5_SET_DNS_CANONICALIZE_X (&__gss_krb5_set_dns_canonicalize_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_get_subkey_x_oid_desc;
|
||||
#define GSS_KRB5_GET_SUBKEY_X (&__gss_krb5_get_subkey_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_get_initiator_subkey_x_oid_desc;
|
||||
#define GSS_KRB5_GET_INITIATOR_SUBKEY_X (&__gss_krb5_get_initiator_subkey_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_get_acceptor_subkey_x_oid_desc;
|
||||
#define GSS_KRB5_GET_ACCEPTOR_SUBKEY_X (&__gss_krb5_get_acceptor_subkey_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_send_to_kdc_x_oid_desc;
|
||||
#define GSS_KRB5_SEND_TO_KDC_X (&__gss_krb5_send_to_kdc_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_get_authtime_x_oid_desc;
|
||||
#define GSS_KRB5_GET_AUTHTIME_X (&__gss_krb5_get_authtime_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_get_service_keyblock_x_oid_desc;
|
||||
#define GSS_KRB5_GET_SERVICE_KEYBLOCK_X (&__gss_krb5_get_service_keyblock_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_set_allowable_enctypes_x_oid_desc;
|
||||
#define GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X (&__gss_krb5_set_allowable_enctypes_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_set_default_realm_x_oid_desc;
|
||||
#define GSS_KRB5_SET_DEFAULT_REALM_X (&__gss_krb5_set_default_realm_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_ccache_name_x_oid_desc;
|
||||
#define GSS_KRB5_CCACHE_NAME_X (&__gss_krb5_ccache_name_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_set_time_offset_x_oid_desc;
|
||||
#define GSS_KRB5_SET_TIME_OFFSET_X (&__gss_krb5_set_time_offset_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_get_time_offset_x_oid_desc;
|
||||
#define GSS_KRB5_GET_TIME_OFFSET_X (&__gss_krb5_get_time_offset_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_plugin_register_x_oid_desc;
|
||||
#define GSS_KRB5_PLUGIN_REGISTER_X (&__gss_krb5_plugin_register_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_ntlm_get_session_key_x_oid_desc;
|
||||
#define GSS_NTLM_GET_SESSION_KEY_X (&__gss_ntlm_get_session_key_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_nt_ntlm_oid_desc;
|
||||
#define GSS_C_NT_NTLM (&__gss_c_nt_ntlm_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_nt_dn_oid_desc;
|
||||
#define GSS_C_NT_DN (&__gss_c_nt_dn_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_nt_principal_name_referral_oid_desc;
|
||||
#define GSS_KRB5_NT_PRINCIPAL_NAME_REFERRAL (&__gss_krb5_nt_principal_name_referral_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ntlm_avguest_oid_desc;
|
||||
#define GSS_C_NTLM_AVGUEST (&__gss_c_ntlm_avguest_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ntlm_v1_oid_desc;
|
||||
#define GSS_C_NTLM_V1 (&__gss_c_ntlm_v1_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ntlm_v2_oid_desc;
|
||||
#define GSS_C_NTLM_V2 (&__gss_c_ntlm_v2_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ntlm_session_key_oid_desc;
|
||||
#define GSS_C_NTLM_SESSION_KEY (&__gss_c_ntlm_session_key_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ntlm_force_v1_oid_desc;
|
||||
#define GSS_C_NTLM_FORCE_V1 (&__gss_c_ntlm_force_v1_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_cred_no_ci_flags_x_oid_desc;
|
||||
#define GSS_KRB5_CRED_NO_CI_FLAGS_X (&__gss_krb5_cred_no_ci_flags_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_import_cred_x_oid_desc;
|
||||
#define GSS_KRB5_IMPORT_CRED_X (&__gss_krb5_import_cred_x_oid_desc)
|
||||
|
||||
/* glue for gss_inquire_saslname_for_mech */
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_sasl_mech_name_oid_desc;
|
||||
#define GSS_C_MA_SASL_MECH_NAME (&__gss_c_ma_sasl_mech_name_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_mech_name_oid_desc;
|
||||
#define GSS_C_MA_MECH_NAME (&__gss_c_ma_mech_name_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_mech_description_oid_desc;
|
||||
#define GSS_C_MA_MECH_DESCRIPTION (&__gss_c_ma_mech_description_oid_desc)
|
||||
|
||||
/* Heimdal mechanisms - 1.2.752.43.14 */
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_sasl_digest_md5_mechanism_oid_desc;
|
||||
#define GSS_SASL_DIGEST_MD5_MECHANISM (&__gss_sasl_digest_md5_mechanism_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_netlogon_mechanism_oid_desc;
|
||||
#define GSS_NETLOGON_MECHANISM (&__gss_netlogon_mechanism_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_netlogon_set_session_key_x_oid_desc;
|
||||
#define GSS_NETLOGON_SET_SESSION_KEY_X (&__gss_netlogon_set_session_key_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_netlogon_set_sign_algorithm_x_oid_desc;
|
||||
#define GSS_NETLOGON_SET_SIGN_ALGORITHM_X (&__gss_netlogon_set_sign_algorithm_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_netlogon_nt_netbios_dns_name_oid_desc;
|
||||
#define GSS_NETLOGON_NT_NETBIOS_DNS_NAME (&__gss_netlogon_nt_netbios_dns_name_oid_desc)
|
||||
|
||||
/* GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_X.128 */
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_inq_win2k_pac_x_oid_desc;
|
||||
#define GSS_C_INQ_WIN2K_PAC_X (&__gss_c_inq_win2k_pac_x_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_inq_sspi_session_key_oid_desc;
|
||||
#define GSS_C_INQ_SSPI_SESSION_KEY (&__gss_c_inq_sspi_session_key_oid_desc)
|
||||
|
||||
/*
|
||||
* "Standard" mechs
|
||||
*/
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_mechanism_oid_desc;
|
||||
#define GSS_KRB5_MECHANISM (&__gss_krb5_mechanism_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_ntlm_mechanism_oid_desc;
|
||||
#define GSS_NTLM_MECHANISM (&__gss_ntlm_mechanism_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_spnego_mechanism_oid_desc;
|
||||
#define GSS_SPNEGO_MECHANISM (&__gss_spnego_mechanism_oid_desc)
|
||||
|
||||
/* From Luke Howard */
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_peer_has_updated_spnego_oid_desc;
|
||||
#define GSS_C_PEER_HAS_UPDATED_SPNEGO (&__gss_c_peer_has_updated_spnego_oid_desc)
|
||||
|
||||
/*
|
||||
* OID mappings with name and short description and and slightly longer description
|
||||
*/
|
||||
/*
|
||||
* RFC5587
|
||||
*/
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_mech_concrete_oid_desc;
|
||||
#define GSS_C_MA_MECH_CONCRETE (&__gss_c_ma_mech_concrete_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_mech_pseudo_oid_desc;
|
||||
#define GSS_C_MA_MECH_PSEUDO (&__gss_c_ma_mech_pseudo_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_mech_composite_oid_desc;
|
||||
#define GSS_C_MA_MECH_COMPOSITE (&__gss_c_ma_mech_composite_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_mech_nego_oid_desc;
|
||||
#define GSS_C_MA_MECH_NEGO (&__gss_c_ma_mech_nego_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_mech_glue_oid_desc;
|
||||
#define GSS_C_MA_MECH_GLUE (&__gss_c_ma_mech_glue_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_not_mech_oid_desc;
|
||||
#define GSS_C_MA_NOT_MECH (&__gss_c_ma_not_mech_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_deprecated_oid_desc;
|
||||
#define GSS_C_MA_DEPRECATED (&__gss_c_ma_deprecated_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_not_dflt_mech_oid_desc;
|
||||
#define GSS_C_MA_NOT_DFLT_MECH (&__gss_c_ma_not_dflt_mech_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_itok_framed_oid_desc;
|
||||
#define GSS_C_MA_ITOK_FRAMED (&__gss_c_ma_itok_framed_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_auth_init_oid_desc;
|
||||
#define GSS_C_MA_AUTH_INIT (&__gss_c_ma_auth_init_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_auth_targ_oid_desc;
|
||||
#define GSS_C_MA_AUTH_TARG (&__gss_c_ma_auth_targ_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_auth_init_init_oid_desc;
|
||||
#define GSS_C_MA_AUTH_INIT_INIT (&__gss_c_ma_auth_init_init_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_auth_targ_init_oid_desc;
|
||||
#define GSS_C_MA_AUTH_TARG_INIT (&__gss_c_ma_auth_targ_init_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_auth_init_anon_oid_desc;
|
||||
#define GSS_C_MA_AUTH_INIT_ANON (&__gss_c_ma_auth_init_anon_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_auth_targ_anon_oid_desc;
|
||||
#define GSS_C_MA_AUTH_TARG_ANON (&__gss_c_ma_auth_targ_anon_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_deleg_cred_oid_desc;
|
||||
#define GSS_C_MA_DELEG_CRED (&__gss_c_ma_deleg_cred_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_integ_prot_oid_desc;
|
||||
#define GSS_C_MA_INTEG_PROT (&__gss_c_ma_integ_prot_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_conf_prot_oid_desc;
|
||||
#define GSS_C_MA_CONF_PROT (&__gss_c_ma_conf_prot_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_mic_oid_desc;
|
||||
#define GSS_C_MA_MIC (&__gss_c_ma_mic_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_wrap_oid_desc;
|
||||
#define GSS_C_MA_WRAP (&__gss_c_ma_wrap_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_prot_ready_oid_desc;
|
||||
#define GSS_C_MA_PROT_READY (&__gss_c_ma_prot_ready_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_replay_det_oid_desc;
|
||||
#define GSS_C_MA_REPLAY_DET (&__gss_c_ma_replay_det_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_oos_det_oid_desc;
|
||||
#define GSS_C_MA_OOS_DET (&__gss_c_ma_oos_det_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_cbindings_oid_desc;
|
||||
#define GSS_C_MA_CBINDINGS (&__gss_c_ma_cbindings_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_pfs_oid_desc;
|
||||
#define GSS_C_MA_PFS (&__gss_c_ma_pfs_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_compress_oid_desc;
|
||||
#define GSS_C_MA_COMPRESS (&__gss_c_ma_compress_oid_desc)
|
||||
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_ctx_trans_oid_desc;
|
||||
#define GSS_C_MA_CTX_TRANS (&__gss_c_ma_ctx_trans_oid_desc)
|
||||
|
||||
#endif /* GSSAPI_GSSAPI_OID */
|
||||
@@ -0,0 +1,57 @@
|
||||
/* $NetBSD: gssapi_spnego.h,v 1.1.1.2 2011/04/14 14:08:25 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* Id */
|
||||
|
||||
#ifndef GSSAPI_SPNEGO_H_
|
||||
#define GSSAPI_SPNEGO_H_
|
||||
|
||||
#include <gssapi/gssapi.h>
|
||||
|
||||
GSSAPI_CPP_START
|
||||
|
||||
/*
|
||||
* RFC2478, SPNEGO:
|
||||
* The security mechanism of the initial
|
||||
* negotiation token is identified by the Object Identifier
|
||||
* iso.org.dod.internet.security.mechanism.snego (1.3.6.1.5.5.2).
|
||||
*/
|
||||
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_spnego_mechanism_oid_desc;
|
||||
#define GSS_SPNEGO_MECHANISM (&__gss_spnego_mechanism_oid_desc)
|
||||
#define gss_mech_spnego GSS_SPNEGO_MECHANISM
|
||||
|
||||
GSSAPI_CPP_END
|
||||
|
||||
#endif /* GSSAPI_SPNEGO_H_ */
|
||||
@@ -0,0 +1,557 @@
|
||||
/* $NetBSD: gssapi_mech.h,v 1.1.1.1 2011/04/13 18:14:43 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/mech_switch.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
|
||||
#ifndef GSSAPI_MECH_H
|
||||
#define GSSAPI_MECH_H 1
|
||||
|
||||
#include <gssapi/gssapi.h>
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_acquire_cred_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_name_t, /* desired_name */
|
||||
OM_uint32, /* time_req */
|
||||
const gss_OID_set, /* desired_mechs */
|
||||
gss_cred_usage_t, /* cred_usage */
|
||||
gss_cred_id_t *, /* output_cred_handle */
|
||||
gss_OID_set *, /* actual_mechs */
|
||||
OM_uint32 * /* time_rec */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_release_cred_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
gss_cred_id_t * /* cred_handle */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_init_sec_context_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_cred_id_t, /* initiator_cred_handle */
|
||||
gss_ctx_id_t *, /* context_handle */
|
||||
const gss_name_t, /* target_name */
|
||||
const gss_OID, /* mech_type */
|
||||
OM_uint32, /* req_flags */
|
||||
OM_uint32, /* time_req */
|
||||
const gss_channel_bindings_t,
|
||||
/* input_chan_bindings */
|
||||
const gss_buffer_t, /* input_token */
|
||||
gss_OID *, /* actual_mech_type */
|
||||
gss_buffer_t, /* output_token */
|
||||
OM_uint32 *, /* ret_flags */
|
||||
OM_uint32 * /* time_rec */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_accept_sec_context_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
gss_ctx_id_t *, /* context_handle */
|
||||
const gss_cred_id_t, /* acceptor_cred_handle */
|
||||
const gss_buffer_t, /* input_token_buffer */
|
||||
const gss_channel_bindings_t,
|
||||
/* input_chan_bindings */
|
||||
gss_name_t *, /* src_name */
|
||||
gss_OID *, /* mech_type */
|
||||
gss_buffer_t, /* output_token */
|
||||
OM_uint32 *, /* ret_flags */
|
||||
OM_uint32 *, /* time_rec */
|
||||
gss_cred_id_t * /* delegated_cred_handle */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_process_context_token_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_ctx_id_t, /* context_handle */
|
||||
const gss_buffer_t /* token_buffer */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_delete_sec_context_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
gss_ctx_id_t *, /* context_handle */
|
||||
gss_buffer_t /* output_token */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_context_time_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_ctx_id_t, /* context_handle */
|
||||
OM_uint32 * /* time_rec */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_get_mic_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_ctx_id_t, /* context_handle */
|
||||
gss_qop_t, /* qop_req */
|
||||
const gss_buffer_t, /* message_buffer */
|
||||
gss_buffer_t /* message_token */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_verify_mic_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_ctx_id_t, /* context_handle */
|
||||
const gss_buffer_t, /* message_buffer */
|
||||
const gss_buffer_t, /* token_buffer */
|
||||
gss_qop_t * /* qop_state */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_wrap_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_ctx_id_t, /* context_handle */
|
||||
int, /* conf_req_flag */
|
||||
gss_qop_t, /* qop_req */
|
||||
const gss_buffer_t, /* input_message_buffer */
|
||||
int *, /* conf_state */
|
||||
gss_buffer_t /* output_message_buffer */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_unwrap_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_ctx_id_t, /* context_handle */
|
||||
const gss_buffer_t, /* input_message_buffer */
|
||||
gss_buffer_t, /* output_message_buffer */
|
||||
int *, /* conf_state */
|
||||
gss_qop_t * /* qop_state */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_display_status_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
OM_uint32, /* status_value */
|
||||
int, /* status_type */
|
||||
const gss_OID, /* mech_type */
|
||||
OM_uint32 *, /* message_context */
|
||||
gss_buffer_t /* status_string */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_indicate_mechs_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
gss_OID_set * /* mech_set */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_compare_name_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_name_t, /* name1 */
|
||||
const gss_name_t, /* name2 */
|
||||
int * /* name_equal */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_display_name_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_name_t, /* input_name */
|
||||
gss_buffer_t, /* output_name_buffer */
|
||||
gss_OID * /* output_name_type */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_import_name_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_buffer_t, /* input_name_buffer */
|
||||
const gss_OID, /* input_name_type */
|
||||
gss_name_t * /* output_name */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_export_name_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_name_t, /* input_name */
|
||||
gss_buffer_t /* exported_name */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_release_name_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
gss_name_t * /* input_name */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_cred_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_cred_id_t, /* cred_handle */
|
||||
gss_name_t *, /* name */
|
||||
OM_uint32 *, /* lifetime */
|
||||
gss_cred_usage_t *, /* cred_usage */
|
||||
gss_OID_set * /* mechanisms */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_context_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_ctx_id_t, /* context_handle */
|
||||
gss_name_t *, /* src_name */
|
||||
gss_name_t *, /* targ_name */
|
||||
OM_uint32 *, /* lifetime_rec */
|
||||
gss_OID *, /* mech_type */
|
||||
OM_uint32 *, /* ctx_flags */
|
||||
int *, /* locally_initiated */
|
||||
int * /* open */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_wrap_size_limit_t
|
||||
(OM_uint32 *, /* minor_status */
|
||||
const gss_ctx_id_t, /* context_handle */
|
||||
int, /* conf_req_flag */
|
||||
gss_qop_t, /* qop_req */
|
||||
OM_uint32, /* req_output_size */
|
||||
OM_uint32 * /* max_input_size */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_add_cred_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
const gss_cred_id_t, /* input_cred_handle */
|
||||
const gss_name_t, /* desired_name */
|
||||
const gss_OID, /* desired_mech */
|
||||
gss_cred_usage_t, /* cred_usage */
|
||||
OM_uint32, /* initiator_time_req */
|
||||
OM_uint32, /* acceptor_time_req */
|
||||
gss_cred_id_t *, /* output_cred_handle */
|
||||
gss_OID_set *, /* actual_mechs */
|
||||
OM_uint32 *, /* initiator_time_rec */
|
||||
OM_uint32 * /* acceptor_time_rec */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_cred_by_mech_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
const gss_cred_id_t, /* cred_handle */
|
||||
const gss_OID, /* mech_type */
|
||||
gss_name_t *, /* name */
|
||||
OM_uint32 *, /* initiator_lifetime */
|
||||
OM_uint32 *, /* acceptor_lifetime */
|
||||
gss_cred_usage_t * /* cred_usage */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_export_sec_context_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
gss_ctx_id_t *, /* context_handle */
|
||||
gss_buffer_t /* interprocess_token */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_import_sec_context_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
const gss_buffer_t, /* interprocess_token */
|
||||
gss_ctx_id_t * /* context_handle */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_names_for_mech_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
const gss_OID, /* mechanism */
|
||||
gss_OID_set * /* name_types */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_mechs_for_name_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
const gss_name_t, /* input_name */
|
||||
gss_OID_set * /* mech_types */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_canonicalize_name_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
const gss_name_t, /* input_name */
|
||||
const gss_OID, /* mech_type */
|
||||
gss_name_t * /* output_name */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_duplicate_name_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
const gss_name_t, /* src_name */
|
||||
gss_name_t * /* dest_name */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_sec_context_by_oid (
|
||||
OM_uint32 *minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
const gss_OID desired_object,
|
||||
gss_buffer_set_t *data_set
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_cred_by_oid (
|
||||
OM_uint32 *minor_status,
|
||||
const gss_cred_id_t cred,
|
||||
const gss_OID desired_object,
|
||||
gss_buffer_set_t *data_set
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_set_sec_context_option (
|
||||
OM_uint32 *minor_status,
|
||||
gss_ctx_id_t *cred_handle,
|
||||
const gss_OID desired_object,
|
||||
const gss_buffer_t value
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_set_cred_option (
|
||||
OM_uint32 *minor_status,
|
||||
gss_cred_id_t *cred_handle,
|
||||
const gss_OID desired_object,
|
||||
const gss_buffer_t value
|
||||
);
|
||||
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_pseudo_random(
|
||||
OM_uint32 *minor_status,
|
||||
gss_ctx_id_t context,
|
||||
int prf_key,
|
||||
const gss_buffer_t prf_in,
|
||||
ssize_t desired_output_len,
|
||||
gss_buffer_t prf_out
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_wrap_iov_t(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
int * conf_state,
|
||||
gss_iov_buffer_desc *iov,
|
||||
int iov_count);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_unwrap_iov_t(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
int *conf_state,
|
||||
gss_qop_t *qop_state,
|
||||
gss_iov_buffer_desc *iov,
|
||||
int iov_count);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_wrap_iov_length_t(OM_uint32 * minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
int *conf_state,
|
||||
gss_iov_buffer_desc *iov,
|
||||
int iov_count);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_store_cred_t(OM_uint32 *minor_status,
|
||||
gss_cred_id_t input_cred_handle,
|
||||
gss_cred_usage_t cred_usage,
|
||||
const gss_OID desired_mech,
|
||||
OM_uint32 overwrite_cred,
|
||||
OM_uint32 default_cred,
|
||||
gss_OID_set *elements_stored,
|
||||
gss_cred_usage_t *cred_usage_stored);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_export_cred_t(OM_uint32 *minor_status,
|
||||
gss_cred_id_t cred_handle,
|
||||
gss_buffer_t cred_token);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_import_cred_t(OM_uint32 * minor_status,
|
||||
gss_buffer_t cred_token,
|
||||
gss_cred_id_t * cred_handle);
|
||||
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_acquire_cred_ex_t(void * /* status */,
|
||||
const gss_name_t /* desired_name */,
|
||||
OM_uint32 /* flags */,
|
||||
OM_uint32 /* time_req */,
|
||||
gss_cred_usage_t /* cred_usage */,
|
||||
void * /* identity */,
|
||||
void * /* ctx */,
|
||||
void (* /*complete */)(void *, OM_uint32, void *, gss_cred_id_t, OM_uint32));
|
||||
|
||||
typedef void GSSAPI_CALLCONV
|
||||
_gss_iter_creds_t(OM_uint32 /* flags */,
|
||||
void * /* userctx */,
|
||||
void (* /*cred_iter */ )(void *, gss_OID, gss_cred_id_t));
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_destroy_cred_t(OM_uint32 * /* minor_status */,
|
||||
gss_cred_id_t * /* cred */);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_cred_hold_t(OM_uint32 * /* minor_status */,
|
||||
gss_cred_id_t /* cred */);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_cred_unhold_t(OM_uint32 * /* minor_status */,
|
||||
gss_cred_id_t /* cred */);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_cred_label_set_t(OM_uint32 * /* minor_status */,
|
||||
gss_cred_id_t /* cred */,
|
||||
const char * /* label */,
|
||||
gss_buffer_t /* value */);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_cred_label_get_t(OM_uint32 * /* minor_status */,
|
||||
gss_cred_id_t /* cred */,
|
||||
const char * /* label */,
|
||||
gss_buffer_t /* value */);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_display_name_ext_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
gss_name_t, /* name */
|
||||
gss_OID, /* display_as_name_type */
|
||||
gss_buffer_t /* display_name */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_name_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
gss_name_t, /* name */
|
||||
int *, /* name_is_MN */
|
||||
gss_OID *, /* MN_mech */
|
||||
gss_buffer_set_t * /* attrs */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_get_name_attribute_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
gss_name_t, /* name */
|
||||
gss_buffer_t, /* attr */
|
||||
int *, /* authenticated */
|
||||
int *, /* complete */
|
||||
gss_buffer_t, /* value */
|
||||
gss_buffer_t, /* display_value */
|
||||
int * /* more */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_set_name_attribute_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
gss_name_t, /* name */
|
||||
int, /* complete */
|
||||
gss_buffer_t, /* attr */
|
||||
gss_buffer_t /* value */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_delete_name_attribute_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
gss_name_t, /* name */
|
||||
gss_buffer_t /* attr */
|
||||
);
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV _gss_export_name_composite_t (
|
||||
OM_uint32 *, /* minor_status */
|
||||
gss_name_t, /* name */
|
||||
gss_buffer_t /* exp_composite_name */
|
||||
);
|
||||
|
||||
/*
|
||||
*
|
||||
*/
|
||||
|
||||
typedef struct gss_mo_desc_struct gss_mo_desc;
|
||||
|
||||
typedef OM_uint32 GSSAPI_CALLCONV
|
||||
_gss_mo_init (OM_uint32 *, gss_OID, gss_mo_desc **, size_t *);
|
||||
|
||||
|
||||
struct gss_mo_desc_struct {
|
||||
gss_OID option;
|
||||
OM_uint32 flags;
|
||||
#define GSS_MO_MA 1
|
||||
#define GSS_MO_MA_CRITICAL 2
|
||||
const char *name;
|
||||
void *ctx;
|
||||
int (*get)(gss_const_OID, gss_mo_desc *, gss_buffer_t);
|
||||
int (*set)(gss_const_OID, gss_mo_desc *, int, gss_buffer_t);
|
||||
};
|
||||
|
||||
|
||||
#define GMI_VERSION 5
|
||||
|
||||
/* gm_flags */
|
||||
#define GM_USE_MG_CRED 1 /* uses mech glue credentials */
|
||||
|
||||
|
||||
typedef struct gssapi_mech_interface_desc {
|
||||
unsigned gm_version;
|
||||
const char *gm_name;
|
||||
gss_OID_desc gm_mech_oid;
|
||||
unsigned gm_flags;
|
||||
_gss_acquire_cred_t *gm_acquire_cred;
|
||||
_gss_release_cred_t *gm_release_cred;
|
||||
_gss_init_sec_context_t *gm_init_sec_context;
|
||||
_gss_accept_sec_context_t *gm_accept_sec_context;
|
||||
_gss_process_context_token_t *gm_process_context_token;
|
||||
_gss_delete_sec_context_t *gm_delete_sec_context;
|
||||
_gss_context_time_t *gm_context_time;
|
||||
_gss_get_mic_t *gm_get_mic;
|
||||
_gss_verify_mic_t *gm_verify_mic;
|
||||
_gss_wrap_t *gm_wrap;
|
||||
_gss_unwrap_t *gm_unwrap;
|
||||
_gss_display_status_t *gm_display_status;
|
||||
_gss_indicate_mechs_t *gm_indicate_mechs;
|
||||
_gss_compare_name_t *gm_compare_name;
|
||||
_gss_display_name_t *gm_display_name;
|
||||
_gss_import_name_t *gm_import_name;
|
||||
_gss_export_name_t *gm_export_name;
|
||||
_gss_release_name_t *gm_release_name;
|
||||
_gss_inquire_cred_t *gm_inquire_cred;
|
||||
_gss_inquire_context_t *gm_inquire_context;
|
||||
_gss_wrap_size_limit_t *gm_wrap_size_limit;
|
||||
_gss_add_cred_t *gm_add_cred;
|
||||
_gss_inquire_cred_by_mech_t *gm_inquire_cred_by_mech;
|
||||
_gss_export_sec_context_t *gm_export_sec_context;
|
||||
_gss_import_sec_context_t *gm_import_sec_context;
|
||||
_gss_inquire_names_for_mech_t *gm_inquire_names_for_mech;
|
||||
_gss_inquire_mechs_for_name_t *gm_inquire_mechs_for_name;
|
||||
_gss_canonicalize_name_t *gm_canonicalize_name;
|
||||
_gss_duplicate_name_t *gm_duplicate_name;
|
||||
_gss_inquire_sec_context_by_oid *gm_inquire_sec_context_by_oid;
|
||||
_gss_inquire_cred_by_oid *gm_inquire_cred_by_oid;
|
||||
_gss_set_sec_context_option *gm_set_sec_context_option;
|
||||
_gss_set_cred_option *gm_set_cred_option;
|
||||
_gss_pseudo_random *gm_pseudo_random;
|
||||
_gss_wrap_iov_t *gm_wrap_iov;
|
||||
_gss_unwrap_iov_t *gm_unwrap_iov;
|
||||
_gss_wrap_iov_length_t *gm_wrap_iov_length;
|
||||
_gss_store_cred_t *gm_store_cred;
|
||||
_gss_export_cred_t *gm_export_cred;
|
||||
_gss_import_cred_t *gm_import_cred;
|
||||
_gss_acquire_cred_ex_t *gm_acquire_cred_ex;
|
||||
_gss_iter_creds_t *gm_iter_creds;
|
||||
_gss_destroy_cred_t *gm_destroy_cred;
|
||||
_gss_cred_hold_t *gm_cred_hold;
|
||||
_gss_cred_unhold_t *gm_cred_unhold;
|
||||
_gss_cred_label_get_t *gm_cred_label_get;
|
||||
_gss_cred_label_set_t *gm_cred_label_set;
|
||||
gss_mo_desc *gm_mo;
|
||||
size_t gm_mo_num;
|
||||
_gss_display_name_ext_t *gm_display_name_ext;
|
||||
_gss_inquire_name_t *gm_inquire_name;
|
||||
_gss_get_name_attribute_t *gm_get_name_attribute;
|
||||
_gss_set_name_attribute_t *gm_set_name_attribute;
|
||||
_gss_delete_name_attribute_t *gm_delete_name_attribute;
|
||||
_gss_export_name_composite_t *gm_export_name_composite;
|
||||
} gssapi_mech_interface_desc, *gssapi_mech_interface;
|
||||
|
||||
gssapi_mech_interface
|
||||
__gss_get_mechanism(gss_const_OID /* oid */);
|
||||
|
||||
gssapi_mech_interface __gss_spnego_initialize(void);
|
||||
gssapi_mech_interface __gss_krb5_initialize(void);
|
||||
gssapi_mech_interface __gss_ntlm_initialize(void);
|
||||
|
||||
void gss_mg_collect_error(gss_OID, OM_uint32, OM_uint32);
|
||||
|
||||
int _gss_mo_get_option_1(gss_const_OID, gss_mo_desc *, gss_buffer_t);
|
||||
int _gss_mo_get_option_0(gss_const_OID, gss_mo_desc *, gss_buffer_t);
|
||||
int _gss_mo_get_ctx_as_string(gss_const_OID, gss_mo_desc *, gss_buffer_t);
|
||||
|
||||
struct _gss_oid_name_table {
|
||||
gss_OID oid;
|
||||
const char *name;
|
||||
const char *short_desc;
|
||||
const char *long_desc;
|
||||
};
|
||||
|
||||
extern struct _gss_oid_name_table _gss_ont_mech[];
|
||||
extern struct _gss_oid_name_table _gss_ont_ma[];
|
||||
|
||||
#endif /* GSSAPI_MECH_H */
|
||||
@@ -0,0 +1,257 @@
|
||||
/* $NetBSD: gsstool.c,v 1.1.1.1 2011/04/13 18:14:43 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Portions Copyright (c) 2009 - 2010 Apple Inc. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of KTH nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
|
||||
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
||||
* BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
#include <krb5/roken.h>
|
||||
|
||||
#include <stdio.h>
|
||||
#include <gssapi/gssapi.h>
|
||||
#include <gssapi/gssapi_krb5.h>
|
||||
#include <gssapi/gssapi_spnego.h>
|
||||
#include <gssapi/gssapi_ntlm.h>
|
||||
#include <err.h>
|
||||
#include <krb5/getarg.h>
|
||||
#include <krb5/rtbl.h>
|
||||
#include <gss-commands.h>
|
||||
|
||||
|
||||
static int version_flag = 0;
|
||||
static int help_flag = 0;
|
||||
|
||||
static struct getargs args[] = {
|
||||
{"version", 0, arg_flag, &version_flag, "print version", NULL },
|
||||
{"help", 0, arg_flag, &help_flag, NULL, NULL }
|
||||
};
|
||||
|
||||
static void
|
||||
usage (int ret)
|
||||
{
|
||||
arg_printusage (args, sizeof(args)/sizeof(*args),
|
||||
NULL, "service@host");
|
||||
exit (ret);
|
||||
}
|
||||
|
||||
#define COL_OID "OID"
|
||||
#define COL_NAME "Name"
|
||||
#define COL_DESC "Description"
|
||||
#define COL_VALUE "Value"
|
||||
#define COL_MECH "Mech"
|
||||
#define COL_EXPIRE "Expire"
|
||||
#define COL_SASL "SASL"
|
||||
|
||||
int
|
||||
supported_mechanisms(void *argptr, int argc, char **argv)
|
||||
{
|
||||
OM_uint32 maj_stat, min_stat;
|
||||
gss_OID_set mechs;
|
||||
rtbl_t ct;
|
||||
size_t i;
|
||||
|
||||
maj_stat = gss_indicate_mechs(&min_stat, &mechs);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
errx(1, "gss_indicate_mechs failed");
|
||||
|
||||
printf("Supported mechanisms:\n");
|
||||
|
||||
ct = rtbl_create();
|
||||
if (ct == NULL)
|
||||
errx(1, "rtbl_create");
|
||||
|
||||
rtbl_set_separator(ct, " ");
|
||||
rtbl_add_column(ct, COL_OID, 0);
|
||||
rtbl_add_column(ct, COL_NAME, 0);
|
||||
rtbl_add_column(ct, COL_DESC, 0);
|
||||
rtbl_add_column(ct, COL_SASL, 0);
|
||||
|
||||
for (i = 0; i < mechs->count; i++) {
|
||||
gss_buffer_desc str, sasl_name, mech_name, mech_desc;
|
||||
|
||||
maj_stat = gss_oid_to_str(&min_stat, &mechs->elements[i], &str);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
errx(1, "gss_oid_to_str failed");
|
||||
|
||||
rtbl_add_column_entryv(ct, COL_OID, "%.*s",
|
||||
(int)str.length, (char *)str.value);
|
||||
gss_release_buffer(&min_stat, &str);
|
||||
|
||||
(void)gss_inquire_saslname_for_mech(&min_stat,
|
||||
&mechs->elements[i],
|
||||
&sasl_name,
|
||||
&mech_name,
|
||||
&mech_desc);
|
||||
|
||||
rtbl_add_column_entryv(ct, COL_NAME, "%.*s",
|
||||
(int)mech_name.length, (char *)mech_name.value);
|
||||
rtbl_add_column_entryv(ct, COL_DESC, "%.*s",
|
||||
(int)mech_desc.length, (char *)mech_desc.value);
|
||||
rtbl_add_column_entryv(ct, COL_SASL, "%.*s",
|
||||
(int)sasl_name.length, (char *)sasl_name.value);
|
||||
|
||||
gss_release_buffer(&min_stat, &mech_name);
|
||||
gss_release_buffer(&min_stat, &mech_desc);
|
||||
gss_release_buffer(&min_stat, &sasl_name);
|
||||
|
||||
}
|
||||
gss_release_oid_set(&min_stat, &mechs);
|
||||
|
||||
rtbl_format(ct, stdout);
|
||||
rtbl_destroy(ct);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
void static
|
||||
print_mech_attr(const char *mechname, gss_const_OID mech, gss_OID_set set)
|
||||
{
|
||||
gss_buffer_desc name, desc;
|
||||
OM_uint32 major, minor;
|
||||
rtbl_t ct;
|
||||
size_t n;
|
||||
|
||||
ct = rtbl_create();
|
||||
if (ct == NULL)
|
||||
errx(1, "rtbl_create");
|
||||
|
||||
rtbl_set_separator(ct, " ");
|
||||
rtbl_add_column(ct, COL_OID, 0);
|
||||
rtbl_add_column(ct, COL_DESC, 0);
|
||||
if (mech)
|
||||
rtbl_add_column(ct, COL_VALUE, 0);
|
||||
|
||||
for (n = 0; n < set->count; n++) {
|
||||
major = gss_display_mech_attr(&minor, &set->elements[n], &name, &desc, NULL);
|
||||
if (major)
|
||||
continue;
|
||||
|
||||
rtbl_add_column_entryv(ct, COL_OID, "%.*s",
|
||||
(int)name.length, (char *)name.value);
|
||||
rtbl_add_column_entryv(ct, COL_DESC, "%.*s",
|
||||
(int)desc.length, (char *)desc.value);
|
||||
if (mech) {
|
||||
gss_buffer_desc value;
|
||||
|
||||
if (gss_mo_get(mech, &set->elements[n], &value) != 0)
|
||||
value.length = 0;
|
||||
|
||||
if (value.length)
|
||||
rtbl_add_column_entryv(ct, COL_VALUE, "%.*s",
|
||||
(int)value.length, (char *)value.value);
|
||||
else
|
||||
rtbl_add_column_entryv(ct, COL_VALUE, "<>");
|
||||
gss_release_buffer(&minor, &value);
|
||||
}
|
||||
|
||||
gss_release_buffer(&minor, &name);
|
||||
gss_release_buffer(&minor, &desc);
|
||||
}
|
||||
|
||||
printf("attributes for: %s\n", mechname);
|
||||
rtbl_format(ct, stdout);
|
||||
rtbl_destroy(ct);
|
||||
}
|
||||
|
||||
|
||||
int
|
||||
attrs_for_mech(struct attrs_for_mech_options *opt, int argc, char **argv)
|
||||
{
|
||||
gss_OID_set mech_attr = NULL, known_mech_attrs = NULL;
|
||||
gss_OID mech = GSS_C_NO_OID;
|
||||
OM_uint32 major, minor;
|
||||
|
||||
if (opt->mech_string) {
|
||||
mech = gss_name_to_oid(opt->mech_string);
|
||||
if (mech == NULL)
|
||||
errx(1, "mech %s is unknown", opt->mech_string);
|
||||
}
|
||||
|
||||
major = gss_inquire_attrs_for_mech(&minor, mech, &mech_attr, &known_mech_attrs);
|
||||
if (major)
|
||||
errx(1, "gss_inquire_attrs_for_mech");
|
||||
|
||||
if (mech) {
|
||||
print_mech_attr(opt->mech_string, mech, mech_attr);
|
||||
}
|
||||
|
||||
if (opt->all_flag) {
|
||||
print_mech_attr("all mechs", NULL, known_mech_attrs);
|
||||
}
|
||||
|
||||
gss_release_oid_set(&minor, &mech_attr);
|
||||
gss_release_oid_set(&minor, &known_mech_attrs);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
*
|
||||
*/
|
||||
|
||||
int
|
||||
help(void *opt, int argc, char **argv)
|
||||
{
|
||||
sl_slc_help(commands, argc, argv);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int
|
||||
main(int argc, char **argv)
|
||||
{
|
||||
int optidx = 0;
|
||||
|
||||
setprogname(argv[0]);
|
||||
if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
|
||||
usage(1);
|
||||
|
||||
if (help_flag)
|
||||
usage (0);
|
||||
|
||||
if(version_flag){
|
||||
print_version(NULL);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
argc -= optidx;
|
||||
argv += optidx;
|
||||
|
||||
if (argc == 0) {
|
||||
help(NULL, argc, argv);
|
||||
return 1;
|
||||
}
|
||||
|
||||
return sl_command (commands, argc, argv);
|
||||
}
|
||||
@@ -0,0 +1,247 @@
|
||||
/* $NetBSD: 8003.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
krb5_error_code
|
||||
_gsskrb5_encode_om_uint32(OM_uint32 n, u_char *p)
|
||||
{
|
||||
p[0] = (n >> 0) & 0xFF;
|
||||
p[1] = (n >> 8) & 0xFF;
|
||||
p[2] = (n >> 16) & 0xFF;
|
||||
p[3] = (n >> 24) & 0xFF;
|
||||
return 0;
|
||||
}
|
||||
|
||||
krb5_error_code
|
||||
_gsskrb5_encode_be_om_uint32(OM_uint32 n, u_char *p)
|
||||
{
|
||||
p[0] = (n >> 24) & 0xFF;
|
||||
p[1] = (n >> 16) & 0xFF;
|
||||
p[2] = (n >> 8) & 0xFF;
|
||||
p[3] = (n >> 0) & 0xFF;
|
||||
return 0;
|
||||
}
|
||||
|
||||
krb5_error_code
|
||||
_gsskrb5_decode_om_uint32(const void *ptr, OM_uint32 *n)
|
||||
{
|
||||
const u_char *p = ptr;
|
||||
*n = (p[0] << 0) | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
|
||||
return 0;
|
||||
}
|
||||
|
||||
krb5_error_code
|
||||
_gsskrb5_decode_be_om_uint32(const void *ptr, OM_uint32 *n)
|
||||
{
|
||||
const u_char *p = ptr;
|
||||
*n = (p[0] <<24) | (p[1] << 16) | (p[2] << 8) | (p[3] << 0);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static krb5_error_code
|
||||
hash_input_chan_bindings (const gss_channel_bindings_t b,
|
||||
u_char *p)
|
||||
{
|
||||
u_char num[4];
|
||||
EVP_MD_CTX *ctx;
|
||||
|
||||
ctx = EVP_MD_CTX_create();
|
||||
EVP_DigestInit_ex(ctx, EVP_md5(), NULL);
|
||||
|
||||
_gsskrb5_encode_om_uint32 (b->initiator_addrtype, num);
|
||||
EVP_DigestUpdate(ctx, num, sizeof(num));
|
||||
_gsskrb5_encode_om_uint32 (b->initiator_address.length, num);
|
||||
EVP_DigestUpdate(ctx, num, sizeof(num));
|
||||
if (b->initiator_address.length)
|
||||
EVP_DigestUpdate(ctx,
|
||||
b->initiator_address.value,
|
||||
b->initiator_address.length);
|
||||
_gsskrb5_encode_om_uint32 (b->acceptor_addrtype, num);
|
||||
EVP_DigestUpdate(ctx, num, sizeof(num));
|
||||
_gsskrb5_encode_om_uint32 (b->acceptor_address.length, num);
|
||||
EVP_DigestUpdate(ctx, num, sizeof(num));
|
||||
if (b->acceptor_address.length)
|
||||
EVP_DigestUpdate(ctx,
|
||||
b->acceptor_address.value,
|
||||
b->acceptor_address.length);
|
||||
_gsskrb5_encode_om_uint32 (b->application_data.length, num);
|
||||
EVP_DigestUpdate(ctx, num, sizeof(num));
|
||||
if (b->application_data.length)
|
||||
EVP_DigestUpdate(ctx,
|
||||
b->application_data.value,
|
||||
b->application_data.length);
|
||||
EVP_DigestFinal_ex(ctx, p, NULL);
|
||||
EVP_MD_CTX_destroy(ctx);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* create a checksum over the chanel bindings in
|
||||
* `input_chan_bindings', `flags' and `fwd_data' and return it in
|
||||
* `result'
|
||||
*/
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_create_8003_checksum (
|
||||
OM_uint32 *minor_status,
|
||||
const gss_channel_bindings_t input_chan_bindings,
|
||||
OM_uint32 flags,
|
||||
const krb5_data *fwd_data,
|
||||
Checksum *result)
|
||||
{
|
||||
u_char *p;
|
||||
|
||||
/*
|
||||
* see rfc1964 (section 1.1.1 (Initial Token), and the checksum value
|
||||
* field's format) */
|
||||
result->cksumtype = CKSUMTYPE_GSSAPI;
|
||||
if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG))
|
||||
result->checksum.length = 24 + 4 + fwd_data->length;
|
||||
else
|
||||
result->checksum.length = 24;
|
||||
result->checksum.data = malloc (result->checksum.length);
|
||||
if (result->checksum.data == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
p = result->checksum.data;
|
||||
_gsskrb5_encode_om_uint32 (16, p);
|
||||
p += 4;
|
||||
if (input_chan_bindings == GSS_C_NO_CHANNEL_BINDINGS) {
|
||||
memset (p, 0, 16);
|
||||
} else {
|
||||
hash_input_chan_bindings (input_chan_bindings, p);
|
||||
}
|
||||
p += 16;
|
||||
_gsskrb5_encode_om_uint32 (flags, p);
|
||||
p += 4;
|
||||
|
||||
if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG)) {
|
||||
|
||||
*p++ = (1 >> 0) & 0xFF; /* DlgOpt */ /* == 1 */
|
||||
*p++ = (1 >> 8) & 0xFF; /* DlgOpt */ /* == 0 */
|
||||
*p++ = (fwd_data->length >> 0) & 0xFF; /* Dlgth */
|
||||
*p++ = (fwd_data->length >> 8) & 0xFF; /* Dlgth */
|
||||
memcpy(p, (unsigned char *) fwd_data->data, fwd_data->length);
|
||||
|
||||
p += fwd_data->length;
|
||||
}
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
/*
|
||||
* verify the checksum in `cksum' over `input_chan_bindings'
|
||||
* returning `flags' and `fwd_data'
|
||||
*/
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_verify_8003_checksum(
|
||||
OM_uint32 *minor_status,
|
||||
const gss_channel_bindings_t input_chan_bindings,
|
||||
const Checksum *cksum,
|
||||
OM_uint32 *flags,
|
||||
krb5_data *fwd_data)
|
||||
{
|
||||
unsigned char hash[16];
|
||||
unsigned char *p;
|
||||
OM_uint32 length;
|
||||
int DlgOpt;
|
||||
static unsigned char zeros[16];
|
||||
|
||||
/* XXX should handle checksums > 24 bytes */
|
||||
if(cksum->cksumtype != CKSUMTYPE_GSSAPI || cksum->checksum.length < 24) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_BINDINGS;
|
||||
}
|
||||
|
||||
p = cksum->checksum.data;
|
||||
_gsskrb5_decode_om_uint32(p, &length);
|
||||
if(length != sizeof(hash)) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_BINDINGS;
|
||||
}
|
||||
|
||||
p += 4;
|
||||
|
||||
if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS
|
||||
&& memcmp(p, zeros, sizeof(zeros)) != 0) {
|
||||
if(hash_input_chan_bindings(input_chan_bindings, hash) != 0) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_BINDINGS;
|
||||
}
|
||||
if(ct_memcmp(hash, p, sizeof(hash)) != 0) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_BINDINGS;
|
||||
}
|
||||
}
|
||||
|
||||
p += sizeof(hash);
|
||||
|
||||
_gsskrb5_decode_om_uint32(p, flags);
|
||||
p += 4;
|
||||
|
||||
if (cksum->checksum.length > 24 && (*flags & GSS_C_DELEG_FLAG)) {
|
||||
if(cksum->checksum.length < 28) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_BINDINGS;
|
||||
}
|
||||
|
||||
DlgOpt = (p[0] << 0) | (p[1] << 8);
|
||||
p += 2;
|
||||
if (DlgOpt != 1) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_BINDINGS;
|
||||
}
|
||||
|
||||
fwd_data->length = (p[0] << 0) | (p[1] << 8);
|
||||
p += 2;
|
||||
if(cksum->checksum.length < 28 + fwd_data->length) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_BINDINGS;
|
||||
}
|
||||
fwd_data->data = malloc(fwd_data->length);
|
||||
if (fwd_data->data == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
memcpy(fwd_data->data, p, fwd_data->length);
|
||||
}
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,933 @@
|
||||
/* $NetBSD: accept_sec_context.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
HEIMDAL_MUTEX gssapi_keytab_mutex = HEIMDAL_MUTEX_INITIALIZER;
|
||||
krb5_keytab _gsskrb5_keytab;
|
||||
|
||||
static krb5_error_code
|
||||
validate_keytab(krb5_context context, const char *name, krb5_keytab *id)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
|
||||
ret = krb5_kt_resolve(context, name, id);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
ret = krb5_kt_have_content(context, *id);
|
||||
if (ret) {
|
||||
krb5_kt_close(context, *id);
|
||||
*id = NULL;
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_register_acceptor_identity (const char *identity)
|
||||
{
|
||||
krb5_context context;
|
||||
krb5_error_code ret;
|
||||
|
||||
ret = _gsskrb5_init(&context);
|
||||
if(ret)
|
||||
return GSS_S_FAILURE;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&gssapi_keytab_mutex);
|
||||
|
||||
if(_gsskrb5_keytab != NULL) {
|
||||
krb5_kt_close(context, _gsskrb5_keytab);
|
||||
_gsskrb5_keytab = NULL;
|
||||
}
|
||||
if (identity == NULL) {
|
||||
ret = krb5_kt_default(context, &_gsskrb5_keytab);
|
||||
} else {
|
||||
/*
|
||||
* First check if we can the keytab as is and if it has content...
|
||||
*/
|
||||
ret = validate_keytab(context, identity, &_gsskrb5_keytab);
|
||||
/*
|
||||
* if it doesn't, lets prepend FILE: and try again
|
||||
*/
|
||||
if (ret) {
|
||||
char *p = NULL;
|
||||
ret = asprintf(&p, "FILE:%s", identity);
|
||||
if(ret < 0 || p == NULL) {
|
||||
HEIMDAL_MUTEX_unlock(&gssapi_keytab_mutex);
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
ret = validate_keytab(context, p, &_gsskrb5_keytab);
|
||||
free(p);
|
||||
}
|
||||
}
|
||||
HEIMDAL_MUTEX_unlock(&gssapi_keytab_mutex);
|
||||
if(ret)
|
||||
return GSS_S_FAILURE;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
void
|
||||
_gsskrb5i_is_cfx(krb5_context context, gsskrb5_ctx ctx, int acceptor)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
krb5_keyblock *key;
|
||||
|
||||
if (acceptor) {
|
||||
if (ctx->auth_context->local_subkey)
|
||||
key = ctx->auth_context->local_subkey;
|
||||
else
|
||||
key = ctx->auth_context->remote_subkey;
|
||||
} else {
|
||||
if (ctx->auth_context->remote_subkey)
|
||||
key = ctx->auth_context->remote_subkey;
|
||||
else
|
||||
key = ctx->auth_context->local_subkey;
|
||||
}
|
||||
if (key == NULL)
|
||||
key = ctx->auth_context->keyblock;
|
||||
|
||||
if (key == NULL)
|
||||
return;
|
||||
|
||||
switch (key->keytype) {
|
||||
case ETYPE_DES_CBC_CRC:
|
||||
case ETYPE_DES_CBC_MD4:
|
||||
case ETYPE_DES_CBC_MD5:
|
||||
case ETYPE_DES3_CBC_MD5:
|
||||
case ETYPE_OLD_DES3_CBC_SHA1:
|
||||
case ETYPE_DES3_CBC_SHA1:
|
||||
case ETYPE_ARCFOUR_HMAC_MD5:
|
||||
case ETYPE_ARCFOUR_HMAC_MD5_56:
|
||||
break;
|
||||
default :
|
||||
ctx->more_flags |= IS_CFX;
|
||||
|
||||
if ((acceptor && ctx->auth_context->local_subkey) ||
|
||||
(!acceptor && ctx->auth_context->remote_subkey))
|
||||
ctx->more_flags |= ACCEPTOR_SUBKEY;
|
||||
break;
|
||||
}
|
||||
if (ctx->crypto)
|
||||
krb5_crypto_destroy(context, ctx->crypto);
|
||||
ret = krb5_crypto_init(context, key, 0, &ctx->crypto);
|
||||
}
|
||||
|
||||
|
||||
static OM_uint32
|
||||
gsskrb5_accept_delegated_token
|
||||
(OM_uint32 * minor_status,
|
||||
gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
gss_cred_id_t * delegated_cred_handle
|
||||
)
|
||||
{
|
||||
krb5_ccache ccache = NULL;
|
||||
krb5_error_code kret;
|
||||
int32_t ac_flags, ret = GSS_S_COMPLETE;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
/* XXX Create a new delegated_cred_handle? */
|
||||
if (delegated_cred_handle == NULL) {
|
||||
kret = krb5_cc_default (context, &ccache);
|
||||
} else {
|
||||
*delegated_cred_handle = NULL;
|
||||
kret = krb5_cc_new_unique (context, krb5_cc_type_memory,
|
||||
NULL, &ccache);
|
||||
}
|
||||
if (kret) {
|
||||
ctx->flags &= ~GSS_C_DELEG_FLAG;
|
||||
goto out;
|
||||
}
|
||||
|
||||
kret = krb5_cc_initialize(context, ccache, ctx->source);
|
||||
if (kret) {
|
||||
ctx->flags &= ~GSS_C_DELEG_FLAG;
|
||||
goto out;
|
||||
}
|
||||
|
||||
krb5_auth_con_removeflags(context,
|
||||
ctx->auth_context,
|
||||
KRB5_AUTH_CONTEXT_DO_TIME,
|
||||
&ac_flags);
|
||||
kret = krb5_rd_cred2(context,
|
||||
ctx->auth_context,
|
||||
ccache,
|
||||
&ctx->fwd_data);
|
||||
krb5_auth_con_setflags(context,
|
||||
ctx->auth_context,
|
||||
ac_flags);
|
||||
if (kret) {
|
||||
ctx->flags &= ~GSS_C_DELEG_FLAG;
|
||||
ret = GSS_S_FAILURE;
|
||||
*minor_status = kret;
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (delegated_cred_handle) {
|
||||
gsskrb5_cred handle;
|
||||
|
||||
ret = _gsskrb5_krb5_import_cred(minor_status,
|
||||
ccache,
|
||||
NULL,
|
||||
NULL,
|
||||
delegated_cred_handle);
|
||||
if (ret != GSS_S_COMPLETE)
|
||||
goto out;
|
||||
|
||||
handle = (gsskrb5_cred) *delegated_cred_handle;
|
||||
|
||||
handle->cred_flags |= GSS_CF_DESTROY_CRED_ON_RELEASE;
|
||||
krb5_cc_close(context, ccache);
|
||||
ccache = NULL;
|
||||
}
|
||||
|
||||
out:
|
||||
if (ccache) {
|
||||
/* Don't destroy the default cred cache */
|
||||
if (delegated_cred_handle == NULL)
|
||||
krb5_cc_close(context, ccache);
|
||||
else
|
||||
krb5_cc_destroy(context, ccache);
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
gsskrb5_acceptor_ready(OM_uint32 * minor_status,
|
||||
gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
gss_cred_id_t *delegated_cred_handle)
|
||||
{
|
||||
OM_uint32 ret;
|
||||
int32_t seq_number;
|
||||
int is_cfx = 0;
|
||||
|
||||
krb5_auth_con_getremoteseqnumber (context,
|
||||
ctx->auth_context,
|
||||
&seq_number);
|
||||
|
||||
_gsskrb5i_is_cfx(context, ctx, 1);
|
||||
is_cfx = (ctx->more_flags & IS_CFX);
|
||||
|
||||
ret = _gssapi_msg_order_create(minor_status,
|
||||
&ctx->order,
|
||||
_gssapi_msg_order_f(ctx->flags),
|
||||
seq_number, 0, is_cfx);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
/*
|
||||
* If requested, set local sequence num to remote sequence if this
|
||||
* isn't a mutual authentication context
|
||||
*/
|
||||
if (!(ctx->flags & GSS_C_MUTUAL_FLAG) && _gssapi_msg_order_f(ctx->flags)) {
|
||||
krb5_auth_con_setlocalseqnumber(context,
|
||||
ctx->auth_context,
|
||||
seq_number);
|
||||
}
|
||||
|
||||
/*
|
||||
* We should handle the delegation ticket, in case it's there
|
||||
*/
|
||||
if (ctx->fwd_data.length > 0 && (ctx->flags & GSS_C_DELEG_FLAG)) {
|
||||
ret = gsskrb5_accept_delegated_token(minor_status,
|
||||
ctx,
|
||||
context,
|
||||
delegated_cred_handle);
|
||||
if (ret)
|
||||
return ret;
|
||||
} else {
|
||||
/* Well, looks like it wasn't there after all */
|
||||
ctx->flags &= ~GSS_C_DELEG_FLAG;
|
||||
}
|
||||
|
||||
ctx->state = ACCEPTOR_READY;
|
||||
ctx->more_flags |= OPEN;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
send_error_token(OM_uint32 *minor_status,
|
||||
krb5_context context,
|
||||
krb5_error_code kret,
|
||||
krb5_principal server,
|
||||
krb5_data *indata,
|
||||
gss_buffer_t output_token)
|
||||
{
|
||||
krb5_principal ap_req_server = NULL;
|
||||
krb5_error_code ret;
|
||||
krb5_data outbuf;
|
||||
/* this e_data value encodes KERB_AP_ERR_TYPE_SKEW_RECOVERY which
|
||||
tells windows to try again with the corrected timestamp. See
|
||||
[MS-KILE] 2.2.1 KERB-ERROR-DATA */
|
||||
krb5_data e_data = { 7, rk_UNCONST("\x30\x05\xa1\x03\x02\x01\x02") };
|
||||
|
||||
/* build server from request if the acceptor had not selected one */
|
||||
if (server == NULL) {
|
||||
AP_REQ ap_req;
|
||||
|
||||
ret = krb5_decode_ap_req(context, indata, &ap_req);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
ret = _krb5_principalname2krb5_principal(context,
|
||||
&ap_req_server,
|
||||
ap_req.ticket.sname,
|
||||
ap_req.ticket.realm);
|
||||
free_AP_REQ(&ap_req);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
server = ap_req_server;
|
||||
}
|
||||
|
||||
ret = krb5_mk_error(context, kret, NULL, &e_data, NULL,
|
||||
server, NULL, NULL, &outbuf);
|
||||
if (ap_req_server)
|
||||
krb5_free_principal(context, ap_req_server);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = _gsskrb5_encapsulate(minor_status,
|
||||
&outbuf,
|
||||
output_token,
|
||||
"\x03\x00",
|
||||
GSS_KRB5_MECHANISM);
|
||||
krb5_data_free (&outbuf);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_CONTINUE_NEEDED;
|
||||
}
|
||||
|
||||
|
||||
static OM_uint32
|
||||
gsskrb5_acceptor_start(OM_uint32 * minor_status,
|
||||
gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
const gss_cred_id_t acceptor_cred_handle,
|
||||
const gss_buffer_t input_token_buffer,
|
||||
const gss_channel_bindings_t input_chan_bindings,
|
||||
gss_name_t * src_name,
|
||||
gss_OID * mech_type,
|
||||
gss_buffer_t output_token,
|
||||
OM_uint32 * ret_flags,
|
||||
OM_uint32 * time_rec,
|
||||
gss_cred_id_t * delegated_cred_handle)
|
||||
{
|
||||
krb5_error_code kret;
|
||||
OM_uint32 ret = GSS_S_COMPLETE;
|
||||
krb5_data indata;
|
||||
krb5_flags ap_options;
|
||||
krb5_keytab keytab = NULL;
|
||||
int is_cfx = 0;
|
||||
const gsskrb5_cred acceptor_cred = (gsskrb5_cred)acceptor_cred_handle;
|
||||
|
||||
/*
|
||||
* We may, or may not, have an escapsulation.
|
||||
*/
|
||||
ret = _gsskrb5_decapsulate (minor_status,
|
||||
input_token_buffer,
|
||||
&indata,
|
||||
"\x01\x00",
|
||||
GSS_KRB5_MECHANISM);
|
||||
|
||||
if (ret) {
|
||||
/* Assume that there is no OID wrapping. */
|
||||
indata.length = input_token_buffer->length;
|
||||
indata.data = input_token_buffer->value;
|
||||
}
|
||||
|
||||
/*
|
||||
* We need to get our keytab
|
||||
*/
|
||||
if (acceptor_cred == NULL) {
|
||||
if (_gsskrb5_keytab != NULL)
|
||||
keytab = _gsskrb5_keytab;
|
||||
} else if (acceptor_cred->keytab != NULL) {
|
||||
keytab = acceptor_cred->keytab;
|
||||
}
|
||||
|
||||
/*
|
||||
* We need to check the ticket and create the AP-REP packet
|
||||
*/
|
||||
|
||||
{
|
||||
krb5_rd_req_in_ctx in = NULL;
|
||||
krb5_rd_req_out_ctx out = NULL;
|
||||
krb5_principal server = NULL;
|
||||
|
||||
if (acceptor_cred)
|
||||
server = acceptor_cred->principal;
|
||||
|
||||
kret = krb5_rd_req_in_ctx_alloc(context, &in);
|
||||
if (kret == 0)
|
||||
kret = krb5_rd_req_in_set_keytab(context, in, keytab);
|
||||
if (kret) {
|
||||
if (in)
|
||||
krb5_rd_req_in_ctx_free(context, in);
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
kret = krb5_rd_req_ctx(context,
|
||||
&ctx->auth_context,
|
||||
&indata,
|
||||
server,
|
||||
in, &out);
|
||||
krb5_rd_req_in_ctx_free(context, in);
|
||||
if (kret == KRB5KRB_AP_ERR_SKEW || kret == KRB5KRB_AP_ERR_TKT_NYV) {
|
||||
/*
|
||||
* No reply in non-MUTUAL mode, but we don't know that its
|
||||
* non-MUTUAL mode yet, thats inside the 8003 checksum, so
|
||||
* lets only send the error token on clock skew, that
|
||||
* limit when send error token for non-MUTUAL.
|
||||
*/
|
||||
return send_error_token(minor_status, context, kret,
|
||||
server, &indata, output_token);
|
||||
} else if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
/*
|
||||
* we need to remember some data on the context_handle.
|
||||
*/
|
||||
kret = krb5_rd_req_out_get_ap_req_options(context, out,
|
||||
&ap_options);
|
||||
if (kret == 0)
|
||||
kret = krb5_rd_req_out_get_ticket(context, out,
|
||||
&ctx->ticket);
|
||||
if (kret == 0)
|
||||
kret = krb5_rd_req_out_get_keyblock(context, out,
|
||||
&ctx->service_keyblock);
|
||||
ctx->lifetime = ctx->ticket->ticket.endtime;
|
||||
|
||||
krb5_rd_req_out_ctx_free(context, out);
|
||||
if (kret) {
|
||||
ret = GSS_S_FAILURE;
|
||||
*minor_status = kret;
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* We need to copy the principal names to the context and the
|
||||
* calling layer.
|
||||
*/
|
||||
kret = krb5_copy_principal(context,
|
||||
ctx->ticket->client,
|
||||
&ctx->source);
|
||||
if (kret) {
|
||||
ret = GSS_S_FAILURE;
|
||||
*minor_status = kret;
|
||||
}
|
||||
|
||||
kret = krb5_copy_principal(context,
|
||||
ctx->ticket->server,
|
||||
&ctx->target);
|
||||
if (kret) {
|
||||
ret = GSS_S_FAILURE;
|
||||
*minor_status = kret;
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* We need to setup some compat stuff, this assumes that
|
||||
* context_handle->target is already set.
|
||||
*/
|
||||
ret = _gss_DES3_get_mic_compat(minor_status, ctx, context);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
if (src_name != NULL) {
|
||||
kret = krb5_copy_principal (context,
|
||||
ctx->ticket->client,
|
||||
(gsskrb5_name*)src_name);
|
||||
if (kret) {
|
||||
ret = GSS_S_FAILURE;
|
||||
*minor_status = kret;
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* We need to get the flags out of the 8003 checksum.
|
||||
*/
|
||||
|
||||
{
|
||||
krb5_authenticator authenticator;
|
||||
|
||||
kret = krb5_auth_con_getauthenticator(context,
|
||||
ctx->auth_context,
|
||||
&authenticator);
|
||||
if(kret) {
|
||||
ret = GSS_S_FAILURE;
|
||||
*minor_status = kret;
|
||||
return ret;
|
||||
}
|
||||
|
||||
if (authenticator->cksum == NULL) {
|
||||
krb5_free_authenticator(context, &authenticator);
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_BINDINGS;
|
||||
}
|
||||
|
||||
if (authenticator->cksum->cksumtype == CKSUMTYPE_GSSAPI) {
|
||||
ret = _gsskrb5_verify_8003_checksum(minor_status,
|
||||
input_chan_bindings,
|
||||
authenticator->cksum,
|
||||
&ctx->flags,
|
||||
&ctx->fwd_data);
|
||||
|
||||
krb5_free_authenticator(context, &authenticator);
|
||||
if (ret) {
|
||||
return ret;
|
||||
}
|
||||
} else {
|
||||
krb5_crypto crypto;
|
||||
|
||||
kret = krb5_crypto_init(context,
|
||||
ctx->auth_context->keyblock,
|
||||
0, &crypto);
|
||||
if(kret) {
|
||||
krb5_free_authenticator(context, &authenticator);
|
||||
|
||||
ret = GSS_S_FAILURE;
|
||||
*minor_status = kret;
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Windows accepts Samba3's use of a kerberos, rather than
|
||||
* GSSAPI checksum here
|
||||
*/
|
||||
|
||||
kret = krb5_verify_checksum(context,
|
||||
crypto, KRB5_KU_AP_REQ_AUTH_CKSUM, NULL, 0,
|
||||
authenticator->cksum);
|
||||
krb5_free_authenticator(context, &authenticator);
|
||||
krb5_crypto_destroy(context, crypto);
|
||||
|
||||
if(kret) {
|
||||
ret = GSS_S_BAD_SIG;
|
||||
*minor_status = kret;
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Samba style get some flags (but not DCE-STYLE), use
|
||||
* ap_options to guess the mutual flag.
|
||||
*/
|
||||
ctx->flags = GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG;
|
||||
if (ap_options & AP_OPTS_MUTUAL_REQUIRED)
|
||||
ctx->flags |= GSS_C_MUTUAL_FLAG;
|
||||
}
|
||||
}
|
||||
|
||||
if(ctx->flags & GSS_C_MUTUAL_FLAG) {
|
||||
krb5_data outbuf;
|
||||
int use_subkey = 0;
|
||||
|
||||
_gsskrb5i_is_cfx(context, ctx, 1);
|
||||
is_cfx = (ctx->more_flags & IS_CFX);
|
||||
|
||||
if (is_cfx || (ap_options & AP_OPTS_USE_SUBKEY)) {
|
||||
use_subkey = 1;
|
||||
} else {
|
||||
krb5_keyblock *rkey;
|
||||
|
||||
/*
|
||||
* If there is a initiator subkey, copy that to acceptor
|
||||
* subkey to match Windows behavior
|
||||
*/
|
||||
kret = krb5_auth_con_getremotesubkey(context,
|
||||
ctx->auth_context,
|
||||
&rkey);
|
||||
if (kret == 0) {
|
||||
kret = krb5_auth_con_setlocalsubkey(context,
|
||||
ctx->auth_context,
|
||||
rkey);
|
||||
if (kret == 0)
|
||||
use_subkey = 1;
|
||||
krb5_free_keyblock(context, rkey);
|
||||
}
|
||||
}
|
||||
if (use_subkey) {
|
||||
ctx->more_flags |= ACCEPTOR_SUBKEY;
|
||||
krb5_auth_con_addflags(context, ctx->auth_context,
|
||||
KRB5_AUTH_CONTEXT_USE_SUBKEY,
|
||||
NULL);
|
||||
}
|
||||
|
||||
kret = krb5_mk_rep(context,
|
||||
ctx->auth_context,
|
||||
&outbuf);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
if (IS_DCE_STYLE(ctx)) {
|
||||
output_token->length = outbuf.length;
|
||||
output_token->value = outbuf.data;
|
||||
} else {
|
||||
ret = _gsskrb5_encapsulate(minor_status,
|
||||
&outbuf,
|
||||
output_token,
|
||||
"\x02\x00",
|
||||
GSS_KRB5_MECHANISM);
|
||||
krb5_data_free (&outbuf);
|
||||
if (ret)
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
|
||||
ctx->flags |= GSS_C_TRANS_FLAG;
|
||||
|
||||
/* Remember the flags */
|
||||
|
||||
ctx->lifetime = ctx->ticket->ticket.endtime;
|
||||
ctx->more_flags |= OPEN;
|
||||
|
||||
if (mech_type)
|
||||
*mech_type = GSS_KRB5_MECHANISM;
|
||||
|
||||
if (time_rec) {
|
||||
ret = _gsskrb5_lifetime_left(minor_status,
|
||||
context,
|
||||
ctx->lifetime,
|
||||
time_rec);
|
||||
if (ret) {
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* When GSS_C_DCE_STYLE is in use, we need ask for a AP-REP from
|
||||
* the client.
|
||||
*/
|
||||
if (IS_DCE_STYLE(ctx)) {
|
||||
/*
|
||||
* Return flags to caller, but we haven't processed
|
||||
* delgations yet
|
||||
*/
|
||||
if (ret_flags)
|
||||
*ret_flags = (ctx->flags & ~GSS_C_DELEG_FLAG);
|
||||
|
||||
ctx->state = ACCEPTOR_WAIT_FOR_DCESTYLE;
|
||||
return GSS_S_CONTINUE_NEEDED;
|
||||
}
|
||||
|
||||
ret = gsskrb5_acceptor_ready(minor_status, ctx, context,
|
||||
delegated_cred_handle);
|
||||
|
||||
if (ret_flags)
|
||||
*ret_flags = ctx->flags;
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
acceptor_wait_for_dcestyle(OM_uint32 * minor_status,
|
||||
gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
const gss_cred_id_t acceptor_cred_handle,
|
||||
const gss_buffer_t input_token_buffer,
|
||||
const gss_channel_bindings_t input_chan_bindings,
|
||||
gss_name_t * src_name,
|
||||
gss_OID * mech_type,
|
||||
gss_buffer_t output_token,
|
||||
OM_uint32 * ret_flags,
|
||||
OM_uint32 * time_rec,
|
||||
gss_cred_id_t * delegated_cred_handle)
|
||||
{
|
||||
OM_uint32 ret;
|
||||
krb5_error_code kret;
|
||||
krb5_data inbuf;
|
||||
int32_t r_seq_number, l_seq_number;
|
||||
|
||||
/*
|
||||
* We know it's GSS_C_DCE_STYLE so we don't need to decapsulate the AP_REP
|
||||
*/
|
||||
|
||||
inbuf.length = input_token_buffer->length;
|
||||
inbuf.data = input_token_buffer->value;
|
||||
|
||||
/*
|
||||
* We need to remeber the old remote seq_number, then check if the
|
||||
* client has replied with our local seq_number, and then reset
|
||||
* the remote seq_number to the old value
|
||||
*/
|
||||
{
|
||||
kret = krb5_auth_con_getlocalseqnumber(context,
|
||||
ctx->auth_context,
|
||||
&l_seq_number);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
kret = krb5_auth_con_getremoteseqnumber(context,
|
||||
ctx->auth_context,
|
||||
&r_seq_number);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
kret = krb5_auth_con_setremoteseqnumber(context,
|
||||
ctx->auth_context,
|
||||
l_seq_number);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* We need to verify the AP_REP, but we need to flag that this is
|
||||
* DCE_STYLE, so don't check the timestamps this time, but put the
|
||||
* flag DO_TIME back afterward.
|
||||
*/
|
||||
{
|
||||
krb5_ap_rep_enc_part *repl;
|
||||
int32_t auth_flags;
|
||||
|
||||
krb5_auth_con_removeflags(context,
|
||||
ctx->auth_context,
|
||||
KRB5_AUTH_CONTEXT_DO_TIME,
|
||||
&auth_flags);
|
||||
|
||||
kret = krb5_rd_rep(context, ctx->auth_context, &inbuf, &repl);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
krb5_free_ap_rep_enc_part(context, repl);
|
||||
krb5_auth_con_setflags(context, ctx->auth_context, auth_flags);
|
||||
}
|
||||
|
||||
/* We need to check the liftime */
|
||||
{
|
||||
OM_uint32 lifetime_rec;
|
||||
|
||||
ret = _gsskrb5_lifetime_left(minor_status,
|
||||
context,
|
||||
ctx->lifetime,
|
||||
&lifetime_rec);
|
||||
if (ret) {
|
||||
return ret;
|
||||
}
|
||||
if (lifetime_rec == 0) {
|
||||
return GSS_S_CONTEXT_EXPIRED;
|
||||
}
|
||||
|
||||
if (time_rec) *time_rec = lifetime_rec;
|
||||
}
|
||||
|
||||
/* We need to give the caller the flags which are in use */
|
||||
if (ret_flags) *ret_flags = ctx->flags;
|
||||
|
||||
if (src_name) {
|
||||
kret = krb5_copy_principal(context,
|
||||
ctx->source,
|
||||
(gsskrb5_name*)src_name);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* After the krb5_rd_rep() the remote and local seq_number should
|
||||
* be the same, because the client just replies the seq_number
|
||||
* from our AP-REP in its AP-REP, but then the client uses the
|
||||
* seq_number from its AP-REQ for GSS_wrap()
|
||||
*/
|
||||
{
|
||||
int32_t tmp_r_seq_number, tmp_l_seq_number;
|
||||
|
||||
kret = krb5_auth_con_getremoteseqnumber(context,
|
||||
ctx->auth_context,
|
||||
&tmp_r_seq_number);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
kret = krb5_auth_con_getlocalseqnumber(context,
|
||||
ctx->auth_context,
|
||||
&tmp_l_seq_number);
|
||||
if (kret) {
|
||||
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
/*
|
||||
* Here we check if the client has responsed with our local seq_number,
|
||||
*/
|
||||
if (tmp_r_seq_number != tmp_l_seq_number) {
|
||||
return GSS_S_UNSEQ_TOKEN;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* We need to reset the remote seq_number, because the client will use,
|
||||
* the old one for the GSS_wrap() calls
|
||||
*/
|
||||
{
|
||||
kret = krb5_auth_con_setremoteseqnumber(context,
|
||||
ctx->auth_context,
|
||||
r_seq_number);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
}
|
||||
|
||||
return gsskrb5_acceptor_ready(minor_status, ctx, context,
|
||||
delegated_cred_handle);
|
||||
}
|
||||
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_accept_sec_context(OM_uint32 * minor_status,
|
||||
gss_ctx_id_t * context_handle,
|
||||
const gss_cred_id_t acceptor_cred_handle,
|
||||
const gss_buffer_t input_token_buffer,
|
||||
const gss_channel_bindings_t input_chan_bindings,
|
||||
gss_name_t * src_name,
|
||||
gss_OID * mech_type,
|
||||
gss_buffer_t output_token,
|
||||
OM_uint32 * ret_flags,
|
||||
OM_uint32 * time_rec,
|
||||
gss_cred_id_t * delegated_cred_handle)
|
||||
{
|
||||
krb5_context context;
|
||||
OM_uint32 ret;
|
||||
gsskrb5_ctx ctx;
|
||||
|
||||
GSSAPI_KRB5_INIT(&context);
|
||||
|
||||
output_token->length = 0;
|
||||
output_token->value = NULL;
|
||||
|
||||
if (src_name != NULL)
|
||||
*src_name = NULL;
|
||||
if (mech_type)
|
||||
*mech_type = GSS_KRB5_MECHANISM;
|
||||
|
||||
if (*context_handle == GSS_C_NO_CONTEXT) {
|
||||
ret = _gsskrb5_create_ctx(minor_status,
|
||||
context_handle,
|
||||
context,
|
||||
input_chan_bindings,
|
||||
ACCEPTOR_START);
|
||||
if (ret)
|
||||
return ret;
|
||||
}
|
||||
|
||||
ctx = (gsskrb5_ctx)*context_handle;
|
||||
|
||||
|
||||
/*
|
||||
* TODO: check the channel_bindings
|
||||
* (above just sets them to krb5 layer)
|
||||
*/
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
|
||||
switch (ctx->state) {
|
||||
case ACCEPTOR_START:
|
||||
ret = gsskrb5_acceptor_start(minor_status,
|
||||
ctx,
|
||||
context,
|
||||
acceptor_cred_handle,
|
||||
input_token_buffer,
|
||||
input_chan_bindings,
|
||||
src_name,
|
||||
mech_type,
|
||||
output_token,
|
||||
ret_flags,
|
||||
time_rec,
|
||||
delegated_cred_handle);
|
||||
break;
|
||||
case ACCEPTOR_WAIT_FOR_DCESTYLE:
|
||||
ret = acceptor_wait_for_dcestyle(minor_status,
|
||||
ctx,
|
||||
context,
|
||||
acceptor_cred_handle,
|
||||
input_token_buffer,
|
||||
input_chan_bindings,
|
||||
src_name,
|
||||
mech_type,
|
||||
output_token,
|
||||
ret_flags,
|
||||
time_rec,
|
||||
delegated_cred_handle);
|
||||
break;
|
||||
case ACCEPTOR_READY:
|
||||
/*
|
||||
* If we get there, the caller have called
|
||||
* gss_accept_sec_context() one time too many.
|
||||
*/
|
||||
ret = GSS_S_BAD_STATUS;
|
||||
break;
|
||||
default:
|
||||
/* TODO: is this correct here? --metze */
|
||||
ret = GSS_S_BAD_STATUS;
|
||||
break;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
|
||||
if (GSS_ERROR(ret)) {
|
||||
OM_uint32 min2;
|
||||
_gsskrb5_delete_sec_context(&min2, context_handle, GSS_C_NO_BUFFER);
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,404 @@
|
||||
/* $NetBSD: acquire_cred.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32
|
||||
__gsskrb5_ccache_lifetime(OM_uint32 *minor_status,
|
||||
krb5_context context,
|
||||
krb5_ccache id,
|
||||
krb5_principal principal,
|
||||
OM_uint32 *lifetime)
|
||||
{
|
||||
krb5_creds in_cred, out_cred;
|
||||
krb5_const_realm realm;
|
||||
krb5_error_code kret;
|
||||
|
||||
memset(&in_cred, 0, sizeof(in_cred));
|
||||
in_cred.client = principal;
|
||||
|
||||
realm = krb5_principal_get_realm(context, principal);
|
||||
if (realm == NULL) {
|
||||
_gsskrb5_clear_status ();
|
||||
*minor_status = KRB5_PRINC_NOMATCH; /* XXX */
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
kret = krb5_make_principal(context, &in_cred.server,
|
||||
realm, KRB5_TGS_NAME, realm, NULL);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
kret = krb5_cc_retrieve_cred(context, id, 0, &in_cred, &out_cred);
|
||||
krb5_free_principal(context, in_cred.server);
|
||||
if (kret) {
|
||||
*minor_status = 0;
|
||||
*lifetime = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
*lifetime = out_cred.times.endtime;
|
||||
krb5_free_cred_contents(context, &out_cred);
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
static krb5_error_code
|
||||
get_keytab(krb5_context context, krb5_keytab *keytab)
|
||||
{
|
||||
krb5_error_code kret;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&gssapi_keytab_mutex);
|
||||
|
||||
if (_gsskrb5_keytab != NULL) {
|
||||
char *name = NULL;
|
||||
|
||||
kret = krb5_kt_get_full_name(context, _gsskrb5_keytab, &name);
|
||||
if (kret == 0) {
|
||||
kret = krb5_kt_resolve(context, name, keytab);
|
||||
krb5_xfree(name);
|
||||
}
|
||||
} else
|
||||
kret = krb5_kt_default(context, keytab);
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&gssapi_keytab_mutex);
|
||||
|
||||
return (kret);
|
||||
}
|
||||
|
||||
static OM_uint32 acquire_initiator_cred
|
||||
(OM_uint32 * minor_status,
|
||||
krb5_context context,
|
||||
const gss_name_t desired_name,
|
||||
OM_uint32 time_req,
|
||||
const gss_OID_set desired_mechs,
|
||||
gss_cred_usage_t cred_usage,
|
||||
gsskrb5_cred handle,
|
||||
gss_OID_set * actual_mechs,
|
||||
OM_uint32 * time_rec
|
||||
)
|
||||
{
|
||||
OM_uint32 ret;
|
||||
krb5_creds cred;
|
||||
krb5_principal def_princ;
|
||||
krb5_get_init_creds_opt *opt;
|
||||
krb5_ccache ccache;
|
||||
krb5_keytab keytab;
|
||||
krb5_error_code kret;
|
||||
|
||||
keytab = NULL;
|
||||
ccache = NULL;
|
||||
def_princ = NULL;
|
||||
ret = GSS_S_FAILURE;
|
||||
memset(&cred, 0, sizeof(cred));
|
||||
|
||||
/*
|
||||
* If we have a preferred principal, lets try to find it in all
|
||||
* caches, otherwise, fall back to default cache, ignore all
|
||||
* errors while searching.
|
||||
*/
|
||||
|
||||
if (handle->principal) {
|
||||
kret = krb5_cc_cache_match (context,
|
||||
handle->principal,
|
||||
&ccache);
|
||||
if (kret == 0) {
|
||||
ret = GSS_S_COMPLETE;
|
||||
goto found;
|
||||
}
|
||||
}
|
||||
|
||||
if (ccache == NULL) {
|
||||
kret = krb5_cc_default(context, &ccache);
|
||||
if (kret)
|
||||
goto end;
|
||||
}
|
||||
kret = krb5_cc_get_principal(context, ccache, &def_princ);
|
||||
if (kret != 0) {
|
||||
/* we'll try to use a keytab below */
|
||||
krb5_cc_close(context, ccache);
|
||||
def_princ = NULL;
|
||||
kret = 0;
|
||||
} else if (handle->principal == NULL) {
|
||||
kret = krb5_copy_principal(context, def_princ, &handle->principal);
|
||||
if (kret)
|
||||
goto end;
|
||||
} else if (handle->principal != NULL &&
|
||||
krb5_principal_compare(context, handle->principal,
|
||||
def_princ) == FALSE) {
|
||||
krb5_free_principal(context, def_princ);
|
||||
def_princ = NULL;
|
||||
krb5_cc_close(context, ccache);
|
||||
ccache = NULL;
|
||||
}
|
||||
if (def_princ == NULL) {
|
||||
/* We have no existing credentials cache,
|
||||
* so attempt to get a TGT using a keytab.
|
||||
*/
|
||||
if (handle->principal == NULL) {
|
||||
kret = krb5_get_default_principal(context, &handle->principal);
|
||||
if (kret)
|
||||
goto end;
|
||||
}
|
||||
kret = get_keytab(context, &keytab);
|
||||
if (kret)
|
||||
goto end;
|
||||
kret = krb5_get_init_creds_opt_alloc(context, &opt);
|
||||
if (kret)
|
||||
goto end;
|
||||
kret = krb5_get_init_creds_keytab(context, &cred,
|
||||
handle->principal, keytab, 0, NULL, opt);
|
||||
krb5_get_init_creds_opt_free(context, opt);
|
||||
if (kret)
|
||||
goto end;
|
||||
kret = krb5_cc_new_unique(context, krb5_cc_type_memory,
|
||||
NULL, &ccache);
|
||||
if (kret)
|
||||
goto end;
|
||||
kret = krb5_cc_initialize(context, ccache, cred.client);
|
||||
if (kret) {
|
||||
krb5_cc_destroy(context, ccache);
|
||||
goto end;
|
||||
}
|
||||
kret = krb5_cc_store_cred(context, ccache, &cred);
|
||||
if (kret) {
|
||||
krb5_cc_destroy(context, ccache);
|
||||
goto end;
|
||||
}
|
||||
handle->lifetime = cred.times.endtime;
|
||||
handle->cred_flags |= GSS_CF_DESTROY_CRED_ON_RELEASE;
|
||||
} else {
|
||||
|
||||
ret = __gsskrb5_ccache_lifetime(minor_status,
|
||||
context,
|
||||
ccache,
|
||||
handle->principal,
|
||||
&handle->lifetime);
|
||||
if (ret != GSS_S_COMPLETE) {
|
||||
krb5_cc_close(context, ccache);
|
||||
goto end;
|
||||
}
|
||||
kret = 0;
|
||||
}
|
||||
found:
|
||||
handle->ccache = ccache;
|
||||
ret = GSS_S_COMPLETE;
|
||||
|
||||
end:
|
||||
if (cred.client != NULL)
|
||||
krb5_free_cred_contents(context, &cred);
|
||||
if (def_princ != NULL)
|
||||
krb5_free_principal(context, def_princ);
|
||||
if (keytab != NULL)
|
||||
krb5_kt_close(context, keytab);
|
||||
if (ret != GSS_S_COMPLETE && kret != 0)
|
||||
*minor_status = kret;
|
||||
return (ret);
|
||||
}
|
||||
|
||||
static OM_uint32 acquire_acceptor_cred
|
||||
(OM_uint32 * minor_status,
|
||||
krb5_context context,
|
||||
const gss_name_t desired_name,
|
||||
OM_uint32 time_req,
|
||||
const gss_OID_set desired_mechs,
|
||||
gss_cred_usage_t cred_usage,
|
||||
gsskrb5_cred handle,
|
||||
gss_OID_set * actual_mechs,
|
||||
OM_uint32 * time_rec
|
||||
)
|
||||
{
|
||||
OM_uint32 ret;
|
||||
krb5_error_code kret;
|
||||
|
||||
ret = GSS_S_FAILURE;
|
||||
kret = get_keytab(context, &handle->keytab);
|
||||
if (kret)
|
||||
goto end;
|
||||
|
||||
/* check that the requested principal exists in the keytab */
|
||||
if (handle->principal) {
|
||||
krb5_keytab_entry entry;
|
||||
|
||||
kret = krb5_kt_get_entry(context, handle->keytab,
|
||||
handle->principal, 0, 0, &entry);
|
||||
if (kret)
|
||||
goto end;
|
||||
krb5_kt_free_entry(context, &entry);
|
||||
ret = GSS_S_COMPLETE;
|
||||
} else {
|
||||
/*
|
||||
* Check if there is at least one entry in the keytab before
|
||||
* declaring it as an useful keytab.
|
||||
*/
|
||||
krb5_keytab_entry tmp;
|
||||
krb5_kt_cursor c;
|
||||
|
||||
kret = krb5_kt_start_seq_get (context, handle->keytab, &c);
|
||||
if (kret)
|
||||
goto end;
|
||||
if (krb5_kt_next_entry(context, handle->keytab, &tmp, &c) == 0) {
|
||||
krb5_kt_free_entry(context, &tmp);
|
||||
ret = GSS_S_COMPLETE; /* ok found one entry */
|
||||
}
|
||||
krb5_kt_end_seq_get (context, handle->keytab, &c);
|
||||
}
|
||||
end:
|
||||
if (ret != GSS_S_COMPLETE) {
|
||||
if (handle->keytab != NULL)
|
||||
krb5_kt_close(context, handle->keytab);
|
||||
if (kret != 0) {
|
||||
*minor_status = kret;
|
||||
}
|
||||
}
|
||||
return (ret);
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_acquire_cred
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_name_t desired_name,
|
||||
OM_uint32 time_req,
|
||||
const gss_OID_set desired_mechs,
|
||||
gss_cred_usage_t cred_usage,
|
||||
gss_cred_id_t * output_cred_handle,
|
||||
gss_OID_set * actual_mechs,
|
||||
OM_uint32 * time_rec
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
gsskrb5_cred handle;
|
||||
OM_uint32 ret;
|
||||
|
||||
if (cred_usage != GSS_C_ACCEPT && cred_usage != GSS_C_INITIATE && cred_usage != GSS_C_BOTH) {
|
||||
*minor_status = GSS_KRB5_S_G_BAD_USAGE;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
GSSAPI_KRB5_INIT(&context);
|
||||
|
||||
*output_cred_handle = NULL;
|
||||
if (time_rec)
|
||||
*time_rec = 0;
|
||||
if (actual_mechs)
|
||||
*actual_mechs = GSS_C_NO_OID_SET;
|
||||
|
||||
if (desired_mechs) {
|
||||
int present = 0;
|
||||
|
||||
ret = gss_test_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
|
||||
desired_mechs, &present);
|
||||
if (ret)
|
||||
return ret;
|
||||
if (!present) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_MECH;
|
||||
}
|
||||
}
|
||||
|
||||
handle = calloc(1, sizeof(*handle));
|
||||
if (handle == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_init(&handle->cred_id_mutex);
|
||||
|
||||
if (desired_name != GSS_C_NO_NAME) {
|
||||
|
||||
ret = _gsskrb5_canon_name(minor_status, context, 1, NULL,
|
||||
desired_name, &handle->principal);
|
||||
if (ret) {
|
||||
HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
|
||||
free(handle);
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
if (cred_usage == GSS_C_INITIATE || cred_usage == GSS_C_BOTH) {
|
||||
ret = acquire_initiator_cred(minor_status, context,
|
||||
desired_name, time_req,
|
||||
desired_mechs, cred_usage, handle,
|
||||
actual_mechs, time_rec);
|
||||
if (ret != GSS_S_COMPLETE) {
|
||||
HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
|
||||
krb5_free_principal(context, handle->principal);
|
||||
free(handle);
|
||||
return (ret);
|
||||
}
|
||||
}
|
||||
if (cred_usage == GSS_C_ACCEPT || cred_usage == GSS_C_BOTH) {
|
||||
ret = acquire_acceptor_cred(minor_status, context,
|
||||
desired_name, time_req,
|
||||
desired_mechs, cred_usage, handle, actual_mechs, time_rec);
|
||||
if (ret != GSS_S_COMPLETE) {
|
||||
HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
|
||||
krb5_free_principal(context, handle->principal);
|
||||
free(handle);
|
||||
return (ret);
|
||||
}
|
||||
}
|
||||
ret = gss_create_empty_oid_set(minor_status, &handle->mechanisms);
|
||||
if (ret == GSS_S_COMPLETE)
|
||||
ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
|
||||
&handle->mechanisms);
|
||||
if (ret == GSS_S_COMPLETE)
|
||||
ret = _gsskrb5_inquire_cred(minor_status, (gss_cred_id_t)handle,
|
||||
NULL, time_rec, NULL, actual_mechs);
|
||||
if (ret != GSS_S_COMPLETE) {
|
||||
if (handle->mechanisms != NULL)
|
||||
gss_release_oid_set(NULL, &handle->mechanisms);
|
||||
HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
|
||||
krb5_free_principal(context, handle->principal);
|
||||
free(handle);
|
||||
return (ret);
|
||||
}
|
||||
*minor_status = 0;
|
||||
if (time_rec) {
|
||||
ret = _gsskrb5_lifetime_left(minor_status,
|
||||
context,
|
||||
handle->lifetime,
|
||||
time_rec);
|
||||
|
||||
if (ret)
|
||||
return ret;
|
||||
}
|
||||
handle->usage = cred_usage;
|
||||
*output_cred_handle = (gss_cred_id_t)handle;
|
||||
return (GSS_S_COMPLETE);
|
||||
}
|
||||
@@ -0,0 +1,241 @@
|
||||
/* $NetBSD: add_cred.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_add_cred (
|
||||
OM_uint32 *minor_status,
|
||||
const gss_cred_id_t input_cred_handle,
|
||||
const gss_name_t desired_name,
|
||||
const gss_OID desired_mech,
|
||||
gss_cred_usage_t cred_usage,
|
||||
OM_uint32 initiator_time_req,
|
||||
OM_uint32 acceptor_time_req,
|
||||
gss_cred_id_t *output_cred_handle,
|
||||
gss_OID_set *actual_mechs,
|
||||
OM_uint32 *initiator_time_rec,
|
||||
OM_uint32 *acceptor_time_rec)
|
||||
{
|
||||
krb5_context context;
|
||||
OM_uint32 ret, lifetime;
|
||||
gsskrb5_cred cred, handle;
|
||||
krb5_const_principal dname;
|
||||
|
||||
handle = NULL;
|
||||
cred = (gsskrb5_cred)input_cred_handle;
|
||||
dname = (krb5_const_principal)desired_name;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (gss_oid_equal(desired_mech, GSS_KRB5_MECHANISM) == 0) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_MECH;
|
||||
}
|
||||
|
||||
if (cred == NULL && output_cred_handle == NULL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_NO_CRED;
|
||||
}
|
||||
|
||||
if (cred == NULL) { /* XXX standard conformance failure */
|
||||
*minor_status = 0;
|
||||
return GSS_S_NO_CRED;
|
||||
}
|
||||
|
||||
/* check if requested output usage is compatible with output usage */
|
||||
if (output_cred_handle != NULL) {
|
||||
HEIMDAL_MUTEX_lock(&cred->cred_id_mutex);
|
||||
if (cred->usage != cred_usage && cred->usage != GSS_C_BOTH) {
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
*minor_status = GSS_KRB5_S_G_BAD_USAGE;
|
||||
return(GSS_S_FAILURE);
|
||||
}
|
||||
}
|
||||
|
||||
/* check that we have the same name */
|
||||
if (dname != NULL &&
|
||||
krb5_principal_compare(context, dname,
|
||||
cred->principal) != FALSE) {
|
||||
if (output_cred_handle)
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_NAME;
|
||||
}
|
||||
|
||||
/* make a copy */
|
||||
if (output_cred_handle) {
|
||||
krb5_error_code kret;
|
||||
|
||||
handle = calloc(1, sizeof(*handle));
|
||||
if (handle == NULL) {
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
|
||||
handle->usage = cred_usage;
|
||||
handle->lifetime = cred->lifetime;
|
||||
handle->principal = NULL;
|
||||
handle->keytab = NULL;
|
||||
handle->ccache = NULL;
|
||||
handle->mechanisms = NULL;
|
||||
HEIMDAL_MUTEX_init(&handle->cred_id_mutex);
|
||||
|
||||
ret = GSS_S_FAILURE;
|
||||
|
||||
kret = krb5_copy_principal(context, cred->principal,
|
||||
&handle->principal);
|
||||
if (kret) {
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
free(handle);
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
if (cred->keytab) {
|
||||
char *name = NULL;
|
||||
|
||||
ret = GSS_S_FAILURE;
|
||||
|
||||
kret = krb5_kt_get_full_name(context, cred->keytab, &name);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
kret = krb5_kt_resolve(context, name,
|
||||
&handle->keytab);
|
||||
krb5_xfree(name);
|
||||
if (kret){
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
}
|
||||
|
||||
if (cred->ccache) {
|
||||
const char *type, *name;
|
||||
char *type_name = NULL;
|
||||
|
||||
ret = GSS_S_FAILURE;
|
||||
|
||||
type = krb5_cc_get_type(context, cred->ccache);
|
||||
if (type == NULL){
|
||||
*minor_status = ENOMEM;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
if (strcmp(type, "MEMORY") == 0) {
|
||||
ret = krb5_cc_new_unique(context, type,
|
||||
NULL, &handle->ccache);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
ret = krb5_cc_copy_cache(context, cred->ccache,
|
||||
handle->ccache);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
} else {
|
||||
name = krb5_cc_get_name(context, cred->ccache);
|
||||
if (name == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
kret = asprintf(&type_name, "%s:%s", type, name);
|
||||
if (kret < 0 || type_name == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
kret = krb5_cc_resolve(context, type_name,
|
||||
&handle->ccache);
|
||||
free(type_name);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
}
|
||||
}
|
||||
ret = gss_create_empty_oid_set(minor_status, &handle->mechanisms);
|
||||
if (ret)
|
||||
goto failure;
|
||||
|
||||
ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
|
||||
&handle->mechanisms);
|
||||
if (ret)
|
||||
goto failure;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
|
||||
ret = _gsskrb5_inquire_cred(minor_status, (gss_cred_id_t)cred,
|
||||
NULL, &lifetime, NULL, actual_mechs);
|
||||
if (ret)
|
||||
goto failure;
|
||||
|
||||
if (initiator_time_rec)
|
||||
*initiator_time_rec = lifetime;
|
||||
if (acceptor_time_rec)
|
||||
*acceptor_time_rec = lifetime;
|
||||
|
||||
if (output_cred_handle) {
|
||||
*output_cred_handle = (gss_cred_id_t)handle;
|
||||
}
|
||||
|
||||
*minor_status = 0;
|
||||
return ret;
|
||||
|
||||
failure:
|
||||
|
||||
if (handle) {
|
||||
if (handle->principal)
|
||||
krb5_free_principal(context, handle->principal);
|
||||
if (handle->keytab)
|
||||
krb5_kt_close(context, handle->keytab);
|
||||
if (handle->ccache)
|
||||
krb5_cc_destroy(context, handle->ccache);
|
||||
if (handle->mechanisms)
|
||||
gss_release_oid_set(NULL, &handle->mechanisms);
|
||||
free(handle);
|
||||
}
|
||||
if (output_cred_handle)
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
/* $NetBSD: address_to_krb5addr.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2000 - 2001 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
#include <krb5/roken.h>
|
||||
|
||||
krb5_error_code
|
||||
_gsskrb5i_address_to_krb5addr(krb5_context context,
|
||||
OM_uint32 gss_addr_type,
|
||||
gss_buffer_desc *gss_addr,
|
||||
int16_t port,
|
||||
krb5_address *address)
|
||||
{
|
||||
int addr_type;
|
||||
struct sockaddr sa;
|
||||
krb5_socklen_t sa_size = sizeof(sa);
|
||||
krb5_error_code problem;
|
||||
|
||||
if (gss_addr == NULL)
|
||||
return GSS_S_FAILURE;
|
||||
|
||||
switch (gss_addr_type) {
|
||||
#ifdef HAVE_IPV6
|
||||
case GSS_C_AF_INET6: addr_type = AF_INET6;
|
||||
break;
|
||||
#endif /* HAVE_IPV6 */
|
||||
|
||||
case GSS_C_AF_INET: addr_type = AF_INET;
|
||||
break;
|
||||
default:
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
problem = krb5_h_addr2sockaddr (context,
|
||||
addr_type,
|
||||
gss_addr->value,
|
||||
&sa,
|
||||
&sa_size,
|
||||
port);
|
||||
if (problem)
|
||||
return GSS_S_FAILURE;
|
||||
|
||||
problem = krb5_sockaddr2address (context, &sa, address);
|
||||
|
||||
return problem;
|
||||
}
|
||||
@@ -0,0 +1,102 @@
|
||||
/* $NetBSD: aeap.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2008 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
#include <krb5/roken.h>
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gk_wrap_iov(OM_uint32 * minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
int * conf_state,
|
||||
gss_iov_buffer_desc *iov,
|
||||
int iov_count)
|
||||
{
|
||||
const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
|
||||
krb5_context context;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (ctx->more_flags & IS_CFX)
|
||||
return _gssapi_wrap_cfx_iov(minor_status, ctx, context,
|
||||
conf_req_flag, conf_state,
|
||||
iov, iov_count);
|
||||
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gk_unwrap_iov(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
int *conf_state,
|
||||
gss_qop_t *qop_state,
|
||||
gss_iov_buffer_desc *iov,
|
||||
int iov_count)
|
||||
{
|
||||
const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
|
||||
krb5_context context;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (ctx->more_flags & IS_CFX)
|
||||
return _gssapi_unwrap_cfx_iov(minor_status, ctx, context,
|
||||
conf_state, qop_state, iov, iov_count);
|
||||
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gk_wrap_iov_length(OM_uint32 * minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
int *conf_state,
|
||||
gss_iov_buffer_desc *iov,
|
||||
int iov_count)
|
||||
{
|
||||
const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
|
||||
krb5_context context;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (ctx->more_flags & IS_CFX)
|
||||
return _gssapi_wrap_iov_length_cfx(minor_status, ctx, context,
|
||||
conf_req_flag, qop_req, conf_state,
|
||||
iov, iov_count);
|
||||
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
@@ -0,0 +1,764 @@
|
||||
/* $NetBSD: arcfour.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003 - 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
/*
|
||||
* Implements draft-brezak-win2k-krb-rc4-hmac-04.txt
|
||||
*
|
||||
* The arcfour message have the following formats:
|
||||
*
|
||||
* MIC token
|
||||
* TOK_ID[2] = 01 01
|
||||
* SGN_ALG[2] = 11 00
|
||||
* Filler[4]
|
||||
* SND_SEQ[8]
|
||||
* SGN_CKSUM[8]
|
||||
*
|
||||
* WRAP token
|
||||
* TOK_ID[2] = 02 01
|
||||
* SGN_ALG[2];
|
||||
* SEAL_ALG[2]
|
||||
* Filler[2]
|
||||
* SND_SEQ[2]
|
||||
* SGN_CKSUM[8]
|
||||
* Confounder[8]
|
||||
*/
|
||||
|
||||
/*
|
||||
* WRAP in DCE-style have a fixed size header, the oid and length over
|
||||
* the WRAP header is a total of
|
||||
* GSS_ARCFOUR_WRAP_TOKEN_DCE_DER_HEADER_SIZE +
|
||||
* GSS_ARCFOUR_WRAP_TOKEN_SIZE byte (ie total of 45 bytes overhead,
|
||||
* remember the 2 bytes from APPL [0] SEQ).
|
||||
*/
|
||||
|
||||
#define GSS_ARCFOUR_WRAP_TOKEN_SIZE 32
|
||||
#define GSS_ARCFOUR_WRAP_TOKEN_DCE_DER_HEADER_SIZE 13
|
||||
|
||||
|
||||
static krb5_error_code
|
||||
arcfour_mic_key(krb5_context context, krb5_keyblock *key,
|
||||
void *cksum_data, size_t cksum_size,
|
||||
void *key6_data, size_t key6_size)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
|
||||
Checksum cksum_k5;
|
||||
krb5_keyblock key5;
|
||||
char k5_data[16];
|
||||
|
||||
Checksum cksum_k6;
|
||||
|
||||
char T[4];
|
||||
|
||||
memset(T, 0, 4);
|
||||
cksum_k5.checksum.data = k5_data;
|
||||
cksum_k5.checksum.length = sizeof(k5_data);
|
||||
|
||||
if (key->keytype == KEYTYPE_ARCFOUR_56) {
|
||||
char L40[14] = "fortybits";
|
||||
|
||||
memcpy(L40 + 10, T, sizeof(T));
|
||||
ret = krb5_hmac(context, CKSUMTYPE_RSA_MD5,
|
||||
L40, 14, 0, key, &cksum_k5);
|
||||
memset(&k5_data[7], 0xAB, 9);
|
||||
} else {
|
||||
ret = krb5_hmac(context, CKSUMTYPE_RSA_MD5,
|
||||
T, 4, 0, key, &cksum_k5);
|
||||
}
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
key5.keytype = KEYTYPE_ARCFOUR;
|
||||
key5.keyvalue = cksum_k5.checksum;
|
||||
|
||||
cksum_k6.checksum.data = key6_data;
|
||||
cksum_k6.checksum.length = key6_size;
|
||||
|
||||
return krb5_hmac(context, CKSUMTYPE_RSA_MD5,
|
||||
cksum_data, cksum_size, 0, &key5, &cksum_k6);
|
||||
}
|
||||
|
||||
|
||||
static krb5_error_code
|
||||
arcfour_mic_cksum(krb5_context context,
|
||||
krb5_keyblock *key, unsigned usage,
|
||||
u_char *sgn_cksum, size_t sgn_cksum_sz,
|
||||
const u_char *v1, size_t l1,
|
||||
const void *v2, size_t l2,
|
||||
const void *v3, size_t l3)
|
||||
{
|
||||
Checksum CKSUM;
|
||||
u_char *ptr;
|
||||
size_t len;
|
||||
krb5_crypto crypto;
|
||||
krb5_error_code ret;
|
||||
|
||||
assert(sgn_cksum_sz == 8);
|
||||
|
||||
len = l1 + l2 + l3;
|
||||
|
||||
ptr = malloc(len);
|
||||
if (ptr == NULL)
|
||||
return ENOMEM;
|
||||
|
||||
memcpy(ptr, v1, l1);
|
||||
memcpy(ptr + l1, v2, l2);
|
||||
memcpy(ptr + l1 + l2, v3, l3);
|
||||
|
||||
ret = krb5_crypto_init(context, key, 0, &crypto);
|
||||
if (ret) {
|
||||
free(ptr);
|
||||
return ret;
|
||||
}
|
||||
|
||||
ret = krb5_create_checksum(context,
|
||||
crypto,
|
||||
usage,
|
||||
0,
|
||||
ptr, len,
|
||||
&CKSUM);
|
||||
free(ptr);
|
||||
if (ret == 0) {
|
||||
memcpy(sgn_cksum, CKSUM.checksum.data, sgn_cksum_sz);
|
||||
free_Checksum(&CKSUM);
|
||||
}
|
||||
krb5_crypto_destroy(context, crypto);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
OM_uint32
|
||||
_gssapi_get_mic_arcfour(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
krb5_context context,
|
||||
gss_qop_t qop_req,
|
||||
const gss_buffer_t message_buffer,
|
||||
gss_buffer_t message_token,
|
||||
krb5_keyblock *key)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
int32_t seq_number;
|
||||
size_t len, total_len;
|
||||
u_char k6_data[16], *p0, *p;
|
||||
EVP_CIPHER_CTX rc4_key;
|
||||
|
||||
_gsskrb5_encap_length (22, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
|
||||
message_token->length = total_len;
|
||||
message_token->value = malloc (total_len);
|
||||
if (message_token->value == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
p0 = _gssapi_make_mech_header(message_token->value,
|
||||
len,
|
||||
GSS_KRB5_MECHANISM);
|
||||
p = p0;
|
||||
|
||||
*p++ = 0x01; /* TOK_ID */
|
||||
*p++ = 0x01;
|
||||
*p++ = 0x11; /* SGN_ALG */
|
||||
*p++ = 0x00;
|
||||
*p++ = 0xff; /* Filler */
|
||||
*p++ = 0xff;
|
||||
*p++ = 0xff;
|
||||
*p++ = 0xff;
|
||||
|
||||
p = NULL;
|
||||
|
||||
ret = arcfour_mic_cksum(context,
|
||||
key, KRB5_KU_USAGE_SIGN,
|
||||
p0 + 16, 8, /* SGN_CKSUM */
|
||||
p0, 8, /* TOK_ID, SGN_ALG, Filer */
|
||||
message_buffer->value, message_buffer->length,
|
||||
NULL, 0);
|
||||
if (ret) {
|
||||
_gsskrb5_release_buffer(minor_status, message_token);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = arcfour_mic_key(context, key,
|
||||
p0 + 16, 8, /* SGN_CKSUM */
|
||||
k6_data, sizeof(k6_data));
|
||||
if (ret) {
|
||||
_gsskrb5_release_buffer(minor_status, message_token);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
krb5_auth_con_getlocalseqnumber (context,
|
||||
context_handle->auth_context,
|
||||
&seq_number);
|
||||
p = p0 + 8; /* SND_SEQ */
|
||||
_gsskrb5_encode_be_om_uint32(seq_number, p);
|
||||
|
||||
krb5_auth_con_setlocalseqnumber (context,
|
||||
context_handle->auth_context,
|
||||
++seq_number);
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
|
||||
memset (p + 4, (context_handle->more_flags & LOCAL) ? 0 : 0xff, 4);
|
||||
|
||||
EVP_CIPHER_CTX_init(&rc4_key);
|
||||
EVP_CipherInit_ex(&rc4_key, EVP_rc4(), NULL, k6_data, NULL, 1);
|
||||
EVP_Cipher(&rc4_key, p, p, 8);
|
||||
EVP_CIPHER_CTX_cleanup(&rc4_key);
|
||||
|
||||
memset(k6_data, 0, sizeof(k6_data));
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
|
||||
OM_uint32
|
||||
_gssapi_verify_mic_arcfour(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
krb5_context context,
|
||||
const gss_buffer_t message_buffer,
|
||||
const gss_buffer_t token_buffer,
|
||||
gss_qop_t * qop_state,
|
||||
krb5_keyblock *key,
|
||||
char *type)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
uint32_t seq_number;
|
||||
OM_uint32 omret;
|
||||
u_char SND_SEQ[8], cksum_data[8], *p;
|
||||
char k6_data[16];
|
||||
int cmp;
|
||||
|
||||
if (qop_state)
|
||||
*qop_state = 0;
|
||||
|
||||
p = token_buffer->value;
|
||||
omret = _gsskrb5_verify_header (&p,
|
||||
token_buffer->length,
|
||||
(u_char *)type,
|
||||
GSS_KRB5_MECHANISM);
|
||||
if (omret)
|
||||
return omret;
|
||||
|
||||
if (memcmp(p, "\x11\x00", 2) != 0) /* SGN_ALG = HMAC MD5 ARCFOUR */
|
||||
return GSS_S_BAD_SIG;
|
||||
p += 2;
|
||||
if (memcmp (p, "\xff\xff\xff\xff", 4) != 0)
|
||||
return GSS_S_BAD_MIC;
|
||||
p += 4;
|
||||
|
||||
ret = arcfour_mic_cksum(context,
|
||||
key, KRB5_KU_USAGE_SIGN,
|
||||
cksum_data, sizeof(cksum_data),
|
||||
p - 8, 8,
|
||||
message_buffer->value, message_buffer->length,
|
||||
NULL, 0);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = arcfour_mic_key(context, key,
|
||||
cksum_data, sizeof(cksum_data),
|
||||
k6_data, sizeof(k6_data));
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
cmp = ct_memcmp(cksum_data, p + 8, 8);
|
||||
if (cmp) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_MIC;
|
||||
}
|
||||
|
||||
{
|
||||
EVP_CIPHER_CTX rc4_key;
|
||||
|
||||
EVP_CIPHER_CTX_init(&rc4_key);
|
||||
EVP_CipherInit_ex(&rc4_key, EVP_rc4(), NULL, (void *)k6_data, NULL, 0);
|
||||
EVP_Cipher(&rc4_key, SND_SEQ, p, 8);
|
||||
EVP_CIPHER_CTX_cleanup(&rc4_key);
|
||||
|
||||
memset(k6_data, 0, sizeof(k6_data));
|
||||
}
|
||||
|
||||
_gsskrb5_decode_be_om_uint32(SND_SEQ, &seq_number);
|
||||
|
||||
if (context_handle->more_flags & LOCAL)
|
||||
cmp = memcmp(&SND_SEQ[4], "\xff\xff\xff\xff", 4);
|
||||
else
|
||||
cmp = memcmp(&SND_SEQ[4], "\x00\x00\x00\x00", 4);
|
||||
|
||||
memset(SND_SEQ, 0, sizeof(SND_SEQ));
|
||||
if (cmp != 0) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_MIC;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
omret = _gssapi_msg_order_check(context_handle->order, seq_number);
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
if (omret)
|
||||
return omret;
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gssapi_wrap_arcfour(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
krb5_context context,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
const gss_buffer_t input_message_buffer,
|
||||
int * conf_state,
|
||||
gss_buffer_t output_message_buffer,
|
||||
krb5_keyblock *key)
|
||||
{
|
||||
u_char Klocaldata[16], k6_data[16], *p, *p0;
|
||||
size_t len, total_len, datalen;
|
||||
krb5_keyblock Klocal;
|
||||
krb5_error_code ret;
|
||||
int32_t seq_number;
|
||||
|
||||
if (conf_state)
|
||||
*conf_state = 0;
|
||||
|
||||
datalen = input_message_buffer->length;
|
||||
|
||||
if (IS_DCE_STYLE(context_handle)) {
|
||||
len = GSS_ARCFOUR_WRAP_TOKEN_SIZE;
|
||||
_gssapi_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
total_len += datalen;
|
||||
} else {
|
||||
datalen += 1; /* padding */
|
||||
len = datalen + GSS_ARCFOUR_WRAP_TOKEN_SIZE;
|
||||
_gssapi_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
}
|
||||
|
||||
output_message_buffer->length = total_len;
|
||||
output_message_buffer->value = malloc (total_len);
|
||||
if (output_message_buffer->value == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
p0 = _gssapi_make_mech_header(output_message_buffer->value,
|
||||
len,
|
||||
GSS_KRB5_MECHANISM);
|
||||
p = p0;
|
||||
|
||||
*p++ = 0x02; /* TOK_ID */
|
||||
*p++ = 0x01;
|
||||
*p++ = 0x11; /* SGN_ALG */
|
||||
*p++ = 0x00;
|
||||
if (conf_req_flag) {
|
||||
*p++ = 0x10; /* SEAL_ALG */
|
||||
*p++ = 0x00;
|
||||
} else {
|
||||
*p++ = 0xff; /* SEAL_ALG */
|
||||
*p++ = 0xff;
|
||||
}
|
||||
*p++ = 0xff; /* Filler */
|
||||
*p++ = 0xff;
|
||||
|
||||
p = NULL;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
krb5_auth_con_getlocalseqnumber (context,
|
||||
context_handle->auth_context,
|
||||
&seq_number);
|
||||
|
||||
_gsskrb5_encode_be_om_uint32(seq_number, p0 + 8);
|
||||
|
||||
krb5_auth_con_setlocalseqnumber (context,
|
||||
context_handle->auth_context,
|
||||
++seq_number);
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
|
||||
memset (p0 + 8 + 4,
|
||||
(context_handle->more_flags & LOCAL) ? 0 : 0xff,
|
||||
4);
|
||||
|
||||
krb5_generate_random_block(p0 + 24, 8); /* fill in Confounder */
|
||||
|
||||
/* p points to data */
|
||||
p = p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE;
|
||||
memcpy(p, input_message_buffer->value, input_message_buffer->length);
|
||||
|
||||
if (!IS_DCE_STYLE(context_handle))
|
||||
p[input_message_buffer->length] = 1; /* padding */
|
||||
|
||||
ret = arcfour_mic_cksum(context,
|
||||
key, KRB5_KU_USAGE_SEAL,
|
||||
p0 + 16, 8, /* SGN_CKSUM */
|
||||
p0, 8, /* TOK_ID, SGN_ALG, SEAL_ALG, Filler */
|
||||
p0 + 24, 8, /* Confounder */
|
||||
p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE,
|
||||
datalen);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
_gsskrb5_release_buffer(minor_status, output_message_buffer);
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
{
|
||||
int i;
|
||||
|
||||
Klocal.keytype = key->keytype;
|
||||
Klocal.keyvalue.data = Klocaldata;
|
||||
Klocal.keyvalue.length = sizeof(Klocaldata);
|
||||
|
||||
for (i = 0; i < 16; i++)
|
||||
Klocaldata[i] = ((u_char *)key->keyvalue.data)[i] ^ 0xF0;
|
||||
}
|
||||
ret = arcfour_mic_key(context, &Klocal,
|
||||
p0 + 8, 4, /* SND_SEQ */
|
||||
k6_data, sizeof(k6_data));
|
||||
memset(Klocaldata, 0, sizeof(Klocaldata));
|
||||
if (ret) {
|
||||
_gsskrb5_release_buffer(minor_status, output_message_buffer);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
|
||||
if(conf_req_flag) {
|
||||
EVP_CIPHER_CTX rc4_key;
|
||||
|
||||
EVP_CIPHER_CTX_init(&rc4_key);
|
||||
EVP_CipherInit_ex(&rc4_key, EVP_rc4(), NULL, k6_data, NULL, 1);
|
||||
EVP_Cipher(&rc4_key, p0 + 24, p0 + 24, 8 + datalen);
|
||||
EVP_CIPHER_CTX_cleanup(&rc4_key);
|
||||
}
|
||||
memset(k6_data, 0, sizeof(k6_data));
|
||||
|
||||
ret = arcfour_mic_key(context, key,
|
||||
p0 + 16, 8, /* SGN_CKSUM */
|
||||
k6_data, sizeof(k6_data));
|
||||
if (ret) {
|
||||
_gsskrb5_release_buffer(minor_status, output_message_buffer);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
{
|
||||
EVP_CIPHER_CTX rc4_key;
|
||||
|
||||
EVP_CIPHER_CTX_init(&rc4_key);
|
||||
EVP_CipherInit_ex(&rc4_key, EVP_rc4(), NULL, k6_data, NULL, 1);
|
||||
EVP_Cipher(&rc4_key, p0 + 8, p0 + 8 /* SND_SEQ */, 8);
|
||||
EVP_CIPHER_CTX_cleanup(&rc4_key);
|
||||
memset(k6_data, 0, sizeof(k6_data));
|
||||
}
|
||||
|
||||
if (conf_state)
|
||||
*conf_state = conf_req_flag;
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32 _gssapi_unwrap_arcfour(OM_uint32 *minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
krb5_context context,
|
||||
const gss_buffer_t input_message_buffer,
|
||||
gss_buffer_t output_message_buffer,
|
||||
int *conf_state,
|
||||
gss_qop_t *qop_state,
|
||||
krb5_keyblock *key)
|
||||
{
|
||||
u_char Klocaldata[16];
|
||||
krb5_keyblock Klocal;
|
||||
krb5_error_code ret;
|
||||
uint32_t seq_number;
|
||||
size_t datalen;
|
||||
OM_uint32 omret;
|
||||
u_char k6_data[16], SND_SEQ[8], Confounder[8];
|
||||
u_char cksum_data[8];
|
||||
u_char *p, *p0;
|
||||
int cmp;
|
||||
int conf_flag;
|
||||
size_t padlen = 0, len;
|
||||
|
||||
if (conf_state)
|
||||
*conf_state = 0;
|
||||
if (qop_state)
|
||||
*qop_state = 0;
|
||||
|
||||
p0 = input_message_buffer->value;
|
||||
|
||||
if (IS_DCE_STYLE(context_handle)) {
|
||||
len = GSS_ARCFOUR_WRAP_TOKEN_SIZE +
|
||||
GSS_ARCFOUR_WRAP_TOKEN_DCE_DER_HEADER_SIZE;
|
||||
if (input_message_buffer->length < len)
|
||||
return GSS_S_BAD_MECH;
|
||||
} else {
|
||||
len = input_message_buffer->length;
|
||||
}
|
||||
|
||||
omret = _gssapi_verify_mech_header(&p0,
|
||||
len,
|
||||
GSS_KRB5_MECHANISM);
|
||||
if (omret)
|
||||
return omret;
|
||||
|
||||
/* length of mech header */
|
||||
len = (p0 - (u_char *)input_message_buffer->value) +
|
||||
GSS_ARCFOUR_WRAP_TOKEN_SIZE;
|
||||
|
||||
if (len > input_message_buffer->length)
|
||||
return GSS_S_BAD_MECH;
|
||||
|
||||
/* length of data */
|
||||
datalen = input_message_buffer->length - len;
|
||||
|
||||
p = p0;
|
||||
|
||||
if (memcmp(p, "\x02\x01", 2) != 0)
|
||||
return GSS_S_BAD_SIG;
|
||||
p += 2;
|
||||
if (memcmp(p, "\x11\x00", 2) != 0) /* SGN_ALG = HMAC MD5 ARCFOUR */
|
||||
return GSS_S_BAD_SIG;
|
||||
p += 2;
|
||||
|
||||
if (memcmp (p, "\x10\x00", 2) == 0)
|
||||
conf_flag = 1;
|
||||
else if (memcmp (p, "\xff\xff", 2) == 0)
|
||||
conf_flag = 0;
|
||||
else
|
||||
return GSS_S_BAD_SIG;
|
||||
|
||||
p += 2;
|
||||
if (memcmp (p, "\xff\xff", 2) != 0)
|
||||
return GSS_S_BAD_MIC;
|
||||
p = NULL;
|
||||
|
||||
ret = arcfour_mic_key(context, key,
|
||||
p0 + 16, 8, /* SGN_CKSUM */
|
||||
k6_data, sizeof(k6_data));
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
{
|
||||
EVP_CIPHER_CTX rc4_key;
|
||||
|
||||
EVP_CIPHER_CTX_init(&rc4_key);
|
||||
EVP_CipherInit_ex(&rc4_key, EVP_rc4(), NULL, k6_data, NULL, 1);
|
||||
EVP_Cipher(&rc4_key, SND_SEQ, p0 + 8, 8);
|
||||
EVP_CIPHER_CTX_cleanup(&rc4_key);
|
||||
memset(k6_data, 0, sizeof(k6_data));
|
||||
}
|
||||
|
||||
_gsskrb5_decode_be_om_uint32(SND_SEQ, &seq_number);
|
||||
|
||||
if (context_handle->more_flags & LOCAL)
|
||||
cmp = memcmp(&SND_SEQ[4], "\xff\xff\xff\xff", 4);
|
||||
else
|
||||
cmp = memcmp(&SND_SEQ[4], "\x00\x00\x00\x00", 4);
|
||||
|
||||
if (cmp != 0) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_MIC;
|
||||
}
|
||||
|
||||
{
|
||||
int i;
|
||||
|
||||
Klocal.keytype = key->keytype;
|
||||
Klocal.keyvalue.data = Klocaldata;
|
||||
Klocal.keyvalue.length = sizeof(Klocaldata);
|
||||
|
||||
for (i = 0; i < 16; i++)
|
||||
Klocaldata[i] = ((u_char *)key->keyvalue.data)[i] ^ 0xF0;
|
||||
}
|
||||
ret = arcfour_mic_key(context, &Klocal,
|
||||
SND_SEQ, 4,
|
||||
k6_data, sizeof(k6_data));
|
||||
memset(Klocaldata, 0, sizeof(Klocaldata));
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
output_message_buffer->value = malloc(datalen);
|
||||
if (output_message_buffer->value == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
output_message_buffer->length = datalen;
|
||||
|
||||
if(conf_flag) {
|
||||
EVP_CIPHER_CTX rc4_key;
|
||||
|
||||
EVP_CIPHER_CTX_init(&rc4_key);
|
||||
EVP_CipherInit_ex(&rc4_key, EVP_rc4(), NULL, k6_data, NULL, 1);
|
||||
EVP_Cipher(&rc4_key, Confounder, p0 + 24, 8);
|
||||
EVP_Cipher(&rc4_key, output_message_buffer->value, p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE, datalen);
|
||||
EVP_CIPHER_CTX_cleanup(&rc4_key);
|
||||
} else {
|
||||
memcpy(Confounder, p0 + 24, 8); /* Confounder */
|
||||
memcpy(output_message_buffer->value,
|
||||
p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE,
|
||||
datalen);
|
||||
}
|
||||
memset(k6_data, 0, sizeof(k6_data));
|
||||
|
||||
if (!IS_DCE_STYLE(context_handle)) {
|
||||
ret = _gssapi_verify_pad(output_message_buffer, datalen, &padlen);
|
||||
if (ret) {
|
||||
_gsskrb5_release_buffer(minor_status, output_message_buffer);
|
||||
*minor_status = 0;
|
||||
return ret;
|
||||
}
|
||||
output_message_buffer->length -= padlen;
|
||||
}
|
||||
|
||||
ret = arcfour_mic_cksum(context,
|
||||
key, KRB5_KU_USAGE_SEAL,
|
||||
cksum_data, sizeof(cksum_data),
|
||||
p0, 8,
|
||||
Confounder, sizeof(Confounder),
|
||||
output_message_buffer->value,
|
||||
output_message_buffer->length + padlen);
|
||||
if (ret) {
|
||||
_gsskrb5_release_buffer(minor_status, output_message_buffer);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
cmp = ct_memcmp(cksum_data, p0 + 16, 8); /* SGN_CKSUM */
|
||||
if (cmp) {
|
||||
_gsskrb5_release_buffer(minor_status, output_message_buffer);
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_MIC;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
omret = _gssapi_msg_order_check(context_handle->order, seq_number);
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
if (omret)
|
||||
return omret;
|
||||
|
||||
if (conf_state)
|
||||
*conf_state = conf_flag;
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
max_wrap_length_arcfour(const gsskrb5_ctx ctx,
|
||||
krb5_crypto crypto,
|
||||
size_t input_length,
|
||||
OM_uint32 *max_input_size)
|
||||
{
|
||||
/*
|
||||
* if GSS_C_DCE_STYLE is in use:
|
||||
* - we only need to encapsulate the WRAP token
|
||||
* However, since this is a fixed since, we just
|
||||
*/
|
||||
if (IS_DCE_STYLE(ctx)) {
|
||||
size_t len, total_len;
|
||||
|
||||
len = GSS_ARCFOUR_WRAP_TOKEN_SIZE;
|
||||
_gssapi_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
|
||||
if (input_length < len)
|
||||
*max_input_size = 0;
|
||||
else
|
||||
*max_input_size = input_length - len;
|
||||
|
||||
} else {
|
||||
size_t extrasize = GSS_ARCFOUR_WRAP_TOKEN_SIZE;
|
||||
size_t blocksize = 8;
|
||||
size_t len, total_len;
|
||||
|
||||
len = 8 + input_length + blocksize + extrasize;
|
||||
|
||||
_gsskrb5_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
|
||||
total_len -= input_length; /* token length */
|
||||
if (total_len < input_length) {
|
||||
*max_input_size = (input_length - total_len);
|
||||
(*max_input_size) &= (~(OM_uint32)(blocksize - 1));
|
||||
} else {
|
||||
*max_input_size = 0;
|
||||
}
|
||||
}
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gssapi_wrap_size_arcfour(OM_uint32 *minor_status,
|
||||
const gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
OM_uint32 req_output_size,
|
||||
OM_uint32 *max_input_size,
|
||||
krb5_keyblock *key)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
krb5_crypto crypto;
|
||||
|
||||
ret = krb5_crypto_init(context, key, 0, &crypto);
|
||||
if (ret != 0) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = max_wrap_length_arcfour(ctx, crypto,
|
||||
req_output_size, max_input_size);
|
||||
if (ret != 0) {
|
||||
*minor_status = ret;
|
||||
krb5_crypto_destroy(context, crypto);
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
krb5_crypto_destroy(context, crypto);
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
/* $NetBSD: canonicalize_name.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_canonicalize_name (
|
||||
OM_uint32 * minor_status,
|
||||
const gss_name_t input_name,
|
||||
const gss_OID mech_type,
|
||||
gss_name_t * output_name
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
krb5_principal name;
|
||||
OM_uint32 ret;
|
||||
|
||||
*output_name = NULL;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
ret = _gsskrb5_canon_name(minor_status, context, 1, NULL, input_name, &name);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
*output_name = (gss_name_t)name;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
/* $NetBSD: ccache_name.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2004 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
char *last_out_name;
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_krb5_ccache_name(OM_uint32 *minor_status,
|
||||
const char *name,
|
||||
const char **out_name)
|
||||
{
|
||||
krb5_context context;
|
||||
krb5_error_code kret;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
GSSAPI_KRB5_INIT(&context);
|
||||
|
||||
if (out_name) {
|
||||
const char *n;
|
||||
|
||||
if (last_out_name) {
|
||||
free(last_out_name);
|
||||
last_out_name = NULL;
|
||||
}
|
||||
|
||||
n = krb5_cc_default_name(context);
|
||||
if (n == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
last_out_name = strdup(n);
|
||||
if (last_out_name == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
*out_name = last_out_name;
|
||||
}
|
||||
|
||||
kret = krb5_cc_set_default_name(context, name);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
+1763
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,67 @@
|
||||
/* $NetBSD: cfx.h,v 1.1.1.2 2011/04/14 14:08:26 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003, PADL Software Pty Ltd.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of PADL Software nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* Id */
|
||||
|
||||
#ifndef GSSAPI_CFX_H_
|
||||
#define GSSAPI_CFX_H_ 1
|
||||
|
||||
/*
|
||||
* Implementation of draft-ietf-krb-wg-gssapi-cfx-01.txt
|
||||
*/
|
||||
|
||||
typedef struct gss_cfx_mic_token_desc_struct {
|
||||
u_char TOK_ID[2]; /* 04 04 */
|
||||
u_char Flags;
|
||||
u_char Filler[5];
|
||||
u_char SND_SEQ[8];
|
||||
} gss_cfx_mic_token_desc, *gss_cfx_mic_token;
|
||||
|
||||
typedef struct gss_cfx_wrap_token_desc_struct {
|
||||
u_char TOK_ID[2]; /* 04 05 */
|
||||
u_char Flags;
|
||||
u_char Filler;
|
||||
u_char EC[2];
|
||||
u_char RRC[2];
|
||||
u_char SND_SEQ[8];
|
||||
} gss_cfx_wrap_token_desc, *gss_cfx_wrap_token;
|
||||
|
||||
typedef struct gss_cfx_delete_token_desc_struct {
|
||||
u_char TOK_ID[2]; /* 05 04 */
|
||||
u_char Flags;
|
||||
u_char Filler[5];
|
||||
u_char SND_SEQ[8];
|
||||
} gss_cfx_delete_token_desc, *gss_cfx_delete_token;
|
||||
|
||||
#endif /* GSSAPI_CFX_H_ */
|
||||
@@ -0,0 +1,55 @@
|
||||
/* $NetBSD: compare_name.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997-2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_compare_name
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_name_t name1,
|
||||
const gss_name_t name2,
|
||||
int * name_equal
|
||||
)
|
||||
{
|
||||
krb5_const_principal princ1 = (krb5_const_principal)name1;
|
||||
krb5_const_principal princ2 = (krb5_const_principal)name2;
|
||||
krb5_context context;
|
||||
|
||||
GSSAPI_KRB5_INIT(&context);
|
||||
|
||||
*name_equal = krb5_principal_compare (context,
|
||||
princ1, princ2);
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,127 @@
|
||||
/* $NetBSD: compat.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003 - 2005 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
static krb5_error_code
|
||||
check_compat(OM_uint32 *minor_status,
|
||||
krb5_context context, krb5_const_principal name,
|
||||
const char *option, krb5_boolean *compat,
|
||||
krb5_boolean match_val)
|
||||
{
|
||||
krb5_error_code ret = 0;
|
||||
char **p, **q;
|
||||
krb5_principal match;
|
||||
|
||||
|
||||
p = krb5_config_get_strings(context, NULL, "gssapi",
|
||||
option, NULL);
|
||||
if(p == NULL)
|
||||
return 0;
|
||||
|
||||
match = NULL;
|
||||
for(q = p; *q; q++) {
|
||||
ret = krb5_parse_name(context, *q, &match);
|
||||
if (ret)
|
||||
break;
|
||||
|
||||
if (krb5_principal_match(context, name, match)) {
|
||||
*compat = match_val;
|
||||
break;
|
||||
}
|
||||
|
||||
krb5_free_principal(context, match);
|
||||
match = NULL;
|
||||
}
|
||||
if (match)
|
||||
krb5_free_principal(context, match);
|
||||
krb5_config_free_strings(p);
|
||||
|
||||
if (ret) {
|
||||
if (minor_status)
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* ctx->ctx_id_mutex is assumed to be locked
|
||||
*/
|
||||
|
||||
OM_uint32
|
||||
_gss_DES3_get_mic_compat(OM_uint32 *minor_status,
|
||||
gsskrb5_ctx ctx,
|
||||
krb5_context context)
|
||||
{
|
||||
krb5_boolean use_compat = FALSE;
|
||||
OM_uint32 ret;
|
||||
|
||||
if ((ctx->more_flags & COMPAT_OLD_DES3_SELECTED) == 0) {
|
||||
ret = check_compat(minor_status, context, ctx->target,
|
||||
"broken_des3_mic", &use_compat, TRUE);
|
||||
if (ret)
|
||||
return ret;
|
||||
ret = check_compat(minor_status, context, ctx->target,
|
||||
"correct_des3_mic", &use_compat, FALSE);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
if (use_compat)
|
||||
ctx->more_flags |= COMPAT_OLD_DES3;
|
||||
ctx->more_flags |= COMPAT_OLD_DES3_SELECTED;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
#if 0
|
||||
OM_uint32
|
||||
gss_krb5_compat_des3_mic(OM_uint32 *minor_status, gss_ctx_id_t ctx, int on)
|
||||
{
|
||||
*minor_status = 0;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
if (on) {
|
||||
ctx->more_flags |= COMPAT_OLD_DES3;
|
||||
} else {
|
||||
ctx->more_flags &= ~COMPAT_OLD_DES3;
|
||||
}
|
||||
ctx->more_flags |= COMPAT_OLD_DES3_SELECTED;
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
|
||||
return 0;
|
||||
}
|
||||
#endif
|
||||
@@ -0,0 +1,95 @@
|
||||
/* $NetBSD: context_time.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_lifetime_left(OM_uint32 *minor_status,
|
||||
krb5_context context,
|
||||
OM_uint32 lifetime,
|
||||
OM_uint32 *lifetime_rec)
|
||||
{
|
||||
krb5_timestamp timeret;
|
||||
krb5_error_code kret;
|
||||
|
||||
if (lifetime == 0) {
|
||||
*lifetime_rec = GSS_C_INDEFINITE;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
kret = krb5_timeofday(context, &timeret);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
if (lifetime < timeret)
|
||||
*lifetime_rec = 0;
|
||||
else
|
||||
*lifetime_rec = lifetime - timeret;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_context_time
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
OM_uint32 * time_rec
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
OM_uint32 lifetime;
|
||||
OM_uint32 major_status;
|
||||
const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
lifetime = ctx->lifetime;
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
|
||||
major_status = _gsskrb5_lifetime_left(minor_status, context,
|
||||
lifetime, time_rec);
|
||||
if (major_status != GSS_S_COMPLETE)
|
||||
return major_status;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
if (*time_rec == 0)
|
||||
return GSS_S_CONTEXT_EXPIRED;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,195 @@
|
||||
/* $NetBSD: copy_ccache.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2000 - 2001, 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
#if 0
|
||||
OM_uint32
|
||||
gss_krb5_copy_ccache(OM_uint32 *minor_status,
|
||||
krb5_context context,
|
||||
gss_cred_id_t cred,
|
||||
krb5_ccache out)
|
||||
{
|
||||
krb5_error_code kret;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&cred->cred_id_mutex);
|
||||
|
||||
if (cred->ccache == NULL) {
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
kret = krb5_cc_copy_cache(context, cred->ccache, out);
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
#endif
|
||||
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_krb5_import_cred(OM_uint32 *minor_status,
|
||||
krb5_ccache id,
|
||||
krb5_principal keytab_principal,
|
||||
krb5_keytab keytab,
|
||||
gss_cred_id_t *cred)
|
||||
{
|
||||
krb5_context context;
|
||||
krb5_error_code kret;
|
||||
gsskrb5_cred handle;
|
||||
OM_uint32 ret;
|
||||
|
||||
*cred = NULL;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
handle = calloc(1, sizeof(*handle));
|
||||
if (handle == NULL) {
|
||||
_gsskrb5_clear_status ();
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
HEIMDAL_MUTEX_init(&handle->cred_id_mutex);
|
||||
|
||||
handle->usage = 0;
|
||||
|
||||
if (id) {
|
||||
char *str;
|
||||
|
||||
handle->usage |= GSS_C_INITIATE;
|
||||
|
||||
kret = krb5_cc_get_principal(context, id,
|
||||
&handle->principal);
|
||||
if (kret) {
|
||||
free(handle);
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
if (keytab_principal) {
|
||||
krb5_boolean match;
|
||||
|
||||
match = krb5_principal_compare(context,
|
||||
handle->principal,
|
||||
keytab_principal);
|
||||
if (match == FALSE) {
|
||||
krb5_free_principal(context, handle->principal);
|
||||
free(handle);
|
||||
_gsskrb5_clear_status ();
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
}
|
||||
|
||||
ret = __gsskrb5_ccache_lifetime(minor_status,
|
||||
context,
|
||||
id,
|
||||
handle->principal,
|
||||
&handle->lifetime);
|
||||
if (ret != GSS_S_COMPLETE) {
|
||||
krb5_free_principal(context, handle->principal);
|
||||
free(handle);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
kret = krb5_cc_get_full_name(context, id, &str);
|
||||
if (kret)
|
||||
goto out;
|
||||
|
||||
kret = krb5_cc_resolve(context, str, &handle->ccache);
|
||||
free(str);
|
||||
if (kret)
|
||||
goto out;
|
||||
}
|
||||
|
||||
|
||||
if (keytab) {
|
||||
char *str;
|
||||
|
||||
handle->usage |= GSS_C_ACCEPT;
|
||||
|
||||
if (keytab_principal && handle->principal == NULL) {
|
||||
kret = krb5_copy_principal(context,
|
||||
keytab_principal,
|
||||
&handle->principal);
|
||||
if (kret)
|
||||
goto out;
|
||||
}
|
||||
|
||||
kret = krb5_kt_get_full_name(context, keytab, &str);
|
||||
if (kret)
|
||||
goto out;
|
||||
|
||||
kret = krb5_kt_resolve(context, str, &handle->keytab);
|
||||
free(str);
|
||||
if (kret)
|
||||
goto out;
|
||||
}
|
||||
|
||||
|
||||
if (id || keytab) {
|
||||
ret = gss_create_empty_oid_set(minor_status, &handle->mechanisms);
|
||||
if (ret == GSS_S_COMPLETE)
|
||||
ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
|
||||
&handle->mechanisms);
|
||||
if (ret != GSS_S_COMPLETE) {
|
||||
kret = *minor_status;
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
|
||||
*minor_status = 0;
|
||||
*cred = (gss_cred_id_t)handle;
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
out:
|
||||
gss_release_oid_set(minor_status, &handle->mechanisms);
|
||||
if (handle->ccache)
|
||||
krb5_cc_close(context, handle->ccache);
|
||||
if (handle->keytab)
|
||||
krb5_kt_close(context, handle->keytab);
|
||||
if (handle->principal)
|
||||
krb5_free_principal(context, handle->principal);
|
||||
HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
|
||||
free(handle);
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
@@ -0,0 +1,257 @@
|
||||
/* $NetBSD: creds.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2009 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_export_cred(OM_uint32 *minor_status,
|
||||
gss_cred_id_t cred_handle,
|
||||
gss_buffer_t cred_token)
|
||||
{
|
||||
gsskrb5_cred handle = (gsskrb5_cred)cred_handle;
|
||||
krb5_context context;
|
||||
krb5_error_code ret;
|
||||
krb5_storage *sp;
|
||||
krb5_data data, mech;
|
||||
const char *type;
|
||||
char *str;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (handle->usage != GSS_C_INITIATE && handle->usage != GSS_C_BOTH) {
|
||||
*minor_status = GSS_KRB5_S_G_BAD_USAGE;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
sp = krb5_storage_emem();
|
||||
if (sp == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
type = krb5_cc_get_type(context, handle->ccache);
|
||||
if (strcmp(type, "MEMORY") == 0) {
|
||||
krb5_creds *creds;
|
||||
ret = krb5_store_uint32(sp, 0);
|
||||
if (ret) {
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = _krb5_get_krbtgt(context, handle->ccache,
|
||||
handle->principal->realm,
|
||||
&creds);
|
||||
if (ret) {
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_store_creds(sp, creds);
|
||||
krb5_free_creds(context, creds);
|
||||
if (ret) {
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
} else {
|
||||
ret = krb5_store_uint32(sp, 1);
|
||||
if (ret) {
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_cc_get_full_name(context, handle->ccache, &str);
|
||||
if (ret) {
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_store_string(sp, str);
|
||||
free(str);
|
||||
if (ret) {
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
}
|
||||
ret = krb5_storage_to_data(sp, &data);
|
||||
krb5_storage_free(sp);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
sp = krb5_storage_emem();
|
||||
if (sp == NULL) {
|
||||
krb5_data_free(&data);
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
mech.data = GSS_KRB5_MECHANISM->elements;
|
||||
mech.length = GSS_KRB5_MECHANISM->length;
|
||||
|
||||
ret = krb5_store_data(sp, mech);
|
||||
if (ret) {
|
||||
krb5_data_free(&data);
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_store_data(sp, data);
|
||||
krb5_data_free(&data);
|
||||
if (ret) {
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_storage_to_data(sp, &data);
|
||||
krb5_storage_free(sp);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
cred_token->value = data.data;
|
||||
cred_token->length = data.length;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_import_cred(OM_uint32 * minor_status,
|
||||
gss_buffer_t cred_token,
|
||||
gss_cred_id_t * cred_handle)
|
||||
{
|
||||
krb5_context context;
|
||||
krb5_error_code ret;
|
||||
gsskrb5_cred handle;
|
||||
krb5_ccache id;
|
||||
krb5_storage *sp;
|
||||
char *str;
|
||||
uint32_t type;
|
||||
int flags = 0;
|
||||
|
||||
*cred_handle = GSS_C_NO_CREDENTIAL;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
sp = krb5_storage_from_mem(cred_token->value, cred_token->length);
|
||||
if (sp == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_ret_uint32(sp, &type);
|
||||
if (ret) {
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
switch (type) {
|
||||
case 0: {
|
||||
krb5_creds creds;
|
||||
|
||||
ret = krb5_ret_creds(sp, &creds);
|
||||
krb5_storage_free(sp);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_cc_new_unique(context, "MEMORY", NULL, &id);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_cc_initialize(context, id, creds.client);
|
||||
if (ret) {
|
||||
krb5_cc_destroy(context, id);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_cc_store_cred(context, id, &creds);
|
||||
krb5_free_cred_contents(context, &creds);
|
||||
|
||||
flags |= GSS_CF_DESTROY_CRED_ON_RELEASE;
|
||||
|
||||
break;
|
||||
}
|
||||
case 1:
|
||||
ret = krb5_ret_string(sp, &str);
|
||||
krb5_storage_free(sp);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_cc_resolve(context, str, &id);
|
||||
krb5_xfree(str);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
break;
|
||||
|
||||
default:
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = 0;
|
||||
return GSS_S_NO_CRED;
|
||||
}
|
||||
|
||||
handle = calloc(1, sizeof(*handle));
|
||||
if (handle == NULL) {
|
||||
krb5_cc_close(context, id);
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
handle->usage = GSS_C_INITIATE;
|
||||
krb5_cc_get_principal(context, id, &handle->principal);
|
||||
handle->ccache = id;
|
||||
handle->cred_flags = flags;
|
||||
|
||||
*cred_handle = (gss_cred_id_t)handle;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,209 @@
|
||||
/* $NetBSD: decapsulate.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
/*
|
||||
* return the length of the mechanism in token or -1
|
||||
* (which implies that the token was bad - GSS_S_DEFECTIVE_TOKEN
|
||||
*/
|
||||
|
||||
ssize_t
|
||||
_gsskrb5_get_mech (const u_char *ptr,
|
||||
size_t total_len,
|
||||
const u_char **mech_ret)
|
||||
{
|
||||
size_t len, len_len, mech_len, foo;
|
||||
const u_char *p = ptr;
|
||||
int e;
|
||||
|
||||
if (total_len < 1)
|
||||
return -1;
|
||||
if (*p++ != 0x60)
|
||||
return -1;
|
||||
e = der_get_length (p, total_len - 1, &len, &len_len);
|
||||
if (e || 1 + len_len + len != total_len)
|
||||
return -1;
|
||||
p += len_len;
|
||||
if (*p++ != 0x06)
|
||||
return -1;
|
||||
e = der_get_length (p, total_len - 1 - len_len - 1,
|
||||
&mech_len, &foo);
|
||||
if (e)
|
||||
return -1;
|
||||
p += foo;
|
||||
*mech_ret = p;
|
||||
return mech_len;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gssapi_verify_mech_header(u_char **str,
|
||||
size_t total_len,
|
||||
gss_OID mech)
|
||||
{
|
||||
const u_char *p;
|
||||
ssize_t mech_len;
|
||||
|
||||
mech_len = _gsskrb5_get_mech (*str, total_len, &p);
|
||||
if (mech_len < 0)
|
||||
return GSS_S_DEFECTIVE_TOKEN;
|
||||
|
||||
if (mech_len != mech->length)
|
||||
return GSS_S_BAD_MECH;
|
||||
if (ct_memcmp(p,
|
||||
mech->elements,
|
||||
mech->length) != 0)
|
||||
return GSS_S_BAD_MECH;
|
||||
p += mech_len;
|
||||
*str = rk_UNCONST(p);
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_verify_header(u_char **str,
|
||||
size_t total_len,
|
||||
const void *type,
|
||||
gss_OID oid)
|
||||
{
|
||||
OM_uint32 ret;
|
||||
size_t len;
|
||||
u_char *p = *str;
|
||||
|
||||
ret = _gssapi_verify_mech_header(str, total_len, oid);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
len = total_len - (*str - p);
|
||||
|
||||
if (len < 2)
|
||||
return GSS_S_DEFECTIVE_TOKEN;
|
||||
|
||||
if (ct_memcmp (*str, type, 2) != 0)
|
||||
return GSS_S_DEFECTIVE_TOKEN;
|
||||
*str += 2;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Remove the GSS-API wrapping from `in_token' giving `out_data.
|
||||
* Does not copy data, so just free `in_token'.
|
||||
*/
|
||||
|
||||
OM_uint32
|
||||
_gssapi_decapsulate(
|
||||
OM_uint32 *minor_status,
|
||||
gss_buffer_t input_token_buffer,
|
||||
krb5_data *out_data,
|
||||
const gss_OID mech
|
||||
)
|
||||
{
|
||||
u_char *p;
|
||||
OM_uint32 ret;
|
||||
|
||||
p = input_token_buffer->value;
|
||||
ret = _gssapi_verify_mech_header(&p,
|
||||
input_token_buffer->length,
|
||||
mech);
|
||||
if (ret) {
|
||||
*minor_status = 0;
|
||||
return ret;
|
||||
}
|
||||
|
||||
out_data->length = input_token_buffer->length -
|
||||
(p - (u_char *)input_token_buffer->value);
|
||||
out_data->data = p;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
/*
|
||||
* Remove the GSS-API wrapping from `in_token' giving `out_data.
|
||||
* Does not copy data, so just free `in_token'.
|
||||
*/
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_decapsulate(OM_uint32 *minor_status,
|
||||
gss_buffer_t input_token_buffer,
|
||||
krb5_data *out_data,
|
||||
const void *type,
|
||||
gss_OID oid)
|
||||
{
|
||||
u_char *p;
|
||||
OM_uint32 ret;
|
||||
|
||||
p = input_token_buffer->value;
|
||||
ret = _gsskrb5_verify_header(&p,
|
||||
input_token_buffer->length,
|
||||
type,
|
||||
oid);
|
||||
if (ret) {
|
||||
*minor_status = 0;
|
||||
return ret;
|
||||
}
|
||||
|
||||
out_data->length = input_token_buffer->length -
|
||||
(p - (u_char *)input_token_buffer->value);
|
||||
out_data->data = p;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
/*
|
||||
* Verify padding of a gss wrapped message and return its length.
|
||||
*/
|
||||
|
||||
OM_uint32
|
||||
_gssapi_verify_pad(gss_buffer_t wrapped_token,
|
||||
size_t datalen,
|
||||
size_t *padlen)
|
||||
{
|
||||
u_char *pad;
|
||||
size_t padlength;
|
||||
int i;
|
||||
|
||||
pad = (u_char *)wrapped_token->value + wrapped_token->length - 1;
|
||||
padlength = *pad;
|
||||
|
||||
if (padlength > datalen)
|
||||
return GSS_S_BAD_MECH;
|
||||
|
||||
for (i = padlength; i > 0 && *pad == padlength; i--, pad--)
|
||||
;
|
||||
if (i != 0)
|
||||
return GSS_S_BAD_MIC;
|
||||
|
||||
*padlen = padlength;
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,86 @@
|
||||
/* $NetBSD: delete_sec_context.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_delete_sec_context(OM_uint32 * minor_status,
|
||||
gss_ctx_id_t * context_handle,
|
||||
gss_buffer_t output_token)
|
||||
{
|
||||
krb5_context context;
|
||||
gsskrb5_ctx ctx;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
if (output_token) {
|
||||
output_token->length = 0;
|
||||
output_token->value = NULL;
|
||||
}
|
||||
|
||||
if (*context_handle == GSS_C_NO_CONTEXT)
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
ctx = (gsskrb5_ctx) *context_handle;
|
||||
*context_handle = GSS_C_NO_CONTEXT;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
|
||||
krb5_auth_con_free (context, ctx->auth_context);
|
||||
krb5_auth_con_free (context, ctx->deleg_auth_context);
|
||||
if (ctx->kcred)
|
||||
krb5_free_creds(context, ctx->kcred);
|
||||
if(ctx->source)
|
||||
krb5_free_principal (context, ctx->source);
|
||||
if(ctx->target)
|
||||
krb5_free_principal (context, ctx->target);
|
||||
if (ctx->ticket)
|
||||
krb5_free_ticket (context, ctx->ticket);
|
||||
if(ctx->order)
|
||||
_gssapi_msg_order_destroy(&ctx->order);
|
||||
if (ctx->service_keyblock)
|
||||
krb5_free_keyblock (context, ctx->service_keyblock);
|
||||
krb5_data_free(&ctx->fwd_data);
|
||||
if (ctx->crypto)
|
||||
krb5_crypto_destroy(context, ctx->crypto);
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
HEIMDAL_MUTEX_destroy(&ctx->ctx_id_mutex);
|
||||
memset(ctx, 0, sizeof(*ctx));
|
||||
free (ctx);
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,74 @@
|
||||
/* $NetBSD: display_name.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_display_name
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_name_t input_name,
|
||||
gss_buffer_t output_name_buffer,
|
||||
gss_OID * output_name_type
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
krb5_const_principal name = (krb5_const_principal)input_name;
|
||||
krb5_error_code kret;
|
||||
char *buf;
|
||||
size_t len;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
kret = krb5_unparse_name_flags (context, name,
|
||||
KRB5_PRINCIPAL_UNPARSE_DISPLAY, &buf);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
len = strlen (buf);
|
||||
output_name_buffer->length = len;
|
||||
output_name_buffer->value = malloc(len + 1);
|
||||
if (output_name_buffer->value == NULL) {
|
||||
free (buf);
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
memcpy (output_name_buffer->value, buf, len);
|
||||
((char *)output_name_buffer->value)[len] = '\0';
|
||||
free (buf);
|
||||
if (output_name_type)
|
||||
*output_name_type = GSS_KRB5_NT_PRINCIPAL_NAME;
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,201 @@
|
||||
/* $NetBSD: display_status.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1998 - 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
static const char *
|
||||
calling_error(OM_uint32 v)
|
||||
{
|
||||
static const char *msgs[] = {
|
||||
NULL, /* 0 */
|
||||
"A required input parameter could not be read.", /* */
|
||||
"A required output parameter could not be written.", /* */
|
||||
"A parameter was malformed"
|
||||
};
|
||||
|
||||
v >>= GSS_C_CALLING_ERROR_OFFSET;
|
||||
|
||||
if (v == 0)
|
||||
return "";
|
||||
else if (v >= sizeof(msgs)/sizeof(*msgs))
|
||||
return "unknown calling error";
|
||||
else
|
||||
return msgs[v];
|
||||
}
|
||||
|
||||
static const char *
|
||||
routine_error(OM_uint32 v)
|
||||
{
|
||||
static const char *msgs[] = {
|
||||
NULL, /* 0 */
|
||||
"An unsupported mechanism was requested",
|
||||
"An invalid name was supplied",
|
||||
"A supplied name was of an unsupported type",
|
||||
"Incorrect channel bindings were supplied",
|
||||
"An invalid status code was supplied",
|
||||
"A token had an invalid MIC",
|
||||
"No credentials were supplied, "
|
||||
"or the credentials were unavailable or inaccessible.",
|
||||
"No context has been established",
|
||||
"A token was invalid",
|
||||
"A credential was invalid",
|
||||
"The referenced credentials have expired",
|
||||
"The context has expired",
|
||||
"Miscellaneous failure (see text)",
|
||||
"The quality-of-protection requested could not be provide",
|
||||
"The operation is forbidden by local security policy",
|
||||
"The operation or option is not available",
|
||||
"The requested credential element already exists",
|
||||
"The provided name was not a mechanism name.",
|
||||
};
|
||||
|
||||
v >>= GSS_C_ROUTINE_ERROR_OFFSET;
|
||||
|
||||
if (v == 0)
|
||||
return "";
|
||||
else if (v >= sizeof(msgs)/sizeof(*msgs))
|
||||
return "unknown routine error";
|
||||
else
|
||||
return msgs[v];
|
||||
}
|
||||
|
||||
static const char *
|
||||
supplementary_error(OM_uint32 v)
|
||||
{
|
||||
static const char *msgs[] = {
|
||||
"normal completion",
|
||||
"continuation call to routine required",
|
||||
"duplicate per-message token detected",
|
||||
"timed-out per-message token detected",
|
||||
"reordered (early) per-message token detected",
|
||||
"skipped predecessor token(s) detected"
|
||||
};
|
||||
|
||||
v >>= GSS_C_SUPPLEMENTARY_OFFSET;
|
||||
|
||||
if (v >= sizeof(msgs)/sizeof(*msgs))
|
||||
return "unknown routine error";
|
||||
else
|
||||
return msgs[v];
|
||||
}
|
||||
|
||||
void
|
||||
_gsskrb5_clear_status (void)
|
||||
{
|
||||
krb5_context context;
|
||||
|
||||
if (_gsskrb5_init (&context) != 0)
|
||||
return;
|
||||
krb5_clear_error_message(context);
|
||||
}
|
||||
|
||||
void
|
||||
_gsskrb5_set_status (int ret, const char *fmt, ...)
|
||||
{
|
||||
krb5_context context;
|
||||
va_list args;
|
||||
char *str;
|
||||
int e;
|
||||
|
||||
if (_gsskrb5_init (&context) != 0)
|
||||
return;
|
||||
|
||||
va_start(args, fmt);
|
||||
e = vasprintf(&str, fmt, args);
|
||||
va_end(args);
|
||||
if (e >= 0 && str) {
|
||||
krb5_set_error_message(context, ret, "%s", str);
|
||||
free(str);
|
||||
}
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_display_status
|
||||
(OM_uint32 *minor_status,
|
||||
OM_uint32 status_value,
|
||||
int status_type,
|
||||
const gss_OID mech_type,
|
||||
OM_uint32 *message_context,
|
||||
gss_buffer_t status_string)
|
||||
{
|
||||
krb5_context context;
|
||||
char *buf = NULL;
|
||||
int e = 0;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
status_string->length = 0;
|
||||
status_string->value = NULL;
|
||||
|
||||
if (gss_oid_equal(mech_type, GSS_C_NO_OID) == 0 &&
|
||||
gss_oid_equal(mech_type, GSS_KRB5_MECHANISM) == 0) {
|
||||
*minor_status = 0;
|
||||
return GSS_C_GSS_CODE;
|
||||
}
|
||||
|
||||
if (status_type == GSS_C_GSS_CODE) {
|
||||
if (GSS_SUPPLEMENTARY_INFO(status_value))
|
||||
e = asprintf(&buf, "%s",
|
||||
supplementary_error(GSS_SUPPLEMENTARY_INFO(status_value)));
|
||||
else
|
||||
e = asprintf (&buf, "%s %s",
|
||||
calling_error(GSS_CALLING_ERROR(status_value)),
|
||||
routine_error(GSS_ROUTINE_ERROR(status_value)));
|
||||
} else if (status_type == GSS_C_MECH_CODE) {
|
||||
const char *buf2 = krb5_get_error_message(context, status_value);
|
||||
if (buf2) {
|
||||
buf = strdup(buf2);
|
||||
krb5_free_error_message(context, buf2);
|
||||
} else {
|
||||
e = asprintf(&buf, "unknown mech error-code %u",
|
||||
(unsigned)status_value);
|
||||
}
|
||||
} else {
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_BAD_STATUS;
|
||||
}
|
||||
|
||||
if (e < 0 || buf == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
*message_context = 0;
|
||||
*minor_status = 0;
|
||||
|
||||
status_string->length = strlen(buf);
|
||||
status_string->value = buf;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
/* $NetBSD: duplicate_name.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_duplicate_name (
|
||||
OM_uint32 * minor_status,
|
||||
const gss_name_t src_name,
|
||||
gss_name_t * dest_name
|
||||
)
|
||||
{
|
||||
krb5_const_principal src = (krb5_const_principal)src_name;
|
||||
krb5_context context;
|
||||
krb5_principal dest;
|
||||
krb5_error_code kret;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
kret = krb5_copy_principal (context, src, &dest);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
} else {
|
||||
*dest_name = (gss_name_t)dest;
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,155 @@
|
||||
/* $NetBSD: encapsulate.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
void
|
||||
_gssapi_encap_length (size_t data_len,
|
||||
size_t *len,
|
||||
size_t *total_len,
|
||||
const gss_OID mech)
|
||||
{
|
||||
size_t len_len;
|
||||
|
||||
*len = 1 + 1 + mech->length + data_len;
|
||||
|
||||
len_len = der_length_len(*len);
|
||||
|
||||
*total_len = 1 + len_len + *len;
|
||||
}
|
||||
|
||||
void
|
||||
_gsskrb5_encap_length (size_t data_len,
|
||||
size_t *len,
|
||||
size_t *total_len,
|
||||
const gss_OID mech)
|
||||
{
|
||||
_gssapi_encap_length(data_len + 2, len, total_len, mech);
|
||||
}
|
||||
|
||||
void *
|
||||
_gsskrb5_make_header (void *ptr,
|
||||
size_t len,
|
||||
const void *type,
|
||||
const gss_OID mech)
|
||||
{
|
||||
u_char *p = ptr;
|
||||
p = _gssapi_make_mech_header(p, len, mech);
|
||||
memcpy (p, type, 2);
|
||||
p += 2;
|
||||
return p;
|
||||
}
|
||||
|
||||
void *
|
||||
_gssapi_make_mech_header(void *ptr,
|
||||
size_t len,
|
||||
const gss_OID mech)
|
||||
{
|
||||
u_char *p = ptr;
|
||||
int e;
|
||||
size_t len_len, foo;
|
||||
|
||||
*p++ = 0x60;
|
||||
len_len = der_length_len(len);
|
||||
e = der_put_length (p + len_len - 1, len_len, len, &foo);
|
||||
if(e || foo != len_len)
|
||||
abort ();
|
||||
p += len_len;
|
||||
*p++ = 0x06;
|
||||
*p++ = mech->length;
|
||||
memcpy (p, mech->elements, mech->length);
|
||||
p += mech->length;
|
||||
return p;
|
||||
}
|
||||
|
||||
/*
|
||||
* Give it a krb5_data and it will encapsulate with extra GSS-API wrappings.
|
||||
*/
|
||||
|
||||
OM_uint32
|
||||
_gssapi_encapsulate(
|
||||
OM_uint32 *minor_status,
|
||||
const krb5_data *in_data,
|
||||
gss_buffer_t output_token,
|
||||
const gss_OID mech
|
||||
)
|
||||
{
|
||||
size_t len, outer_len;
|
||||
void *p;
|
||||
|
||||
_gssapi_encap_length (in_data->length, &len, &outer_len, mech);
|
||||
|
||||
output_token->length = outer_len;
|
||||
output_token->value = malloc (outer_len);
|
||||
if (output_token->value == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
p = _gssapi_make_mech_header (output_token->value, len, mech);
|
||||
memcpy (p, in_data->data, in_data->length);
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
/*
|
||||
* Give it a krb5_data and it will encapsulate with extra GSS-API krb5
|
||||
* wrappings.
|
||||
*/
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_encapsulate(
|
||||
OM_uint32 *minor_status,
|
||||
const krb5_data *in_data,
|
||||
gss_buffer_t output_token,
|
||||
const void *type,
|
||||
const gss_OID mech
|
||||
)
|
||||
{
|
||||
size_t len, outer_len;
|
||||
u_char *p;
|
||||
|
||||
_gsskrb5_encap_length (in_data->length, &len, &outer_len, mech);
|
||||
|
||||
output_token->length = outer_len;
|
||||
output_token->value = malloc (outer_len);
|
||||
if (output_token->value == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
p = _gsskrb5_make_header (output_token->value, len, type, mech);
|
||||
memcpy (p, in_data->data, in_data->length);
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,94 @@
|
||||
/* $NetBSD: export_name.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997, 1999, 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_export_name
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_name_t input_name,
|
||||
gss_buffer_t exported_name
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
krb5_const_principal princ = (krb5_const_principal)input_name;
|
||||
krb5_error_code kret;
|
||||
char *buf, *name;
|
||||
size_t len;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
kret = krb5_unparse_name (context, princ, &name);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
len = strlen (name);
|
||||
|
||||
exported_name->length = 10 + len + GSS_KRB5_MECHANISM->length;
|
||||
exported_name->value = malloc(exported_name->length);
|
||||
if (exported_name->value == NULL) {
|
||||
free (name);
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
/* TOK, MECH_OID_LEN, DER(MECH_OID), NAME_LEN, NAME */
|
||||
|
||||
buf = exported_name->value;
|
||||
memcpy(buf, "\x04\x01", 2);
|
||||
buf += 2;
|
||||
buf[0] = ((GSS_KRB5_MECHANISM->length + 2) >> 8) & 0xff;
|
||||
buf[1] = (GSS_KRB5_MECHANISM->length + 2) & 0xff;
|
||||
buf+= 2;
|
||||
buf[0] = 0x06;
|
||||
buf[1] = (GSS_KRB5_MECHANISM->length) & 0xFF;
|
||||
buf+= 2;
|
||||
|
||||
memcpy(buf, GSS_KRB5_MECHANISM->elements, GSS_KRB5_MECHANISM->length);
|
||||
buf += GSS_KRB5_MECHANISM->length;
|
||||
|
||||
buf[0] = (len >> 24) & 0xff;
|
||||
buf[1] = (len >> 16) & 0xff;
|
||||
buf[2] = (len >> 8) & 0xff;
|
||||
buf[3] = (len) & 0xff;
|
||||
buf += 4;
|
||||
|
||||
memcpy (buf, name, len);
|
||||
|
||||
free (name);
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,240 @@
|
||||
/* $NetBSD: export_sec_context.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_export_sec_context (
|
||||
OM_uint32 * minor_status,
|
||||
gss_ctx_id_t * context_handle,
|
||||
gss_buffer_t interprocess_token
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
const gsskrb5_ctx ctx = (const gsskrb5_ctx) *context_handle;
|
||||
krb5_storage *sp;
|
||||
krb5_auth_context ac;
|
||||
OM_uint32 ret = GSS_S_COMPLETE;
|
||||
krb5_data data;
|
||||
gss_buffer_desc buffer;
|
||||
int flags;
|
||||
OM_uint32 minor;
|
||||
krb5_error_code kret;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
|
||||
if (!(ctx->flags & GSS_C_TRANS_FLAG)) {
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
*minor_status = 0;
|
||||
return GSS_S_UNAVAILABLE;
|
||||
}
|
||||
|
||||
sp = krb5_storage_emem ();
|
||||
if (sp == NULL) {
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
ac = ctx->auth_context;
|
||||
|
||||
/* flagging included fields */
|
||||
|
||||
flags = 0;
|
||||
if (ac->local_address)
|
||||
flags |= SC_LOCAL_ADDRESS;
|
||||
if (ac->remote_address)
|
||||
flags |= SC_REMOTE_ADDRESS;
|
||||
if (ac->keyblock)
|
||||
flags |= SC_KEYBLOCK;
|
||||
if (ac->local_subkey)
|
||||
flags |= SC_LOCAL_SUBKEY;
|
||||
if (ac->remote_subkey)
|
||||
flags |= SC_REMOTE_SUBKEY;
|
||||
|
||||
kret = krb5_store_int32 (sp, flags);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
/* marshall auth context */
|
||||
|
||||
kret = krb5_store_int32 (sp, ac->flags);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
if (ac->local_address) {
|
||||
kret = krb5_store_address (sp, *ac->local_address);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
}
|
||||
if (ac->remote_address) {
|
||||
kret = krb5_store_address (sp, *ac->remote_address);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
}
|
||||
kret = krb5_store_int16 (sp, ac->local_port);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
kret = krb5_store_int16 (sp, ac->remote_port);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
if (ac->keyblock) {
|
||||
kret = krb5_store_keyblock (sp, *ac->keyblock);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
}
|
||||
if (ac->local_subkey) {
|
||||
kret = krb5_store_keyblock (sp, *ac->local_subkey);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
}
|
||||
if (ac->remote_subkey) {
|
||||
kret = krb5_store_keyblock (sp, *ac->remote_subkey);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
}
|
||||
kret = krb5_store_int32 (sp, ac->local_seqnumber);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
kret = krb5_store_int32 (sp, ac->remote_seqnumber);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
kret = krb5_store_int32 (sp, ac->keytype);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
kret = krb5_store_int32 (sp, ac->cksumtype);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
/* names */
|
||||
|
||||
ret = _gsskrb5_export_name (minor_status,
|
||||
(gss_name_t)ctx->source, &buffer);
|
||||
if (ret)
|
||||
goto failure;
|
||||
data.data = buffer.value;
|
||||
data.length = buffer.length;
|
||||
kret = krb5_store_data (sp, data);
|
||||
_gsskrb5_release_buffer (&minor, &buffer);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
ret = _gsskrb5_export_name (minor_status,
|
||||
(gss_name_t)ctx->target, &buffer);
|
||||
if (ret)
|
||||
goto failure;
|
||||
data.data = buffer.value;
|
||||
data.length = buffer.length;
|
||||
|
||||
ret = GSS_S_FAILURE;
|
||||
|
||||
kret = krb5_store_data (sp, data);
|
||||
_gsskrb5_release_buffer (&minor, &buffer);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
kret = krb5_store_int32 (sp, ctx->flags);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
kret = krb5_store_int32 (sp, ctx->more_flags);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
kret = krb5_store_int32 (sp, ctx->lifetime);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
kret = _gssapi_msg_order_export(sp, ctx->order);
|
||||
if (kret ) {
|
||||
*minor_status = kret;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
kret = krb5_storage_to_data (sp, &data);
|
||||
krb5_storage_free (sp);
|
||||
if (kret) {
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
interprocess_token->length = data.length;
|
||||
interprocess_token->value = data.data;
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
ret = _gsskrb5_delete_sec_context (minor_status, context_handle,
|
||||
GSS_C_NO_BUFFER);
|
||||
if (ret != GSS_S_COMPLETE)
|
||||
_gsskrb5_release_buffer (NULL, interprocess_token);
|
||||
*minor_status = 0;
|
||||
return ret;
|
||||
failure:
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
krb5_storage_free (sp);
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,335 @@
|
||||
/* $NetBSD: external.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
#include <gssapi_mech.h>
|
||||
|
||||
/*
|
||||
* The implementation must reserve static storage for a
|
||||
* gss_OID_desc object containing the value
|
||||
* {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
|
||||
* "\x01\x02\x01\x01"},
|
||||
* corresponding to an object-identifier value of
|
||||
* {iso(1) member-body(2) United States(840) mit(113554)
|
||||
* infosys(1) gssapi(2) generic(1) user_name(1)}. The constant
|
||||
* GSS_C_NT_USER_NAME should be initialized to point
|
||||
* to that gss_OID_desc.
|
||||
*/
|
||||
|
||||
gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_nt_user_name_oid_desc =
|
||||
{10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x01")};
|
||||
|
||||
/*
|
||||
* The implementation must reserve static storage for a
|
||||
* gss_OID_desc object containing the value
|
||||
* {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
|
||||
* "\x01\x02\x01\x02"},
|
||||
* corresponding to an object-identifier value of
|
||||
* {iso(1) member-body(2) United States(840) mit(113554)
|
||||
* infosys(1) gssapi(2) generic(1) machine_uid_name(2)}.
|
||||
* The constant GSS_C_NT_MACHINE_UID_NAME should be
|
||||
* initialized to point to that gss_OID_desc.
|
||||
*/
|
||||
|
||||
gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_nt_machine_uid_name_oid_desc =
|
||||
{10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x02")};
|
||||
|
||||
/*
|
||||
* The implementation must reserve static storage for a
|
||||
* gss_OID_desc object containing the value
|
||||
* {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
|
||||
* "\x01\x02\x01\x03"},
|
||||
* corresponding to an object-identifier value of
|
||||
* {iso(1) member-body(2) United States(840) mit(113554)
|
||||
* infosys(1) gssapi(2) generic(1) string_uid_name(3)}.
|
||||
* The constant GSS_C_NT_STRING_UID_NAME should be
|
||||
* initialized to point to that gss_OID_desc.
|
||||
*/
|
||||
|
||||
gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_nt_string_uid_name_oid_desc =
|
||||
{10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x03")};
|
||||
|
||||
/*
|
||||
* The implementation must reserve static storage for a
|
||||
* gss_OID_desc object containing the value
|
||||
* {6, (void *)"\x2b\x06\x01\x05\x06\x02"},
|
||||
* corresponding to an object-identifier value of
|
||||
* {iso(1) org(3) dod(6) internet(1) security(5)
|
||||
* nametypes(6) gss-host-based-services(2)). The constant
|
||||
* GSS_C_NT_HOSTBASED_SERVICE_X should be initialized to point
|
||||
* to that gss_OID_desc. This is a deprecated OID value, and
|
||||
* implementations wishing to support hostbased-service names
|
||||
* should instead use the GSS_C_NT_HOSTBASED_SERVICE OID,
|
||||
* defined below, to identify such names;
|
||||
* GSS_C_NT_HOSTBASED_SERVICE_X should be accepted a synonym
|
||||
* for GSS_C_NT_HOSTBASED_SERVICE when presented as an input
|
||||
* parameter, but should not be emitted by GSS-API
|
||||
* implementations
|
||||
*/
|
||||
|
||||
gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_nt_hostbased_service_x_oid_desc =
|
||||
{6, rk_UNCONST("\x2b\x06\x01\x05\x06\x02")};
|
||||
|
||||
/*
|
||||
* The implementation must reserve static storage for a
|
||||
* gss_OID_desc object containing the value
|
||||
* {10, (void *)"\x2a\x86\x48\x86\xf7\x12"
|
||||
* "\x01\x02\x01\x04"}, corresponding to an
|
||||
* object-identifier value of {iso(1) member-body(2)
|
||||
* Unites States(840) mit(113554) infosys(1) gssapi(2)
|
||||
* generic(1) service_name(4)}. The constant
|
||||
* GSS_C_NT_HOSTBASED_SERVICE should be initialized
|
||||
* to point to that gss_OID_desc.
|
||||
*/
|
||||
gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_nt_hostbased_service_oid_desc =
|
||||
{10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12" "\x01\x02\x01\x04")};
|
||||
|
||||
/*
|
||||
* The implementation must reserve static storage for a
|
||||
* gss_OID_desc object containing the value
|
||||
* {6, (void *)"\x2b\x06\01\x05\x06\x03"},
|
||||
* corresponding to an object identifier value of
|
||||
* {1(iso), 3(org), 6(dod), 1(internet), 5(security),
|
||||
* 6(nametypes), 3(gss-anonymous-name)}. The constant
|
||||
* and GSS_C_NT_ANONYMOUS should be initialized to point
|
||||
* to that gss_OID_desc.
|
||||
*/
|
||||
|
||||
gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_nt_anonymous_oid_desc =
|
||||
{6, rk_UNCONST("\x2b\x06\01\x05\x06\x03")};
|
||||
|
||||
/*
|
||||
* The implementation must reserve static storage for a
|
||||
* gss_OID_desc object containing the value
|
||||
* {6, (void *)"\x2b\x06\x01\x05\x06\x04"},
|
||||
* corresponding to an object-identifier value of
|
||||
* {1(iso), 3(org), 6(dod), 1(internet), 5(security),
|
||||
* 6(nametypes), 4(gss-api-exported-name)}. The constant
|
||||
* GSS_C_NT_EXPORT_NAME should be initialized to point
|
||||
* to that gss_OID_desc.
|
||||
*/
|
||||
|
||||
gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_nt_export_name_oid_desc =
|
||||
{6, rk_UNCONST("\x2b\x06\x01\x05\x06\x04") };
|
||||
|
||||
/*
|
||||
* This name form shall be represented by the Object Identifier {iso(1)
|
||||
* member-body(2) United States(840) mit(113554) infosys(1) gssapi(2)
|
||||
* krb5(2) krb5_name(1)}. The recommended symbolic name for this type
|
||||
* is "GSS_KRB5_NT_PRINCIPAL_NAME".
|
||||
*/
|
||||
|
||||
gss_OID_desc GSSAPI_LIB_VARIABLE __gss_krb5_nt_principal_name_oid_desc =
|
||||
{10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x01") };
|
||||
|
||||
/*
|
||||
* draft-ietf-cat-iakerb-09, IAKERB:
|
||||
* The mechanism ID for IAKERB proxy GSS-API Kerberos, in accordance
|
||||
* with the mechanism proposed by SPNEGO [7] for negotiating protocol
|
||||
* variations, is: {iso(1) org(3) dod(6) internet(1) security(5)
|
||||
* mechanisms(5) iakerb(10) iakerbProxyProtocol(1)}. The proposed
|
||||
* mechanism ID for IAKERB minimum messages GSS-API Kerberos, in
|
||||
* accordance with the mechanism proposed by SPNEGO for negotiating
|
||||
* protocol variations, is: {iso(1) org(3) dod(6) internet(1)
|
||||
* security(5) mechanisms(5) iakerb(10)
|
||||
* iakerbMinimumMessagesProtocol(2)}.
|
||||
*/
|
||||
|
||||
gss_OID_desc GSSAPI_LIB_VARIABLE __gss_iakerb_proxy_mechanism_oid_desc =
|
||||
{7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0a\x01")};
|
||||
|
||||
gss_OID_desc GSSAPI_LIB_VARIABLE __gss_iakerb_min_msg_mechanism_oid_desc =
|
||||
{7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0a\x02") };
|
||||
|
||||
/*
|
||||
* Context for krb5 calls.
|
||||
*/
|
||||
|
||||
static gss_mo_desc krb5_mo[] = {
|
||||
{
|
||||
GSS_C_MA_SASL_MECH_NAME,
|
||||
GSS_MO_MA,
|
||||
"SASL mech name",
|
||||
"GS2-KRB5",
|
||||
_gss_mo_get_ctx_as_string,
|
||||
NULL
|
||||
},
|
||||
{
|
||||
GSS_C_MA_MECH_NAME,
|
||||
GSS_MO_MA,
|
||||
"Mechanism name",
|
||||
"KRB5",
|
||||
_gss_mo_get_ctx_as_string,
|
||||
NULL
|
||||
},
|
||||
{
|
||||
GSS_C_MA_MECH_DESCRIPTION,
|
||||
GSS_MO_MA,
|
||||
"Mechanism description",
|
||||
"Heimdal Kerberos 5 mech",
|
||||
_gss_mo_get_ctx_as_string,
|
||||
NULL
|
||||
},
|
||||
{
|
||||
GSS_C_MA_MECH_CONCRETE,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_ITOK_FRAMED,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_AUTH_INIT,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_AUTH_TARG,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_AUTH_INIT_ANON,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_DELEG_CRED,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_INTEG_PROT,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_CONF_PROT,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_MIC,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_WRAP,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_PROT_READY,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_REPLAY_DET,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_OOS_DET,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_CBINDINGS,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_PFS,
|
||||
GSS_MO_MA
|
||||
},
|
||||
{
|
||||
GSS_C_MA_CTX_TRANS,
|
||||
GSS_MO_MA
|
||||
}
|
||||
};
|
||||
|
||||
/*
|
||||
*
|
||||
*/
|
||||
|
||||
static gssapi_mech_interface_desc krb5_mech = {
|
||||
GMI_VERSION,
|
||||
"kerberos 5",
|
||||
{9, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" },
|
||||
0,
|
||||
_gsskrb5_acquire_cred,
|
||||
_gsskrb5_release_cred,
|
||||
_gsskrb5_init_sec_context,
|
||||
_gsskrb5_accept_sec_context,
|
||||
_gsskrb5_process_context_token,
|
||||
_gsskrb5_delete_sec_context,
|
||||
_gsskrb5_context_time,
|
||||
_gsskrb5_get_mic,
|
||||
_gsskrb5_verify_mic,
|
||||
_gsskrb5_wrap,
|
||||
_gsskrb5_unwrap,
|
||||
_gsskrb5_display_status,
|
||||
_gsskrb5_indicate_mechs,
|
||||
_gsskrb5_compare_name,
|
||||
_gsskrb5_display_name,
|
||||
_gsskrb5_import_name,
|
||||
_gsskrb5_export_name,
|
||||
_gsskrb5_release_name,
|
||||
_gsskrb5_inquire_cred,
|
||||
_gsskrb5_inquire_context,
|
||||
_gsskrb5_wrap_size_limit,
|
||||
_gsskrb5_add_cred,
|
||||
_gsskrb5_inquire_cred_by_mech,
|
||||
_gsskrb5_export_sec_context,
|
||||
_gsskrb5_import_sec_context,
|
||||
_gsskrb5_inquire_names_for_mech,
|
||||
_gsskrb5_inquire_mechs_for_name,
|
||||
_gsskrb5_canonicalize_name,
|
||||
_gsskrb5_duplicate_name,
|
||||
_gsskrb5_inquire_sec_context_by_oid,
|
||||
_gsskrb5_inquire_cred_by_oid,
|
||||
_gsskrb5_set_sec_context_option,
|
||||
_gsskrb5_set_cred_option,
|
||||
_gsskrb5_pseudo_random,
|
||||
_gk_wrap_iov,
|
||||
_gk_unwrap_iov,
|
||||
_gk_wrap_iov_length,
|
||||
_gsskrb5_store_cred,
|
||||
_gsskrb5_export_cred,
|
||||
_gsskrb5_import_cred,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
krb5_mo,
|
||||
sizeof(krb5_mo) / sizeof(krb5_mo[0])
|
||||
};
|
||||
|
||||
gssapi_mech_interface
|
||||
__gss_krb5_initialize(void)
|
||||
{
|
||||
return &krb5_mech;
|
||||
}
|
||||
@@ -0,0 +1,331 @@
|
||||
/* $NetBSD: get_mic.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
#ifdef HEIM_WEAK_CRYPTO
|
||||
|
||||
static OM_uint32
|
||||
mic_des
|
||||
(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
gss_qop_t qop_req,
|
||||
const gss_buffer_t message_buffer,
|
||||
gss_buffer_t message_token,
|
||||
krb5_keyblock *key
|
||||
)
|
||||
{
|
||||
u_char *p;
|
||||
EVP_MD_CTX *md5;
|
||||
u_char hash[16];
|
||||
DES_key_schedule schedule;
|
||||
EVP_CIPHER_CTX des_ctx;
|
||||
DES_cblock deskey;
|
||||
DES_cblock zero;
|
||||
int32_t seq_number;
|
||||
size_t len, total_len;
|
||||
|
||||
_gsskrb5_encap_length (22, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
|
||||
message_token->length = total_len;
|
||||
message_token->value = malloc (total_len);
|
||||
if (message_token->value == NULL) {
|
||||
message_token->length = 0;
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
p = _gsskrb5_make_header(message_token->value,
|
||||
len,
|
||||
"\x01\x01", /* TOK_ID */
|
||||
GSS_KRB5_MECHANISM);
|
||||
|
||||
memcpy (p, "\x00\x00", 2); /* SGN_ALG = DES MAC MD5 */
|
||||
p += 2;
|
||||
|
||||
memcpy (p, "\xff\xff\xff\xff", 4); /* Filler */
|
||||
p += 4;
|
||||
|
||||
/* Fill in later (SND-SEQ) */
|
||||
memset (p, 0, 16);
|
||||
p += 16;
|
||||
|
||||
/* checksum */
|
||||
md5 = EVP_MD_CTX_create();
|
||||
EVP_DigestInit_ex(md5, EVP_md5(), NULL);
|
||||
EVP_DigestUpdate(md5, p - 24, 8);
|
||||
EVP_DigestUpdate(md5, message_buffer->value, message_buffer->length);
|
||||
EVP_DigestFinal_ex(md5, hash, NULL);
|
||||
EVP_MD_CTX_destroy(md5);
|
||||
|
||||
memset (&zero, 0, sizeof(zero));
|
||||
memcpy (&deskey, key->keyvalue.data, sizeof(deskey));
|
||||
DES_set_key_unchecked (&deskey, &schedule);
|
||||
DES_cbc_cksum ((void *)hash, (void *)hash, sizeof(hash),
|
||||
&schedule, &zero);
|
||||
memcpy (p - 8, hash, 8); /* SGN_CKSUM */
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
/* sequence number */
|
||||
krb5_auth_con_getlocalseqnumber (context,
|
||||
ctx->auth_context,
|
||||
&seq_number);
|
||||
|
||||
p -= 16; /* SND_SEQ */
|
||||
p[0] = (seq_number >> 0) & 0xFF;
|
||||
p[1] = (seq_number >> 8) & 0xFF;
|
||||
p[2] = (seq_number >> 16) & 0xFF;
|
||||
p[3] = (seq_number >> 24) & 0xFF;
|
||||
memset (p + 4,
|
||||
(ctx->more_flags & LOCAL) ? 0 : 0xFF,
|
||||
4);
|
||||
|
||||
EVP_CIPHER_CTX_init(&des_ctx);
|
||||
EVP_CipherInit_ex(&des_ctx, EVP_des_cbc(), NULL, key->keyvalue.data, p + 8, 1);
|
||||
EVP_Cipher(&des_ctx, p, p, 8);
|
||||
EVP_CIPHER_CTX_cleanup(&des_ctx);
|
||||
|
||||
krb5_auth_con_setlocalseqnumber (context,
|
||||
ctx->auth_context,
|
||||
++seq_number);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
|
||||
memset (deskey, 0, sizeof(deskey));
|
||||
memset (&schedule, 0, sizeof(schedule));
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
#endif
|
||||
|
||||
static OM_uint32
|
||||
mic_des3
|
||||
(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
gss_qop_t qop_req,
|
||||
const gss_buffer_t message_buffer,
|
||||
gss_buffer_t message_token,
|
||||
krb5_keyblock *key
|
||||
)
|
||||
{
|
||||
u_char *p;
|
||||
Checksum cksum;
|
||||
u_char seq[8];
|
||||
|
||||
int32_t seq_number;
|
||||
size_t len, total_len;
|
||||
|
||||
krb5_crypto crypto;
|
||||
krb5_error_code kret;
|
||||
krb5_data encdata;
|
||||
char *tmp;
|
||||
char ivec[8];
|
||||
|
||||
_gsskrb5_encap_length (36, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
|
||||
message_token->length = total_len;
|
||||
message_token->value = malloc (total_len);
|
||||
if (message_token->value == NULL) {
|
||||
message_token->length = 0;
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
p = _gsskrb5_make_header(message_token->value,
|
||||
len,
|
||||
"\x01\x01", /* TOK-ID */
|
||||
GSS_KRB5_MECHANISM);
|
||||
|
||||
memcpy (p, "\x04\x00", 2); /* SGN_ALG = HMAC SHA1 DES3-KD */
|
||||
p += 2;
|
||||
|
||||
memcpy (p, "\xff\xff\xff\xff", 4); /* filler */
|
||||
p += 4;
|
||||
|
||||
/* this should be done in parts */
|
||||
|
||||
tmp = malloc (message_buffer->length + 8);
|
||||
if (tmp == NULL) {
|
||||
free (message_token->value);
|
||||
message_token->value = NULL;
|
||||
message_token->length = 0;
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
memcpy (tmp, p - 8, 8);
|
||||
memcpy (tmp + 8, message_buffer->value, message_buffer->length);
|
||||
|
||||
kret = krb5_crypto_init(context, key, 0, &crypto);
|
||||
if (kret) {
|
||||
free (message_token->value);
|
||||
message_token->value = NULL;
|
||||
message_token->length = 0;
|
||||
free (tmp);
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
kret = krb5_create_checksum (context,
|
||||
crypto,
|
||||
KRB5_KU_USAGE_SIGN,
|
||||
0,
|
||||
tmp,
|
||||
message_buffer->length + 8,
|
||||
&cksum);
|
||||
free (tmp);
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
if (kret) {
|
||||
free (message_token->value);
|
||||
message_token->value = NULL;
|
||||
message_token->length = 0;
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
memcpy (p + 8, cksum.checksum.data, cksum.checksum.length);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
/* sequence number */
|
||||
krb5_auth_con_getlocalseqnumber (context,
|
||||
ctx->auth_context,
|
||||
&seq_number);
|
||||
|
||||
seq[0] = (seq_number >> 0) & 0xFF;
|
||||
seq[1] = (seq_number >> 8) & 0xFF;
|
||||
seq[2] = (seq_number >> 16) & 0xFF;
|
||||
seq[3] = (seq_number >> 24) & 0xFF;
|
||||
memset (seq + 4,
|
||||
(ctx->more_flags & LOCAL) ? 0 : 0xFF,
|
||||
4);
|
||||
|
||||
kret = krb5_crypto_init(context, key,
|
||||
ETYPE_DES3_CBC_NONE, &crypto);
|
||||
if (kret) {
|
||||
free (message_token->value);
|
||||
message_token->value = NULL;
|
||||
message_token->length = 0;
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
if (ctx->more_flags & COMPAT_OLD_DES3)
|
||||
memset(ivec, 0, 8);
|
||||
else
|
||||
memcpy(ivec, p + 8, 8);
|
||||
|
||||
kret = krb5_encrypt_ivec (context,
|
||||
crypto,
|
||||
KRB5_KU_USAGE_SEQ,
|
||||
seq, 8, &encdata, ivec);
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
if (kret) {
|
||||
free (message_token->value);
|
||||
message_token->value = NULL;
|
||||
message_token->length = 0;
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
assert (encdata.length == 8);
|
||||
|
||||
memcpy (p, encdata.data, encdata.length);
|
||||
krb5_data_free (&encdata);
|
||||
|
||||
krb5_auth_con_setlocalseqnumber (context,
|
||||
ctx->auth_context,
|
||||
++seq_number);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
|
||||
free_Checksum (&cksum);
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_get_mic
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
gss_qop_t qop_req,
|
||||
const gss_buffer_t message_buffer,
|
||||
gss_buffer_t message_token
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
|
||||
krb5_keyblock *key;
|
||||
OM_uint32 ret;
|
||||
krb5_keytype keytype;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (ctx->more_flags & IS_CFX)
|
||||
return _gssapi_mic_cfx (minor_status, ctx, context, qop_req,
|
||||
message_buffer, message_token);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
ret = _gsskrb5i_get_token_key(ctx, context, &key);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
krb5_enctype_to_keytype (context, key->keytype, &keytype);
|
||||
|
||||
switch (keytype) {
|
||||
case KEYTYPE_DES :
|
||||
#ifdef HEIM_WEAK_CRYPTO
|
||||
ret = mic_des (minor_status, ctx, context, qop_req,
|
||||
message_buffer, message_token, key);
|
||||
#else
|
||||
ret = GSS_S_FAILURE;
|
||||
#endif
|
||||
break;
|
||||
case KEYTYPE_DES3 :
|
||||
ret = mic_des3 (minor_status, ctx, context, qop_req,
|
||||
message_buffer, message_token, key);
|
||||
break;
|
||||
case KEYTYPE_ARCFOUR:
|
||||
case KEYTYPE_ARCFOUR_56:
|
||||
ret = _gssapi_get_mic_arcfour (minor_status, ctx, context, qop_req,
|
||||
message_buffer, message_token, key);
|
||||
break;
|
||||
default :
|
||||
abort();
|
||||
break;
|
||||
}
|
||||
krb5_free_keyblock (context, key);
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
#
|
||||
# extended gss krb5 error messages
|
||||
#
|
||||
|
||||
id "Id"
|
||||
|
||||
error_table gk5
|
||||
|
||||
prefix GSS_KRB5_S
|
||||
|
||||
error_code G_BAD_SERVICE_NAME, "No @ in SERVICE-NAME name string"
|
||||
error_code G_BAD_STRING_UID, "STRING-UID-NAME contains nondigits"
|
||||
error_code G_NOUSER, "UID does not resolve to username"
|
||||
error_code G_VALIDATE_FAILED, "Validation error"
|
||||
error_code G_BUFFER_ALLOC, "Couldn't allocate gss_buffer_t data"
|
||||
error_code G_BAD_MSG_CTX, "Message context invalid"
|
||||
error_code G_WRONG_SIZE, "Buffer is the wrong size"
|
||||
error_code G_BAD_USAGE, "Credential usage type is unknown"
|
||||
error_code G_UNKNOWN_QOP, "Unknown quality of protection specified"
|
||||
|
||||
index 128
|
||||
|
||||
error_code KG_CCACHE_NOMATCH, "Principal in credential cache does not match desired name"
|
||||
error_code KG_KEYTAB_NOMATCH, "No principal in keytab matches desired name"
|
||||
error_code KG_TGT_MISSING, "Credential cache has no TGT"
|
||||
error_code KG_NO_SUBKEY, "Authenticator has no subkey"
|
||||
error_code KG_CONTEXT_ESTABLISHED, "Context is already fully established"
|
||||
error_code KG_BAD_SIGN_TYPE, "Unknown signature type in token"
|
||||
error_code KG_BAD_LENGTH, "Invalid field length in token"
|
||||
error_code KG_CTX_INCOMPLETE, "Attempt to use incomplete security context"
|
||||
error_code KG_INPUT_TOO_LONG, "Input too long"
|
||||
@@ -0,0 +1,142 @@
|
||||
/* $NetBSD: gsskrb5_locl.h,v 1.1.1.2 2011/04/14 14:08:26 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* Id */
|
||||
|
||||
#ifndef GSSKRB5_LOCL_H
|
||||
#define GSSKRB5_LOCL_H
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <krb5_locl.h>
|
||||
#include <gkrb5_err.h>
|
||||
#include <gssapi/gssapi.h>
|
||||
#include <gssapi_mech.h>
|
||||
#include <gssapi/gssapi_krb5.h>
|
||||
#include <assert.h>
|
||||
|
||||
#include "cfx.h"
|
||||
|
||||
/*
|
||||
*
|
||||
*/
|
||||
|
||||
struct gss_msg_order;
|
||||
|
||||
typedef struct gsskrb5_ctx {
|
||||
struct krb5_auth_context_data *auth_context;
|
||||
struct krb5_auth_context_data *deleg_auth_context;
|
||||
krb5_principal source, target;
|
||||
#define IS_DCE_STYLE(ctx) (((ctx)->flags & GSS_C_DCE_STYLE) != 0)
|
||||
OM_uint32 flags;
|
||||
enum { LOCAL = 1, OPEN = 2,
|
||||
COMPAT_OLD_DES3 = 4,
|
||||
COMPAT_OLD_DES3_SELECTED = 8,
|
||||
ACCEPTOR_SUBKEY = 16,
|
||||
RETRIED = 32,
|
||||
CLOSE_CCACHE = 64,
|
||||
IS_CFX = 128
|
||||
} more_flags;
|
||||
enum gss_ctx_id_t_state {
|
||||
/* initiator states */
|
||||
INITIATOR_START,
|
||||
INITIATOR_RESTART,
|
||||
INITIATOR_WAIT_FOR_MUTAL,
|
||||
INITIATOR_READY,
|
||||
/* acceptor states */
|
||||
ACCEPTOR_START,
|
||||
ACCEPTOR_WAIT_FOR_DCESTYLE,
|
||||
ACCEPTOR_READY
|
||||
} state;
|
||||
krb5_creds *kcred;
|
||||
krb5_ccache ccache;
|
||||
struct krb5_ticket *ticket;
|
||||
OM_uint32 lifetime;
|
||||
HEIMDAL_MUTEX ctx_id_mutex;
|
||||
struct gss_msg_order *order;
|
||||
krb5_keyblock *service_keyblock;
|
||||
krb5_data fwd_data;
|
||||
krb5_crypto crypto;
|
||||
} *gsskrb5_ctx;
|
||||
|
||||
typedef struct {
|
||||
krb5_principal principal;
|
||||
int cred_flags;
|
||||
#define GSS_CF_DESTROY_CRED_ON_RELEASE 1
|
||||
#define GSS_CF_NO_CI_FLAGS 2
|
||||
struct krb5_keytab_data *keytab;
|
||||
OM_uint32 lifetime;
|
||||
gss_cred_usage_t usage;
|
||||
gss_OID_set mechanisms;
|
||||
struct krb5_ccache_data *ccache;
|
||||
HEIMDAL_MUTEX cred_id_mutex;
|
||||
krb5_enctype *enctypes;
|
||||
} *gsskrb5_cred;
|
||||
|
||||
typedef struct Principal *gsskrb5_name;
|
||||
|
||||
/*
|
||||
*
|
||||
*/
|
||||
|
||||
extern krb5_keytab _gsskrb5_keytab;
|
||||
extern HEIMDAL_MUTEX gssapi_keytab_mutex;
|
||||
|
||||
/*
|
||||
* Prototypes
|
||||
*/
|
||||
|
||||
#include <gsskrb5-private.h>
|
||||
|
||||
#define GSSAPI_KRB5_INIT(ctx) do { \
|
||||
krb5_error_code kret_gss_init; \
|
||||
if((kret_gss_init = _gsskrb5_init (ctx)) != 0) { \
|
||||
*minor_status = kret_gss_init; \
|
||||
return GSS_S_FAILURE; \
|
||||
} \
|
||||
} while (0)
|
||||
|
||||
/* sec_context flags */
|
||||
|
||||
#define SC_LOCAL_ADDRESS 0x01
|
||||
#define SC_REMOTE_ADDRESS 0x02
|
||||
#define SC_KEYBLOCK 0x04
|
||||
#define SC_LOCAL_SUBKEY 0x08
|
||||
#define SC_REMOTE_SUBKEY 0x10
|
||||
|
||||
/* type to signal that that dns canon maybe should be done */
|
||||
#define MAGIC_HOSTBASED_NAME_TYPE 4711
|
||||
|
||||
#endif
|
||||
@@ -0,0 +1,257 @@
|
||||
/* $NetBSD: import_name.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
static OM_uint32
|
||||
parse_krb5_name (OM_uint32 *minor_status,
|
||||
krb5_context context,
|
||||
const char *name,
|
||||
gss_name_t *output_name)
|
||||
{
|
||||
krb5_principal princ;
|
||||
krb5_error_code kerr;
|
||||
|
||||
kerr = krb5_parse_name (context, name, &princ);
|
||||
|
||||
if (kerr == 0) {
|
||||
*output_name = (gss_name_t)princ;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
*minor_status = kerr;
|
||||
|
||||
if (kerr == KRB5_PARSE_ILLCHAR || kerr == KRB5_PARSE_MALFORMED)
|
||||
return GSS_S_BAD_NAME;
|
||||
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
import_krb5_name (OM_uint32 *minor_status,
|
||||
krb5_context context,
|
||||
const gss_buffer_t input_name_buffer,
|
||||
gss_name_t *output_name)
|
||||
{
|
||||
OM_uint32 ret;
|
||||
char *tmp;
|
||||
|
||||
tmp = malloc (input_name_buffer->length + 1);
|
||||
if (tmp == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
memcpy (tmp,
|
||||
input_name_buffer->value,
|
||||
input_name_buffer->length);
|
||||
tmp[input_name_buffer->length] = '\0';
|
||||
|
||||
ret = parse_krb5_name(minor_status, context, tmp, output_name);
|
||||
free(tmp);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_canon_name(OM_uint32 *minor_status, krb5_context context,
|
||||
int use_dns, krb5_const_principal sourcename, gss_name_t targetname,
|
||||
krb5_principal *out)
|
||||
{
|
||||
krb5_principal p = (krb5_principal)targetname;
|
||||
krb5_error_code ret;
|
||||
char *hostname = NULL, *service;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
/* If its not a hostname */
|
||||
if (krb5_principal_get_type(context, p) != MAGIC_HOSTBASED_NAME_TYPE) {
|
||||
ret = krb5_copy_principal(context, p, out);
|
||||
} else if (!use_dns) {
|
||||
ret = krb5_copy_principal(context, p, out);
|
||||
if (ret)
|
||||
goto out;
|
||||
krb5_principal_set_type(context, *out, KRB5_NT_SRV_HST);
|
||||
if (sourcename)
|
||||
ret = krb5_principal_set_realm(context, *out, sourcename->realm);
|
||||
} else {
|
||||
if (p->name.name_string.len == 0)
|
||||
return GSS_S_BAD_NAME;
|
||||
else if (p->name.name_string.len > 1)
|
||||
hostname = p->name.name_string.val[1];
|
||||
|
||||
service = p->name.name_string.val[0];
|
||||
|
||||
ret = krb5_sname_to_principal(context,
|
||||
hostname,
|
||||
service,
|
||||
KRB5_NT_SRV_HST,
|
||||
out);
|
||||
}
|
||||
|
||||
out:
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
static OM_uint32
|
||||
import_hostbased_name (OM_uint32 *minor_status,
|
||||
krb5_context context,
|
||||
const gss_buffer_t input_name_buffer,
|
||||
gss_name_t *output_name)
|
||||
{
|
||||
krb5_principal princ = NULL;
|
||||
krb5_error_code kerr;
|
||||
char *tmp, *p, *host = NULL;
|
||||
|
||||
tmp = malloc (input_name_buffer->length + 1);
|
||||
if (tmp == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
memcpy (tmp,
|
||||
input_name_buffer->value,
|
||||
input_name_buffer->length);
|
||||
tmp[input_name_buffer->length] = '\0';
|
||||
|
||||
p = strchr (tmp, '@');
|
||||
if (p != NULL) {
|
||||
*p = '\0';
|
||||
host = p + 1;
|
||||
}
|
||||
|
||||
kerr = krb5_make_principal(context, &princ, NULL, tmp, host, NULL);
|
||||
free (tmp);
|
||||
*minor_status = kerr;
|
||||
if (kerr == KRB5_PARSE_ILLCHAR || kerr == KRB5_PARSE_MALFORMED)
|
||||
return GSS_S_BAD_NAME;
|
||||
else if (kerr)
|
||||
return GSS_S_FAILURE;
|
||||
|
||||
krb5_principal_set_type(context, princ, MAGIC_HOSTBASED_NAME_TYPE);
|
||||
*output_name = (gss_name_t)princ;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
import_export_name (OM_uint32 *minor_status,
|
||||
krb5_context context,
|
||||
const gss_buffer_t input_name_buffer,
|
||||
gss_name_t *output_name)
|
||||
{
|
||||
unsigned char *p;
|
||||
uint32_t length;
|
||||
OM_uint32 ret;
|
||||
char *name;
|
||||
|
||||
if (input_name_buffer->length < 10 + GSS_KRB5_MECHANISM->length)
|
||||
return GSS_S_BAD_NAME;
|
||||
|
||||
/* TOK, MECH_OID_LEN, DER(MECH_OID), NAME_LEN, NAME */
|
||||
|
||||
p = input_name_buffer->value;
|
||||
|
||||
if (memcmp(&p[0], "\x04\x01\x00", 3) != 0 ||
|
||||
p[3] != GSS_KRB5_MECHANISM->length + 2 ||
|
||||
p[4] != 0x06 ||
|
||||
p[5] != GSS_KRB5_MECHANISM->length ||
|
||||
memcmp(&p[6], GSS_KRB5_MECHANISM->elements,
|
||||
GSS_KRB5_MECHANISM->length) != 0)
|
||||
return GSS_S_BAD_NAME;
|
||||
|
||||
p += 6 + GSS_KRB5_MECHANISM->length;
|
||||
|
||||
length = p[0] << 24 | p[1] << 16 | p[2] << 8 | p[3];
|
||||
p += 4;
|
||||
|
||||
if (length > input_name_buffer->length - 10 - GSS_KRB5_MECHANISM->length)
|
||||
return GSS_S_BAD_NAME;
|
||||
|
||||
name = malloc(length + 1);
|
||||
if (name == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
memcpy(name, p, length);
|
||||
name[length] = '\0';
|
||||
|
||||
ret = parse_krb5_name(minor_status, context, name, output_name);
|
||||
free(name);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_import_name
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_buffer_t input_name_buffer,
|
||||
const gss_OID input_name_type,
|
||||
gss_name_t * output_name
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
|
||||
*minor_status = 0;
|
||||
*output_name = GSS_C_NO_NAME;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (gss_oid_equal(input_name_type, GSS_C_NT_HOSTBASED_SERVICE) ||
|
||||
gss_oid_equal(input_name_type, GSS_C_NT_HOSTBASED_SERVICE_X))
|
||||
return import_hostbased_name (minor_status,
|
||||
context,
|
||||
input_name_buffer,
|
||||
output_name);
|
||||
else if (input_name_type == GSS_C_NO_OID
|
||||
|| gss_oid_equal(input_name_type, GSS_C_NT_USER_NAME)
|
||||
|| gss_oid_equal(input_name_type, GSS_KRB5_NT_PRINCIPAL_NAME))
|
||||
/* default printable syntax */
|
||||
return import_krb5_name (minor_status,
|
||||
context,
|
||||
input_name_buffer,
|
||||
output_name);
|
||||
else if (gss_oid_equal(input_name_type, GSS_C_NT_EXPORT_NAME)) {
|
||||
return import_export_name(minor_status,
|
||||
context,
|
||||
input_name_buffer,
|
||||
output_name);
|
||||
} else {
|
||||
*minor_status = 0;
|
||||
return GSS_S_BAD_NAMETYPE;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,231 @@
|
||||
/* $NetBSD: import_sec_context.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_import_sec_context (
|
||||
OM_uint32 * minor_status,
|
||||
const gss_buffer_t interprocess_token,
|
||||
gss_ctx_id_t * context_handle
|
||||
)
|
||||
{
|
||||
OM_uint32 ret = GSS_S_FAILURE;
|
||||
krb5_context context;
|
||||
krb5_error_code kret;
|
||||
krb5_storage *sp;
|
||||
krb5_auth_context ac;
|
||||
krb5_address local, remote;
|
||||
krb5_address *localp, *remotep;
|
||||
krb5_data data;
|
||||
gss_buffer_desc buffer;
|
||||
krb5_keyblock keyblock;
|
||||
int32_t flags, tmp;
|
||||
gsskrb5_ctx ctx;
|
||||
gss_name_t name;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
*context_handle = GSS_C_NO_CONTEXT;
|
||||
|
||||
localp = remotep = NULL;
|
||||
|
||||
sp = krb5_storage_from_mem (interprocess_token->value,
|
||||
interprocess_token->length);
|
||||
if (sp == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ctx = calloc(1, sizeof(*ctx));
|
||||
if (ctx == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
krb5_storage_free (sp);
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
HEIMDAL_MUTEX_init(&ctx->ctx_id_mutex);
|
||||
|
||||
kret = krb5_auth_con_init (context,
|
||||
&ctx->auth_context);
|
||||
if (kret) {
|
||||
*minor_status = kret;
|
||||
ret = GSS_S_FAILURE;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
/* flags */
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
if (krb5_ret_int32 (sp, &flags) != 0)
|
||||
goto failure;
|
||||
|
||||
/* retrieve the auth context */
|
||||
|
||||
ac = ctx->auth_context;
|
||||
if (krb5_ret_int32 (sp, &tmp) != 0)
|
||||
goto failure;
|
||||
ac->flags = tmp;
|
||||
if (flags & SC_LOCAL_ADDRESS) {
|
||||
if (krb5_ret_address (sp, localp = &local) != 0)
|
||||
goto failure;
|
||||
}
|
||||
|
||||
if (flags & SC_REMOTE_ADDRESS) {
|
||||
if (krb5_ret_address (sp, remotep = &remote) != 0)
|
||||
goto failure;
|
||||
}
|
||||
|
||||
krb5_auth_con_setaddrs (context, ac, localp, remotep);
|
||||
if (localp)
|
||||
krb5_free_address (context, localp);
|
||||
if (remotep)
|
||||
krb5_free_address (context, remotep);
|
||||
localp = remotep = NULL;
|
||||
|
||||
if (krb5_ret_int16 (sp, &ac->local_port) != 0)
|
||||
goto failure;
|
||||
|
||||
if (krb5_ret_int16 (sp, &ac->remote_port) != 0)
|
||||
goto failure;
|
||||
if (flags & SC_KEYBLOCK) {
|
||||
if (krb5_ret_keyblock (sp, &keyblock) != 0)
|
||||
goto failure;
|
||||
krb5_auth_con_setkey (context, ac, &keyblock);
|
||||
krb5_free_keyblock_contents (context, &keyblock);
|
||||
}
|
||||
if (flags & SC_LOCAL_SUBKEY) {
|
||||
if (krb5_ret_keyblock (sp, &keyblock) != 0)
|
||||
goto failure;
|
||||
krb5_auth_con_setlocalsubkey (context, ac, &keyblock);
|
||||
krb5_free_keyblock_contents (context, &keyblock);
|
||||
}
|
||||
if (flags & SC_REMOTE_SUBKEY) {
|
||||
if (krb5_ret_keyblock (sp, &keyblock) != 0)
|
||||
goto failure;
|
||||
krb5_auth_con_setremotesubkey (context, ac, &keyblock);
|
||||
krb5_free_keyblock_contents (context, &keyblock);
|
||||
}
|
||||
if (krb5_ret_uint32 (sp, &ac->local_seqnumber))
|
||||
goto failure;
|
||||
if (krb5_ret_uint32 (sp, &ac->remote_seqnumber))
|
||||
goto failure;
|
||||
|
||||
if (krb5_ret_int32 (sp, &tmp) != 0)
|
||||
goto failure;
|
||||
ac->keytype = tmp;
|
||||
if (krb5_ret_int32 (sp, &tmp) != 0)
|
||||
goto failure;
|
||||
ac->cksumtype = tmp;
|
||||
|
||||
/* names */
|
||||
|
||||
if (krb5_ret_data (sp, &data))
|
||||
goto failure;
|
||||
buffer.value = data.data;
|
||||
buffer.length = data.length;
|
||||
|
||||
ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NT_EXPORT_NAME,
|
||||
&name);
|
||||
if (ret) {
|
||||
ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NO_OID,
|
||||
&name);
|
||||
if (ret) {
|
||||
krb5_data_free (&data);
|
||||
goto failure;
|
||||
}
|
||||
}
|
||||
ctx->source = (krb5_principal)name;
|
||||
krb5_data_free (&data);
|
||||
|
||||
if (krb5_ret_data (sp, &data) != 0)
|
||||
goto failure;
|
||||
buffer.value = data.data;
|
||||
buffer.length = data.length;
|
||||
|
||||
ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NT_EXPORT_NAME,
|
||||
&name);
|
||||
if (ret) {
|
||||
ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NO_OID,
|
||||
&name);
|
||||
if (ret) {
|
||||
krb5_data_free (&data);
|
||||
goto failure;
|
||||
}
|
||||
}
|
||||
ctx->target = (krb5_principal)name;
|
||||
krb5_data_free (&data);
|
||||
|
||||
if (krb5_ret_int32 (sp, &tmp))
|
||||
goto failure;
|
||||
ctx->flags = tmp;
|
||||
if (krb5_ret_int32 (sp, &tmp))
|
||||
goto failure;
|
||||
ctx->more_flags = tmp;
|
||||
if (krb5_ret_int32 (sp, &tmp))
|
||||
goto failure;
|
||||
ctx->lifetime = tmp;
|
||||
|
||||
ret = _gssapi_msg_order_import(minor_status, sp, &ctx->order);
|
||||
if (ret)
|
||||
goto failure;
|
||||
|
||||
krb5_storage_free (sp);
|
||||
|
||||
_gsskrb5i_is_cfx(context, ctx, (ctx->more_flags & LOCAL) == 0);
|
||||
|
||||
*context_handle = (gss_ctx_id_t)ctx;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
failure:
|
||||
krb5_auth_con_free (context,
|
||||
ctx->auth_context);
|
||||
if (ctx->source != NULL)
|
||||
krb5_free_principal(context, ctx->source);
|
||||
if (ctx->target != NULL)
|
||||
krb5_free_principal(context, ctx->target);
|
||||
if (localp)
|
||||
krb5_free_address (context, localp);
|
||||
if (remotep)
|
||||
krb5_free_address (context, remotep);
|
||||
if(ctx->order)
|
||||
_gssapi_msg_order_destroy(&ctx->order);
|
||||
HEIMDAL_MUTEX_destroy(&ctx->ctx_id_mutex);
|
||||
krb5_storage_free (sp);
|
||||
free (ctx);
|
||||
*context_handle = GSS_C_NO_CONTEXT;
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
/* $NetBSD: indicate_mechs.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_indicate_mechs
|
||||
(OM_uint32 * minor_status,
|
||||
gss_OID_set * mech_set
|
||||
)
|
||||
{
|
||||
OM_uint32 ret, junk;
|
||||
|
||||
ret = gss_create_empty_oid_set(minor_status, mech_set);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM, mech_set);
|
||||
if (ret) {
|
||||
gss_release_oid_set(&junk, mech_set);
|
||||
return ret;
|
||||
}
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,83 @@
|
||||
/* $NetBSD: init.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2001, 2003, 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
static HEIMDAL_MUTEX context_mutex = HEIMDAL_MUTEX_INITIALIZER;
|
||||
static int created_key;
|
||||
static HEIMDAL_thread_key context_key;
|
||||
|
||||
static void
|
||||
destroy_context(void *ptr)
|
||||
{
|
||||
krb5_context context = ptr;
|
||||
|
||||
if (context == NULL)
|
||||
return;
|
||||
krb5_free_context(context);
|
||||
}
|
||||
|
||||
krb5_error_code
|
||||
_gsskrb5_init (krb5_context *context)
|
||||
{
|
||||
krb5_error_code ret = 0;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_mutex);
|
||||
|
||||
if (!created_key) {
|
||||
HEIMDAL_key_create(&context_key, destroy_context, ret);
|
||||
if (ret) {
|
||||
HEIMDAL_MUTEX_unlock(&context_mutex);
|
||||
return ret;
|
||||
}
|
||||
created_key = 1;
|
||||
}
|
||||
HEIMDAL_MUTEX_unlock(&context_mutex);
|
||||
|
||||
*context = HEIMDAL_getspecific(context_key);
|
||||
if (*context == NULL) {
|
||||
|
||||
ret = krb5_init_context(context);
|
||||
if (ret == 0) {
|
||||
HEIMDAL_setspecific(context_key, *context, ret);
|
||||
if (ret) {
|
||||
krb5_free_context(*context);
|
||||
*context = NULL;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,112 @@
|
||||
/* $NetBSD: inquire_context.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997, 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_context (
|
||||
OM_uint32 * minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
gss_name_t * src_name,
|
||||
gss_name_t * targ_name,
|
||||
OM_uint32 * lifetime_rec,
|
||||
gss_OID * mech_type,
|
||||
OM_uint32 * ctx_flags,
|
||||
int * locally_initiated,
|
||||
int * open_context
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
OM_uint32 ret;
|
||||
gsskrb5_ctx ctx = (gsskrb5_ctx)context_handle;
|
||||
gss_name_t name;
|
||||
|
||||
if (src_name)
|
||||
*src_name = GSS_C_NO_NAME;
|
||||
if (targ_name)
|
||||
*targ_name = GSS_C_NO_NAME;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
|
||||
if (src_name) {
|
||||
name = (gss_name_t)ctx->source;
|
||||
ret = _gsskrb5_duplicate_name (minor_status, name, src_name);
|
||||
if (ret)
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (targ_name) {
|
||||
name = (gss_name_t)ctx->target;
|
||||
ret = _gsskrb5_duplicate_name (minor_status, name, targ_name);
|
||||
if (ret)
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (lifetime_rec) {
|
||||
ret = _gsskrb5_lifetime_left(minor_status,
|
||||
context,
|
||||
ctx->lifetime,
|
||||
lifetime_rec);
|
||||
if (ret)
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (mech_type)
|
||||
*mech_type = GSS_KRB5_MECHANISM;
|
||||
|
||||
if (ctx_flags)
|
||||
*ctx_flags = ctx->flags;
|
||||
|
||||
if (locally_initiated)
|
||||
*locally_initiated = ctx->more_flags & LOCAL;
|
||||
|
||||
if (open_context)
|
||||
*open_context = ctx->more_flags & OPEN;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
failed:
|
||||
if (src_name)
|
||||
_gsskrb5_release_name(NULL, src_name);
|
||||
if (targ_name)
|
||||
_gsskrb5_release_name(NULL, targ_name);
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,182 @@
|
||||
/* $NetBSD: inquire_cred.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997, 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_cred
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_cred_id_t cred_handle,
|
||||
gss_name_t * output_name,
|
||||
OM_uint32 * lifetime,
|
||||
gss_cred_usage_t * cred_usage,
|
||||
gss_OID_set * mechanisms
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
gss_cred_id_t aqcred_init = GSS_C_NO_CREDENTIAL;
|
||||
gss_cred_id_t aqcred_accept = GSS_C_NO_CREDENTIAL;
|
||||
gsskrb5_cred acred = NULL, icred = NULL;
|
||||
OM_uint32 ret;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
if (output_name)
|
||||
*output_name = NULL;
|
||||
if (mechanisms)
|
||||
*mechanisms = GSS_C_NO_OID_SET;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (cred_handle == GSS_C_NO_CREDENTIAL) {
|
||||
ret = _gsskrb5_acquire_cred(minor_status,
|
||||
GSS_C_NO_NAME,
|
||||
GSS_C_INDEFINITE,
|
||||
GSS_C_NO_OID_SET,
|
||||
GSS_C_ACCEPT,
|
||||
&aqcred_accept,
|
||||
NULL,
|
||||
NULL);
|
||||
if (ret == GSS_S_COMPLETE)
|
||||
acred = (gsskrb5_cred)aqcred_accept;
|
||||
|
||||
ret = _gsskrb5_acquire_cred(minor_status,
|
||||
GSS_C_NO_NAME,
|
||||
GSS_C_INDEFINITE,
|
||||
GSS_C_NO_OID_SET,
|
||||
GSS_C_INITIATE,
|
||||
&aqcred_init,
|
||||
NULL,
|
||||
NULL);
|
||||
if (ret == GSS_S_COMPLETE)
|
||||
icred = (gsskrb5_cred)aqcred_init;
|
||||
|
||||
if (icred == NULL && acred == NULL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_NO_CRED;
|
||||
}
|
||||
} else
|
||||
acred = (gsskrb5_cred)cred_handle;
|
||||
|
||||
if (acred)
|
||||
HEIMDAL_MUTEX_lock(&acred->cred_id_mutex);
|
||||
if (icred)
|
||||
HEIMDAL_MUTEX_lock(&icred->cred_id_mutex);
|
||||
|
||||
if (output_name != NULL) {
|
||||
if (icred && icred->principal != NULL) {
|
||||
gss_name_t name;
|
||||
|
||||
if (acred && acred->principal)
|
||||
name = (gss_name_t)acred->principal;
|
||||
else
|
||||
name = (gss_name_t)icred->principal;
|
||||
|
||||
ret = _gsskrb5_duplicate_name(minor_status, name, output_name);
|
||||
if (ret)
|
||||
goto out;
|
||||
} else if (acred && acred->usage == GSS_C_ACCEPT) {
|
||||
krb5_principal princ;
|
||||
*minor_status = krb5_sname_to_principal(context, NULL,
|
||||
NULL, KRB5_NT_SRV_HST,
|
||||
&princ);
|
||||
if (*minor_status) {
|
||||
ret = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
*output_name = (gss_name_t)princ;
|
||||
} else {
|
||||
krb5_principal princ;
|
||||
*minor_status = krb5_get_default_principal(context,
|
||||
&princ);
|
||||
if (*minor_status) {
|
||||
ret = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
*output_name = (gss_name_t)princ;
|
||||
}
|
||||
}
|
||||
if (lifetime != NULL) {
|
||||
OM_uint32 alife = GSS_C_INDEFINITE, ilife = GSS_C_INDEFINITE;
|
||||
|
||||
if (acred) alife = acred->lifetime;
|
||||
if (icred) ilife = icred->lifetime;
|
||||
|
||||
ret = _gsskrb5_lifetime_left(minor_status,
|
||||
context,
|
||||
min(alife,ilife),
|
||||
lifetime);
|
||||
if (ret)
|
||||
goto out;
|
||||
}
|
||||
if (cred_usage != NULL) {
|
||||
if (acred && icred)
|
||||
*cred_usage = GSS_C_BOTH;
|
||||
else if (acred)
|
||||
*cred_usage = GSS_C_ACCEPT;
|
||||
else if (icred)
|
||||
*cred_usage = GSS_C_INITIATE;
|
||||
else
|
||||
abort();
|
||||
}
|
||||
|
||||
if (mechanisms != NULL) {
|
||||
ret = gss_create_empty_oid_set(minor_status, mechanisms);
|
||||
if (ret)
|
||||
goto out;
|
||||
if (acred)
|
||||
ret = gss_add_oid_set_member(minor_status,
|
||||
&acred->mechanisms->elements[0],
|
||||
mechanisms);
|
||||
if (ret == GSS_S_COMPLETE && icred)
|
||||
ret = gss_add_oid_set_member(minor_status,
|
||||
&icred->mechanisms->elements[0],
|
||||
mechanisms);
|
||||
if (ret)
|
||||
goto out;
|
||||
}
|
||||
ret = GSS_S_COMPLETE;
|
||||
out:
|
||||
if (acred)
|
||||
HEIMDAL_MUTEX_unlock(&acred->cred_id_mutex);
|
||||
if (icred)
|
||||
HEIMDAL_MUTEX_unlock(&icred->cred_id_mutex);
|
||||
|
||||
if (aqcred_init != GSS_C_NO_CREDENTIAL)
|
||||
ret = _gsskrb5_release_cred(minor_status, &aqcred_init);
|
||||
if (aqcred_accept != GSS_C_NO_CREDENTIAL)
|
||||
ret = _gsskrb5_release_cred(minor_status, &aqcred_accept);
|
||||
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
/* $NetBSD: inquire_cred_by_mech.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003, 2006, 2007 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_cred_by_mech (
|
||||
OM_uint32 * minor_status,
|
||||
const gss_cred_id_t cred_handle,
|
||||
const gss_OID mech_type,
|
||||
gss_name_t * name,
|
||||
OM_uint32 * initiator_lifetime,
|
||||
OM_uint32 * acceptor_lifetime,
|
||||
gss_cred_usage_t * cred_usage
|
||||
)
|
||||
{
|
||||
gss_cred_usage_t usage;
|
||||
OM_uint32 maj_stat;
|
||||
OM_uint32 lifetime;
|
||||
|
||||
maj_stat =
|
||||
_gsskrb5_inquire_cred (minor_status, cred_handle,
|
||||
name, &lifetime, &usage, NULL);
|
||||
if (maj_stat)
|
||||
return maj_stat;
|
||||
|
||||
if (initiator_lifetime) {
|
||||
if (usage == GSS_C_INITIATE || usage == GSS_C_BOTH)
|
||||
*initiator_lifetime = lifetime;
|
||||
else
|
||||
*initiator_lifetime = 0;
|
||||
}
|
||||
|
||||
if (acceptor_lifetime) {
|
||||
if (usage == GSS_C_ACCEPT || usage == GSS_C_BOTH)
|
||||
*acceptor_lifetime = lifetime;
|
||||
else
|
||||
*acceptor_lifetime = 0;
|
||||
}
|
||||
|
||||
if (cred_usage)
|
||||
*cred_usage = usage;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,83 @@
|
||||
/* $NetBSD: inquire_cred_by_oid.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2004, PADL Software Pty Ltd.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of PADL Software nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_cred_by_oid
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_cred_id_t cred_handle,
|
||||
const gss_OID desired_object,
|
||||
gss_buffer_set_t *data_set)
|
||||
{
|
||||
krb5_context context;
|
||||
gsskrb5_cred cred = (gsskrb5_cred)cred_handle;
|
||||
krb5_error_code ret;
|
||||
gss_buffer_desc buffer;
|
||||
char *str;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (gss_oid_equal(desired_object, GSS_KRB5_COPY_CCACHE_X) == 0) {
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_lock(&cred->cred_id_mutex);
|
||||
|
||||
if (cred->ccache == NULL) {
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_cc_get_full_name(context, cred->ccache, &str);
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
buffer.value = str;
|
||||
buffer.length = strlen(str);
|
||||
|
||||
ret = gss_add_buffer_set_member(minor_status, &buffer, data_set);
|
||||
if (ret != GSS_S_COMPLETE)
|
||||
_gsskrb5_clear_status ();
|
||||
|
||||
free(str);
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
/* $NetBSD: inquire_mechs_for_name.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_mechs_for_name (
|
||||
OM_uint32 * minor_status,
|
||||
const gss_name_t input_name,
|
||||
gss_OID_set * mech_types
|
||||
)
|
||||
{
|
||||
OM_uint32 ret;
|
||||
|
||||
ret = gss_create_empty_oid_set(minor_status, mech_types);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
ret = gss_add_oid_set_member(minor_status,
|
||||
GSS_KRB5_MECHANISM,
|
||||
mech_types);
|
||||
if (ret)
|
||||
gss_release_oid_set(NULL, mech_types);
|
||||
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
/* $NetBSD: inquire_names_for_mech.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
static gss_OID name_list[] = {
|
||||
GSS_C_NT_HOSTBASED_SERVICE,
|
||||
GSS_C_NT_USER_NAME,
|
||||
GSS_KRB5_NT_PRINCIPAL_NAME,
|
||||
GSS_C_NT_EXPORT_NAME,
|
||||
NULL
|
||||
};
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_names_for_mech (
|
||||
OM_uint32 * minor_status,
|
||||
const gss_OID mechanism,
|
||||
gss_OID_set * name_types
|
||||
)
|
||||
{
|
||||
OM_uint32 ret;
|
||||
int i;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
if (gss_oid_equal(mechanism, GSS_KRB5_MECHANISM) == 0 &&
|
||||
gss_oid_equal(mechanism, GSS_C_NULL_OID) == 0) {
|
||||
*name_types = GSS_C_NO_OID_SET;
|
||||
return GSS_S_BAD_MECH;
|
||||
}
|
||||
|
||||
ret = gss_create_empty_oid_set(minor_status, name_types);
|
||||
if (ret != GSS_S_COMPLETE)
|
||||
return ret;
|
||||
|
||||
for (i = 0; name_list[i] != NULL; i++) {
|
||||
ret = gss_add_oid_set_member(minor_status,
|
||||
name_list[i],
|
||||
name_types);
|
||||
if (ret != GSS_S_COMPLETE)
|
||||
break;
|
||||
}
|
||||
|
||||
if (ret != GSS_S_COMPLETE)
|
||||
gss_release_oid_set(NULL, name_types);
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
+562
@@ -0,0 +1,562 @@
|
||||
/* $NetBSD: inquire_sec_context_by_oid.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2004, PADL Software Pty Ltd.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of PADL Software nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
static int
|
||||
oid_prefix_equal(gss_OID oid_enc, gss_OID prefix_enc, unsigned *suffix)
|
||||
{
|
||||
int ret;
|
||||
heim_oid oid;
|
||||
heim_oid prefix;
|
||||
|
||||
*suffix = 0;
|
||||
|
||||
ret = der_get_oid(oid_enc->elements, oid_enc->length,
|
||||
&oid, NULL);
|
||||
if (ret) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
ret = der_get_oid(prefix_enc->elements, prefix_enc->length,
|
||||
&prefix, NULL);
|
||||
if (ret) {
|
||||
der_free_oid(&oid);
|
||||
return 0;
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
|
||||
if (oid.length - 1 == prefix.length) {
|
||||
*suffix = oid.components[oid.length - 1];
|
||||
oid.length--;
|
||||
ret = (der_heim_oid_cmp(&oid, &prefix) == 0);
|
||||
oid.length++;
|
||||
}
|
||||
|
||||
der_free_oid(&oid);
|
||||
der_free_oid(&prefix);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static OM_uint32 inquire_sec_context_tkt_flags
|
||||
(OM_uint32 *minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
gss_buffer_set_t *data_set)
|
||||
{
|
||||
OM_uint32 tkt_flags;
|
||||
unsigned char buf[4];
|
||||
gss_buffer_desc value;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
|
||||
if (context_handle->ticket == NULL) {
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
_gsskrb5_set_status(EINVAL, "No ticket from which to obtain flags");
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_BAD_MECH;
|
||||
}
|
||||
|
||||
tkt_flags = TicketFlags2int(context_handle->ticket->ticket.flags);
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
|
||||
_gsskrb5_encode_om_uint32(tkt_flags, buf);
|
||||
value.length = sizeof(buf);
|
||||
value.value = buf;
|
||||
|
||||
return gss_add_buffer_set_member(minor_status,
|
||||
&value,
|
||||
data_set);
|
||||
}
|
||||
|
||||
enum keytype { ACCEPTOR_KEY, INITIATOR_KEY, TOKEN_KEY };
|
||||
|
||||
static OM_uint32 inquire_sec_context_get_subkey
|
||||
(OM_uint32 *minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
krb5_context context,
|
||||
enum keytype keytype,
|
||||
gss_buffer_set_t *data_set)
|
||||
{
|
||||
krb5_keyblock *key = NULL;
|
||||
krb5_storage *sp = NULL;
|
||||
krb5_data data;
|
||||
OM_uint32 maj_stat = GSS_S_COMPLETE;
|
||||
krb5_error_code ret;
|
||||
|
||||
krb5_data_zero(&data);
|
||||
|
||||
sp = krb5_storage_emem();
|
||||
if (sp == NULL) {
|
||||
_gsskrb5_clear_status();
|
||||
ret = ENOMEM;
|
||||
goto out;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
switch(keytype) {
|
||||
case ACCEPTOR_KEY:
|
||||
ret = _gsskrb5i_get_acceptor_subkey(context_handle, context, &key);
|
||||
break;
|
||||
case INITIATOR_KEY:
|
||||
ret = _gsskrb5i_get_initiator_subkey(context_handle, context, &key);
|
||||
break;
|
||||
case TOKEN_KEY:
|
||||
ret = _gsskrb5i_get_token_key(context_handle, context, &key);
|
||||
break;
|
||||
default:
|
||||
_gsskrb5_set_status(EINVAL, "%d is not a valid subkey type", keytype);
|
||||
ret = EINVAL;
|
||||
break;
|
||||
}
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
if (ret)
|
||||
goto out;
|
||||
if (key == NULL) {
|
||||
_gsskrb5_set_status(EINVAL, "have no subkey of type %d", keytype);
|
||||
ret = EINVAL;
|
||||
goto out;
|
||||
}
|
||||
|
||||
ret = krb5_store_keyblock(sp, *key);
|
||||
krb5_free_keyblock (context, key);
|
||||
if (ret)
|
||||
goto out;
|
||||
|
||||
ret = krb5_storage_to_data(sp, &data);
|
||||
if (ret)
|
||||
goto out;
|
||||
|
||||
{
|
||||
gss_buffer_desc value;
|
||||
|
||||
value.length = data.length;
|
||||
value.value = data.data;
|
||||
|
||||
maj_stat = gss_add_buffer_set_member(minor_status,
|
||||
&value,
|
||||
data_set);
|
||||
}
|
||||
|
||||
out:
|
||||
krb5_data_free(&data);
|
||||
if (sp)
|
||||
krb5_storage_free(sp);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
maj_stat = GSS_S_FAILURE;
|
||||
}
|
||||
return maj_stat;
|
||||
}
|
||||
|
||||
static OM_uint32 inquire_sec_context_authz_data
|
||||
(OM_uint32 *minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
krb5_context context,
|
||||
unsigned ad_type,
|
||||
gss_buffer_set_t *data_set)
|
||||
{
|
||||
krb5_data data;
|
||||
gss_buffer_desc ad_data;
|
||||
OM_uint32 ret;
|
||||
|
||||
*minor_status = 0;
|
||||
*data_set = GSS_C_NO_BUFFER_SET;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
if (context_handle->ticket == NULL) {
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
*minor_status = EINVAL;
|
||||
_gsskrb5_set_status(EINVAL, "No ticket to obtain authz data from");
|
||||
return GSS_S_NO_CONTEXT;
|
||||
}
|
||||
|
||||
ret = krb5_ticket_get_authorization_data_type(context,
|
||||
context_handle->ticket,
|
||||
ad_type,
|
||||
&data);
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ad_data.value = data.data;
|
||||
ad_data.length = data.length;
|
||||
|
||||
ret = gss_add_buffer_set_member(minor_status,
|
||||
&ad_data,
|
||||
data_set);
|
||||
|
||||
krb5_data_free(&data);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static OM_uint32 inquire_sec_context_has_updated_spnego
|
||||
(OM_uint32 *minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
gss_buffer_set_t *data_set)
|
||||
{
|
||||
int is_updated = 0;
|
||||
|
||||
*minor_status = 0;
|
||||
*data_set = GSS_C_NO_BUFFER_SET;
|
||||
|
||||
/*
|
||||
* For Windows SPNEGO implementations, both the initiator and the
|
||||
* acceptor are assumed to have been updated if a "newer" [CLAR] or
|
||||
* different enctype is negotiated for use by the Kerberos GSS-API
|
||||
* mechanism.
|
||||
*/
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
is_updated = (context_handle->more_flags & IS_CFX);
|
||||
if (is_updated == 0) {
|
||||
krb5_keyblock *acceptor_subkey;
|
||||
|
||||
if (context_handle->more_flags & LOCAL)
|
||||
acceptor_subkey = context_handle->auth_context->remote_subkey;
|
||||
else
|
||||
acceptor_subkey = context_handle->auth_context->local_subkey;
|
||||
|
||||
if (acceptor_subkey != NULL)
|
||||
is_updated = (acceptor_subkey->keytype !=
|
||||
context_handle->auth_context->keyblock->keytype);
|
||||
}
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
|
||||
return is_updated ? GSS_S_COMPLETE : GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
*/
|
||||
|
||||
static OM_uint32
|
||||
export_lucid_sec_context_v1(OM_uint32 *minor_status,
|
||||
gsskrb5_ctx context_handle,
|
||||
krb5_context context,
|
||||
gss_buffer_set_t *data_set)
|
||||
{
|
||||
krb5_storage *sp = NULL;
|
||||
OM_uint32 major_status = GSS_S_COMPLETE;
|
||||
krb5_error_code ret;
|
||||
krb5_keyblock *key = NULL;
|
||||
int32_t number;
|
||||
int is_cfx;
|
||||
krb5_data data;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
|
||||
is_cfx = (context_handle->more_flags & IS_CFX);
|
||||
|
||||
sp = krb5_storage_emem();
|
||||
if (sp == NULL) {
|
||||
_gsskrb5_clear_status();
|
||||
ret = ENOMEM;
|
||||
goto out;
|
||||
}
|
||||
|
||||
ret = krb5_store_int32(sp, 1);
|
||||
if (ret) goto out;
|
||||
ret = krb5_store_int32(sp, (context_handle->more_flags & LOCAL) ? 1 : 0);
|
||||
if (ret) goto out;
|
||||
ret = krb5_store_int32(sp, context_handle->lifetime);
|
||||
if (ret) goto out;
|
||||
krb5_auth_con_getlocalseqnumber (context,
|
||||
context_handle->auth_context,
|
||||
&number);
|
||||
ret = krb5_store_uint32(sp, (uint32_t)0); /* store top half as zero */
|
||||
if (ret) goto out;
|
||||
ret = krb5_store_uint32(sp, (uint32_t)number);
|
||||
if (ret) goto out;
|
||||
krb5_auth_con_getremoteseqnumber (context,
|
||||
context_handle->auth_context,
|
||||
&number);
|
||||
ret = krb5_store_uint32(sp, (uint32_t)0); /* store top half as zero */
|
||||
if (ret) goto out;
|
||||
ret = krb5_store_uint32(sp, (uint32_t)number);
|
||||
if (ret) goto out;
|
||||
ret = krb5_store_int32(sp, (is_cfx) ? 1 : 0);
|
||||
if (ret) goto out;
|
||||
|
||||
ret = _gsskrb5i_get_token_key(context_handle, context, &key);
|
||||
if (ret) goto out;
|
||||
|
||||
if (is_cfx == 0) {
|
||||
int sign_alg, seal_alg;
|
||||
|
||||
switch (key->keytype) {
|
||||
case ETYPE_DES_CBC_CRC:
|
||||
case ETYPE_DES_CBC_MD4:
|
||||
case ETYPE_DES_CBC_MD5:
|
||||
sign_alg = 0;
|
||||
seal_alg = 0;
|
||||
break;
|
||||
case ETYPE_DES3_CBC_MD5:
|
||||
case ETYPE_DES3_CBC_SHA1:
|
||||
sign_alg = 4;
|
||||
seal_alg = 2;
|
||||
break;
|
||||
case ETYPE_ARCFOUR_HMAC_MD5:
|
||||
case ETYPE_ARCFOUR_HMAC_MD5_56:
|
||||
sign_alg = 17;
|
||||
seal_alg = 16;
|
||||
break;
|
||||
default:
|
||||
sign_alg = -1;
|
||||
seal_alg = -1;
|
||||
break;
|
||||
}
|
||||
ret = krb5_store_int32(sp, sign_alg);
|
||||
if (ret) goto out;
|
||||
ret = krb5_store_int32(sp, seal_alg);
|
||||
if (ret) goto out;
|
||||
/* ctx_key */
|
||||
ret = krb5_store_keyblock(sp, *key);
|
||||
if (ret) goto out;
|
||||
} else {
|
||||
int subkey_p = (context_handle->more_flags & ACCEPTOR_SUBKEY) ? 1 : 0;
|
||||
|
||||
/* have_acceptor_subkey */
|
||||
ret = krb5_store_int32(sp, subkey_p);
|
||||
if (ret) goto out;
|
||||
/* ctx_key */
|
||||
ret = krb5_store_keyblock(sp, *key);
|
||||
if (ret) goto out;
|
||||
/* acceptor_subkey */
|
||||
if (subkey_p) {
|
||||
ret = krb5_store_keyblock(sp, *key);
|
||||
if (ret) goto out;
|
||||
}
|
||||
}
|
||||
ret = krb5_storage_to_data(sp, &data);
|
||||
if (ret) goto out;
|
||||
|
||||
{
|
||||
gss_buffer_desc ad_data;
|
||||
|
||||
ad_data.value = data.data;
|
||||
ad_data.length = data.length;
|
||||
|
||||
ret = gss_add_buffer_set_member(minor_status, &ad_data, data_set);
|
||||
krb5_data_free(&data);
|
||||
if (ret)
|
||||
goto out;
|
||||
}
|
||||
|
||||
out:
|
||||
if (key)
|
||||
krb5_free_keyblock (context, key);
|
||||
if (sp)
|
||||
krb5_storage_free(sp);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
major_status = GSS_S_FAILURE;
|
||||
}
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return major_status;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
get_authtime(OM_uint32 *minor_status,
|
||||
gsskrb5_ctx ctx,
|
||||
gss_buffer_set_t *data_set)
|
||||
|
||||
{
|
||||
gss_buffer_desc value;
|
||||
unsigned char buf[4];
|
||||
OM_uint32 authtime;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
if (ctx->ticket == NULL) {
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
_gsskrb5_set_status(EINVAL, "No ticket to obtain auth time from");
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
authtime = ctx->ticket->ticket.authtime;
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
|
||||
_gsskrb5_encode_om_uint32(authtime, buf);
|
||||
value.length = sizeof(buf);
|
||||
value.value = buf;
|
||||
|
||||
return gss_add_buffer_set_member(minor_status,
|
||||
&value,
|
||||
data_set);
|
||||
}
|
||||
|
||||
|
||||
static OM_uint32
|
||||
get_service_keyblock
|
||||
(OM_uint32 *minor_status,
|
||||
gsskrb5_ctx ctx,
|
||||
gss_buffer_set_t *data_set)
|
||||
{
|
||||
krb5_storage *sp = NULL;
|
||||
krb5_data data;
|
||||
OM_uint32 maj_stat = GSS_S_COMPLETE;
|
||||
krb5_error_code ret = EINVAL;
|
||||
|
||||
sp = krb5_storage_emem();
|
||||
if (sp == NULL) {
|
||||
_gsskrb5_clear_status();
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
if (ctx->service_keyblock == NULL) {
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
krb5_storage_free(sp);
|
||||
_gsskrb5_set_status(EINVAL, "No service keyblock on gssapi context");
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
krb5_data_zero(&data);
|
||||
|
||||
ret = krb5_store_keyblock(sp, *ctx->service_keyblock);
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
|
||||
if (ret)
|
||||
goto out;
|
||||
|
||||
ret = krb5_storage_to_data(sp, &data);
|
||||
if (ret)
|
||||
goto out;
|
||||
|
||||
{
|
||||
gss_buffer_desc value;
|
||||
|
||||
value.length = data.length;
|
||||
value.value = data.data;
|
||||
|
||||
maj_stat = gss_add_buffer_set_member(minor_status,
|
||||
&value,
|
||||
data_set);
|
||||
}
|
||||
|
||||
out:
|
||||
krb5_data_free(&data);
|
||||
if (sp)
|
||||
krb5_storage_free(sp);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
maj_stat = GSS_S_FAILURE;
|
||||
}
|
||||
return maj_stat;
|
||||
}
|
||||
/*
|
||||
*
|
||||
*/
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_sec_context_by_oid
|
||||
(OM_uint32 *minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
const gss_OID desired_object,
|
||||
gss_buffer_set_t *data_set)
|
||||
{
|
||||
krb5_context context;
|
||||
const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
|
||||
unsigned suffix;
|
||||
|
||||
if (ctx == NULL) {
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_NO_CONTEXT;
|
||||
}
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (gss_oid_equal(desired_object, GSS_KRB5_GET_TKT_FLAGS_X)) {
|
||||
return inquire_sec_context_tkt_flags(minor_status,
|
||||
ctx,
|
||||
data_set);
|
||||
} else if (gss_oid_equal(desired_object, GSS_C_PEER_HAS_UPDATED_SPNEGO)) {
|
||||
return inquire_sec_context_has_updated_spnego(minor_status,
|
||||
ctx,
|
||||
data_set);
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_GET_SUBKEY_X)) {
|
||||
return inquire_sec_context_get_subkey(minor_status,
|
||||
ctx,
|
||||
context,
|
||||
TOKEN_KEY,
|
||||
data_set);
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_GET_INITIATOR_SUBKEY_X)) {
|
||||
return inquire_sec_context_get_subkey(minor_status,
|
||||
ctx,
|
||||
context,
|
||||
INITIATOR_KEY,
|
||||
data_set);
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_GET_ACCEPTOR_SUBKEY_X)) {
|
||||
return inquire_sec_context_get_subkey(minor_status,
|
||||
ctx,
|
||||
context,
|
||||
ACCEPTOR_KEY,
|
||||
data_set);
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_GET_AUTHTIME_X)) {
|
||||
return get_authtime(minor_status, ctx, data_set);
|
||||
} else if (oid_prefix_equal(desired_object,
|
||||
GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_X,
|
||||
&suffix)) {
|
||||
return inquire_sec_context_authz_data(minor_status,
|
||||
ctx,
|
||||
context,
|
||||
suffix,
|
||||
data_set);
|
||||
} else if (oid_prefix_equal(desired_object,
|
||||
GSS_KRB5_EXPORT_LUCID_CONTEXT_X,
|
||||
&suffix)) {
|
||||
if (suffix == 1)
|
||||
return export_lucid_sec_context_v1(minor_status,
|
||||
ctx,
|
||||
context,
|
||||
data_set);
|
||||
*minor_status = 0;
|
||||
return GSS_S_FAILURE;
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_GET_SERVICE_KEYBLOCK_X)) {
|
||||
return get_service_keyblock(minor_status, ctx, data_set);
|
||||
} else {
|
||||
*minor_status = 0;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,144 @@
|
||||
/* $NetBSD: prf.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2007 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_pseudo_random(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
int prf_key,
|
||||
const gss_buffer_t prf_in,
|
||||
ssize_t desired_output_len,
|
||||
gss_buffer_t prf_out)
|
||||
{
|
||||
gsskrb5_ctx ctx = (gsskrb5_ctx)context_handle;
|
||||
krb5_context context;
|
||||
krb5_error_code ret;
|
||||
krb5_crypto crypto;
|
||||
krb5_data input, output;
|
||||
uint32_t num;
|
||||
unsigned char *p;
|
||||
krb5_keyblock *key = NULL;
|
||||
|
||||
if (ctx == NULL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_NO_CONTEXT;
|
||||
}
|
||||
|
||||
if (desired_output_len <= 0) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
switch(prf_key) {
|
||||
case GSS_C_PRF_KEY_FULL:
|
||||
_gsskrb5i_get_acceptor_subkey(ctx, context, &key);
|
||||
break;
|
||||
case GSS_C_PRF_KEY_PARTIAL:
|
||||
_gsskrb5i_get_initiator_subkey(ctx, context, &key);
|
||||
break;
|
||||
default:
|
||||
_gsskrb5_set_status(EINVAL, "unknown kerberos prf_key");
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
if (key == NULL) {
|
||||
_gsskrb5_set_status(EINVAL, "no prf_key found");
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_crypto_init(context, key, 0, &crypto);
|
||||
krb5_free_keyblock (context, key);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
prf_out->value = malloc(desired_output_len);
|
||||
if (prf_out->value == NULL) {
|
||||
_gsskrb5_set_status(GSS_KRB5_S_KG_INPUT_TOO_LONG, "Out of memory");
|
||||
*minor_status = GSS_KRB5_S_KG_INPUT_TOO_LONG;
|
||||
krb5_crypto_destroy(context, crypto);
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
prf_out->length = desired_output_len;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
|
||||
input.length = prf_in->length + 4;
|
||||
input.data = malloc(prf_in->length + 4);
|
||||
if (input.data == NULL) {
|
||||
OM_uint32 junk;
|
||||
_gsskrb5_set_status(GSS_KRB5_S_KG_INPUT_TOO_LONG, "Out of memory");
|
||||
*minor_status = GSS_KRB5_S_KG_INPUT_TOO_LONG;
|
||||
gss_release_buffer(&junk, prf_out);
|
||||
krb5_crypto_destroy(context, crypto);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
memcpy(((unsigned char *)input.data) + 4, prf_in->value, prf_in->length);
|
||||
|
||||
num = 0;
|
||||
p = prf_out->value;
|
||||
while(desired_output_len > 0) {
|
||||
_gsskrb5_encode_om_uint32(num, input.data);
|
||||
ret = krb5_crypto_prf(context, crypto, &input, &output);
|
||||
if (ret) {
|
||||
OM_uint32 junk;
|
||||
*minor_status = ret;
|
||||
free(input.data);
|
||||
gss_release_buffer(&junk, prf_out);
|
||||
krb5_crypto_destroy(context, crypto);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
memcpy(p, output.data, min(desired_output_len, output.length));
|
||||
p += output.length;
|
||||
desired_output_len -= output.length;
|
||||
krb5_data_free(&output);
|
||||
num++;
|
||||
}
|
||||
free(input.data);
|
||||
|
||||
krb5_crypto_destroy(context, crypto);
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
/* $NetBSD: process_context_token.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_process_context_token (
|
||||
OM_uint32 *minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
const gss_buffer_t token_buffer
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
OM_uint32 ret = GSS_S_FAILURE;
|
||||
gss_buffer_desc empty_buffer;
|
||||
|
||||
empty_buffer.length = 0;
|
||||
empty_buffer.value = NULL;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
ret = _gsskrb5_verify_mic_internal(minor_status,
|
||||
(gsskrb5_ctx)context_handle,
|
||||
context,
|
||||
token_buffer, &empty_buffer,
|
||||
GSS_C_QOP_DEFAULT, "\x01\x02");
|
||||
|
||||
if (ret == GSS_S_COMPLETE)
|
||||
ret = _gsskrb5_delete_sec_context(minor_status,
|
||||
rk_UNCONST(&context_handle),
|
||||
GSS_C_NO_BUFFER);
|
||||
if (ret == GSS_S_COMPLETE)
|
||||
*minor_status = 0;
|
||||
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
/* $NetBSD: release_buffer.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2000, 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 _gsskrb5_release_buffer
|
||||
(OM_uint32 * minor_status,
|
||||
gss_buffer_t buffer
|
||||
)
|
||||
{
|
||||
*minor_status = 0;
|
||||
free (buffer->value);
|
||||
buffer->value = NULL;
|
||||
buffer->length = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
/* $NetBSD: release_cred.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997-2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_release_cred
|
||||
(OM_uint32 * minor_status,
|
||||
gss_cred_id_t * cred_handle
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
gsskrb5_cred cred;
|
||||
OM_uint32 junk;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
if (*cred_handle == NULL)
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
cred = (gsskrb5_cred)*cred_handle;
|
||||
*cred_handle = GSS_C_NO_CREDENTIAL;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&cred->cred_id_mutex);
|
||||
|
||||
if (cred->principal != NULL)
|
||||
krb5_free_principal(context, cred->principal);
|
||||
if (cred->keytab != NULL)
|
||||
krb5_kt_close(context, cred->keytab);
|
||||
if (cred->ccache != NULL) {
|
||||
if (cred->cred_flags & GSS_CF_DESTROY_CRED_ON_RELEASE)
|
||||
krb5_cc_destroy(context, cred->ccache);
|
||||
else
|
||||
krb5_cc_close(context, cred->ccache);
|
||||
}
|
||||
gss_release_oid_set(&junk, &cred->mechanisms);
|
||||
if (cred->enctypes)
|
||||
free(cred->enctypes);
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
HEIMDAL_MUTEX_destroy(&cred->cred_id_mutex);
|
||||
memset(cred, 0, sizeof(*cred));
|
||||
free(cred);
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,55 @@
|
||||
/* $NetBSD: release_name.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_release_name
|
||||
(OM_uint32 * minor_status,
|
||||
gss_name_t * input_name
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
krb5_principal name = (krb5_principal)*input_name;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
*input_name = GSS_C_NO_NAME;
|
||||
|
||||
krb5_free_principal(context, name);
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,294 @@
|
||||
/* $NetBSD: sequence.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003 - 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
#define DEFAULT_JITTER_WINDOW 20
|
||||
|
||||
struct gss_msg_order {
|
||||
OM_uint32 flags;
|
||||
OM_uint32 start;
|
||||
OM_uint32 length;
|
||||
OM_uint32 jitter_window;
|
||||
OM_uint32 first_seq;
|
||||
OM_uint32 elem[1];
|
||||
};
|
||||
|
||||
|
||||
/*
|
||||
*
|
||||
*/
|
||||
|
||||
static OM_uint32
|
||||
msg_order_alloc(OM_uint32 *minor_status,
|
||||
struct gss_msg_order **o,
|
||||
OM_uint32 jitter_window)
|
||||
{
|
||||
size_t len;
|
||||
|
||||
len = jitter_window * sizeof((*o)->elem[0]);
|
||||
len += sizeof(**o);
|
||||
len -= sizeof((*o)->elem[0]);
|
||||
|
||||
*o = calloc(1, len);
|
||||
if (*o == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
*/
|
||||
|
||||
OM_uint32
|
||||
_gssapi_msg_order_create(OM_uint32 *minor_status,
|
||||
struct gss_msg_order **o,
|
||||
OM_uint32 flags,
|
||||
OM_uint32 seq_num,
|
||||
OM_uint32 jitter_window,
|
||||
int use_64)
|
||||
{
|
||||
OM_uint32 ret;
|
||||
|
||||
if (jitter_window == 0)
|
||||
jitter_window = DEFAULT_JITTER_WINDOW;
|
||||
|
||||
ret = msg_order_alloc(minor_status, o, jitter_window);
|
||||
if(ret != GSS_S_COMPLETE)
|
||||
return ret;
|
||||
|
||||
(*o)->flags = flags;
|
||||
(*o)->length = 0;
|
||||
(*o)->first_seq = seq_num;
|
||||
(*o)->jitter_window = jitter_window;
|
||||
(*o)->elem[0] = seq_num - 1;
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gssapi_msg_order_destroy(struct gss_msg_order **m)
|
||||
{
|
||||
free(*m);
|
||||
*m = NULL;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
static void
|
||||
elem_set(struct gss_msg_order *o, unsigned int slot, OM_uint32 val)
|
||||
{
|
||||
o->elem[slot % o->jitter_window] = val;
|
||||
}
|
||||
|
||||
static void
|
||||
elem_insert(struct gss_msg_order *o,
|
||||
unsigned int after_slot,
|
||||
OM_uint32 seq_num)
|
||||
{
|
||||
assert(o->jitter_window > after_slot);
|
||||
|
||||
if (o->length > after_slot)
|
||||
memmove(&o->elem[after_slot + 1], &o->elem[after_slot],
|
||||
(o->length - after_slot - 1) * sizeof(o->elem[0]));
|
||||
|
||||
elem_set(o, after_slot, seq_num);
|
||||
|
||||
if (o->length < o->jitter_window)
|
||||
o->length++;
|
||||
}
|
||||
|
||||
/* rule 1: expected sequence number */
|
||||
/* rule 2: > expected sequence number */
|
||||
/* rule 3: seqnum < seqnum(first) */
|
||||
/* rule 4+5: seqnum in [seqnum(first),seqnum(last)] */
|
||||
|
||||
OM_uint32
|
||||
_gssapi_msg_order_check(struct gss_msg_order *o, OM_uint32 seq_num)
|
||||
{
|
||||
OM_uint32 r;
|
||||
int i;
|
||||
|
||||
if (o == NULL)
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
if ((o->flags & (GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG)) == 0)
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
/* check if the packet is the next in order */
|
||||
if (o->elem[0] == seq_num - 1) {
|
||||
elem_insert(o, 0, seq_num);
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
r = (o->flags & (GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG))==GSS_C_REPLAY_FLAG;
|
||||
|
||||
/* sequence number larger then largest sequence number
|
||||
* or smaller then the first sequence number */
|
||||
if (seq_num > o->elem[0]
|
||||
|| seq_num < o->first_seq
|
||||
|| o->length == 0)
|
||||
{
|
||||
elem_insert(o, 0, seq_num);
|
||||
if (r) {
|
||||
return GSS_S_COMPLETE;
|
||||
} else {
|
||||
return GSS_S_GAP_TOKEN;
|
||||
}
|
||||
}
|
||||
|
||||
assert(o->length > 0);
|
||||
|
||||
/* sequence number smaller the first sequence number */
|
||||
if (seq_num < o->elem[o->length - 1]) {
|
||||
if (r)
|
||||
return(GSS_S_OLD_TOKEN);
|
||||
else
|
||||
return(GSS_S_UNSEQ_TOKEN);
|
||||
}
|
||||
|
||||
if (seq_num == o->elem[o->length - 1]) {
|
||||
return GSS_S_DUPLICATE_TOKEN;
|
||||
}
|
||||
|
||||
for (i = 0; i < o->length - 1; i++) {
|
||||
if (o->elem[i] == seq_num)
|
||||
return GSS_S_DUPLICATE_TOKEN;
|
||||
if (o->elem[i + 1] < seq_num && o->elem[i] < seq_num) {
|
||||
elem_insert(o, i, seq_num);
|
||||
if (r)
|
||||
return GSS_S_COMPLETE;
|
||||
else
|
||||
return GSS_S_UNSEQ_TOKEN;
|
||||
}
|
||||
}
|
||||
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gssapi_msg_order_f(OM_uint32 flags)
|
||||
{
|
||||
return flags & (GSS_C_SEQUENCE_FLAG|GSS_C_REPLAY_FLAG);
|
||||
}
|
||||
|
||||
/*
|
||||
* Translate `o` into inter-process format and export in to `sp'.
|
||||
*/
|
||||
|
||||
krb5_error_code
|
||||
_gssapi_msg_order_export(krb5_storage *sp, struct gss_msg_order *o)
|
||||
{
|
||||
krb5_error_code kret;
|
||||
OM_uint32 i;
|
||||
|
||||
kret = krb5_store_int32(sp, o->flags);
|
||||
if (kret)
|
||||
return kret;
|
||||
kret = krb5_store_int32(sp, o->start);
|
||||
if (kret)
|
||||
return kret;
|
||||
kret = krb5_store_int32(sp, o->length);
|
||||
if (kret)
|
||||
return kret;
|
||||
kret = krb5_store_int32(sp, o->jitter_window);
|
||||
if (kret)
|
||||
return kret;
|
||||
kret = krb5_store_int32(sp, o->first_seq);
|
||||
if (kret)
|
||||
return kret;
|
||||
|
||||
for (i = 0; i < o->jitter_window; i++) {
|
||||
kret = krb5_store_int32(sp, o->elem[i]);
|
||||
if (kret)
|
||||
return kret;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gssapi_msg_order_import(OM_uint32 *minor_status,
|
||||
krb5_storage *sp,
|
||||
struct gss_msg_order **o)
|
||||
{
|
||||
OM_uint32 ret;
|
||||
krb5_error_code kret;
|
||||
int32_t i, flags, start, length, jitter_window, first_seq;
|
||||
|
||||
kret = krb5_ret_int32(sp, &flags);
|
||||
if (kret)
|
||||
goto failed;
|
||||
kret = krb5_ret_int32(sp, &start);
|
||||
if (kret)
|
||||
goto failed;
|
||||
kret = krb5_ret_int32(sp, &length);
|
||||
if (kret)
|
||||
goto failed;
|
||||
kret = krb5_ret_int32(sp, &jitter_window);
|
||||
if (kret)
|
||||
goto failed;
|
||||
kret = krb5_ret_int32(sp, &first_seq);
|
||||
if (kret)
|
||||
goto failed;
|
||||
|
||||
ret = msg_order_alloc(minor_status, o, jitter_window);
|
||||
if (ret != GSS_S_COMPLETE)
|
||||
return ret;
|
||||
|
||||
(*o)->flags = flags;
|
||||
(*o)->start = start;
|
||||
(*o)->length = length;
|
||||
(*o)->jitter_window = jitter_window;
|
||||
(*o)->first_seq = first_seq;
|
||||
|
||||
for( i = 0; i < jitter_window; i++ ) {
|
||||
kret = krb5_ret_int32(sp, (int32_t*)&((*o)->elem[i]));
|
||||
if (kret)
|
||||
goto failed;
|
||||
}
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
failed:
|
||||
_gssapi_msg_order_destroy(o);
|
||||
*minor_status = kret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
@@ -0,0 +1,250 @@
|
||||
/* $NetBSD: set_cred_option.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2004, PADL Software Pty Ltd.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of PADL Software nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
static OM_uint32
|
||||
import_cred(OM_uint32 *minor_status,
|
||||
krb5_context context,
|
||||
gss_cred_id_t *cred_handle,
|
||||
const gss_buffer_t value)
|
||||
{
|
||||
OM_uint32 major_stat;
|
||||
krb5_error_code ret;
|
||||
krb5_principal keytab_principal = NULL;
|
||||
krb5_keytab keytab = NULL;
|
||||
krb5_storage *sp = NULL;
|
||||
krb5_ccache id = NULL;
|
||||
char *str;
|
||||
|
||||
if (cred_handle == NULL || *cred_handle != GSS_C_NO_CREDENTIAL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
sp = krb5_storage_from_mem(value->value, value->length);
|
||||
if (sp == NULL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
/* credential cache name */
|
||||
ret = krb5_ret_string(sp, &str);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
major_stat = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
if (str[0]) {
|
||||
ret = krb5_cc_resolve(context, str, &id);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
major_stat = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
free(str);
|
||||
str = NULL;
|
||||
|
||||
/* keytab principal name */
|
||||
ret = krb5_ret_string(sp, &str);
|
||||
if (ret == 0 && str[0])
|
||||
ret = krb5_parse_name(context, str, &keytab_principal);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
major_stat = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
free(str);
|
||||
str = NULL;
|
||||
|
||||
/* keytab principal */
|
||||
ret = krb5_ret_string(sp, &str);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
major_stat = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
if (str[0]) {
|
||||
ret = krb5_kt_resolve(context, str, &keytab);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
major_stat = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
free(str);
|
||||
str = NULL;
|
||||
|
||||
major_stat = _gsskrb5_krb5_import_cred(minor_status, id, keytab_principal,
|
||||
keytab, cred_handle);
|
||||
out:
|
||||
if (id)
|
||||
krb5_cc_close(context, id);
|
||||
if (keytab_principal)
|
||||
krb5_free_principal(context, keytab_principal);
|
||||
if (keytab)
|
||||
krb5_kt_close(context, keytab);
|
||||
if (str)
|
||||
free(str);
|
||||
if (sp)
|
||||
krb5_storage_free(sp);
|
||||
|
||||
return major_stat;
|
||||
}
|
||||
|
||||
|
||||
static OM_uint32
|
||||
allowed_enctypes(OM_uint32 *minor_status,
|
||||
krb5_context context,
|
||||
gss_cred_id_t *cred_handle,
|
||||
const gss_buffer_t value)
|
||||
{
|
||||
OM_uint32 major_stat;
|
||||
krb5_error_code ret;
|
||||
size_t len, i;
|
||||
krb5_enctype *enctypes = NULL;
|
||||
krb5_storage *sp = NULL;
|
||||
gsskrb5_cred cred;
|
||||
|
||||
if (cred_handle == NULL || *cred_handle == GSS_C_NO_CREDENTIAL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
cred = (gsskrb5_cred)*cred_handle;
|
||||
|
||||
if ((value->length % 4) != 0) {
|
||||
*minor_status = 0;
|
||||
major_stat = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
|
||||
len = value->length / 4;
|
||||
enctypes = malloc((len + 1) * 4);
|
||||
if (enctypes == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
major_stat = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
|
||||
sp = krb5_storage_from_mem(value->value, value->length);
|
||||
if (sp == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
major_stat = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
|
||||
for (i = 0; i < len; i++) {
|
||||
uint32_t e;
|
||||
|
||||
ret = krb5_ret_uint32(sp, &e);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
major_stat = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
enctypes[i] = e;
|
||||
}
|
||||
enctypes[i] = 0;
|
||||
|
||||
if (cred->enctypes)
|
||||
free(cred->enctypes);
|
||||
cred->enctypes = enctypes;
|
||||
|
||||
krb5_storage_free(sp);
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
out:
|
||||
if (sp)
|
||||
krb5_storage_free(sp);
|
||||
if (enctypes)
|
||||
free(enctypes);
|
||||
|
||||
return major_stat;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
no_ci_flags(OM_uint32 *minor_status,
|
||||
krb5_context context,
|
||||
gss_cred_id_t *cred_handle,
|
||||
const gss_buffer_t value)
|
||||
{
|
||||
gsskrb5_cred cred;
|
||||
|
||||
if (cred_handle == NULL || *cred_handle == GSS_C_NO_CREDENTIAL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
cred = (gsskrb5_cred)*cred_handle;
|
||||
cred->cred_flags |= GSS_CF_NO_CI_FLAGS;
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
}
|
||||
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_set_cred_option
|
||||
(OM_uint32 *minor_status,
|
||||
gss_cred_id_t *cred_handle,
|
||||
const gss_OID desired_object,
|
||||
const gss_buffer_t value)
|
||||
{
|
||||
krb5_context context;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (value == GSS_C_NO_BUFFER) {
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
if (gss_oid_equal(desired_object, GSS_KRB5_IMPORT_CRED_X))
|
||||
return import_cred(minor_status, context, cred_handle, value);
|
||||
|
||||
if (gss_oid_equal(desired_object, GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X))
|
||||
return allowed_enctypes(minor_status, context, cred_handle, value);
|
||||
|
||||
if (gss_oid_equal(desired_object, GSS_KRB5_CRED_NO_CI_FLAGS_X)) {
|
||||
return no_ci_flags(minor_status, context, cred_handle, value);
|
||||
}
|
||||
|
||||
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
@@ -0,0 +1,263 @@
|
||||
/* $NetBSD: set_sec_context_option.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2004, PADL Software Pty Ltd.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of PADL Software nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/*
|
||||
* glue routine for _gsskrb5_inquire_sec_context_by_oid
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
static OM_uint32
|
||||
get_bool(OM_uint32 *minor_status,
|
||||
const gss_buffer_t value,
|
||||
int *flag)
|
||||
{
|
||||
if (value->value == NULL || value->length != 1) {
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
*flag = *((const char *)value->value) != 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
get_string(OM_uint32 *minor_status,
|
||||
const gss_buffer_t value,
|
||||
char **str)
|
||||
{
|
||||
if (value == NULL || value->length == 0) {
|
||||
*str = NULL;
|
||||
} else {
|
||||
*str = malloc(value->length + 1);
|
||||
if (*str == NULL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_UNAVAILABLE;
|
||||
}
|
||||
memcpy(*str, value->value, value->length);
|
||||
(*str)[value->length] = '\0';
|
||||
}
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
get_int32(OM_uint32 *minor_status,
|
||||
const gss_buffer_t value,
|
||||
OM_uint32 *ret)
|
||||
{
|
||||
*minor_status = 0;
|
||||
if (value == NULL || value->length == 0)
|
||||
*ret = 0;
|
||||
else if (value->length == sizeof(*ret))
|
||||
memcpy(ret, value->value, sizeof(*ret));
|
||||
else
|
||||
return GSS_S_UNAVAILABLE;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
set_int32(OM_uint32 *minor_status,
|
||||
const gss_buffer_t value,
|
||||
OM_uint32 set)
|
||||
{
|
||||
*minor_status = 0;
|
||||
if (value->length == sizeof(set))
|
||||
memcpy(value->value, &set, sizeof(set));
|
||||
else
|
||||
return GSS_S_UNAVAILABLE;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_set_sec_context_option
|
||||
(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t *context_handle,
|
||||
const gss_OID desired_object,
|
||||
const gss_buffer_t value)
|
||||
{
|
||||
krb5_context context;
|
||||
OM_uint32 maj_stat;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (value == GSS_C_NO_BUFFER) {
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
if (gss_oid_equal(desired_object, GSS_KRB5_COMPAT_DES3_MIC_X)) {
|
||||
gsskrb5_ctx ctx;
|
||||
int flag;
|
||||
|
||||
if (*context_handle == GSS_C_NO_CONTEXT) {
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_NO_CONTEXT;
|
||||
}
|
||||
|
||||
maj_stat = get_bool(minor_status, value, &flag);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
return maj_stat;
|
||||
|
||||
ctx = (gsskrb5_ctx)*context_handle;
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
if (flag)
|
||||
ctx->more_flags |= COMPAT_OLD_DES3;
|
||||
else
|
||||
ctx->more_flags &= ~COMPAT_OLD_DES3;
|
||||
ctx->more_flags |= COMPAT_OLD_DES3_SELECTED;
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
return GSS_S_COMPLETE;
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_SET_DNS_CANONICALIZE_X)) {
|
||||
int flag;
|
||||
|
||||
maj_stat = get_bool(minor_status, value, &flag);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
return maj_stat;
|
||||
|
||||
krb5_set_dns_canonicalize_hostname(context, flag);
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X)) {
|
||||
char *str;
|
||||
|
||||
maj_stat = get_string(minor_status, value, &str);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
return maj_stat;
|
||||
|
||||
_gsskrb5_register_acceptor_identity(str);
|
||||
free(str);
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_SET_DEFAULT_REALM_X)) {
|
||||
char *str;
|
||||
|
||||
maj_stat = get_string(minor_status, value, &str);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
return maj_stat;
|
||||
if (str == NULL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_CALL_INACCESSIBLE_READ;
|
||||
}
|
||||
|
||||
krb5_set_default_realm(context, str);
|
||||
free(str);
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_SEND_TO_KDC_X)) {
|
||||
|
||||
if (value == NULL || value->length == 0) {
|
||||
krb5_set_send_to_kdc_func(context, NULL, NULL);
|
||||
} else {
|
||||
struct gsskrb5_send_to_kdc c;
|
||||
|
||||
if (value->length != sizeof(c)) {
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
memcpy(&c, value->value, sizeof(c));
|
||||
krb5_set_send_to_kdc_func(context,
|
||||
(krb5_send_to_kdc_func)c.func,
|
||||
c.ptr);
|
||||
}
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_CCACHE_NAME_X)) {
|
||||
char *str;
|
||||
|
||||
maj_stat = get_string(minor_status, value, &str);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
return maj_stat;
|
||||
if (str == NULL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_CALL_INACCESSIBLE_READ;
|
||||
}
|
||||
|
||||
*minor_status = krb5_cc_set_default_name(context, str);
|
||||
free(str);
|
||||
if (*minor_status)
|
||||
return GSS_S_FAILURE;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_SET_TIME_OFFSET_X)) {
|
||||
OM_uint32 offset;
|
||||
time_t t;
|
||||
|
||||
maj_stat = get_int32(minor_status, value, &offset);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
return maj_stat;
|
||||
|
||||
t = time(NULL) + offset;
|
||||
|
||||
krb5_set_real_time(context, t, 0);
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_GET_TIME_OFFSET_X)) {
|
||||
krb5_timestamp sec;
|
||||
int32_t usec;
|
||||
time_t t;
|
||||
|
||||
t = time(NULL);
|
||||
|
||||
krb5_us_timeofday (context, &sec, &usec);
|
||||
|
||||
maj_stat = set_int32(minor_status, value, sec - t);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
return maj_stat;
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
} else if (gss_oid_equal(desired_object, GSS_KRB5_PLUGIN_REGISTER_X)) {
|
||||
struct gsskrb5_krb5_plugin c;
|
||||
|
||||
if (value->length != sizeof(c)) {
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
memcpy(&c, value->value, sizeof(c));
|
||||
krb5_plugin_register(context, c.type, c.name, c.symbol);
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
@@ -0,0 +1,118 @@
|
||||
/* $NetBSD: store_cred.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_store_cred(OM_uint32 *minor_status,
|
||||
gss_cred_id_t input_cred_handle,
|
||||
gss_cred_usage_t cred_usage,
|
||||
const gss_OID desired_mech,
|
||||
OM_uint32 overwrite_cred,
|
||||
OM_uint32 default_cred,
|
||||
gss_OID_set *elements_stored,
|
||||
gss_cred_usage_t *cred_usage_stored)
|
||||
{
|
||||
krb5_context context;
|
||||
krb5_error_code ret;
|
||||
gsskrb5_cred cred;
|
||||
krb5_ccache id;
|
||||
int destroy = 0;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
if (cred_usage != GSS_C_INITIATE) {
|
||||
*minor_status = GSS_KRB5_S_G_BAD_USAGE;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
if (gss_oid_equal(desired_mech, GSS_KRB5_MECHANISM) == 0)
|
||||
return GSS_S_BAD_MECH;
|
||||
|
||||
cred = (gsskrb5_cred)input_cred_handle;
|
||||
if (cred == NULL)
|
||||
return GSS_S_NO_CRED;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&cred->cred_id_mutex);
|
||||
if (cred->usage != cred_usage && cred->usage != GSS_C_BOTH) {
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
*minor_status = GSS_KRB5_S_G_BAD_USAGE;
|
||||
return(GSS_S_FAILURE);
|
||||
}
|
||||
|
||||
if (cred->principal == NULL) {
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
*minor_status = GSS_KRB5_S_KG_TGT_MISSING;
|
||||
return(GSS_S_FAILURE);
|
||||
}
|
||||
|
||||
/* write out cred to credential cache */
|
||||
|
||||
ret = krb5_cc_cache_match(context, cred->principal, &id);
|
||||
if (ret) {
|
||||
ret = krb5_cc_new_unique(context, NULL, NULL, &id);
|
||||
if (ret) {
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
*minor_status = ret;
|
||||
return(GSS_S_FAILURE);
|
||||
}
|
||||
destroy = 1;
|
||||
}
|
||||
|
||||
ret = krb5_cc_initialize(context, id, cred->principal);
|
||||
if (ret == 0)
|
||||
ret = krb5_cc_copy_match_f(context, cred->ccache, id, NULL, NULL, NULL);
|
||||
if (ret) {
|
||||
if (destroy)
|
||||
krb5_cc_destroy(context, id);
|
||||
else
|
||||
krb5_cc_close(context, id);
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
*minor_status = ret;
|
||||
return(GSS_S_FAILURE);
|
||||
}
|
||||
|
||||
if (default_cred)
|
||||
krb5_cc_switch(context, id);
|
||||
|
||||
krb5_cc_close(context, id);
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,164 @@
|
||||
/* $NetBSD: test_acquire_cred.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003-2005 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of KTH nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
|
||||
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
||||
* BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
#include <err.h>
|
||||
|
||||
static void
|
||||
print_time(OM_uint32 time_rec)
|
||||
{
|
||||
if (time_rec == GSS_C_INDEFINITE) {
|
||||
printf("cred never expire\n");
|
||||
} else {
|
||||
time_t t = time_rec + time(NULL);
|
||||
printf("expiration time: %s", ctime(&t));
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
test_add(gss_cred_id_t cred_handle)
|
||||
{
|
||||
OM_uint32 major_status, minor_status;
|
||||
gss_cred_id_t copy_cred;
|
||||
OM_uint32 time_rec;
|
||||
|
||||
major_status = gss_add_cred (&minor_status,
|
||||
cred_handle,
|
||||
GSS_C_NO_NAME,
|
||||
GSS_KRB5_MECHANISM,
|
||||
GSS_C_INITIATE,
|
||||
0,
|
||||
0,
|
||||
©_cred,
|
||||
NULL,
|
||||
&time_rec,
|
||||
NULL);
|
||||
|
||||
if (GSS_ERROR(major_status))
|
||||
errx(1, "add_cred failed");
|
||||
|
||||
print_time(time_rec);
|
||||
|
||||
major_status = gss_release_cred(&minor_status,
|
||||
©_cred);
|
||||
if (GSS_ERROR(major_status))
|
||||
errx(1, "release_cred failed");
|
||||
}
|
||||
|
||||
static void
|
||||
copy_cred(void)
|
||||
{
|
||||
OM_uint32 major_status, minor_status;
|
||||
gss_cred_id_t cred_handle;
|
||||
OM_uint32 time_rec;
|
||||
|
||||
major_status = gss_acquire_cred(&minor_status,
|
||||
GSS_C_NO_NAME,
|
||||
0,
|
||||
NULL,
|
||||
GSS_C_INITIATE,
|
||||
&cred_handle,
|
||||
NULL,
|
||||
&time_rec);
|
||||
if (GSS_ERROR(major_status))
|
||||
errx(1, "acquire_cred failed");
|
||||
|
||||
print_time(time_rec);
|
||||
|
||||
test_add(cred_handle);
|
||||
test_add(cred_handle);
|
||||
test_add(cred_handle);
|
||||
|
||||
major_status = gss_release_cred(&minor_status,
|
||||
&cred_handle);
|
||||
if (GSS_ERROR(major_status))
|
||||
errx(1, "release_cred failed");
|
||||
}
|
||||
|
||||
static void
|
||||
acquire_cred_service(const char *service)
|
||||
{
|
||||
OM_uint32 major_status, minor_status;
|
||||
gss_cred_id_t cred_handle;
|
||||
OM_uint32 time_rec;
|
||||
gss_buffer_desc name_buffer;
|
||||
gss_name_t name;
|
||||
|
||||
name_buffer.value = rk_UNCONST(service);
|
||||
name_buffer.length = strlen(service);
|
||||
|
||||
major_status = gss_import_name(&minor_status,
|
||||
&name_buffer,
|
||||
GSS_C_NT_HOSTBASED_SERVICE,
|
||||
&name);
|
||||
if (GSS_ERROR(major_status))
|
||||
errx(1, "import_name failed");
|
||||
|
||||
|
||||
major_status = gss_acquire_cred(&minor_status,
|
||||
name,
|
||||
0,
|
||||
NULL,
|
||||
GSS_C_ACCEPT,
|
||||
&cred_handle,
|
||||
NULL,
|
||||
&time_rec);
|
||||
if (GSS_ERROR(major_status))
|
||||
errx(1, "acquire_cred failed");
|
||||
|
||||
print_time(time_rec);
|
||||
|
||||
major_status = gss_release_cred(&minor_status,
|
||||
&cred_handle);
|
||||
if (GSS_ERROR(major_status))
|
||||
errx(1, "release_cred failed");
|
||||
|
||||
|
||||
major_status = gss_release_name(&minor_status,
|
||||
&name);
|
||||
if (GSS_ERROR(major_status))
|
||||
errx(1, "release_name failed");
|
||||
|
||||
}
|
||||
|
||||
int
|
||||
main(int argc, char **argv)
|
||||
{
|
||||
copy_cred();
|
||||
|
||||
acquire_cred_service("host@xen2-heimdal-linux.lab.it.su.se");
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,175 @@
|
||||
/* $NetBSD: test_cfx.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of KTH nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
|
||||
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
||||
* BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
struct range {
|
||||
size_t lower;
|
||||
size_t upper;
|
||||
};
|
||||
|
||||
struct range tests[] = {
|
||||
{ 0, 1040 },
|
||||
{ 2040, 2080 },
|
||||
{ 4080, 5000 },
|
||||
{ 8180, 8292 },
|
||||
{ 9980, 10010 }
|
||||
};
|
||||
|
||||
static void
|
||||
test_range(const struct range *r, int integ,
|
||||
krb5_context context, krb5_crypto crypto)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
size_t size, rsize;
|
||||
struct gsskrb5_ctx ctx;
|
||||
|
||||
for (size = r->lower; size < r->upper; size++) {
|
||||
size_t cksumsize;
|
||||
uint16_t padsize;
|
||||
OM_uint32 minor;
|
||||
OM_uint32 max_wrap_size;
|
||||
|
||||
ctx.crypto = crypto;
|
||||
|
||||
ret = _gssapi_wrap_size_cfx(&minor,
|
||||
&ctx,
|
||||
context,
|
||||
integ,
|
||||
0,
|
||||
size,
|
||||
&max_wrap_size);
|
||||
if (ret)
|
||||
krb5_errx(context, 1, "_gsskrb5cfx_max_wrap_length_cfx: %d", ret);
|
||||
if (max_wrap_size == 0)
|
||||
continue;
|
||||
|
||||
ret = _gsskrb5cfx_wrap_length_cfx(context,
|
||||
crypto,
|
||||
integ,
|
||||
0,
|
||||
max_wrap_size,
|
||||
&rsize, &cksumsize, &padsize);
|
||||
if (ret)
|
||||
krb5_errx(context, 1, "_gsskrb5cfx_wrap_length_cfx: %d", ret);
|
||||
|
||||
if (size < rsize)
|
||||
krb5_errx(context, 1,
|
||||
"size (%d) < rsize (%d) for max_wrap_size %d",
|
||||
(int)size, (int)rsize, (int)max_wrap_size);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
test_special(krb5_context context, krb5_crypto crypto,
|
||||
int integ, size_t testsize)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
size_t rsize;
|
||||
OM_uint32 max_wrap_size;
|
||||
size_t cksumsize;
|
||||
uint16_t padsize;
|
||||
struct gsskrb5_ctx ctx;
|
||||
OM_uint32 minor;
|
||||
|
||||
ctx.crypto = crypto;
|
||||
|
||||
ret = _gssapi_wrap_size_cfx(&minor,
|
||||
&ctx,
|
||||
context,
|
||||
integ,
|
||||
0,
|
||||
testsize,
|
||||
&max_wrap_size);
|
||||
if (ret)
|
||||
krb5_errx(context, 1, "_gsskrb5cfx_max_wrap_length_cfx: %d", ret);
|
||||
if (ret)
|
||||
krb5_errx(context, 1, "_gsskrb5cfx_max_wrap_length_cfx: %d", ret);
|
||||
|
||||
ret = _gsskrb5cfx_wrap_length_cfx(context,
|
||||
crypto,
|
||||
integ,
|
||||
0,
|
||||
max_wrap_size,
|
||||
&rsize, &cksumsize, &padsize);
|
||||
if (ret)
|
||||
krb5_errx(context, 1, "_gsskrb5cfx_wrap_length_cfx: %d", ret);
|
||||
|
||||
if (testsize < rsize)
|
||||
krb5_errx(context, 1,
|
||||
"testsize (%d) < rsize (%d) for max_wrap_size %d",
|
||||
(int)testsize, (int)rsize, (int)max_wrap_size);
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
int
|
||||
main(int argc, char **argv)
|
||||
{
|
||||
krb5_keyblock keyblock;
|
||||
krb5_error_code ret;
|
||||
krb5_context context;
|
||||
krb5_crypto crypto;
|
||||
int i;
|
||||
|
||||
ret = krb5_init_context(&context);
|
||||
if (ret)
|
||||
errx(1, "krb5_context_init: %d", ret);
|
||||
|
||||
ret = krb5_generate_random_keyblock(context,
|
||||
ENCTYPE_AES256_CTS_HMAC_SHA1_96,
|
||||
&keyblock);
|
||||
if (ret)
|
||||
krb5_err(context, 1, ret, "krb5_generate_random_keyblock");
|
||||
|
||||
ret = krb5_crypto_init(context, &keyblock, 0, &crypto);
|
||||
if (ret)
|
||||
krb5_err(context, 1, ret, "krb5_crypto_init");
|
||||
|
||||
test_special(context, crypto, 1, 60);
|
||||
test_special(context, crypto, 0, 60);
|
||||
|
||||
for (i = 0; i < sizeof(tests)/sizeof(tests[0]); i++) {
|
||||
test_range(&tests[i], 1, context, crypto);
|
||||
test_range(&tests[i], 0, context, crypto);
|
||||
}
|
||||
|
||||
krb5_free_keyblock_contents(context, &keyblock);
|
||||
krb5_crypto_destroy(context, crypto);
|
||||
krb5_free_context(context);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,219 @@
|
||||
/* $NetBSD: test_cred.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003-2004 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of KTH nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
|
||||
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
||||
* BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
#include <err.h>
|
||||
#include <krb5/getarg.h>
|
||||
|
||||
static void
|
||||
gss_print_errors (int min_stat)
|
||||
{
|
||||
OM_uint32 new_stat;
|
||||
OM_uint32 msg_ctx = 0;
|
||||
gss_buffer_desc status_string;
|
||||
OM_uint32 ret;
|
||||
|
||||
do {
|
||||
ret = gss_display_status (&new_stat,
|
||||
min_stat,
|
||||
GSS_C_MECH_CODE,
|
||||
GSS_C_NO_OID,
|
||||
&msg_ctx,
|
||||
&status_string);
|
||||
fprintf (stderr, "%.*s\n", (int)status_string.length,
|
||||
(char *)status_string.value);
|
||||
gss_release_buffer (&new_stat, &status_string);
|
||||
} while (!GSS_ERROR(ret) && msg_ctx != 0);
|
||||
}
|
||||
|
||||
static void
|
||||
gss_err(int exitval, int status, const char *fmt, ...)
|
||||
{
|
||||
va_list args;
|
||||
|
||||
va_start(args, fmt);
|
||||
vwarnx (fmt, args);
|
||||
gss_print_errors (status);
|
||||
va_end(args);
|
||||
exit (exitval);
|
||||
}
|
||||
|
||||
static void
|
||||
acquire_release_loop(gss_name_t name, int counter, gss_cred_usage_t usage)
|
||||
{
|
||||
OM_uint32 maj_stat, min_stat;
|
||||
gss_cred_id_t cred;
|
||||
int i;
|
||||
|
||||
for (i = 0; i < counter; i++) {
|
||||
maj_stat = gss_acquire_cred(&min_stat, name,
|
||||
GSS_C_INDEFINITE,
|
||||
GSS_C_NO_OID_SET,
|
||||
usage,
|
||||
&cred,
|
||||
NULL,
|
||||
NULL);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
gss_err(1, min_stat, "aquire %d %d != GSS_S_COMPLETE",
|
||||
i, (int)maj_stat);
|
||||
|
||||
maj_stat = gss_release_cred(&min_stat, &cred);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
gss_err(1, min_stat, "release %d %d != GSS_S_COMPLETE",
|
||||
i, (int)maj_stat);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
acquire_add_release_add(gss_name_t name, gss_cred_usage_t usage)
|
||||
{
|
||||
OM_uint32 maj_stat, min_stat;
|
||||
gss_cred_id_t cred, cred2, cred3;
|
||||
|
||||
maj_stat = gss_acquire_cred(&min_stat, name,
|
||||
GSS_C_INDEFINITE,
|
||||
GSS_C_NO_OID_SET,
|
||||
usage,
|
||||
&cred,
|
||||
NULL,
|
||||
NULL);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
gss_err(1, min_stat, "aquire %d != GSS_S_COMPLETE", (int)maj_stat);
|
||||
|
||||
maj_stat = gss_add_cred(&min_stat,
|
||||
cred,
|
||||
GSS_C_NO_NAME,
|
||||
GSS_KRB5_MECHANISM,
|
||||
usage,
|
||||
GSS_C_INDEFINITE,
|
||||
GSS_C_INDEFINITE,
|
||||
&cred2,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL);
|
||||
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
gss_err(1, min_stat, "add_cred %d != GSS_S_COMPLETE", (int)maj_stat);
|
||||
|
||||
maj_stat = gss_release_cred(&min_stat, &cred);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
gss_err(1, min_stat, "release %d != GSS_S_COMPLETE", (int)maj_stat);
|
||||
|
||||
maj_stat = gss_add_cred(&min_stat,
|
||||
cred2,
|
||||
GSS_C_NO_NAME,
|
||||
GSS_KRB5_MECHANISM,
|
||||
GSS_C_BOTH,
|
||||
GSS_C_INDEFINITE,
|
||||
GSS_C_INDEFINITE,
|
||||
&cred3,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL);
|
||||
|
||||
maj_stat = gss_release_cred(&min_stat, &cred2);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
gss_err(1, min_stat, "release 2 %d != GSS_S_COMPLETE", (int)maj_stat);
|
||||
|
||||
maj_stat = gss_release_cred(&min_stat, &cred3);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
gss_err(1, min_stat, "release 2 %d != GSS_S_COMPLETE", (int)maj_stat);
|
||||
}
|
||||
|
||||
static int version_flag = 0;
|
||||
static int help_flag = 0;
|
||||
|
||||
static struct getargs args[] = {
|
||||
{"version", 0, arg_flag, &version_flag, "print version", NULL },
|
||||
{"help", 0, arg_flag, &help_flag, NULL, NULL }
|
||||
};
|
||||
|
||||
static void
|
||||
usage (int ret)
|
||||
{
|
||||
arg_printusage (args, sizeof(args)/sizeof(*args),
|
||||
NULL, "service@host");
|
||||
exit (ret);
|
||||
}
|
||||
|
||||
|
||||
int
|
||||
main(int argc, char **argv)
|
||||
{
|
||||
struct gss_buffer_desc_struct name_buffer;
|
||||
OM_uint32 maj_stat, min_stat;
|
||||
gss_name_t name;
|
||||
int optidx = 0;
|
||||
|
||||
setprogname(argv[0]);
|
||||
if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
|
||||
usage(1);
|
||||
|
||||
if (help_flag)
|
||||
usage (0);
|
||||
|
||||
if(version_flag){
|
||||
print_version(NULL);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
argc -= optidx;
|
||||
argv += optidx;
|
||||
|
||||
if (argc < 1)
|
||||
errx(1, "argc < 1");
|
||||
|
||||
name_buffer.value = argv[0];
|
||||
name_buffer.length = strlen(argv[0]);
|
||||
|
||||
maj_stat = gss_import_name(&min_stat, &name_buffer,
|
||||
GSS_C_NT_HOSTBASED_SERVICE,
|
||||
&name);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
errx(1, "import name error");
|
||||
|
||||
acquire_release_loop(name, 100, GSS_C_ACCEPT);
|
||||
acquire_release_loop(name, 100, GSS_C_INITIATE);
|
||||
acquire_release_loop(name, 100, GSS_C_BOTH);
|
||||
|
||||
acquire_add_release_add(name, GSS_C_ACCEPT);
|
||||
acquire_add_release_add(name, GSS_C_INITIATE);
|
||||
acquire_add_release_add(name, GSS_C_BOTH);
|
||||
|
||||
gss_release_name(&min_stat, &name);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,154 @@
|
||||
/* $NetBSD: test_kcred.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003-2004 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of KTH nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
|
||||
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
||||
* BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
#include <err.h>
|
||||
#include <krb5/getarg.h>
|
||||
|
||||
static int version_flag = 0;
|
||||
static int help_flag = 0;
|
||||
|
||||
static void
|
||||
copy_import(void)
|
||||
{
|
||||
gss_cred_id_t cred1, cred2;
|
||||
OM_uint32 maj_stat, min_stat;
|
||||
gss_name_t name1, name2;
|
||||
OM_uint32 lifetime1, lifetime2;
|
||||
gss_cred_usage_t usage1, usage2;
|
||||
gss_OID_set mechs1, mechs2;
|
||||
krb5_ccache id;
|
||||
krb5_error_code ret;
|
||||
krb5_context context;
|
||||
int equal;
|
||||
|
||||
maj_stat = gss_acquire_cred(&min_stat, GSS_C_NO_NAME, GSS_C_INDEFINITE,
|
||||
GSS_C_NO_OID_SET, GSS_C_INITIATE,
|
||||
&cred1, NULL, NULL);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
errx(1, "gss_acquire_cred");
|
||||
|
||||
maj_stat = gss_inquire_cred(&min_stat, cred1, &name1, &lifetime1,
|
||||
&usage1, &mechs1);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
errx(1, "gss_inquire_cred");
|
||||
|
||||
ret = krb5_init_context(&context);
|
||||
if (ret)
|
||||
errx(1, "krb5_init_context");
|
||||
|
||||
ret = krb5_cc_new_unique(context, krb5_cc_type_memory, NULL, &id);
|
||||
if (ret)
|
||||
krb5_err(context, 1, ret, "krb5_cc_new_unique");
|
||||
|
||||
maj_stat = gss_krb5_copy_ccache(&min_stat, context, cred1, id);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
errx(1, "gss_krb5_copy_ccache");
|
||||
|
||||
maj_stat = gss_krb5_import_cred(&min_stat, id, NULL, NULL, &cred2);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
errx(1, "gss_krb5_import_cred");
|
||||
|
||||
maj_stat = gss_inquire_cred(&min_stat, cred2, &name2, &lifetime2,
|
||||
&usage2, &mechs2);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
errx(1, "gss_inquire_cred 2");
|
||||
|
||||
maj_stat = gss_compare_name(&min_stat, name1, name2, &equal);
|
||||
if (maj_stat != GSS_S_COMPLETE)
|
||||
errx(1, "gss_compare_name");
|
||||
if (!equal)
|
||||
errx(1, "names not equal");
|
||||
|
||||
if (lifetime1 != lifetime1)
|
||||
errx(1, "lifetime not equal");
|
||||
|
||||
if (usage1 != usage1)
|
||||
errx(1, "usage not equal");
|
||||
|
||||
gss_release_cred(&min_stat, &cred1);
|
||||
gss_release_cred(&min_stat, &cred2);
|
||||
|
||||
gss_release_name(&min_stat, &name1);
|
||||
gss_release_name(&min_stat, &name2);
|
||||
|
||||
#if 0
|
||||
compare(mechs1, mechs2);
|
||||
#endif
|
||||
|
||||
gss_release_oid_set(&min_stat, &mechs1);
|
||||
gss_release_oid_set(&min_stat, &mechs2);
|
||||
|
||||
krb5_cc_destroy(context, id);
|
||||
krb5_free_context(context);
|
||||
}
|
||||
|
||||
static struct getargs args[] = {
|
||||
{"version", 0, arg_flag, &version_flag, "print version", NULL },
|
||||
{"help", 0, arg_flag, &help_flag, NULL, NULL }
|
||||
};
|
||||
|
||||
static void
|
||||
usage (int ret)
|
||||
{
|
||||
arg_printusage (args, sizeof(args)/sizeof(*args),
|
||||
NULL, "");
|
||||
exit (ret);
|
||||
}
|
||||
|
||||
int
|
||||
main(int argc, char **argv)
|
||||
{
|
||||
int optidx = 0;
|
||||
|
||||
setprogname(argv[0]);
|
||||
if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
|
||||
usage(1);
|
||||
|
||||
if (help_flag)
|
||||
usage (0);
|
||||
|
||||
if(version_flag){
|
||||
print_version(NULL);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
argc -= optidx;
|
||||
argv += optidx;
|
||||
|
||||
copy_import();
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
/* $NetBSD: test_oid.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
int
|
||||
main(int argc, char **argv)
|
||||
{
|
||||
OM_uint32 minor_status, maj_stat;
|
||||
gss_buffer_desc data;
|
||||
int ret;
|
||||
|
||||
maj_stat = gss_oid_to_str(&minor_status, GSS_KRB5_MECHANISM, &data);
|
||||
if (GSS_ERROR(maj_stat))
|
||||
errx(1, "gss_oid_to_str failed");
|
||||
ret = strncmp(data.value, "1 2 840 113554 1 2 2", data.length);
|
||||
gss_release_buffer(&maj_stat, &data);
|
||||
if (ret)
|
||||
return 1;
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,369 @@
|
||||
/* $NetBSD: test_sequence.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
/* correct ordering */
|
||||
OM_uint32 pattern1[] = {
|
||||
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13
|
||||
};
|
||||
|
||||
/* gap 10 */
|
||||
OM_uint32 pattern2[] = {
|
||||
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13
|
||||
};
|
||||
|
||||
/* dup 9 */
|
||||
OM_uint32 pattern3[] = {
|
||||
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 9, 10, 11, 12, 13
|
||||
};
|
||||
|
||||
/* gaps */
|
||||
OM_uint32 pattern4[] = {
|
||||
0, 1, 2, 3, 4, 5, 6, 7, 8, 10, 12, 13, 14, 15, 16, 18, 100
|
||||
};
|
||||
|
||||
/* 11 before 10 */
|
||||
OM_uint32 pattern5[] = {
|
||||
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 10, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21
|
||||
};
|
||||
|
||||
/* long */
|
||||
OM_uint32 pattern6[] = {
|
||||
0, 1, 2, 3, 4, 5, 6, 7, 8, 9,
|
||||
10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
|
||||
20, 21, 22, 23, 24, 25, 26, 27, 28, 29,
|
||||
30, 31, 32, 33, 34, 35, 36, 37, 38, 39,
|
||||
40, 41, 42, 43, 44, 45, 46, 47, 48, 49,
|
||||
50, 51, 52, 53, 54, 55, 56, 57, 58, 59
|
||||
};
|
||||
|
||||
/* dont start at 0 */
|
||||
OM_uint32 pattern7[] = {
|
||||
11, 12, 13
|
||||
};
|
||||
|
||||
/* wrap around */
|
||||
OM_uint32 pattern8[] = {
|
||||
4294967293U, 4294967294U, 4294967295U, 0, 1, 2
|
||||
};
|
||||
|
||||
static int
|
||||
test_seq(int t, OM_uint32 flags, OM_uint32 start_seq,
|
||||
OM_uint32 *pattern, int pattern_len, OM_uint32 expected_error)
|
||||
{
|
||||
struct gss_msg_order *o;
|
||||
OM_uint32 maj_stat, min_stat;
|
||||
krb5_storage *sp;
|
||||
int i;
|
||||
|
||||
maj_stat = _gssapi_msg_order_create(&min_stat, &o, flags,
|
||||
start_seq, 20, 0);
|
||||
if (maj_stat)
|
||||
errx(1, "create: %d %d", maj_stat, min_stat);
|
||||
|
||||
sp = krb5_storage_emem();
|
||||
if (sp == NULL)
|
||||
errx(1, "krb5_storage_from_emem");
|
||||
|
||||
_gssapi_msg_order_export(sp, o);
|
||||
|
||||
for (i = 0; i < pattern_len; i++) {
|
||||
maj_stat = _gssapi_msg_order_check(o, pattern[i]);
|
||||
if (maj_stat)
|
||||
break;
|
||||
}
|
||||
if (maj_stat != expected_error) {
|
||||
printf("test pattern %d failed with %d (should have been %d)\n",
|
||||
t, maj_stat, expected_error);
|
||||
krb5_storage_free(sp);
|
||||
_gssapi_msg_order_destroy(&o);
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
_gssapi_msg_order_destroy(&o);
|
||||
|
||||
/* try again, now with export/imported blob */
|
||||
krb5_storage_seek(sp, 0, SEEK_SET);
|
||||
|
||||
maj_stat = _gssapi_msg_order_import(&min_stat, sp, &o);
|
||||
if (maj_stat)
|
||||
errx(1, "import: %d %d", maj_stat, min_stat);
|
||||
|
||||
for (i = 0; i < pattern_len; i++) {
|
||||
maj_stat = _gssapi_msg_order_check(o, pattern[i]);
|
||||
if (maj_stat)
|
||||
break;
|
||||
}
|
||||
if (maj_stat != expected_error) {
|
||||
printf("import/export test pattern %d failed "
|
||||
"with %d (should have been %d)\n",
|
||||
t, maj_stat, expected_error);
|
||||
_gssapi_msg_order_destroy(&o);
|
||||
krb5_storage_free(sp);
|
||||
return 1;
|
||||
}
|
||||
|
||||
_gssapi_msg_order_destroy(&o);
|
||||
krb5_storage_free(sp);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
struct {
|
||||
OM_uint32 flags;
|
||||
OM_uint32 *pattern;
|
||||
int pattern_len;
|
||||
OM_uint32 error_code;
|
||||
OM_uint32 start_seq;
|
||||
} pl[] = {
|
||||
{
|
||||
GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
|
||||
pattern1,
|
||||
sizeof(pattern1)/sizeof(pattern1[0]),
|
||||
0
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
|
||||
pattern2,
|
||||
sizeof(pattern2)/sizeof(pattern2[0]),
|
||||
GSS_S_GAP_TOKEN
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
|
||||
pattern3,
|
||||
sizeof(pattern3)/sizeof(pattern3[0]),
|
||||
GSS_S_DUPLICATE_TOKEN
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
|
||||
pattern4,
|
||||
sizeof(pattern4)/sizeof(pattern4[0]),
|
||||
GSS_S_GAP_TOKEN
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
|
||||
pattern5,
|
||||
sizeof(pattern5)/sizeof(pattern5[0]),
|
||||
GSS_S_GAP_TOKEN
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
|
||||
pattern6,
|
||||
sizeof(pattern6)/sizeof(pattern6[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
|
||||
pattern7,
|
||||
sizeof(pattern7)/sizeof(pattern7[0]),
|
||||
GSS_S_GAP_TOKEN
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
|
||||
pattern8,
|
||||
sizeof(pattern8)/sizeof(pattern8[0]),
|
||||
GSS_S_COMPLETE,
|
||||
4294967293U
|
||||
},
|
||||
{
|
||||
0,
|
||||
pattern1,
|
||||
sizeof(pattern1)/sizeof(pattern1[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
0,
|
||||
pattern2,
|
||||
sizeof(pattern2)/sizeof(pattern2[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
0,
|
||||
pattern3,
|
||||
sizeof(pattern3)/sizeof(pattern3[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
0,
|
||||
pattern4,
|
||||
sizeof(pattern4)/sizeof(pattern4[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
0,
|
||||
pattern5,
|
||||
sizeof(pattern5)/sizeof(pattern5[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
0,
|
||||
pattern6,
|
||||
sizeof(pattern6)/sizeof(pattern6[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
0,
|
||||
pattern7,
|
||||
sizeof(pattern7)/sizeof(pattern7[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
0,
|
||||
pattern8,
|
||||
sizeof(pattern8)/sizeof(pattern8[0]),
|
||||
GSS_S_COMPLETE,
|
||||
4294967293U
|
||||
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG,
|
||||
pattern1,
|
||||
sizeof(pattern1)/sizeof(pattern1[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG,
|
||||
pattern2,
|
||||
sizeof(pattern2)/sizeof(pattern2[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG,
|
||||
pattern3,
|
||||
sizeof(pattern3)/sizeof(pattern3[0]),
|
||||
GSS_S_DUPLICATE_TOKEN
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG,
|
||||
pattern4,
|
||||
sizeof(pattern4)/sizeof(pattern4[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG,
|
||||
pattern5,
|
||||
sizeof(pattern5)/sizeof(pattern5[0]),
|
||||
0
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG,
|
||||
pattern6,
|
||||
sizeof(pattern6)/sizeof(pattern6[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG,
|
||||
pattern7,
|
||||
sizeof(pattern7)/sizeof(pattern7[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
GSS_C_SEQUENCE_FLAG,
|
||||
pattern8,
|
||||
sizeof(pattern8)/sizeof(pattern8[0]),
|
||||
GSS_S_COMPLETE,
|
||||
4294967293U
|
||||
},
|
||||
{
|
||||
GSS_C_SEQUENCE_FLAG,
|
||||
pattern1,
|
||||
sizeof(pattern1)/sizeof(pattern1[0]),
|
||||
0
|
||||
},
|
||||
{
|
||||
GSS_C_SEQUENCE_FLAG,
|
||||
pattern2,
|
||||
sizeof(pattern2)/sizeof(pattern2[0]),
|
||||
GSS_S_GAP_TOKEN
|
||||
},
|
||||
{
|
||||
GSS_C_SEQUENCE_FLAG,
|
||||
pattern3,
|
||||
sizeof(pattern3)/sizeof(pattern3[0]),
|
||||
GSS_S_DUPLICATE_TOKEN
|
||||
},
|
||||
{
|
||||
GSS_C_SEQUENCE_FLAG,
|
||||
pattern4,
|
||||
sizeof(pattern4)/sizeof(pattern4[0]),
|
||||
GSS_S_GAP_TOKEN
|
||||
},
|
||||
{
|
||||
GSS_C_SEQUENCE_FLAG,
|
||||
pattern5,
|
||||
sizeof(pattern5)/sizeof(pattern5[0]),
|
||||
GSS_S_GAP_TOKEN
|
||||
},
|
||||
{
|
||||
GSS_C_SEQUENCE_FLAG,
|
||||
pattern6,
|
||||
sizeof(pattern6)/sizeof(pattern6[0]),
|
||||
GSS_S_COMPLETE
|
||||
},
|
||||
{
|
||||
GSS_C_SEQUENCE_FLAG,
|
||||
pattern7,
|
||||
sizeof(pattern7)/sizeof(pattern7[0]),
|
||||
GSS_S_GAP_TOKEN
|
||||
},
|
||||
{
|
||||
GSS_C_REPLAY_FLAG,
|
||||
pattern8,
|
||||
sizeof(pattern8)/sizeof(pattern8[0]),
|
||||
GSS_S_COMPLETE,
|
||||
4294967293U
|
||||
}
|
||||
};
|
||||
|
||||
int
|
||||
main(int argc, char **argv)
|
||||
{
|
||||
int i, failed = 0;
|
||||
|
||||
for (i = 0; i < sizeof(pl)/sizeof(pl[0]); i++) {
|
||||
if (test_seq(i,
|
||||
pl[i].flags,
|
||||
pl[i].start_seq,
|
||||
pl[i].pattern,
|
||||
pl[i].pattern_len,
|
||||
pl[i].error_code))
|
||||
failed++;
|
||||
}
|
||||
if (failed)
|
||||
printf("FAILED %d tests\n", failed);
|
||||
return failed != 0;
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
/* $NetBSD: ticket_flags.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2004 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_get_tkt_flags(OM_uint32 *minor_status,
|
||||
gsskrb5_ctx ctx,
|
||||
OM_uint32 *tkt_flags)
|
||||
{
|
||||
if (ctx == NULL) {
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_NO_CONTEXT;
|
||||
}
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
|
||||
if (ctx->ticket == NULL) {
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_BAD_MECH;
|
||||
}
|
||||
|
||||
*tkt_flags = TicketFlags2int(ctx->ticket->ticket.flags);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,449 @@
|
||||
/* $NetBSD: unwrap.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
#ifdef HEIM_WEAK_CRYPTO
|
||||
|
||||
static OM_uint32
|
||||
unwrap_des
|
||||
(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
const gss_buffer_t input_message_buffer,
|
||||
gss_buffer_t output_message_buffer,
|
||||
int * conf_state,
|
||||
gss_qop_t * qop_state,
|
||||
krb5_keyblock *key
|
||||
)
|
||||
{
|
||||
u_char *p, *seq;
|
||||
size_t len;
|
||||
EVP_MD_CTX *md5;
|
||||
u_char hash[16];
|
||||
EVP_CIPHER_CTX des_ctx;
|
||||
DES_key_schedule schedule;
|
||||
DES_cblock deskey;
|
||||
DES_cblock zero;
|
||||
int i;
|
||||
uint32_t seq_number;
|
||||
size_t padlength;
|
||||
OM_uint32 ret;
|
||||
int cstate;
|
||||
int cmp;
|
||||
int token_len;
|
||||
|
||||
if (IS_DCE_STYLE(context_handle)) {
|
||||
token_len = 22 + 8 + 15; /* 45 */
|
||||
} else {
|
||||
token_len = input_message_buffer->length;
|
||||
}
|
||||
|
||||
p = input_message_buffer->value;
|
||||
ret = _gsskrb5_verify_header (&p,
|
||||
token_len,
|
||||
"\x02\x01",
|
||||
GSS_KRB5_MECHANISM);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
if (memcmp (p, "\x00\x00", 2) != 0)
|
||||
return GSS_S_BAD_SIG;
|
||||
p += 2;
|
||||
if (memcmp (p, "\x00\x00", 2) == 0) {
|
||||
cstate = 1;
|
||||
} else if (memcmp (p, "\xFF\xFF", 2) == 0) {
|
||||
cstate = 0;
|
||||
} else
|
||||
return GSS_S_BAD_MIC;
|
||||
p += 2;
|
||||
if(conf_state != NULL)
|
||||
*conf_state = cstate;
|
||||
if (memcmp (p, "\xff\xff", 2) != 0)
|
||||
return GSS_S_DEFECTIVE_TOKEN;
|
||||
p += 2;
|
||||
p += 16;
|
||||
|
||||
len = p - (u_char *)input_message_buffer->value;
|
||||
|
||||
if(cstate) {
|
||||
/* decrypt data */
|
||||
memcpy (&deskey, key->keyvalue.data, sizeof(deskey));
|
||||
|
||||
for (i = 0; i < sizeof(deskey); ++i)
|
||||
deskey[i] ^= 0xf0;
|
||||
|
||||
|
||||
EVP_CIPHER_CTX_init(&des_ctx);
|
||||
EVP_CipherInit_ex(&des_ctx, EVP_des_cbc(), NULL, deskey, zero, 0);
|
||||
EVP_Cipher(&des_ctx, p, p, input_message_buffer->length - len);
|
||||
EVP_CIPHER_CTX_cleanup(&des_ctx);
|
||||
|
||||
memset (&schedule, 0, sizeof(schedule));
|
||||
}
|
||||
|
||||
if (IS_DCE_STYLE(context_handle)) {
|
||||
padlength = 0;
|
||||
} else {
|
||||
/* check pad */
|
||||
ret = _gssapi_verify_pad(input_message_buffer,
|
||||
input_message_buffer->length - len,
|
||||
&padlength);
|
||||
if (ret)
|
||||
return ret;
|
||||
}
|
||||
|
||||
md5 = EVP_MD_CTX_create();
|
||||
EVP_DigestInit_ex(md5, EVP_md5(), NULL);
|
||||
EVP_DigestUpdate(md5, p - 24, 8);
|
||||
EVP_DigestUpdate(md5, p, input_message_buffer->length - len);
|
||||
EVP_DigestFinal_ex(md5, hash, NULL);
|
||||
EVP_MD_CTX_destroy(md5);
|
||||
|
||||
memset (&zero, 0, sizeof(zero));
|
||||
memcpy (&deskey, key->keyvalue.data, sizeof(deskey));
|
||||
DES_set_key_unchecked (&deskey, &schedule);
|
||||
DES_cbc_cksum ((void *)hash, (void *)hash, sizeof(hash),
|
||||
&schedule, &zero);
|
||||
if (ct_memcmp (p - 8, hash, 8) != 0)
|
||||
return GSS_S_BAD_MIC;
|
||||
|
||||
/* verify sequence number */
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
|
||||
p -= 16;
|
||||
|
||||
EVP_CIPHER_CTX_init(&des_ctx);
|
||||
EVP_CipherInit_ex(&des_ctx, EVP_des_cbc(), NULL, key->keyvalue.data, hash, 0);
|
||||
EVP_Cipher(&des_ctx, p, p, 8);
|
||||
EVP_CIPHER_CTX_cleanup(&des_ctx);
|
||||
|
||||
memset (deskey, 0, sizeof(deskey));
|
||||
memset (&schedule, 0, sizeof(schedule));
|
||||
|
||||
seq = p;
|
||||
_gsskrb5_decode_om_uint32(seq, &seq_number);
|
||||
|
||||
if (context_handle->more_flags & LOCAL)
|
||||
cmp = ct_memcmp(&seq[4], "\xff\xff\xff\xff", 4);
|
||||
else
|
||||
cmp = ct_memcmp(&seq[4], "\x00\x00\x00\x00", 4);
|
||||
|
||||
if (cmp != 0) {
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return GSS_S_BAD_MIC;
|
||||
}
|
||||
|
||||
ret = _gssapi_msg_order_check(context_handle->order, seq_number);
|
||||
if (ret) {
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return ret;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
|
||||
/* copy out data */
|
||||
|
||||
output_message_buffer->length = input_message_buffer->length
|
||||
- len - padlength - 8;
|
||||
output_message_buffer->value = malloc(output_message_buffer->length);
|
||||
if(output_message_buffer->length != 0 && output_message_buffer->value == NULL)
|
||||
return GSS_S_FAILURE;
|
||||
memcpy (output_message_buffer->value,
|
||||
p + 24,
|
||||
output_message_buffer->length);
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
#endif
|
||||
|
||||
static OM_uint32
|
||||
unwrap_des3
|
||||
(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
krb5_context context,
|
||||
const gss_buffer_t input_message_buffer,
|
||||
gss_buffer_t output_message_buffer,
|
||||
int * conf_state,
|
||||
gss_qop_t * qop_state,
|
||||
krb5_keyblock *key
|
||||
)
|
||||
{
|
||||
u_char *p;
|
||||
size_t len;
|
||||
u_char *seq;
|
||||
krb5_data seq_data;
|
||||
u_char cksum[20];
|
||||
uint32_t seq_number;
|
||||
size_t padlength;
|
||||
OM_uint32 ret;
|
||||
int cstate;
|
||||
krb5_crypto crypto;
|
||||
Checksum csum;
|
||||
int cmp;
|
||||
int token_len;
|
||||
|
||||
if (IS_DCE_STYLE(context_handle)) {
|
||||
token_len = 34 + 8 + 15; /* 57 */
|
||||
} else {
|
||||
token_len = input_message_buffer->length;
|
||||
}
|
||||
|
||||
p = input_message_buffer->value;
|
||||
ret = _gsskrb5_verify_header (&p,
|
||||
token_len,
|
||||
"\x02\x01",
|
||||
GSS_KRB5_MECHANISM);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
if (memcmp (p, "\x04\x00", 2) != 0) /* HMAC SHA1 DES3_KD */
|
||||
return GSS_S_BAD_SIG;
|
||||
p += 2;
|
||||
if (ct_memcmp (p, "\x02\x00", 2) == 0) {
|
||||
cstate = 1;
|
||||
} else if (ct_memcmp (p, "\xff\xff", 2) == 0) {
|
||||
cstate = 0;
|
||||
} else
|
||||
return GSS_S_BAD_MIC;
|
||||
p += 2;
|
||||
if(conf_state != NULL)
|
||||
*conf_state = cstate;
|
||||
if (ct_memcmp (p, "\xff\xff", 2) != 0)
|
||||
return GSS_S_DEFECTIVE_TOKEN;
|
||||
p += 2;
|
||||
p += 28;
|
||||
|
||||
len = p - (u_char *)input_message_buffer->value;
|
||||
|
||||
if(cstate) {
|
||||
/* decrypt data */
|
||||
krb5_data tmp;
|
||||
|
||||
ret = krb5_crypto_init(context, key,
|
||||
ETYPE_DES3_CBC_NONE, &crypto);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
ret = krb5_decrypt(context, crypto, KRB5_KU_USAGE_SEAL,
|
||||
p, input_message_buffer->length - len, &tmp);
|
||||
krb5_crypto_destroy(context, crypto);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
assert (tmp.length == input_message_buffer->length - len);
|
||||
|
||||
memcpy (p, tmp.data, tmp.length);
|
||||
krb5_data_free(&tmp);
|
||||
}
|
||||
|
||||
if (IS_DCE_STYLE(context_handle)) {
|
||||
padlength = 0;
|
||||
} else {
|
||||
/* check pad */
|
||||
ret = _gssapi_verify_pad(input_message_buffer,
|
||||
input_message_buffer->length - len,
|
||||
&padlength);
|
||||
if (ret)
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* verify sequence number */
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
|
||||
p -= 28;
|
||||
|
||||
ret = krb5_crypto_init(context, key,
|
||||
ETYPE_DES3_CBC_NONE, &crypto);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
{
|
||||
DES_cblock ivec;
|
||||
|
||||
memcpy(&ivec, p + 8, 8);
|
||||
ret = krb5_decrypt_ivec (context,
|
||||
crypto,
|
||||
KRB5_KU_USAGE_SEQ,
|
||||
p, 8, &seq_data,
|
||||
&ivec);
|
||||
}
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
if (seq_data.length != 8) {
|
||||
krb5_data_free (&seq_data);
|
||||
*minor_status = 0;
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return GSS_S_BAD_MIC;
|
||||
}
|
||||
|
||||
seq = seq_data.data;
|
||||
_gsskrb5_decode_om_uint32(seq, &seq_number);
|
||||
|
||||
if (context_handle->more_flags & LOCAL)
|
||||
cmp = ct_memcmp(&seq[4], "\xff\xff\xff\xff", 4);
|
||||
else
|
||||
cmp = ct_memcmp(&seq[4], "\x00\x00\x00\x00", 4);
|
||||
|
||||
krb5_data_free (&seq_data);
|
||||
if (cmp != 0) {
|
||||
*minor_status = 0;
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return GSS_S_BAD_MIC;
|
||||
}
|
||||
|
||||
ret = _gssapi_msg_order_check(context_handle->order, seq_number);
|
||||
if (ret) {
|
||||
*minor_status = 0;
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return ret;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
|
||||
/* verify checksum */
|
||||
|
||||
memcpy (cksum, p + 8, 20);
|
||||
|
||||
memcpy (p + 20, p - 8, 8);
|
||||
|
||||
csum.cksumtype = CKSUMTYPE_HMAC_SHA1_DES3;
|
||||
csum.checksum.length = 20;
|
||||
csum.checksum.data = cksum;
|
||||
|
||||
ret = krb5_crypto_init(context, key, 0, &crypto);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_verify_checksum (context, crypto,
|
||||
KRB5_KU_USAGE_SIGN,
|
||||
p + 20,
|
||||
input_message_buffer->length - len + 8,
|
||||
&csum);
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
/* copy out data */
|
||||
|
||||
output_message_buffer->length = input_message_buffer->length
|
||||
- len - padlength - 8;
|
||||
output_message_buffer->value = malloc(output_message_buffer->length);
|
||||
if(output_message_buffer->length != 0 && output_message_buffer->value == NULL)
|
||||
return GSS_S_FAILURE;
|
||||
memcpy (output_message_buffer->value,
|
||||
p + 36,
|
||||
output_message_buffer->length);
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV _gsskrb5_unwrap
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
const gss_buffer_t input_message_buffer,
|
||||
gss_buffer_t output_message_buffer,
|
||||
int * conf_state,
|
||||
gss_qop_t * qop_state
|
||||
)
|
||||
{
|
||||
krb5_keyblock *key;
|
||||
krb5_context context;
|
||||
OM_uint32 ret;
|
||||
krb5_keytype keytype;
|
||||
gsskrb5_ctx ctx = (gsskrb5_ctx) context_handle;
|
||||
|
||||
output_message_buffer->value = NULL;
|
||||
output_message_buffer->length = 0;
|
||||
if (qop_state != NULL)
|
||||
*qop_state = GSS_C_QOP_DEFAULT;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (ctx->more_flags & IS_CFX)
|
||||
return _gssapi_unwrap_cfx (minor_status, ctx, context,
|
||||
input_message_buffer, output_message_buffer,
|
||||
conf_state, qop_state);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
ret = _gsskrb5i_get_token_key(ctx, context, &key);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
krb5_enctype_to_keytype (context, key->keytype, &keytype);
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
switch (keytype) {
|
||||
case KEYTYPE_DES :
|
||||
#ifdef HEIM_WEAK_CRYPTO
|
||||
ret = unwrap_des (minor_status, ctx,
|
||||
input_message_buffer, output_message_buffer,
|
||||
conf_state, qop_state, key);
|
||||
#else
|
||||
ret = GSS_S_FAILURE;
|
||||
#endif
|
||||
break;
|
||||
case KEYTYPE_DES3 :
|
||||
ret = unwrap_des3 (minor_status, ctx, context,
|
||||
input_message_buffer, output_message_buffer,
|
||||
conf_state, qop_state, key);
|
||||
break;
|
||||
case KEYTYPE_ARCFOUR:
|
||||
case KEYTYPE_ARCFOUR_56:
|
||||
ret = _gssapi_unwrap_arcfour (minor_status, ctx, context,
|
||||
input_message_buffer, output_message_buffer,
|
||||
conf_state, qop_state, key);
|
||||
break;
|
||||
default :
|
||||
abort();
|
||||
break;
|
||||
}
|
||||
krb5_free_keyblock (context, key);
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,356 @@
|
||||
/* $NetBSD: verify_mic.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
#ifdef HEIM_WEAK_CRYPTO
|
||||
|
||||
static OM_uint32
|
||||
verify_mic_des
|
||||
(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
krb5_context context,
|
||||
const gss_buffer_t message_buffer,
|
||||
const gss_buffer_t token_buffer,
|
||||
gss_qop_t * qop_state,
|
||||
krb5_keyblock *key,
|
||||
char *type
|
||||
)
|
||||
{
|
||||
u_char *p;
|
||||
EVP_MD_CTX *md5;
|
||||
u_char hash[16], *seq;
|
||||
DES_key_schedule schedule;
|
||||
EVP_CIPHER_CTX des_ctx;
|
||||
DES_cblock zero;
|
||||
DES_cblock deskey;
|
||||
uint32_t seq_number;
|
||||
OM_uint32 ret;
|
||||
int cmp;
|
||||
|
||||
p = token_buffer->value;
|
||||
ret = _gsskrb5_verify_header (&p,
|
||||
token_buffer->length,
|
||||
type,
|
||||
GSS_KRB5_MECHANISM);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
if (memcmp(p, "\x00\x00", 2) != 0)
|
||||
return GSS_S_BAD_SIG;
|
||||
p += 2;
|
||||
if (memcmp (p, "\xff\xff\xff\xff", 4) != 0)
|
||||
return GSS_S_BAD_MIC;
|
||||
p += 4;
|
||||
p += 16;
|
||||
|
||||
/* verify checksum */
|
||||
md5 = EVP_MD_CTX_create();
|
||||
EVP_DigestInit_ex(md5, EVP_md5(), NULL);
|
||||
EVP_DigestUpdate(md5, p - 24, 8);
|
||||
EVP_DigestUpdate(md5, message_buffer->value, message_buffer->length);
|
||||
EVP_DigestFinal_ex(md5, hash, NULL);
|
||||
EVP_MD_CTX_destroy(md5);
|
||||
|
||||
memset (&zero, 0, sizeof(zero));
|
||||
memcpy (&deskey, key->keyvalue.data, sizeof(deskey));
|
||||
|
||||
DES_set_key_unchecked (&deskey, &schedule);
|
||||
DES_cbc_cksum ((void *)hash, (void *)hash, sizeof(hash),
|
||||
&schedule, &zero);
|
||||
if (ct_memcmp (p - 8, hash, 8) != 0) {
|
||||
memset (deskey, 0, sizeof(deskey));
|
||||
memset (&schedule, 0, sizeof(schedule));
|
||||
return GSS_S_BAD_MIC;
|
||||
}
|
||||
|
||||
/* verify sequence number */
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
|
||||
p -= 16;
|
||||
|
||||
EVP_CIPHER_CTX_init(&des_ctx);
|
||||
EVP_CipherInit_ex(&des_ctx, EVP_des_cbc(), NULL, key->keyvalue.data, hash, 0);
|
||||
EVP_Cipher(&des_ctx, p, p, 8);
|
||||
EVP_CIPHER_CTX_cleanup(&des_ctx);
|
||||
|
||||
memset (deskey, 0, sizeof(deskey));
|
||||
memset (&schedule, 0, sizeof(schedule));
|
||||
|
||||
seq = p;
|
||||
_gsskrb5_decode_om_uint32(seq, &seq_number);
|
||||
|
||||
if (context_handle->more_flags & LOCAL)
|
||||
cmp = ct_memcmp(&seq[4], "\xff\xff\xff\xff", 4);
|
||||
else
|
||||
cmp = ct_memcmp(&seq[4], "\x00\x00\x00\x00", 4);
|
||||
|
||||
if (cmp != 0) {
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return GSS_S_BAD_MIC;
|
||||
}
|
||||
|
||||
ret = _gssapi_msg_order_check(context_handle->order, seq_number);
|
||||
if (ret) {
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return ret;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
#endif
|
||||
|
||||
static OM_uint32
|
||||
verify_mic_des3
|
||||
(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx context_handle,
|
||||
krb5_context context,
|
||||
const gss_buffer_t message_buffer,
|
||||
const gss_buffer_t token_buffer,
|
||||
gss_qop_t * qop_state,
|
||||
krb5_keyblock *key,
|
||||
char *type
|
||||
)
|
||||
{
|
||||
u_char *p;
|
||||
u_char *seq;
|
||||
uint32_t seq_number;
|
||||
OM_uint32 ret;
|
||||
krb5_crypto crypto;
|
||||
krb5_data seq_data;
|
||||
int cmp, docompat;
|
||||
Checksum csum;
|
||||
char *tmp;
|
||||
char ivec[8];
|
||||
|
||||
p = token_buffer->value;
|
||||
ret = _gsskrb5_verify_header (&p,
|
||||
token_buffer->length,
|
||||
type,
|
||||
GSS_KRB5_MECHANISM);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
if (memcmp(p, "\x04\x00", 2) != 0) /* SGN_ALG = HMAC SHA1 DES3-KD */
|
||||
return GSS_S_BAD_SIG;
|
||||
p += 2;
|
||||
if (memcmp (p, "\xff\xff\xff\xff", 4) != 0)
|
||||
return GSS_S_BAD_MIC;
|
||||
p += 4;
|
||||
|
||||
ret = krb5_crypto_init(context, key,
|
||||
ETYPE_DES3_CBC_NONE, &crypto);
|
||||
if (ret){
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
/* verify sequence number */
|
||||
docompat = 0;
|
||||
retry:
|
||||
if (docompat)
|
||||
memset(ivec, 0, 8);
|
||||
else
|
||||
memcpy(ivec, p + 8, 8);
|
||||
|
||||
ret = krb5_decrypt_ivec (context,
|
||||
crypto,
|
||||
KRB5_KU_USAGE_SEQ,
|
||||
p, 8, &seq_data, ivec);
|
||||
if (ret) {
|
||||
if (docompat++) {
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
} else
|
||||
goto retry;
|
||||
}
|
||||
|
||||
if (seq_data.length != 8) {
|
||||
krb5_data_free (&seq_data);
|
||||
if (docompat++) {
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
return GSS_S_BAD_MIC;
|
||||
} else
|
||||
goto retry;
|
||||
}
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
|
||||
|
||||
seq = seq_data.data;
|
||||
_gsskrb5_decode_om_uint32(seq, &seq_number);
|
||||
|
||||
if (context_handle->more_flags & LOCAL)
|
||||
cmp = ct_memcmp(&seq[4], "\xff\xff\xff\xff", 4);
|
||||
else
|
||||
cmp = ct_memcmp(&seq[4], "\x00\x00\x00\x00", 4);
|
||||
|
||||
krb5_data_free (&seq_data);
|
||||
if (cmp != 0) {
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
*minor_status = 0;
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return GSS_S_BAD_MIC;
|
||||
}
|
||||
|
||||
ret = _gssapi_msg_order_check(context_handle->order, seq_number);
|
||||
if (ret) {
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
*minor_status = 0;
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* verify checksum */
|
||||
|
||||
tmp = malloc (message_buffer->length + 8);
|
||||
if (tmp == NULL) {
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
memcpy (tmp, p - 8, 8);
|
||||
memcpy (tmp + 8, message_buffer->value, message_buffer->length);
|
||||
|
||||
csum.cksumtype = CKSUMTYPE_HMAC_SHA1_DES3;
|
||||
csum.checksum.length = 20;
|
||||
csum.checksum.data = p + 8;
|
||||
|
||||
ret = krb5_verify_checksum (context, crypto,
|
||||
KRB5_KU_USAGE_SIGN,
|
||||
tmp, message_buffer->length + 8,
|
||||
&csum);
|
||||
free (tmp);
|
||||
if (ret) {
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
*minor_status = ret;
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
return GSS_S_BAD_MIC;
|
||||
}
|
||||
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
|
||||
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5_verify_mic_internal
|
||||
(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
const gss_buffer_t message_buffer,
|
||||
const gss_buffer_t token_buffer,
|
||||
gss_qop_t * qop_state,
|
||||
char * type
|
||||
)
|
||||
{
|
||||
krb5_keyblock *key;
|
||||
OM_uint32 ret;
|
||||
krb5_keytype keytype;
|
||||
|
||||
if (ctx->more_flags & IS_CFX)
|
||||
return _gssapi_verify_mic_cfx (minor_status, ctx,
|
||||
context, message_buffer, token_buffer,
|
||||
qop_state);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
ret = _gsskrb5i_get_token_key(ctx, context, &key);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
*minor_status = 0;
|
||||
krb5_enctype_to_keytype (context, key->keytype, &keytype);
|
||||
switch (keytype) {
|
||||
case KEYTYPE_DES :
|
||||
#ifdef HEIM_WEAK_CRYPTO
|
||||
ret = verify_mic_des (minor_status, ctx, context,
|
||||
message_buffer, token_buffer, qop_state, key,
|
||||
type);
|
||||
#else
|
||||
ret = GSS_S_FAILURE;
|
||||
#endif
|
||||
break;
|
||||
case KEYTYPE_DES3 :
|
||||
ret = verify_mic_des3 (minor_status, ctx, context,
|
||||
message_buffer, token_buffer, qop_state, key,
|
||||
type);
|
||||
break;
|
||||
case KEYTYPE_ARCFOUR :
|
||||
case KEYTYPE_ARCFOUR_56 :
|
||||
ret = _gssapi_verify_mic_arcfour (minor_status, ctx,
|
||||
context,
|
||||
message_buffer, token_buffer,
|
||||
qop_state, key, type);
|
||||
break;
|
||||
default :
|
||||
abort();
|
||||
}
|
||||
krb5_free_keyblock (context, key);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_verify_mic
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
const gss_buffer_t message_buffer,
|
||||
const gss_buffer_t token_buffer,
|
||||
gss_qop_t * qop_state
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
OM_uint32 ret;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (qop_state != NULL)
|
||||
*qop_state = GSS_C_QOP_DEFAULT;
|
||||
|
||||
ret = _gsskrb5_verify_mic_internal(minor_status,
|
||||
(gsskrb5_ctx)context_handle,
|
||||
context,
|
||||
message_buffer, token_buffer,
|
||||
qop_state, "\x01\x01");
|
||||
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,592 @@
|
||||
/* $NetBSD: wrap.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "gsskrb5_locl.h"
|
||||
|
||||
/*
|
||||
* Return initiator subkey, or if that doesn't exists, the subkey.
|
||||
*/
|
||||
|
||||
krb5_error_code
|
||||
_gsskrb5i_get_initiator_subkey(const gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
krb5_keyblock **key)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
*key = NULL;
|
||||
|
||||
if (ctx->more_flags & LOCAL) {
|
||||
ret = krb5_auth_con_getlocalsubkey(context,
|
||||
ctx->auth_context,
|
||||
key);
|
||||
} else {
|
||||
ret = krb5_auth_con_getremotesubkey(context,
|
||||
ctx->auth_context,
|
||||
key);
|
||||
}
|
||||
if (ret == 0 && *key == NULL)
|
||||
ret = krb5_auth_con_getkey(context,
|
||||
ctx->auth_context,
|
||||
key);
|
||||
if (ret == 0 && *key == NULL) {
|
||||
krb5_set_error_message(context, 0, "No initiator subkey available");
|
||||
return GSS_KRB5_S_KG_NO_SUBKEY;
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
krb5_error_code
|
||||
_gsskrb5i_get_acceptor_subkey(const gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
krb5_keyblock **key)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
*key = NULL;
|
||||
|
||||
if (ctx->more_flags & LOCAL) {
|
||||
ret = krb5_auth_con_getremotesubkey(context,
|
||||
ctx->auth_context,
|
||||
key);
|
||||
} else {
|
||||
ret = krb5_auth_con_getlocalsubkey(context,
|
||||
ctx->auth_context,
|
||||
key);
|
||||
}
|
||||
if (ret == 0 && *key == NULL) {
|
||||
krb5_set_error_message(context, 0, "No acceptor subkey available");
|
||||
return GSS_KRB5_S_KG_NO_SUBKEY;
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gsskrb5i_get_token_key(const gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
krb5_keyblock **key)
|
||||
{
|
||||
_gsskrb5i_get_acceptor_subkey(ctx, context, key);
|
||||
if(*key == NULL) {
|
||||
/*
|
||||
* Only use the initiator subkey or ticket session key if an
|
||||
* acceptor subkey was not required.
|
||||
*/
|
||||
if ((ctx->more_flags & ACCEPTOR_SUBKEY) == 0)
|
||||
_gsskrb5i_get_initiator_subkey(ctx, context, key);
|
||||
}
|
||||
if (*key == NULL) {
|
||||
krb5_set_error_message(context, 0, "No token key available");
|
||||
return GSS_KRB5_S_KG_NO_SUBKEY;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static OM_uint32
|
||||
sub_wrap_size (
|
||||
OM_uint32 req_output_size,
|
||||
OM_uint32 * max_input_size,
|
||||
int blocksize,
|
||||
int extrasize
|
||||
)
|
||||
{
|
||||
size_t len, total_len;
|
||||
|
||||
len = 8 + req_output_size + blocksize + extrasize;
|
||||
|
||||
_gsskrb5_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
|
||||
total_len -= req_output_size; /* token length */
|
||||
if (total_len < req_output_size) {
|
||||
*max_input_size = (req_output_size - total_len);
|
||||
(*max_input_size) &= (~(OM_uint32)(blocksize - 1));
|
||||
} else {
|
||||
*max_input_size = 0;
|
||||
}
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_wrap_size_limit (
|
||||
OM_uint32 * minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
OM_uint32 req_output_size,
|
||||
OM_uint32 * max_input_size
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
krb5_keyblock *key;
|
||||
OM_uint32 ret;
|
||||
krb5_keytype keytype;
|
||||
const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (ctx->more_flags & IS_CFX)
|
||||
return _gssapi_wrap_size_cfx(minor_status, ctx, context,
|
||||
conf_req_flag, qop_req,
|
||||
req_output_size, max_input_size);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
ret = _gsskrb5i_get_token_key(ctx, context, &key);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
krb5_enctype_to_keytype (context, key->keytype, &keytype);
|
||||
|
||||
switch (keytype) {
|
||||
case KEYTYPE_DES :
|
||||
#ifdef HEIM_WEAK_CRYPTO
|
||||
ret = sub_wrap_size(req_output_size, max_input_size, 8, 22);
|
||||
#else
|
||||
ret = GSS_S_FAILURE;
|
||||
#endif
|
||||
break;
|
||||
case KEYTYPE_ARCFOUR:
|
||||
case KEYTYPE_ARCFOUR_56:
|
||||
ret = _gssapi_wrap_size_arcfour(minor_status, ctx, context,
|
||||
conf_req_flag, qop_req,
|
||||
req_output_size, max_input_size, key);
|
||||
break;
|
||||
case KEYTYPE_DES3 :
|
||||
ret = sub_wrap_size(req_output_size, max_input_size, 8, 34);
|
||||
break;
|
||||
default :
|
||||
abort();
|
||||
break;
|
||||
}
|
||||
krb5_free_keyblock (context, key);
|
||||
*minor_status = 0;
|
||||
return ret;
|
||||
}
|
||||
|
||||
#ifdef HEIM_WEAK_CRYPTO
|
||||
|
||||
static OM_uint32
|
||||
wrap_des
|
||||
(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
const gss_buffer_t input_message_buffer,
|
||||
int * conf_state,
|
||||
gss_buffer_t output_message_buffer,
|
||||
krb5_keyblock *key
|
||||
)
|
||||
{
|
||||
u_char *p;
|
||||
EVP_MD_CTX *md5;
|
||||
u_char hash[16];
|
||||
DES_key_schedule schedule;
|
||||
EVP_CIPHER_CTX des_ctx;
|
||||
DES_cblock deskey;
|
||||
DES_cblock zero;
|
||||
int i;
|
||||
int32_t seq_number;
|
||||
size_t len, total_len, padlength, datalen;
|
||||
|
||||
if (IS_DCE_STYLE(ctx)) {
|
||||
padlength = 0;
|
||||
datalen = input_message_buffer->length;
|
||||
len = 22 + 8;
|
||||
_gsskrb5_encap_length (len, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
total_len += datalen;
|
||||
datalen += 8;
|
||||
} else {
|
||||
padlength = 8 - (input_message_buffer->length % 8);
|
||||
datalen = input_message_buffer->length + padlength + 8;
|
||||
len = datalen + 22;
|
||||
_gsskrb5_encap_length (len, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
}
|
||||
|
||||
output_message_buffer->length = total_len;
|
||||
output_message_buffer->value = malloc (total_len);
|
||||
if (output_message_buffer->value == NULL) {
|
||||
output_message_buffer->length = 0;
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
p = _gsskrb5_make_header(output_message_buffer->value,
|
||||
len,
|
||||
"\x02\x01", /* TOK_ID */
|
||||
GSS_KRB5_MECHANISM);
|
||||
|
||||
/* SGN_ALG */
|
||||
memcpy (p, "\x00\x00", 2);
|
||||
p += 2;
|
||||
/* SEAL_ALG */
|
||||
if(conf_req_flag)
|
||||
memcpy (p, "\x00\x00", 2);
|
||||
else
|
||||
memcpy (p, "\xff\xff", 2);
|
||||
p += 2;
|
||||
/* Filler */
|
||||
memcpy (p, "\xff\xff", 2);
|
||||
p += 2;
|
||||
|
||||
/* fill in later */
|
||||
memset (p, 0, 16);
|
||||
p += 16;
|
||||
|
||||
/* confounder + data + pad */
|
||||
krb5_generate_random_block(p, 8);
|
||||
memcpy (p + 8, input_message_buffer->value,
|
||||
input_message_buffer->length);
|
||||
memset (p + 8 + input_message_buffer->length, padlength, padlength);
|
||||
|
||||
/* checksum */
|
||||
md5 = EVP_MD_CTX_create();
|
||||
EVP_DigestInit_ex(md5, EVP_md5(), NULL);
|
||||
EVP_DigestUpdate(md5, p - 24, 8);
|
||||
EVP_DigestUpdate(md5, p, datalen);
|
||||
EVP_DigestFinal_ex(md5, hash, NULL);
|
||||
EVP_MD_CTX_destroy(md5);
|
||||
|
||||
memset (&zero, 0, sizeof(zero));
|
||||
memcpy (&deskey, key->keyvalue.data, sizeof(deskey));
|
||||
DES_set_key_unchecked (&deskey, &schedule);
|
||||
DES_cbc_cksum ((void *)hash, (void *)hash, sizeof(hash),
|
||||
&schedule, &zero);
|
||||
memcpy (p - 8, hash, 8);
|
||||
|
||||
/* sequence number */
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
krb5_auth_con_getlocalseqnumber (context,
|
||||
ctx->auth_context,
|
||||
&seq_number);
|
||||
|
||||
p -= 16;
|
||||
p[0] = (seq_number >> 0) & 0xFF;
|
||||
p[1] = (seq_number >> 8) & 0xFF;
|
||||
p[2] = (seq_number >> 16) & 0xFF;
|
||||
p[3] = (seq_number >> 24) & 0xFF;
|
||||
memset (p + 4,
|
||||
(ctx->more_flags & LOCAL) ? 0 : 0xFF,
|
||||
4);
|
||||
|
||||
EVP_CIPHER_CTX_init(&des_ctx);
|
||||
EVP_CipherInit_ex(&des_ctx, EVP_des_cbc(), NULL, key->keyvalue.data, p + 8, 1);
|
||||
EVP_Cipher(&des_ctx, p, p, 8);
|
||||
EVP_CIPHER_CTX_cleanup(&des_ctx);
|
||||
|
||||
krb5_auth_con_setlocalseqnumber (context,
|
||||
ctx->auth_context,
|
||||
++seq_number);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
|
||||
/* encrypt the data */
|
||||
p += 16;
|
||||
|
||||
if(conf_req_flag) {
|
||||
memcpy (&deskey, key->keyvalue.data, sizeof(deskey));
|
||||
|
||||
for (i = 0; i < sizeof(deskey); ++i)
|
||||
deskey[i] ^= 0xf0;
|
||||
|
||||
EVP_CIPHER_CTX_init(&des_ctx);
|
||||
EVP_CipherInit_ex(&des_ctx, EVP_des_cbc(), NULL, deskey, zero, 1);
|
||||
EVP_Cipher(&des_ctx, p, p, datalen);
|
||||
EVP_CIPHER_CTX_cleanup(&des_ctx);
|
||||
}
|
||||
memset (deskey, 0, sizeof(deskey));
|
||||
memset (&schedule, 0, sizeof(schedule));
|
||||
|
||||
if(conf_state != NULL)
|
||||
*conf_state = conf_req_flag;
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
static OM_uint32
|
||||
wrap_des3
|
||||
(OM_uint32 * minor_status,
|
||||
const gsskrb5_ctx ctx,
|
||||
krb5_context context,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
const gss_buffer_t input_message_buffer,
|
||||
int * conf_state,
|
||||
gss_buffer_t output_message_buffer,
|
||||
krb5_keyblock *key
|
||||
)
|
||||
{
|
||||
u_char *p;
|
||||
u_char seq[8];
|
||||
int32_t seq_number;
|
||||
size_t len, total_len, padlength, datalen;
|
||||
uint32_t ret;
|
||||
krb5_crypto crypto;
|
||||
Checksum cksum;
|
||||
krb5_data encdata;
|
||||
|
||||
if (IS_DCE_STYLE(ctx)) {
|
||||
padlength = 0;
|
||||
datalen = input_message_buffer->length;
|
||||
len = 34 + 8;
|
||||
_gsskrb5_encap_length (len, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
total_len += datalen;
|
||||
datalen += 8;
|
||||
} else {
|
||||
padlength = 8 - (input_message_buffer->length % 8);
|
||||
datalen = input_message_buffer->length + padlength + 8;
|
||||
len = datalen + 34;
|
||||
_gsskrb5_encap_length (len, &len, &total_len, GSS_KRB5_MECHANISM);
|
||||
}
|
||||
|
||||
output_message_buffer->length = total_len;
|
||||
output_message_buffer->value = malloc (total_len);
|
||||
if (output_message_buffer->value == NULL) {
|
||||
output_message_buffer->length = 0;
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
p = _gsskrb5_make_header(output_message_buffer->value,
|
||||
len,
|
||||
"\x02\x01", /* TOK_ID */
|
||||
GSS_KRB5_MECHANISM);
|
||||
|
||||
/* SGN_ALG */
|
||||
memcpy (p, "\x04\x00", 2); /* HMAC SHA1 DES3-KD */
|
||||
p += 2;
|
||||
/* SEAL_ALG */
|
||||
if(conf_req_flag)
|
||||
memcpy (p, "\x02\x00", 2); /* DES3-KD */
|
||||
else
|
||||
memcpy (p, "\xff\xff", 2);
|
||||
p += 2;
|
||||
/* Filler */
|
||||
memcpy (p, "\xff\xff", 2);
|
||||
p += 2;
|
||||
|
||||
/* calculate checksum (the above + confounder + data + pad) */
|
||||
|
||||
memcpy (p + 20, p - 8, 8);
|
||||
krb5_generate_random_block(p + 28, 8);
|
||||
memcpy (p + 28 + 8, input_message_buffer->value,
|
||||
input_message_buffer->length);
|
||||
memset (p + 28 + 8 + input_message_buffer->length, padlength, padlength);
|
||||
|
||||
ret = krb5_crypto_init(context, key, 0, &crypto);
|
||||
if (ret) {
|
||||
free (output_message_buffer->value);
|
||||
output_message_buffer->length = 0;
|
||||
output_message_buffer->value = NULL;
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
ret = krb5_create_checksum (context,
|
||||
crypto,
|
||||
KRB5_KU_USAGE_SIGN,
|
||||
0,
|
||||
p + 20,
|
||||
datalen + 8,
|
||||
&cksum);
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
if (ret) {
|
||||
free (output_message_buffer->value);
|
||||
output_message_buffer->length = 0;
|
||||
output_message_buffer->value = NULL;
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
/* zero out SND_SEQ + SGN_CKSUM in case */
|
||||
memset (p, 0, 28);
|
||||
|
||||
memcpy (p + 8, cksum.checksum.data, cksum.checksum.length);
|
||||
free_Checksum (&cksum);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
/* sequence number */
|
||||
krb5_auth_con_getlocalseqnumber (context,
|
||||
ctx->auth_context,
|
||||
&seq_number);
|
||||
|
||||
seq[0] = (seq_number >> 0) & 0xFF;
|
||||
seq[1] = (seq_number >> 8) & 0xFF;
|
||||
seq[2] = (seq_number >> 16) & 0xFF;
|
||||
seq[3] = (seq_number >> 24) & 0xFF;
|
||||
memset (seq + 4,
|
||||
(ctx->more_flags & LOCAL) ? 0 : 0xFF,
|
||||
4);
|
||||
|
||||
|
||||
ret = krb5_crypto_init(context, key, ETYPE_DES3_CBC_NONE,
|
||||
&crypto);
|
||||
if (ret) {
|
||||
free (output_message_buffer->value);
|
||||
output_message_buffer->length = 0;
|
||||
output_message_buffer->value = NULL;
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
{
|
||||
DES_cblock ivec;
|
||||
|
||||
memcpy (&ivec, p + 8, 8);
|
||||
ret = krb5_encrypt_ivec (context,
|
||||
crypto,
|
||||
KRB5_KU_USAGE_SEQ,
|
||||
seq, 8, &encdata,
|
||||
&ivec);
|
||||
}
|
||||
krb5_crypto_destroy (context, crypto);
|
||||
if (ret) {
|
||||
free (output_message_buffer->value);
|
||||
output_message_buffer->length = 0;
|
||||
output_message_buffer->value = NULL;
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
assert (encdata.length == 8);
|
||||
|
||||
memcpy (p, encdata.data, encdata.length);
|
||||
krb5_data_free (&encdata);
|
||||
|
||||
krb5_auth_con_setlocalseqnumber (context,
|
||||
ctx->auth_context,
|
||||
++seq_number);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
|
||||
/* encrypt the data */
|
||||
p += 28;
|
||||
|
||||
if(conf_req_flag) {
|
||||
krb5_data tmp;
|
||||
|
||||
ret = krb5_crypto_init(context, key,
|
||||
ETYPE_DES3_CBC_NONE, &crypto);
|
||||
if (ret) {
|
||||
free (output_message_buffer->value);
|
||||
output_message_buffer->length = 0;
|
||||
output_message_buffer->value = NULL;
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
ret = krb5_encrypt(context, crypto, KRB5_KU_USAGE_SEAL,
|
||||
p, datalen, &tmp);
|
||||
krb5_crypto_destroy(context, crypto);
|
||||
if (ret) {
|
||||
free (output_message_buffer->value);
|
||||
output_message_buffer->length = 0;
|
||||
output_message_buffer->value = NULL;
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
assert (tmp.length == datalen);
|
||||
|
||||
memcpy (p, tmp.data, datalen);
|
||||
krb5_data_free(&tmp);
|
||||
}
|
||||
if(conf_state != NULL)
|
||||
*conf_state = conf_req_flag;
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
OM_uint32 GSSAPI_CALLCONV
|
||||
_gsskrb5_wrap
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
const gss_buffer_t input_message_buffer,
|
||||
int * conf_state,
|
||||
gss_buffer_t output_message_buffer
|
||||
)
|
||||
{
|
||||
krb5_context context;
|
||||
krb5_keyblock *key;
|
||||
OM_uint32 ret;
|
||||
krb5_keytype keytype;
|
||||
const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
|
||||
|
||||
output_message_buffer->value = NULL;
|
||||
output_message_buffer->length = 0;
|
||||
|
||||
GSSAPI_KRB5_INIT (&context);
|
||||
|
||||
if (ctx->more_flags & IS_CFX)
|
||||
return _gssapi_wrap_cfx (minor_status, ctx, context, conf_req_flag,
|
||||
input_message_buffer, conf_state,
|
||||
output_message_buffer);
|
||||
|
||||
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
|
||||
ret = _gsskrb5i_get_token_key(ctx, context, &key);
|
||||
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
krb5_enctype_to_keytype (context, key->keytype, &keytype);
|
||||
|
||||
switch (keytype) {
|
||||
case KEYTYPE_DES :
|
||||
#ifdef HEIM_WEAK_CRYPTO
|
||||
ret = wrap_des (minor_status, ctx, context, conf_req_flag,
|
||||
qop_req, input_message_buffer, conf_state,
|
||||
output_message_buffer, key);
|
||||
#else
|
||||
ret = GSS_S_FAILURE;
|
||||
#endif
|
||||
break;
|
||||
case KEYTYPE_DES3 :
|
||||
ret = wrap_des3 (minor_status, ctx, context, conf_req_flag,
|
||||
qop_req, input_message_buffer, conf_state,
|
||||
output_message_buffer, key);
|
||||
break;
|
||||
case KEYTYPE_ARCFOUR:
|
||||
case KEYTYPE_ARCFOUR_56:
|
||||
ret = _gssapi_wrap_arcfour (minor_status, ctx, context, conf_req_flag,
|
||||
qop_req, input_message_buffer, conf_state,
|
||||
output_message_buffer, key);
|
||||
break;
|
||||
default :
|
||||
abort();
|
||||
break;
|
||||
}
|
||||
krb5_free_keyblock (context, key);
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,175 @@
|
||||
EXPORTS
|
||||
__gss_c_nt_anonymous_oid_desc DATA ;!
|
||||
;! __gss_c_nt_anonymous
|
||||
__gss_c_nt_export_name_oid_desc DATA
|
||||
__gss_c_nt_hostbased_service_oid_desc DATA
|
||||
__gss_c_nt_hostbased_service_x_oid_desc DATA
|
||||
__gss_c_nt_machine_uid_name_oid_desc DATA
|
||||
__gss_c_nt_string_uid_name_oid_desc DATA
|
||||
__gss_c_nt_user_name_oid_desc DATA
|
||||
__gss_krb5_nt_principal_name_oid_desc DATA
|
||||
__gss_c_attr_stream_sizes_oid_desc DATA
|
||||
gss_accept_sec_context
|
||||
gss_acquire_cred
|
||||
gss_add_buffer_set_member
|
||||
gss_add_cred
|
||||
gss_add_oid_set_member
|
||||
gss_canonicalize_name
|
||||
gss_compare_name
|
||||
gss_context_query_attributes
|
||||
gss_context_time
|
||||
gss_create_empty_buffer_set
|
||||
gss_create_empty_oid_set
|
||||
gss_decapsulate_token
|
||||
gss_delete_sec_context
|
||||
gss_display_mech_attr
|
||||
gss_display_name
|
||||
gss_display_status
|
||||
gss_duplicate_name
|
||||
gss_duplicate_oid
|
||||
gss_encapsulate_token
|
||||
gss_export_cred
|
||||
gss_export_name
|
||||
gss_export_sec_context
|
||||
gss_get_mic
|
||||
gss_import_cred
|
||||
gss_import_name
|
||||
gss_import_sec_context
|
||||
gss_indicate_mechs
|
||||
gss_indicate_mechs_by_attrs
|
||||
gss_init_sec_context
|
||||
gss_inquire_attrs_for_mech
|
||||
gss_inquire_context
|
||||
gss_inquire_cred
|
||||
gss_inquire_cred_by_mech
|
||||
gss_inquire_cred_by_oid
|
||||
gss_inquire_mech_for_saslname
|
||||
gss_inquire_mechs_for_name
|
||||
gss_inquire_names_for_mech
|
||||
gss_inquire_saslname_for_mech
|
||||
gss_inquire_sec_context_by_oid ;!
|
||||
gss_krb5_ccache_name
|
||||
gss_krb5_copy_ccache
|
||||
gss_krb5_export_lucid_sec_context
|
||||
gss_krb5_free_lucid_sec_context
|
||||
gss_krb5_get_tkt_flags
|
||||
gss_krb5_import_cred
|
||||
gss_krb5_set_allowable_enctypes
|
||||
gss_mg_collect_error
|
||||
gss_mo_get
|
||||
gss_mo_set
|
||||
gss_mo_list
|
||||
gss_mo_name
|
||||
gss_name_to_oid
|
||||
gss_oid_to_name
|
||||
gss_oid_equal
|
||||
gss_oid_to_str
|
||||
gss_process_context_token
|
||||
gss_pseudo_random
|
||||
gss_release_buffer
|
||||
gss_release_buffer_set
|
||||
gss_release_cred
|
||||
gss_release_iov_buffer
|
||||
gss_release_name
|
||||
gss_release_oid
|
||||
gss_release_oid_set
|
||||
gss_seal
|
||||
gss_set_cred_option
|
||||
gss_set_sec_context_option
|
||||
gss_sign
|
||||
gss_test_oid_set_member
|
||||
gss_unseal
|
||||
gss_unwrap
|
||||
gss_unwrap_iov
|
||||
gss_verify
|
||||
gss_verify_mic
|
||||
gss_wrap
|
||||
gss_wrap_iov
|
||||
gss_wrap_iov_length
|
||||
gss_wrap_size_limit
|
||||
gsskrb5_extract_authtime_from_sec_context
|
||||
gsskrb5_extract_authz_data_from_sec_context
|
||||
gsskrb5_extract_service_keyblock
|
||||
gsskrb5_get_initiator_subkey
|
||||
gsskrb5_get_subkey
|
||||
gsskrb5_get_time_offset
|
||||
gsskrb5_register_acceptor_identity
|
||||
gsskrb5_set_default_realm
|
||||
gsskrb5_set_dns_canonicalize
|
||||
gsskrb5_set_send_to_kdc
|
||||
gsskrb5_set_time_offset
|
||||
krb5_gss_register_acceptor_identity
|
||||
|
||||
; _gsskrb5cfx_ are really internal symbols, but export
|
||||
; then now to make testing easier.
|
||||
_gsskrb5cfx_wrap_length_cfx
|
||||
_gssapi_wrap_size_cfx
|
||||
|
||||
initialize_gk5_error_table_r ;!
|
||||
|
||||
__gss_krb5_copy_ccache_x_oid_desc DATA
|
||||
__gss_krb5_get_tkt_flags_x_oid_desc DATA
|
||||
__gss_krb5_extract_authz_data_from_sec_context_x_oid_desc DATA
|
||||
__gss_krb5_compat_des3_mic_x_oid_desc DATA
|
||||
__gss_krb5_register_acceptor_identity_x_oid_desc DATA
|
||||
__gss_krb5_export_lucid_context_x_oid_desc DATA
|
||||
__gss_krb5_export_lucid_context_v1_x_oid_desc DATA
|
||||
__gss_krb5_set_dns_canonicalize_x_oid_desc DATA
|
||||
__gss_krb5_get_subkey_x_oid_desc DATA
|
||||
__gss_krb5_get_initiator_subkey_x_oid_desc DATA
|
||||
__gss_krb5_get_acceptor_subkey_x_oid_desc DATA
|
||||
__gss_krb5_send_to_kdc_x_oid_desc DATA
|
||||
__gss_krb5_get_authtime_x_oid_desc DATA
|
||||
__gss_krb5_get_service_keyblock_x_oid_desc DATA
|
||||
__gss_krb5_set_allowable_enctypes_x_oid_desc DATA
|
||||
__gss_krb5_set_default_realm_x_oid_desc DATA
|
||||
__gss_krb5_ccache_name_x_oid_desc DATA
|
||||
__gss_krb5_set_time_offset_x_oid_desc DATA
|
||||
__gss_krb5_get_time_offset_x_oid_desc DATA
|
||||
__gss_krb5_plugin_register_x_oid_desc DATA
|
||||
__gss_ntlm_get_session_key_x_oid_desc DATA
|
||||
__gss_c_nt_ntlm_oid_desc DATA
|
||||
__gss_c_nt_dn_oid_desc DATA
|
||||
__gss_krb5_nt_principal_name_referral_oid_desc DATA
|
||||
__gss_c_ntlm_avguest_oid_desc DATA
|
||||
__gss_c_ntlm_v1_oid_desc DATA
|
||||
__gss_c_ntlm_v2_oid_desc DATA
|
||||
__gss_c_ntlm_session_key_oid_desc DATA
|
||||
__gss_c_ntlm_force_v1_oid_desc DATA
|
||||
__gss_krb5_cred_no_ci_flags_x_oid_desc DATA
|
||||
__gss_krb5_import_cred_x_oid_desc DATA
|
||||
__gss_c_ma_sasl_mech_name_oid_desc DATA
|
||||
__gss_c_ma_mech_name_oid_desc DATA
|
||||
__gss_c_ma_mech_description_oid_desc DATA
|
||||
__gss_sasl_digest_md5_mechanism_oid_desc DATA
|
||||
__gss_krb5_mechanism_oid_desc DATA
|
||||
__gss_ntlm_mechanism_oid_desc DATA
|
||||
__gss_spnego_mechanism_oid_desc DATA
|
||||
__gss_c_peer_has_updated_spnego_oid_desc DATA
|
||||
__gss_c_ma_mech_concrete_oid_desc DATA
|
||||
__gss_c_ma_mech_pseudo_oid_desc DATA
|
||||
__gss_c_ma_mech_composite_oid_desc DATA
|
||||
__gss_c_ma_mech_nego_oid_desc DATA
|
||||
__gss_c_ma_mech_glue_oid_desc DATA
|
||||
__gss_c_ma_not_mech_oid_desc DATA
|
||||
__gss_c_ma_deprecated_oid_desc DATA
|
||||
__gss_c_ma_not_dflt_mech_oid_desc DATA
|
||||
__gss_c_ma_itok_framed_oid_desc DATA
|
||||
__gss_c_ma_auth_init_oid_desc DATA
|
||||
__gss_c_ma_auth_targ_oid_desc DATA
|
||||
__gss_c_ma_auth_init_init_oid_desc DATA
|
||||
__gss_c_ma_auth_targ_init_oid_desc DATA
|
||||
__gss_c_ma_auth_init_anon_oid_desc DATA
|
||||
__gss_c_ma_auth_targ_anon_oid_desc DATA
|
||||
__gss_c_ma_deleg_cred_oid_desc DATA
|
||||
__gss_c_ma_integ_prot_oid_desc DATA
|
||||
__gss_c_ma_conf_prot_oid_desc DATA
|
||||
__gss_c_ma_mic_oid_desc DATA
|
||||
__gss_c_ma_wrap_oid_desc DATA
|
||||
__gss_c_ma_prot_ready_oid_desc DATA
|
||||
__gss_c_ma_replay_det_oid_desc DATA
|
||||
__gss_c_ma_oos_det_oid_desc DATA
|
||||
__gss_c_ma_cbindings_oid_desc DATA
|
||||
__gss_c_ma_pfs_oid_desc DATA
|
||||
__gss_c_ma_compress_oid_desc DATA
|
||||
__gss_c_ma_ctx_trans_oid_desc DATA
|
||||
@@ -0,0 +1,36 @@
|
||||
/***********************************************************************
|
||||
* Copyright (c) 2010, Secure Endpoints Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* - Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* - Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
|
||||
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
||||
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
||||
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
**********************************************************************/
|
||||
|
||||
#define RC_FILE_TYPE VFT_DLL
|
||||
#define RC_FILE_DESC_0409 "Generic Security Service Application Program Interface library"
|
||||
#define RC_FILE_ORIG_0409 "gssapi.dll"
|
||||
|
||||
#include "../../windows/version.rc"
|
||||
@@ -0,0 +1,165 @@
|
||||
/* $NetBSD: context.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
#include "mech_locl.h"
|
||||
#include "heim_threads.h"
|
||||
|
||||
struct mg_thread_ctx {
|
||||
gss_OID mech;
|
||||
OM_uint32 maj_stat;
|
||||
OM_uint32 min_stat;
|
||||
gss_buffer_desc maj_error;
|
||||
gss_buffer_desc min_error;
|
||||
};
|
||||
|
||||
static HEIMDAL_MUTEX context_mutex = HEIMDAL_MUTEX_INITIALIZER;
|
||||
static int created_key;
|
||||
static HEIMDAL_thread_key context_key;
|
||||
|
||||
|
||||
static void
|
||||
destroy_context(void *ptr)
|
||||
{
|
||||
struct mg_thread_ctx *mg = ptr;
|
||||
OM_uint32 junk;
|
||||
|
||||
if (mg == NULL)
|
||||
return;
|
||||
|
||||
gss_release_buffer(&junk, &mg->maj_error);
|
||||
gss_release_buffer(&junk, &mg->min_error);
|
||||
free(mg);
|
||||
}
|
||||
|
||||
|
||||
static struct mg_thread_ctx *
|
||||
_gss_mechglue_thread(void)
|
||||
{
|
||||
struct mg_thread_ctx *ctx;
|
||||
int ret = 0;
|
||||
|
||||
HEIMDAL_MUTEX_lock(&context_mutex);
|
||||
|
||||
if (!created_key) {
|
||||
HEIMDAL_key_create(&context_key, destroy_context, ret);
|
||||
if (ret) {
|
||||
HEIMDAL_MUTEX_unlock(&context_mutex);
|
||||
return NULL;
|
||||
}
|
||||
created_key = 1;
|
||||
}
|
||||
HEIMDAL_MUTEX_unlock(&context_mutex);
|
||||
|
||||
ctx = HEIMDAL_getspecific(context_key);
|
||||
if (ctx == NULL) {
|
||||
|
||||
ctx = calloc(1, sizeof(*ctx));
|
||||
if (ctx == NULL)
|
||||
return NULL;
|
||||
HEIMDAL_setspecific(context_key, ctx, ret);
|
||||
if (ret) {
|
||||
free(ctx);
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
return ctx;
|
||||
}
|
||||
|
||||
OM_uint32
|
||||
_gss_mg_get_error(const gss_OID mech, OM_uint32 type,
|
||||
OM_uint32 value, gss_buffer_t string)
|
||||
{
|
||||
struct mg_thread_ctx *mg;
|
||||
|
||||
mg = _gss_mechglue_thread();
|
||||
if (mg == NULL)
|
||||
return GSS_S_BAD_STATUS;
|
||||
|
||||
#if 0
|
||||
/*
|
||||
* We cant check the mech here since a pseudo-mech might have
|
||||
* called an lower layer and then the mech info is all broken
|
||||
*/
|
||||
if (mech != NULL && gss_oid_equal(mg->mech, mech) == 0)
|
||||
return GSS_S_BAD_STATUS;
|
||||
#endif
|
||||
|
||||
switch (type) {
|
||||
case GSS_C_GSS_CODE: {
|
||||
if (value != mg->maj_stat || mg->maj_error.length == 0)
|
||||
break;
|
||||
string->value = malloc(mg->maj_error.length + 1);
|
||||
string->length = mg->maj_error.length;
|
||||
memcpy(string->value, mg->maj_error.value, mg->maj_error.length);
|
||||
((char *) string->value)[string->length] = '\0';
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
case GSS_C_MECH_CODE: {
|
||||
if (value != mg->min_stat || mg->min_error.length == 0)
|
||||
break;
|
||||
string->value = malloc(mg->min_error.length + 1);
|
||||
string->length = mg->min_error.length;
|
||||
memcpy(string->value, mg->min_error.value, mg->min_error.length);
|
||||
((char *) string->value)[string->length] = '\0';
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
}
|
||||
string->value = NULL;
|
||||
string->length = 0;
|
||||
return GSS_S_BAD_STATUS;
|
||||
}
|
||||
|
||||
void
|
||||
_gss_mg_error(gssapi_mech_interface m, OM_uint32 maj, OM_uint32 min)
|
||||
{
|
||||
OM_uint32 major_status, minor_status;
|
||||
OM_uint32 message_content;
|
||||
struct mg_thread_ctx *mg;
|
||||
|
||||
/*
|
||||
* Mechs without gss_display_status() does
|
||||
* gss_mg_collect_error() by themself.
|
||||
*/
|
||||
if (m->gm_display_status == NULL)
|
||||
return ;
|
||||
|
||||
mg = _gss_mechglue_thread();
|
||||
if (mg == NULL)
|
||||
return;
|
||||
|
||||
gss_release_buffer(&minor_status, &mg->maj_error);
|
||||
gss_release_buffer(&minor_status, &mg->min_error);
|
||||
|
||||
mg->mech = &m->gm_mech_oid;
|
||||
mg->maj_stat = maj;
|
||||
mg->min_stat = min;
|
||||
|
||||
major_status = m->gm_display_status(&minor_status,
|
||||
maj,
|
||||
GSS_C_GSS_CODE,
|
||||
&m->gm_mech_oid,
|
||||
&message_content,
|
||||
&mg->maj_error);
|
||||
if (GSS_ERROR(major_status)) {
|
||||
mg->maj_error.value = NULL;
|
||||
mg->maj_error.length = 0;
|
||||
}
|
||||
major_status = m->gm_display_status(&minor_status,
|
||||
min,
|
||||
GSS_C_MECH_CODE,
|
||||
&m->gm_mech_oid,
|
||||
&message_content,
|
||||
&mg->min_error);
|
||||
if (GSS_ERROR(major_status)) {
|
||||
mg->min_error.value = NULL;
|
||||
mg->min_error.length = 0;
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
gss_mg_collect_error(gss_OID mech, OM_uint32 maj, OM_uint32 min)
|
||||
{
|
||||
gssapi_mech_interface m = __gss_get_mechanism(mech);
|
||||
if (m == NULL)
|
||||
return;
|
||||
_gss_mg_error(m, maj, min);
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
/* $NetBSD: context.h,v 1.1.1.2 2011/04/14 14:08:27 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/context.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
* Id
|
||||
*/
|
||||
|
||||
#include <gssapi_mech.h>
|
||||
|
||||
struct _gss_context {
|
||||
gssapi_mech_interface gc_mech;
|
||||
gss_ctx_id_t gc_ctx;
|
||||
};
|
||||
|
||||
void
|
||||
_gss_mg_error(gssapi_mech_interface, OM_uint32, OM_uint32);
|
||||
|
||||
OM_uint32
|
||||
_gss_mg_get_error(const gss_OID, OM_uint32, OM_uint32, gss_buffer_t);
|
||||
@@ -0,0 +1,43 @@
|
||||
/* $NetBSD: cred.h,v 1.1.1.2 2011/04/14 14:08:27 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/cred.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
* Id
|
||||
*/
|
||||
|
||||
struct _gss_mechanism_cred {
|
||||
HEIM_SLIST_ENTRY(_gss_mechanism_cred) gmc_link;
|
||||
gssapi_mech_interface gmc_mech; /* mechanism ops for MC */
|
||||
gss_OID gmc_mech_oid; /* mechanism oid for MC */
|
||||
gss_cred_id_t gmc_cred; /* underlying MC */
|
||||
};
|
||||
HEIM_SLIST_HEAD(_gss_mechanism_cred_list, _gss_mechanism_cred);
|
||||
|
||||
struct _gss_cred {
|
||||
struct _gss_mechanism_cred_list gc_mc;
|
||||
};
|
||||
|
||||
@@ -0,0 +1,134 @@
|
||||
/* $NetBSD: doxygen.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2009 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/*! @mainpage Heimdal GSS-API Library
|
||||
*
|
||||
* Heimdal implements the following mechanisms:
|
||||
*
|
||||
* - Kerberos 5
|
||||
* - SPNEGO
|
||||
* - NTLM
|
||||
*
|
||||
* See @ref gssapi_mechs for more describtion about these mechanisms.
|
||||
*
|
||||
* The project web page: http://www.h5l.org/
|
||||
*
|
||||
* - @ref gssapi_services_intro
|
||||
* - @ref gssapi_mechs
|
||||
* - @ref gssapi_api_INvsMN
|
||||
*/
|
||||
|
||||
/**
|
||||
* @page gssapi_services_intro Introduction to GSS-API services
|
||||
* @section gssapi_services GSS-API services
|
||||
*
|
||||
* @subsection gssapi_services_context Context creation
|
||||
*
|
||||
* - delegation
|
||||
* - mutual authentication
|
||||
* - anonymous
|
||||
* - use per message before context creation has completed
|
||||
*
|
||||
* return status:
|
||||
* - support conf
|
||||
* - support int
|
||||
*
|
||||
* @subsection gssapi_context_flags Context creation flags
|
||||
*
|
||||
* - GSS_C_DELEG_FLAG
|
||||
* - GSS_C_MUTUAL_FLAG
|
||||
* - GSS_C_REPLAY_FLAG
|
||||
* - GSS_C_SEQUENCE_FLAG
|
||||
* - GSS_C_CONF_FLAG
|
||||
* - GSS_C_INTEG_FLAG
|
||||
* - GSS_C_ANON_FLAG
|
||||
* - GSS_C_PROT_READY_FLAG
|
||||
* - GSS_C_TRANS_FLAG
|
||||
* - GSS_C_DCE_STYLE
|
||||
* - GSS_C_IDENTIFY_FLAG
|
||||
* - GSS_C_EXTENDED_ERROR_FLAG
|
||||
* - GSS_C_DELEG_POLICY_FLAG
|
||||
*
|
||||
*
|
||||
* @subsection gssapi_services_permessage Per-message services
|
||||
*
|
||||
* - conf
|
||||
* - int
|
||||
* - message integrity
|
||||
* - replay detection
|
||||
* - out of sequence
|
||||
*
|
||||
*/
|
||||
|
||||
/**
|
||||
* @page gssapi_mechs_intro GSS-API mechanisms
|
||||
* @section gssapi_mechs GSS-API mechanisms
|
||||
*
|
||||
* - Kerberos 5 - GSS_KRB5_MECHANISM
|
||||
* - SPNEGO - GSS_SPNEGO_MECHANISM
|
||||
* - NTLM - GSS_NTLM_MECHANISM
|
||||
|
||||
*/
|
||||
|
||||
|
||||
/**
|
||||
* @page internalVSmechname Internal names and mechanism names
|
||||
* @section gssapi_api_INvsMN Name forms
|
||||
*
|
||||
* There are two forms of name in GSS-API, Internal form and
|
||||
* Contiguous string ("flat") form. gss_export_name() and
|
||||
* gss_import_name() can be used to convert between the two forms.
|
||||
*
|
||||
* - The contiguous string form is described by an oid specificing the
|
||||
* type and an octet string. A special form of the contiguous
|
||||
* string form is the exported name object. The exported name
|
||||
* defined for each mechanism, is something that can be stored and
|
||||
* complared later. The exported name is what should be used for
|
||||
* ACLs comparisons.
|
||||
*
|
||||
* - The Internal form
|
||||
*
|
||||
* There is also special form of the Internal Name (IN), and that is
|
||||
* the Mechanism Name (MN). In the mechanism name all the generic
|
||||
* information is stripped of and only contain the information for
|
||||
* one mechanism. In GSS-API some function return MN and some
|
||||
* require MN as input. Each of these function is marked up as such.
|
||||
*
|
||||
*
|
||||
* Describe relationship between import_name, canonicalize_name,
|
||||
* export_name and friends.
|
||||
*/
|
||||
|
||||
/** @defgroup gssapi Heimdal GSS-API functions */
|
||||
@@ -0,0 +1,310 @@
|
||||
/* $NetBSD: gss_accept_sec_context.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/gss_accept_sec_context.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
static OM_uint32
|
||||
parse_header(const gss_buffer_t input_token, gss_OID mech_oid)
|
||||
{
|
||||
unsigned char *p = input_token->value;
|
||||
size_t len = input_token->length;
|
||||
size_t a, b;
|
||||
|
||||
/*
|
||||
* Token must start with [APPLICATION 0] SEQUENCE.
|
||||
* But if it doesn't assume it is DCE-STYLE Kerberos!
|
||||
*/
|
||||
if (len == 0)
|
||||
return (GSS_S_DEFECTIVE_TOKEN);
|
||||
|
||||
p++;
|
||||
len--;
|
||||
|
||||
/*
|
||||
* Decode the length and make sure it agrees with the
|
||||
* token length.
|
||||
*/
|
||||
if (len == 0)
|
||||
return (GSS_S_DEFECTIVE_TOKEN);
|
||||
if ((*p & 0x80) == 0) {
|
||||
a = *p;
|
||||
p++;
|
||||
len--;
|
||||
} else {
|
||||
b = *p & 0x7f;
|
||||
p++;
|
||||
len--;
|
||||
if (len < b)
|
||||
return (GSS_S_DEFECTIVE_TOKEN);
|
||||
a = 0;
|
||||
while (b) {
|
||||
a = (a << 8) | *p;
|
||||
p++;
|
||||
len--;
|
||||
b--;
|
||||
}
|
||||
}
|
||||
if (a != len)
|
||||
return (GSS_S_DEFECTIVE_TOKEN);
|
||||
|
||||
/*
|
||||
* Decode the OID for the mechanism. Simplify life by
|
||||
* assuming that the OID length is less than 128 bytes.
|
||||
*/
|
||||
if (len < 2 || *p != 0x06)
|
||||
return (GSS_S_DEFECTIVE_TOKEN);
|
||||
if ((p[1] & 0x80) || p[1] > (len - 2))
|
||||
return (GSS_S_DEFECTIVE_TOKEN);
|
||||
mech_oid->length = p[1];
|
||||
p += 2;
|
||||
len -= 2;
|
||||
mech_oid->elements = p;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
static gss_OID_desc krb5_mechanism =
|
||||
{9, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02")};
|
||||
static gss_OID_desc ntlm_mechanism =
|
||||
{10, rk_UNCONST("\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a")};
|
||||
static gss_OID_desc spnego_mechanism =
|
||||
{6, rk_UNCONST("\x2b\x06\x01\x05\x05\x02")};
|
||||
|
||||
static OM_uint32
|
||||
choose_mech(const gss_buffer_t input, gss_OID mech_oid)
|
||||
{
|
||||
OM_uint32 status;
|
||||
|
||||
/*
|
||||
* First try to parse the gssapi token header and see if it's a
|
||||
* correct header, use that in the first hand.
|
||||
*/
|
||||
|
||||
status = parse_header(input, mech_oid);
|
||||
if (status == GSS_S_COMPLETE)
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
/*
|
||||
* Lets guess what mech is really is, callback function to mech ??
|
||||
*/
|
||||
|
||||
if (input->length > 8 &&
|
||||
memcmp((const char *)input->value, "NTLMSSP\x00", 8) == 0)
|
||||
{
|
||||
*mech_oid = ntlm_mechanism;
|
||||
return GSS_S_COMPLETE;
|
||||
} else if (input->length != 0 &&
|
||||
((const char *)input->value)[0] == 0x6E)
|
||||
{
|
||||
/* Could be a raw AP-REQ (check for APPLICATION tag) */
|
||||
*mech_oid = krb5_mechanism;
|
||||
return GSS_S_COMPLETE;
|
||||
} else if (input->length == 0) {
|
||||
/*
|
||||
* There is the a wierd mode of SPNEGO (in CIFS and
|
||||
* SASL GSS-SPENGO where the first token is zero
|
||||
* length and the acceptor returns a mech_list, lets
|
||||
* hope that is what is happening now.
|
||||
*
|
||||
* http://msdn.microsoft.com/en-us/library/cc213114.aspx
|
||||
* "NegTokenInit2 Variation for Server-Initiation"
|
||||
*/
|
||||
*mech_oid = spnego_mechanism;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_accept_sec_context(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t *context_handle,
|
||||
const gss_cred_id_t acceptor_cred_handle,
|
||||
const gss_buffer_t input_token,
|
||||
const gss_channel_bindings_t input_chan_bindings,
|
||||
gss_name_t *src_name,
|
||||
gss_OID *mech_type,
|
||||
gss_buffer_t output_token,
|
||||
OM_uint32 *ret_flags,
|
||||
OM_uint32 *time_rec,
|
||||
gss_cred_id_t *delegated_cred_handle)
|
||||
{
|
||||
OM_uint32 major_status, mech_ret_flags, junk;
|
||||
gssapi_mech_interface m;
|
||||
struct _gss_context *ctx = (struct _gss_context *) *context_handle;
|
||||
struct _gss_cred *cred = (struct _gss_cred *) acceptor_cred_handle;
|
||||
struct _gss_mechanism_cred *mc;
|
||||
gss_cred_id_t acceptor_mc, delegated_mc;
|
||||
gss_name_t src_mn;
|
||||
gss_OID mech_ret_type = NULL;
|
||||
|
||||
*minor_status = 0;
|
||||
if (src_name)
|
||||
*src_name = GSS_C_NO_NAME;
|
||||
if (mech_type)
|
||||
*mech_type = GSS_C_NO_OID;
|
||||
if (ret_flags)
|
||||
*ret_flags = 0;
|
||||
if (time_rec)
|
||||
*time_rec = 0;
|
||||
if (delegated_cred_handle)
|
||||
*delegated_cred_handle = GSS_C_NO_CREDENTIAL;
|
||||
_mg_buffer_zero(output_token);
|
||||
|
||||
|
||||
/*
|
||||
* If this is the first call (*context_handle is NULL), we must
|
||||
* parse the input token to figure out the mechanism to use.
|
||||
*/
|
||||
if (*context_handle == GSS_C_NO_CONTEXT) {
|
||||
gss_OID_desc mech_oid;
|
||||
|
||||
major_status = choose_mech(input_token, &mech_oid);
|
||||
if (major_status != GSS_S_COMPLETE)
|
||||
return major_status;
|
||||
|
||||
/*
|
||||
* Now that we have a mechanism, we can find the
|
||||
* implementation.
|
||||
*/
|
||||
ctx = malloc(sizeof(struct _gss_context));
|
||||
if (!ctx) {
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_DEFECTIVE_TOKEN);
|
||||
}
|
||||
memset(ctx, 0, sizeof(struct _gss_context));
|
||||
m = ctx->gc_mech = __gss_get_mechanism(&mech_oid);
|
||||
if (!m) {
|
||||
free(ctx);
|
||||
return (GSS_S_BAD_MECH);
|
||||
}
|
||||
*context_handle = (gss_ctx_id_t) ctx;
|
||||
} else {
|
||||
m = ctx->gc_mech;
|
||||
}
|
||||
|
||||
if (cred) {
|
||||
HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link)
|
||||
if (mc->gmc_mech == m)
|
||||
break;
|
||||
if (!mc) {
|
||||
gss_delete_sec_context(&junk, context_handle, NULL);
|
||||
return (GSS_S_BAD_MECH);
|
||||
}
|
||||
acceptor_mc = mc->gmc_cred;
|
||||
} else {
|
||||
acceptor_mc = GSS_C_NO_CREDENTIAL;
|
||||
}
|
||||
delegated_mc = GSS_C_NO_CREDENTIAL;
|
||||
|
||||
mech_ret_flags = 0;
|
||||
major_status = m->gm_accept_sec_context(minor_status,
|
||||
&ctx->gc_ctx,
|
||||
acceptor_mc,
|
||||
input_token,
|
||||
input_chan_bindings,
|
||||
&src_mn,
|
||||
&mech_ret_type,
|
||||
output_token,
|
||||
&mech_ret_flags,
|
||||
time_rec,
|
||||
&delegated_mc);
|
||||
if (major_status != GSS_S_COMPLETE &&
|
||||
major_status != GSS_S_CONTINUE_NEEDED)
|
||||
{
|
||||
_gss_mg_error(m, major_status, *minor_status);
|
||||
gss_delete_sec_context(&junk, context_handle, NULL);
|
||||
return (major_status);
|
||||
}
|
||||
|
||||
if (mech_type)
|
||||
*mech_type = mech_ret_type;
|
||||
|
||||
if (src_name && src_mn) {
|
||||
/*
|
||||
* Make a new name and mark it as an MN.
|
||||
*/
|
||||
struct _gss_name *name = _gss_make_name(m, src_mn);
|
||||
|
||||
if (!name) {
|
||||
m->gm_release_name(minor_status, &src_mn);
|
||||
gss_delete_sec_context(&junk, context_handle, NULL);
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
*src_name = (gss_name_t) name;
|
||||
} else if (src_mn) {
|
||||
m->gm_release_name(minor_status, &src_mn);
|
||||
}
|
||||
|
||||
if (mech_ret_flags & GSS_C_DELEG_FLAG) {
|
||||
if (!delegated_cred_handle) {
|
||||
m->gm_release_cred(minor_status, &delegated_mc);
|
||||
mech_ret_flags &=
|
||||
~(GSS_C_DELEG_FLAG|GSS_C_DELEG_POLICY_FLAG);
|
||||
} else if (gss_oid_equal(mech_ret_type, &m->gm_mech_oid) == 0) {
|
||||
/*
|
||||
* If the returned mech_type is not the same
|
||||
* as the mech, assume its pseudo mech type
|
||||
* and the returned type is already a
|
||||
* mech-glue object
|
||||
*/
|
||||
*delegated_cred_handle = delegated_mc;
|
||||
|
||||
} else if (delegated_mc) {
|
||||
struct _gss_cred *dcred;
|
||||
struct _gss_mechanism_cred *dmc;
|
||||
|
||||
dcred = malloc(sizeof(struct _gss_cred));
|
||||
if (!dcred) {
|
||||
*minor_status = ENOMEM;
|
||||
gss_delete_sec_context(&junk, context_handle, NULL);
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
HEIM_SLIST_INIT(&dcred->gc_mc);
|
||||
dmc = malloc(sizeof(struct _gss_mechanism_cred));
|
||||
if (!dmc) {
|
||||
free(dcred);
|
||||
*minor_status = ENOMEM;
|
||||
gss_delete_sec_context(&junk, context_handle, NULL);
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
dmc->gmc_mech = m;
|
||||
dmc->gmc_mech_oid = &m->gm_mech_oid;
|
||||
dmc->gmc_cred = delegated_mc;
|
||||
HEIM_SLIST_INSERT_HEAD(&dcred->gc_mc, dmc, gmc_link);
|
||||
|
||||
*delegated_cred_handle = (gss_cred_id_t) dcred;
|
||||
}
|
||||
}
|
||||
|
||||
if (ret_flags)
|
||||
*ret_flags = mech_ret_flags;
|
||||
return (major_status);
|
||||
}
|
||||
@@ -0,0 +1,170 @@
|
||||
/* $NetBSD: gss_acquire_cred.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/gss_acquire_cred.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_acquire_cred(OM_uint32 *minor_status,
|
||||
const gss_name_t desired_name,
|
||||
OM_uint32 time_req,
|
||||
const gss_OID_set desired_mechs,
|
||||
gss_cred_usage_t cred_usage,
|
||||
gss_cred_id_t *output_cred_handle,
|
||||
gss_OID_set *actual_mechs,
|
||||
OM_uint32 *time_rec)
|
||||
{
|
||||
OM_uint32 major_status;
|
||||
gss_OID_set mechs = desired_mechs;
|
||||
gss_OID_set_desc set;
|
||||
struct _gss_name *name = (struct _gss_name *) desired_name;
|
||||
gssapi_mech_interface m;
|
||||
struct _gss_cred *cred;
|
||||
struct _gss_mechanism_cred *mc;
|
||||
OM_uint32 min_time, cred_time;
|
||||
int i;
|
||||
|
||||
*minor_status = 0;
|
||||
if (output_cred_handle == NULL)
|
||||
return GSS_S_CALL_INACCESSIBLE_READ;
|
||||
if (actual_mechs)
|
||||
*actual_mechs = GSS_C_NO_OID_SET;
|
||||
if (time_rec)
|
||||
*time_rec = 0;
|
||||
|
||||
_gss_load_mech();
|
||||
|
||||
/*
|
||||
* First make sure that at least one of the requested
|
||||
* mechanisms is one that we support.
|
||||
*/
|
||||
if (mechs) {
|
||||
for (i = 0; i < mechs->count; i++) {
|
||||
int t;
|
||||
gss_test_oid_set_member(minor_status,
|
||||
&mechs->elements[i], _gss_mech_oids, &t);
|
||||
if (t)
|
||||
break;
|
||||
}
|
||||
if (i == mechs->count) {
|
||||
*minor_status = 0;
|
||||
return (GSS_S_BAD_MECH);
|
||||
}
|
||||
}
|
||||
|
||||
if (actual_mechs) {
|
||||
major_status = gss_create_empty_oid_set(minor_status,
|
||||
actual_mechs);
|
||||
if (major_status)
|
||||
return (major_status);
|
||||
}
|
||||
|
||||
cred = malloc(sizeof(struct _gss_cred));
|
||||
if (!cred) {
|
||||
if (actual_mechs)
|
||||
gss_release_oid_set(minor_status, actual_mechs);
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
HEIM_SLIST_INIT(&cred->gc_mc);
|
||||
|
||||
if (mechs == GSS_C_NO_OID_SET)
|
||||
mechs = _gss_mech_oids;
|
||||
|
||||
set.count = 1;
|
||||
min_time = GSS_C_INDEFINITE;
|
||||
for (i = 0; i < mechs->count; i++) {
|
||||
struct _gss_mechanism_name *mn = NULL;
|
||||
|
||||
m = __gss_get_mechanism(&mechs->elements[i]);
|
||||
if (!m)
|
||||
continue;
|
||||
|
||||
if (desired_name != GSS_C_NO_NAME) {
|
||||
major_status = _gss_find_mn(minor_status, name,
|
||||
&mechs->elements[i], &mn);
|
||||
if (major_status != GSS_S_COMPLETE)
|
||||
continue;
|
||||
}
|
||||
|
||||
mc = malloc(sizeof(struct _gss_mechanism_cred));
|
||||
if (!mc) {
|
||||
continue;
|
||||
}
|
||||
mc->gmc_mech = m;
|
||||
mc->gmc_mech_oid = &m->gm_mech_oid;
|
||||
|
||||
/*
|
||||
* XXX Probably need to do something with actual_mechs.
|
||||
*/
|
||||
set.elements = &mechs->elements[i];
|
||||
major_status = m->gm_acquire_cred(minor_status,
|
||||
(desired_name != GSS_C_NO_NAME
|
||||
? mn->gmn_name : GSS_C_NO_NAME),
|
||||
time_req, &set, cred_usage,
|
||||
&mc->gmc_cred, NULL, &cred_time);
|
||||
if (major_status) {
|
||||
free(mc);
|
||||
continue;
|
||||
}
|
||||
if (cred_time < min_time)
|
||||
min_time = cred_time;
|
||||
|
||||
if (actual_mechs) {
|
||||
major_status = gss_add_oid_set_member(minor_status,
|
||||
mc->gmc_mech_oid, actual_mechs);
|
||||
if (major_status) {
|
||||
m->gm_release_cred(minor_status,
|
||||
&mc->gmc_cred);
|
||||
free(mc);
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
HEIM_SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
|
||||
}
|
||||
|
||||
/*
|
||||
* If we didn't manage to create a single credential, return
|
||||
* an error.
|
||||
*/
|
||||
if (!HEIM_SLIST_FIRST(&cred->gc_mc)) {
|
||||
free(cred);
|
||||
if (actual_mechs)
|
||||
gss_release_oid_set(minor_status, actual_mechs);
|
||||
*minor_status = 0;
|
||||
return (GSS_S_NO_CRED);
|
||||
}
|
||||
|
||||
if (time_rec)
|
||||
*time_rec = min_time;
|
||||
*output_cred_handle = (gss_cred_id_t) cred;
|
||||
*minor_status = 0;
|
||||
return (GSS_S_COMPLETE);
|
||||
}
|
||||
@@ -0,0 +1,188 @@
|
||||
/* $NetBSD: gss_add_cred.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/gss_add_cred.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
static struct _gss_mechanism_cred *
|
||||
_gss_copy_cred(struct _gss_mechanism_cred *mc)
|
||||
{
|
||||
struct _gss_mechanism_cred *new_mc;
|
||||
gssapi_mech_interface m = mc->gmc_mech;
|
||||
OM_uint32 major_status, minor_status;
|
||||
gss_name_t name;
|
||||
gss_cred_id_t cred;
|
||||
OM_uint32 initiator_lifetime, acceptor_lifetime;
|
||||
gss_cred_usage_t cred_usage;
|
||||
|
||||
major_status = m->gm_inquire_cred_by_mech(&minor_status,
|
||||
mc->gmc_cred, mc->gmc_mech_oid,
|
||||
&name, &initiator_lifetime, &acceptor_lifetime, &cred_usage);
|
||||
if (major_status) {
|
||||
_gss_mg_error(m, major_status, minor_status);
|
||||
return (0);
|
||||
}
|
||||
|
||||
major_status = m->gm_add_cred(&minor_status,
|
||||
GSS_C_NO_CREDENTIAL, name, mc->gmc_mech_oid,
|
||||
cred_usage, initiator_lifetime, acceptor_lifetime,
|
||||
&cred, 0, 0, 0);
|
||||
m->gm_release_name(&minor_status, &name);
|
||||
|
||||
if (major_status) {
|
||||
_gss_mg_error(m, major_status, minor_status);
|
||||
return (0);
|
||||
}
|
||||
|
||||
new_mc = malloc(sizeof(struct _gss_mechanism_cred));
|
||||
if (!new_mc) {
|
||||
m->gm_release_cred(&minor_status, &cred);
|
||||
return (0);
|
||||
}
|
||||
new_mc->gmc_mech = m;
|
||||
new_mc->gmc_mech_oid = &m->gm_mech_oid;
|
||||
new_mc->gmc_cred = cred;
|
||||
|
||||
return (new_mc);
|
||||
}
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_add_cred(OM_uint32 *minor_status,
|
||||
const gss_cred_id_t input_cred_handle,
|
||||
const gss_name_t desired_name,
|
||||
const gss_OID desired_mech,
|
||||
gss_cred_usage_t cred_usage,
|
||||
OM_uint32 initiator_time_req,
|
||||
OM_uint32 acceptor_time_req,
|
||||
gss_cred_id_t *output_cred_handle,
|
||||
gss_OID_set *actual_mechs,
|
||||
OM_uint32 *initiator_time_rec,
|
||||
OM_uint32 *acceptor_time_rec)
|
||||
{
|
||||
OM_uint32 major_status;
|
||||
gssapi_mech_interface m;
|
||||
struct _gss_cred *cred = (struct _gss_cred *) input_cred_handle;
|
||||
struct _gss_cred *new_cred;
|
||||
gss_cred_id_t release_cred;
|
||||
struct _gss_mechanism_cred *mc, *target_mc, *copy_mc;
|
||||
struct _gss_mechanism_name *mn;
|
||||
OM_uint32 junk;
|
||||
|
||||
*minor_status = 0;
|
||||
*output_cred_handle = GSS_C_NO_CREDENTIAL;
|
||||
if (initiator_time_rec)
|
||||
*initiator_time_rec = 0;
|
||||
if (acceptor_time_rec)
|
||||
*acceptor_time_rec = 0;
|
||||
if (actual_mechs)
|
||||
*actual_mechs = GSS_C_NO_OID_SET;
|
||||
|
||||
new_cred = malloc(sizeof(struct _gss_cred));
|
||||
if (!new_cred) {
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
HEIM_SLIST_INIT(&new_cred->gc_mc);
|
||||
|
||||
/*
|
||||
* We go through all the mc attached to the input_cred_handle
|
||||
* and check the mechanism. If it matches, we call
|
||||
* gss_add_cred for that mechanism, otherwise we copy the mc
|
||||
* to new_cred.
|
||||
*/
|
||||
target_mc = 0;
|
||||
if (cred) {
|
||||
HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
|
||||
if (gss_oid_equal(mc->gmc_mech_oid, desired_mech)) {
|
||||
target_mc = mc;
|
||||
}
|
||||
copy_mc = _gss_copy_cred(mc);
|
||||
if (!copy_mc) {
|
||||
release_cred = (gss_cred_id_t)new_cred;
|
||||
gss_release_cred(&junk, &release_cred);
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
HEIM_SLIST_INSERT_HEAD(&new_cred->gc_mc, copy_mc, gmc_link);
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Figure out a suitable mn, if any.
|
||||
*/
|
||||
if (desired_name) {
|
||||
major_status = _gss_find_mn(minor_status,
|
||||
(struct _gss_name *) desired_name,
|
||||
desired_mech,
|
||||
&mn);
|
||||
if (major_status != GSS_S_COMPLETE) {
|
||||
free(new_cred);
|
||||
return major_status;
|
||||
}
|
||||
} else {
|
||||
mn = 0;
|
||||
}
|
||||
|
||||
m = __gss_get_mechanism(desired_mech);
|
||||
|
||||
mc = malloc(sizeof(struct _gss_mechanism_cred));
|
||||
if (!mc) {
|
||||
release_cred = (gss_cred_id_t)new_cred;
|
||||
gss_release_cred(&junk, &release_cred);
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
mc->gmc_mech = m;
|
||||
mc->gmc_mech_oid = &m->gm_mech_oid;
|
||||
|
||||
major_status = m->gm_add_cred(minor_status,
|
||||
target_mc ? target_mc->gmc_cred : GSS_C_NO_CREDENTIAL,
|
||||
desired_name ? mn->gmn_name : GSS_C_NO_NAME,
|
||||
desired_mech,
|
||||
cred_usage,
|
||||
initiator_time_req,
|
||||
acceptor_time_req,
|
||||
&mc->gmc_cred,
|
||||
actual_mechs,
|
||||
initiator_time_rec,
|
||||
acceptor_time_rec);
|
||||
|
||||
if (major_status) {
|
||||
_gss_mg_error(m, major_status, *minor_status);
|
||||
release_cred = (gss_cred_id_t)new_cred;
|
||||
gss_release_cred(&junk, &release_cred);
|
||||
free(mc);
|
||||
return (major_status);
|
||||
}
|
||||
HEIM_SLIST_INSERT_HEAD(&new_cred->gc_mc, mc, gmc_link);
|
||||
*output_cred_handle = (gss_cred_id_t) new_cred;
|
||||
|
||||
return (GSS_S_COMPLETE);
|
||||
}
|
||||
|
||||
@@ -0,0 +1,86 @@
|
||||
/* $NetBSD: gss_add_oid_set_member.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
/**
|
||||
* Add a oid to the oid set, function does not make a copy of the oid,
|
||||
* so the pointer to member_oid needs to be stable for the whole time
|
||||
* oid_set is used.
|
||||
*
|
||||
* If there is a duplicate member of the oid, the new member is not
|
||||
* added to to the set.
|
||||
*
|
||||
* @param minor_status minor status code.
|
||||
* @param member_oid member to add to the oid set
|
||||
* @param oid_set oid set to add the member too
|
||||
*
|
||||
* @returns a gss_error code, see gss_display_status() about printing
|
||||
* the error code.
|
||||
*
|
||||
* @ingroup gssapi
|
||||
*/
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_add_oid_set_member (OM_uint32 * minor_status,
|
||||
const gss_OID member_oid,
|
||||
gss_OID_set * oid_set)
|
||||
{
|
||||
gss_OID tmp;
|
||||
size_t n;
|
||||
OM_uint32 res;
|
||||
int present;
|
||||
|
||||
res = gss_test_oid_set_member(minor_status, member_oid, *oid_set, &present);
|
||||
if (res != GSS_S_COMPLETE)
|
||||
return res;
|
||||
|
||||
if (present) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
n = (*oid_set)->count + 1;
|
||||
tmp = realloc ((*oid_set)->elements, n * sizeof(gss_OID_desc));
|
||||
if (tmp == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
(*oid_set)->elements = tmp;
|
||||
(*oid_set)->count = n;
|
||||
(*oid_set)->elements[n-1] = *member_oid;
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,218 @@
|
||||
/* $NetBSD: gss_aeap.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* AEAD support
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
/**
|
||||
* Encrypts or sign the data.
|
||||
*
|
||||
* This is a more complicated version of gss_wrap(), it allows the
|
||||
* caller to use AEAD data (signed header/trailer) and allow greater
|
||||
* controll over where the encrypted data is placed.
|
||||
*
|
||||
* The maximum packet size is gss_context_stream_sizes.max_msg_size.
|
||||
*
|
||||
* The caller needs provide the folloing buffers when using in conf_req_flag=1 mode:
|
||||
*
|
||||
* - HEADER (of size gss_context_stream_sizes.header)
|
||||
* { DATA or SIGN_ONLY } (optional, zero or more)
|
||||
* PADDING (of size gss_context_stream_sizes.blocksize, if zero padding is zero, can be omitted)
|
||||
* TRAILER (of size gss_context_stream_sizes.trailer)
|
||||
*
|
||||
* - on DCE-RPC mode, the caller can skip PADDING and TRAILER if the
|
||||
* DATA elements is padded to a block bountry and header is of at
|
||||
* least size gss_context_stream_sizes.header + gss_context_stream_sizes.trailer.
|
||||
*
|
||||
* HEADER, PADDING, TRAILER will be shrunken to the size required to transmit any of them too large.
|
||||
*
|
||||
* To generate gss_wrap() compatible packets, use: HEADER | DATA | PADDING | TRAILER
|
||||
*
|
||||
* When used in conf_req_flag=0,
|
||||
*
|
||||
* - HEADER (of size gss_context_stream_sizes.header)
|
||||
* { DATA or SIGN_ONLY } (optional, zero or more)
|
||||
* PADDING (of size gss_context_stream_sizes.blocksize, if zero padding is zero, can be omitted)
|
||||
* TRAILER (of size gss_context_stream_sizes.trailer)
|
||||
*
|
||||
*
|
||||
* The input sizes of HEADER, PADDING and TRAILER can be fetched using gss_wrap_iov_length() or
|
||||
* gss_context_query_attributes().
|
||||
*
|
||||
* @ingroup gssapi
|
||||
*/
|
||||
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_wrap_iov(OM_uint32 * minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
int * conf_state,
|
||||
gss_iov_buffer_desc *iov,
|
||||
int iov_count)
|
||||
{
|
||||
struct _gss_context *ctx = (struct _gss_context *) context_handle;
|
||||
gssapi_mech_interface m;
|
||||
|
||||
if (minor_status)
|
||||
*minor_status = 0;
|
||||
if (conf_state)
|
||||
*conf_state = 0;
|
||||
if (ctx == NULL)
|
||||
return GSS_S_NO_CONTEXT;
|
||||
if (iov == NULL && iov_count != 0)
|
||||
return GSS_S_CALL_INACCESSIBLE_READ;
|
||||
|
||||
m = ctx->gc_mech;
|
||||
|
||||
if (m->gm_wrap_iov == NULL)
|
||||
return GSS_S_UNAVAILABLE;
|
||||
|
||||
return (m->gm_wrap_iov)(minor_status, ctx->gc_ctx,
|
||||
conf_req_flag, qop_req, conf_state,
|
||||
iov, iov_count);
|
||||
}
|
||||
|
||||
/**
|
||||
* Decrypt or verifies the signature on the data.
|
||||
*
|
||||
*
|
||||
* @ingroup gssapi
|
||||
*/
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_unwrap_iov(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
int *conf_state,
|
||||
gss_qop_t *qop_state,
|
||||
gss_iov_buffer_desc *iov,
|
||||
int iov_count)
|
||||
{
|
||||
struct _gss_context *ctx = (struct _gss_context *) context_handle;
|
||||
gssapi_mech_interface m;
|
||||
|
||||
if (minor_status)
|
||||
*minor_status = 0;
|
||||
if (conf_state)
|
||||
*conf_state = 0;
|
||||
if (qop_state)
|
||||
*qop_state = 0;
|
||||
if (ctx == NULL)
|
||||
return GSS_S_NO_CONTEXT;
|
||||
if (iov == NULL && iov_count != 0)
|
||||
return GSS_S_CALL_INACCESSIBLE_READ;
|
||||
|
||||
m = ctx->gc_mech;
|
||||
|
||||
if (m->gm_unwrap_iov == NULL)
|
||||
return GSS_S_UNAVAILABLE;
|
||||
|
||||
return (m->gm_unwrap_iov)(minor_status, ctx->gc_ctx,
|
||||
conf_state, qop_state,
|
||||
iov, iov_count);
|
||||
}
|
||||
|
||||
/**
|
||||
* Update the length fields in iov buffer for the types:
|
||||
* - GSS_IOV_BUFFER_TYPE_HEADER
|
||||
* - GSS_IOV_BUFFER_TYPE_PADDING
|
||||
* - GSS_IOV_BUFFER_TYPE_TRAILER
|
||||
*
|
||||
* Consider using gss_context_query_attributes() to fetch the data instead.
|
||||
*
|
||||
* @ingroup gssapi
|
||||
*/
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_wrap_iov_length(OM_uint32 * minor_status,
|
||||
gss_ctx_id_t context_handle,
|
||||
int conf_req_flag,
|
||||
gss_qop_t qop_req,
|
||||
int *conf_state,
|
||||
gss_iov_buffer_desc *iov,
|
||||
int iov_count)
|
||||
{
|
||||
struct _gss_context *ctx = (struct _gss_context *) context_handle;
|
||||
gssapi_mech_interface m;
|
||||
|
||||
if (minor_status)
|
||||
*minor_status = 0;
|
||||
if (conf_state)
|
||||
*conf_state = 0;
|
||||
if (ctx == NULL)
|
||||
return GSS_S_NO_CONTEXT;
|
||||
if (iov == NULL && iov_count != 0)
|
||||
return GSS_S_CALL_INACCESSIBLE_READ;
|
||||
|
||||
m = ctx->gc_mech;
|
||||
|
||||
if (m->gm_wrap_iov_length == NULL)
|
||||
return GSS_S_UNAVAILABLE;
|
||||
|
||||
return (m->gm_wrap_iov_length)(minor_status, ctx->gc_ctx,
|
||||
conf_req_flag, qop_req, conf_state,
|
||||
iov, iov_count);
|
||||
}
|
||||
|
||||
/**
|
||||
* Free all buffer allocated by gss_wrap_iov() or gss_unwrap_iov() by
|
||||
* looking at the GSS_IOV_BUFFER_FLAG_ALLOCATED flag.
|
||||
*
|
||||
* @ingroup gssapi
|
||||
*/
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_release_iov_buffer(OM_uint32 *minor_status,
|
||||
gss_iov_buffer_desc *iov,
|
||||
int iov_count)
|
||||
{
|
||||
OM_uint32 junk;
|
||||
size_t i;
|
||||
|
||||
if (minor_status)
|
||||
*minor_status = 0;
|
||||
if (iov == NULL && iov_count != 0)
|
||||
return GSS_S_CALL_INACCESSIBLE_READ;
|
||||
|
||||
for (i = 0; i < iov_count; i++) {
|
||||
if ((iov[i].type & GSS_IOV_BUFFER_FLAG_ALLOCATED) == 0)
|
||||
continue;
|
||||
gss_release_buffer(&junk, &iov[i].buffer);
|
||||
iov[i].type &= ~GSS_IOV_BUFFER_FLAG_ALLOCATED;
|
||||
}
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Query the context for parameters.
|
||||
*
|
||||
* SSPI equivalent if this function is QueryContextAttributes.
|
||||
*
|
||||
* - GSS_C_ATTR_STREAM_SIZES data is a gss_context_stream_sizes.
|
||||
*
|
||||
* @ingroup gssapi
|
||||
*/
|
||||
|
||||
gss_OID_desc GSSAPI_LIB_FUNCTION __gss_c_attr_stream_sizes_oid_desc =
|
||||
{10, rk_UNCONST("\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x03")};
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_context_query_attributes(OM_uint32 *minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
const gss_OID attribute,
|
||||
void *data,
|
||||
size_t len)
|
||||
{
|
||||
if (minor_status)
|
||||
*minor_status = 0;
|
||||
|
||||
if (gss_oid_equal(GSS_C_ATTR_STREAM_SIZES, attribute)) {
|
||||
memset(data, 0, len);
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
@@ -0,0 +1,126 @@
|
||||
/* $NetBSD: gss_buffer_set.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2004, PADL Software Pty Ltd.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of PADL Software nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_create_empty_buffer_set
|
||||
(OM_uint32 * minor_status,
|
||||
gss_buffer_set_t *buffer_set)
|
||||
{
|
||||
gss_buffer_set_t set;
|
||||
|
||||
set = (gss_buffer_set_desc *) malloc(sizeof(*set));
|
||||
if (set == GSS_C_NO_BUFFER_SET) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
set->count = 0;
|
||||
set->elements = NULL;
|
||||
|
||||
*buffer_set = set;
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_add_buffer_set_member
|
||||
(OM_uint32 * minor_status,
|
||||
const gss_buffer_t member_buffer,
|
||||
gss_buffer_set_t *buffer_set)
|
||||
{
|
||||
gss_buffer_set_t set;
|
||||
gss_buffer_t p;
|
||||
OM_uint32 ret;
|
||||
|
||||
if (*buffer_set == GSS_C_NO_BUFFER_SET) {
|
||||
ret = gss_create_empty_buffer_set(minor_status,
|
||||
buffer_set);
|
||||
if (ret) {
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
|
||||
set = *buffer_set;
|
||||
set->elements = realloc(set->elements,
|
||||
(set->count + 1) * sizeof(set->elements[0]));
|
||||
if (set->elements == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
p = &set->elements[set->count];
|
||||
|
||||
p->value = malloc(member_buffer->length);
|
||||
if (p->value == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
memcpy(p->value, member_buffer->value, member_buffer->length);
|
||||
p->length = member_buffer->length;
|
||||
|
||||
set->count++;
|
||||
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_release_buffer_set(OM_uint32 * minor_status,
|
||||
gss_buffer_set_t *buffer_set)
|
||||
{
|
||||
int i;
|
||||
OM_uint32 minor;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
if (*buffer_set == GSS_C_NO_BUFFER_SET)
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
for (i = 0; i < (*buffer_set)->count; i++)
|
||||
gss_release_buffer(&minor, &((*buffer_set)->elements[i]));
|
||||
|
||||
free((*buffer_set)->elements);
|
||||
|
||||
(*buffer_set)->elements = NULL;
|
||||
(*buffer_set)->count = 0;
|
||||
|
||||
free(*buffer_set);
|
||||
*buffer_set = GSS_C_NO_BUFFER_SET;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,113 @@
|
||||
/* $NetBSD: gss_canonicalize_name.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/gss_canonicalize_name.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
/**
|
||||
* gss_canonicalize_name takes a Internal Name (IN) and converts in into a
|
||||
* mechanism specific Mechanism Name (MN).
|
||||
*
|
||||
* The input name may multiple name, or generic name types.
|
||||
*
|
||||
* If the input_name if of the GSS_C_NT_USER_NAME, and the Kerberos
|
||||
* mechanism is specified, the resulting MN type is a
|
||||
* GSS_KRB5_NT_PRINCIPAL_NAME.
|
||||
*
|
||||
* For more information about @ref internalVSmechname.
|
||||
*
|
||||
* @param minor_status minor status code.
|
||||
* @param input_name name to covert, unchanged by gss_canonicalize_name().
|
||||
* @param mech_type the type to convert Name too.
|
||||
* @param output_name the resulting type, release with
|
||||
* gss_release_name(), independent of input_name.
|
||||
*
|
||||
* @returns a gss_error code, see gss_display_status() about printing
|
||||
* the error code.
|
||||
*
|
||||
* @ingroup gssapi
|
||||
*/
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_canonicalize_name(OM_uint32 *minor_status,
|
||||
const gss_name_t input_name,
|
||||
const gss_OID mech_type,
|
||||
gss_name_t *output_name)
|
||||
{
|
||||
OM_uint32 major_status;
|
||||
struct _gss_name *name = (struct _gss_name *) input_name;
|
||||
struct _gss_mechanism_name *mn;
|
||||
gssapi_mech_interface m;
|
||||
gss_name_t new_canonical_name;
|
||||
|
||||
*minor_status = 0;
|
||||
*output_name = 0;
|
||||
|
||||
major_status = _gss_find_mn(minor_status, name, mech_type, &mn);
|
||||
if (major_status)
|
||||
return major_status;
|
||||
|
||||
m = mn->gmn_mech;
|
||||
major_status = m->gm_canonicalize_name(minor_status,
|
||||
mn->gmn_name, mech_type, &new_canonical_name);
|
||||
if (major_status) {
|
||||
_gss_mg_error(m, major_status, *minor_status);
|
||||
return (major_status);
|
||||
}
|
||||
|
||||
/*
|
||||
* Now we make a new name and mark it as an MN.
|
||||
*/
|
||||
*minor_status = 0;
|
||||
name = malloc(sizeof(struct _gss_name));
|
||||
if (!name) {
|
||||
m->gm_release_name(minor_status, &new_canonical_name);
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
memset(name, 0, sizeof(struct _gss_name));
|
||||
|
||||
mn = malloc(sizeof(struct _gss_mechanism_name));
|
||||
if (!mn) {
|
||||
m->gm_release_name(minor_status, &new_canonical_name);
|
||||
free(name);
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
|
||||
HEIM_SLIST_INIT(&name->gn_mn);
|
||||
mn->gmn_mech = m;
|
||||
mn->gmn_mech_oid = &m->gm_mech_oid;
|
||||
mn->gmn_name = new_canonical_name;
|
||||
HEIM_SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
|
||||
|
||||
*output_name = (gss_name_t) name;
|
||||
|
||||
return (GSS_S_COMPLETE);
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
/* $NetBSD: gss_compare_name.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/gss_compare_name.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_compare_name(OM_uint32 *minor_status,
|
||||
const gss_name_t name1_arg,
|
||||
const gss_name_t name2_arg,
|
||||
int *name_equal)
|
||||
{
|
||||
struct _gss_name *name1 = (struct _gss_name *) name1_arg;
|
||||
struct _gss_name *name2 = (struct _gss_name *) name2_arg;
|
||||
|
||||
/*
|
||||
* First check the implementation-independant name if both
|
||||
* names have one. Otherwise, try to find common mechanism
|
||||
* names and compare them.
|
||||
*/
|
||||
if (name1->gn_value.value && name2->gn_value.value) {
|
||||
*name_equal = 1;
|
||||
if (!gss_oid_equal(&name1->gn_type, &name2->gn_type)) {
|
||||
*name_equal = 0;
|
||||
} else if (name1->gn_value.length != name2->gn_value.length ||
|
||||
memcmp(name1->gn_value.value, name1->gn_value.value,
|
||||
name1->gn_value.length)) {
|
||||
*name_equal = 0;
|
||||
}
|
||||
} else {
|
||||
struct _gss_mechanism_name *mn1;
|
||||
struct _gss_mechanism_name *mn2;
|
||||
|
||||
HEIM_SLIST_FOREACH(mn1, &name1->gn_mn, gmn_link) {
|
||||
OM_uint32 major_status;
|
||||
|
||||
major_status = _gss_find_mn(minor_status, name2,
|
||||
mn1->gmn_mech_oid, &mn2);
|
||||
if (major_status == GSS_S_COMPLETE) {
|
||||
return (mn1->gmn_mech->gm_compare_name(
|
||||
minor_status,
|
||||
mn1->gmn_name,
|
||||
mn2->gmn_name,
|
||||
name_equal));
|
||||
}
|
||||
}
|
||||
*name_equal = 0;
|
||||
}
|
||||
|
||||
*minor_status = 0;
|
||||
return (GSS_S_COMPLETE);
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
/* $NetBSD: gss_context_time.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/gss_context_time.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_context_time(OM_uint32 *minor_status,
|
||||
const gss_ctx_id_t context_handle,
|
||||
OM_uint32 *time_rec)
|
||||
{
|
||||
struct _gss_context *ctx = (struct _gss_context *) context_handle;
|
||||
gssapi_mech_interface m = ctx->gc_mech;
|
||||
|
||||
return (m->gm_context_time(minor_status, ctx->gc_ctx, time_rec));
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
/* $NetBSD: gss_create_empty_oid_set.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/gss_create_empty_oid_set.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_create_empty_oid_set(OM_uint32 *minor_status,
|
||||
gss_OID_set *oid_set)
|
||||
{
|
||||
gss_OID_set set;
|
||||
|
||||
*minor_status = 0;
|
||||
*oid_set = GSS_C_NO_OID_SET;
|
||||
|
||||
set = malloc(sizeof(gss_OID_set_desc));
|
||||
if (!set) {
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
|
||||
set->count = 0;
|
||||
set->elements = 0;
|
||||
*oid_set = set;
|
||||
|
||||
return (GSS_S_COMPLETE);
|
||||
}
|
||||
@@ -0,0 +1,226 @@
|
||||
/* $NetBSD: gss_cred.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2009 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of KTH nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
|
||||
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
||||
* BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
#include <krb5/krb5.h>
|
||||
|
||||
/*
|
||||
* format: any number of:
|
||||
* mech-len: int32
|
||||
* mech-data: char * (not alligned)
|
||||
* cred-len: int32
|
||||
* cred-data char * (not alligned)
|
||||
*/
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_export_cred(OM_uint32 * minor_status,
|
||||
gss_cred_id_t cred_handle,
|
||||
gss_buffer_t token)
|
||||
{
|
||||
struct _gss_cred *cred = (struct _gss_cred *)cred_handle;
|
||||
struct _gss_mechanism_cred *mc;
|
||||
gss_buffer_desc buffer;
|
||||
krb5_error_code ret;
|
||||
krb5_storage *sp;
|
||||
OM_uint32 major;
|
||||
krb5_data data;
|
||||
|
||||
_mg_buffer_zero(token);
|
||||
|
||||
if (cred == NULL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_NO_CRED;
|
||||
}
|
||||
|
||||
HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
|
||||
if (mc->gmc_mech->gm_export_cred == NULL) {
|
||||
*minor_status = 0;
|
||||
return GSS_S_NO_CRED;
|
||||
}
|
||||
}
|
||||
|
||||
sp = krb5_storage_emem();
|
||||
if (sp == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
|
||||
|
||||
major = mc->gmc_mech->gm_export_cred(minor_status,
|
||||
mc->gmc_cred, &buffer);
|
||||
if (major) {
|
||||
krb5_storage_free(sp);
|
||||
return major;
|
||||
}
|
||||
|
||||
ret = krb5_storage_write(sp, buffer.value, buffer.length);
|
||||
if (ret != buffer.length) {
|
||||
gss_release_buffer(minor_status, &buffer);
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = EINVAL;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
gss_release_buffer(minor_status, &buffer);
|
||||
}
|
||||
|
||||
ret = krb5_storage_to_data(sp, &data);
|
||||
krb5_storage_free(sp);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
token->value = data.data;
|
||||
token->length = data.length;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_import_cred(OM_uint32 * minor_status,
|
||||
gss_buffer_t token,
|
||||
gss_cred_id_t * cred_handle)
|
||||
{
|
||||
gssapi_mech_interface m;
|
||||
krb5_error_code ret;
|
||||
struct _gss_cred *cred;
|
||||
krb5_storage *sp = NULL;
|
||||
OM_uint32 major, junk;
|
||||
krb5_data data;
|
||||
|
||||
*cred_handle = GSS_C_NO_CREDENTIAL;
|
||||
|
||||
if (token->length == 0) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
sp = krb5_storage_from_readonly_mem(token->value, token->length);
|
||||
if (sp == NULL) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
cred = calloc(1, sizeof(struct _gss_cred));
|
||||
if (cred == NULL) {
|
||||
krb5_storage_free(sp);
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
HEIM_SLIST_INIT(&cred->gc_mc);
|
||||
|
||||
*cred_handle = (gss_cred_id_t)cred;
|
||||
|
||||
while(1) {
|
||||
struct _gss_mechanism_cred *mc;
|
||||
gss_buffer_desc buffer;
|
||||
gss_cred_id_t mcred;
|
||||
gss_OID_desc oid;
|
||||
|
||||
ret = krb5_ret_data(sp, &data);
|
||||
if (ret == HEIM_ERR_EOF) {
|
||||
break;
|
||||
} else if (ret) {
|
||||
*minor_status = ret;
|
||||
major = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
oid.elements = data.data;
|
||||
oid.length = data.length;
|
||||
|
||||
m = __gss_get_mechanism(&oid);
|
||||
krb5_data_free(&data);
|
||||
if (!m) {
|
||||
*minor_status = 0;
|
||||
major = GSS_S_BAD_MECH;
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (m->gm_import_cred == NULL) {
|
||||
*minor_status = 0;
|
||||
major = GSS_S_BAD_MECH;
|
||||
goto out;
|
||||
}
|
||||
|
||||
ret = krb5_ret_data(sp, &data);
|
||||
if (ret) {
|
||||
*minor_status = ret;
|
||||
major = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
|
||||
buffer.value = data.data;
|
||||
buffer.length = data.length;
|
||||
|
||||
major = m->gm_import_cred(minor_status,
|
||||
&buffer, &mcred);
|
||||
krb5_data_free(&data);
|
||||
if (major) {
|
||||
goto out;
|
||||
}
|
||||
|
||||
mc = malloc(sizeof(struct _gss_mechanism_cred));
|
||||
if (mc == NULL) {
|
||||
*minor_status = EINVAL;
|
||||
major = GSS_S_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
|
||||
mc->gmc_mech = m;
|
||||
mc->gmc_mech_oid = &m->gm_mech_oid;
|
||||
mc->gmc_cred = mcred;
|
||||
|
||||
HEIM_SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
|
||||
}
|
||||
krb5_storage_free(sp);
|
||||
sp = NULL;
|
||||
|
||||
if (HEIM_SLIST_EMPTY(&cred->gc_mc)) {
|
||||
major = GSS_S_NO_CRED;
|
||||
goto out;
|
||||
}
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
out:
|
||||
if (sp)
|
||||
krb5_storage_free(sp);
|
||||
|
||||
gss_release_cred(&junk, cred_handle);
|
||||
|
||||
return major;
|
||||
|
||||
}
|
||||
@@ -0,0 +1,74 @@
|
||||
/* $NetBSD: gss_decapsulate_token.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2006 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_decapsulate_token(gss_const_buffer_t input_token,
|
||||
gss_const_OID oid,
|
||||
gss_buffer_t output_token)
|
||||
{
|
||||
GSSAPIContextToken ct;
|
||||
heim_oid o;
|
||||
OM_uint32 status;
|
||||
int ret;
|
||||
size_t size;
|
||||
|
||||
_mg_buffer_zero(output_token);
|
||||
|
||||
ret = der_get_oid (oid->elements, oid->length, &o, &size);
|
||||
if (ret)
|
||||
return GSS_S_FAILURE;
|
||||
|
||||
ret = decode_GSSAPIContextToken(input_token->value, input_token->length,
|
||||
&ct, NULL);
|
||||
if (ret) {
|
||||
der_free_oid(&o);
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
|
||||
if (der_heim_oid_cmp(&ct.thisMech, &o) == 0) {
|
||||
status = GSS_S_COMPLETE;
|
||||
output_token->value = ct.innerContextToken.data;
|
||||
output_token->length = ct.innerContextToken.length;
|
||||
der_free_oid(&ct.thisMech);
|
||||
} else {
|
||||
free_GSSAPIContextToken(&ct);
|
||||
status = GSS_S_FAILURE;
|
||||
}
|
||||
der_free_oid(&o);
|
||||
|
||||
return status;
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
/* $NetBSD: gss_delete_name_attribute.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2010, PADL Software Pty Ltd.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of PADL Software nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
OM_uint32
|
||||
gss_delete_name_attribute(OM_uint32 *minor_status,
|
||||
gss_name_t input_name,
|
||||
gss_buffer_t attr)
|
||||
{
|
||||
OM_uint32 major_status = GSS_S_UNAVAILABLE;
|
||||
struct _gss_name *name = (struct _gss_name *) input_name;
|
||||
struct _gss_mechanism_name *mn;
|
||||
|
||||
*minor_status = 0;
|
||||
|
||||
if (input_name == GSS_C_NO_NAME)
|
||||
return GSS_S_BAD_NAME;
|
||||
|
||||
HEIM_SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
|
||||
gssapi_mech_interface m = mn->gmn_mech;
|
||||
|
||||
if (!m->gm_delete_name_attribute)
|
||||
continue;
|
||||
|
||||
major_status = m->gm_delete_name_attribute(minor_status,
|
||||
mn->gmn_name,
|
||||
attr);
|
||||
if (GSS_ERROR(major_status))
|
||||
_gss_mg_error(m, major_status, *minor_status);
|
||||
else
|
||||
break;
|
||||
}
|
||||
|
||||
return major_status;
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
/* $NetBSD: gss_delete_sec_context.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/gss_delete_sec_context.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_delete_sec_context(OM_uint32 *minor_status,
|
||||
gss_ctx_id_t *context_handle,
|
||||
gss_buffer_t output_token)
|
||||
{
|
||||
OM_uint32 major_status;
|
||||
struct _gss_context *ctx = (struct _gss_context *) *context_handle;
|
||||
|
||||
if (output_token)
|
||||
_mg_buffer_zero(output_token);
|
||||
|
||||
*minor_status = 0;
|
||||
if (ctx) {
|
||||
/*
|
||||
* If we have an implementation ctx, delete it,
|
||||
* otherwise fake an empty token.
|
||||
*/
|
||||
if (ctx->gc_ctx) {
|
||||
major_status = ctx->gc_mech->gm_delete_sec_context(
|
||||
minor_status, &ctx->gc_ctx, output_token);
|
||||
}
|
||||
free(ctx);
|
||||
*context_handle = GSS_C_NO_CONTEXT;
|
||||
}
|
||||
|
||||
return (GSS_S_COMPLETE);
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
/* $NetBSD: gss_destroy_cred.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Portions Copyright (c) 2009 Apple Inc. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
#include <heim_threads.h>
|
||||
|
||||
OM_uint32 GSSAPI_LIB_FUNCTION
|
||||
gss_destroy_cred(void *status,
|
||||
gss_cred_id_t *cred_handle)
|
||||
{
|
||||
struct _gss_cred *cred;
|
||||
struct _gss_mechanism_cred *mc;
|
||||
OM_uint32 junk;
|
||||
|
||||
if (cred_handle == NULL)
|
||||
return GSS_S_CALL_INACCESSIBLE_READ;
|
||||
if (*cred_handle == GSS_C_NO_CREDENTIAL)
|
||||
return GSS_S_COMPLETE;
|
||||
|
||||
cred = (struct _gss_cred *)*cred_handle;
|
||||
|
||||
while (HEIM_SLIST_FIRST(&cred->gc_mc)) {
|
||||
mc = HEIM_SLIST_FIRST(&cred->gc_mc);
|
||||
HEIM_SLIST_REMOVE_HEAD(&cred->gc_mc, gmc_link);
|
||||
if (mc->gmc_mech->gm_destroy_cred)
|
||||
mc->gmc_mech->gm_destroy_cred(&junk, &mc->gmc_cred);
|
||||
else
|
||||
mc->gmc_mech->gm_release_cred(&junk, &mc->gmc_cred);
|
||||
free(mc);
|
||||
}
|
||||
free(cred);
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
@@ -0,0 +1,84 @@
|
||||
/* $NetBSD: gss_display_name.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/gss_display_name.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_display_name(OM_uint32 *minor_status,
|
||||
const gss_name_t input_name,
|
||||
gss_buffer_t output_name_buffer,
|
||||
gss_OID *output_name_type)
|
||||
{
|
||||
OM_uint32 major_status;
|
||||
struct _gss_name *name = (struct _gss_name *) input_name;
|
||||
struct _gss_mechanism_name *mn;
|
||||
|
||||
_mg_buffer_zero(output_name_buffer);
|
||||
if (output_name_type)
|
||||
*output_name_type = GSS_C_NO_OID;
|
||||
|
||||
if (name == NULL) {
|
||||
*minor_status = 0;
|
||||
return (GSS_S_BAD_NAME);
|
||||
}
|
||||
|
||||
/*
|
||||
* If we know it, copy the buffer used to import the name in
|
||||
* the first place. Otherwise, ask all the MNs in turn if
|
||||
* they can display the thing.
|
||||
*/
|
||||
if (name->gn_value.value) {
|
||||
output_name_buffer->value = malloc(name->gn_value.length);
|
||||
if (!output_name_buffer->value) {
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
output_name_buffer->length = name->gn_value.length;
|
||||
memcpy(output_name_buffer->value, name->gn_value.value,
|
||||
output_name_buffer->length);
|
||||
if (output_name_type)
|
||||
*output_name_type = &name->gn_type;
|
||||
|
||||
*minor_status = 0;
|
||||
return (GSS_S_COMPLETE);
|
||||
} else {
|
||||
HEIM_SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
|
||||
major_status = mn->gmn_mech->gm_display_name(
|
||||
minor_status, mn->gmn_name,
|
||||
output_name_buffer,
|
||||
output_name_type);
|
||||
if (major_status == GSS_S_COMPLETE)
|
||||
return (GSS_S_COMPLETE);
|
||||
}
|
||||
}
|
||||
|
||||
*minor_status = 0;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
@@ -0,0 +1,70 @@
|
||||
/* $NetBSD: gss_display_name_ext.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2010, PADL Software Pty Ltd.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of PADL Software nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
OM_uint32
|
||||
gss_display_name_ext(OM_uint32 *minor_status,
|
||||
gss_name_t input_name,
|
||||
gss_OID display_as_name_type,
|
||||
gss_buffer_t display_name)
|
||||
{
|
||||
OM_uint32 major_status = GSS_S_UNAVAILABLE;
|
||||
struct _gss_name *name = (struct _gss_name *) input_name;
|
||||
struct _gss_mechanism_name *mn;
|
||||
|
||||
*minor_status = 0;
|
||||
_mg_buffer_zero(display_name);
|
||||
|
||||
if (input_name == GSS_C_NO_NAME)
|
||||
return GSS_S_BAD_NAME;
|
||||
|
||||
HEIM_SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
|
||||
gssapi_mech_interface m = mn->gmn_mech;
|
||||
|
||||
if (!m->gm_display_name_ext)
|
||||
continue;
|
||||
|
||||
major_status = m->gm_display_name_ext(minor_status,
|
||||
mn->gmn_name,
|
||||
display_as_name_type,
|
||||
display_name);
|
||||
if (GSS_ERROR(major_status))
|
||||
_gss_mg_error(m, major_status, *minor_status);
|
||||
else
|
||||
break;
|
||||
}
|
||||
|
||||
return major_status;
|
||||
}
|
||||
@@ -0,0 +1,213 @@
|
||||
/* $NetBSD: gss_display_status.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/gss_display_status.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
/*
|
||||
* Copyright (c) 1998 - 2005 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
static const char *
|
||||
calling_error(OM_uint32 v)
|
||||
{
|
||||
static const char *msgs[] = {
|
||||
NULL, /* 0 */
|
||||
"A required input parameter could not be read.", /* */
|
||||
"A required output parameter could not be written.", /* */
|
||||
"A parameter was malformed"
|
||||
};
|
||||
|
||||
v >>= GSS_C_CALLING_ERROR_OFFSET;
|
||||
|
||||
if (v == 0)
|
||||
return "";
|
||||
else if (v >= sizeof(msgs)/sizeof(*msgs))
|
||||
return "unknown calling error";
|
||||
else
|
||||
return msgs[v];
|
||||
}
|
||||
|
||||
static const char *
|
||||
routine_error(OM_uint32 v)
|
||||
{
|
||||
static const char *msgs[] = {
|
||||
"Function completed successfully", /* 0 */
|
||||
"An unsupported mechanism was requested",
|
||||
"An invalid name was supplied",
|
||||
"A supplied name was of an unsupported type",
|
||||
"Incorrect channel bindings were supplied",
|
||||
"An invalid status code was supplied",
|
||||
"A token had an invalid MIC",
|
||||
"No credentials were supplied, "
|
||||
"or the credentials were unavailable or inaccessible.",
|
||||
"No context has been established",
|
||||
"A token was invalid",
|
||||
"A credential was invalid",
|
||||
"The referenced credentials have expired",
|
||||
"The context has expired",
|
||||
"Miscellaneous failure (see text)",
|
||||
"The quality-of-protection requested could not be provide",
|
||||
"The operation is forbidden by local security policy",
|
||||
"The operation or option is not available",
|
||||
"The requested credential element already exists",
|
||||
"The provided name was not a mechanism name.",
|
||||
};
|
||||
|
||||
v >>= GSS_C_ROUTINE_ERROR_OFFSET;
|
||||
|
||||
if (v >= sizeof(msgs)/sizeof(*msgs))
|
||||
return "unknown routine error";
|
||||
else
|
||||
return msgs[v];
|
||||
}
|
||||
|
||||
static const char *
|
||||
supplementary_error(OM_uint32 v)
|
||||
{
|
||||
static const char *msgs[] = {
|
||||
"normal completion",
|
||||
"continuation call to routine required",
|
||||
"duplicate per-message token detected",
|
||||
"timed-out per-message token detected",
|
||||
"reordered (early) per-message token detected",
|
||||
"skipped predecessor token(s) detected"
|
||||
};
|
||||
|
||||
v >>= GSS_C_SUPPLEMENTARY_OFFSET;
|
||||
|
||||
if (v >= sizeof(msgs)/sizeof(*msgs))
|
||||
return "unknown routine error";
|
||||
else
|
||||
return msgs[v];
|
||||
}
|
||||
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_display_status(OM_uint32 *minor_status,
|
||||
OM_uint32 status_value,
|
||||
int status_type,
|
||||
const gss_OID mech_type,
|
||||
OM_uint32 *message_content,
|
||||
gss_buffer_t status_string)
|
||||
{
|
||||
OM_uint32 major_status;
|
||||
|
||||
_mg_buffer_zero(status_string);
|
||||
*message_content = 0;
|
||||
|
||||
major_status = _gss_mg_get_error(mech_type, status_type,
|
||||
status_value, status_string);
|
||||
if (major_status == GSS_S_COMPLETE) {
|
||||
|
||||
*message_content = 0;
|
||||
*minor_status = 0;
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
*minor_status = 0;
|
||||
switch (status_type) {
|
||||
case GSS_C_GSS_CODE: {
|
||||
char *buf = NULL;
|
||||
int e;
|
||||
|
||||
if (GSS_SUPPLEMENTARY_INFO(status_value))
|
||||
e = asprintf(&buf, "%s", supplementary_error(
|
||||
GSS_SUPPLEMENTARY_INFO(status_value)));
|
||||
else
|
||||
e = asprintf (&buf, "%s %s",
|
||||
calling_error(GSS_CALLING_ERROR(status_value)),
|
||||
routine_error(GSS_ROUTINE_ERROR(status_value)));
|
||||
|
||||
if (e < 0 || buf == NULL)
|
||||
break;
|
||||
|
||||
status_string->length = strlen(buf);
|
||||
status_string->value = buf;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
case GSS_C_MECH_CODE: {
|
||||
OM_uint32 maj_junk, min_junk;
|
||||
gss_buffer_desc oid;
|
||||
char *buf = NULL;
|
||||
int e;
|
||||
|
||||
maj_junk = gss_oid_to_str(&min_junk, mech_type, &oid);
|
||||
if (maj_junk != GSS_S_COMPLETE) {
|
||||
oid.value = rk_UNCONST("unknown");
|
||||
oid.length = 7;
|
||||
}
|
||||
|
||||
e = asprintf (&buf, "unknown mech-code %lu for mech %.*s",
|
||||
(unsigned long)status_value,
|
||||
(int)oid.length, (char *)oid.value);
|
||||
if (maj_junk == GSS_S_COMPLETE)
|
||||
gss_release_buffer(&min_junk, &oid);
|
||||
|
||||
if (e < 0 || buf == NULL)
|
||||
break;
|
||||
|
||||
status_string->length = strlen(buf);
|
||||
status_string->value = buf;
|
||||
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
}
|
||||
_mg_buffer_zero(status_string);
|
||||
return (GSS_S_BAD_STATUS);
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
/* $NetBSD: gss_duplicate_name.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $ */
|
||||
|
||||
/*-
|
||||
* Copyright (c) 2005 Doug Rabson
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD: src/lib/libgssapi/gss_duplicate_name.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
|
||||
*/
|
||||
|
||||
#include "mech_locl.h"
|
||||
|
||||
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
|
||||
gss_duplicate_name(OM_uint32 *minor_status,
|
||||
const gss_name_t src_name,
|
||||
gss_name_t *dest_name)
|
||||
{
|
||||
OM_uint32 major_status;
|
||||
struct _gss_name *name = (struct _gss_name *) src_name;
|
||||
struct _gss_name *new_name;
|
||||
struct _gss_mechanism_name *mn;
|
||||
|
||||
*minor_status = 0;
|
||||
*dest_name = GSS_C_NO_NAME;
|
||||
|
||||
/*
|
||||
* If this name has a value (i.e. it didn't come from
|
||||
* gss_canonicalize_name(), we re-import the thing. Otherwise,
|
||||
* we make copy of each mech names.
|
||||
*/
|
||||
if (name->gn_value.value) {
|
||||
major_status = gss_import_name(minor_status,
|
||||
&name->gn_value, &name->gn_type, dest_name);
|
||||
if (major_status != GSS_S_COMPLETE)
|
||||
return (major_status);
|
||||
new_name = (struct _gss_name *) *dest_name;
|
||||
|
||||
HEIM_SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
|
||||
struct _gss_mechanism_name *mn2;
|
||||
_gss_find_mn(minor_status, new_name,
|
||||
mn->gmn_mech_oid, &mn2);
|
||||
}
|
||||
} else {
|
||||
new_name = malloc(sizeof(struct _gss_name));
|
||||
if (!new_name) {
|
||||
*minor_status = ENOMEM;
|
||||
return (GSS_S_FAILURE);
|
||||
}
|
||||
memset(new_name, 0, sizeof(struct _gss_name));
|
||||
HEIM_SLIST_INIT(&new_name->gn_mn);
|
||||
*dest_name = (gss_name_t) new_name;
|
||||
|
||||
HEIM_SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
|
||||
struct _gss_mechanism_name *new_mn;
|
||||
|
||||
new_mn = malloc(sizeof(*new_mn));
|
||||
if (!new_mn) {
|
||||
*minor_status = ENOMEM;
|
||||
return GSS_S_FAILURE;
|
||||
}
|
||||
new_mn->gmn_mech = mn->gmn_mech;
|
||||
new_mn->gmn_mech_oid = mn->gmn_mech_oid;
|
||||
|
||||
major_status =
|
||||
mn->gmn_mech->gm_duplicate_name(minor_status,
|
||||
mn->gmn_name, &new_mn->gmn_name);
|
||||
if (major_status != GSS_S_COMPLETE) {
|
||||
free(new_mn);
|
||||
continue;
|
||||
}
|
||||
HEIM_SLIST_INSERT_HEAD(&new_name->gn_mn, new_mn, gmn_link);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return (GSS_S_COMPLETE);
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user