static int kerberosv4_encode(void *context,
const struct iovec *invec,
unsigned numiov,
const char **output,
unsigned *outputlen)
{
int len, ret;
context_t *text = (context_t *)context;
struct buffer_info *inblob, bufinfo;
if(numiov > 1) {
ret = _plug_iovec_to_buf(text->utils, invec, numiov, &text->enc_in_buf);
if(ret != SASL_OK) return ret;
inblob = text->enc_in_buf;
} else {
bufinfo.data = invec[0].iov_base;
bufinfo.curlen = invec[0].iov_len;
inblob = &bufinfo;
}
ret = _plug_buf_alloc(text->utils, &(text->encode_buf),
&text->encode_buf_len, inblob->curlen+40);
if(ret != SASL_OK) return ret;
KRB_LOCK_MUTEX(text->utils);
if (text->sec_type == KRB_SEC_ENCRYPTION) {
/* Type incompatibility on 4th arg probably means you're
building against krb4 in MIT krb5, but got the OpenSSL
headers in your way. You need to not use openssl/des.h with
MIT kerberos. */
len=krb_mk_priv(inblob->data, (text->encode_buf+4),
inblob->curlen, text->init_keysched,
&text->session, &text->ip_local,
&text->ip_remote);
} else if (text->sec_type == KRB_SEC_INTEGRITY) {
len=krb_mk_safe(inblob->data, (text->encode_buf+4),
inblob->curlen,
&text->session, &text->ip_local, &text->ip_remote);
} else {
len = -1;
}
KRB_UNLOCK_MUTEX(text->utils);
/* returns -1 on error */
if (len==-1) return SASL_FAIL;
/* now copy in the len of the buffer in network byte order */
*outputlen=len+4;
len=htonl(len);
memcpy(text->encode_buf, &len, 4);
/* Setup the const pointer */
*output = text->encode_buf;
return SASL_OK;
}
static int
sasl_gss_encode(void *context, const struct iovec *invec, unsigned numiov,
const char **output, unsigned *outputlen, int privacy)
{
context_t *text = (context_t *)context;
OM_uint32 maj_stat, min_stat;
gss_buffer_t input_token, output_token;
gss_buffer_desc real_input_token, real_output_token;
int ret;
struct buffer_info *inblob, bufinfo;
if(!output) return SASL_BADPARAM;
if(numiov > 1) {
ret = _plug_iovec_to_buf(text->utils, invec, numiov, &text->enc_in_buf);
if(ret != SASL_OK) return ret;
inblob = text->enc_in_buf;
} else {
bufinfo.data = invec[0].iov_base;
bufinfo.curlen = invec[0].iov_len;
inblob = &bufinfo;
}
if (text->state != SASL_GSSAPI_STATE_AUTHENTICATED) return SASL_NOTDONE;
input_token = &real_input_token;
real_input_token.value = inblob->data;
real_input_token.length = inblob->curlen;
output_token = &real_output_token;
output_token->value = NULL;
output_token->length = 0;
GSS_LOCK_MUTEX(text->utils);
maj_stat = gss_wrap (&min_stat,
text->gss_ctx,
privacy,
GSS_C_QOP_DEFAULT,
input_token,
NULL,
output_token);
GSS_UNLOCK_MUTEX(text->utils);
if (GSS_ERROR(maj_stat))
{
sasl_gss_seterror(text->utils, maj_stat, min_stat);
if (output_token->value) {
GSS_LOCK_MUTEX(text->utils);
gss_release_buffer(&min_stat, output_token);
GSS_UNLOCK_MUTEX(text->utils);
}
return SASL_FAIL;
}
if (output_token->value && output) {
int len;
ret = _plug_buf_alloc(text->utils, &(text->encode_buf),
&(text->encode_buf_len), output_token->length + 4);
if (ret != SASL_OK) {
GSS_LOCK_MUTEX(text->utils);
gss_release_buffer(&min_stat, output_token);
GSS_UNLOCK_MUTEX(text->utils);
return ret;
}
len = htonl(output_token->length);
memcpy(text->encode_buf, &len, 4);
memcpy(text->encode_buf + 4, output_token->value, output_token->length);
}
if (outputlen) {
*outputlen = output_token->length + 4;
}
*output = text->encode_buf;
if (output_token->value) {
GSS_LOCK_MUTEX(text->utils);
gss_release_buffer(&min_stat, output_token);
GSS_UNLOCK_MUTEX(text->utils);
}
return SASL_OK;
}
