static void
iterate(void *cctx, gss_OID mech, gss_cred_id_t cred)
{
struct _gss_iter *ctx = cctx;
if (cred) {
struct _gss_mechanism_cred *mc;
struct _gss_cred *c;
c = _gss_mg_alloc_cred();
if (!c)
return;
mc = malloc(sizeof(struct _gss_mechanism_cred));
if (!mc) {
free(c);
return;
}
mc->gmc_mech = __gss_get_mechanism(mech);
mc->gmc_mech_oid = mech;
mc->gmc_cred = cred;
HEIM_SLIST_INSERT_HEAD(&c->gc_mc, mc, gmc_link);
ctx->iter(ctx->userctx, mech, (gss_cred_id_t)c);
} else {
/*
* Now that we reach the end of this mechs credentials,
* release the context, only one ref per mech.
*/
iter_deref(ctx);
}
}
void
gss_mg_collect_error(gss_OID mech, OM_uint32 maj, OM_uint32 min)
{
gssapi_mech_interface m = __gss_get_mechanism(mech);
if (m == NULL)
return;
_gss_mg_error(m, maj, min);
}
OM_uint32 GSSAPI_LIB_FUNCTION
gss_iter_creds_f(OM_uint32 *min_stat,
OM_uint32 flags,
gss_const_OID mech,
void * userctx,
void (*useriter)(void *, gss_iter_OID, gss_cred_id_t))
{
struct _gss_iter *ctx;
gss_OID_set mechs;
gssapi_mech_interface m;
size_t i;
if (useriter == NULL)
return GSS_S_CALL_INACCESSIBLE_READ;
_gss_load_mech();
/*
* First make sure that at least one of the requested
* mechanisms is one that we support.
*/
mechs = _gss_mech_oids;
ctx = malloc(sizeof(struct _gss_iter));
if (ctx == NULL) {
if (min_stat)
*min_stat = ENOMEM;
return GSS_S_FAILURE;
}
HEIMDAL_MUTEX_init(&ctx->mutex);
ctx->count = 1;
ctx->userctx = userctx;
ctx->iter = useriter;
for (i = 0; i < mechs->count; i++) {
if (mech && !gss_oid_equal(mech, &mechs->elements[i]))
continue;
m = __gss_get_mechanism(&mechs->elements[i]);
if (!m)
continue;
if (m->gm_iter_creds == NULL)
continue;
HEIMDAL_MUTEX_lock(&ctx->mutex);
ctx->count += 1;
HEIMDAL_MUTEX_unlock(&ctx->mutex);
m->gm_iter_creds(flags, ctx, iterate);
}
iter_deref(ctx);
return GSS_S_COMPLETE;
}
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_import_sec_context(OM_uint32 *minor_status,
const gss_buffer_t interprocess_token,
gss_ctx_id_t *context_handle)
{
OM_uint32 major_status;
gssapi_mech_interface m;
struct _gss_context *ctx;
gss_OID_desc mech_oid;
gss_buffer_desc buf;
unsigned char *p;
size_t len;
*minor_status = 0;
*context_handle = GSS_C_NO_CONTEXT;
/*
* We added an oid to the front of the token in
* gss_export_sec_context.
*/
p = interprocess_token->value;
len = interprocess_token->length;
if (len < 2)
return (GSS_S_DEFECTIVE_TOKEN);
mech_oid.length = (p[0] << 8) | p[1];
if (len < mech_oid.length + 2)
return (GSS_S_DEFECTIVE_TOKEN);
mech_oid.elements = p + 2;
buf.length = len - 2 - mech_oid.length;
buf.value = p + 2 + mech_oid.length;
m = __gss_get_mechanism(&mech_oid);
if (!m)
return (GSS_S_DEFECTIVE_TOKEN);
ctx = malloc(sizeof(struct _gss_context));
if (!ctx) {
*minor_status = ENOMEM;
return (GSS_S_FAILURE);
}
ctx->gc_mech = m;
major_status = m->gm_import_sec_context(minor_status,
&buf, &ctx->gc_ctx);
if (major_status != GSS_S_COMPLETE) {
_gss_mg_error(m, major_status, *minor_status);
free(ctx);
} else {
*context_handle = (gss_ctx_id_t) ctx;
}
return (major_status);
}
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_inquire_names_for_mech(OM_uint32 *minor_status,
const gss_OID mechanism,
gss_OID_set *name_types)
{
OM_uint32 major_status;
gssapi_mech_interface m = __gss_get_mechanism(mechanism);
*minor_status = 0;
*name_types = GSS_C_NO_OID_SET;
if (!m)
return (GSS_S_BAD_MECH);
/*
* If the implementation can do it, ask it for a list of
* names, otherwise fake it.
*/
if (m->gm_inquire_names_for_mech) {
return (m->gm_inquire_names_for_mech(minor_status,
mechanism, name_types));
} else {
major_status = gss_create_empty_oid_set(minor_status,
name_types);
if (major_status)
return (major_status);
major_status = gss_add_oid_set_member(minor_status,
GSS_C_NT_HOSTBASED_SERVICE, name_types);
if (major_status) {
OM_uint32 junk;
gss_release_oid_set(&junk, name_types);
return (major_status);
}
major_status = gss_add_oid_set_member(minor_status,
GSS_C_NT_USER_NAME, name_types);
if (major_status) {
OM_uint32 junk;
gss_release_oid_set(&junk, name_types);
return (major_status);
}
}
return (GSS_S_COMPLETE);
}
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_inquire_cred_by_mech(OM_uint32 *minor_status,
gss_const_cred_id_t cred_handle,
const gss_OID mech_type,
gss_name_t *cred_name,
OM_uint32 *initiator_lifetime,
OM_uint32 *acceptor_lifetime,
gss_cred_usage_t *cred_usage)
{
OM_uint32 major_status;
gssapi_mech_interface m;
struct _gss_mechanism_cred *mcp;
gss_cred_id_t mc;
gss_name_t mn;
struct _gss_name *name;
*minor_status = 0;
if (cred_name)
*cred_name = GSS_C_NO_NAME;
if (initiator_lifetime)
*initiator_lifetime = 0;
if (acceptor_lifetime)
*acceptor_lifetime = 0;
if (cred_usage)
*cred_usage = 0;
m = __gss_get_mechanism(mech_type);
if (m == NULL || m->gm_inquire_cred_by_mech == NULL)
return (GSS_S_NO_CRED);
if (cred_handle != GSS_C_NO_CREDENTIAL) {
struct _gss_cred *cred = (struct _gss_cred *) cred_handle;
HEIM_SLIST_FOREACH(mcp, &cred->gc_mc, gmc_link)
if (mcp->gmc_mech == m)
break;
if (!mcp)
return (GSS_S_NO_CRED);
mc = mcp->gmc_cred;
} else {
OM_uint32
gss_acquire_cred(OM_uint32 *minor_status,
const gss_name_t desired_name,
OM_uint32 time_req,
const gss_OID_set desired_mechs,
gss_cred_usage_t cred_usage,
gss_cred_id_t *output_cred_handle,
gss_OID_set *actual_mechs,
OM_uint32 *time_rec)
{
OM_uint32 major_status;
gss_OID_set mechs = desired_mechs;
gss_OID_set_desc set;
struct _gss_name *name = (struct _gss_name *) desired_name;
gssapi_mech_interface m;
struct _gss_cred *cred;
struct _gss_mechanism_cred *mc;
OM_uint32 min_time, cred_time;
int i;
_gss_load_mech();
/*
* First make sure that at least one of the requested
* mechanisms is one that we support.
*/
if (mechs) {
for (i = 0; i < mechs->count; i++) {
int t;
gss_test_oid_set_member(minor_status,
&mechs->elements[i], _gss_mech_oids, &t);
if (t)
break;
}
if (i == mechs->count) {
*output_cred_handle = 0;
*minor_status = 0;
return (GSS_S_BAD_MECH);
}
}
if (actual_mechs) {
major_status = gss_create_empty_oid_set(minor_status,
actual_mechs);
if (major_status)
return (major_status);
}
cred = malloc(sizeof(struct _gss_cred));
if (!cred) {
if (actual_mechs)
gss_release_oid_set(minor_status, actual_mechs);
*minor_status = ENOMEM;
return (GSS_S_FAILURE);
}
cred->gc_usage = cred_usage;
SLIST_INIT(&cred->gc_mc);
if (mechs == GSS_C_NO_OID_SET)
mechs = _gss_mech_oids;
set.count = 1;
min_time = GSS_C_INDEFINITE;
for (i = 0; i < mechs->count; i++) {
struct _gss_mechanism_name *mn = NULL;
m = __gss_get_mechanism(&mechs->elements[i]);
if (!m)
continue;
if (desired_name != GSS_C_NO_NAME) {
mn = _gss_find_mn(name, &mechs->elements[i]);
if (!mn)
continue;
}
mc = malloc(sizeof(struct _gss_mechanism_cred));
if (!mc) {
continue;
}
SLIST_INIT(&cred->gc_mc);
mc->gmc_mech = m;
mc->gmc_mech_oid = &m->gm_mech_oid;
/*
* XXX Probably need to do something with actual_mechs.
*/
set.elements = &mechs->elements[i];
major_status = m->gm_acquire_cred(minor_status,
(desired_name != GSS_C_NO_NAME
? mn->gmn_name : GSS_C_NO_NAME),
time_req, &set, cred_usage,
&mc->gmc_cred, NULL, &cred_time);
if (major_status) {
free(mc);
continue;
}
if (cred_time < min_time)
min_time = cred_time;
if (actual_mechs) {
major_status = gss_add_oid_set_member(minor_status,
mc->gmc_mech_oid, actual_mechs);
if (major_status) {
m->gm_release_cred(minor_status,
&mc->gmc_cred);
free(mc);
continue;
}
}
SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
}
/*
* If we didn't manage to create a single credential, return
* an error.
*/
if (!SLIST_FIRST(&cred->gc_mc)) {
free(cred);
if (actual_mechs)
gss_release_oid_set(minor_status, actual_mechs);
*output_cred_handle = 0;
*minor_status = 0;
return (GSS_S_NO_CRED);
}
if (time_rec)
*time_rec = min_time;
*output_cred_handle = (gss_cred_id_t) cred;
*minor_status = 0;
return (GSS_S_COMPLETE);
}
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_accept_sec_context(OM_uint32 *minor_status,
gss_ctx_id_t *context_handle,
const gss_cred_id_t acceptor_cred_handle,
const gss_buffer_t input_token,
const gss_channel_bindings_t input_chan_bindings,
gss_name_t *src_name,
gss_OID *mech_type,
gss_buffer_t output_token,
OM_uint32 *ret_flags,
OM_uint32 *time_rec,
gss_cred_id_t *delegated_cred_handle)
{
OM_uint32 major_status, mech_ret_flags, junk;
gssapi_mech_interface m;
struct _gss_context *ctx = (struct _gss_context *) *context_handle;
struct _gss_cred *cred = (struct _gss_cred *) acceptor_cred_handle;
struct _gss_mechanism_cred *mc;
gss_cred_id_t acceptor_mc, delegated_mc;
gss_name_t src_mn;
gss_OID mech_ret_type = NULL;
*minor_status = 0;
if (src_name)
*src_name = GSS_C_NO_NAME;
if (mech_type)
*mech_type = GSS_C_NO_OID;
if (ret_flags)
*ret_flags = 0;
if (time_rec)
*time_rec = 0;
if (delegated_cred_handle)
*delegated_cred_handle = GSS_C_NO_CREDENTIAL;
_mg_buffer_zero(output_token);
/*
* If this is the first call (*context_handle is NULL), we must
* parse the input token to figure out the mechanism to use.
*/
if (*context_handle == GSS_C_NO_CONTEXT) {
gss_OID_desc mech_oid;
major_status = choose_mech(input_token, &mech_oid);
if (major_status != GSS_S_COMPLETE)
return major_status;
/*
* Now that we have a mechanism, we can find the
* implementation.
*/
ctx = malloc(sizeof(struct _gss_context));
if (!ctx) {
*minor_status = ENOMEM;
return (GSS_S_DEFECTIVE_TOKEN);
}
memset(ctx, 0, sizeof(struct _gss_context));
m = ctx->gc_mech = __gss_get_mechanism(&mech_oid);
if (!m) {
free(ctx);
return (GSS_S_BAD_MECH);
}
*context_handle = (gss_ctx_id_t) ctx;
} else {
m = ctx->gc_mech;
}
if (cred) {
HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link)
if (mc->gmc_mech == m)
break;
if (!mc) {
gss_delete_sec_context(&junk, context_handle, NULL);
return (GSS_S_BAD_MECH);
}
acceptor_mc = mc->gmc_cred;
} else {
/**
* This function is not a public interface and is deprecated anyways, do
* not use. Use gss_acquire_cred_with_password() instead for now.
*
* @deprecated
*/
OM_uint32
_gss_acquire_cred_ext(OM_uint32 *minor_status,
gss_const_name_t desired_name,
gss_const_OID credential_type,
const void *credential_data,
OM_uint32 time_req,
gss_const_OID desired_mech,
gss_cred_usage_t cred_usage,
gss_cred_id_t *output_cred_handle)
{
OM_uint32 major_status;
struct _gss_name *name = (struct _gss_name *) desired_name;
gssapi_mech_interface m;
struct _gss_cred *cred;
gss_OID_set_desc set, *mechs;
size_t i;
*minor_status = 0;
if (output_cred_handle == NULL)
return GSS_S_CALL_INACCESSIBLE_READ;
_gss_load_mech();
if (desired_mech != GSS_C_NO_OID) {
int match = 0;
gss_test_oid_set_member(minor_status, (gss_OID)desired_mech,
_gss_mech_oids, &match);
if (!match)
return GSS_S_BAD_MECH;
set.count = 1;
set.elements = (gss_OID)desired_mech;
mechs = &set;
} else
mechs = _gss_mech_oids;
cred = calloc(1, sizeof(*cred));
if (cred == NULL) {
*minor_status = ENOMEM;
return GSS_S_FAILURE;
}
HEIM_SLIST_INIT(&cred->gc_mc);
for (i = 0; i < mechs->count; i++) {
struct _gss_mechanism_name *mn = NULL;
struct _gss_mechanism_cred *mc = NULL;
m = __gss_get_mechanism(&mechs->elements[i]);
if (!m)
continue;
if (desired_name != GSS_C_NO_NAME) {
major_status = _gss_find_mn(minor_status, name,
&mechs->elements[i], &mn);
if (major_status != GSS_S_COMPLETE)
continue;
}
major_status = _gss_acquire_mech_cred(minor_status, m, mn,
credential_type, credential_data,
time_req, desired_mech, cred_usage,
&mc);
if (GSS_ERROR(major_status)) {
if (mechs->count == 1)
_gss_mg_error(m, major_status, *minor_status);
continue;
}
HEIM_SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
}
/*
* If we didn't manage to create a single credential, return
* an error.
*/
if (!HEIM_SLIST_FIRST(&cred->gc_mc)) {
free(cred);
if (mechs->count > 1)
*minor_status = 0;
return GSS_S_NO_CRED;
}
*output_cred_handle = (gss_cred_id_t) cred;
*minor_status = 0;
return GSS_S_COMPLETE;
}
