OM_uint32
gss_pname_to_uid(OM_uint32 *minor_status, const gss_name_t pname,
const gss_OID mech, uid_t *uidp)
{
struct _gss_name *name = (struct _gss_name *) pname;
struct _gss_mech_switch *m;
struct _gss_mechanism_name *mn;
OM_uint32 major_status;
*minor_status = 0;
if (pname == GSS_C_NO_NAME)
return (GSS_S_BAD_NAME);
m = _gss_find_mech_switch(mech);
if (!m)
return (GSS_S_BAD_MECH);
if (m->gm_pname_to_uid == NULL)
return (GSS_S_UNAVAILABLE);
major_status = _gss_find_mn(minor_status, name, mech, &mn);
if (major_status != GSS_S_COMPLETE) {
_gss_mg_error(m, major_status, *minor_status);
return (major_status);
}
major_status = (*m->gm_pname_to_uid)(minor_status, mn->gmn_name,
mech, uidp);
if (major_status != GSS_S_COMPLETE)
_gss_mg_error(m, major_status, *minor_status);
return (major_status);
}
void
_gss_mg_collect_error(gss_OID mech, OM_uint32 maj, OM_uint32 min)
{
struct _gss_mech_switch *m;
m = _gss_find_mech_switch(mech);
if (m != NULL)
_gss_mg_error(m, maj, min);
}
OM_uint32
gss_canonicalize_name(OM_uint32 *minor_status,
const gss_name_t input_name,
const gss_OID mech_type,
gss_name_t *output_name)
{
OM_uint32 major_status;
struct _gss_name *name = (struct _gss_name *) input_name;
struct _gss_mechanism_name *mn;
struct _gss_mech_switch *m = _gss_find_mech_switch(mech_type);
gss_name_t new_canonical_name;
*minor_status = 0;
*output_name = 0;
major_status = _gss_find_mn(minor_status, name, mech_type, &mn);
if (major_status)
return (major_status);
m = mn->gmn_mech;
major_status = m->gm_canonicalize_name(minor_status,
mn->gmn_name, mech_type, &new_canonical_name);
if (major_status) {
_gss_mg_error(m, major_status, *minor_status);
return (major_status);
}
/*
* Now we make a new name and mark it as an MN.
*/
*minor_status = 0;
name = malloc(sizeof(struct _gss_name));
if (!name) {
m->gm_release_name(minor_status, &new_canonical_name);
*minor_status = ENOMEM;
return (GSS_S_FAILURE);
}
memset(name, 0, sizeof(struct _gss_name));
mn = malloc(sizeof(struct _gss_mechanism_name));
if (!mn) {
m->gm_release_name(minor_status, &new_canonical_name);
free(name);
*minor_status = ENOMEM;
return (GSS_S_FAILURE);
}
SLIST_INIT(&name->gn_mn);
mn->gmn_mech = m;
mn->gmn_mech_oid = &m->gm_mech_oid;
mn->gmn_name = new_canonical_name;
SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
*output_name = (gss_name_t) name;
return (GSS_S_COMPLETE);
}
OM_uint32
gss_import_sec_context(OM_uint32 *minor_status,
const gss_buffer_t interprocess_token,
gss_ctx_id_t *context_handle)
{
OM_uint32 major_status;
struct _gss_mech_switch *m;
struct _gss_context *ctx;
gss_OID_desc mech_oid;
gss_buffer_desc buf;
unsigned char *p;
size_t len;
*minor_status = 0;
*context_handle = GSS_C_NO_CONTEXT;
/*
* We added an oid to the front of the token in
* gss_export_sec_context.
*/
p = interprocess_token->value;
len = interprocess_token->length;
if (len < 2)
return (GSS_S_DEFECTIVE_TOKEN);
mech_oid.length = (p[0] << 8) | p[1];
if (len < mech_oid.length + 2)
return (GSS_S_DEFECTIVE_TOKEN);
mech_oid.elements = p + 2;
buf.length = len - 2 - mech_oid.length;
buf.value = p + 2 + mech_oid.length;
m = _gss_find_mech_switch(&mech_oid);
if (!m)
return (GSS_S_DEFECTIVE_TOKEN);
ctx = malloc(sizeof(struct _gss_context));
if (!ctx) {
*minor_status = ENOMEM;
return (GSS_S_FAILURE);
}
ctx->gc_mech = m;
major_status = m->gm_import_sec_context(minor_status,
&buf, &ctx->gc_ctx);
if (major_status != GSS_S_COMPLETE) {
_gss_mg_error(m, major_status, *minor_status);
free(ctx);
} else {
*context_handle = (gss_ctx_id_t) ctx;
}
return (major_status);
}
OM_uint32
gss_inquire_cred_by_mech(OM_uint32 *minor_status,
const gss_cred_id_t cred_handle,
const gss_OID mech_type,
gss_name_t *cred_name,
OM_uint32 *initiator_lifetime,
OM_uint32 *acceptor_lifetime,
gss_cred_usage_t *cred_usage)
{
OM_uint32 major_status;
struct _gss_mech_switch *m;
struct _gss_mechanism_cred *mcp;
gss_cred_id_t mc;
gss_name_t mn;
struct _gss_name *name;
*minor_status = 0;
if (cred_name)
*cred_name = GSS_C_NO_NAME;
if (initiator_lifetime)
*initiator_lifetime = 0;
if (acceptor_lifetime)
*acceptor_lifetime = 0;
if (cred_usage)
*cred_usage = 0;
m = _gss_find_mech_switch(mech_type);
if (!m)
return (GSS_S_NO_CRED);
if (cred_handle != GSS_C_NO_CREDENTIAL) {
struct _gss_cred *cred = (struct _gss_cred *) cred_handle;
SLIST_FOREACH(mcp, &cred->gc_mc, gmc_link)
if (mcp->gmc_mech == m)
break;
if (!mcp)
return (GSS_S_NO_CRED);
mc = mcp->gmc_cred;
} else {
OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status,
gss_ctx_id_t *context_handle,
const gss_cred_id_t acceptor_cred_handle,
const gss_buffer_t input_token,
const gss_channel_bindings_t input_chan_bindings,
gss_name_t *src_name,
gss_OID *mech_type,
gss_buffer_t output_token,
OM_uint32 *ret_flags,
OM_uint32 *time_rec,
gss_cred_id_t *delegated_cred_handle)
{
OM_uint32 major_status, mech_ret_flags;
struct _gss_mech_switch *m;
struct _gss_context *ctx = (struct _gss_context *) *context_handle;
struct _gss_cred *cred = (struct _gss_cred *) acceptor_cred_handle;
struct _gss_mechanism_cred *mc;
gss_cred_id_t acceptor_mc, delegated_mc;
gss_name_t src_mn;
*minor_status = 0;
if (src_name)
*src_name = GSS_C_NO_NAME;
if (mech_type)
*mech_type = GSS_C_NO_OID;
if (ret_flags)
*ret_flags = 0;
if (time_rec)
*time_rec = 0;
if (delegated_cred_handle)
*delegated_cred_handle = GSS_C_NO_CREDENTIAL;
_gss_buffer_zero(output_token);
/*
* If this is the first call (*context_handle is NULL), we must
* parse the input token to figure out the mechanism to use.
*/
if (*context_handle == GSS_C_NO_CONTEXT) {
gss_OID_desc mech_oid;
major_status = choose_mech(input_token, &mech_oid);
if (major_status != GSS_S_COMPLETE)
return (major_status);
/*
* Now that we have a mechanism, we can find the
* implementation.
*/
ctx = malloc(sizeof(struct _gss_context));
if (!ctx) {
*minor_status = ENOMEM;
return (GSS_S_DEFECTIVE_TOKEN);
}
memset(ctx, 0, sizeof(struct _gss_context));
m = ctx->gc_mech = _gss_find_mech_switch(&mech_oid);
if (!m) {
free(ctx);
return (GSS_S_BAD_MECH);
}
} else
m = ctx->gc_mech;
if (cred) {
SLIST_FOREACH(mc, &cred->gc_mc, gmc_link)
if (mc->gmc_mech == m)
break;
if (!mc)
return (GSS_S_BAD_MECH);
acceptor_mc = mc->gmc_cred;
} else {
OM_uint32
gss_acquire_cred(OM_uint32 *minor_status,
const gss_name_t desired_name,
OM_uint32 time_req,
const gss_OID_set desired_mechs,
gss_cred_usage_t cred_usage,
gss_cred_id_t *output_cred_handle,
gss_OID_set *actual_mechs,
OM_uint32 *time_rec)
{
OM_uint32 major_status;
gss_OID_set mechs = desired_mechs;
gss_OID_set_desc set;
struct _gss_name *name = (struct _gss_name *) desired_name;
struct _gss_mech_switch *m;
struct _gss_cred *cred;
struct _gss_mechanism_cred *mc;
struct _gss_mechanism_name *mn;
OM_uint32 min_time, cred_time;
size_t i;
*minor_status = 0;
if (output_cred_handle)
*output_cred_handle = GSS_C_NO_CREDENTIAL;
if (actual_mechs)
*actual_mechs = GSS_C_NO_OID_SET;
if (time_rec)
*time_rec = 0;
_gss_load_mech();
/*
* First make sure that at least one of the requested
* mechanisms is one that we support.
*/
if (mechs) {
for (i = 0; i < mechs->count; i++) {
int t;
gss_test_oid_set_member(minor_status,
&mechs->elements[i], _gss_mech_oids, &t);
if (t)
break;
}
if (i == mechs->count) {
*minor_status = 0;
return (GSS_S_BAD_MECH);
}
} else {
mechs = _gss_mech_oids;
}
if (actual_mechs) {
major_status = gss_create_empty_oid_set(minor_status,
actual_mechs);
if (major_status)
return (major_status);
}
cred = malloc(sizeof(struct _gss_cred));
if (!cred) {
if (actual_mechs)
gss_release_oid_set(minor_status, actual_mechs);
*minor_status = ENOMEM;
return (GSS_S_FAILURE);
}
SLIST_INIT(&cred->gc_mc);
set.count = 1;
min_time = GSS_C_INDEFINITE;
for (i = 0; i < mechs->count; i++) {
m = _gss_find_mech_switch(&mechs->elements[i]);
if (!m)
continue;
if (desired_name != GSS_C_NO_NAME) {
major_status = _gss_find_mn(minor_status, name,
&mechs->elements[i], &mn);
if (major_status != GSS_S_COMPLETE)
continue;
}
mc = malloc(sizeof(struct _gss_mechanism_cred));
if (!mc) {
continue;
}
mc->gmc_mech = m;
mc->gmc_mech_oid = &m->gm_mech_oid;
/*
* XXX Probably need to do something with actual_mechs.
*/
set.elements = &mechs->elements[i];
major_status = m->gm_acquire_cred(minor_status,
(desired_name != GSS_C_NO_NAME
? mn->gmn_name : GSS_C_NO_NAME),
time_req, &set, cred_usage,
&mc->gmc_cred, NULL, &cred_time);
if (major_status) {
free(mc);
continue;
}
if (cred_time < min_time)
min_time = cred_time;
if (actual_mechs) {
major_status = gss_add_oid_set_member(minor_status,
mc->gmc_mech_oid, actual_mechs);
if (major_status) {
m->gm_release_cred(minor_status,
&mc->gmc_cred);
free(mc);
continue;
}
}
SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
}
/*
* If we didn't manage to create a single credential, return
* an error.
*/
if (!SLIST_FIRST(&cred->gc_mc)) {
free(cred);
if (actual_mechs)
gss_release_oid_set(minor_status, actual_mechs);
*minor_status = 0;
return (GSS_S_NO_CRED);
}
if (time_rec)
*time_rec = min_time;
*output_cred_handle = (gss_cred_id_t) cred;
*minor_status = 0;
return (GSS_S_COMPLETE);
}
static OM_uint32
_gss_import_export_name(OM_uint32 *minor_status,
const gss_buffer_t input_name_buffer,
gss_name_t *output_name)
{
OM_uint32 major_status;
unsigned char *p = input_name_buffer->value;
size_t len = input_name_buffer->length;
size_t t;
gss_OID_desc mech_oid;
struct _gss_mech_switch *m;
struct _gss_name *name;
gss_name_t new_canonical_name;
*minor_status = 0;
*output_name = 0;
/*
* Make sure that TOK_ID is {4, 1}.
*/
if (len < 2)
return (GSS_S_BAD_NAME);
if (p[0] != 4 || p[1] != 1)
return (GSS_S_BAD_NAME);
p += 2;
len -= 2;
/*
* Get the mech length and the name length and sanity
* check the size of of the buffer.
*/
if (len < 2)
return (GSS_S_BAD_NAME);
t = (p[0] << 8) + p[1];
p += 2;
len -= 2;
/*
* Check the DER encoded OID to make sure it agrees with the
* length we just decoded.
*/
if (p[0] != 6) /* 6=OID */
return (GSS_S_BAD_NAME);
p++;
len--;
t--;
if (p[0] & 0x80) {
int digits = p[0];
p++;
len--;
t--;
mech_oid.length = 0;
while (digits--) {
mech_oid.length = (mech_oid.length << 8) | p[0];
p++;
len--;
t--;
}
} else {
mech_oid.length = p[0];
p++;
len--;
t--;
}
if (mech_oid.length != t)
return (GSS_S_BAD_NAME);
mech_oid.elements = p;
if (len < t + 4)
return (GSS_S_BAD_NAME);
p += t;
len -= t;
t = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
p += 4;
len -= 4;
if (len != t)
return (GSS_S_BAD_NAME);
m = _gss_find_mech_switch(&mech_oid);
if (!m)
return (GSS_S_BAD_MECH);
/*
* Ask the mechanism to import the name.
*/
major_status = m->gm_import_name(minor_status,
input_name_buffer, GSS_C_NT_EXPORT_NAME, &new_canonical_name);
if (major_status != GSS_S_COMPLETE) {
_gss_mg_error(m, major_status, *minor_status);
return (major_status);
}
/*
* Now we make a new name and mark it as an MN.
*/
name = _gss_make_name(m, new_canonical_name);
if (!name) {
m->gm_release_name(minor_status, &new_canonical_name);
return (GSS_S_FAILURE);
}
*output_name = (gss_name_t) name;
*minor_status = 0;
return (GSS_S_COMPLETE);
}
