/* * close * * - free our pointers to the NC */ krb5_error_code KRB5_CALLCONV krb5_stdccv3_close(krb5_context context, krb5_ccache id) { krb5_error_code err = 0; stdccCacheDataPtr ccapi_data = id->data; if (!err) { err = stdccv3_setup (context, NULL); } if (!err) { if (ccapi_data) { if (ccapi_data->cache_name) { free (ccapi_data->cache_name); } if (ccapi_data->NamedCache) { err = cc_ccache_release (ccapi_data->NamedCache); } free (ccapi_data); id->data = NULL; } free (id); } return cc_err_xlate(err); }
/* * Destroy credentials file * * Implementation in dest_tkt.c */ int KRB5_CALLCONV dest_tkt (void) { cc_int32 cc_err = ccNoError; cc_context_t cc_context = NULL; cc_int32 cc_version; cc_ccache_t ccache = NULL; cc_err = cc_initialize (&cc_context, ccapi_version_3, &cc_version, NULL); if (cc_err == ccNoError) { cc_err = cc_context_open_ccache (cc_context, TKT_FILE, &ccache); } if (cc_err == ccNoError) { cc_ccache_destroy (ccache); } if (ccache != NULL) cc_ccache_release (ccache); if (cc_context != NULL) cc_context_release (cc_context); if (cc_err != ccNoError) return RET_TKFIL; else return KSUCCESS; }
int KRB5_CALLCONV krb_in_tkt ( char* pname, char* pinst, char* realm) { char principal [MAX_K_NAME_SZ + 1]; cc_int32 err = ccNoError; cc_context_t cc_context = NULL; cc_int32 cc_version; cc_ccache_t ccache = NULL; err = cc_initialize (&cc_context, ccapi_version_3, &cc_version, NULL); if (err == ccNoError) { sprintf (principal, "%s%s%s@%s", pname, (pinst [0] == '\0') ? "" : ".", pinst, realm); } if (err == ccNoError) { err = cc_context_create_ccache (cc_context, TKT_FILE, cc_credentials_v4, principal, &ccache); } if (ccache != NULL) cc_ccache_release (ccache); if (cc_context != NULL) cc_context_release (cc_context); if (err != ccNoError) return KFAILURE; else return KSUCCESS; }
/* * Deletion from credentials file */ int KRB5_CALLCONV krb_delete_cred ( char* sname, char* sinstance, char* srealm) { cc_credentials_t theCreds = NULL; cc_credentials_iterator_t iterator = NULL; cc_int32 cc_err = ccNoError; cc_context_t cc_context = NULL; cc_int32 cc_version; cc_ccache_t ccache = NULL; cc_err = cc_initialize (&cc_context, ccapi_version_3, &cc_version, NULL); if (cc_err == ccNoError) { cc_err = cc_context_open_ccache (cc_context, TKT_FILE, &ccache); } if (cc_err == ccNoError) { cc_err = cc_ccache_new_credentials_iterator (ccache, &iterator); } if (cc_err == ccNoError) { for (;;) { /* get next creds */ cc_err = cc_credentials_iterator_next (iterator, &theCreds); if (cc_err != ccNoError) { break; } if ((theCreds -> data -> version == cc_credentials_v4) && (strcmp (theCreds -> data -> credentials.credentials_v4 -> service, sname) == 0) && (strcmp (theCreds -> data -> credentials.credentials_v4 -> service_instance, sinstance) == 0) && (strcmp (theCreds -> data -> credentials.credentials_v4 -> realm, srealm) == 0)) { cc_ccache_remove_credentials (ccache, theCreds); cc_credentials_release (theCreds); break; } cc_credentials_release (theCreds); } } if (iterator != NULL) cc_credentials_iterator_release (iterator); if (ccache != NULL) cc_ccache_release (ccache); if (cc_context != NULL) cc_context_release (cc_context); if (cc_err != ccNoError) return KFAILURE; else return KSUCCESS; }
/* * initialize * * initialize the cache, check to see if one already exists for this * principal if not set our principal to this principal. This * searching enables ticket sharing */ krb5_error_code KRB5_CALLCONV krb5_stdccv3_initialize (krb5_context context, krb5_ccache id, krb5_principal princ) { krb5_error_code err = 0; stdccCacheDataPtr ccapi_data = id->data; char *name = NULL; cc_ccache_t ccache = NULL; if (id == NULL) { err = KRB5_CC_NOMEM; } if (!err) { err = stdccv3_setup (context, NULL); } if (!err) { err = krb5_unparse_name(context, princ, &name); } if (!err) { err = cc_context_create_ccache (gCntrlBlock, ccapi_data->cache_name, cc_credentials_v5, name, &ccache); } if (!err) { err = stdccv3_set_timeoffset (context, ccache); } if (!err) { if (ccapi_data->NamedCache) { err = cc_ccache_release (ccapi_data->NamedCache); } ccapi_data->NamedCache = ccache; ccache = NULL; /* take ownership */ cache_changed (); } if (ccache) { cc_ccache_release (ccache); } if (name ) { krb5_free_unparsed_name(context, name); } return cc_err_xlate(err); }
/* * Number of credentials in credentials cache */ int KRB5_CALLCONV krb_get_num_cred (void) { cc_credentials_t theCreds = NULL; int count = 0; cc_credentials_iterator_t iterator = NULL; cc_int32 cc_err = ccNoError; cc_context_t cc_context = NULL; cc_int32 cc_version; cc_ccache_t ccache = NULL; cc_err = cc_initialize (&cc_context, ccapi_version_3, &cc_version, NULL); if (cc_err == ccNoError) { cc_err = cc_context_open_ccache (cc_context, TKT_FILE, &ccache); } if (cc_err == ccNoError) { cc_err = cc_ccache_new_credentials_iterator (ccache, &iterator); } if (cc_err == ccNoError) { for (;;) { /* get next creds */ cc_err = cc_credentials_iterator_next (iterator, &theCreds); if (cc_err != ccNoError) break; if (theCreds -> data -> version == cc_credentials_v4) count++; cc_credentials_release (theCreds); } } if (iterator != NULL) cc_credentials_iterator_release (iterator); if (ccache != NULL) cc_ccache_release (ccache); if (cc_context != NULL) cc_context_release (cc_context); if (cc_err != ccNoError) return 0; else return count; }
/* * Credentials file -> realm mapping * * Determine the realm by opening the named cache and parsing realm from the principal */ int KRB5_CALLCONV krb_get_tf_realm ( const char* ticket_file, char* realm) { cc_string_t principal; char pname [ANAME_SZ]; char pinst [INST_SZ]; char prealm [REALM_SZ]; int kerr = KSUCCESS; cc_int32 cc_err = ccNoError; cc_context_t cc_context = NULL; cc_int32 cc_version = 0; cc_ccache_t ccache = NULL; cc_err = cc_initialize (&cc_context, ccapi_version_3, &cc_version, NULL); if (cc_err == ccNoError) { cc_err = cc_context_open_ccache (cc_context, ticket_file, &ccache); } if (cc_err == ccNoError) { cc_err = cc_ccache_get_principal (ccache, cc_credentials_v4, &principal); } if (cc_err == ccNoError) { /* found cache. get princiapl and parse it */ kerr = kname_parse (pname, pinst, prealm, (char*) principal -> data); cc_string_release (principal); } if ((cc_err == ccNoError) && (kerr == KSUCCESS)) { strcpy (realm, prealm); } if (ccache != NULL) cc_ccache_release (ccache); if (cc_context != NULL) cc_context_release (cc_context); if (kerr != KSUCCESS) return kerr; if (cc_err != ccNoError) return GC_NOTKT; else return KSUCCESS; }
/* * Credentials file -> name, instance, realm mapping */ int KRB5_CALLCONV krb_get_tf_fullname ( const char* ticket_file, char* name, char* instance, char* realm) { cc_string_t principal; int kerr = KSUCCESS; cc_int32 cc_err = ccNoError; cc_context_t cc_context = NULL; cc_int32 cc_version; cc_ccache_t ccache = NULL; cc_err = cc_initialize (&cc_context, ccapi_version_3, &cc_version, NULL); if (cc_err == ccNoError) { cc_err = cc_context_open_ccache (cc_context, ticket_file, &ccache); } if (cc_err == ccNoError) { /* found cache. get principal and parse it */ cc_err = cc_ccache_get_principal (ccache, cc_credentials_v4, &principal); } if (cc_err == ccNoError) { kerr = kname_parse (name, instance, realm, (char*) principal -> data); cc_string_release (principal); } if (ccache != NULL) cc_ccache_release (ccache); if (cc_context != NULL) cc_context_release (cc_context); if (kerr != KSUCCESS) return kerr; if (cc_err != ccNoError) return GC_NOTKT; else return KSUCCESS; }
cc_int32 check_once_cc_ccache_iterator_next(cc_ccache_iterator_t iterator, cc_uint32 expected_count, cc_int32 expected_err, const char *description) { cc_int32 err = ccNoError; // BEGIN_CHECK_ONCE(description); cc_int32 possible_return_values[6] = { ccNoError, ccIteratorEnd, ccErrBadParam, ccErrNoMem, ccErrInvalidCCacheIterator, ccErrCCacheNotFound, }; #define possible_ret_val_count sizeof(possible_return_values)/sizeof(possible_return_values[0]) cc_ccache_t ccache = NULL; cc_uint32 actual_count = 0; while (!err) { err = cc_ccache_iterator_next(iterator, &ccache); if (ccache) { actual_count++; cc_ccache_release(ccache); ccache = NULL; } } if (err == ccIteratorEnd) { err = ccNoError; } // check returned error check_err(err, expected_err, possible_return_values); check_if(actual_count != expected_count, "iterator didn't iterate over all ccaches"); // END_CHECK_ONCE; return err; }
int check_cc_ccache_iterator_next(void) { cc_int32 err = 0; cc_context_t context = NULL; cc_ccache_t ccache = NULL; cc_ccache_iterator_t iterator = NULL; unsigned int i; BEGIN_TEST("cc_ccache_iterator_next"); err = cc_initialize(&context, ccapi_version_3, NULL, NULL); if (!err) { err = destroy_all_ccaches(context); } // iterate with no ccaches if (!err) { err = cc_context_new_ccache_iterator(context, &iterator); } check_once_cc_ccache_iterator_next(iterator, 0, ccNoError, "iterating over an empty collection"); if (iterator) { cc_ccache_iterator_release(iterator); iterator = NULL; } // iterate with one ccache if (!err) { destroy_all_ccaches(context); err = cc_context_create_new_ccache(context, cc_credentials_v5, "*****@*****.**", &ccache); } if (ccache) { cc_ccache_release(ccache); ccache = NULL; } if (!err) { err = cc_context_new_ccache_iterator(context, &iterator); } check_once_cc_ccache_iterator_next(iterator, 1, ccNoError, "iterating over a collection of 1 ccache"); if (iterator) { cc_ccache_iterator_release(iterator); iterator = NULL; } // iterate with several ccaches if (!err) { destroy_all_ccaches(context); } for(i = 0; !err && (i < 1000); i++) { if (i%100 == 0) fprintf(stdout, "."); err = cc_context_create_new_ccache(context, cc_credentials_v5, "*****@*****.**", &ccache); if (ccache) { cc_ccache_release(ccache); ccache = NULL; } } if (!err) { err = cc_context_new_ccache_iterator(context, &iterator); } check_once_cc_ccache_iterator_next(iterator, 1000, ccNoError, "iterating over a collection of 1000 ccache"); if (iterator) { cc_ccache_iterator_release(iterator); iterator = NULL; } if (ccache) { cc_ccache_release(ccache); } if (iterator) { cc_ccache_iterator_release(iterator); } if (context) { destroy_all_ccaches(context); cc_context_release(context); } END_TEST_AND_RETURN }
krb5_error_code KRB5_CALLCONV krb5_stdccv3_ptcursor_next( krb5_context context, krb5_cc_ptcursor cursor, krb5_ccache *ccache) { krb5_error_code err = 0; cc_ccache_iterator_t iterator = NULL; krb5_ccache newCache = NULL; stdccCacheDataPtr ccapi_data = NULL; cc_ccache_t ccCache = NULL; cc_string_t ccstring = NULL; char *name = NULL; if (!cursor || !cursor->data) { err = ccErrInvalidContext; } *ccache = NULL; if (!err) { newCache = (krb5_ccache) malloc (sizeof (*newCache)); if (!newCache) { err = KRB5_CC_NOMEM; } } if (!err) { ccapi_data = (stdccCacheDataPtr) malloc (sizeof (*ccapi_data)); if (!ccapi_data) { err = KRB5_CC_NOMEM; } } if (!err) { iterator = cursor->data; err = cc_ccache_iterator_next(iterator, &ccCache); } if (!err) { err = cc_ccache_get_name (ccCache, &ccstring); } if (!err) { name = strdup (ccstring->data); if (!name) { err = KRB5_CC_NOMEM; } } if (!err) { ccapi_data->cache_name = name; name = NULL; /* take ownership */ ccapi_data->NamedCache = ccCache; ccCache = NULL; /* take ownership */ newCache->ops = &krb5_cc_stdcc_ops; newCache->data = ccapi_data; ccapi_data = NULL; /* take ownership */ /* return a pointer to the new cache */ *ccache = newCache; newCache = NULL; } if (name) { free (name); } if (ccstring) { cc_string_release (ccstring); } if (ccCache) { cc_ccache_release (ccCache); } if (ccapi_data) { free (ccapi_data); } if (newCache) { free (newCache); } if (err == ccIteratorEnd) { err = ccNoError; } return err; }
/* * -- generate_new -------------------------------- * * create a new cache with a unique name, corresponds to creating a * named cache initialize the API here if we have to. */ krb5_error_code KRB5_CALLCONV krb5_stdccv3_generate_new (krb5_context context, krb5_ccache *id ) { krb5_error_code err = 0; krb5_ccache newCache = NULL; stdccCacheDataPtr ccapi_data = NULL; cc_ccache_t ccache = NULL; cc_string_t ccstring = NULL; char *name = NULL; if (!err) { err = stdccv3_setup(context, NULL); } if (!err) { newCache = (krb5_ccache) malloc (sizeof (*newCache)); if (!newCache) { err = KRB5_CC_NOMEM; } } if (!err) { ccapi_data = (stdccCacheDataPtr) malloc (sizeof (*ccapi_data)); if (!ccapi_data) { err = KRB5_CC_NOMEM; } } if (!err) { err = cc_context_create_new_ccache (gCntrlBlock, cc_credentials_v5, "", &ccache); } if (!err) { err = stdccv3_set_timeoffset (context, ccache); } if (!err) { err = cc_ccache_get_name (ccache, &ccstring); } if (!err) { name = strdup (ccstring->data); if (!name) { err = KRB5_CC_NOMEM; } } if (!err) { ccapi_data->cache_name = name; name = NULL; /* take ownership */ ccapi_data->NamedCache = ccache; ccache = NULL; /* take ownership */ newCache->ops = &krb5_cc_stdcc_ops; newCache->data = ccapi_data; ccapi_data = NULL; /* take ownership */ /* return a pointer to the new cache */ *id = newCache; newCache = NULL; } if (ccstring) { cc_string_release (ccstring); } if (name) { free (name); } if (ccache) { cc_ccache_release (ccache); } if (ccapi_data) { free (ccapi_data); } if (newCache) { free (newCache); } return cc_err_xlate (err); }
/* * Retrieval from credentials file * This function is _not_!! well-defined under CCache API, because * there is no guarantee about order of credentials remaining the same. */ int KRB5_CALLCONV krb_get_nth_cred ( char* sname, char* sinstance, char* srealm, int n) { cc_credentials_t theCreds = NULL; int count = 0; cc_credentials_iterator_t iterator = NULL; cc_int32 cc_err = ccNoError; cc_context_t cc_context = NULL; cc_int32 cc_version; cc_ccache_t ccache = NULL; if (n < 1) return KFAILURE; cc_err = cc_initialize (&cc_context, ccapi_version_3, &cc_version, NULL); if (cc_err == ccNoError) { cc_err = cc_context_open_ccache (cc_context, TKT_FILE, &ccache); } if (cc_err == ccNoError) { cc_err = cc_ccache_new_credentials_iterator (ccache, &iterator); } if (cc_err == ccNoError) { for (count = 0; count < n;) { /* get next creds */ cc_err = cc_credentials_iterator_next (iterator, &theCreds); if (cc_err != ccNoError) break; if (theCreds -> data -> version == cc_credentials_v4) count++; if (count < n - 1) cc_credentials_release (theCreds); } } if (cc_err == ccNoError) { strcpy (sname, theCreds -> data -> credentials.credentials_v4 -> service); strcpy (sinstance, theCreds -> data -> credentials.credentials_v4 -> service_instance); strcpy (srealm, theCreds -> data -> credentials.credentials_v4 -> realm); } if (theCreds != NULL) cc_credentials_release (theCreds); if (iterator != NULL) cc_credentials_iterator_release (iterator); if (ccache != NULL) cc_ccache_release (ccache); if (cc_context != NULL) cc_context_release (cc_context); if (cc_err != ccNoError) return KFAILURE; else return KSUCCESS; }
/* * Retrieval from credentials cache */ int KRB5_CALLCONV krb_get_cred ( char* service, char* instance, char* realm, CREDENTIALS* creds) { int kerr = KSUCCESS; cc_int32 cc_err = ccNoError; cc_credentials_t theCreds = NULL; cc_credentials_iterator_t iterator = NULL; cc_context_t cc_context = NULL; cc_int32 cc_version; cc_ccache_t ccache = NULL; #ifdef USE_LOGIN_LIBRARY // If we are requesting a tgt, prompt for it if (strncmp (service, KRB_TICKET_GRANTING_TICKET, ANAME_SZ) == 0) { OSStatus err; char *cacheName; KLPrincipal outPrincipal; err = __KLInternalAcquireInitialTicketsForCache (TKT_FILE, kerberosVersion_V4, NULL, &outPrincipal, &cacheName); if (err == klNoErr) { krb_set_tkt_string (cacheName); // Tickets for the krb4 principal went here KLDisposeString (cacheName); KLDisposePrincipal (outPrincipal); } else { return GC_NOTKT; } } #endif /* USE_LOGIN_LIBRARY */ cc_err = cc_initialize (&cc_context, ccapi_version_3, &cc_version, NULL); if (cc_err == ccNoError) { cc_err = cc_context_open_ccache (cc_context, TKT_FILE, &ccache); } if (cc_err == ccNoError) { cc_err = cc_ccache_new_credentials_iterator (ccache, &iterator); } if (cc_err == ccNoError) { for (;;) { /* get next creds */ cc_err = cc_credentials_iterator_next (iterator, &theCreds); if (cc_err == ccIteratorEnd) { kerr = GC_NOTKT; break; } if (cc_err != ccNoError) { kerr = KFAILURE; break; } /* version, service, instance, realm check */ if ((theCreds -> data -> version == cc_credentials_v4) && (strcmp (theCreds -> data -> credentials.credentials_v4 -> service, service) == 0) && (strcmp (theCreds -> data -> credentials.credentials_v4 -> service_instance, instance) == 0) && (strcmp (theCreds -> data -> credentials.credentials_v4 -> realm, realm) == 0)) { /* Match! */ strcpy (creds -> service, service); strcpy (creds -> instance, instance); strcpy (creds -> realm, realm); memmove (creds -> session, theCreds -> data -> credentials.credentials_v4 -> session_key, sizeof (C_Block)); creds -> lifetime = theCreds -> data -> credentials.credentials_v4 -> lifetime; creds -> kvno = theCreds -> data -> credentials.credentials_v4 -> kvno; creds -> ticket_st.length = theCreds -> data -> credentials.credentials_v4 -> ticket_size; memmove (creds -> ticket_st.dat, theCreds -> data -> credentials.credentials_v4 -> ticket, creds -> ticket_st.length); creds -> issue_date = theCreds -> data -> credentials.credentials_v4 -> issue_date; strcpy (creds -> pname, theCreds -> data -> credentials.credentials_v4 -> principal); strcpy (creds -> pinst, theCreds -> data -> credentials.credentials_v4 -> principal_instance); creds -> stk_type = theCreds -> data -> credentials.credentials_v4 -> string_to_key_type; cc_credentials_release (theCreds); kerr = KSUCCESS; break; } else { cc_credentials_release (theCreds); } } } if (iterator != NULL) cc_credentials_iterator_release (iterator); if (ccache != NULL) cc_ccache_release (ccache); if (cc_context != NULL) cc_context_release (cc_context); if (kerr != KSUCCESS) return kerr; if (cc_err != ccNoError) return GC_NOTKT; else return KSUCCESS; }
/* * Store a ticket into the default credentials cache * cache must exist (if it didn't exist, it would have been created by in_tkt) */ int krb4int_save_credentials_addr( char* service, char* instance, char* realm, C_Block session, int lifetime, int kvno, KTEXT ticket, KRB4_32 issue_date, KRB_UINT32 local_address) { cc_int32 cc_err = ccNoError; int kerr = KSUCCESS; cc_credentials_v4_t v4creds; cc_credentials_union creds; cc_ccache_t ccache = NULL; cc_string_t principal; cc_context_t cc_context = NULL; cc_int32 cc_version; cc_err = cc_initialize (&cc_context, ccapi_version_3, &cc_version, NULL); if (cc_err == ccNoError) { /* First try existing cache */ cc_err = cc_context_open_ccache (cc_context, TKT_FILE, &ccache); } if (cc_err == ccNoError) { /* Now we have a cache. Fill out the credentials and put them in the cache. */ /* To fill out the credentials, we need the principal */ cc_err = cc_ccache_get_principal (ccache, cc_credentials_v4, &principal); } if (cc_err == ccNoError) { kerr = kname_parse (v4creds.principal, v4creds.principal_instance, v4creds.realm, (char*) principal -> data); cc_string_release (principal); } if ((cc_err == ccNoError) && (kerr == KSUCCESS)) { strncpy (v4creds.service, service, SNAME_SZ); strncpy (v4creds.service_instance, instance, INST_SZ); strncpy (v4creds.realm, realm, REALM_SZ); memmove (v4creds.session_key, session, sizeof (C_Block)); v4creds.kvno = kvno; v4creds.string_to_key_type = cc_v4_stk_unknown; v4creds.issue_date = issue_date; v4creds.address = local_address; v4creds.lifetime = lifetime; v4creds.ticket_size = ticket -> length; memmove (v4creds.ticket, ticket -> dat, ticket -> length); creds.version = cc_credentials_v4; creds.credentials.credentials_v4 = &v4creds; cc_err = cc_ccache_store_credentials (ccache, &creds); } if (ccache != NULL) cc_ccache_release (ccache); if (cc_context != NULL) cc_context_release (cc_context); if (kerr != KSUCCESS) return kerr; if (cc_err != ccNoError) return KFAILURE; else return KSUCCESS; }