OM_uint32 gss_pname_to_uid(OM_uint32 *minor_status, const gss_name_t pname, const gss_OID mech, uid_t *uidp) { struct _gss_name *name = (struct _gss_name *) pname; struct _gss_mech_switch *m; struct _gss_mechanism_name *mn; OM_uint32 major_status; *minor_status = 0; if (pname == GSS_C_NO_NAME) return (GSS_S_BAD_NAME); m = _gss_find_mech_switch(mech); if (!m) return (GSS_S_BAD_MECH); if (m->gm_pname_to_uid == NULL) return (GSS_S_UNAVAILABLE); major_status = _gss_find_mn(minor_status, name, mech, &mn); if (major_status != GSS_S_COMPLETE) { _gss_mg_error(m, major_status, *minor_status); return (major_status); } major_status = (*m->gm_pname_to_uid)(minor_status, mn->gmn_name, mech, uidp); if (major_status != GSS_S_COMPLETE) _gss_mg_error(m, major_status, *minor_status); return (major_status); }
void _gss_mg_collect_error(gss_OID mech, OM_uint32 maj, OM_uint32 min) { struct _gss_mech_switch *m; m = _gss_find_mech_switch(mech); if (m != NULL) _gss_mg_error(m, maj, min); }
OM_uint32 gss_canonicalize_name(OM_uint32 *minor_status, const gss_name_t input_name, const gss_OID mech_type, gss_name_t *output_name) { OM_uint32 major_status; struct _gss_name *name = (struct _gss_name *) input_name; struct _gss_mechanism_name *mn; struct _gss_mech_switch *m = _gss_find_mech_switch(mech_type); gss_name_t new_canonical_name; *minor_status = 0; *output_name = 0; major_status = _gss_find_mn(minor_status, name, mech_type, &mn); if (major_status) return (major_status); m = mn->gmn_mech; major_status = m->gm_canonicalize_name(minor_status, mn->gmn_name, mech_type, &new_canonical_name); if (major_status) { _gss_mg_error(m, major_status, *minor_status); return (major_status); } /* * Now we make a new name and mark it as an MN. */ *minor_status = 0; name = malloc(sizeof(struct _gss_name)); if (!name) { m->gm_release_name(minor_status, &new_canonical_name); *minor_status = ENOMEM; return (GSS_S_FAILURE); } memset(name, 0, sizeof(struct _gss_name)); mn = malloc(sizeof(struct _gss_mechanism_name)); if (!mn) { m->gm_release_name(minor_status, &new_canonical_name); free(name); *minor_status = ENOMEM; return (GSS_S_FAILURE); } SLIST_INIT(&name->gn_mn); mn->gmn_mech = m; mn->gmn_mech_oid = &m->gm_mech_oid; mn->gmn_name = new_canonical_name; SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link); *output_name = (gss_name_t) name; return (GSS_S_COMPLETE); }
OM_uint32 gss_import_sec_context(OM_uint32 *minor_status, const gss_buffer_t interprocess_token, gss_ctx_id_t *context_handle) { OM_uint32 major_status; struct _gss_mech_switch *m; struct _gss_context *ctx; gss_OID_desc mech_oid; gss_buffer_desc buf; unsigned char *p; size_t len; *minor_status = 0; *context_handle = GSS_C_NO_CONTEXT; /* * We added an oid to the front of the token in * gss_export_sec_context. */ p = interprocess_token->value; len = interprocess_token->length; if (len < 2) return (GSS_S_DEFECTIVE_TOKEN); mech_oid.length = (p[0] << 8) | p[1]; if (len < mech_oid.length + 2) return (GSS_S_DEFECTIVE_TOKEN); mech_oid.elements = p + 2; buf.length = len - 2 - mech_oid.length; buf.value = p + 2 + mech_oid.length; m = _gss_find_mech_switch(&mech_oid); if (!m) return (GSS_S_DEFECTIVE_TOKEN); ctx = malloc(sizeof(struct _gss_context)); if (!ctx) { *minor_status = ENOMEM; return (GSS_S_FAILURE); } ctx->gc_mech = m; major_status = m->gm_import_sec_context(minor_status, &buf, &ctx->gc_ctx); if (major_status != GSS_S_COMPLETE) { _gss_mg_error(m, major_status, *minor_status); free(ctx); } else { *context_handle = (gss_ctx_id_t) ctx; } return (major_status); }
OM_uint32 gss_inquire_cred_by_mech(OM_uint32 *minor_status, const gss_cred_id_t cred_handle, const gss_OID mech_type, gss_name_t *cred_name, OM_uint32 *initiator_lifetime, OM_uint32 *acceptor_lifetime, gss_cred_usage_t *cred_usage) { OM_uint32 major_status; struct _gss_mech_switch *m; struct _gss_mechanism_cred *mcp; gss_cred_id_t mc; gss_name_t mn; struct _gss_name *name; *minor_status = 0; if (cred_name) *cred_name = GSS_C_NO_NAME; if (initiator_lifetime) *initiator_lifetime = 0; if (acceptor_lifetime) *acceptor_lifetime = 0; if (cred_usage) *cred_usage = 0; m = _gss_find_mech_switch(mech_type); if (!m) return (GSS_S_NO_CRED); if (cred_handle != GSS_C_NO_CREDENTIAL) { struct _gss_cred *cred = (struct _gss_cred *) cred_handle; SLIST_FOREACH(mcp, &cred->gc_mc, gmc_link) if (mcp->gmc_mech == m) break; if (!mcp) return (GSS_S_NO_CRED); mc = mcp->gmc_cred; } else {
OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle, const gss_cred_id_t acceptor_cred_handle, const gss_buffer_t input_token, const gss_channel_bindings_t input_chan_bindings, gss_name_t *src_name, gss_OID *mech_type, gss_buffer_t output_token, OM_uint32 *ret_flags, OM_uint32 *time_rec, gss_cred_id_t *delegated_cred_handle) { OM_uint32 major_status, mech_ret_flags; struct _gss_mech_switch *m; struct _gss_context *ctx = (struct _gss_context *) *context_handle; struct _gss_cred *cred = (struct _gss_cred *) acceptor_cred_handle; struct _gss_mechanism_cred *mc; gss_cred_id_t acceptor_mc, delegated_mc; gss_name_t src_mn; *minor_status = 0; if (src_name) *src_name = GSS_C_NO_NAME; if (mech_type) *mech_type = GSS_C_NO_OID; if (ret_flags) *ret_flags = 0; if (time_rec) *time_rec = 0; if (delegated_cred_handle) *delegated_cred_handle = GSS_C_NO_CREDENTIAL; _gss_buffer_zero(output_token); /* * If this is the first call (*context_handle is NULL), we must * parse the input token to figure out the mechanism to use. */ if (*context_handle == GSS_C_NO_CONTEXT) { gss_OID_desc mech_oid; major_status = choose_mech(input_token, &mech_oid); if (major_status != GSS_S_COMPLETE) return (major_status); /* * Now that we have a mechanism, we can find the * implementation. */ ctx = malloc(sizeof(struct _gss_context)); if (!ctx) { *minor_status = ENOMEM; return (GSS_S_DEFECTIVE_TOKEN); } memset(ctx, 0, sizeof(struct _gss_context)); m = ctx->gc_mech = _gss_find_mech_switch(&mech_oid); if (!m) { free(ctx); return (GSS_S_BAD_MECH); } } else m = ctx->gc_mech; if (cred) { SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) if (mc->gmc_mech == m) break; if (!mc) return (GSS_S_BAD_MECH); acceptor_mc = mc->gmc_cred; } else {
OM_uint32 gss_acquire_cred(OM_uint32 *minor_status, const gss_name_t desired_name, OM_uint32 time_req, const gss_OID_set desired_mechs, gss_cred_usage_t cred_usage, gss_cred_id_t *output_cred_handle, gss_OID_set *actual_mechs, OM_uint32 *time_rec) { OM_uint32 major_status; gss_OID_set mechs = desired_mechs; gss_OID_set_desc set; struct _gss_name *name = (struct _gss_name *) desired_name; struct _gss_mech_switch *m; struct _gss_cred *cred; struct _gss_mechanism_cred *mc; struct _gss_mechanism_name *mn; OM_uint32 min_time, cred_time; size_t i; *minor_status = 0; if (output_cred_handle) *output_cred_handle = GSS_C_NO_CREDENTIAL; if (actual_mechs) *actual_mechs = GSS_C_NO_OID_SET; if (time_rec) *time_rec = 0; _gss_load_mech(); /* * First make sure that at least one of the requested * mechanisms is one that we support. */ if (mechs) { for (i = 0; i < mechs->count; i++) { int t; gss_test_oid_set_member(minor_status, &mechs->elements[i], _gss_mech_oids, &t); if (t) break; } if (i == mechs->count) { *minor_status = 0; return (GSS_S_BAD_MECH); } } else { mechs = _gss_mech_oids; } if (actual_mechs) { major_status = gss_create_empty_oid_set(minor_status, actual_mechs); if (major_status) return (major_status); } cred = malloc(sizeof(struct _gss_cred)); if (!cred) { if (actual_mechs) gss_release_oid_set(minor_status, actual_mechs); *minor_status = ENOMEM; return (GSS_S_FAILURE); } SLIST_INIT(&cred->gc_mc); set.count = 1; min_time = GSS_C_INDEFINITE; for (i = 0; i < mechs->count; i++) { m = _gss_find_mech_switch(&mechs->elements[i]); if (!m) continue; if (desired_name != GSS_C_NO_NAME) { major_status = _gss_find_mn(minor_status, name, &mechs->elements[i], &mn); if (major_status != GSS_S_COMPLETE) continue; } mc = malloc(sizeof(struct _gss_mechanism_cred)); if (!mc) { continue; } mc->gmc_mech = m; mc->gmc_mech_oid = &m->gm_mech_oid; /* * XXX Probably need to do something with actual_mechs. */ set.elements = &mechs->elements[i]; major_status = m->gm_acquire_cred(minor_status, (desired_name != GSS_C_NO_NAME ? mn->gmn_name : GSS_C_NO_NAME), time_req, &set, cred_usage, &mc->gmc_cred, NULL, &cred_time); if (major_status) { free(mc); continue; } if (cred_time < min_time) min_time = cred_time; if (actual_mechs) { major_status = gss_add_oid_set_member(minor_status, mc->gmc_mech_oid, actual_mechs); if (major_status) { m->gm_release_cred(minor_status, &mc->gmc_cred); free(mc); continue; } } SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link); } /* * If we didn't manage to create a single credential, return * an error. */ if (!SLIST_FIRST(&cred->gc_mc)) { free(cred); if (actual_mechs) gss_release_oid_set(minor_status, actual_mechs); *minor_status = 0; return (GSS_S_NO_CRED); } if (time_rec) *time_rec = min_time; *output_cred_handle = (gss_cred_id_t) cred; *minor_status = 0; return (GSS_S_COMPLETE); }
static OM_uint32 _gss_import_export_name(OM_uint32 *minor_status, const gss_buffer_t input_name_buffer, gss_name_t *output_name) { OM_uint32 major_status; unsigned char *p = input_name_buffer->value; size_t len = input_name_buffer->length; size_t t; gss_OID_desc mech_oid; struct _gss_mech_switch *m; struct _gss_name *name; gss_name_t new_canonical_name; *minor_status = 0; *output_name = 0; /* * Make sure that TOK_ID is {4, 1}. */ if (len < 2) return (GSS_S_BAD_NAME); if (p[0] != 4 || p[1] != 1) return (GSS_S_BAD_NAME); p += 2; len -= 2; /* * Get the mech length and the name length and sanity * check the size of of the buffer. */ if (len < 2) return (GSS_S_BAD_NAME); t = (p[0] << 8) + p[1]; p += 2; len -= 2; /* * Check the DER encoded OID to make sure it agrees with the * length we just decoded. */ if (p[0] != 6) /* 6=OID */ return (GSS_S_BAD_NAME); p++; len--; t--; if (p[0] & 0x80) { int digits = p[0]; p++; len--; t--; mech_oid.length = 0; while (digits--) { mech_oid.length = (mech_oid.length << 8) | p[0]; p++; len--; t--; } } else { mech_oid.length = p[0]; p++; len--; t--; } if (mech_oid.length != t) return (GSS_S_BAD_NAME); mech_oid.elements = p; if (len < t + 4) return (GSS_S_BAD_NAME); p += t; len -= t; t = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3]; p += 4; len -= 4; if (len != t) return (GSS_S_BAD_NAME); m = _gss_find_mech_switch(&mech_oid); if (!m) return (GSS_S_BAD_MECH); /* * Ask the mechanism to import the name. */ major_status = m->gm_import_name(minor_status, input_name_buffer, GSS_C_NT_EXPORT_NAME, &new_canonical_name); if (major_status != GSS_S_COMPLETE) { _gss_mg_error(m, major_status, *minor_status); return (major_status); } /* * Now we make a new name and mark it as an MN. */ name = _gss_make_name(m, new_canonical_name); if (!name) { m->gm_release_name(minor_status, &new_canonical_name); return (GSS_S_FAILURE); } *output_name = (gss_name_t) name; *minor_status = 0; return (GSS_S_COMPLETE); }