diff --git a/lib/gssapi/Makefile.am b/lib/gssapi/Makefile.am index d67157e5f..b6ed90ce4 100644 --- a/lib/gssapi/Makefile.am +++ b/lib/gssapi/Makefile.am @@ -85,6 +85,7 @@ mechsrc = \ mech/gss_acquire_cred_ext.c \ mech/gss_acquire_cred_with_password.c \ mech/gss_add_cred.c \ + mech/gss_add_cred_with_password.c \ mech/gss_add_oid_set_member.c \ mech/gss_aeap.c \ mech/gss_buffer_set.c \ diff --git a/lib/gssapi/mech/cred.h b/lib/gssapi/mech/cred.h index 5d6430f69..5661b5323 100644 --- a/lib/gssapi/mech/cred.h +++ b/lib/gssapi/mech/cred.h @@ -42,3 +42,16 @@ struct _gss_cred { struct _gss_mechanism_cred * _gss_copy_cred(struct _gss_mechanism_cred *mc); +struct _gss_mechanism_name; + +OM_uint32 +_gss_acquire_mech_cred(OM_uint32 *minor_status, + gssapi_mech_interface m, + const struct _gss_mechanism_name *mn, + gss_const_OID credential_type, + const void *credential_data, + OM_uint32 time_req, + gss_const_OID desired_mech, + gss_cred_usage_t cred_usage, + struct _gss_mechanism_cred **output_cred_handle); + diff --git a/lib/gssapi/mech/gss_acquire_cred_ext.c b/lib/gssapi/mech/gss_acquire_cred_ext.c index 2fcd15268..b9cb6c50a 100644 --- a/lib/gssapi/mech/gss_acquire_cred_ext.c +++ b/lib/gssapi/mech/gss_acquire_cred_ext.c @@ -30,6 +30,80 @@ #include "mech_locl.h" +OM_uint32 +_gss_acquire_mech_cred(OM_uint32 *minor_status, + gssapi_mech_interface m, + const struct _gss_mechanism_name *mn, + gss_const_OID credential_type, + const void *credential_data, + OM_uint32 time_req, + gss_const_OID desired_mech, + gss_cred_usage_t cred_usage, + struct _gss_mechanism_cred **output_cred_handle) +{ + OM_uint32 major_status; + struct _gss_mechanism_cred *mc; + gss_OID_set_desc set2; + + *output_cred_handle = NULL; + + mc = calloc(1, sizeof(struct _gss_mechanism_cred)); + if (mc == NULL) { + *minor_status = ENOMEM; + return GSS_S_FAILURE; + } + + mc->gmc_mech = m; + mc->gmc_mech_oid = &m->gm_mech_oid; + + set2.count = 1; + set2.elements = mc->gmc_mech_oid; + + if (m->gm_acquire_cred_ext) { + major_status = m->gm_acquire_cred_ext(minor_status, + mn->gmn_name, + credential_type, + credential_data, + time_req, + mc->gmc_mech_oid, + cred_usage, + &mc->gmc_cred); + } else if (gss_oid_equal(credential_type, GSS_C_CRED_PASSWORD) && + m->gm_compat && + m->gm_compat->gmc_acquire_cred_with_password) { + /* + * Shim for mechanisms that adhere to API-as-SPI and do not + * implement gss_acquire_cred_ext(). + */ + + major_status = m->gm_compat->gmc_acquire_cred_with_password(minor_status, + mn->gmn_name, + (const gss_buffer_t)credential_data, + time_req, + &set2, + cred_usage, + &mc->gmc_cred, + NULL, + NULL); + } else if (credential_type == GSS_C_NO_OID) { + major_status = m->gm_acquire_cred(minor_status, + mn->gmn_name, + time_req, + &set2, + cred_usage, + &mc->gmc_cred, + NULL, + NULL); + } else { + major_status = GSS_S_UNAVAILABLE; + free(mc); + mc= NULL; + } + + *output_cred_handle = mc; + return major_status; +} + GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_acquire_cred_ext(OM_uint32 *minor_status, const gss_name_t desired_name, @@ -44,7 +118,6 @@ gss_acquire_cred_ext(OM_uint32 *minor_status, struct _gss_name *name = (struct _gss_name *) desired_name; gssapi_mech_interface m; struct _gss_cred *cred; - struct _gss_mechanism_cred *mc; gss_OID_set_desc set, *mechs; size_t i; @@ -57,13 +130,13 @@ gss_acquire_cred_ext(OM_uint32 *minor_status, if (desired_mech != GSS_C_NO_OID) { int match = 0; - gss_test_oid_set_member(minor_status, desired_mech, + gss_test_oid_set_member(minor_status, (gss_OID)desired_mech, _gss_mech_oids, &match); if (!match) return GSS_S_BAD_MECH; set.count = 1; - set.elements = desired_mech; + set.elements = (gss_OID)desired_mech; mechs = &set; } else mechs = _gss_mech_oids; @@ -78,6 +151,7 @@ gss_acquire_cred_ext(OM_uint32 *minor_status, for (i = 0; i < mechs->count; i++) { struct _gss_mechanism_name *mn = NULL; + struct _gss_mechanism_cred *mc = NULL; gss_name_t desired_mech_name = GSS_C_NO_NAME; m = __gss_get_mechanism(&mechs->elements[i]); @@ -93,68 +167,13 @@ gss_acquire_cred_ext(OM_uint32 *minor_status, desired_mech_name = mn->gmn_name; } - mc = calloc(1, sizeof(struct _gss_mechanism_cred)); - if (mc == NULL) + major_status = _gss_acquire_mech_cred(minor_status, m, mn, + credential_type, credential_data, + time_req, desired_mech, cred_usage, + &mc); + if (GSS_ERROR(major_status)) continue; - mc->gmc_mech = m; - mc->gmc_mech_oid = &m->gm_mech_oid; - - if (m->gm_acquire_cred_ext) { - major_status = m->gm_acquire_cred_ext(minor_status, - desired_mech_name, - credential_type, - credential_data, - time_req, - mc->gmc_mech_oid, - cred_usage, - &mc->gmc_cred); - } else if (gss_oid_equal(credential_type, GSS_C_CRED_PASSWORD) && - m->gm_compat && - m->gm_compat->gmc_acquire_cred_with_password) { - /* - * Shim for mechanisms that adhere to API-as-SPI and do not - * implement gss_acquire_cred_ext(). - */ - gss_OID_set_desc set2; - _gss_acquire_cred_with_password_t *acwp - = m->gm_compat->gmc_acquire_cred_with_password; - - set2.count = 1; - set2.elements = mc->gmc_mech_oid; - - major_status = acwp(minor_status, - desired_mech_name, - (const gss_buffer_t)credential_data, - time_req, - &set2, - cred_usage, - &mc->gmc_cred, - NULL, - NULL); - } else if (credential_type == GSS_C_NO_OID) { - gss_OID_set_desc set2; - - set2.count = 1; - set2.elements = mc->gmc_mech_oid; - - major_status = m->gm_acquire_cred(minor_status, - desired_name, - time_req, - &set2, - cred_usage, - &mc->gmc_cred, - NULL, - NULL); - } else { - major_status = GSS_S_UNAVAILABLE; - } - - if (GSS_ERROR(major_status)) { - free(mc); - continue; - } - HEIM_SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link); } diff --git a/lib/gssapi/mech/gss_add_cred_with_password.c b/lib/gssapi/mech/gss_add_cred_with_password.c index 9f205465c..a4bb0c018 100644 --- a/lib/gssapi/mech/gss_add_cred_with_password.c +++ b/lib/gssapi/mech/gss_add_cred_with_password.c @@ -46,10 +46,9 @@ gss_add_cred_with_password(OM_uint32 *minor_status, gssapi_mech_interface m; struct _gss_cred *cred = (struct _gss_cred *) input_cred_handle; struct _gss_cred *new_cred; - gss_cred_id_t release_cred; struct _gss_mechanism_cred *mc, *target_mc, *copy_mc; - struct _gss_mechanism_name *mn; - OM_uint32 junk; + struct _gss_mechanism_name *mn = NULL; + OM_uint32 junk, time_req; *minor_status = 0; *output_cred_handle = GSS_C_NO_CREDENTIAL; @@ -60,7 +59,13 @@ gss_add_cred_with_password(OM_uint32 *minor_status, if (actual_mechs) *actual_mechs = GSS_C_NO_OID_SET; - new_cred = malloc(sizeof(struct _gss_cred)); + m = __gss_get_mechanism(desired_mech); + if (m == NULL) { + *minor_status = 0; + return (GSS_S_BAD_MECH); + } + + new_cred = calloc(1, sizeof(struct _gss_cred)); if (!new_cred) { *minor_status = ENOMEM; return (GSS_S_FAILURE); @@ -81,8 +86,7 @@ gss_add_cred_with_password(OM_uint32 *minor_status, } copy_mc = _gss_copy_cred(mc); if (!copy_mc) { - release_cred = (gss_cred_id_t)new_cred; - gss_release_cred(&junk, &release_cred); + gss_release_cred(&junk, (gss_cred_id_t *)&new_cred); *minor_status = ENOMEM; return (GSS_S_FAILURE); } @@ -99,53 +103,50 @@ gss_add_cred_with_password(OM_uint32 *minor_status, desired_mech, &mn); if (major_status != GSS_S_COMPLETE) { - free(new_cred); - return major_status; + gss_release_cred(&junk, (gss_cred_id_t *)&new_cred); + return (major_status); } - } else { - mn = 0; } - m = __gss_get_mechanism(desired_mech); - if (m->gm_add_cred_with_password == NULL) { - release_cred = (gss_cred_id_t)new_cred; - gss_release_cred(&junk, &release_cred); - return (GSS_S_UNAVAILABLE); - } + if (cred_usage == GSS_C_INITIATE) + time_req = initiator_time_req; + else if (cred_usage == GSS_C_ACCEPT) + time_req = acceptor_time_req; + else if (cred_usage == GSS_C_BOTH) + time_req = initiator_time_req > acceptor_time_req ? initiator_time_req : acceptor_time_req; - mc = malloc(sizeof(struct _gss_mechanism_cred)); - if (!mc) { - release_cred = (gss_cred_id_t)new_cred; - gss_release_cred(&junk, &release_cred); - *minor_status = ENOMEM; - return (GSS_S_FAILURE); - } - mc->gmc_mech = m; - mc->gmc_mech_oid = &m->gm_mech_oid; - - major_status = m->gm_add_cred_with_password(minor_status, - target_mc ? target_mc->gmc_cred : GSS_C_NO_CREDENTIAL, - desired_name ? mn->gmn_name : GSS_C_NO_NAME, - desired_mech, - password, - cred_usage, - initiator_time_req, - acceptor_time_req, - &mc->gmc_cred, - actual_mechs, - initiator_time_rec, - acceptor_time_rec); - - if (major_status) { - _gss_mg_error(m, major_status, *minor_status); - release_cred = (gss_cred_id_t)new_cred; - gss_release_cred(&junk, &release_cred); - free(mc); + major_status = _gss_acquire_mech_cred(minor_status, m, mn, + GSS_C_CRED_PASSWORD, password, + time_req, desired_mech, + cred_usage, &mc); + if (major_status != GSS_S_COMPLETE) { + gss_release_cred(&junk, (gss_cred_id_t *)&new_cred); return (major_status); } - HEIM_SLIST_INSERT_HEAD(&new_cred->gc_mc, mc, gmc_link); - *output_cred_handle = (gss_cred_id_t) new_cred; + HEIM_SLIST_INSERT_HEAD(&new_cred->gc_mc, mc, gmc_link); + + if (actual_mechs != NULL || initiator_time_rec != NULL || acceptor_time_rec != NULL) { + OM_uint32 time_rec; + + major_status = gss_inquire_cred(minor_status, + (gss_cred_id_t)new_cred, + NULL, + &time_rec, + NULL, + actual_mechs); + if (GSS_ERROR(major_status)) { + gss_release_cred(&junk, (gss_cred_id_t *)&new_cred); + return (major_status); + } + if (initiator_time_rec != NULL && + (cred_usage == GSS_C_INITIATE || cred_usage == GSS_C_BOTH)) + *initiator_time_rec = time_rec; + if (acceptor_time_rec != NULL && + (cred_usage == GSS_C_ACCEPT || cred_usage == GSS_C_BOTH)) + *acceptor_time_rec = time_rec; + } + + *output_cred_handle = (gss_cred_id_t) new_cred; return (GSS_S_COMPLETE); } - diff --git a/lib/gssapi/version-script.map b/lib/gssapi/version-script.map index 2736b2e7c..11e9e3340 100644 --- a/lib/gssapi/version-script.map +++ b/lib/gssapi/version-script.map @@ -20,7 +20,7 @@ HEIMDAL_GSS_2.0 { gss_acquire_cred_with_password; gss_add_buffer_set_member; gss_add_cred; -# gss_add_cred_with_password; + gss_add_cred_with_password; gss_add_oid_set_member; gss_authorize_localname; gss_canonicalize_name;