oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Properly implement neg_mechs & GM_USE_MG_CRED

Browse Source 
SPNEGO was already using union creds.  Now make the mechglue know about
it, delete all of the cred-related SPNEGO stubs that are now not called
(lib/gssapi/spnego/cred_stubs.c), and implement gss_get/set_neg_mechs()
by storing the OID set in the union cred.

This commit was essentially authored as much if not more by Luke Howard
<lukeh at padl.com> as much as by the listed author.
This commit is contained in:
Nicolas Williams
2020-04-18 22:15:00 -05:00
parent 2ec9e17042
commit a54761d68a
20 changed files with 397 additions and 418 deletions
Download Patch File Download Diff File Expand all files Collapse all files

161
lib/gssapi/mech/gss_add_cred_from.c
View File

@@ -88,14 +88,75 @@ _gss_mg_add_mech_cred(OM_uint32 *minor_status,
} else
major_status = GSS_S_UNAVAILABLE;
if (major_status == GSS_S_COMPLETE && out)
if (major_status == GSS_S_COMPLETE && out) {
heim_assert(new_mc->gmc_cred != GSS_C_NO_CREDENTIAL,
"mechanism gss_add_cred did not return a cred");
*out = new_mc;
else
} else
free(new_mc);
return major_status;
}
static OM_uint32
add_mech_cred_internal(OM_uint32 *minor_status,
gss_const_name_t desired_name,
gssapi_mech_interface m,
gss_cred_usage_t cred_usage,
OM_uint32 initiator_time_req,
OM_uint32 acceptor_time_req,
gss_const_key_value_set_t cred_store,
struct _gss_cred *mut_cred,
OM_uint32 *initiator_time_rec,
OM_uint32 *acceptor_time_rec)
{
OM_uint32 major_status;
struct _gss_mechanism_cred *mc;
struct _gss_mechanism_name *mn;
heim_assert((m->gm_flags & GM_USE_MG_CRED) == 0,
"add_mech_cred_internal must be called with concrete mechanism");
if (desired_name != GSS_C_NO_NAME) {
major_status = _gss_find_mn(minor_status,
(struct _gss_name *)desired_name,
&m->gm_mech_oid, &mn);
if (major_status != GSS_S_COMPLETE)
return major_status;
} else
mn = NULL;
/*
* If we have an existing mechanism credential for mechanism m, then
* add the desired credential to it; otherwise, create a new one and
* add it to mut_cred.
*/
HEIM_TAILQ_FOREACH(mc, &mut_cred->gc_mc, gmc_link) {
if (gss_oid_equal(&m->gm_mech_oid, mc->gmc_mech_oid))
break;
}
if (mc) {
major_status = _gss_mg_add_mech_cred(minor_status, m,
mc, mn, cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, NULL,
initiator_time_rec, acceptor_time_rec);
} else {
struct _gss_mechanism_cred *new_mc = NULL;
major_status = _gss_mg_add_mech_cred(minor_status, m,
NULL, mn, cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, &new_mc,
initiator_time_rec, acceptor_time_rec);
if (major_status == GSS_S_COMPLETE)
HEIM_TAILQ_INSERT_TAIL(&mut_cred->gc_mc, new_mc, gmc_link);
}
return major_status;
}
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_add_cred_from(OM_uint32 *minor_status,
gss_cred_id_t input_cred_handle,
@@ -114,9 +175,6 @@ gss_add_cred_from(OM_uint32 *minor_status,
gssapi_mech_interface m;
gss_cred_id_t release_cred = GSS_C_NO_CREDENTIAL;
struct _gss_cred *mut_cred;
struct _gss_mechanism_cred *mc;
struct _gss_mechanism_cred *new_mc = NULL;
struct _gss_mechanism_name *mn = NULL;
OM_uint32 junk;
*minor_status = 0;
@@ -130,8 +188,7 @@ gss_add_cred_from(OM_uint32 *minor_status,
*acceptor_time_rec = 0;
if (actual_mechs)
*actual_mechs = GSS_C_NO_OID_SET;
if ((m = __gss_get_mechanism(desired_mech)) == NULL ||
(m->gm_flags & GM_USE_MG_CRED))
if ((m = __gss_get_mechanism(desired_mech)) == NULL)
return GSS_S_BAD_MECH;
if (input_cred_handle == GSS_C_NO_CREDENTIAL &&
output_cred_handle == NULL) {
@@ -162,45 +219,62 @@ gss_add_cred_from(OM_uint32 *minor_status,
release_cred = (gss_cred_id_t)mut_cred;
}
/* Find an MN, if any */
if (desired_name) {
major_status = _gss_find_mn(minor_status,
(struct _gss_name *)desired_name,
desired_mech, &mn);
if (major_status != GSS_S_COMPLETE)
goto done;
if (m->gm_flags & GM_USE_MG_CRED) {
struct _gss_mech_switch *ms;
OM_uint32 initiator_time_min = GSS_C_INDEFINITE;
OM_uint32 acceptor_time_min = GSS_C_INDEFINITE;
major_status = GSS_S_UNAVAILABLE; /* in case of no mechs */
if (input_cred_handle == GSS_C_NO_CREDENTIAL) {
HEIM_TAILQ_FOREACH(ms, &_gss_mechs, gm_link) {
m = &ms->gm_mech; /* for _gss_mg_error() */
if (m->gm_flags & GM_USE_MG_CRED)
continue;
major_status = add_mech_cred_internal(minor_status, desired_name, m,
cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, mut_cred,
initiator_time_rec, acceptor_time_rec);
if (major_status != GSS_S_COMPLETE)
continue;
if (initiator_time_rec && *initiator_time_rec < initiator_time_min)
initiator_time_min = *initiator_time_rec;
if (acceptor_time_rec && *acceptor_time_rec < acceptor_time_min)
acceptor_time_min = *acceptor_time_rec;
}
} else {
OM_uint32 lifetime;
gss_cred_usage_t usage = GSS_C_BOTH;
major_status = gss_inquire_cred(minor_status, input_cred_handle,
NULL, &lifetime, &usage, NULL);
if (major_status == GSS_S_COMPLETE) {
if (usage == GSS_C_BOTH || usage == GSS_C_INITIATE)
initiator_time_min = lifetime;
if (usage == GSS_C_BOTH || usage == GSS_C_ACCEPT)
acceptor_time_min = lifetime;
}
}
if (initiator_time_rec)
*initiator_time_rec = initiator_time_min;
if (acceptor_time_rec)
*acceptor_time_rec = acceptor_time_min;
} else {
major_status = add_mech_cred_internal(minor_status, desired_name, m,
cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, mut_cred,
initiator_time_rec, acceptor_time_rec);
}
/*
* We go through all the mc attached to the input_cred_handle and check the
* mechanism. If it matches, we call gss_add_cred for that mechanism,
* otherwise we just add a new mc.
*/
HEIM_TAILQ_FOREACH(mc, &mut_cred->gc_mc, gmc_link) {
if (!gss_oid_equal(mc->gmc_mech_oid, desired_mech))
continue;
major_status = _gss_mg_add_mech_cred(minor_status, m,
mc, mn, cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, NULL,
initiator_time_rec, acceptor_time_rec);
if (major_status != GSS_S_COMPLETE)
_gss_mg_error(m, *minor_status);
goto done;
}
if (major_status != GSS_S_COMPLETE)
_gss_mg_error(m, *minor_status);
major_status = _gss_mg_add_mech_cred(minor_status, m, NULL, mn, cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, &new_mc,
initiator_time_rec, acceptor_time_rec);
if (major_status != GSS_S_COMPLETE) {
_gss_mg_error(m, *minor_status);
goto done;
}
HEIM_TAILQ_INSERT_TAIL(&mut_cred->gc_mc, new_mc, gmc_link);
new_mc = NULL;
done:
/* Lastly, we have to inquire the cred to get the actual_mechs */
if (major_status == GSS_S_COMPLETE && actual_mechs != NULL) {
major_status = gss_inquire_cred(minor_status,
@@ -213,7 +287,6 @@ done:
} else {
gss_release_cred(&junk, &release_cred);
}
free(new_mc);
return major_status;
}