oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

gssapi: credential store extensions (#451)

Browse Source 
Implement the GSS-API credential store API extensions defined by MIT here:

https://k5wiki.kerberos.org/wiki/Projects/Credential_Store_extensions

Note: we kill off gss_acquire_cred_ext() here. This was never a public API,
although mechanisms could have implemented it and I briefly used it in my
BrowserID prototype mechanism. gss_acquire_cred_ext_from() occupies the place
in the dispatch table where gss_acquire_cred_ext() used to, but this structure
was never visible outside Heimdal (i.e. it is only used by internal
mechanisms);

(Mechanisms that need to accept arbitrary key/value dictionaries from
applications should now implement gss_acquire_cred_from().)
This commit is contained in:
Luke Howard
2019-01-03 09:26:41 +11:00
committed by Nico Williams
parent a7d42cdf6b
commit e0bb9c10ca
39 changed files with 1289 additions and 1054 deletions
Download Patch File Download Diff File Expand all files Collapse all files

94
lib/gssapi/mech/gss_duplicate_cred.c
View File

@@ -31,24 +31,58 @@
#include "mech_locl.h"
static OM_uint32
_gss_copy_cred_element(OM_uint32 *minor_status,
struct _gss_mechanism_cred *mc,
struct _gss_mechanism_cred **out)
copy_cred_element(OM_uint32 *minor_status,
struct _gss_mechanism_cred *mc,
struct _gss_mechanism_cred **out)
{
gssapi_mech_interface m = mc->gmc_mech;
OM_uint32 major_status;
gss_name_t name;
gss_cred_id_t cred;
OM_uint32 major_status, tmp;
struct _gss_mechanism_name mn;
struct _gss_mechanism_cred *new_mc;
OM_uint32 initiator_lifetime, acceptor_lifetime;
gss_cred_usage_t cred_usage;
gss_cred_id_t dup_cred = GSS_C_NO_CREDENTIAL;
if (m->gm_duplicate_cred)
return m->gm_duplicate_cred(minor_status, (gss_const_cred_id_t)mc,
(gss_cred_id_t *)out);
if (m->gm_duplicate_cred) {
major_status = m->gm_duplicate_cred(minor_status,
mc->gmc_cred, &dup_cred);
} else if (m->gm_import_cred && m->gm_export_cred) {
gss_buffer_desc export;
/* This path won't work for ephemeral creds */
major_status = m->gm_export_cred(minor_status, mc->gmc_cred, &export);
if (major_status == GSS_S_COMPLETE) {
major_status = m->gm_import_cred(minor_status, &export, &dup_cred);
gss_release_buffer(&tmp, &export);
}
} else
major_status = GSS_S_UNAVAILABLE;
if (major_status != GSS_S_UNAVAILABLE) {
if (dup_cred != GSS_C_NO_CREDENTIAL) {
new_mc = calloc(1, sizeof(*new_mc));
if (new_mc == NULL) {
*minor_status = ENOMEM;
m->gm_release_cred(&tmp, &dup_cred);
return GSS_S_FAILURE;
}
new_mc->gmc_mech = m;
new_mc->gmc_mech_oid = mc->gmc_mech_oid;
new_mc->gmc_cred = dup_cred;
*out = new_mc;
}
return major_status;
}
mn.gmn_mech = m;
mn.gmn_mech_oid = mc->gmc_mech_oid;
mn.gmn_name = GSS_C_NO_NAME;
/* This path won't work for ephemeral creds or cred stores */
major_status = m->gm_inquire_cred_by_mech(minor_status, mc->gmc_cred,
mc->gmc_mech_oid, &name,
mc->gmc_mech_oid, &mn.gmn_name,
&initiator_lifetime,
&acceptor_lifetime, &cred_usage);
if (major_status) {
@@ -56,27 +90,25 @@ _gss_copy_cred_element(OM_uint32 *minor_status,
return major_status;
}
major_status = m->gm_add_cred(minor_status,
GSS_C_NO_CREDENTIAL, name, mc->gmc_mech_oid,
cred_usage, initiator_lifetime, acceptor_lifetime,
&cred, 0, 0, 0);
m->gm_release_name(minor_status, &name);
if (major_status) {
major_status = _gss_mg_add_mech_cred(minor_status,
m,
NULL, /* mc */
&mn,
cred_usage,
initiator_lifetime,
acceptor_lifetime,
GSS_C_NO_CRED_STORE,
&new_mc,
NULL,
NULL);
if (major_status)
_gss_mg_error(m, major_status, *minor_status);
return major_status;
}
*out = malloc(sizeof(struct _gss_mechanism_cred));
if (!*out) {
*minor_status = ENOMEM;
m->gm_release_cred(minor_status, &cred);
return GSS_S_FAILURE;
}
(*out)->gmc_mech = m;
(*out)->gmc_mech_oid = &m->gm_mech_oid;
(*out)->gmc_cred = cred;
return GSS_S_COMPLETE;
m->gm_release_name(&tmp, &mn.gmn_name);
*out = new_mc;
return major_status;
}
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
@@ -111,7 +143,7 @@ gss_duplicate_cred(OM_uint32 *minor_status,
major_status = GSS_S_NO_CRED;
HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
major_status = _gss_copy_cred_element(minor_status, mc, &copy_mc);
major_status = copy_cred_element(minor_status, mc, &copy_mc);
if (major_status != GSS_S_COMPLETE) {
_gss_mg_error(mc->gmc_mech, major_status, *minor_status);
break;