oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Use asn1 decoder now that it can handle CHOICE

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@24187 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2008-12-15 04:30:02 +00:00
parent be0a52e885
commit e9d32a0ac5
1 changed files with 33 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
lib/gssapi/spnego/init_sec_context.c
View File

@@ -392,8 +392,7 @@ spnego_reply
) )
{ {
OM_uint32 ret, minor; OM_uint32 ret, minor;
NegTokenResp resp; NegotiationToken resp;
size_t len, taglen;
gss_OID_desc mech; gss_OID_desc mech;
int require_mic; int require_mic;
size_t buf_len; size_t buf_len;
@@ -414,27 +413,23 @@ spnego_reply
mech_buf.value = NULL; mech_buf.value = NULL;
mech_buf.length = 0; mech_buf.length = 0;
ret = der_match_tag_and_length(input_token->value, input_token->length, ret = decode_NegotiationToken(input_token->value, input_token->length,
ASN1_C_CONTEXT, CONS, 1, &len, &taglen); &resp, NULL);
if (ret) if (ret)
return ret; return ret;
if (len > input_token->length - taglen) if (resp.element != choice_NegotiationToken_negTokenResp) {
return ASN1_OVERRUN; free_NegotiationToken(&resp);
*minor_status = 0;
ret = decode_NegTokenResp((const unsigned char *)input_token->value+taglen, return GSS_S_BAD_MECH;
len, &resp, NULL);
if (ret) {
*minor_status = ENOMEM;
return GSS_S_FAILURE;
} }
if (resp.negResult == NULL if (resp.u.negTokenResp.negResult == NULL
|| *(resp.negResult) == reject || *(resp.u.negTokenResp.negResult) == reject
/* || resp.supportedMech == NULL */ /* || resp.u.negTokenResp.supportedMech == NULL */
) )
{ {
free_NegTokenResp(&resp); free_NegotiationToken(&resp);
return GSS_S_BAD_MECH; return GSS_S_BAD_MECH;
} }
@@ -445,16 +440,16 @@ spnego_reply
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex); HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
if (resp.supportedMech) { if (resp.u.negTokenResp.supportedMech) {
if (ctx->oidlen) { if (ctx->oidlen) {
free_NegTokenResp(&resp); free_NegotiationToken(&resp);
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex); HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
return GSS_S_BAD_MECH; return GSS_S_BAD_MECH;
} }
ret = der_put_oid(ctx->oidbuf + sizeof(ctx->oidbuf) - 1, ret = der_put_oid(ctx->oidbuf + sizeof(ctx->oidbuf) - 1,
sizeof(ctx->oidbuf), sizeof(ctx->oidbuf),
resp.supportedMech, resp.u.negTokenResp.supportedMech,
&ctx->oidlen); &ctx->oidlen);
/* Avoid recursively embedded SPNEGO */ /* Avoid recursively embedded SPNEGO */
if (ret || (ctx->oidlen == GSS_SPNEGO_MECHANISM->length && if (ret || (ctx->oidlen == GSS_SPNEGO_MECHANISM->length &&
@@ -462,7 +457,7 @@ spnego_reply
GSS_SPNEGO_MECHANISM->elements, GSS_SPNEGO_MECHANISM->elements,
ctx->oidlen) == 0)) ctx->oidlen) == 0))
{ {
free_NegTokenResp(&resp); free_NegotiationToken(&resp);
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex); HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
return GSS_S_BAD_MECH; return GSS_S_BAD_MECH;
} }
@@ -478,19 +473,19 @@ spnego_reply
ctx->negotiated_ctx_id = GSS_C_NO_CONTEXT; ctx->negotiated_ctx_id = GSS_C_NO_CONTEXT;
} }
} else if (ctx->oidlen == 0) { } else if (ctx->oidlen == 0) {
free_NegTokenResp(&resp); free_NegotiationToken(&resp);
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex); HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
return GSS_S_BAD_MECH; return GSS_S_BAD_MECH;
} }
/* if a token (of non zero length), or no context, pass to underlaying mech */ /* if a token (of non zero length), or no context, pass to underlaying mech */
if ((resp.responseToken != NULL && resp.responseToken->length) || if ((resp.u.negTokenResp.responseToken != NULL && resp.u.negTokenResp.responseToken->length) ||
ctx->negotiated_ctx_id == GSS_C_NO_CONTEXT) { ctx->negotiated_ctx_id == GSS_C_NO_CONTEXT) {
gss_buffer_desc mech_input_token; gss_buffer_desc mech_input_token;
if (resp.responseToken) { if (resp.u.negTokenResp.responseToken) {
mech_input_token.length = resp.responseToken->length; mech_input_token.length = resp.u.negTokenResp.responseToken->length;
mech_input_token.value = resp.responseToken->data; mech_input_token.value = resp.u.negTokenResp.responseToken->data;
} else { } else {
mech_input_token.length = 0; mech_input_token.length = 0;
mech_input_token.value = NULL; mech_input_token.value = NULL;
@@ -518,7 +513,7 @@ spnego_reply
&ctx->mech_time_rec); &ctx->mech_time_rec);
if (GSS_ERROR(ret)) { if (GSS_ERROR(ret)) {
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex); HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
free_NegTokenResp(&resp); free_NegotiationToken(&resp);
gss_mg_collect_error(&mech, ret, minor); gss_mg_collect_error(&mech, ret, minor);
*minor_status = minor; *minor_status = minor;
return ret; return ret;
@@ -526,12 +521,12 @@ spnego_reply
if (ret == GSS_S_COMPLETE) { if (ret == GSS_S_COMPLETE) {
ctx->open = 1; ctx->open = 1;
} }
} else if (*(resp.negResult) == accept_completed) { } else if (*(resp.u.negTokenResp.negResult) == accept_completed) {
if (ctx->maybe_open) if (ctx->maybe_open)
ctx->open = 1; ctx->open = 1;
} }
if (*(resp.negResult) == request_mic) { if (*(resp.u.negTokenResp.negResult) == request_mic) {
ctx->require_mic = 1; ctx->require_mic = 1;
} }
@@ -540,14 +535,14 @@ spnego_reply
* Verify the mechListMIC if one was provided or CFX was * Verify the mechListMIC if one was provided or CFX was
* used and a non-preferred mechanism was selected * used and a non-preferred mechanism was selected
*/ */
if (resp.mechListMIC != NULL) { if (resp.u.negTokenResp.mechListMIC != NULL) {
require_mic = 1; require_mic = 1;
} else { } else {
ret = _gss_spnego_require_mechlist_mic(minor_status, ctx, ret = _gss_spnego_require_mechlist_mic(minor_status, ctx,
&require_mic); &require_mic);
if (ret) { if (ret) {
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex); HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
free_NegTokenResp(&resp); free_NegotiationToken(&resp);
gss_release_buffer(&minor, &mech_output_token); gss_release_buffer(&minor, &mech_output_token);
return ret; return ret;
} }
@@ -561,7 +556,7 @@ spnego_reply
&ctx->initiator_mech_types, &buf_len, ret); &ctx->initiator_mech_types, &buf_len, ret);
if (ret) { if (ret) {
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex); HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
free_NegTokenResp(&resp); free_NegotiationToken(&resp);
gss_release_buffer(&minor, &mech_output_token); gss_release_buffer(&minor, &mech_output_token);
*minor_status = ret; *minor_status = ret;
return GSS_S_FAILURE; return GSS_S_FAILURE;
@@ -569,15 +564,15 @@ spnego_reply
if (mech_buf.length != buf_len) if (mech_buf.length != buf_len)
abort(); abort();
if (resp.mechListMIC == NULL) { if (resp.u.negTokenResp.mechListMIC == NULL) {
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex); HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
free(mech_buf.value); free(mech_buf.value);
free_NegTokenResp(&resp); free_NegotiationToken(&resp);
*minor_status = 0; *minor_status = 0;
return GSS_S_DEFECTIVE_TOKEN; return GSS_S_DEFECTIVE_TOKEN;
} }
mic_buf.length = resp.mechListMIC->length; mic_buf.length = resp.u.negTokenResp.mechListMIC->length;
mic_buf.value = resp.mechListMIC->data; mic_buf.value = resp.u.negTokenResp.mechListMIC->data;
if (mech_output_token.length == 0) { if (mech_output_token.length == 0) {
ret = gss_verify_mic(minor_status, ret = gss_verify_mic(minor_status,
@@ -589,7 +584,7 @@ spnego_reply
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex); HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
free(mech_buf.value); free(mech_buf.value);
gss_release_buffer(&minor, &mech_output_token); gss_release_buffer(&minor, &mech_output_token);
free_NegTokenResp(&resp); free_NegotiationToken(&resp);
return GSS_S_DEFECTIVE_TOKEN; return GSS_S_DEFECTIVE_TOKEN;
} }
ctx->verified_mic = 1; ctx->verified_mic = 1;
@@ -604,7 +599,7 @@ spnego_reply
if (mech_buf.value != NULL) if (mech_buf.value != NULL)
free(mech_buf.value); free(mech_buf.value);
free_NegTokenResp(&resp); free_NegotiationToken(&resp);
gss_release_buffer(&minor, &mech_output_token); gss_release_buffer(&minor, &mech_output_token);
if (actual_mech_type) if (actual_mech_type)