lib/gssapi/krb5/accept_sec_context.c

   1 /*
   2  * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "gssapi_locl.h"
  35
  36 RCSID("$Id$");
  37
  38 static krb5_keytab gss_keytab;
  39
  40 OM_uint32
  41 gsskrb5_register_acceptor_identity (char *identity)
  42 {
  43     char *p;
  44     if(gss_keytab != NULL) {
  45         krb5_kt_close(gssapi_krb5_context, gss_keytab);
  46         gss_keytab = NULL;
  47     }
  48     asprintf(&p, "FILE:%s", identity);
  49     if(p == NULL)
  50         return GSS_S_FAILURE;
  51     krb5_kt_resolve(gssapi_krb5_context, p, &gss_keytab);
  52     free(p);
  53     return GSS_S_COMPLETE;
  54 }
  55
  56 OM_uint32 gss_accept_sec_context
  57            (OM_uint32 * minor_status,
  58             gss_ctx_id_t * context_handle,
  59             const gss_cred_id_t acceptor_cred_handle,
  60             const gss_buffer_t input_token_buffer,
  61             const gss_channel_bindings_t input_chan_bindings,
  62             gss_name_t * src_name,
  63             gss_OID * mech_type,
  64             gss_buffer_t output_token,
  65             OM_uint32 * ret_flags,
  66             OM_uint32 * time_rec,
  67             gss_cred_id_t * delegated_cred_handle
  68            )
  69 {
  70   krb5_error_code kret;
  71   OM_uint32 ret;
  72   krb5_data indata;
  73   krb5_flags ap_options;
  74   OM_uint32 flags;
  75   krb5_ticket *ticket = NULL;
  76   krb5_keytab keytab = NULL;
  77
  78   gssapi_krb5_init ();
  79
  80   output_token->length = 0;
  81   output_token->value   = NULL;
  82
  83   if (*context_handle == GSS_C_NO_CONTEXT) {
  84       *context_handle = malloc(sizeof(**context_handle));
  85     if (*context_handle == GSS_C_NO_CONTEXT) {
  86         *minor_status = ENOMEM;
  87         return GSS_S_FAILURE;
  88     }
  89   }
  90
  91   (*context_handle)->auth_context =  NULL;
  92   (*context_handle)->source = NULL;
  93   (*context_handle)->target = NULL;
  94   (*context_handle)->flags = 0;
  95   (*context_handle)->more_flags = 0;
  96   (*context_handle)->ticket = NULL;
  97
  98   kret = krb5_auth_con_init (gssapi_krb5_context,
  99                              &(*context_handle)->auth_context);
 100   if (kret) {
 101     ret = GSS_S_FAILURE;
 102     goto failure;
 103   }
 104
 105   {
 106     int32_t tmp;
 107
 108     krb5_auth_con_getflags(gssapi_krb5_context,
 109                            (*context_handle)->auth_context,
 110                            &tmp);
 111     tmp |= KRB5_AUTH_CONTEXT_DO_SEQUENCE;
 112     krb5_auth_con_setflags(gssapi_krb5_context,
 113                            (*context_handle)->auth_context,
 114                            tmp);
 115   }
 116
 117   ret = gssapi_krb5_decapsulate (input_token_buffer,
 118                                  &indata,
 119                                  "\x01\x00");
 120   if (ret) {
 121       kret = 0;
 122       goto failure;
 123   }
 124
 125   if (acceptor_cred_handle == GSS_C_NO_CREDENTIAL) {
 126       if (gss_keytab != NULL) {
 127           keytab = gss_keytab;
 128      }
 129   } else if (acceptor_cred_handle->keytab != NULL) {
 130      keytab = acceptor_cred_handle->keytab;
 131   }
 132
 133   kret = krb5_rd_req (gssapi_krb5_context,
 134                       &(*context_handle)->auth_context,
 135                       &indata,
 136                       (acceptor_cred_handle == GSS_C_NO_CREDENTIAL) ? NULL
 137                         : acceptor_cred_handle->principal,
 138                       keytab,
 139                       &ap_options,
 140                       &ticket);
 141   if (kret) {
 142     ret = GSS_S_FAILURE;
 143     goto failure;
 144   }
 145
 146   kret = krb5_copy_principal (gssapi_krb5_context,
 147                               ticket->client,
 148                               &(*context_handle)->source);
 149   if (kret) {
 150     ret = GSS_S_FAILURE;
 151     goto failure;
 152   }
 153
 154   if (src_name) {
 155     kret = krb5_copy_principal (gssapi_krb5_context,
 156                                 ticket->client,
 157                                 src_name);
 158     if (kret) {
 159       ret = GSS_S_FAILURE;
 160       goto failure;
 161     }
 162   }
 163
 164   {
 165       krb5_authenticator authenticator;
 166
 167       kret = krb5_auth_getauthenticator(gssapi_krb5_context,
 168                                         (*context_handle)->auth_context,
 169                                         &authenticator);
 170       if(kret) {
 171           ret = GSS_S_FAILURE;
 172           goto failure;
 173       }
 174
 175       kret = gssapi_krb5_verify_8003_checksum(input_chan_bindings,
 176                                               authenticator->cksum,
 177                                               &flags);
 178       krb5_free_authenticator(gssapi_krb5_context, &authenticator);
 179       if (kret) {
 180           ret = GSS_S_FAILURE;
 181           goto failure;
 182       }
 183   }
 184
 185   if (ret_flags)
 186     *ret_flags = flags;
 187   (*context_handle)->flags = flags;
 188   (*context_handle)->more_flags |= OPEN;
 189
 190   if (mech_type)
 191     *mech_type = GSS_KRB5_MECHANISM;
 192
 193   if (time_rec)
 194     *time_rec = GSS_C_INDEFINITE;
 195
 196   if(flags & GSS_C_MUTUAL_FLAG) {
 197     krb5_data outbuf;
 198
 199     kret = krb5_mk_rep (gssapi_krb5_context,
 200                         &(*context_handle)->auth_context,
 201                         &outbuf);
 202     if (kret) {
 203       krb5_data_free (&outbuf);
 204       ret = GSS_S_FAILURE;
 205       goto failure;
 206     }
 207     ret = gssapi_krb5_encapsulate (&outbuf,
 208                                    output_token,
 209                                    "\x02\x00");
 210     if (ret) {
 211         kret = 0;
 212       goto failure;
 213     }
 214   } else {
 215     output_token->length = 0;
 216   }
 217
 218   (*context_handle)->ticket = ticket;
 219   ticket = NULL;
 220
 221 #if 0
 222   krb5_free_ticket (context, ticket);
 223 #endif
 224
 225   return GSS_S_COMPLETE;
 226
 227 failure:
 228   if (ticket != NULL)
 229     krb5_free_ticket (gssapi_krb5_context, ticket);
 230   krb5_auth_con_free (gssapi_krb5_context,
 231                       (*context_handle)->auth_context);
 232   if((*context_handle)->source)
 233     krb5_free_principal (gssapi_krb5_context,
 234                          (*context_handle)->source);
 235   if((*context_handle)->target)
 236     krb5_free_principal (gssapi_krb5_context,
 237                          (*context_handle)->target);
 238   free (*context_handle);
 239   *context_handle = GSS_C_NO_CONTEXT;
 240   *minor_status = kret;
 241   return GSS_S_FAILURE;
 242 }