lib/gssapi/krb5/accept_sec_context.c

   1 /*
   2  * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "gssapi_locl.h"
  35
  36 RCSID("$Id$");
  37
  38 static krb5_keytab gss_keytab;
  39
  40 OM_uint32
  41 gsskrb5_register_acceptor_identity (char *identity)
  42 {
  43     char *p;
  44     if(gss_keytab != NULL) {
  45         krb5_kt_close(gssapi_krb5_context, gss_keytab);
  46         gss_keytab = NULL;
  47     }
  48     asprintf(&p, "FILE:%s", identity);
  49     if(p == NULL)
  50         return GSS_S_FAILURE;
  51     krb5_kt_resolve(gssapi_krb5_context, p, &gss_keytab);
  52     free(p);
  53     return GSS_S_COMPLETE;
  54 }
  55
  56 OM_uint32 gss_accept_sec_context
  57            (OM_uint32 * minor_status,
  58             gss_ctx_id_t * context_handle,
  59             const gss_cred_id_t acceptor_cred_handle,
  60             const gss_buffer_t input_token_buffer,
  61             const gss_channel_bindings_t input_chan_bindings,
  62             gss_name_t * src_name,
  63             gss_OID * mech_type,
  64             gss_buffer_t output_token,
  65             OM_uint32 * ret_flags,
  66             OM_uint32 * time_rec,
  67             gss_cred_id_t * delegated_cred_handle
  68            )
  69 {
  70   krb5_error_code kret;
  71   OM_uint32 ret;
  72   krb5_data indata;
  73   krb5_flags ap_options;
  74   OM_uint32 flags;
  75   krb5_ticket *ticket = NULL;
  76   krb5_keytab keytab = NULL;
  77
  78   gssapi_krb5_init ();
  79
  80   if (*context_handle == GSS_C_NO_CONTEXT) {
  81       *context_handle = malloc(sizeof(**context_handle));
  82     if (*context_handle == GSS_C_NO_CONTEXT) {
  83         *minor_status = ENOMEM;
  84         return GSS_S_FAILURE;
  85     }
  86   }
  87
  88   (*context_handle)->auth_context =  NULL;
  89   (*context_handle)->source = NULL;
  90   (*context_handle)->target = NULL;
  91   (*context_handle)->flags = 0;
  92   (*context_handle)->more_flags = 0;
  93   (*context_handle)->ticket = NULL;
  94
  95   kret = krb5_auth_con_init (gssapi_krb5_context,
  96                              &(*context_handle)->auth_context);
  97   if (kret) {
  98     ret = GSS_S_FAILURE;
  99     goto failure;
 100   }
 101
 102   {
 103     int32_t tmp;
 104
 105     krb5_auth_con_getflags(gssapi_krb5_context,
 106                            (*context_handle)->auth_context,
 107                            &tmp);
 108     tmp |= KRB5_AUTH_CONTEXT_DO_SEQUENCE;
 109     krb5_auth_con_setflags(gssapi_krb5_context,
 110                            (*context_handle)->auth_context,
 111                            tmp);
 112   }
 113
 114   ret = gssapi_krb5_decapsulate (input_token_buffer,
 115                                  &indata,
 116                                  "\x01\x00");
 117   if (ret) {
 118       kret = 0;
 119       goto failure;
 120   }
 121
 122   if (acceptor_cred_handle == GSS_C_NO_CREDENTIAL) {
 123       if (gss_keytab != NULL) {
 124           keytab = gss_keytab;
 125      }
 126   } else if (acceptor_cred_handle->keytab != NULL) {
 127      keytab = acceptor_cred_handle->keytab;
 128   }
 129
 130   kret = krb5_rd_req (gssapi_krb5_context,
 131                       &(*context_handle)->auth_context,
 132                       &indata,
 133                       (acceptor_cred_handle == GSS_C_NO_CREDENTIAL) ? NULL
 134                         : acceptor_cred_handle->principal,
 135                       keytab,
 136                       &ap_options,
 137                       &ticket);
 138   if (kret) {
 139     ret = GSS_S_FAILURE;
 140     goto failure;
 141   }
 142
 143   kret = krb5_copy_principal (gssapi_krb5_context,
 144                               ticket->client,
 145                               &(*context_handle)->source);
 146   if (kret) {
 147     ret = GSS_S_FAILURE;
 148     goto failure;
 149   }
 150
 151   if (src_name) {
 152     kret = krb5_copy_principal (gssapi_krb5_context,
 153                                 ticket->client,
 154                                 src_name);
 155     if (kret) {
 156       ret = GSS_S_FAILURE;
 157       goto failure;
 158     }
 159   }
 160
 161   {
 162       krb5_authenticator authenticator;
 163
 164       kret = krb5_auth_getauthenticator(gssapi_krb5_context,
 165                                         (*context_handle)->auth_context,
 166                                         &authenticator);
 167       if(kret) {
 168           ret = GSS_S_FAILURE;
 169           goto failure;
 170       }
 171
 172       kret = gssapi_krb5_verify_8003_checksum(input_chan_bindings,
 173                                               authenticator->cksum,
 174                                               &flags);
 175       krb5_free_authenticator(gssapi_krb5_context, &authenticator);
 176       if (kret) {
 177           ret = GSS_S_FAILURE;
 178           goto failure;
 179       }
 180   }
 181
 182   if (ret_flags)
 183     *ret_flags = flags;
 184   (*context_handle)->flags = flags;
 185   (*context_handle)->more_flags |= OPEN;
 186
 187   if (mech_type)
 188     *mech_type = GSS_KRB5_MECHANISM;
 189
 190   if (time_rec)
 191     *time_rec = GSS_C_INDEFINITE;
 192
 193   if(flags & GSS_C_MUTUAL_FLAG) {
 194     krb5_data outbuf;
 195
 196     kret = krb5_mk_rep (gssapi_krb5_context,
 197                         &(*context_handle)->auth_context,
 198                         &outbuf);
 199     if (kret) {
 200       krb5_data_free (&outbuf);
 201       ret = GSS_S_FAILURE;
 202       goto failure;
 203     }
 204     ret = gssapi_krb5_encapsulate (&outbuf,
 205                                    output_token,
 206                                    "\x02\x00");
 207     if (ret) {
 208         kret = 0;
 209       goto failure;
 210     }
 211   } else {
 212     output_token->length = 0;
 213   }
 214
 215   (*context_handle)->ticket = ticket;
 216   ticket = NULL;
 217
 218 #if 0
 219   krb5_free_ticket (context, ticket);
 220 #endif
 221
 222   return GSS_S_COMPLETE;
 223
 224 failure:
 225   if (ticket != NULL)
 226     krb5_free_ticket (gssapi_krb5_context, ticket);
 227   krb5_auth_con_free (gssapi_krb5_context,
 228                       (*context_handle)->auth_context);
 229   if((*context_handle)->source)
 230     krb5_free_principal (gssapi_krb5_context,
 231                          (*context_handle)->source);
 232   if((*context_handle)->target)
 233     krb5_free_principal (gssapi_krb5_context,
 234                          (*context_handle)->target);
 235   free (*context_handle);
 236   *context_handle = GSS_C_NO_CONTEXT;
 237   *minor_status = kret;
 238   return GSS_S_FAILURE;
 239 }