?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge branch 'master' into lukeh/acquire-cred-ex-moonshot-integ
[heimdal.git] / lib / gssapi / test_context.c
blob27104284aae915b7d3bcece1c4d1f96dabd7d657
1 /*
2 * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of KTH nor the names of its contributors may be
18 * used to endorse or promote products derived from this software without
19 * specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
22 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
25 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
28 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
29 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
30 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
31 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 */
33
34 #include "krb5/gsskrb5_locl.h"
35 #include <err.h>
36 #include <getarg.h>
37 #include <gssapi.h>
38 #include <gssapi_krb5.h>
39 #include <gssapi_spnego.h>
40 #include <gssapi_ntlm.h>
41 #include "test_common.h"
42
43 static char *type_string;
44 static char *mech_string;
45 static char *ret_mech_string;
46 static char *client_name;
47 static char *client_password;
48 static int dns_canon_flag = -1;
49 static int mutual_auth_flag = 0;
50 static int dce_style_flag = 0;
51 static int wrapunwrap_flag = 0;
52 static int iov_flag = 0;
53 static int getverifymic_flag = 0;
54 static int deleg_flag = 0;
55 static int policy_deleg_flag = 0;
56 static int server_no_deleg_flag = 0;
57 static int ei_flag = 0;
58 static char *gsskrb5_acceptor_identity = NULL;
59 static char *session_enctype_string = NULL;
60 static int client_time_offset = 0;
61 static int server_time_offset = 0;
62 static int max_loops = 0;
63 static char *limit_enctype_string = NULL;
64 static int version_flag = 0;
65 static int verbose_flag = 0;
66 static int help_flag = 0;
67
68 static krb5_context context;
69 static krb5_enctype limit_enctype = 0;
70
71 static struct {
72 const char *name;
73 gss_OID oid;
74 } o2n[] = {
75 { "krb5", NULL /* GSS_KRB5_MECHANISM */ },
76 { "spnego", NULL /* GSS_SPNEGO_MECHANISM */ },
77 { "ntlm", NULL /* GSS_NTLM_MECHANISM */ },
78 { "sasl-digest-md5", NULL /* GSS_SASL_DIGEST_MD5_MECHANISM */ }
79 };
80
81 static void
82 init_o2n(void)
83 {
84 o2n[0].oid = GSS_KRB5_MECHANISM;
85 o2n[1].oid = GSS_SPNEGO_MECHANISM;
86 o2n[2].oid = GSS_NTLM_MECHANISM;
87 o2n[3].oid = GSS_SASL_DIGEST_MD5_MECHANISM;
88 }
89
90 static gss_OID
91 string_to_oid(const char *name)
92 {
93 int i;
94 for (i = 0; i < sizeof(o2n)/sizeof(o2n[0]); i++)
95 if (strcasecmp(name, o2n[i].name) == 0)
96 return o2n[i].oid;
97 errx(1, "name '%s' not unknown", name);
98 }
99
100 static const char *
101 oid_to_string(const gss_OID oid)
102 {
103 int i;
104 for (i = 0; i < sizeof(o2n)/sizeof(o2n[0]); i++)
105 if (gss_oid_equal(oid, o2n[i].oid))
106 return o2n[i].name;
107 return "unknown oid";
108 }
109
110 static void
111 loop(gss_OID mechoid,
112 gss_OID nameoid, const char *target,
113 gss_cred_id_t init_cred,
114 gss_ctx_id_t *sctx, gss_ctx_id_t *cctx,
115 gss_OID *actual_mech,
116 gss_cred_id_t *deleg_cred)
117 {
118 int server_done = 0, client_done = 0;
119 int num_loops = 0;
120 OM_uint32 maj_stat, min_stat;
121 gss_name_t gss_target_name;
122 gss_buffer_desc input_token, output_token;
123 OM_uint32 flags = 0, ret_cflags, ret_sflags;
124 gss_OID actual_mech_client;
125 gss_OID actual_mech_server;
126
127 *actual_mech = GSS_C_NO_OID;
128
129 flags |= GSS_C_INTEG_FLAG;
130 flags |= GSS_C_CONF_FLAG;
131
132 if (mutual_auth_flag)
133 flags |= GSS_C_MUTUAL_FLAG;
134 if (dce_style_flag)
135 flags |= GSS_C_DCE_STYLE;
136 if (deleg_flag)
137 flags |= GSS_C_DELEG_FLAG;
138 if (policy_deleg_flag)
139 flags |= GSS_C_DELEG_POLICY_FLAG;
140
141 input_token.value = rk_UNCONST(target);
142 input_token.length = strlen(target);
143
144 maj_stat = gss_import_name(&min_stat,
145 &input_token,
146 nameoid,
147 &gss_target_name);
148 if (GSS_ERROR(maj_stat))
149 err(1, "import name creds failed with: %d", maj_stat);
150
151 input_token.length = 0;
152 input_token.value = NULL;
153
154 while (!server_done || !client_done) {
155 num_loops++;
156
157 gsskrb5_set_time_offset(client_time_offset);
158
159 maj_stat = gss_init_sec_context(&min_stat,
160 init_cred,
161 cctx,
162 gss_target_name,
163 mechoid,
164 flags,
165 0,
166 NULL,
167 &input_token,
168 &actual_mech_client,
169 &output_token,
170 &ret_cflags,
171 NULL);
172 if (GSS_ERROR(maj_stat))
173 errx(1, "init_sec_context: %s",
174 gssapi_err(maj_stat, min_stat, mechoid));
175 if (maj_stat & GSS_S_CONTINUE_NEEDED)
176 ;
177 else
178 client_done = 1;
179
180 gsskrb5_get_time_offset(&client_time_offset);
181
182 if (client_done && server_done)
183 break;
184
185 if (input_token.length != 0)
186 gss_release_buffer(&min_stat, &input_token);
187
188 gsskrb5_set_time_offset(server_time_offset);
189
190 maj_stat = gss_accept_sec_context(&min_stat,
191 sctx,
192 GSS_C_NO_CREDENTIAL,
193 &output_token,
194 GSS_C_NO_CHANNEL_BINDINGS,
195 NULL,
196 &actual_mech_server,
197 &input_token,
198 &ret_sflags,
199 NULL,
200 deleg_cred);
201 if (GSS_ERROR(maj_stat))
202 errx(1, "accept_sec_context: %s",
203 gssapi_err(maj_stat, min_stat, actual_mech_server));
204
205 gsskrb5_get_time_offset(&server_time_offset);
206
207 if (output_token.length != 0)
208 gss_release_buffer(&min_stat, &output_token);
209
210 if (maj_stat & GSS_S_CONTINUE_NEEDED)
211 ;
212 else
213 server_done = 1;
214 }
215 if (output_token.length != 0)
216 gss_release_buffer(&min_stat, &output_token);
217 if (input_token.length != 0)
218 gss_release_buffer(&min_stat, &input_token);
219 gss_release_name(&min_stat, &gss_target_name);
220
221 if (deleg_flag || policy_deleg_flag) {
222 if (server_no_deleg_flag) {
223 if (*deleg_cred != GSS_C_NO_CREDENTIAL)
224 errx(1, "got delegated cred but didn't expect one");
225 } else if (*deleg_cred == GSS_C_NO_CREDENTIAL)
226 errx(1, "asked for delegarated cred but did get one");
227 } else if (*deleg_cred != GSS_C_NO_CREDENTIAL)
228 errx(1, "got deleg_cred cred but didn't ask");
229
230 if (gss_oid_equal(actual_mech_server, actual_mech_client) == 0)
231 errx(1, "mech mismatch");
232 *actual_mech = actual_mech_server;
233
234 if (max_loops && num_loops > max_loops)
235 errx(1, "num loops %d was lager then max loops %d",
236 num_loops, max_loops);
237
238 if (verbose_flag) {
239 printf("server time offset: %d\n", server_time_offset);
240 printf("client time offset: %d\n", client_time_offset);
241 printf("num loops %d\n", num_loops);
242 }
243 }
244
245 static void
246 wrapunwrap(gss_ctx_id_t cctx, gss_ctx_id_t sctx, int flags, gss_OID mechoid)
247 {
248 gss_buffer_desc input_token, output_token, output_token2;
249 OM_uint32 min_stat, maj_stat;
250 gss_qop_t qop_state;
251 int conf_state;
252
253 input_token.value = "foo";
254 input_token.length = 3;
255
256 maj_stat = gss_wrap(&min_stat, cctx, flags, 0, &input_token,
257 &conf_state, &output_token);
258 if (maj_stat != GSS_S_COMPLETE)
259 errx(1, "gss_wrap failed: %s",
260 gssapi_err(maj_stat, min_stat, mechoid));
261
262 maj_stat = gss_unwrap(&min_stat, sctx, &output_token,
263 &output_token2, &conf_state, &qop_state);
264 if (maj_stat != GSS_S_COMPLETE)
265 errx(1, "gss_unwrap failed: %s",
266 gssapi_err(maj_stat, min_stat, mechoid));
267
268 gss_release_buffer(&min_stat, &output_token);
269 gss_release_buffer(&min_stat, &output_token2);
270
271 #if 0 /* doesn't work for NTLM yet */
272 if (!!conf_state != !!flags)
273 errx(1, "conf_state mismatch");
274 #endif
275 }
276
277 #define USE_CONF 1
278 #define USE_HEADER_ONLY 2
279 #define USE_SIGN_ONLY 4
280 #define FORCE_IOV 8
281
282 static void
283 wrapunwrap_iov(gss_ctx_id_t cctx, gss_ctx_id_t sctx, int flags, gss_OID mechoid)
284 {
285 krb5_data token, header, trailer;
286 OM_uint32 min_stat, maj_stat;
287 gss_qop_t qop_state;
288 int conf_state, conf_state2;
289 gss_iov_buffer_desc iov[6];
290 unsigned char *p;
291 int iov_len;
292 char header_data[9] = "ABCheader";
293 char trailer_data[10] = "trailerXYZ";
294
295 char token_data[16] = "0123456789abcdef";
296
297 memset(&iov, 0, sizeof(iov));
298
299 if (flags & USE_SIGN_ONLY) {
300 header.data = header_data;
301 header.length = 9;
302 trailer.data = trailer_data;
303 trailer.length = 10;
304 } else {
305 header.data = NULL;
306 header.length = 0;
307 trailer.data = NULL;
308 trailer.length = 0;
309 }
310
311 token.data = token_data;
312 token.length = 16;
313
314 iov_len = sizeof(iov)/sizeof(iov[0]);
315
316 memset(iov, 0, sizeof(iov));
317
318 iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER | GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATE;
319
320 if (header.length != 0) {
321 iov[1].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY;
322 iov[1].buffer.length = header.length;
323 iov[1].buffer.value = header.data;
324 } else {
325 iov[1].type = GSS_IOV_BUFFER_TYPE_EMPTY;
326 iov[1].buffer.length = 0;
327 iov[1].buffer.value = NULL;
328 }
329 iov[2].type = GSS_IOV_BUFFER_TYPE_DATA;
330 iov[2].buffer.length = token.length;
331 iov[2].buffer.value = token.data;
332 if (trailer.length != 0) {
333 iov[3].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY;
334 iov[3].buffer.length = trailer.length;
335 iov[3].buffer.value = trailer.data;
336 } else {
337 iov[3].type = GSS_IOV_BUFFER_TYPE_EMPTY;
338 iov[3].buffer.length = 0;
339 iov[3].buffer.value = NULL;
340 }
341 if (dce_style_flag) {
342 iov[4].type = GSS_IOV_BUFFER_TYPE_EMPTY;
343 } else {
344 iov[4].type = GSS_IOV_BUFFER_TYPE_PADDING | GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATE;
345 }
346 iov[4].buffer.length = 0;
347 iov[4].buffer.value = 0;
348 if (dce_style_flag) {
349 iov[5].type = GSS_IOV_BUFFER_TYPE_EMPTY;
350 } else if (flags & USE_HEADER_ONLY) {
351 iov[5].type = GSS_IOV_BUFFER_TYPE_EMPTY;
352 } else {
353 iov[5].type = GSS_IOV_BUFFER_TYPE_TRAILER | GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATE;
354 }
355 iov[5].buffer.length = 0;
356 iov[5].buffer.value = 0;
357
358 maj_stat = gss_wrap_iov(&min_stat, cctx, dce_style_flag || flags & USE_CONF, 0, &conf_state,
359 iov, iov_len);
360 if (maj_stat != GSS_S_COMPLETE)
361 errx(1, "gss_wrap_iov failed");
362
363 token.length =
364 iov[0].buffer.length +
365 iov[1].buffer.length +
366 iov[2].buffer.length +
367 iov[3].buffer.length +
368 iov[4].buffer.length +
369 iov[5].buffer.length;
370 token.data = emalloc(token.length);
371
372 p = token.data;
373 memcpy(p, iov[0].buffer.value, iov[0].buffer.length);
374 p += iov[0].buffer.length;
375 memcpy(p, iov[1].buffer.value, iov[1].buffer.length);
376 p += iov[1].buffer.length;
377 memcpy(p, iov[2].buffer.value, iov[2].buffer.length);
378 p += iov[2].buffer.length;
379 memcpy(p, iov[3].buffer.value, iov[3].buffer.length);
380 p += iov[3].buffer.length;
381 memcpy(p, iov[4].buffer.value, iov[4].buffer.length);
382 p += iov[4].buffer.length;
383 memcpy(p, iov[5].buffer.value, iov[5].buffer.length);
384 p += iov[5].buffer.length;
385
386 assert(p - ((unsigned char *)token.data) == token.length);
387
388 if ((flags & (USE_SIGN_ONLY|FORCE_IOV)) == 0) {
389 gss_buffer_desc input, output;
390
391 input.value = token.data;
392 input.length = token.length;
393
394 maj_stat = gss_unwrap(&min_stat, sctx, &input,
395 &output, &conf_state2, &qop_state);
396
397 if (maj_stat != GSS_S_COMPLETE)
398 errx(1, "gss_unwrap from gss_wrap_iov failed: %s",
399 gssapi_err(maj_stat, min_stat, mechoid));
400
401 gss_release_buffer(&min_stat, &output);
402 } else {
403 maj_stat = gss_unwrap_iov(&min_stat, sctx, &conf_state2, &qop_state,
404 iov, iov_len);
405
406 if (maj_stat != GSS_S_COMPLETE)
407 errx(1, "gss_unwrap_iov failed: %x %s", flags,
408 gssapi_err(maj_stat, min_stat, mechoid));
409
410 }
411 if (conf_state2 != conf_state)
412 errx(1, "conf state wrong for iov: %x", flags);
413
414
415 free(token.data);
416 }
417
418 static void
419 getverifymic(gss_ctx_id_t cctx, gss_ctx_id_t sctx, gss_OID mechoid)
420 {
421 gss_buffer_desc input_token, output_token;
422 OM_uint32 min_stat, maj_stat;
423 gss_qop_t qop_state;
424
425 input_token.value = "bar";
426 input_token.length = 3;
427
428 maj_stat = gss_get_mic(&min_stat, cctx, 0, &input_token,
429 &output_token);
430 if (maj_stat != GSS_S_COMPLETE)
431 errx(1, "gss_get_mic failed: %s",
432 gssapi_err(maj_stat, min_stat, mechoid));
433
434 maj_stat = gss_verify_mic(&min_stat, sctx, &input_token,
435 &output_token, &qop_state);
436 if (maj_stat != GSS_S_COMPLETE)
437 errx(1, "gss_verify_mic failed: %s",
438 gssapi_err(maj_stat, min_stat, mechoid));
439
440 gss_release_buffer(&min_stat, &output_token);
441 }
442
443 static void
444 empty_release(void)
445 {
446 gss_ctx_id_t ctx = GSS_C_NO_CONTEXT;
447 gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
448 gss_name_t name = GSS_C_NO_NAME;
449 gss_OID_set oidset = GSS_C_NO_OID_SET;
450 OM_uint32 junk;
451
452 gss_delete_sec_context(&junk, &ctx, NULL);
453 gss_release_cred(&junk, &cred);
454 gss_release_name(&junk, &name);
455 gss_release_oid_set(&junk, &oidset);
456 }
457
458 /*
459 *
460 */
461
462 static struct getargs args[] = {
463 {"name-type",0, arg_string, &type_string, "type of name", NULL },
464 {"mech-type",0, arg_string, &mech_string, "type of mech", NULL },
465 {"ret-mech-type",0, arg_string, &ret_mech_string,
466 "type of return mech", NULL },
467 {"dns-canonicalize",0,arg_negative_flag, &dns_canon_flag,
468 "use dns to canonicalize", NULL },
469 {"mutual-auth",0, arg_flag, &mutual_auth_flag,"mutual auth", NULL },
470 {"client-name", 0, arg_string, &client_name, "client name", NULL },
471 {"client-password", 0, arg_string, &client_password, "client password", NULL },
472 {"limit-enctype",0, arg_string, &limit_enctype_string, "enctype", NULL },
473 {"dce-style",0, arg_flag, &dce_style_flag, "dce-style", NULL },
474 {"wrapunwrap",0, arg_flag, &wrapunwrap_flag, "wrap/unwrap", NULL },
475 {"iov", 0, arg_flag, &iov_flag, "wrap/unwrap iov", NULL },
476 {"getverifymic",0, arg_flag, &getverifymic_flag,
477 "get and verify mic", NULL },
478 {"delegate",0, arg_flag, &deleg_flag, "delegate credential", NULL },
479 {"policy-delegate",0, arg_flag, &policy_deleg_flag, "policy delegate credential", NULL },
480 {"server-no-delegate",0, arg_flag, &server_no_deleg_flag,
481 "server should get a credential", NULL },
482 {"export-import-cred",0, arg_flag, &ei_flag, "test export/import cred", NULL },
483 {"gsskrb5-acceptor-identity", 0, arg_string, &gsskrb5_acceptor_identity, "keytab", NULL },
484 {"session-enctype", 0, arg_string, &session_enctype_string, "enctype", NULL },
485 {"client-time-offset", 0, arg_integer, &client_time_offset, "time", NULL },
486 {"server-time-offset", 0, arg_integer, &server_time_offset, "time", NULL },
487 {"max-loops", 0, arg_integer, &max_loops, "time", NULL },
488 {"version", 0, arg_flag, &version_flag, "print version", NULL },
489 {"verbose", 'v', arg_flag, &verbose_flag, "verbose", NULL },
490 {"help", 0, arg_flag, &help_flag, NULL, NULL }
491 };
492
493 static void
494 usage (int ret)
495 {
496 arg_printusage (args, sizeof(args)/sizeof(*args),
497 NULL, "service@host");
498 exit (ret);
499 }
500
501 int
502 main(int argc, char **argv)
503 {
504 int optind = 0;
505 OM_uint32 min_stat, maj_stat;
506 gss_ctx_id_t cctx, sctx;
507 void *ctx;
508 gss_OID nameoid, mechoid, actual_mech, actual_mech2;
509 gss_cred_id_t client_cred = GSS_C_NO_CREDENTIAL, deleg_cred = GSS_C_NO_CREDENTIAL;
510 gss_OID credential_type;
511 gss_buffer_desc credential_data;
512
513 setprogname(argv[0]);
514
515 init_o2n();
516
517 if (krb5_init_context(&context))
518 errx(1, "krb5_init_context");
519
520 cctx = sctx = GSS_C_NO_CONTEXT;
521
522 if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind))
523 usage(1);
524
525 if (help_flag)
526 usage (0);
527
528 if(version_flag){
529 print_version(NULL);
530 exit(0);
531 }
532
533 argc -= optind;
534 argv += optind;
535
536 if (argc != 1)
537 usage(1);
538
539 if (dns_canon_flag != -1)
540 gsskrb5_set_dns_canonicalize(dns_canon_flag);
541
542 if (type_string == NULL)
543 nameoid = GSS_C_NT_HOSTBASED_SERVICE;
544 else if (strcmp(type_string, "hostbased-service") == 0)
545 nameoid = GSS_C_NT_HOSTBASED_SERVICE;
546 else if (strcmp(type_string, "krb5-principal-name") == 0)
547 nameoid = GSS_KRB5_NT_PRINCIPAL_NAME;
548 else
549 errx(1, "%s not suppported", type_string);
550
551 if (mech_string == NULL)
552 mechoid = GSS_KRB5_MECHANISM;
553 else
554 mechoid = string_to_oid(mech_string);
555
556 if (gsskrb5_acceptor_identity) {
557 maj_stat = gsskrb5_register_acceptor_identity(gsskrb5_acceptor_identity);
558 if (maj_stat)
559 errx(1, "gsskrb5_acceptor_identity: %s",
560 gssapi_err(maj_stat, 0, GSS_C_NO_OID));
561 }
562
563 if (client_password) {
564 credential_type = GSS_C_CRED_PASSWORD;
565 credential_data.value = client_password;
566 credential_data.length = strlen(client_password);
567 } else
568 credential_type = GSS_C_NO_OID;
569
570 if (client_name) {
571 gss_buffer_desc cn;
572 gss_name_t cname;
573 cn.value = client_name;
574 cn.length = strlen(client_name);
575 maj_stat = gss_import_name(&min_stat, &cn, GSS_C_NT_USER_NAME, &cname);
576 if (maj_stat)
577 errx(1, "gss_import_name: %s",
578 gssapi_err(maj_stat, min_stat, GSS_C_NO_OID));
579
580 maj_stat = gss_acquire_cred_ext(&min_stat, cname,
581 credential_type, &credential_data,
582 0, GSS_C_NO_OID, GSS_C_INITIATE, &client_cred);
583 if (GSS_ERROR(maj_stat))
584 errx(1, "gss_acquire_cred_ext: %s",
585 gssapi_err(maj_stat, min_stat, GSS_C_NO_OID));
586 gss_release_name(&min_stat, &cname);
587 } else if (credential_type) {
588 maj_stat = gss_acquire_cred_ex(&min_stat, GSS_C_NO_NAME,
589 credential_type, &credential_data,
590 0, GSS_C_NO_OID, GSS_C_INITIATE, &client_cred);
591 if (GSS_ERROR(maj_stat))
592 errx(1, "gss_acquire_cred_ex: %s",
593 gssapi_err(maj_stat, min_stat, GSS_C_NO_OID));
594 }
595
596 if (limit_enctype_string) {
597 krb5_error_code ret;
598
599 ret = krb5_string_to_enctype(context,
600 limit_enctype_string,
601 &limit_enctype);
602 if (ret)
603 krb5_err(context, 1, ret, "krb5_string_to_enctype");
604 }
605
606
607 if (limit_enctype) {
608 if (client_cred == NULL)
609 errx(1, "client_cred missing");
610
611 maj_stat = gss_krb5_set_allowable_enctypes(&min_stat, client_cred,
612 1, &limit_enctype);
613 if (maj_stat)
614 errx(1, "gss_krb5_set_allowable_enctypes: %s",
615 gssapi_err(maj_stat, min_stat, GSS_C_NO_OID));
616 }
617
618 loop(mechoid, nameoid, argv[0], client_cred,
619 &sctx, &cctx, &actual_mech, &deleg_cred);
620
621 if (verbose_flag)
622 printf("resulting mech: %s\n", oid_to_string(actual_mech));
623
624 if (ret_mech_string) {
625 gss_OID retoid;
626
627 retoid = string_to_oid(ret_mech_string);
628
629 if (gss_oid_equal(retoid, actual_mech) == 0)
630 errx(1, "actual_mech mech is not the expected type %s",
631 ret_mech_string);
632 }
633
634 /* XXX should be actual_mech */
635 if (gss_oid_equal(mechoid, GSS_KRB5_MECHANISM)) {
636 time_t time;
637 gss_buffer_desc authz_data;
638 gss_buffer_desc in, out1, out2;
639 krb5_keyblock *keyblock, *keyblock2;
640 krb5_timestamp now;
641 krb5_error_code ret;
642
643 ret = krb5_timeofday(context, &now);
644 if (ret)
645 errx(1, "krb5_timeofday failed");
646
647 /* client */
648 maj_stat = gss_krb5_export_lucid_sec_context(&min_stat,
649 &cctx,
650 1, /* version */
651 &ctx);
652 if (maj_stat != GSS_S_COMPLETE)
653 errx(1, "gss_krb5_export_lucid_sec_context failed: %s",
654 gssapi_err(maj_stat, min_stat, actual_mech));
655
656
657 maj_stat = gss_krb5_free_lucid_sec_context(&maj_stat, ctx);
658 if (maj_stat != GSS_S_COMPLETE)
659 errx(1, "gss_krb5_free_lucid_sec_context failed: %s",
660 gssapi_err(maj_stat, min_stat, actual_mech));
661
662 /* server */
663 maj_stat = gss_krb5_export_lucid_sec_context(&min_stat,
664 &sctx,
665 1, /* version */
666 &ctx);
667 if (maj_stat != GSS_S_COMPLETE)
668 errx(1, "gss_krb5_export_lucid_sec_context failed: %s",
669 gssapi_err(maj_stat, min_stat, actual_mech));
670 maj_stat = gss_krb5_free_lucid_sec_context(&min_stat, ctx);
671 if (maj_stat != GSS_S_COMPLETE)
672 errx(1, "gss_krb5_free_lucid_sec_context failed: %s",
673 gssapi_err(maj_stat, min_stat, actual_mech));
674
675 maj_stat = gsskrb5_extract_authtime_from_sec_context(&min_stat,
676 sctx,
677 &time);
678 if (maj_stat != GSS_S_COMPLETE)
679 errx(1, "gsskrb5_extract_authtime_from_sec_context failed: %s",
680 gssapi_err(maj_stat, min_stat, actual_mech));
681
682 if (time > now)
683 errx(1, "gsskrb5_extract_authtime_from_sec_context failed: "
684 "time authtime is before now: %ld %ld",
685 (long)time, (long)now);
686
687 maj_stat = gsskrb5_extract_service_keyblock(&min_stat,
688 sctx,
689 &keyblock);
690 if (maj_stat != GSS_S_COMPLETE)
691 errx(1, "gsskrb5_export_service_keyblock failed: %s",
692 gssapi_err(maj_stat, min_stat, actual_mech));
693
694 krb5_free_keyblock(context, keyblock);
695
696 maj_stat = gsskrb5_get_subkey(&min_stat,
697 sctx,
698 &keyblock);
699 if (maj_stat != GSS_S_COMPLETE
700 && (!(maj_stat == GSS_S_FAILURE && min_stat == GSS_KRB5_S_KG_NO_SUBKEY)))
701 errx(1, "gsskrb5_get_subkey server failed: %s",
702 gssapi_err(maj_stat, min_stat, actual_mech));
703
704 if (maj_stat != GSS_S_COMPLETE)
705 keyblock = NULL;
706 else if (limit_enctype && keyblock->keytype != limit_enctype)
707 errx(1, "gsskrb5_get_subkey wrong enctype");
708
709 maj_stat = gsskrb5_get_subkey(&min_stat,
710 cctx,
711 &keyblock2);
712 if (maj_stat != GSS_S_COMPLETE
713 && (!(maj_stat == GSS_S_FAILURE && min_stat == GSS_KRB5_S_KG_NO_SUBKEY)))
714 errx(1, "gsskrb5_get_subkey client failed: %s",
715 gssapi_err(maj_stat, min_stat, actual_mech));
716
717 if (maj_stat != GSS_S_COMPLETE)
718 keyblock2 = NULL;
719 else if (limit_enctype && keyblock->keytype != limit_enctype)
720 errx(1, "gsskrb5_get_subkey wrong enctype");
721
722 if (keyblock || keyblock2) {
723 if (keyblock == NULL)
724 errx(1, "server missing token keyblock");
725 if (keyblock2 == NULL)
726 errx(1, "client missing token keyblock");
727
728 if (keyblock->keytype != keyblock2->keytype)
729 errx(1, "enctype mismatch");
730 if (keyblock->keyvalue.length != keyblock2->keyvalue.length)
731 errx(1, "key length mismatch");
732 if (memcmp(keyblock->keyvalue.data, keyblock2->keyvalue.data,
733 keyblock2->keyvalue.length) != 0)
734 errx(1, "key data mismatch");
735 }
736
737 if (session_enctype_string) {
738 krb5_enctype enctype;
739
740 ret = krb5_string_to_enctype(context,
741 session_enctype_string,
742 &enctype);
743
744 if (ret)
745 krb5_err(context, 1, ret, "krb5_string_to_enctype");
746
747 if (enctype != keyblock->keytype)
748 errx(1, "keytype is not the expected %d != %d",
749 (int)enctype, (int)keyblock2->keytype);
750 }
751
752 if (keyblock)
753 krb5_free_keyblock(context, keyblock);
754 if (keyblock2)
755 krb5_free_keyblock(context, keyblock2);
756
757 maj_stat = gsskrb5_get_initiator_subkey(&min_stat,
758 sctx,
759 &keyblock);
760 if (maj_stat != GSS_S_COMPLETE
761 && (!(maj_stat == GSS_S_FAILURE && min_stat == GSS_KRB5_S_KG_NO_SUBKEY)))
762 errx(1, "gsskrb5_get_initiator_subkey failed: %s",
763 gssapi_err(maj_stat, min_stat, actual_mech));
764
765 if (maj_stat == GSS_S_COMPLETE) {
766
767 if (limit_enctype && keyblock->keytype != limit_enctype)
768 errx(1, "gsskrb5_get_initiator_subkey wrong enctype");
769 krb5_free_keyblock(context, keyblock);
770 }
771
772 maj_stat = gsskrb5_extract_authz_data_from_sec_context(&min_stat,
773 sctx,
774 128,
775 &authz_data);
776 if (maj_stat == GSS_S_COMPLETE)
777 gss_release_buffer(&min_stat, &authz_data);
778
779
780 memset(&out1, 0, sizeof(out1));
781 memset(&out2, 0, sizeof(out2));
782
783 in.value = "foo";
784 in.length = 3;
785
786 gss_pseudo_random(&min_stat, sctx, GSS_C_PRF_KEY_FULL, &in,
787 100, &out1);
788 gss_pseudo_random(&min_stat, cctx, GSS_C_PRF_KEY_FULL, &in,
789 100, &out2);
790
791 if (out1.length != out2.length)
792 errx(1, "prf len mismatch");
793 if (memcmp(out1.value, out2.value, out1.length) != 0)
794 errx(1, "prf data mismatch");
795
796 gss_release_buffer(&min_stat, &out1);
797
798 gss_pseudo_random(&min_stat, sctx, GSS_C_PRF_KEY_FULL, &in,
799 100, &out1);
800
801 if (out1.length != out2.length)
802 errx(1, "prf len mismatch");
803 if (memcmp(out1.value, out2.value, out1.length) != 0)
804 errx(1, "prf data mismatch");
805
806 gss_release_buffer(&min_stat, &out1);
807 gss_release_buffer(&min_stat, &out2);
808
809 in.value = "bar";
810 in.length = 3;
811
812 gss_pseudo_random(&min_stat, sctx, GSS_C_PRF_KEY_PARTIAL, &in,
813 100, &out1);
814 gss_pseudo_random(&min_stat, cctx, GSS_C_PRF_KEY_PARTIAL, &in,
815 100, &out2);
816
817 if (out1.length != out2.length)
818 errx(1, "prf len mismatch");
819 if (memcmp(out1.value, out2.value, out1.length) != 0)
820 errx(1, "prf data mismatch");
821
822 gss_release_buffer(&min_stat, &out1);
823 gss_release_buffer(&min_stat, &out2);
824
825 wrapunwrap_flag = 1;
826 getverifymic_flag = 1;
827 }
828
829 if (wrapunwrap_flag) {
830 wrapunwrap(cctx, sctx, 0, actual_mech);
831 wrapunwrap(cctx, sctx, 1, actual_mech);
832 wrapunwrap(sctx, cctx, 0, actual_mech);
833 wrapunwrap(sctx, cctx, 1, actual_mech);
834 }
835
836 if (iov_flag) {
837 wrapunwrap_iov(cctx, sctx, 0, actual_mech);
838 wrapunwrap_iov(cctx, sctx, USE_HEADER_ONLY|FORCE_IOV, actual_mech);
839 wrapunwrap_iov(cctx, sctx, USE_HEADER_ONLY, actual_mech);
840 wrapunwrap_iov(cctx, sctx, USE_CONF, actual_mech);
841 wrapunwrap_iov(cctx, sctx, USE_CONF|USE_HEADER_ONLY, actual_mech);
842
843 wrapunwrap_iov(cctx, sctx, FORCE_IOV, actual_mech);
844 wrapunwrap_iov(cctx, sctx, USE_CONF|FORCE_IOV, actual_mech);
845 wrapunwrap_iov(cctx, sctx, USE_HEADER_ONLY|FORCE_IOV, actual_mech);
846 wrapunwrap_iov(cctx, sctx, USE_CONF|USE_HEADER_ONLY|FORCE_IOV, actual_mech);
847
848 wrapunwrap_iov(cctx, sctx, USE_SIGN_ONLY|FORCE_IOV, actual_mech);
849 wrapunwrap_iov(cctx, sctx, USE_CONF|USE_SIGN_ONLY|FORCE_IOV, actual_mech);
850 wrapunwrap_iov(cctx, sctx, USE_CONF|USE_HEADER_ONLY|USE_SIGN_ONLY|FORCE_IOV, actual_mech);
851
852 /* works */
853 wrapunwrap_iov(cctx, sctx, 0, actual_mech);
854 wrapunwrap_iov(cctx, sctx, FORCE_IOV, actual_mech);
855
856 wrapunwrap_iov(cctx, sctx, USE_CONF, actual_mech);
857 wrapunwrap_iov(cctx, sctx, USE_CONF|FORCE_IOV, actual_mech);
858
859 wrapunwrap_iov(cctx, sctx, USE_SIGN_ONLY, actual_mech);
860 wrapunwrap_iov(cctx, sctx, USE_SIGN_ONLY|FORCE_IOV, actual_mech);
861
862 wrapunwrap_iov(cctx, sctx, USE_CONF|USE_SIGN_ONLY, actual_mech);
863 wrapunwrap_iov(cctx, sctx, USE_CONF|USE_SIGN_ONLY|FORCE_IOV, actual_mech);
864
865 wrapunwrap_iov(cctx, sctx, USE_HEADER_ONLY, actual_mech);
866 wrapunwrap_iov(cctx, sctx, USE_HEADER_ONLY|FORCE_IOV, actual_mech);
867
868 wrapunwrap_iov(cctx, sctx, USE_CONF|USE_HEADER_ONLY, actual_mech);
869 wrapunwrap_iov(cctx, sctx, USE_CONF|USE_HEADER_ONLY|FORCE_IOV, actual_mech);
870 }
871
872 if (getverifymic_flag) {
873 getverifymic(cctx, sctx, actual_mech);
874 getverifymic(cctx, sctx, actual_mech);
875 getverifymic(sctx, cctx, actual_mech);
876 getverifymic(sctx, cctx, actual_mech);
877 }
878
879
880 gss_delete_sec_context(&min_stat, &cctx, NULL);
881 gss_delete_sec_context(&min_stat, &sctx, NULL);
882
883 if (deleg_cred != GSS_C_NO_CREDENTIAL) {
884 gss_cred_id_t cred2 = GSS_C_NO_CREDENTIAL;
885 gss_buffer_desc cb;
886
887 if (verbose_flag)
888 printf("checking actual mech (%s) on delegated cred\n",
889 oid_to_string(actual_mech));
890 loop(actual_mech, nameoid, argv[0], deleg_cred, &sctx, &cctx, &actual_mech2, &cred2);
891
892 gss_delete_sec_context(&min_stat, &cctx, NULL);
893 gss_delete_sec_context(&min_stat, &sctx, NULL);
894
895 gss_release_cred(&min_stat, &cred2);
896
897 /* try again using SPNEGO */
898 if (verbose_flag)
899 printf("checking spnego on delegated cred\n");
900 loop(GSS_SPNEGO_MECHANISM, nameoid, argv[0], deleg_cred, &sctx, &cctx,
901 &actual_mech2, &cred2);
902
903 gss_delete_sec_context(&min_stat, &cctx, NULL);
904 gss_delete_sec_context(&min_stat, &sctx, NULL);
905
906 gss_release_cred(&min_stat, &cred2);
907
908 /* check export/import */
909 if (ei_flag) {
910
911 maj_stat = gss_export_cred(&min_stat, deleg_cred, &cb);
912 if (maj_stat != GSS_S_COMPLETE)
913 errx(1, "export failed: %s",
914 gssapi_err(maj_stat, min_stat, NULL));
915
916 maj_stat = gss_import_cred(&min_stat, &cb, &cred2);
917 if (maj_stat != GSS_S_COMPLETE)
918 errx(1, "import failed: %s",
919 gssapi_err(maj_stat, min_stat, NULL));
920
921 gss_release_buffer(&min_stat, &cb);
922 gss_release_cred(&min_stat, &deleg_cred);
923
924 if (verbose_flag)
925 printf("checking actual mech (%s) on export/imported cred\n",
926 oid_to_string(actual_mech));
927 loop(actual_mech, nameoid, argv[0], cred2, &sctx, &cctx,
928 &actual_mech2, &deleg_cred);
929
930 gss_release_cred(&min_stat, &deleg_cred);
931
932 gss_delete_sec_context(&min_stat, &cctx, NULL);
933 gss_delete_sec_context(&min_stat, &sctx, NULL);
934
935 /* try again using SPNEGO */
936 if (verbose_flag)
937 printf("checking SPNEGO on export/imported cred\n");
938 loop(GSS_SPNEGO_MECHANISM, nameoid, argv[0], cred2, &sctx, &cctx,
939 &actual_mech2, &deleg_cred);
940
941 gss_release_cred(&min_stat, &deleg_cred);
942
943 gss_delete_sec_context(&min_stat, &cctx, NULL);
944 gss_delete_sec_context(&min_stat, &sctx, NULL);
945
946 gss_release_cred(&min_stat, &cred2);
947
948 } else {
949 gss_release_cred(&min_stat, &deleg_cred);
950 }
951
952 }
953
954 empty_release();
955
956 krb5_free_context(context);
957
958 return 0;
959 }
Heimdal