diff options
Diffstat (limited to 'crypto/heimdal/lib/gssapi')
| -rw-r--r-- | crypto/heimdal/lib/gssapi/ChangeLog | 24 | ||||
| -rw-r--r-- | crypto/heimdal/lib/gssapi/Makefile.am | 6 | ||||
| -rw-r--r-- | crypto/heimdal/lib/gssapi/Makefile.in | 17 | ||||
| -rw-r--r-- | crypto/heimdal/lib/gssapi/accept_sec_context.c | 17 | ||||
| -rw-r--r-- | crypto/heimdal/lib/gssapi/delete_sec_context.c | 3 | ||||
| -rw-r--r-- | crypto/heimdal/lib/gssapi/export_sec_context.c | 142 | ||||
| -rw-r--r-- | crypto/heimdal/lib/gssapi/gssapi_locl.h | 12 | ||||
| -rw-r--r-- | crypto/heimdal/lib/gssapi/import_sec_context.c | 180 |
8 files changed, 385 insertions, 16 deletions
diff --git a/crypto/heimdal/lib/gssapi/ChangeLog b/crypto/heimdal/lib/gssapi/ChangeLog index d8f80f454e8ff..ba765baf01673 100644 --- a/crypto/heimdal/lib/gssapi/ChangeLog +++ b/crypto/heimdal/lib/gssapi/ChangeLog @@ -1,3 +1,27 @@ +2000-02-13 Assar Westerlund <assar@sics.se> + + * Makefile.am: set version to 1:0:1 + +2000-02-12 Assar Westerlund <assar@sics.se> + + * gssapi_locl.h: add flags for import/export + * import_sec_context.c (import_sec_context: add flags for what + fields are included. do not include the authenticator for now. + * export_sec_context.c (export_sec_context: add flags for what + fields are included. do not include the authenticator for now. + * accept_sec_context.c (gss_accept_sec_context): set target in + context_handle + +2000-02-11 Assar Westerlund <assar@sics.se> + + * delete_sec_context.c (gss_delete_sec_context): set context to + GSS_C_NO_CONTEXT + + * Makefile.am: add {export,import}_sec_context.c + * export_sec_context.c: new file + * import_sec_context.c: new file + * accept_sec_context.c (gss_accept_sec_context): set trans flag + 2000-02-07 Assar Westerlund <assar@sics.se> * Makefile.am: set version to 0:5:0 diff --git a/crypto/heimdal/lib/gssapi/Makefile.am b/crypto/heimdal/lib/gssapi/Makefile.am index 72bdf4511a8b6..07d4e6517ee1f 100644 --- a/crypto/heimdal/lib/gssapi/Makefile.am +++ b/crypto/heimdal/lib/gssapi/Makefile.am @@ -1,11 +1,11 @@ -# $Id: Makefile.am,v 1.19 2000/02/07 04:00:51 assar Exp $ +# $Id: Makefile.am,v 1.21 2000/02/13 20:34:49 assar Exp $ include $(top_srcdir)/Makefile.am.common INCLUDES += -I$(srcdir)/../krb5 lib_LTLIBRARIES = libgssapi.la -libgssapi_la_LDFLAGS = -version-info 0:5:0 +libgssapi_la_LDFLAGS = -version-info 1:0:1 include_HEADERS = gssapi.h @@ -24,12 +24,14 @@ libgssapi_la_SOURCES = \ display_status.c \ duplicate_name.c \ encapsulate.c \ + export_sec_context.c \ export_name.c \ external.c \ get_mic.c \ gssapi.h \ gssapi_locl.h \ import_name.c \ + import_sec_context.c \ indicate_mechs.c \ init.c \ init_sec_context.c \ diff --git a/crypto/heimdal/lib/gssapi/Makefile.in b/crypto/heimdal/lib/gssapi/Makefile.in index 2ecd970325cb8..31ea813045886 100644 --- a/crypto/heimdal/lib/gssapi/Makefile.in +++ b/crypto/heimdal/lib/gssapi/Makefile.in @@ -10,7 +10,7 @@ # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. -# $Id: Makefile.am,v 1.19 2000/02/07 04:00:51 assar Exp $ +# $Id: Makefile.am,v 1.21 2000/02/13 20:34:49 assar Exp $ # $Id: Makefile.am.common,v 1.3 1999/04/01 14:58:43 joda Exp $ @@ -174,11 +174,11 @@ NROFF_MAN = groff -mandoc -Tascii CHECK_LOCAL = $(PROGRAMS) lib_LTLIBRARIES = libgssapi.la -libgssapi_la_LDFLAGS = -version-info 0:5:0 +libgssapi_la_LDFLAGS = -version-info 1:0:1 include_HEADERS = gssapi.h -libgssapi_la_SOURCES = 8003.c accept_sec_context.c acquire_cred.c add_oid_set_member.c canonicalize_name.c compare_name.c context_time.c create_emtpy_oid_set.c decapsulate.c delete_sec_context.c display_name.c display_status.c duplicate_name.c encapsulate.c export_name.c external.c get_mic.c gssapi.h gssapi_locl.h import_name.c indicate_mechs.c init.c init_sec_context.c inquire_context.c inquire_cred.c release_buffer.c release_cred.c release_name.c release_oid_set.c test_oid_set_member.c unwrap.c v1.c verify_mic.c wrap.c +libgssapi_la_SOURCES = 8003.c accept_sec_context.c acquire_cred.c add_oid_set_member.c canonicalize_name.c compare_name.c context_time.c create_emtpy_oid_set.c decapsulate.c delete_sec_context.c display_name.c display_status.c duplicate_name.c encapsulate.c export_sec_context.c export_name.c external.c get_mic.c gssapi.h gssapi_locl.h import_name.c import_sec_context.c indicate_mechs.c init.c init_sec_context.c inquire_context.c inquire_cred.c release_buffer.c release_cred.c release_name.c release_oid_set.c test_oid_set_member.c unwrap.c v1.c verify_mic.c wrap.c mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs CONFIG_HEADER = ../../include/config.h @@ -199,11 +199,12 @@ libgssapi_la_OBJECTS = 8003.lo accept_sec_context.lo acquire_cred.lo \ add_oid_set_member.lo canonicalize_name.lo compare_name.lo \ context_time.lo create_emtpy_oid_set.lo decapsulate.lo \ delete_sec_context.lo display_name.lo display_status.lo \ -duplicate_name.lo encapsulate.lo export_name.lo external.lo get_mic.lo \ -import_name.lo indicate_mechs.lo init.lo init_sec_context.lo \ -inquire_context.lo inquire_cred.lo release_buffer.lo release_cred.lo \ -release_name.lo release_oid_set.lo test_oid_set_member.lo unwrap.lo \ -v1.lo verify_mic.lo wrap.lo +duplicate_name.lo encapsulate.lo export_sec_context.lo export_name.lo \ +external.lo get_mic.lo import_name.lo import_sec_context.lo \ +indicate_mechs.lo init.lo init_sec_context.lo inquire_context.lo \ +inquire_cred.lo release_buffer.lo release_cred.lo release_name.lo \ +release_oid_set.lo test_oid_set_member.lo unwrap.lo v1.lo verify_mic.lo \ +wrap.lo CFLAGS = @CFLAGS@ COMPILE = $(CC) $(DEFS) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) LTCOMPILE = $(LIBTOOL) --mode=compile $(CC) $(DEFS) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) diff --git a/crypto/heimdal/lib/gssapi/accept_sec_context.c b/crypto/heimdal/lib/gssapi/accept_sec_context.c index 4d9a2b07aa254..3f61ae11a9c19 100644 --- a/crypto/heimdal/lib/gssapi/accept_sec_context.c +++ b/crypto/heimdal/lib/gssapi/accept_sec_context.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$Id: accept_sec_context.c,v 1.15 1999/12/26 18:32:08 assar Exp $"); +RCSID("$Id: accept_sec_context.c,v 1.17 2000/02/12 21:24:08 assar Exp $"); static krb5_keytab gss_keytab; @@ -53,7 +53,8 @@ gsskrb5_register_acceptor_identity (char *identity) return GSS_S_COMPLETE; } -OM_uint32 gss_accept_sec_context +OM_uint32 +gss_accept_sec_context (OM_uint32 * minor_status, gss_ctx_id_t * context_handle, const gss_cred_id_t acceptor_cred_handle, @@ -151,6 +152,14 @@ OM_uint32 gss_accept_sec_context goto failure; } + kret = krb5_copy_principal (gssapi_krb5_context, + ticket->server, + &(*context_handle)->target); + if (kret) { + ret = GSS_S_FAILURE; + goto failure; + } + if (src_name) { kret = krb5_copy_principal (gssapi_krb5_context, ticket->client, @@ -182,6 +191,8 @@ OM_uint32 gss_accept_sec_context } } + flags |= GSS_C_TRANS_FLAG; + if (ret_flags) *ret_flags = flags; (*context_handle)->flags = flags; diff --git a/crypto/heimdal/lib/gssapi/delete_sec_context.c b/crypto/heimdal/lib/gssapi/delete_sec_context.c index faa77e4b1209a..15e3cfa13ee35 100644 --- a/crypto/heimdal/lib/gssapi/delete_sec_context.c +++ b/crypto/heimdal/lib/gssapi/delete_sec_context.c @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$Id: delete_sec_context.c,v 1.6 2000/01/26 00:45:46 assar Exp $"); +RCSID("$Id: delete_sec_context.c,v 1.7 2000/02/11 23:00:48 assar Exp $"); OM_uint32 gss_delete_sec_context (OM_uint32 * minor_status, @@ -60,5 +60,6 @@ OM_uint32 gss_delete_sec_context krb5_free_ticket (gssapi_krb5_context, (*context_handle)->ticket); free (*context_handle); + *context_handle = GSS_C_NO_CONTEXT; return GSS_S_COMPLETE; } diff --git a/crypto/heimdal/lib/gssapi/export_sec_context.c b/crypto/heimdal/lib/gssapi/export_sec_context.c new file mode 100644 index 0000000000000..d982be7af8ccf --- /dev/null +++ b/crypto/heimdal/lib/gssapi/export_sec_context.c @@ -0,0 +1,142 @@ +/* + * Copyright (c) 1999 - 2000 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "gssapi_locl.h" + +RCSID("$Id: export_sec_context.c,v 1.2 2000/02/12 21:25:24 assar Exp $"); + +OM_uint32 +gss_export_sec_context ( + OM_uint32 * minor_status, + gss_ctx_id_t * context_handle, + gss_buffer_t interprocess_token + ) +{ + krb5_storage *sp; + krb5_auth_context ac; + unsigned char auth_buf[1024]; + size_t sz; + int ret; + krb5_data data; + gss_buffer_desc buffer; + int flags; + + gssapi_krb5_init (); + if (!((*context_handle)->flags & GSS_C_TRANS_FLAG)) + return GSS_S_UNAVAILABLE; + + sp = krb5_storage_emem (); + if (sp == NULL) { + *minor_status = ENOMEM; + return GSS_S_FAILURE; + } + ac = (*context_handle)->auth_context; + + /* flagging included fields */ + + flags = 0; + if (ac->local_address) + flags |= SC_LOCAL_ADDRESS; + if (ac->remote_address) + flags |= SC_REMOTE_ADDRESS; + if (ac->keyblock) + flags |= SC_KEYBLOCK; + if (ac->local_subkey) + flags |= SC_LOCAL_SUBKEY; + if (ac->remote_subkey) + flags |= SC_REMOTE_SUBKEY; + + krb5_store_int32 (sp, flags); + + /* marshall auth context */ + + krb5_store_int32 (sp, ac->flags); + if (ac->local_address) + krb5_store_address (sp, *ac->local_address); + if (ac->remote_address) + krb5_store_address (sp, *ac->remote_address); + krb5_store_int16 (sp, ac->local_port); + krb5_store_int16 (sp, ac->remote_port); + if (ac->keyblock) + krb5_store_keyblock (sp, *ac->keyblock); + if (ac->local_subkey) + krb5_store_keyblock (sp, *ac->local_subkey); + if (ac->remote_subkey) + krb5_store_keyblock (sp, *ac->remote_subkey); + krb5_store_int32 (sp, ac->local_seqnumber); + krb5_store_int32 (sp, ac->remote_seqnumber); + +#if 0 + ret = encode_Authenticator (auth_buf, sizeof(auth_buf), + ac->authenticator, &sz); + if (ret) { + krb5_storage_free (sp); + *minor_status = ret; + return GSS_S_FAILURE; + } + data.data = auth_buf; + data.length = sz; + krb5_store_data (sp, data); +#endif + krb5_store_int32 (sp, ac->keytype); + krb5_store_int32 (sp, ac->cksumtype); + + /* names */ + + gss_export_name (minor_status, (*context_handle)->source, &buffer); + data.data = buffer.value; + data.length = buffer.length; + krb5_store_data (sp, data); + + gss_export_name (minor_status, (*context_handle)->target, &buffer); + data.data = buffer.value; + data.length = buffer.length; + krb5_store_data (sp, data); + + krb5_store_int32 (sp, (*context_handle)->flags); + krb5_store_int32 (sp, (*context_handle)->more_flags); + + ret = krb5_storage_to_data (sp, &data); + krb5_storage_free (sp); + if (ret) { + *minor_status = ret; + return GSS_S_FAILURE; + } + interprocess_token->length = data.length; + interprocess_token->value = data.data; + ret = gss_delete_sec_context (minor_status, context_handle, + GSS_C_NO_BUFFER); + if (ret != GSS_S_COMPLETE) + gss_release_buffer (NULL, interprocess_token); + return ret; +} diff --git a/crypto/heimdal/lib/gssapi/gssapi_locl.h b/crypto/heimdal/lib/gssapi/gssapi_locl.h index f488a2004046f..53f9cdc8b2502 100644 --- a/crypto/heimdal/lib/gssapi/gssapi_locl.h +++ b/crypto/heimdal/lib/gssapi/gssapi_locl.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $Id: gssapi_locl.h,v 1.11 1999/12/02 17:05:03 joda Exp $ */ +/* $Id: gssapi_locl.h,v 1.12 2000/02/12 21:26:26 assar Exp $ */ #ifndef GSSAPI_LOCL_H #define GSSAPI_LOCL_H @@ -86,4 +86,12 @@ OM_uint32 gss_krb5_getsomekey(const gss_ctx_id_t context_handle, des_cblock *key); +/* sec_context flags */ + +#define SC_LOCAL_ADDRESS 0x01 +#define SC_REMOTE_ADDRESS 0x02 +#define SC_KEYBLOCK 0x04 +#define SC_LOCAL_SUBKEY 0x08 +#define SC_REMOTE_SUBKEY 0x10 + #endif diff --git a/crypto/heimdal/lib/gssapi/import_sec_context.c b/crypto/heimdal/lib/gssapi/import_sec_context.c new file mode 100644 index 0000000000000..2667637fbba44 --- /dev/null +++ b/crypto/heimdal/lib/gssapi/import_sec_context.c @@ -0,0 +1,180 @@ +/* + * Copyright (c) 1999 - 2000 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "gssapi_locl.h" + +RCSID("$Id: import_sec_context.c,v 1.2 2000/02/12 21:26:00 assar Exp $"); + +OM_uint32 +gss_import_sec_context ( + OM_uint32 * minor_status, + const gss_buffer_t interprocess_token, + gss_ctx_id_t * context_handle + ) +{ + OM_uint32 ret = GSS_S_FAILURE; + krb5_error_code kret; + krb5_storage *sp; + krb5_auth_context ac; + krb5_address local, remote; + krb5_address *localp, *remotep; + krb5_data data; + gss_buffer_desc buffer; + krb5_keyblock keyblock; + size_t sz; + int32_t tmp; + int32_t flags; + + gssapi_krb5_init (); + + sp = krb5_storage_from_mem (interprocess_token->value, + interprocess_token->length); + if (sp == NULL) { + *minor_status = ENOMEM; + return GSS_S_FAILURE; + } + + *context_handle = malloc(sizeof(**context_handle)); + if (*context_handle == NULL) { + *minor_status = ENOMEM; + krb5_storage_free (sp); + return GSS_S_FAILURE; + } + + kret = krb5_auth_con_init (gssapi_krb5_context, + &(*context_handle)->auth_context); + if (kret) { + *minor_status = kret; + ret = GSS_S_FAILURE; + goto failure; + } + + /* flags */ + + krb5_ret_int32 (sp, &flags); + + /* retrieve the auth context */ + + ac = (*context_handle)->auth_context; + krb5_ret_int32 (sp, &ac->flags); + if (flags & SC_LOCAL_ADDRESS) + krb5_ret_address (sp, localp = &local); + else + localp = NULL; + if (flags & SC_REMOTE_ADDRESS) + krb5_ret_address (sp, remotep = &remote); + else + remotep = NULL; + krb5_auth_con_setaddrs (gssapi_krb5_context, ac, localp, remotep); + if (localp) + krb5_free_address (gssapi_krb5_context, localp); + if (remotep) + krb5_free_address (gssapi_krb5_context, remotep); + krb5_ret_int16 (sp, &ac->local_port); + krb5_ret_int16 (sp, &ac->remote_port); + if (flags & SC_KEYBLOCK) { + krb5_ret_keyblock (sp, &keyblock); + krb5_auth_con_setkey (gssapi_krb5_context, ac, &keyblock); + krb5_free_keyblock_contents (gssapi_krb5_context, &keyblock); + } + if (flags & SC_LOCAL_SUBKEY) { + krb5_ret_keyblock (sp, &keyblock); + krb5_auth_con_setlocalsubkey (gssapi_krb5_context, ac, &keyblock); + krb5_free_keyblock_contents (gssapi_krb5_context, &keyblock); + } + if (flags & SC_REMOTE_SUBKEY) { + krb5_ret_keyblock (sp, &keyblock); + krb5_auth_con_setremotesubkey (gssapi_krb5_context, ac, &keyblock); + krb5_free_keyblock_contents (gssapi_krb5_context, &keyblock); + } + krb5_ret_int32 (sp, &ac->local_seqnumber); + krb5_ret_int32 (sp, &ac->remote_seqnumber); + +#if 0 + krb5_ret_data (sp, &data); + ac->authenticator = malloc (sizeof (*ac->authenticator)); + if (ac->authenticator == NULL) { + *minor_status = ENOMEM; + ret = GSS_S_FAILURE; + goto failure; + } + + kret = decode_Authenticator (data.data, data.length, + ac->authenticator, &sz); + krb5_data_free (&data); + if (kret) { + *minor_status = kret; + ret = GSS_S_FAILURE; + goto failure; + } +#endif + + krb5_ret_int32 (sp, &tmp); + ac->keytype = tmp; + krb5_ret_int32 (sp, &tmp); + ac->cksumtype = tmp; + + /* names */ + + krb5_ret_data (sp, &data); + buffer.value = data.data; + buffer.length = data.length; + + gss_import_name (minor_status, &buffer, GSS_C_NO_OID, + &(*context_handle)->source); + krb5_data_free (&data); + + krb5_ret_data (sp, &data); + buffer.value = data.data; + buffer.length = data.length; + + gss_import_name (minor_status, &buffer, GSS_C_NO_OID, + &(*context_handle)->target); + krb5_data_free (&data); + + krb5_ret_int32 (sp, &tmp); + (*context_handle)->flags = tmp; + krb5_ret_int32 (sp, &tmp); + (*context_handle)->more_flags = tmp; + + (*context_handle)->ticket = NULL; + + return GSS_S_COMPLETE; + +failure: + krb5_auth_con_free (gssapi_krb5_context, + (*context_handle)->auth_context); + free (*context_handle); + *context_handle = GSS_C_NO_CONTEXT; + return ret; +} |