aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--sys/kgssapi/gss_accept_sec_context.c145
-rw-r--r--sys/kgssapi/gss_impl.c8
-rw-r--r--sys/kgssapi/gss_init_sec_context.c145
-rw-r--r--sys/kgssapi/gssapi.h42
-rw-r--r--sys/kgssapi/gssapi_impl.h2
-rw-r--r--sys/kgssapi/gssd.x79
-rw-r--r--sys/kgssapi/krb5/krb5_mech.c80
-rw-r--r--sys/rpc/rpcsec_gss/rpcsec_gss.c50
-rw-r--r--sys/rpc/rpcsec_gss/rpcsec_gss_int.h6
-rw-r--r--sys/rpc/rpcsec_gss/svc_rpcsec_gss.c122
-rw-r--r--usr.sbin/Makefile2
-rw-r--r--usr.sbin/gssd/Makefile9
-rw-r--r--usr.sbin/gssd/gssd.c506
13 files changed, 86 insertions, 1110 deletions
diff --git a/sys/kgssapi/gss_accept_sec_context.c b/sys/kgssapi/gss_accept_sec_context.c
index 8a49b85be852..723ed9db9072 100644
--- a/sys/kgssapi/gss_accept_sec_context.c
+++ b/sys/kgssapi/gss_accept_sec_context.c
@@ -41,11 +41,6 @@
#include "gssd.h"
#include "kgss_if.h"
-/*
- * This function should only be called when the gssd
- * daemon running on the system is an old one that
- * does not use gss_krb5_export_lucid_sec_context().
- */
OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status,
gss_ctx_id_t *context_handle,
const gss_cred_id_t acceptor_cred_handle,
@@ -143,145 +138,7 @@ OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status,
* etc.) to the kernel implementation.
*/
if (res.major_status == GSS_S_COMPLETE)
- res.major_status = kgss_transfer_context(ctx, NULL);
-
- return (res.major_status);
-}
-
-/*
- * This function should be called when the gssd daemon is
- * one that uses gss_krb5_export_lucid_sec_context().
- * There is a lot of code common with
- * gss_accept_sec_context(). However, the structures used
- * are not the same and future changes may be needed for
- * this one. As such, I have not factored out the common
- * code.
- * gss_supports_lucid() may be used to check to see if the
- * gssd daemon uses gss_krb5_export_lucid_sec_context().
- */
-OM_uint32 gss_accept_sec_context_lucid_v1(OM_uint32 *minor_status,
- gss_ctx_id_t *context_handle,
- const gss_cred_id_t acceptor_cred_handle,
- const gss_buffer_t input_token,
- const gss_channel_bindings_t input_chan_bindings,
- gss_name_t *src_name,
- gss_OID *mech_type,
- gss_buffer_t output_token,
- OM_uint32 *ret_flags,
- OM_uint32 *time_rec,
- gss_cred_id_t *delegated_cred_handle,
- gss_buffer_t exported_name,
- uid_t *uidp,
- gid_t *gidp,
- int *numgroups,
- gid_t *groups)
-{
- struct accept_sec_context_lucid_v1_res res;
- struct accept_sec_context_lucid_v1_args args;
- enum clnt_stat stat;
- gss_ctx_id_t ctx = *context_handle;
- gss_name_t name;
- gss_cred_id_t cred;
- CLIENT *cl;
-
- cl = kgss_gssd_client();
- if (cl == NULL) {
- *minor_status = 0;
- return (GSS_S_FAILURE);
- }
-
- if (ctx)
- args.ctx = ctx->handle;
- else
- args.ctx = 0;
- if (acceptor_cred_handle)
- args.cred = acceptor_cred_handle->handle;
- else
- args.cred = 0;
- args.input_token = *input_token;
- args.input_chan_bindings = input_chan_bindings;
-
- bzero(&res, sizeof(res));
- stat = gssd_accept_sec_context_lucid_v1_1(&args, &res, cl);
- CLNT_RELEASE(cl);
- if (stat != RPC_SUCCESS) {
- *minor_status = stat;
- return (GSS_S_FAILURE);
- }
-
- if (res.major_status != GSS_S_COMPLETE
- && res.major_status != GSS_S_CONTINUE_NEEDED) {
- *minor_status = res.minor_status;
- xdr_free((xdrproc_t) xdr_accept_sec_context_res, &res);
- return (res.major_status);
- }
-
- *minor_status = res.minor_status;
-
- if (!ctx) {
- ctx = kgss_create_context(res.mech_type);
- if (!ctx) {
- xdr_free((xdrproc_t) xdr_accept_sec_context_res, &res);
- *minor_status = 0;
- return (GSS_S_BAD_MECH);
- }
- }
- *context_handle = ctx;
-
- ctx->handle = res.ctx;
- name = malloc(sizeof(struct _gss_name_t), M_GSSAPI, M_WAITOK);
- name->handle = res.src_name;
- if (src_name) {
- *src_name = name;
- } else {
- OM_uint32 junk;
- gss_release_name(&junk, &name);
- }
- if (mech_type)
- *mech_type = KGSS_MECH_TYPE(ctx);
- kgss_copy_buffer(&res.output_token, output_token);
- if (ret_flags)
- *ret_flags = res.ret_flags;
- if (time_rec)
- *time_rec = res.time_rec;
- cred = malloc(sizeof(struct _gss_cred_id_t), M_GSSAPI, M_WAITOK);
- cred->handle = res.delegated_cred_handle;
- if (delegated_cred_handle) {
- *delegated_cred_handle = cred;
- } else {
- OM_uint32 junk;
- gss_release_cred(&junk, &cred);
- }
-
- /*
- * If the context establishment is complete, export it from
- * userland and hand the result (which includes key material
- * etc.) to the kernel implementation.
- */
- if (res.major_status == GSS_S_COMPLETE) {
- int i, n;
-
- /* First, get the unix credentials. */
- *uidp = res.uid;
- *gidp = res.gid;
- n = res.gidlist.gidlist_len;
- if (n > *numgroups)
- n = *numgroups;
- for (i = 0; i < n; i++)
- groups[i] = res.gidlist.gidlist_val[i];
- *numgroups = n;
-
- /* Next, get the exported_name. */
- kgss_copy_buffer(&res.exported_name, exported_name);
-
- /* Now, handle the lucid credential setup. */
- res.major_status = kgss_transfer_context(ctx, &res.lucid);
- if (res.major_status != GSS_S_COMPLETE)
- printf("gss_accept_sec_context_lucid_v1: "
- "transfer failed\n");
- }
-
- xdr_free((xdrproc_t) xdr_accept_sec_context_res, &res);
+ res.major_status = kgss_transfer_context(ctx);
return (res.major_status);
}
diff --git a/sys/kgssapi/gss_impl.c b/sys/kgssapi/gss_impl.c
index c9cd4d880695..e2569bea61f9 100644
--- a/sys/kgssapi/gss_impl.c
+++ b/sys/kgssapi/gss_impl.c
@@ -192,19 +192,13 @@ kgss_delete_context(gss_ctx_id_t ctx, gss_buffer_t output_token)
}
OM_uint32
-kgss_transfer_context(gss_ctx_id_t ctx, void *lctx)
+kgss_transfer_context(gss_ctx_id_t ctx)
{
struct export_sec_context_res res;
struct export_sec_context_args args;
enum clnt_stat stat;
OM_uint32 maj_stat;
- if (lctx != NULL) {
- maj_stat = KGSS_IMPORT(ctx, MIT_V1, lctx);
- ctx->handle = 0;
- return (maj_stat);
- }
-
KGSS_CURVNET_SET_QUIET(KGSS_TD_TO_VNET(curthread));
if (!KGSS_VNET(kgss_gssd_handle)) {
KGSS_CURVNET_RESTORE();
diff --git a/sys/kgssapi/gss_init_sec_context.c b/sys/kgssapi/gss_init_sec_context.c
index a0f48fda8b29..fa0d3fb2ae19 100644
--- a/sys/kgssapi/gss_init_sec_context.c
+++ b/sys/kgssapi/gss_init_sec_context.c
@@ -42,11 +42,6 @@
#include "gssd.h"
#include "kgss_if.h"
-/*
- * This function should only be called when the gssd
- * daemon running on the system is an old one that
- * does not use gss_krb5_export_lucid_sec_context().
- */
OM_uint32
gss_init_sec_context(OM_uint32 * minor_status,
const gss_cred_id_t initiator_cred_handle,
@@ -138,145 +133,7 @@ gss_init_sec_context(OM_uint32 * minor_status,
* etc.) to the kernel implementation.
*/
if (res.major_status == GSS_S_COMPLETE)
- res.major_status = kgss_transfer_context(ctx, NULL);
-
- return (res.major_status);
-}
-
-OM_uint32
-gss_supports_lucid(uint32_t *minor_status, uint32_t *vers)
-{
- struct supports_lucid_res res;
- enum clnt_stat stat;
- CLIENT *cl;
-
- *minor_status = 0;
-
- cl = kgss_gssd_client();
- if (cl == NULL)
- return (GSS_S_FAILURE);
-
- bzero(&res, sizeof(res));
- stat = gssd_supports_lucid_1(NULL, &res, cl);
- CLNT_RELEASE(cl);
- if (stat != RPC_SUCCESS) {
- *minor_status = stat;
- return (GSS_S_FAILURE);
- }
-
- if (vers)
- *vers = res.vers;
-
- return (res.major_status);
-}
-
-/*
- * This function should be called when the gssd daemon is
- * one that uses gss_krb5_export_lucid_sec_context().
- * There is a lot of code common with
- * gss_init_sec_context(). However, the structures used
- * are not the same and future changes may be needed for
- * this one. As such, I have not factored out the common
- * code.
- * gss_supports_lucid() may be used to check to see if the
- * gssd daemon uses gss_krb5_export_lucid_sec_context().
- */
-OM_uint32
-gss_init_sec_context_lucid_v1(OM_uint32 * minor_status,
- const gss_cred_id_t initiator_cred_handle,
- gss_ctx_id_t * context_handle,
- const gss_name_t target_name,
- const gss_OID input_mech_type,
- OM_uint32 req_flags,
- OM_uint32 time_req,
- const gss_channel_bindings_t input_chan_bindings,
- const gss_buffer_t input_token,
- gss_OID * actual_mech_type,
- gss_buffer_t output_token,
- OM_uint32 * ret_flags,
- OM_uint32 * time_rec)
-{
- struct init_sec_context_lucid_v1_res res;
- struct init_sec_context_lucid_v1_args args;
- enum clnt_stat stat;
- gss_ctx_id_t ctx = *context_handle;
- CLIENT *cl;
-
- *minor_status = 0;
-
- cl = kgss_gssd_client();
- if (cl == NULL)
- return (GSS_S_FAILURE);
-
- args.uid = curthread->td_ucred->cr_uid;
- if (initiator_cred_handle)
- args.cred = initiator_cred_handle->handle;
- else
- args.cred = 0;
- if (ctx)
- args.ctx = ctx->handle;
- else
- args.ctx = 0;
- args.name = target_name->handle;
- args.mech_type = input_mech_type;
- args.req_flags = req_flags;
- args.time_req = time_req;
- args.input_chan_bindings = input_chan_bindings;
- if (input_token)
- args.input_token = *input_token;
- else {
- args.input_token.length = 0;
- args.input_token.value = NULL;
- }
-
- bzero(&res, sizeof(res));
- stat = gssd_init_sec_context_lucid_v1_1(&args, &res, cl);
- CLNT_RELEASE(cl);
- if (stat != RPC_SUCCESS) {
- *minor_status = stat;
- return (GSS_S_FAILURE);
- }
-
- if (res.major_status != GSS_S_COMPLETE
- && res.major_status != GSS_S_CONTINUE_NEEDED) {
- *minor_status = res.minor_status;
- xdr_free((xdrproc_t) xdr_init_sec_context_lucid_v1_res, &res);
- return (res.major_status);
- }
-
- *minor_status = res.minor_status;
-
- if (!ctx) {
- ctx = kgss_create_context(res.actual_mech_type);
- if (!ctx) {
- xdr_free((xdrproc_t) xdr_init_sec_context_lucid_v1_res, &res);
- *minor_status = 0;
- return (GSS_S_BAD_MECH);
- }
- }
- *context_handle = ctx;
- ctx->handle = res.ctx;
- if (actual_mech_type)
- *actual_mech_type = KGSS_MECH_TYPE(ctx);
- kgss_copy_buffer(&res.output_token, output_token);
- if (ret_flags)
- *ret_flags = res.ret_flags;
- if (time_rec)
- *time_rec = res.time_rec;
-
- /*
- * If the context establishment is complete, export it from
- * userland and hand the result (which includes key material
- * etc.) to the kernel implementation.
- */
- if (res.major_status == GSS_S_COMPLETE) {
- res.major_status = kgss_transfer_context(ctx, &res.lucid);
- if (res.major_status != GSS_S_COMPLETE)
- printf("gss_init_sec_context_lucid_v1: "
- "transfer failed\n");
- }
-
- xdr_free((xdrproc_t) xdr_init_sec_context_lucid_v1_res, &res);
+ res.major_status = kgss_transfer_context(ctx);
return (res.major_status);
}
diff --git a/sys/kgssapi/gssapi.h b/sys/kgssapi/gssapi.h
index cd4a4b508cc5..37cc8a1a5a09 100644
--- a/sys/kgssapi/gssapi.h
+++ b/sys/kgssapi/gssapi.h
@@ -422,28 +422,6 @@ OM_uint32 gss_init_sec_context
OM_uint32 * /* time_rec */
);
-OM_uint32 gss_init_sec_context_lucid_v1
- (OM_uint32 *, /* minor_status */
- const gss_cred_id_t, /* initiator_cred_handle */
- gss_ctx_id_t *, /* context_handle */
- const gss_name_t, /* target_name */
- const gss_OID, /* mech_type */
- OM_uint32, /* req_flags */
- OM_uint32, /* time_req */
- const gss_channel_bindings_t,
- /* input_chan_bindings */
- const gss_buffer_t, /* input_token */
- gss_OID *, /* actual_mech_type */
- gss_buffer_t, /* output_token */
- OM_uint32 *, /* ret_flags */
- OM_uint32 * /* time_rec */
- );
-
-OM_uint32 gss_supports_lucid
- (OM_uint32 *, /* minor_status */
- OM_uint32 * /* vers */
- );
-
OM_uint32 gss_accept_sec_context
(OM_uint32 *, /* minor_status */
gss_ctx_id_t *, /* context_handle */
@@ -459,26 +437,6 @@ OM_uint32 gss_accept_sec_context
gss_cred_id_t * /* delegated_cred_handle */
);
-OM_uint32 gss_accept_sec_context_lucid_v1
- (OM_uint32 *, /* minor_status */
- gss_ctx_id_t *, /* context_handle */
- const gss_cred_id_t, /* acceptor_cred_handle */
- const gss_buffer_t, /* input_token_buffer */
- const gss_channel_bindings_t,
- /* input_chan_bindings */
- gss_name_t *, /* src_name */
- gss_OID *, /* mech_type */
- gss_buffer_t, /* output_token */
- OM_uint32 *, /* ret_flags */
- OM_uint32 *, /* time_rec */
- gss_cred_id_t *, /* delegated_cred_handle */
- gss_buffer_t, /* exported_name */
- uid_t *, /* Unix cred */
- gid_t *,
- int *, /* Number of groups */
- gid_t * /* groups list */
- );
-
OM_uint32 gss_delete_sec_context
(OM_uint32 *, /* minor_status */
gss_ctx_id_t *, /* context_handle */
diff --git a/sys/kgssapi/gssapi_impl.h b/sys/kgssapi/gssapi_impl.h
index d8a85f20a602..3279dc8da122 100644
--- a/sys/kgssapi/gssapi_impl.h
+++ b/sys/kgssapi/gssapi_impl.h
@@ -78,5 +78,5 @@ extern gss_OID kgss_find_mech_by_name(const char *name);
extern const char *kgss_find_mech_by_oid(const gss_OID oid);
extern gss_ctx_id_t kgss_create_context(gss_OID mech_type);
extern void kgss_delete_context(gss_ctx_id_t ctx, gss_buffer_t output_token);
-extern OM_uint32 kgss_transfer_context(gss_ctx_id_t ctx, void *lctx);
+extern OM_uint32 kgss_transfer_context(gss_ctx_id_t ctx);
extern void kgss_copy_buffer(const gss_buffer_t from, gss_buffer_t to);
diff --git a/sys/kgssapi/gssd.x b/sys/kgssapi/gssd.x
index bf63ba95f8df..b50f39b33554 100644
--- a/sys/kgssapi/gssd.x
+++ b/sys/kgssapi/gssd.x
@@ -48,21 +48,6 @@ typedef uint64_t gssd_ctx_id_t;
typedef uint64_t gssd_cred_id_t;
typedef uint64_t gssd_name_t;
-struct kgss_lucid_desc {
- uint32_t initiate;
- uint32_t endtime;
- uint64_t send_seq;
- uint64_t recv_seq;
- uint32_t protocol;
- uint32_t rfc_sign;
- uint32_t rfc_seal;
- uint32_t have_subkey;
- uint32_t ctx_type;
- gss_buffer_desc ctx_key;
- uint32_t subkey_type;
- gss_buffer_desc subkey_key;
-};
-
struct init_sec_context_res {
uint32_t major_status;
uint32_t minor_status;
@@ -85,29 +70,6 @@ struct init_sec_context_args {
gss_buffer_desc input_token;
};
-struct init_sec_context_lucid_v1_res {
- uint32_t major_status;
- uint32_t minor_status;
- gssd_ctx_id_t ctx;
- gss_OID actual_mech_type;
- gss_buffer_desc output_token;
- uint32_t ret_flags;
- uint32_t time_rec;
- kgss_lucid_desc lucid;
-};
-
-struct init_sec_context_lucid_v1_args {
- uint32_t uid;
- gssd_cred_id_t cred;
- gssd_ctx_id_t ctx;
- gssd_name_t name;
- gss_OID mech_type;
- uint32_t req_flags;
- uint32_t time_req;
- gss_channel_bindings_t input_chan_bindings;
- gss_buffer_desc input_token;
-};
-
struct accept_sec_context_res {
uint32_t major_status;
uint32_t minor_status;
@@ -127,30 +89,6 @@ struct accept_sec_context_args {
gss_channel_bindings_t input_chan_bindings;
};
-struct accept_sec_context_lucid_v1_res {
- uint32_t major_status;
- uint32_t minor_status;
- gssd_ctx_id_t ctx;
- gssd_name_t src_name;
- gss_OID mech_type;
- gss_buffer_desc output_token;
- uint32_t ret_flags;
- uint32_t time_rec;
- gssd_cred_id_t delegated_cred_handle;
- kgss_lucid_desc lucid;
- gss_buffer_desc exported_name;
- uint32_t uid;
- uint32_t gid;
- uint32_t gidlist<>;
-};
-
-struct accept_sec_context_lucid_v1_args {
- gssd_ctx_id_t ctx;
- gssd_cred_id_t cred;
- gss_buffer_desc input_token;
- gss_channel_bindings_t input_chan_bindings;
-};
-
struct delete_sec_context_res {
uint32_t major_status;
uint32_t minor_status;
@@ -163,8 +101,7 @@ struct delete_sec_context_args {
enum sec_context_format {
KGSS_HEIMDAL_0_6,
- KGSS_HEIMDAL_1_1,
- MIT_V1
+ KGSS_HEIMDAL_1_1
};
struct export_sec_context_res {
@@ -292,11 +229,6 @@ struct ip_to_dns_args {
char ip_addr<NI_MAXHOST>;
};
-struct supports_lucid_res {
- uint32_t major_status;
- uint32_t vers;
-};
-
program GSSD {
version GSSDVERS {
void GSSD_NULL(void) = 0;
@@ -342,14 +274,5 @@ program GSSD {
ip_to_dns_res
GSSD_IP_TO_DNS(ip_to_dns_args) = 14;
-
- init_sec_context_lucid_v1_res
- GSSD_INIT_SEC_CONTEXT_LUCID_V1(init_sec_context_lucid_v1_args) = 15;
-
- accept_sec_context_lucid_v1_res
- GSSD_ACCEPT_SEC_CONTEXT_LUCID_V1(accept_sec_context_lucid_v1_args) = 16;
-
- supports_lucid_res
- GSSD_SUPPORTS_LUCID(void) = 17;
} = 1;
} = 0x40677373;
diff --git a/sys/kgssapi/krb5/krb5_mech.c b/sys/kgssapi/krb5/krb5_mech.c
index 59d5b120e4fb..0b8fbc90fcd1 100644
--- a/sys/kgssapi/krb5/krb5_mech.c
+++ b/sys/kgssapi/krb5/krb5_mech.c
@@ -217,18 +217,6 @@ copy_key(struct krb5_keyblock *from, struct krb5_keyblock **to)
*to = NULL;
}
-static void
-copy_lucid_key(gss_buffer_desc *from, uint32_t type, struct krb5_keyblock *to)
-{
-
- to->kk_type = type;
- to->kk_key.kd_length = from->length;
- if (from->length > 0) {
- to->kk_key.kd_data = malloc(from->length, M_GSSAPI, M_WAITOK);
- memcpy(to->kk_key.kd_data, from->value, from->length);
- }
-}
-
/*
* Return non-zero if we are initiator.
*/
@@ -414,70 +402,6 @@ krb5_init(gss_ctx_id_t ctx)
}
static OM_uint32
-krb5_lucid_import(gss_ctx_id_t ctx,
- enum sec_context_format format,
- const gss_buffer_t context_token)
-{
- struct krb5_context *kc = (struct krb5_context *)ctx;
- kgss_lucid_desc *lctx = (kgss_lucid_desc *)context_token;
- OM_uint32 res;
-
- kc->kc_more_flags = 0;
- if (lctx->protocol == 0) {
- kc->kc_cksumtype = lctx->rfc_sign;
- kc->kc_keytype = lctx->rfc_seal;
- copy_lucid_key(&lctx->ctx_key, lctx->ctx_type,
- &kc->kc_keyblock);
- } else if (lctx->protocol == 1) {
- if (lctx->have_subkey != 0) {
- if (lctx->initiate != 0)
- copy_lucid_key(&lctx->subkey_key,
- lctx->subkey_type,
- &kc->kc_remote_subkey);
- else
- copy_lucid_key(&lctx->subkey_key,
- lctx->subkey_type,
- &kc->kc_local_subkey);
- kc->kc_cksumtype = lctx->subkey_type;
- kc->kc_keytype = lctx->subkey_type;
- kc->kc_more_flags |= ACCEPTOR_SUBKEY;
- } else {
- if (lctx->initiate != 0)
- copy_lucid_key(&lctx->ctx_key,
- lctx->ctx_type,
- &kc->kc_remote_subkey);
- else
- copy_lucid_key(&lctx->ctx_key,
- lctx->ctx_type,
- &kc->kc_local_subkey);
- kc->kc_cksumtype = lctx->ctx_type;
- kc->kc_keytype = lctx->ctx_type;
- }
- } else {
- return (GSS_S_DEFECTIVE_TOKEN);
- }
- kc->kc_local_seqnumber = lctx->send_seq;
- kc->kc_remote_seqnumber = lctx->recv_seq;
- if (lctx->initiate != 0)
- kc->kc_more_flags |= LOCAL;
- kc->kc_lifetime = lctx->endtime;
- kc->kc_msg_order.km_flags = 0;
-
- res = get_keys(kc);
- if (GSS_ERROR(res))
- return (res);
-
- /*
- * We don't need these anymore.
- */
- delete_keyblock(&kc->kc_keyblock);
- delete_keyblock(&kc->kc_local_subkey);
- delete_keyblock(&kc->kc_remote_subkey);
-
- return (GSS_S_COMPLETE);
-}
-
-static OM_uint32
krb5_import(gss_ctx_id_t ctx,
enum sec_context_format format,
const gss_buffer_t context_token)
@@ -489,10 +413,6 @@ krb5_import(gss_ctx_id_t ctx,
uint32_t flags;
int i;
- /* For MIT, just call krb5_lucid_import(). */
- if (format == MIT_V1)
- return (krb5_lucid_import(ctx, format, context_token));
-
/*
* We support heimdal 0.6 and heimdal 1.1
*/
diff --git a/sys/rpc/rpcsec_gss/rpcsec_gss.c b/sys/rpc/rpcsec_gss/rpcsec_gss.c
index 53770d139c61..983dd251f81f 100644
--- a/sys/rpc/rpcsec_gss/rpcsec_gss.c
+++ b/sys/rpc/rpcsec_gss/rpcsec_gss.c
@@ -746,7 +746,6 @@ rpc_gss_init(AUTH *auth, rpc_gss_options_ret_t *options_ret)
struct rpc_callextra ext;
gss_OID mech_oid;
gss_OID_set mechlist;
- static enum krb_imp my_krb_imp = KRBIMP_UNKNOWN;
rpc_gss_log_debug("in rpc_gss_refresh()");
@@ -853,14 +852,6 @@ rpc_gss_init(AUTH *auth, rpc_gss_options_ret_t *options_ret)
goto out;
}
- if (my_krb_imp == KRBIMP_UNKNOWN) {
- maj_stat = gss_supports_lucid(&min_stat, NULL);
- if (maj_stat == GSS_S_COMPLETE)
- my_krb_imp = KRBIMP_MIT;
- else
- my_krb_imp = KRBIMP_HESIOD1;
- }
-
/* GSS context establishment loop. */
memset(&recv_token, 0, sizeof(recv_token));
memset(&gr, 0, sizeof(gr));
@@ -871,34 +862,19 @@ rpc_gss_init(AUTH *auth, rpc_gss_options_ret_t *options_ret)
for (;;) {
crsave = td->td_ucred;
td->td_ucred = gd->gd_ucred;
- if (my_krb_imp == KRBIMP_MIT)
- maj_stat = gss_init_sec_context_lucid_v1(&min_stat,
- gd->gd_options.my_cred,
- &gd->gd_ctx,
- name,
- gd->gd_mech,
- gd->gd_options.req_flags,
- gd->gd_options.time_req,
- gd->gd_options.input_channel_bindings,
- recv_tokenp,
- &gd->gd_mech, /* used mech */
- &send_token,
- &options_ret->ret_flags,
- &options_ret->time_req);
- else
- maj_stat = gss_init_sec_context(&min_stat,
- gd->gd_options.my_cred,
- &gd->gd_ctx,
- name,
- gd->gd_mech,
- gd->gd_options.req_flags,
- gd->gd_options.time_req,
- gd->gd_options.input_channel_bindings,
- recv_tokenp,
- &gd->gd_mech, /* used mech */
- &send_token,
- &options_ret->ret_flags,
- &options_ret->time_req);
+ maj_stat = gss_init_sec_context(&min_stat,
+ gd->gd_options.my_cred,
+ &gd->gd_ctx,
+ name,
+ gd->gd_mech,
+ gd->gd_options.req_flags,
+ gd->gd_options.time_req,
+ gd->gd_options.input_channel_bindings,
+ recv_tokenp,
+ &gd->gd_mech, /* used mech */
+ &send_token,
+ &options_ret->ret_flags,
+ &options_ret->time_req);
td->td_ucred = crsave;
/*
diff --git a/sys/rpc/rpcsec_gss/rpcsec_gss_int.h b/sys/rpc/rpcsec_gss/rpcsec_gss_int.h
index 02a7767220de..3d643af8c498 100644
--- a/sys/rpc/rpcsec_gss/rpcsec_gss_int.h
+++ b/sys/rpc/rpcsec_gss/rpcsec_gss_int.h
@@ -73,12 +73,6 @@ struct rpc_gss_init_res {
/* Maximum sequence number value. */
#define MAXSEQ 0x80000000
-enum krb_imp {
- KRBIMP_UNKNOWN,
- KRBIMP_HESIOD1,
- KRBIMP_MIT
-};
-
/* Prototypes. */
__BEGIN_DECLS
diff --git a/sys/rpc/rpcsec_gss/svc_rpcsec_gss.c b/sys/rpc/rpcsec_gss/svc_rpcsec_gss.c
index e047c557c712..51077c71822c 100644
--- a/sys/rpc/rpcsec_gss/svc_rpcsec_gss.c
+++ b/sys/rpc/rpcsec_gss/svc_rpcsec_gss.c
@@ -925,29 +925,9 @@ svc_rpc_gss_accept_sec_context(struct svc_rpc_gss_client *client,
OM_uint32 maj_stat = 0, min_stat = 0, ret_flags;
OM_uint32 cred_lifetime;
struct svc_rpc_gss_svc_name *sname;
- gss_buffer_desc export_name;
- rpc_gss_ucred_t *uc = &client->cl_ucred;
- int numgroups;
- static enum krb_imp my_krb_imp = KRBIMP_UNKNOWN;
rpc_gss_log_debug("in svc_rpc_gss_accept_context()");
- if (my_krb_imp == KRBIMP_UNKNOWN) {
- maj_stat = gss_supports_lucid(&min_stat, NULL);
- if (maj_stat == GSS_S_COMPLETE)
- my_krb_imp = KRBIMP_MIT;
- else
- my_krb_imp = KRBIMP_HESIOD1;
- min_stat = 0;
- }
-
- if (my_krb_imp == KRBIMP_MIT) {
- uc->uid = 65534;
- uc->gid = 65534;
- uc->gidlist = client->cl_gid_storage;
- numgroups = NGROUPS;
- }
-
/* Deserialize arguments. */
memset(&recv_tok, 0, sizeof(recv_tok));
@@ -969,38 +949,18 @@ svc_rpc_gss_accept_sec_context(struct svc_rpc_gss_client *client,
if (sname->sn_program == rqst->rq_prog
&& sname->sn_version == rqst->rq_vers) {
retry:
- if (my_krb_imp == KRBIMP_MIT)
- gr->gr_major =
- gss_accept_sec_context_lucid_v1(
- &gr->gr_minor,
- &client->cl_ctx,
- sname->sn_cred,
- &recv_tok,
- GSS_C_NO_CHANNEL_BINDINGS,
- &client->cl_cname,
- &mech,
- &gr->gr_token,
- &ret_flags,
- &cred_lifetime,
- &client->cl_creds,
- &export_name,
- &uc->uid,
- &uc->gid,
- &numgroups,
- &uc->gidlist[0]);
- else
- gr->gr_major = gss_accept_sec_context(
- &gr->gr_minor,
- &client->cl_ctx,
- sname->sn_cred,
- &recv_tok,
- GSS_C_NO_CHANNEL_BINDINGS,
- &client->cl_cname,
- &mech,
- &gr->gr_token,
- &ret_flags,
- &cred_lifetime,
- &client->cl_creds);
+ gr->gr_major = gss_accept_sec_context(
+ &gr->gr_minor,
+ &client->cl_ctx,
+ sname->sn_cred,
+ &recv_tok,
+ GSS_C_NO_CHANNEL_BINDINGS,
+ &client->cl_cname,
+ &mech,
+ &gr->gr_token,
+ &ret_flags,
+ &cred_lifetime,
+ &client->cl_creds);
if (gr->gr_major ==
GSS_S_CREDENTIALS_EXPIRED) {
/*
@@ -1022,37 +982,18 @@ svc_rpc_gss_accept_sec_context(struct svc_rpc_gss_client *client,
return (FALSE);
}
} else {
- if (my_krb_imp == KRBIMP_MIT)
- gr->gr_major = gss_accept_sec_context_lucid_v1(
- &gr->gr_minor,
- &client->cl_ctx,
- client->cl_sname->sn_cred,
- &recv_tok,
- GSS_C_NO_CHANNEL_BINDINGS,
- &client->cl_cname,
- &mech,
- &gr->gr_token,
- &ret_flags,
- &cred_lifetime,
- NULL,
- &export_name,
- &uc->uid,
- &uc->gid,
- &numgroups,
- &uc->gidlist[0]);
- else
- gr->gr_major = gss_accept_sec_context(
- &gr->gr_minor,
- &client->cl_ctx,
- client->cl_sname->sn_cred,
- &recv_tok,
- GSS_C_NO_CHANNEL_BINDINGS,
- &client->cl_cname,
- &mech,
- &gr->gr_token,
- &ret_flags,
- &cred_lifetime,
- NULL);
+ gr->gr_major = gss_accept_sec_context(
+ &gr->gr_minor,
+ &client->cl_ctx,
+ client->cl_sname->sn_cred,
+ &recv_tok,
+ GSS_C_NO_CHANNEL_BINDINGS,
+ &client->cl_cname,
+ &mech,
+ &gr->gr_token,
+ &ret_flags,
+ &cred_lifetime,
+ NULL);
}
sx_xunlock(&svc_rpc_gss_lock);
@@ -1068,12 +1009,8 @@ svc_rpc_gss_accept_sec_context(struct svc_rpc_gss_client *client,
rpc_gss_log_status("accept_sec_context", client->cl_mech,
gr->gr_major, gr->gr_minor);
client->cl_state = CLIENT_STALE;
- if (my_krb_imp == KRBIMP_MIT)
- uc->gidlen = 0;
return (TRUE);
}
- if (my_krb_imp == KRBIMP_MIT)
- uc->gidlen = numgroups;
gr->gr_handle.value = &client->cl_id;
gr->gr_handle.length = sizeof(client->cl_id);
@@ -1085,6 +1022,8 @@ svc_rpc_gss_accept_sec_context(struct svc_rpc_gss_client *client,
client->cl_done_callback = FALSE;
if (gr->gr_major == GSS_S_COMPLETE) {
+ gss_buffer_desc export_name;
+
/*
* Change client expiration time to be near when the
* client creds expire (or 24 hours if we can't figure
@@ -1107,10 +1046,8 @@ svc_rpc_gss_accept_sec_context(struct svc_rpc_gss_client *client,
*/
client->cl_rawcred.version = RPCSEC_GSS_VERSION;
rpc_gss_oid_to_mech(mech, &client->cl_rawcred.mechanism);
- maj_stat = GSS_S_COMPLETE;
- if (my_krb_imp != KRBIMP_MIT)
- maj_stat = gss_export_name(&min_stat, client->cl_cname,
- &export_name);
+ maj_stat = gss_export_name(&min_stat, client->cl_cname,
+ &export_name);
if (maj_stat != GSS_S_COMPLETE) {
rpc_gss_log_status("gss_export_name", client->cl_mech,
maj_stat, min_stat);
@@ -1131,8 +1068,7 @@ svc_rpc_gss_accept_sec_context(struct svc_rpc_gss_client *client,
* Use gss_pname_to_uid to map to unix creds. For
* kerberos5, this uses krb5_aname_to_localname.
*/
- if (my_krb_imp != KRBIMP_MIT)
- svc_rpc_gss_build_ucred(client, client->cl_cname);
+ svc_rpc_gss_build_ucred(client, client->cl_cname);
svc_rpc_gss_set_flavor(client);
gss_release_name(&min_stat, &client->cl_cname);
diff --git a/usr.sbin/Makefile b/usr.sbin/Makefile
index 51908818e550..c361c1e5866d 100644
--- a/usr.sbin/Makefile
+++ b/usr.sbin/Makefile
@@ -140,9 +140,7 @@ SUBDIR.${MK_FLOPPY}+= fdformat
SUBDIR.${MK_FLOPPY}+= fdread
SUBDIR.${MK_FLOPPY}+= fdwrite
SUBDIR.${MK_FREEBSD_UPDATE}+= freebsd-update
-.if ${MK_KERBEROS_SUPPORT} != "no"
SUBDIR.${MK_GSSAPI}+= gssd
-.endif
SUBDIR.${MK_GPIO}+= gpioctl
SUBDIR.${MK_HYPERV}+= hyperv
SUBDIR.${MK_INET6}+= ip6addrctl
diff --git a/usr.sbin/gssd/Makefile b/usr.sbin/gssd/Makefile
index 2cbe909c8178..569e2c7e18f5 100644
--- a/usr.sbin/gssd/Makefile
+++ b/usr.sbin/gssd/Makefile
@@ -9,13 +9,18 @@ SRCS= gssd.c gssd.h gssd_svc.c gssd_xdr.c gssd_prot.c
CFLAGS+= -I.
WARNS?= 1
+LIBADD= gssapi
+.if ${MK_KERBEROS_SUPPORT} != "no"
.if ${MK_MITKRB5} != "no"
# MIT KRB5
-LIBADD= krb5 k5crypto krb5profile krb5support gssapi_krb5
+LIBADD+= krb5 k5crypto krb5profile krb5support
CFLAGS+= -DMK_MITKRB5=yes
.else
# Heimdal
-LIBADD= gssapi krb5 roken
+LIBADD+= krb5 roken
+.endif
+.else
+CFLAGS+= -DWITHOUT_KERBEROS
.endif
CLEANFILES= gssd_svc.c gssd_xdr.c gssd.h
diff --git a/usr.sbin/gssd/gssd.c b/usr.sbin/gssd/gssd.c
index 54d2062dd29a..94eb6ca575c8 100644
--- a/usr.sbin/gssd/gssd.c
+++ b/usr.sbin/gssd/gssd.c
@@ -39,7 +39,9 @@
#include <dirent.h>
#include <err.h>
#include <errno.h>
+#ifndef WITHOUT_KERBEROS
#include <krb5.h>
+#endif
#include <netdb.h>
#include <pwd.h>
#include <signal.h>
@@ -51,9 +53,6 @@
#include <arpa/inet.h>
#include <netinet/in.h>
#include <gssapi/gssapi.h>
-#ifdef MK_MITKRB5
-#include <gssapi/gssapi_krb5.h>
-#endif
#include <rpc/rpc.h>
#include <rpc/rpc_com.h>
@@ -78,6 +77,7 @@ static char ccfile_dirlist[PATH_MAX + 1], ccfile_substring[NAME_MAX + 1];
static char pref_realm[1024];
static int verbose;
static int hostbased_initiator_cred;
+#ifndef WITHOUT_KERBEROS
/* 1.2.752.43.13.14 */
static gss_OID_desc gss_krb5_set_allowable_enctypes_x_desc =
{6, (void *) "\x2a\x85\x70\x2b\x0d\x0e"};
@@ -87,13 +87,16 @@ static gss_OID_desc gss_krb5_mech_oid_x_desc =
{9, (void *) "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
static gss_OID GSS_KRB5_MECH_OID_X =
&gss_krb5_mech_oid_x_desc;
+#endif
static void gssd_load_mech(void);
static int find_ccache_file(const char *, uid_t, char *);
static int is_a_valid_tgt_cache(const char *, uid_t, int *, time_t *);
static void gssd_verbose_out(const char *, ...);
+#ifndef WITHOUT_KERBEROS
static krb5_error_code gssd_get_cc_from_keytab(const char *);
static OM_uint32 gssd_get_user_cred(OM_uint32 *, uid_t, gss_cred_id_t *);
+#endif
void gssd_terminate(int);
extern void gssd_1(struct svc_req *rqstp, SVCXPRT *transp);
@@ -125,22 +128,32 @@ main(int argc, char **argv)
debug_level++;
break;
case 'h':
+#ifndef WITHOUT_KERBEROS
/*
* Enable use of a host based initiator credential
* in the default keytab file.
*/
hostbased_initiator_cred = 1;
+#else
+ errx(1, "This option not available when built"
+ " without MK_KERBEROS\n");
+#endif
break;
case 'v':
verbose = 1;
break;
case 's':
+#ifndef WITHOUT_KERBEROS
/*
* Set the directory search list. This enables use of
* find_ccache_file() to search the directories for a
* suitable credentials cache file.
*/
strlcpy(ccfile_dirlist, optarg, sizeof(ccfile_dirlist));
+#else
+ errx(1, "This option not available when built"
+ " without MK_KERBEROS\n");
+#endif
break;
case 'c':
/*
@@ -322,7 +335,6 @@ gssd_null_1_svc(void *argp, void *result, struct svc_req *rqstp)
return (TRUE);
}
-#ifndef MK_MITKRB5
bool_t
gssd_init_sec_context_1_svc(init_sec_context_args *argp, init_sec_context_res *result, struct svc_req *rqstp)
{
@@ -332,10 +344,12 @@ gssd_init_sec_context_1_svc(init_sec_context_args *argp, init_sec_context_res *r
char ccname[PATH_MAX + 5 + 1], *cp, *cp2;
int gotone, gotcred;
OM_uint32 min_stat;
+#ifndef WITHOUT_KERBEROS
gss_buffer_desc principal_desc;
char enctype[sizeof(uint32_t)];
int key_enctype;
OM_uint32 maj_stat;
+#endif
memset(result, 0, sizeof(*result));
if (hostbased_initiator_cred != 0 && argp->cred != 0 &&
@@ -445,35 +459,6 @@ gssd_init_sec_context_1_svc(init_sec_context_args *argp, init_sec_context_res *r
}
bool_t
-gssd_supports_lucid_1_svc(void *argp, supports_lucid_res *result, struct svc_req *rqstp)
-{
-
- gssd_verbose_out("gssd_lucid: done\n");
- result->major_status = GSS_S_UNAVAILABLE;
- return (TRUE);
-}
-
-bool_t
-gssd_init_sec_context_lucid_v1_1_svc(init_sec_context_lucid_v1_args *argp,
- init_sec_context_lucid_v1_res *result, struct svc_req *rqstp)
-{
-
- gssd_verbose_out("gssd_init_sec_context_lucid_v1: Heimdal\n");
- result->major_status = GSS_S_UNAVAILABLE;
- return (TRUE);
-}
-
-bool_t
-gssd_accept_sec_context_lucid_v1_1_svc(accept_sec_context_lucid_v1_args *argp,
- accept_sec_context_lucid_v1_res *result, struct svc_req *rqstp)
-{
-
- gssd_verbose_out("gssd_accept_sec_context_lucid_v1: Heimdal\n");
- result->major_status = GSS_S_UNAVAILABLE;
- return (TRUE);
-}
-
-bool_t
gssd_accept_sec_context_1_svc(accept_sec_context_args *argp, accept_sec_context_res *result, struct svc_req *rqstp)
{
gss_ctx_id_t ctx = GSS_C_NO_CONTEXT;
@@ -523,446 +508,6 @@ gssd_accept_sec_context_1_svc(accept_sec_context_args *argp, accept_sec_context_
return (TRUE);
}
-#else /* MK_MITKRB5 */
-bool_t
-gssd_supports_lucid_1_svc(void *argp, supports_lucid_res *result, struct svc_req *rqstp)
-{
-
- gssd_verbose_out("gssd_lucid: done\n");
- result->vers = 1;
- result->major_status = GSS_S_COMPLETE;
- return (TRUE);
-}
-
-bool_t
-gssd_init_sec_context_1_svc(init_sec_context_args *argp,
- init_sec_context_res *result, struct svc_req *rqstp)
-{
-
- gssd_verbose_out("gssd_init_sec_context: MIT\n");
- result->major_status = GSS_S_UNAVAILABLE;
- return (TRUE);
-}
-
-bool_t
-gssd_accept_sec_context_1_svc(accept_sec_context_args *argp,
- accept_sec_context_res *result, struct svc_req *rqstp)
-{
-
- gssd_verbose_out("gssd_accept_sec_context: MIT\n");
- result->major_status = GSS_S_UNAVAILABLE;
- return (TRUE);
-}
-
-bool_t
-gssd_init_sec_context_lucid_v1_1_svc(init_sec_context_lucid_v1_args *argp,
- init_sec_context_lucid_v1_res *result, struct svc_req *rqstp)
-{
- gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
- gss_ctx_id_t ctx = GSS_C_NO_CONTEXT;
- gss_name_t name = GSS_C_NO_NAME;
- char ccname[PATH_MAX + 5 + 1], *cp, *cp2;
- int gotone, gotcred;
- OM_uint32 min_stat;
- gss_buffer_desc principal_desc;
- char enctype[sizeof(uint32_t)];
- int key_enctype;
- OM_uint32 maj_stat;
-
- memset(result, 0, sizeof(*result));
- if (hostbased_initiator_cred != 0 && argp->cred != 0 &&
- argp->uid == 0) {
- /*
- * These credentials are for a host based initiator name
- * in a keytab file, which should now have credentials
- * in /tmp/krb5cc_gssd, because gss_acquire_cred() did
- * the equivalent of "kinit -k".
- */
- snprintf(ccname, sizeof(ccname), "FILE:%s",
- GSSD_CREDENTIAL_CACHE_FILE);
- } else if (ccfile_dirlist[0] != '\0' && argp->cred == 0) {
- /*
- * For the "-s" case and no credentials provided as an
- * argument, search the directory list for an appropriate
- * credential cache file. If the search fails, return failure.
- */
- gotone = 0;
- cp = ccfile_dirlist;
- do {
- cp2 = strchr(cp, ':');
- if (cp2 != NULL)
- *cp2 = '\0';
- gotone = find_ccache_file(cp, argp->uid, ccname);
- if (gotone != 0)
- break;
- if (cp2 != NULL)
- *cp2++ = ':';
- cp = cp2;
- } while (cp != NULL && *cp != '\0');
- if (gotone == 0) {
- result->major_status = GSS_S_CREDENTIALS_EXPIRED;
- gssd_verbose_out("gssd_init_sec_context_plus: -s no"
- " credential cache file found for uid=%d\n",
- (int)argp->uid);
- return (TRUE);
- }
- } else {
- /*
- * If there wasn't a "-s" option or the credentials have
- * been provided as an argument, do it the old way.
- * When credentials are provided, the uid should be root.
- */
- if (argp->cred != 0 && argp->uid != 0) {
- if (debug_level == 0)
- syslog(LOG_ERR, "gss_init_sec_context_plus:"
- " cred for non-root");
- else
- fprintf(stderr, "gss_init_sec_context_plus:"
- " cred for non-root\n");
- }
- snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_%d",
- (int) argp->uid);
- }
- setenv("KRB5CCNAME", ccname, TRUE);
-
- if (argp->cred) {
- cred = gssd_find_resource(argp->cred);
- if (!cred) {
- result->major_status = GSS_S_CREDENTIALS_EXPIRED;
- gssd_verbose_out("gssd_init_sec_context_plus: cred"
- " resource not found\n");
- return (TRUE);
- }
- }
- if (argp->ctx) {
- ctx = gssd_find_resource(argp->ctx);
- if (!ctx) {
- result->major_status = GSS_S_CONTEXT_EXPIRED;
- gssd_verbose_out("gssd_init_sec_context_plus: context"
- " resource not found\n");
- return (TRUE);
- }
- }
- if (argp->name) {
- name = gssd_find_resource(argp->name);
- if (!name) {
- result->major_status = GSS_S_BAD_NAME;
- gssd_verbose_out("gssd_init_sec_context_plus: name"
- " resource not found\n");
- return (TRUE);
- }
- }
- gotcred = 0;
-
- result->major_status = gss_init_sec_context(&result->minor_status,
- cred, &ctx, name, argp->mech_type,
- argp->req_flags, argp->time_req, argp->input_chan_bindings,
- &argp->input_token, &result->actual_mech_type,
- &result->output_token, &result->ret_flags, &result->time_rec);
- gssd_verbose_out("gssd_init_sec_context_plus: done major=0x%x minor=%d"
- " uid=%d\n", (unsigned int)result->major_status,
- (int)result->minor_status, (int)argp->uid);
- if (gotcred != 0)
- gss_release_cred(&min_stat, &cred);
-
- if (result->actual_mech_type) {
- /*
- * Just to keep the bogus "elements" pointer
- * from core dumping the daemon when linked to MIT
- * libraries. For some reason, the "elements" pointer
- * in actual_mech_type cannot be read.
- */
- result->actual_mech_type = GSS_KRB5_MECH_OID_X;
- }
-
- if (result->major_status == GSS_S_COMPLETE
- || result->major_status == GSS_S_CONTINUE_NEEDED) {
- if (argp->ctx)
- result->ctx = argp->ctx;
- else
- result->ctx = gssd_make_resource(ctx);
- }
-
- if (result->major_status == GSS_S_COMPLETE) {
- gss_krb5_lucid_context_v1_t *lctx;
-
- result->major_status = gss_krb5_export_lucid_sec_context(
- &result->minor_status, &ctx, 1, (void *)&lctx);
- gssd_delete_resource(result->ctx);
- if (result->major_status == GSS_S_COMPLETE &&
- lctx != NULL) {
- result->lucid.initiate = lctx->initiate;
- result->lucid.endtime = lctx->endtime;
- result->lucid.send_seq = lctx->send_seq;
- result->lucid.recv_seq = lctx->recv_seq;
- result->lucid.protocol = lctx->protocol;
- if (lctx->protocol == 0) {
- result->lucid.rfc_sign =
- lctx->rfc1964_kd.sign_alg;
- result->lucid.rfc_seal =
- lctx->rfc1964_kd.seal_alg;
- result->lucid.ctx_type =
- lctx->rfc1964_kd.ctx_key.type;
- result->lucid.ctx_key.length =
- lctx->rfc1964_kd.ctx_key.length;
- result->lucid.ctx_key.value =
- mem_alloc(result->lucid.ctx_key.length);
- memcpy(result->lucid.ctx_key.value,
- lctx->rfc1964_kd.ctx_key.data,
- result->lucid.ctx_key.length);
- } else if (lctx->protocol == 1) {
- result->lucid.have_subkey =
- lctx->cfx_kd.have_acceptor_subkey;
- result->lucid.ctx_type =
- lctx->cfx_kd.ctx_key.type;
- result->lucid.ctx_key.length =
- lctx->cfx_kd.ctx_key.length;
- result->lucid.ctx_key.value =
- mem_alloc(result->lucid.ctx_key.length);
- memcpy(result->lucid.ctx_key.value,
- lctx->cfx_kd.ctx_key.data,
- result->lucid.ctx_key.length);
- if (result->lucid.have_subkey != 0) {
- result->lucid.subkey_type =
- lctx->cfx_kd.acceptor_subkey.type;
- result->lucid.subkey_key.length =
- lctx->cfx_kd.acceptor_subkey.length;
- result->lucid.subkey_key.value =
- mem_alloc(
- result->lucid.subkey_key.length);
- memcpy(result->lucid.subkey_key.value,
- lctx->cfx_kd.acceptor_subkey.data,
- result->lucid.subkey_key.length);
- } else {
- result->lucid.subkey_type = 0;
- result->lucid.subkey_key.length = 0;
- result->lucid.subkey_key.value = NULL;
- }
- }
- (void)gss_krb5_free_lucid_sec_context(&min_stat,
- (void *)lctx);
- } else {
- gssd_verbose_out("gss_krb5_export_lucid_set_context"
- " failed: major=0x%x minor=%d lctx=%p\n",
- result->major_status, result->minor_status, lctx);
- }
- }
-
- return (TRUE);
-}
-
-/*
- * Internal function to acquire unix credentials.
- */
-static OM_uint32
-_gss_get_unix_cred(OM_uint32 *minor_stat, gss_name_t name, gss_OID mech,
- uid_t *uidp, gid_t *gidp, int *numgroups, gid_t *groups)
-{
- OM_uint32 major_stat;
- uid_t uid;
- char buf[1024], *bufp;
- struct passwd pwd, *pw;
- size_t buflen;
- int error;
- static size_t buflen_hint = 1024;
-
- major_stat = gss_pname_to_uid(minor_stat, name, mech, &uid);
- if (major_stat == GSS_S_COMPLETE) {
- *uidp = uid;
- buflen = buflen_hint;
- for (;;) {
- pw = NULL;
- bufp = buf;
- if (buflen > sizeof(buf))
- bufp = malloc(buflen);
- if (bufp == NULL)
- break;
- error = getpwuid_r(uid, &pwd, bufp, buflen,
- &pw);
- if (error != ERANGE)
- break;
- if (buflen > sizeof(buf))
- free(bufp);
- buflen += 1024;
- if (buflen > buflen_hint)
- buflen_hint = buflen;
- }
- if (pw) {
- *gidp = pw->pw_gid;
- getgrouplist(pw->pw_name, pw->pw_gid,
- groups, numgroups);
- } else {
- major_stat = GSS_S_FAILURE;
- gssd_verbose_out("get_unix_cred: cannot find"
- " passwd entry\n");
- }
- if (bufp != NULL && buflen > sizeof(buf))
- free(bufp);
- } else if (major_stat != GSS_S_UNAVAILABLE) {
- gssd_verbose_out("gssd_pname_to_uid: failed major=0x%x"
- " minor=%d\n", major_stat, *minor_stat);
- }
- return (major_stat);
-}
-
-bool_t
-gssd_accept_sec_context_lucid_v1_1_svc(accept_sec_context_lucid_v1_args *argp,
- accept_sec_context_lucid_v1_res *result, struct svc_req *rqstp)
-{
- gss_ctx_id_t ctx = GSS_C_NO_CONTEXT;
- gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
- gss_name_t src_name;
- gss_cred_id_t delegated_cred_handle;
- OM_uint32 min_stat;
-
- memset(result, 0, sizeof(*result));
- if (argp->ctx) {
- ctx = gssd_find_resource(argp->ctx);
- if (!ctx) {
- result->major_status = GSS_S_CONTEXT_EXPIRED;
- gssd_verbose_out("gssd_accept_sec_context: ctx"
- " resource not found\n");
- return (TRUE);
- }
- }
- if (argp->cred) {
- cred = gssd_find_resource(argp->cred);
- if (!cred) {
- result->major_status = GSS_S_CREDENTIALS_EXPIRED;
- gssd_verbose_out("gssd_accept_sec_context: cred"
- " resource not found\n");
- return (TRUE);
- }
- }
-
- memset(result, 0, sizeof(*result));
- result->major_status = gss_accept_sec_context(&result->minor_status,
- &ctx, cred, &argp->input_token, argp->input_chan_bindings,
- &src_name, &result->mech_type, &result->output_token,
- &result->ret_flags, &result->time_rec,
- &delegated_cred_handle);
- gssd_verbose_out("gssd_accept_sec_context: done major=0x%x minor=%d\n",
- (unsigned int)result->major_status, (int)result->minor_status);
-
- if (result->major_status == GSS_S_COMPLETE
- || result->major_status == GSS_S_CONTINUE_NEEDED) {
- if (argp->ctx)
- result->ctx = argp->ctx;
- else
- result->ctx = gssd_make_resource(ctx);
- result->src_name = gssd_make_resource(src_name);
- result->delegated_cred_handle =
- gssd_make_resource(delegated_cred_handle);
- }
-
- if (result->major_status == GSS_S_COMPLETE) {
- gss_krb5_lucid_context_v1_t *lctx;
-
- /* Get the lucid context stuff. */
- result->major_status = gss_krb5_export_lucid_sec_context(
- &result->minor_status, &ctx, 1, (void *)&lctx);
- gssd_delete_resource(result->ctx);
- if (result->major_status == GSS_S_COMPLETE &&
- lctx != NULL) {
- result->lucid.initiate = lctx->initiate;
- result->lucid.endtime = lctx->endtime;
- result->lucid.send_seq = lctx->send_seq;
- result->lucid.recv_seq = lctx->recv_seq;
- result->lucid.protocol = lctx->protocol;
- if (lctx->protocol == 0) {
- result->lucid.rfc_sign =
- lctx->rfc1964_kd.sign_alg;
- result->lucid.rfc_seal =
- lctx->rfc1964_kd.seal_alg;
- result->lucid.ctx_type =
- lctx->rfc1964_kd.ctx_key.type;
- result->lucid.ctx_key.length =
- lctx->rfc1964_kd.ctx_key.length;
- result->lucid.ctx_key.value =
- mem_alloc(result->lucid.ctx_key.length);
- memcpy(result->lucid.ctx_key.value,
- lctx->rfc1964_kd.ctx_key.data,
- result->lucid.ctx_key.length);
- } else if (lctx->protocol == 1) {
- result->lucid.have_subkey =
- lctx->cfx_kd.have_acceptor_subkey;
- result->lucid.ctx_type =
- lctx->cfx_kd.ctx_key.type;
- result->lucid.ctx_key.length =
- lctx->cfx_kd.ctx_key.length;
- result->lucid.ctx_key.value =
- mem_alloc(result->lucid.ctx_key.length);
- memcpy(result->lucid.ctx_key.value,
- lctx->cfx_kd.ctx_key.data,
- result->lucid.ctx_key.length);
- if (result->lucid.have_subkey != 0) {
- result->lucid.subkey_type =
- lctx->cfx_kd.acceptor_subkey.type;
- result->lucid.subkey_key.length =
- lctx->cfx_kd.acceptor_subkey.length;
- result->lucid.subkey_key.value =
- mem_alloc(
- result->lucid.subkey_key.length);
- memcpy(result->lucid.subkey_key.value,
- lctx->cfx_kd.acceptor_subkey.data,
- result->lucid.subkey_key.length);
- } else {
- result->lucid.subkey_type = 0;
- result->lucid.subkey_key.length = 0;
- result->lucid.subkey_key.value = NULL;
- }
- }
- (void)gss_krb5_free_lucid_sec_context(&min_stat,
- (void *)lctx);
- } else {
- gssd_verbose_out("gss_krb5_export_lucid_set_context"
- " failed: major=0x%x minor=%d lctx=%p\n",
- result->major_status, result->minor_status, lctx);
- }
-
- /* Now, get the exported name. */
- if (result->major_status == GSS_S_COMPLETE) {
- result->major_status = gss_export_name(
- &result->minor_status, src_name,
- &result->exported_name);
- gssd_verbose_out("gssd_accept_sec_context (name):"
- " done major=0x%x minor=%d\n",
- result->major_status, result->minor_status);
- }
-
- /* Finally, get the unix credentials. */
- if (result->major_status == GSS_S_COMPLETE) {
- gid_t groups[NGROUPS];
- int i, len = NGROUPS;
- OM_uint32 major_stat, minor_stat;
-
- major_stat = _gss_get_unix_cred(&minor_stat,
- src_name, result->mech_type,
- &result->uid, &result->gid, &len, groups);
- if (major_stat == GSS_S_COMPLETE) {
- result->gidlist.gidlist_len = len;
- result->gidlist.gidlist_val =
- mem_alloc(len * sizeof(uint32_t));
- /*
- * Just in case
- * sizeof(gid_t) != sizeof(uint32_t).
- */
- for (i = 0; i < len; i++)
- result->gidlist.gidlist_val[i] =
- groups[i];
- } else {
- result->gid = 65534;
- result->gidlist.gidlist_len = 0;
- result->gidlist.gidlist_val = NULL;
- gssd_verbose_out("gssd_pname_to_uid: mapped"
- " to uid=%d, but no groups\n",
- (int)result->uid);
- }
- }
- }
- return (TRUE);
-}
-#endif /* !MK_MITKRB5 */
bool_t
gssd_delete_sec_context_1_svc(delete_sec_context_args *argp, delete_sec_context_res *result, struct svc_req *rqstp)
@@ -1213,9 +758,11 @@ gssd_acquire_cred_1_svc(acquire_cred_args *argp, acquire_cred_res *result, struc
gss_cred_id_t cred;
char ccname[PATH_MAX + 5 + 1], *cp, *cp2;
int gotone;
+#ifndef WITHOUT_KERBEROS
gss_buffer_desc namebuf;
uint32_t minstat;
krb5_error_code kret;
+#endif
memset(result, 0, sizeof(*result));
if (argp->desired_name) {
@@ -1228,6 +775,7 @@ gssd_acquire_cred_1_svc(acquire_cred_args *argp, acquire_cred_res *result, struc
}
}
+#ifndef WITHOUT_KERBEROS
if (hostbased_initiator_cred != 0 && argp->desired_name != 0 &&
argp->uid == 0 && argp->cred_usage == GSS_C_INITIATE) {
/* This is a host based initiator name in the keytab file. */
@@ -1260,7 +808,9 @@ gssd_acquire_cred_1_svc(acquire_cred_args *argp, acquire_cred_res *result, struc
result->major_status = GSS_S_FAILURE;
return (TRUE);
}
- } else if (ccfile_dirlist[0] != '\0' && argp->desired_name == 0) {
+ } else
+#endif /* !WITHOUT_KERBEROS */
+ if (ccfile_dirlist[0] != '\0' && argp->desired_name == 0) {
/*
* For the "-s" case and no name provided as an
* argument, search the directory list for an appropriate
@@ -1504,6 +1054,7 @@ static int
is_a_valid_tgt_cache(const char *filepath, uid_t uid, int *retrating,
time_t *retexptime)
{
+#ifndef WITHOUT_KERBEROS
krb5_context context;
krb5_principal princ;
krb5_ccache ccache;
@@ -1603,8 +1154,12 @@ is_a_valid_tgt_cache(const char *filepath, uid_t uid, int *retrating,
*retexptime = exptime;
}
return (ret);
+#else /* WITHOUT_KERBEROS */
+ return (0);
+#endif /* !WITHOUT_KERBEROS */
}
+#ifndef WITHOUT_KERBEROS
/*
* This function attempts to do essentially a "kinit -k" for the principal
* name provided as the argument, so that there will be a TGT in the
@@ -1707,12 +1262,15 @@ gssd_get_user_cred(OM_uint32 *min_statp, uid_t uid, gss_cred_id_t *credp)
gss_release_oid_set(&min_stat, &mechlist);
return (maj_stat);
}
+#endif /* !WITHOUT_KERBEROS */
void gssd_terminate(int sig __unused)
{
+#ifndef WITHOUT_KERBEROS
if (hostbased_initiator_cred != 0)
unlink(GSSD_CREDENTIAL_CACHE_FILE);
+#endif
exit(0);
}
generated by cgit v1.3 (git 2.53.0) at 2026-08-02 19:27:19 +0000