Home | History | Annotate | Download | only in mech
      1 /*
      2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
      3  * Use is subject to license terms.
      4  */
      5 
      6 
      7 /*
      8  * lib/gssapi/krb5/import_sec_context.c
      9  *
     10  * Copyright 1995,2004 by the Massachusetts Institute of Technology.
     11  * All Rights Reserved.
     12  *
     13  * Export of this software from the United States of America may
     14  *   require a specific license from the United States Government.
     15  *   It is the responsibility of any person or organization contemplating
     16  *   export to obtain such a license before exporting.
     17  *
     18  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
     19  * distribute this software and its documentation for any purpose and
     20  * without fee is hereby granted, provided that the above copyright
     21  * notice appear in all copies and that both that copyright notice and
     22  * this permission notice appear in supporting documentation, and that
     23  * the name of M.I.T. not be used in advertising or publicity pertaining
     24  * to distribution of the software without specific, written prior
     25  * permission.  Furthermore if you modify this software you must label
     26  * your software as modified software and not distribute it in such a
     27  * fashion that it might be confused with the original M.I.T. software.
     28  * M.I.T. makes no representations about the suitability of
     29  * this software for any purpose.  It is provided "as is" without express
     30  * or implied warranty.
     31  *
     32  */
     33 
     34 /*
     35  * import_sec_context.c	- Internalize the security context.
     36  */
     37 #include "gssapiP_krb5.h"
     38 /* for serialization initialization functions */
     39 #include "k5-int.h"
     40 #include "mglueP.h"  /* SUNW15resync - for KGSS_ macros */
     41 
     42 #ifdef	 _KERNEL
     43 extern OM_uint32 kgss_release_oid(OM_uint32 *, gss_OID *);
     44 #endif
     45 
     46 
     47 /*
     48  * Fix up the OID of the mechanism so that uses the static version of
     49  * the OID if possible.
     50  */
     51 gss_OID krb5_gss_convert_static_mech_oid(oid)
     52      gss_OID	oid;
     53 {
     54 	const gss_OID_desc 	*p;
     55 	OM_uint32		minor_status;
     56 
     57 	for (p = krb5_gss_oid_array; p->length; p++) {
     58 		if ((oid->length == p->length) &&
     59 		    (memcmp(oid->elements, p->elements, p->length) == 0)) {
     60 		        (void) KGSS_RELEASE_OID(&minor_status, &oid);
     61 			return (gss_OID) p;
     62 		}
     63 	}
     64 	return oid;
     65 }
     66 
     67 krb5_error_code
     68 krb5_gss_ser_init (krb5_context context)
     69 {
     70     krb5_error_code code;
     71     static krb5_error_code (KRB5_CALLCONV *const fns[])(krb5_context) = {
     72 	krb5_ser_auth_context_init,
     73 #ifndef _KERNEL
     74 	krb5_ser_context_init,
     75 	krb5_ser_ccache_init, krb5_ser_rcache_init, krb5_ser_keytab_init,
     76 #endif
     77     };
     78     int i;
     79 
     80     for (i = 0; i < sizeof(fns)/sizeof(fns[0]); i++)
     81 	if ((code = (fns[i])(context)) != 0)
     82 	    return code;
     83     return 0;
     84 }
     85 
     86 OM_uint32
     87 krb5_gss_import_sec_context(minor_status, interprocess_token, context_handle)
     88     OM_uint32		*minor_status;
     89     gss_buffer_t	interprocess_token;
     90     gss_ctx_id_t	*context_handle;
     91 {
     92     krb5_context	context;
     93     krb5_error_code	kret = 0;
     94     size_t		blen;
     95     krb5_gss_ctx_id_t	ctx;
     96     krb5_octet		*ibp;
     97 
     98     /* This is a bit screwy.  We create a krb5 context because we need
     99        one when calling the serialization code.  However, one of the
    100        objects we're unpacking is a krb5 context, so when we finish,
    101        we can throw this one away.  */
    102     kret = KGSS_INIT_CONTEXT(&context);
    103     if (kret) {
    104 	*minor_status = kret;
    105 	return GSS_S_FAILURE;
    106     }
    107 
    108     kret = krb5_gss_ser_init(context);
    109     if (kret) {
    110 	krb5_free_context(context);
    111 	*minor_status = kret;
    112 	return GSS_S_FAILURE;
    113     }
    114 
    115     /* Assume a tragic failure */
    116     ctx = (krb5_gss_ctx_id_t) NULL;
    117     *minor_status = 0;
    118 
    119     /* Internalize the context */
    120     ibp = (krb5_octet *) interprocess_token->value;
    121     blen = (size_t) interprocess_token->length;
    122     kret = kg_ctx_internalize(context, (krb5_pointer *) &ctx, &ibp, &blen);
    123     /*
    124      * SUNW15resync
    125      *
    126      *    krb5_free_context(context);
    127      * Previous versions of MIT(1.2ish)/Solaris did not serialize the
    128      * k5_context but MIT 1.5 does.  But we don't need all the userspace
    129      * junk in the kernel so we continue to not serialize it.
    130      * So we keep this context live here (see it's use in kg_ctx_internalize)
    131      * and it will get freed by delete_sec_context.
    132      */
    133     if (kret) {
    134        krb5_free_context(context);
    135        *minor_status = (OM_uint32) kret;
    136        return(GSS_S_FAILURE);
    137     }
    138 
    139     /* intern the context handle */
    140     if (! kg_save_ctx_id((gss_ctx_id_t) ctx)) {
    141        (void)krb5_gss_delete_sec_context(minor_status,
    142 					 (gss_ctx_id_t *) &ctx, NULL
    143 #ifdef _KERNEL
    144  					,0  /* gssd_ctx_verifier */
    145 #endif
    146 					);
    147        *minor_status = (OM_uint32) G_VALIDATE_FAILED;
    148        return(GSS_S_FAILURE);
    149     }
    150     ctx->mech_used = krb5_gss_convert_static_mech_oid(ctx->mech_used);
    151 
    152     *context_handle = (gss_ctx_id_t) ctx;
    153 
    154     *minor_status = 0;
    155     return (GSS_S_COMPLETE);
    156 }
    157