lib/gssapi/mech/gss_acquire_cred_from.c

   1 /*-
   2  * Copyright (c) 2005 Doug Rabson
   3  * All rights reserved.
   4  *
   5  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   6  * Portions Copyright (c) 2011, 2018 PADL Software Pty Ltd.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  *
  29  *      $FreeBSD: src/lib/libgssapi/gss_acquire_cred.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
  30  */
  31
  32 #include "mech_locl.h"
  33
  34 /*
  35  * Shim for gss_acquire_cred_with_password()
  36  */
  37 static const char *
  38 find_password_in_cred_store(gss_const_key_value_set_t cred_store)
  39 {
  40     size_t i;
  41
  42     if (cred_store == GSS_C_NO_CRED_STORE)
  43         return NULL;
  44
  45     for (i = 0; i < cred_store->count; i++) {
  46         if (strcmp(cred_store->elements[i].key, "password") == 0)
  47             return cred_store->elements[i].value;
  48     }
  49
  50     return NULL;
  51 }
  52
  53 static OM_uint32
  54 acquire_mech_cred(OM_uint32 *minor_status,
  55                   gssapi_mech_interface m,
  56                   const struct _gss_mechanism_name *mn,
  57                   OM_uint32 time_req,
  58                   gss_cred_usage_t cred_usage,
  59                   gss_const_key_value_set_t cred_store,
  60                   struct _gss_mechanism_cred **out,
  61                   OM_uint32 *time_rec)
  62 {
  63     OM_uint32 major_status;
  64     struct _gss_mechanism_cred *mc;
  65     gss_OID_set_desc mech;
  66     const char *spassword;
  67
  68     *out = NULL;
  69     if (time_rec)
  70         *time_rec = 0;
  71
  72     mc = calloc(1, sizeof(struct _gss_mechanism_cred));
  73     if (mc == NULL) {
  74         *minor_status = ENOMEM;
  75         return GSS_S_FAILURE;
  76     }
  77
  78     mc->gmc_mech = m;
  79     mc->gmc_mech_oid = &m->gm_mech_oid;
  80
  81     mech.count = 1;
  82     mech.elements = mc->gmc_mech_oid;
  83
  84     if (m->gm_acquire_cred_from) {
  85         major_status = m->gm_acquire_cred_from(minor_status,
  86                                                mn ? mn->gmn_name : GSS_C_NO_NAME,
  87                                                time_req,
  88                                                &mech,
  89                                                cred_usage,
  90                                                cred_store,
  91                                                &mc->gmc_cred,
  92                                                NULL,
  93                                                time_rec);
  94     } else if (cred_store == GSS_C_NO_CRED_STORE && m->gm_acquire_cred) {
  95         major_status = m->gm_acquire_cred(minor_status,
  96                                           mn ? mn->gmn_name : GSS_C_NO_NAME,
  97                                           time_req,
  98                                           &mech,
  99                                           cred_usage,
 100                                           &mc->gmc_cred,
 101                                           NULL,
 102                                           time_rec);
 103     } else if (m->gm_compat &&
 104                m->gm_compat->gmc_acquire_cred_with_password &&
 105                (spassword = find_password_in_cred_store(cred_store)) != NULL) {
 106         gss_buffer_desc password;
 107
 108         password.length = strlen(spassword);
 109         password.value = rk_UNCONST(spassword);
 110
 111         /* compat glue for loadable mechanisms that implement API-as-SPI */
 112         major_status = m->gm_compat->gmc_acquire_cred_with_password(minor_status,
 113                                 mn ? mn->gmn_name : GSS_C_NO_NAME,
 114                                 &password,
 115                                 time_req,
 116                                 &mech,
 117                                 cred_usage,
 118                                 &mc->gmc_cred,
 119                                 NULL,
 120                                 time_rec);
 121     } else
 122         major_status = GSS_S_UNAVAILABLE;
 123
 124     heim_assert(major_status == GSS_S_COMPLETE || mc->gmc_cred == NULL,
 125                 "gss_acquire_cred_from: mech succeeded but did not return a credential");
 126
 127     if (major_status == GSS_S_COMPLETE)
 128         *out = mc;
 129     else
 130         free(mc);
 131
 132     return major_status;
 133 }
 134
 135 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 136 gss_acquire_cred_from(OM_uint32 *minor_status,
 137                       gss_const_name_t desired_name,
 138                       OM_uint32 time_req,
 139                       const gss_OID_set desired_mechs,
 140                       gss_cred_usage_t cred_usage,
 141                       gss_const_key_value_set_t cred_store,
 142                       gss_cred_id_t *output_cred_handle,
 143                       gss_OID_set *actual_mechs,
 144                       OM_uint32 *time_rec)
 145 {
 146     OM_uint32 major_status, minor;
 147     struct _gss_name *name = (struct _gss_name *)desired_name;
 148     gssapi_mech_interface m;
 149     struct _gss_cred *cred = NULL;
 150     size_t i;
 151     OM_uint32 min_time = GSS_C_INDEFINITE;
 152     gss_OID_set mechs = GSS_C_NO_OID_SET;
 153
 154     *minor_status = 0;
 155     if (output_cred_handle == NULL)
 156         return GSS_S_CALL_INACCESSIBLE_READ;
 157     *output_cred_handle = GSS_C_NO_CREDENTIAL;
 158     if (actual_mechs)
 159         *actual_mechs = GSS_C_NO_OID_SET;
 160     if (time_rec)
 161         *time_rec = 0;
 162
 163     _gss_load_mech();
 164
 165     if (desired_mechs != GSS_C_NO_OID_SET) {
 166         int only_mg_cred_mechs = -1;
 167
 168         for (i = 0; i < desired_mechs->count; i++) {
 169             m = __gss_get_mechanism(&desired_mechs->elements[i]);
 170             if (m != NULL) {
 171                 if ((m->gm_flags & GM_USE_MG_CRED) == 0)
 172                     only_mg_cred_mechs = 0;
 173                 else if (only_mg_cred_mechs == -1)
 174                     only_mg_cred_mechs = 1;
 175             }
 176         }
 177         /*
 178          * Now SPNEGO supports GM_USE_MG_CRED it's no longer necessary
 179          * to specifically acquire SPNEGO credentials. If the caller
 180          * did not specify any concrete mechanisms then we will acquire
 181          * credentials for all of them.
 182          */
 183         if (only_mg_cred_mechs == -1) {
 184             *minor_status = 0;
 185             major_status = GSS_S_BAD_MECH;
 186             goto cleanup;
 187         } else if (only_mg_cred_mechs == 0)
 188             mechs = desired_mechs;
 189         else
 190             mechs = _gss_mech_oids;
 191     } else
 192         mechs = _gss_mech_oids;
 193
 194     cred = _gss_mg_alloc_cred();
 195     if (cred == NULL) {
 196         *minor_status = ENOMEM;
 197         major_status = GSS_S_FAILURE;
 198         goto cleanup;
 199     }
 200
 201     if (actual_mechs) {
 202         major_status = gss_create_empty_oid_set(minor_status, actual_mechs);
 203         if (GSS_ERROR(major_status))
 204             goto cleanup;
 205     }
 206
 207     major_status = GSS_S_UNAVAILABLE; /* in case of no mechs */
 208
 209     for (i = 0; i < mechs->count; i++) {
 210         struct _gss_mechanism_name *mn = NULL;
 211         struct _gss_mechanism_cred *mc = NULL;
 212         OM_uint32 cred_time;
 213
 214         m = __gss_get_mechanism(&mechs->elements[i]);
 215         if (m == NULL || (m->gm_flags & GM_USE_MG_CRED) != 0)
 216             continue;
 217
 218         if (desired_name != GSS_C_NO_NAME) {
 219             major_status = _gss_find_mn(minor_status, name,
 220                                         &mechs->elements[i], &mn);
 221             if (major_status != GSS_S_COMPLETE)
 222                 continue;
 223         }
 224
 225         major_status = acquire_mech_cred(minor_status, m, mn,
 226                                          time_req, cred_usage,
 227                                          cred_store, &mc, &cred_time);
 228         if (major_status != GSS_S_COMPLETE) {
 229             if (mechs->count == 1)
 230                 _gss_mg_error(m, *minor_status);
 231             continue;
 232         }
 233
 234         _gss_mg_log_name(10, name, &mechs->elements[i],
 235                          "gss_acquire_cred %s name: %ld/%ld",
 236                          m->gm_name,
 237                          (long)major_status, (long)*minor_status);
 238
 239         HEIM_TAILQ_INSERT_TAIL(&cred->gc_mc, mc, gmc_link);
 240
 241         if (cred_time < min_time)
 242             min_time = cred_time;
 243         if (actual_mechs != NULL) {
 244             major_status = gss_add_oid_set_member(minor_status,
 245                                                   mc->gmc_mech_oid,
 246                                                   actual_mechs);
 247             if (GSS_ERROR(major_status))
 248                 goto cleanup;
 249         }
 250     }
 251
 252     /*
 253      * If we didn't manage to create a single credential, return
 254      * an error.
 255      */
 256     if (!HEIM_TAILQ_FIRST(&cred->gc_mc)) {
 257         if (mechs->count > 1) {
 258             *minor_status = 0;
 259             major_status = GSS_S_NO_CRED;
 260         }
 261         heim_assert(major_status != GSS_S_COMPLETE,
 262                     "lack of credentials must result in an error");
 263         goto cleanup;
 264     }
 265
 266     /* add all GM_USE_MG_CRED mechs such as SPNEGO */
 267     if (actual_mechs != NULL) {
 268         struct _gss_mech_switch *ms;
 269
 270         HEIM_TAILQ_FOREACH(ms, &_gss_mechs, gm_link) {
 271             m = &ms->gm_mech;
 272
 273             if ((m->gm_flags & GM_USE_MG_CRED) == 0)
 274                 continue;
 275
 276             major_status = gss_add_oid_set_member(minor_status,
 277                                                   &m->gm_mech_oid,
 278                                                   actual_mechs);
 279             if (GSS_ERROR(major_status))
 280                 goto cleanup;
 281         }
 282     }
 283
 284     *minor_status = 0;
 285     major_status = GSS_S_COMPLETE;
 286
 287     *output_cred_handle = (gss_cred_id_t)cred;
 288     if (time_rec)
 289         *time_rec = min_time;
 290
 291     _gss_mg_log_cred(10, cred, "gss_acquire_cred_from");
 292
 293 cleanup:
 294     if (major_status != GSS_S_COMPLETE) {
 295         gss_release_cred(&minor, (gss_cred_id_t *)&cred);
 296         if (actual_mechs)
 297             gss_release_oid_set(&minor, actual_mechs);
 298     }
 299
 300     return major_status;
 301 }