2 * Unix SMB/CIFS implementation.
4 * Simple GSSAPI wrappers
6 * Copyright (c) 2012 Andreas Schneider <asn@samba.org>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 #include "gss_samba.h"
27 #if !defined(HAVE_GSS_OID_EQUAL)
28 int smb_gss_oid_equal(const gss_OID first_oid, const gss_OID second_oid)
30 if (first_oid == GSS_C_NO_OID || second_oid == GSS_C_NO_OID) {
34 if (first_oid == second_oid) {
38 if ((first_oid)->length != (second_oid)->length) {
42 if (memcmp((first_oid)->elements, (second_oid)->elements,
43 (first_oid)->length) == 0) {
49 #endif /* !HAVE_GSS_OID_EQUAL */
52 /* wrapper around gss_krb5_import_cred() that prefers to use gss_acquire_cred_from()
53 * if this GSSAPI extension is available. gss_acquire_cred_from() is properly
54 * interposed by GSSPROXY while gss_krb5_import_cred() is not.
56 * This wrapper requires a proper krb5_context to resolve ccache name.
57 * All gss_krb5_import_cred() callers in Samba already have krb5_context available. */
58 uint32_t smb_gss_krb5_import_cred(uint32_t *minor_status, krb5_context ctx,
59 krb5_ccache id, krb5_principal keytab_principal,
60 krb5_keytab keytab, gss_cred_id_t *cred)
62 uint32_t major_status = 0;
64 #ifdef HAVE_GSS_ACQUIRE_CRED_FROM
66 gss_key_value_element_desc ccache_element = {
71 gss_key_value_element_desc keytab_element = {
76 gss_key_value_element_desc elements[2];
78 gss_key_value_set_desc cred_store = {
79 .elements = &ccache_element,
83 gss_OID_set mech_set = GSS_C_NO_OID_SET;
84 gss_cred_usage_t cred_usage = GSS_C_INITIATE;
85 gss_name_t name = NULL;
86 gss_buffer_desc pr_name = {
92 major_status = krb5_cc_get_full_name(ctx,
94 discard_const(&ccache_element.value));
95 if (major_status != 0) {
100 if (keytab != NULL) {
101 keytab_element.value = malloc(4096);
102 if (!keytab_element.value) {
105 major_status = krb5_kt_get_name(ctx,
107 discard_const(keytab_element.value), 4096);
108 if (major_status != 0) {
109 free(discard_const(keytab_element.value));
112 cred_usage = GSS_C_ACCEPT;
113 cred_store.elements = &keytab_element;
115 if (keytab_principal != NULL) {
116 major_status = krb5_unparse_name(ctx, keytab_principal, (char**)&pr_name.value);
117 if (major_status != 0) {
118 free(discard_const(keytab_element.value));
121 pr_name.length = strlen(pr_name.value);
123 major_status = gss_import_name(minor_status,
125 discard_const(GSS_KRB5_NT_PRINCIPAL_NAME),
127 if (major_status != 0) {
128 krb5_free_unparsed_name(ctx, pr_name.value);
129 free(discard_const(keytab_element.value));
135 if (id != NULL && keytab != NULL) {
136 elements[0] = ccache_element;
137 elements[1] = keytab_element;
139 cred_store.elements = elements;
140 cred_store.count = 2;
141 cred_usage = GSS_C_BOTH;
144 major_status = gss_acquire_cred_from(minor_status,
154 if (pr_name.value != NULL) {
155 (void)gss_release_name(&minor, &name);
156 krb5_free_unparsed_name(ctx, pr_name.value);
158 if (keytab_element.value != NULL) {
159 free(discard_const(keytab_element.value));
161 krb5_free_string(ctx, discard_const(ccache_element.value));
163 major_status = gss_krb5_import_cred(minor_status,
168 if (major_status == (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME)) {
169 if ((keytab_principal == NULL) && (keytab != NULL)) {
170 /* No principal was specified and MIT krb5 1.9 version failed.
171 * We have to fall back to set global acceptor identity */
172 gss_OID_set_desc mech_set;
173 char *kt_name = NULL;
175 kt_name = malloc(4096);
180 major_status = krb5_kt_get_name(ctx,
183 if (major_status != 0) {
188 major_status = gsskrb5_register_acceptor_identity(kt_name);
194 /* We are dealing with krb5 GSSAPI mech in this fallback */
197 discard_const_p(struct gss_OID_desc_struct,
199 major_status = gss_acquire_cred(minor_status,
214 #endif /* HAVE_GSSAPI */