Don't overwrite minorStatus before printing error.

[trust_router.git] / gsscon / gsscon_passive.c

diff --git a/gsscon/gsscon_passive.c b/gsscon/gsscon_passive.c
index 96d1417..f6a782b 100755 (executable)
--- a/gsscon/gsscon_passive.c
+++ b/gsscon/gsscon_passive.c
@@ -56,21 +56,46 @@
 
 const char *gServiceName = NULL;
 
-int gsscon_passive_authenticate (int           inSocket, 
-                         gss_ctx_id_t *outGSSContext)
+int gsscon_passive_authenticate (int               inSocket, 
+                                gss_buffer_desc    inNameBuffer,
+                                gss_ctx_id_t      *outGSSContext,
+                                client_cb_fn       clientCb,
+                                void              *clientCbData)
 {
     int err = 0;
     OM_uint32 majorStatus;
-    OM_uint32 minorStatus = 0;
+    OM_uint32 minorStatus = 0, minorStatusToo = 0;
     gss_ctx_id_t gssContext = GSS_C_NO_CONTEXT;
-    
+    gss_name_t clientName = GSS_C_NO_NAME, serviceName = GSS_C_NO_NAME;
+    gss_cred_id_t acceptorCredentials = NULL;
+    gss_buffer_desc clientDisplayName = {0, NULL};
     char *inputTokenBuffer = NULL;
     size_t inputTokenBufferLength = 0;
     gss_buffer_desc inputToken;  /* buffer received from the server */
     
+    printf("In gsscon_passive_authenticate(), inNameBuffer = %s\n", inNameBuffer.value);
+
     if (inSocket <  0 ) { err = EINVAL; }
     if (!outGSSContext) { err = EINVAL; }
-    
+
+    if (!err)
+      majorStatus = gss_import_name (&minorStatus, &inNameBuffer, (gss_OID) GSS_KRB5_NT_PRINCIPAL_NAME, &serviceName); 
+    if (majorStatus != GSS_S_COMPLETE) {
+       gsscon_print_gss_errors ("gss_import_name(serviceName)", majorStatus, minorStatus);
+       err = minorStatus ? minorStatus : majorStatus; 
+      }
+
+    if (!err) {
+      majorStatus = gss_acquire_cred ( &minorStatus, serviceName,
+                                      GSS_C_INDEFINITE, GSS_C_NO_OID_SET,
+                                      GSS_C_ACCEPT, &acceptorCredentials,
+                                      NULL /*mechs out*/, NULL /*time out*/);
+      if (majorStatus != GSS_S_COMPLETE) { 
+       gsscon_print_gss_errors ("gss_acquire_cred", majorStatus, minorStatus);
+       err = minorStatus ? minorStatus : majorStatus; 
+      }
+    }
+
     /* 
      * The main authentication loop:
      *
@@ -106,29 +131,14 @@ int gsscon_passive_authenticate (int           inSocket,
             
             /*
              * accept_sec_context does the actual work of taking the client's 
-             * request and generating an appropriate reply.  Note that we pass 
-             * GSS_C_NO_CREDENTIAL for the service principal.  This causes the 
-             * server to accept any service principal in the server's keytab, 
-             * which enables you to support multihomed hosts by having one key 
-             * in the keytab for each host identity the server responds on.  
-             *
-             * However, since we may have more keys in the keytab than we want 
-             * the server to actually use, we will need to check which service 
-             * principal the client used after authentication succeeds.  See 
-             * ServicePrincipalIsValidForService() for where you would put these 
-             * checks.  We don't check here since if we stopped responding in the 
-             * middle of the authentication negotiation, the client would get an 
-             * EOF, and the user wouldn't know what went wrong.
-             */
-            
-           // printf ("Calling gss_accept_sec_context...\n");
+             * request and generating an appropriate reply.              */
             majorStatus = gss_accept_sec_context (&minorStatus, 
                                                   &gssContext, 
-                                                  GSS_C_NO_CREDENTIAL, 
+                                                 acceptorCredentials,
                                                   &inputToken, 
                                                   GSS_C_NO_CHANNEL_BINDINGS, 
-                                                  NULL /* client_name */, 
-                                                  NULL /* actual_mech_type */, 
+                                                  &clientName,
+                                                  NULL /* actual_mech_type */,
                                                   &outputToken, 
                                                   NULL /* req_flags */, 
                                                   NULL /* time_rec */, 
@@ -139,7 +149,7 @@ int gsscon_passive_authenticate (int           inSocket,
                 err = gsscon_write_token (inSocket, outputToken.value, outputToken.length);
                 
                 /* free the output token */
-                gss_release_buffer (&minorStatus, &outputToken);
+                gss_release_buffer (&minorStatusToo, &outputToken);
             }
         }
         
@@ -148,7 +158,17 @@ int gsscon_passive_authenticate (int           inSocket,
             err = minorStatus ? minorStatus : majorStatus; 
         }            
     }
-    
+
+    if (!err) {
+      majorStatus = gss_display_name(&minorStatus, clientName, &clientDisplayName, NULL);
+      if (GSS_ERROR(majorStatus)) {
+       gsscon_print_gss_errors("gss_display_name", majorStatus, minorStatus);
+       err = EINVAL;
+      }
+      if (!err)
+       err = clientCb(clientName, &clientDisplayName, clientCbData);
+    }
+
     if (!err) { 
         *outGSSContext = gssContext;
         gssContext = NULL;
@@ -159,6 +179,12 @@ int gsscon_passive_authenticate (int           inSocket,
     if (inputTokenBuffer) { free (inputTokenBuffer); }
     if (gssContext != GSS_C_NO_CONTEXT) { 
         gss_delete_sec_context (&minorStatus, &gssContext, GSS_C_NO_BUFFER); }
+if (clientName != GSS_C_NO_NAME)
+  gss_release_name(&minorStatus, &clientName);
+if (clientDisplayName.value != NULL)
+  gss_release_buffer(&minorStatus, &clientDisplayName);
+ gss_release_name( &minorStatus, &serviceName);
+ gss_release_cred( &minorStatus, &acceptorCredentials);
         
     return err;
 }