for now, allow default GSS EAP realm to be set

[mech_eap.orig] / util_name.c

diff --git a/util_name.c b/util_name.c
index 26154a8..daa059f 100644 (file)
--- a/util_name.c
+++ b/util_name.c
@@ -111,6 +111,7 @@ gssEapReleaseName(OM_uint32 *minor, gss_name_t *pName)
 
     GSSEAP_KRB_INIT(&krbContext);
     krb5_free_principal(krbContext, name->krbPrincipal);
+    gssEapReleaseOid(&tmpMinor, &name->mechanismUsed);
 
     gssEapReleaseAttrContext(&tmpMinor, name);
 
@@ -195,10 +196,20 @@ importUserName(OM_uint32 *minor,
     OM_uint32 major;
     krb5_context krbContext;
     krb5_principal krbPrinc;
-    char *nameString;
+    char *nameString, *realm;
+    int flags = 0;
 
     GSSEAP_KRB_INIT(&krbContext);
 
+    realm = getenv("GSSEAP_DEFAULT_REALM");
+    if (realm != NULL) {
+        *minor = krb5_set_default_realm(krbContext, realm);
+        if (*minor != 0)
+            return GSS_S_FAILURE;
+    } else {
+        flags |= KRB5_PRINCIPAL_PARSE_REQUIRE_REALM;
+    }
+
     if (nameBuffer == GSS_C_NO_BUFFER) {
         *minor = krb5_copy_principal(krbContext,
                                      krbAnonymousPrincipal(), &krbPrinc);
@@ -209,7 +220,7 @@ importUserName(OM_uint32 *minor,
         if (GSS_ERROR(major))
             return major;
 
-        *minor = krb5_parse_name(krbContext, nameString, &krbPrinc);
+        *minor = krb5_parse_name_flags(krbContext, nameString, flags, &krbPrinc);
         if (*minor != 0) {
             GSSEAP_FREE(nameString);
             return GSS_S_FAILURE;
@@ -227,7 +238,7 @@ importUserName(OM_uint32 *minor,
 
 static OM_uint32
 importAnonymousName(OM_uint32 *minor,
-                    const gss_buffer_t nameBuffer,
+                    const gss_buffer_t nameBuffer GSSEAP_UNUSED,
                     gss_name_t *pName)
 {
     OM_uint32 major;
@@ -275,6 +286,7 @@ gssEapImportNameInternal(OM_uint32 *minor,
     gss_buffer_desc buf;
     enum gss_eap_token_type tokType;
     gss_name_t name = GSS_C_NO_NAME;
+    gss_OID mechanismUsed = GSS_C_NO_OID;
 
     GSSEAP_KRB_INIT(&krbContext);
 
@@ -282,7 +294,10 @@ gssEapImportNameInternal(OM_uint32 *minor,
     remain = nameBuffer->length;
 
     if (flags & EXPORT_NAME_FLAG_OID) {
-        if (remain < 6 + GSS_EAP_MECHANISM->length + 4)
+        gss_OID_desc mech;
+
+        /* TOK_ID || MECH_OID_LEN || MECH_OID */
+        if (remain < 6)
             return GSS_S_BAD_NAME;
 
         if (flags & EXPORT_NAME_FLAG_COMPOSITE)
@@ -297,21 +312,32 @@ gssEapImportNameInternal(OM_uint32 *minor,
 
         /* MECH_OID_LEN */
         len = load_uint16_be(p);
-        if (len != 2 + GSS_EAP_MECHANISM->length)
+        if (len < 2)
             return GSS_S_BAD_NAME;
         UPDATE_REMAIN(2);
 
         /* MECH_OID */
         if (p[0] != 0x06)
             return GSS_S_BAD_NAME;
-        if (p[1] != GSS_EAP_MECHANISM->length)
-            return GSS_S_BAD_MECH;
-        if (memcmp(&p[2], GSS_EAP_MECHANISM->elements, GSS_EAP_MECHANISM->length))
-            return GSS_S_BAD_MECH;
-        UPDATE_REMAIN(2 + GSS_EAP_MECHANISM->length);
+
+        mech.length = p[1];
+        mech.elements = &p[2];
+
+        CHECK_REMAIN(mech.length);
+
+        major = gssEapCanonicalizeOid(minor,
+                                      &mech,
+                                      OID_FLAG_FAMILY_MECH_VALID |
+                                        OID_FLAG_MAP_FAMILY_MECH_TO_NULL,
+                                      &mechanismUsed);
+        if (GSS_ERROR(major))
+            goto cleanup;
+
+        UPDATE_REMAIN(2 + mech.length);
     }
 
     /* NAME_LEN */
+    CHECK_REMAIN(4);
     len = load_uint32_be(p);
     UPDATE_REMAIN(4);
 
@@ -325,6 +351,9 @@ gssEapImportNameInternal(OM_uint32 *minor,
     if (GSS_ERROR(major))
         goto cleanup;
 
+    name->mechanismUsed = mechanismUsed;
+    mechanismUsed = GSS_C_NO_OID;
+
     if (flags & EXPORT_NAME_FLAG_COMPOSITE) {
         gss_buffer_desc buf;
 
@@ -340,10 +369,12 @@ gssEapImportNameInternal(OM_uint32 *minor,
     *minor = 0;
 
 cleanup:
-    if (GSS_ERROR(major))
+    if (GSS_ERROR(major)) {
+        gssEapReleaseOid(&tmpMinor, &mechanismUsed);
         gssEapReleaseName(&tmpMinor, &name);
-    else
+    } else {
         *pName = name;
+    }
 
     return major;
 }
@@ -378,7 +409,8 @@ OM_uint32
 gssEapImportName(OM_uint32 *minor,
                  const gss_buffer_t nameBuffer,
                  gss_OID nameType,
-                 gss_name_t *name)
+                 gss_OID mechType,
+                 gss_name_t *pName)
 {
     struct gss_eap_name_import_provider nameTypes[] = {
         { GSS_C_NT_USER_NAME,               importUserName              },
@@ -392,18 +424,34 @@ gssEapImportName(OM_uint32 *minor,
 #endif
     };
     size_t i;
-
-    *name = GSS_C_NO_NAME;
+    OM_uint32 major = GSS_S_BAD_NAMETYPE;
+    OM_uint32 tmpMinor;
+    gss_name_t name = GSS_C_NO_NAME;
 
     if (nameType == GSS_C_NO_OID)
         nameType = nameTypes[0].oid;
 
     for (i = 0; i < sizeof(nameTypes) / sizeof(nameTypes[0]); i++) {
-        if (oidEqual(nameTypes[i].oid, nameType))
-            return nameTypes[i].import(minor, nameBuffer, name);
+        if (oidEqual(nameTypes[i].oid, nameType)) {
+            major = nameTypes[i].import(minor, nameBuffer, &name);
+            break;
+        }
     }
 
-    return GSS_S_BAD_NAMETYPE;
+    if (major == GSS_S_COMPLETE &&
+        mechType != GSS_C_NO_OID) {
+        assert(gssEapIsConcreteMechanismOid(mechType));
+        assert(name->mechanismUsed == GSS_C_NO_OID);
+
+        major = gssEapCanonicalizeOid(minor, mechType, 0, &name->mechanismUsed);
+    }
+
+    if (GSS_ERROR(major))
+        gssEapReleaseName(&tmpMinor, &name);
+    else
+        *pName = name;
+
+    return major;
 }
 
 OM_uint32
@@ -427,10 +475,16 @@ gssEapExportNameInternal(OM_uint32 *minor,
     size_t krbNameLen, exportedNameLen;
     unsigned char *p;
     gss_buffer_desc attrs = GSS_C_EMPTY_BUFFER;
+    gss_OID mech;
 
     exportedName->length = 0;
     exportedName->value = NULL;
 
+    if (name->mechanismUsed != GSS_C_NO_OID)
+        mech = name->mechanismUsed;
+    else
+        mech = GSS_EAP_MECHANISM;
+
     GSSEAP_KRB_INIT(&krbContext);
 
     *minor = krb5_unparse_name(krbContext, name->krbPrincipal, &krbName);
@@ -442,7 +496,7 @@ gssEapExportNameInternal(OM_uint32 *minor,
 
     exportedNameLen = 0;
     if (flags & EXPORT_NAME_FLAG_OID) {
-        exportedNameLen += 6 + GSS_EAP_MECHANISM->length;
+        exportedNameLen += 6 + mech->length;
     }
     exportedNameLen += 4 + krbNameLen;
     if (flags & EXPORT_NAME_FLAG_COMPOSITE) {
@@ -469,14 +523,14 @@ gssEapExportNameInternal(OM_uint32 *minor,
                         : TOK_TYPE_EXPORT_NAME,
                         p);
         p += 2;
-        store_uint16_be(GSS_EAP_MECHANISM->length + 2, p);
+        store_uint16_be(mech->length + 2, p);
         p += 2;
 
         /* MECH_OID */
         *p++ = 0x06;
-        *p++ = GSS_EAP_MECHANISM->length & 0xff;
-        memcpy(p, GSS_EAP_MECHANISM->elements, GSS_EAP_MECHANISM->length);
-        p += GSS_EAP_MECHANISM->length;
+        *p++ = mech->length & 0xff;
+        memcpy(p, mech->elements, mech->length);
+        p += mech->length;
     }
 
     /* NAME_LEN */
@@ -507,13 +561,15 @@ cleanup:
 }
 
 OM_uint32
-gssEapDuplicateName(OM_uint32 *minor,
-                    const gss_name_t input_name,
-                    gss_name_t *dest_name)
+gssEapCanonicalizeName(OM_uint32 *minor,
+                       const gss_name_t input_name,
+                       const gss_OID mech_type,
+                       gss_name_t *dest_name)
 {
     OM_uint32 major, tmpMinor;
     krb5_context krbContext;
     gss_name_t name;
+    gss_OID mech_used;
 
     if (input_name == GSS_C_NO_NAME) {
         *minor = EINVAL;
@@ -527,6 +583,18 @@ gssEapDuplicateName(OM_uint32 *minor,
         return major;
     }
 
+    if (mech_type != GSS_C_NO_OID)
+        mech_used = mech_type;
+    else
+        mech_used = input_name->mechanismUsed;
+
+    major = gssEapCanonicalizeOid(minor,
+                                  mech_used,
+                                  OID_FLAG_NULL_VALID,
+                                  &name->mechanismUsed);
+    if (GSS_ERROR(major))
+        goto cleanup;
+
     name->flags = input_name->flags;
 
     *minor = krb5_copy_principal(krbContext, input_name->krbPrincipal,
@@ -553,6 +621,15 @@ cleanup:
 }
 
 OM_uint32
+gssEapDuplicateName(OM_uint32 *minor,
+                    const gss_name_t input_name,
+                    gss_name_t *dest_name)
+{
+    return gssEapCanonicalizeName(minor, input_name,
+                                  GSS_C_NO_OID, dest_name);
+}
+
+OM_uint32
 gssEapDisplayName(OM_uint32 *minor,
                   gss_name_t name,
                   gss_buffer_t output_name_buffer,