X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=util_name.c;h=26fccbc843a7e28dd59894104cf7885c08d35c85;hb=fb205ffa6d9fbc901a0e377c556d05f68d5a5fb7;hp=4c6c3241caa6427325e9bf8fed2f4e9271034853;hpb=93054b5558ab487334f1ea0fb127ac42f4188913;p=mech_eap.orig diff --git a/util_name.c b/util_name.c index 4c6c324..26fccbc 100644 --- a/util_name.c +++ b/util_name.c @@ -55,9 +55,9 @@ #include "gssapiP_eap.h" -static const gss_OID_desc gssEapNtPrincipalName = { +static gss_OID_desc gssEapNtPrincipalName = { /* 1.3.6.1.4.1.5322.21.2.1 */ - 12, "\x06\x0A\x2B\x06\x01\x04\x01\xA9\x4A\x15\x02\x01" + 10, "\x2B\x06\x01\x04\x01\xA9\x4A\x15\x02\x01" }; gss_OID GSS_EAP_NT_PRINCIPAL_NAME = &gssEapNtPrincipalName; @@ -68,7 +68,7 @@ gssEapAllocName(OM_uint32 *minor, gss_name_t *pName) OM_uint32 tmpMinor; gss_name_t name; - assert(*pName == GSS_C_NO_NAME); + *pName = GSS_C_NO_NAME; name = (gss_name_t)GSSEAP_CALLOC(1, sizeof(*name)); if (name == NULL) { @@ -106,8 +106,7 @@ gssEapReleaseName(OM_uint32 *minor, gss_name_t *pName) GSSEAP_KRB_INIT(&krbContext); krb5_free_principal(krbContext, name->krbPrincipal); - radiusFreeAVPs(&tmpMinor, name->avps); - samlFreeAssertion(&tmpMinor, name->assertion); + gssEapReleaseAttrContext(&tmpMinor, name); GSSEAP_MUTEX_DESTROY(&name->mutex); GSSEAP_FREE(name); @@ -132,7 +131,15 @@ krbPrincipalToName(OM_uint32 *minor, name->krbPrincipal = *principal; *principal = NULL; + if (name->krbPrincipal->length == 1) { + name->flags |= NAME_FLAG_NAI; + } else { + name->flags |= NAME_FLAG_SERVICE; + } + + *pName = name; *minor = 0; + return GSS_S_COMPLETE; } @@ -206,82 +213,114 @@ importUserName(OM_uint32 *minor, return major; } -static OM_uint32 -importExportedName(OM_uint32 *minor, - const gss_buffer_t nameBuffer, - gss_name_t *pName) +#define UPDATE_REMAIN(n) do { \ + p += (n); \ + remain -= (n); \ + } while (0) + +#define CHECK_REMAIN(n) do { \ + if (remain < (n)) { \ + *minor = ERANGE; \ + major = GSS_S_BAD_NAME; \ + goto cleanup; \ + } \ + } while (0) + +OM_uint32 +gssEapImportNameInternal(OM_uint32 *minor, + const gss_buffer_t nameBuffer, + gss_name_t *pName, + unsigned int flags) { OM_uint32 major, tmpMinor; krb5_context krbContext; unsigned char *p; - int composite = 0; size_t len, remain; gss_buffer_desc buf; - enum gss_eap_token_type tok_type; + enum gss_eap_token_type tokType; + gss_name_t name = GSS_C_NO_NAME; GSSEAP_KRB_INIT(&krbContext); p = (unsigned char *)nameBuffer->value; remain = nameBuffer->length; - if (remain < 6 + GSS_EAP_MECHANISM->length + 4) - return GSS_S_BAD_NAME; - - /* TOK_ID */ - tok_type = load_uint16_be(p); - if (tok_type != TOK_TYPE_EXPORT_NAME && - tok_type != TOK_TYPE_EXPORT_NAME_COMPOSITE) - return GSS_S_BAD_NAME; - p += 2; - remain -= 2; - - /* MECH_OID_LEN */ - len = load_uint16_be(p); - if (len != 2 + GSS_EAP_MECHANISM->length) - return GSS_S_BAD_NAME; - p += 2; - remain -= 2; - - /* MECH_OID */ - if (p[0] != 0x06) - return GSS_S_BAD_NAME; - if (p[1] != GSS_EAP_MECHANISM->length) - return GSS_S_BAD_MECH; - if (memcmp(p, GSS_EAP_MECHANISM->elements, GSS_EAP_MECHANISM->length)) - return GSS_S_BAD_MECH; - p += 2 + GSS_EAP_MECHANISM->length; - remain -= 2 + GSS_EAP_MECHANISM->length; + if (flags & EXPORT_NAME_FLAG_OID) { + if (remain < 6 + GSS_EAP_MECHANISM->length + 4) + return GSS_S_BAD_NAME; + + if (flags & EXPORT_NAME_FLAG_ATTRS) + tokType = TOK_TYPE_EXPORT_NAME_COMPOSITE; + else + tokType = TOK_TYPE_EXPORT_NAME; + + /* TOK_ID */ + if (load_uint16_be(p) != tokType) + return GSS_S_BAD_NAME; + UPDATE_REMAIN(2); + + /* MECH_OID_LEN */ + len = load_uint16_be(p); + if (len != 2 + GSS_EAP_MECHANISM->length) + return GSS_S_BAD_NAME; + UPDATE_REMAIN(2); + + /* MECH_OID */ + if (p[0] != 0x06) + return GSS_S_BAD_NAME; + if (p[1] != GSS_EAP_MECHANISM->length) + return GSS_S_BAD_MECH; + if (memcmp(&p[2], GSS_EAP_MECHANISM->elements, GSS_EAP_MECHANISM->length)) + return GSS_S_BAD_MECH; + UPDATE_REMAIN(2 + GSS_EAP_MECHANISM->length); + } /* NAME_LEN */ len = load_uint32_be(p); - p += 4; - - if (remain < len) - return GSS_S_BAD_NAME; + UPDATE_REMAIN(4); /* NAME */ + CHECK_REMAIN(len); buf.length = len; buf.value = p; + UPDATE_REMAIN(len); - p += len; - remain -= len; + major = importUserName(minor, &buf, &name); + if (GSS_ERROR(major)) + goto cleanup; - if (composite == 0 && remain != 0) - return GSS_S_BAD_NAME; + if (flags & EXPORT_NAME_FLAG_ATTRS) { + gss_buffer_desc buf; - major = importUserName(minor, &buf, pName); - if (GSS_ERROR(major)) - return major; + CHECK_REMAIN(4); + buf.length = load_uint32_be(p); + UPDATE_REMAIN(4); - /* XXX TODO composite handling */ + CHECK_REMAIN(buf.length); + buf.value = p; + UPDATE_REMAIN(buf.length); - return GSS_S_COMPLETE; + major = gssEapImportAttrContext(minor, &buf, name); + if (GSS_ERROR(major)) + goto cleanup; + } + + major = GSS_S_COMPLETE; + +cleanup: + if (GSS_ERROR(major)) + gssEapReleaseName(&tmpMinor, &name); + else + *pName = name; + + return major; } -OM_uint32 gssEapImportName(OM_uint32 *minor, - const gss_buffer_t nameBuffer, - gss_OID nameType, - gss_name_t *name) +OM_uint32 +gssEapImportName(OM_uint32 *minor, + const gss_buffer_t nameBuffer, + gss_OID nameType, + gss_name_t *name) { OM_uint32 major, tmpMinor; @@ -295,7 +334,14 @@ OM_uint32 gssEapImportName(OM_uint32 *minor, oidEqual(nameType, GSS_C_NT_HOSTBASED_SERVICE_X)) major = importServiceName(minor, nameBuffer, name); else if (oidEqual(nameType, GSS_C_NT_EXPORT_NAME)) - major = importExportedName(minor, nameBuffer, name); + major = gssEapImportNameInternal(minor, nameBuffer, name, + EXPORT_NAME_FLAG_OID); +#ifdef HAVE_GSS_C_NT_COMPOSITE_EXPORT + else if (oidEqual(nameType, GSS_C_NT_COMPOSITE_EXPORT)) + major = gssEapImportNameInternal(minor, nameBuffer, name, + EXPORT_NAME_FLAG_OID | + EXPORT_NAME_FLAG_ATTRS); +#endif else major = GSS_S_BAD_NAMETYPE; @@ -305,16 +351,27 @@ OM_uint32 gssEapImportName(OM_uint32 *minor, return major; } -OM_uint32 gssEapExportName(OM_uint32 *minor, - const gss_name_t name, - gss_buffer_t exportedName, - int composite) +OM_uint32 +gssEapExportName(OM_uint32 *minor, + const gss_name_t name, + gss_buffer_t exportedName) +{ + return gssEapExportNameInternal(minor, name, exportedName, + EXPORT_NAME_FLAG_OID); +} + +OM_uint32 +gssEapExportNameInternal(OM_uint32 *minor, + const gss_name_t name, + gss_buffer_t exportedName, + unsigned int flags) { OM_uint32 major = GSS_S_FAILURE, tmpMinor; krb5_context krbContext; char *krbName = NULL; size_t krbNameLen; unsigned char *p; + gss_buffer_desc attrs = GSS_C_EMPTY_BUFFER; exportedName->length = 0; exportedName->value = NULL; @@ -322,44 +379,49 @@ OM_uint32 gssEapExportName(OM_uint32 *minor, GSSEAP_KRB_INIT(&krbContext); GSSEAP_MUTEX_LOCK(&name->mutex); - /* - * Don't export a composite name if we don't have any attributes. - */ - if (composite && !NAME_HAS_ATTRIBUTES(name)) - composite = 0; - *minor = krb5_unparse_name(krbContext, name->krbPrincipal, &krbName); - if (*minor != 0) + if (*minor != 0) { + major = GSS_S_FAILURE; goto cleanup; + } krbNameLen = strlen(krbName); - exportedName->length = 6 + GSS_EAP_MECHANISM->length + 4 + krbNameLen; - if (composite) { - /* TODO: export SAML/AVP, this is pending specification */ - GSSEAP_NOT_IMPLEMENTED; + exportedName->length = 0; + if (flags & EXPORT_NAME_FLAG_OID) { + exportedName->length += 6 + GSS_EAP_MECHANISM->length; + } + exportedName->length += 4 + krbNameLen; + if (flags & EXPORT_NAME_FLAG_ATTRS) { + major = gssEapExportAttrContext(minor, name, &attrs); + if (GSS_ERROR(major)) + goto cleanup; + exportedName->length += 4 + attrs.length; } exportedName->value = GSSEAP_MALLOC(exportedName->length); if (exportedName->value == NULL) { + major = GSS_S_FAILURE; *minor = ENOMEM; goto cleanup; } - - /* TOK | MECH_OID_LEN */ p = (unsigned char *)exportedName->value; - store_uint16_be(composite + + if (flags & EXPORT_NAME_FLAG_OID) { + /* TOK | MECH_OID_LEN */ + store_uint16_be((flags & EXPORT_NAME_FLAG_ATTRS) ? TOK_TYPE_EXPORT_NAME_COMPOSITE : TOK_TYPE_EXPORT_NAME, - p); - p += 2; - store_uint16_be(GSS_EAP_MECHANISM->length + 2, p); - p += 2; - - /* MECH_OID */ - *p++ = 0x06; - *p++ = GSS_EAP_MECHANISM->length & 0xff; - memcpy(p, GSS_EAP_MECHANISM->elements, GSS_EAP_MECHANISM->length); - p += GSS_EAP_MECHANISM->length; + p); + p += 2; + store_uint16_be(GSS_EAP_MECHANISM->length + 2, p); + p += 2; + + /* MECH_OID */ + *p++ = 0x06; + *p++ = GSS_EAP_MECHANISM->length & 0xff; + memcpy(p, GSS_EAP_MECHANISM->elements, GSS_EAP_MECHANISM->length); + p += GSS_EAP_MECHANISM->length; + } /* NAME_LEN */ store_uint32_be(krbNameLen, p); @@ -369,11 +431,18 @@ OM_uint32 gssEapExportName(OM_uint32 *minor, memcpy(p, krbName, krbNameLen); p += krbNameLen; + if (flags & EXPORT_NAME_FLAG_ATTRS) { + store_uint32_be(attrs.length, p); + memcpy(&p[4], attrs.value, attrs.length); + p += 4 + attrs.length; + } + *minor = 0; major = GSS_S_COMPLETE; cleanup: GSSEAP_MUTEX_UNLOCK(&name->mutex); + gss_release_buffer(&tmpMinor, &attrs); if (GSS_ERROR(major)) gss_release_buffer(&tmpMinor, exportedName); krb5_free_unparsed_name(krbContext, krbName);