mech_eap/util_cred.c

   1 /*
   2  * Copyright (c) 2011, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 /*
  34  * Utility routines for credential handles.
  35  */
  36
  37 #include "gssapiP_eap.h"
  38
  39 #ifdef WIN32
  40 # include <shlobj.h>     /* may need to use ShFolder.h instead */
  41 # include <stdio.h>
  42 #else
  43 # include <pwd.h>
  44 #endif
  45
  46 OM_uint32
  47 gssEapAllocCred(OM_uint32 *minor, gss_cred_id_t *pCred)
  48 {
  49     OM_uint32 tmpMinor;
  50     gss_cred_id_t cred;
  51
  52     *pCred = GSS_C_NO_CREDENTIAL;
  53
  54     cred = (gss_cred_id_t)GSSEAP_CALLOC(1, sizeof(*cred));
  55     if (cred == NULL) {
  56         *minor = ENOMEM;
  57         return GSS_S_FAILURE;
  58     }
  59
  60     if (GSSEAP_MUTEX_INIT(&cred->mutex) != 0) {
  61         *minor = GSSEAP_GET_LAST_ERROR();
  62         gssEapReleaseCred(&tmpMinor, &cred);
  63         return GSS_S_FAILURE;
  64     }
  65
  66     *pCred = cred;
  67
  68     *minor = 0;
  69     return GSS_S_COMPLETE;
  70 }
  71
  72 static void
  73 zeroAndReleasePassword(gss_buffer_t password)
  74 {
  75     GSSEAP_ASSERT(password != GSS_C_NO_BUFFER);
  76
  77     if (password->value != NULL) {
  78         memset(password->value, 0, password->length);
  79         GSSEAP_FREE(password->value);
  80     }
  81
  82     password->value = NULL;
  83     password->length = 0;
  84 }
  85
  86 OM_uint32
  87 gssEapReleaseCred(OM_uint32 *minor, gss_cred_id_t *pCred)
  88 {
  89     OM_uint32 tmpMinor;
  90     gss_cred_id_t cred = *pCred;
  91     krb5_context krbContext = NULL;
  92
  93     if (cred == GSS_C_NO_CREDENTIAL) {
  94         return GSS_S_COMPLETE;
  95     }
  96
  97     GSSEAP_KRB_INIT(&krbContext);
  98
  99     gssEapReleaseName(&tmpMinor, &cred->name);
 100     gssEapReleaseName(&tmpMinor, &cred->target);
 101
 102     zeroAndReleasePassword(&cred->password);
 103
 104     gss_release_buffer(&tmpMinor, &cred->radiusConfigFile);
 105     gss_release_buffer(&tmpMinor, &cred->radiusConfigStanza);
 106     gss_release_buffer(&tmpMinor, &cred->caCertificate);
 107     gss_release_buffer(&tmpMinor, &cred->caCertificateBlob);
 108     gss_release_buffer(&tmpMinor, &cred->subjectNameConstraint);
 109     gss_release_buffer(&tmpMinor, &cred->subjectAltNameConstraint);
 110     gss_release_buffer(&tmpMinor, &cred->clientCertificate);
 111     gss_release_buffer(&tmpMinor, &cred->privateKey);
 112
 113 #ifdef GSSEAP_ENABLE_REAUTH
 114     if (cred->krbCredCache != NULL) {
 115         if (cred->flags & CRED_FLAG_DEFAULT_CCACHE)
 116             krb5_cc_close(krbContext, cred->krbCredCache);
 117         else
 118             krb5_cc_destroy(krbContext, cred->krbCredCache);
 119     }
 120     if (cred->reauthCred != GSS_C_NO_CREDENTIAL)
 121         gssReleaseCred(&tmpMinor, &cred->reauthCred);
 122 #endif
 123
 124     GSSEAP_MUTEX_DESTROY(&cred->mutex);
 125     memset(cred, 0, sizeof(*cred));
 126     GSSEAP_FREE(cred);
 127     *pCred = NULL;
 128
 129     *minor = 0;
 130     return GSS_S_COMPLETE;
 131 }
 132
 133 static OM_uint32
 134 readStaticIdentityFile(OM_uint32 *minor,
 135                        gss_buffer_t defaultIdentity,
 136                        gss_buffer_t defaultPassword)
 137 {
 138     OM_uint32 major, tmpMinor;
 139     FILE *fp = NULL;
 140     char buf[BUFSIZ];
 141     char *ccacheName;
 142     int i = 0;
 143 #ifndef WIN32
 144     struct passwd *pw = NULL, pwd;
 145     char pwbuf[BUFSIZ];
 146 #endif
 147
 148     defaultIdentity->length = 0;
 149     defaultIdentity->value = NULL;
 150
 151     if (defaultPassword != GSS_C_NO_BUFFER) {
 152         defaultPassword->length = 0;
 153         defaultPassword->value = NULL;
 154     }
 155
 156     ccacheName = getenv("GSSEAP_IDENTITY");
 157     if (ccacheName == NULL) {
 158 #ifdef WIN32
 159         TCHAR szPath[MAX_PATH];
 160
 161         if (!SUCCEEDED(SHGetFolderPath(NULL,
 162                                        CSIDL_APPDATA, /* |CSIDL_FLAG_CREATE */
 163                                        NULL, /* User access token */
 164                                        0,    /* SHGFP_TYPE_CURRENT */
 165                                        szPath))) {
 166             major = GSS_S_CRED_UNAVAIL;
 167             *minor = GSSEAP_GET_LAST_ERROR(); /* XXX */
 168             goto cleanup;
 169         }
 170
 171         snprintf(buf, sizeof(buf), "%s/.gss_eap_id", szPath);
 172 #else
 173         if (getpwuid_r(getuid(), &pwd, pwbuf, sizeof(pwbuf), &pw) != 0 ||
 174             pw == NULL || pw->pw_dir == NULL) {
 175             major = GSS_S_CRED_UNAVAIL;
 176             *minor = GSSEAP_GET_LAST_ERROR();
 177             goto cleanup;
 178         }
 179
 180         snprintf(buf, sizeof(buf), "%s/.gss_eap_id", pw->pw_dir);
 181 #endif /* WIN32 */
 182         ccacheName = buf;
 183     }
 184
 185     fp = fopen(ccacheName, "r");
 186     if (fp == NULL) {
 187         major = GSS_S_CRED_UNAVAIL;
 188         *minor = GSSEAP_NO_DEFAULT_CRED;
 189         goto cleanup;
 190     }
 191
 192     while (fgets(buf, sizeof(buf), fp) != NULL) {
 193         gss_buffer_desc src, *dst;
 194
 195         src.length = strlen(buf);
 196         src.value = buf;
 197
 198         if (src.length == 0)
 199             break;
 200
 201         if (buf[src.length - 1] == '\n') {
 202             buf[src.length - 1] = '\0';
 203             if (--src.length == 0)
 204                 break;
 205         }
 206
 207         if (i == 0)
 208             dst = defaultIdentity;
 209         else if (i == 1)
 210             dst = defaultPassword;
 211         else
 212             break;
 213
 214         if (dst != GSS_C_NO_BUFFER) {
 215             major = duplicateBuffer(minor, &src, dst);
 216             if (GSS_ERROR(major))
 217                 goto cleanup;
 218         }
 219
 220         i++;
 221     }
 222
 223     if (defaultIdentity->length == 0) {
 224         major = GSS_S_CRED_UNAVAIL;
 225         *minor = GSSEAP_NO_DEFAULT_CRED;
 226         goto cleanup;
 227     }
 228
 229     major = GSS_S_COMPLETE;
 230     *minor = 0;
 231
 232 cleanup:
 233     if (fp != NULL)
 234         fclose(fp);
 235
 236     if (GSS_ERROR(major)) {
 237         gss_release_buffer(&tmpMinor, defaultIdentity);
 238         zeroAndReleasePassword(defaultPassword);
 239     }
 240
 241     memset(buf, 0, sizeof(buf));
 242
 243     return major;
 244 }
 245
 246 gss_OID
 247 gssEapPrimaryMechForCred(gss_cred_id_t cred)
 248 {
 249     gss_OID credMech = GSS_C_NO_OID;
 250
 251     if (cred != GSS_C_NO_CREDENTIAL &&
 252         cred->mechanisms != GSS_C_NO_OID_SET &&
 253         cred->mechanisms->count == 1)
 254         credMech = &cred->mechanisms->elements[0];
 255
 256     return credMech;
 257 }
 258
 259 OM_uint32
 260 gssEapAcquireCred(OM_uint32 *minor,
 261                   const gss_name_t desiredName,
 262                   OM_uint32 timeReq GSSEAP_UNUSED,
 263                   const gss_OID_set desiredMechs,
 264                   int credUsage,
 265                   gss_cred_id_t *pCred,
 266                   gss_OID_set *pActualMechs,
 267                   OM_uint32 *timeRec)
 268 {
 269     OM_uint32 major, tmpMinor;
 270     gss_cred_id_t cred;
 271
 272     /* XXX TODO validate with changed set_cred_option API */
 273     *pCred = GSS_C_NO_CREDENTIAL;
 274
 275     major = gssEapAllocCred(minor, &cred);
 276     if (GSS_ERROR(major))
 277         goto cleanup;
 278
 279     switch (credUsage) {
 280     case GSS_C_BOTH:
 281         cred->flags |= CRED_FLAG_INITIATE | CRED_FLAG_ACCEPT;
 282         break;
 283     case GSS_C_INITIATE:
 284         cred->flags |= CRED_FLAG_INITIATE;
 285         break;
 286     case GSS_C_ACCEPT:
 287         cred->flags |= CRED_FLAG_ACCEPT;
 288         break;
 289     default:
 290         major = GSS_S_FAILURE;
 291         *minor = GSSEAP_BAD_USAGE;
 292         goto cleanup;
 293         break;
 294     }
 295
 296     major = gssEapValidateMechs(minor, desiredMechs);
 297     if (GSS_ERROR(major))
 298         goto cleanup;
 299
 300     major = duplicateOidSet(minor, desiredMechs, &cred->mechanisms);
 301     if (GSS_ERROR(major))
 302         goto cleanup;
 303
 304     if (desiredName != GSS_C_NO_NAME) {
 305         GSSEAP_MUTEX_LOCK(&desiredName->mutex);
 306
 307         major = gssEapDuplicateName(minor, desiredName, &cred->name);
 308         if (GSS_ERROR(major)) {
 309             GSSEAP_MUTEX_UNLOCK(&desiredName->mutex);
 310             goto cleanup;
 311         }
 312
 313         GSSEAP_MUTEX_UNLOCK(&desiredName->mutex);
 314     }
 315
 316 #ifdef GSSEAP_ENABLE_ACCEPTOR
 317     if (cred->flags & CRED_FLAG_ACCEPT) {
 318         struct rs_context *radContext;
 319
 320         major = gssEapCreateRadiusContext(minor, cred, &radContext);
 321         if (GSS_ERROR(major))
 322             goto cleanup;
 323
 324         rs_context_destroy(radContext);
 325     }
 326 #endif
 327
 328     if (pActualMechs != NULL) {
 329         major = duplicateOidSet(minor, cred->mechanisms, pActualMechs);
 330         if (GSS_ERROR(major))
 331             goto cleanup;
 332     }
 333
 334     if (timeRec != NULL)
 335         *timeRec = GSS_C_INDEFINITE;
 336
 337     *pCred = cred;
 338
 339     major = GSS_S_COMPLETE;
 340     *minor = 0;
 341
 342 cleanup:
 343     if (GSS_ERROR(major))
 344         gssEapReleaseCred(&tmpMinor, &cred);
 345
 346     gssEapTraceStatus("gss_acquire_cred", major, *minor);
 347     return major;
 348 }
 349
 350 /*
 351  * Return TRUE if cred available for mechanism. Caller need no acquire
 352  * lock because mechanisms list is immutable.
 353  */
 354 int
 355 gssEapCredAvailable(gss_cred_id_t cred, gss_OID mech)
 356 {
 357     OM_uint32 minor;
 358     int present = 0;
 359
 360     GSSEAP_ASSERT(mech != GSS_C_NO_OID);
 361
 362     if (cred == GSS_C_NO_CREDENTIAL || cred->mechanisms == GSS_C_NO_OID_SET)
 363         return TRUE;
 364
 365     gss_test_oid_set_member(&minor, mech, cred->mechanisms, &present);
 366
 367     return present;
 368 }
 369
 370 static OM_uint32
 371 staticIdentityFileResolveDefaultIdentity(OM_uint32 *minor,
 372                                          const gss_cred_id_t cred,
 373                                          gss_name_t *pName)
 374 {
 375     OM_uint32 major, tmpMinor;
 376     gss_OID nameMech = gssEapPrimaryMechForCred(cred);
 377     gss_buffer_desc defaultIdentity = GSS_C_EMPTY_BUFFER;
 378
 379     *pName = GSS_C_NO_NAME;
 380
 381     major = readStaticIdentityFile(minor, &defaultIdentity, GSS_C_NO_BUFFER);
 382     if (major == GSS_S_COMPLETE) {
 383         major = gssEapImportName(minor, &defaultIdentity, GSS_C_NT_USER_NAME,
 384                                  nameMech, pName);
 385     }
 386
 387     gss_release_buffer(&tmpMinor, &defaultIdentity);
 388
 389     return major;
 390 }
 391
 392 static OM_uint32
 393 gssEapResolveCredIdentity(OM_uint32 *minor,
 394                           gss_cred_id_t cred)
 395 {
 396     OM_uint32 major;
 397     gss_OID nameMech = gssEapPrimaryMechForCred(cred);
 398
 399     if (cred->name != GSS_C_NO_NAME) {
 400         *minor = 0;
 401         return GSS_S_COMPLETE;
 402     }
 403
 404     if (cred->flags & CRED_FLAG_ACCEPT) {
 405         gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER;
 406         char serviceName[5 + MAXHOSTNAMELEN];
 407
 408         /* default host-based service is host@localhost */
 409         memcpy(serviceName, "host@", 5);
 410         if (gethostname(&serviceName[5], MAXHOSTNAMELEN) != 0) {
 411             *minor = GSSEAP_NO_HOSTNAME;
 412             return GSS_S_FAILURE;
 413         }
 414
 415         nameBuf.value = serviceName;
 416         nameBuf.length = strlen((char *)nameBuf.value);
 417
 418         major = gssEapImportName(minor, &nameBuf, GSS_C_NT_HOSTBASED_SERVICE,
 419                                  nameMech, &cred->name);
 420         if (GSS_ERROR(major))
 421             return major;
 422     } else if (cred->flags & CRED_FLAG_INITIATE) {
 423 #ifdef HAVE_MOONSHOT_GET_IDENTITY
 424         major = libMoonshotResolveDefaultIdentity(minor, cred, &cred->name);
 425         if (major == GSS_S_CRED_UNAVAIL)
 426 #endif
 427             major = staticIdentityFileResolveDefaultIdentity(minor, cred, &cred->name);
 428         if (major != GSS_S_CRED_UNAVAIL)
 429             return major;
 430     }
 431
 432     *minor = 0;
 433     return GSS_S_COMPLETE;
 434 }
 435
 436 OM_uint32
 437 gssEapInquireCred(OM_uint32 *minor,
 438                   gss_cred_id_t cred,
 439                   gss_name_t *name,
 440                   OM_uint32 *pLifetime,
 441                   gss_cred_usage_t *cred_usage,
 442                   gss_OID_set *mechanisms)
 443 {
 444     OM_uint32 major;
 445     time_t now, lifetime;
 446
 447     if (name != NULL) {
 448         major = gssEapResolveCredIdentity(minor, cred);
 449         if (GSS_ERROR(major))
 450             goto cleanup;
 451
 452         if (cred->name != GSS_C_NO_NAME) {
 453             major = gssEapDuplicateName(minor, cred->name, name);
 454             if (GSS_ERROR(major))
 455                 goto cleanup;
 456         } else
 457             *name = GSS_C_NO_NAME;
 458     }
 459
 460     if (cred_usage != NULL) {
 461         OM_uint32 flags = (cred->flags & (CRED_FLAG_INITIATE | CRED_FLAG_ACCEPT));
 462
 463         switch (flags) {
 464         case CRED_FLAG_INITIATE:
 465             *cred_usage = GSS_C_INITIATE;
 466             break;
 467         case CRED_FLAG_ACCEPT:
 468             *cred_usage = GSS_C_ACCEPT;
 469             break;
 470         default:
 471             *cred_usage = GSS_C_BOTH;
 472             break;
 473         }
 474     }
 475
 476     if (mechanisms != NULL) {
 477         if (cred->mechanisms != GSS_C_NO_OID_SET)
 478             major = duplicateOidSet(minor, cred->mechanisms, mechanisms);
 479         else
 480             major = gssEapIndicateMechs(minor, mechanisms);
 481         if (GSS_ERROR(major))
 482             goto cleanup;
 483     }
 484
 485     if (cred->expiryTime == 0) {
 486         lifetime = GSS_C_INDEFINITE;
 487     } else  {
 488         now = time(NULL);
 489         lifetime = now - cred->expiryTime;
 490         if (lifetime < 0)
 491             lifetime = 0;
 492     }
 493
 494     if (pLifetime != NULL) {
 495         *pLifetime = lifetime;
 496     }
 497
 498     if (lifetime == 0) {
 499         major = GSS_S_CREDENTIALS_EXPIRED;
 500         *minor = GSSEAP_CRED_EXPIRED;
 501         goto cleanup;
 502     }
 503
 504     major = GSS_S_COMPLETE;
 505     *minor = 0;
 506
 507 cleanup:
 508     return major;
 509 }
 510
 511 OM_uint32
 512 gssEapSetCredPassword(OM_uint32 *minor,
 513                       gss_cred_id_t cred,
 514                       const gss_buffer_t password)
 515 {
 516     OM_uint32 major, tmpMinor;
 517     gss_buffer_desc newPassword = GSS_C_EMPTY_BUFFER;
 518
 519     if (cred->flags & CRED_FLAG_RESOLVED) {
 520         major = GSS_S_FAILURE;
 521         *minor = GSSEAP_CRED_RESOLVED;
 522         goto cleanup;
 523     }
 524
 525     if (password != GSS_C_NO_BUFFER) {
 526         major = duplicateBuffer(minor, password, &newPassword);
 527         if (GSS_ERROR(major))
 528             goto cleanup;
 529
 530         cred->flags |= CRED_FLAG_PASSWORD;
 531     } else {
 532         cred->flags &= ~(CRED_FLAG_PASSWORD);
 533     }
 534
 535     gss_release_buffer(&tmpMinor, &cred->password);
 536     cred->password = newPassword;
 537
 538     major = GSS_S_COMPLETE;
 539     *minor = 0;
 540
 541 cleanup:
 542     return major;
 543 }
 544
 545 /*
 546  * Currently only the privateKey path is exposed to the application
 547  * (via gss_set_cred_option() or the third line in ~/.gss_eap_id).
 548  * At some point in the future we may add support for setting the
 549  * client certificate separately.
 550  */
 551 OM_uint32
 552 gssEapSetCredClientCertificate(OM_uint32 *minor,
 553                               gss_cred_id_t cred,
 554                               const gss_buffer_t clientCert,
 555                               const gss_buffer_t privateKey)
 556 {
 557     OM_uint32 major, tmpMinor;
 558     gss_buffer_desc newClientCert = GSS_C_EMPTY_BUFFER;
 559     gss_buffer_desc newPrivateKey = GSS_C_EMPTY_BUFFER;
 560
 561     if (cred->flags & CRED_FLAG_RESOLVED) {
 562         major = GSS_S_FAILURE;
 563         *minor = GSSEAP_CRED_RESOLVED;
 564         goto cleanup;
 565     }
 566
 567     if (clientCert == GSS_C_NO_BUFFER &&
 568         privateKey == GSS_C_NO_BUFFER) {
 569         cred->flags &= ~(CRED_FLAG_CERTIFICATE);
 570         major = GSS_S_COMPLETE;
 571         *minor = 0;
 572         goto cleanup;
 573     }
 574
 575     if (clientCert != GSS_C_NO_BUFFER) {
 576         major = duplicateBuffer(minor, clientCert, &newClientCert);
 577         if (GSS_ERROR(major))
 578             goto cleanup;
 579     }
 580
 581     if (privateKey != GSS_C_NO_BUFFER) {
 582         major = duplicateBuffer(minor, privateKey, &newPrivateKey);
 583         if (GSS_ERROR(major))
 584             goto cleanup;
 585     }
 586
 587     cred->flags |= CRED_FLAG_CERTIFICATE;
 588
 589     gss_release_buffer(&tmpMinor, &cred->clientCertificate);
 590     cred->clientCertificate = newClientCert;
 591
 592     gss_release_buffer(&tmpMinor, &cred->privateKey);
 593     cred->privateKey = newPrivateKey;
 594
 595     major = GSS_S_COMPLETE;
 596     *minor = 0;
 597
 598 cleanup:
 599     if (GSS_ERROR(major)) {
 600         gss_release_buffer(&tmpMinor, &newClientCert);
 601         gss_release_buffer(&tmpMinor, &newPrivateKey);
 602     }
 603
 604     return major;
 605 }
 606
 607 OM_uint32
 608 gssEapSetCredService(OM_uint32 *minor,
 609                      gss_cred_id_t cred,
 610                      const gss_name_t target)
 611 {
 612     OM_uint32 major, tmpMinor;
 613     gss_name_t newTarget = GSS_C_NO_NAME;
 614
 615     if (cred->flags & CRED_FLAG_RESOLVED) {
 616         major = GSS_S_FAILURE;
 617         *minor = GSSEAP_CRED_RESOLVED;
 618         goto cleanup;
 619     }
 620
 621     if (target != GSS_C_NO_NAME) {
 622         major = gssEapDuplicateName(minor, target, &newTarget);
 623         if (GSS_ERROR(major))
 624             goto cleanup;
 625
 626         cred->flags |= CRED_FLAG_TARGET;
 627     } else {
 628         cred->flags &= ~(CRED_FLAG_TARGET);
 629     }
 630
 631     gssEapReleaseName(&tmpMinor, &cred->target);
 632     cred->target = newTarget;
 633
 634     major = GSS_S_COMPLETE;
 635     *minor = 0;
 636
 637 cleanup:
 638     return major;
 639 }
 640
 641 static OM_uint32
 642 gssEapDuplicateCred(OM_uint32 *minor,
 643                     const gss_cred_id_t src,
 644                     gss_cred_id_t *pDst)
 645 {
 646     OM_uint32 major, tmpMinor;
 647     gss_cred_id_t dst = GSS_C_NO_CREDENTIAL;
 648
 649     *pDst = GSS_C_NO_CREDENTIAL;
 650
 651     major = gssEapAllocCred(minor, &dst);
 652     if (GSS_ERROR(major))
 653         goto cleanup;
 654
 655     dst->flags = src->flags;
 656
 657     if (src->name != GSS_C_NO_NAME) {
 658         major = gssEapDuplicateName(minor, src->name, &dst->name);
 659         if (GSS_ERROR(major))
 660             goto cleanup;
 661     }
 662
 663     if (src->target != GSS_C_NO_NAME) {
 664         major = gssEapDuplicateName(minor, src->target, &dst->target);
 665         if (GSS_ERROR(major))
 666             goto cleanup;
 667     }
 668
 669     if (src->password.value != NULL) {
 670         major = duplicateBuffer(minor, &src->password, &dst->password);
 671         if (GSS_ERROR(major))
 672             goto cleanup;
 673     }
 674
 675     major = duplicateOidSet(minor, src->mechanisms, &dst->mechanisms);
 676     if (GSS_ERROR(major))
 677         goto cleanup;
 678
 679     dst->expiryTime = src->expiryTime;
 680
 681     if (src->radiusConfigFile.value != NULL)
 682         duplicateBufferOrCleanup(&src->radiusConfigFile, &dst->radiusConfigFile);
 683     if (src->radiusConfigStanza.value != NULL)
 684         duplicateBufferOrCleanup(&src->radiusConfigStanza, &dst->radiusConfigStanza);
 685     if (src->caCertificate.value != NULL)
 686         duplicateBufferOrCleanup(&src->caCertificate, &dst->caCertificate);
 687     if (src->caCertificateBlob.value != NULL)
 688         duplicateBufferOrCleanup(&src->caCertificateBlob, &dst->caCertificateBlob);
 689     if (src->subjectNameConstraint.value != NULL)
 690         duplicateBufferOrCleanup(&src->subjectNameConstraint, &dst->subjectNameConstraint);
 691     if (src->subjectAltNameConstraint.value != NULL)
 692         duplicateBufferOrCleanup(&src->subjectAltNameConstraint, &dst->subjectAltNameConstraint);
 693     if (src->clientCertificate.value != NULL)
 694         duplicateBufferOrCleanup(&src->clientCertificate, &dst->clientCertificate);
 695     if (src->privateKey.value != NULL)
 696         duplicateBufferOrCleanup(&src->privateKey, &dst->privateKey);
 697
 698 #ifdef GSSEAP_ENABLE_REAUTH
 699     /* XXX krbCredCache, reauthCred */
 700 #endif
 701
 702     *pDst = dst;
 703     dst = GSS_C_NO_CREDENTIAL;
 704
 705     major = GSS_S_COMPLETE;
 706     *minor = 0;
 707
 708 cleanup:
 709     gssEapReleaseCred(&tmpMinor, &dst);
 710
 711     return major;
 712 }
 713
 714 static OM_uint32
 715 staticIdentityFileResolveInitiatorCred(OM_uint32 *minor, gss_cred_id_t cred)
 716 {
 717     OM_uint32 major, tmpMinor;
 718     gss_buffer_desc defaultIdentity = GSS_C_EMPTY_BUFFER;
 719     gss_name_t defaultIdentityName = GSS_C_NO_NAME;
 720     gss_buffer_desc defaultPassword = GSS_C_EMPTY_BUFFER;
 721     int isDefaultIdentity = FALSE;
 722
 723     major = readStaticIdentityFile(minor, &defaultIdentity, &defaultPassword);
 724     if (GSS_ERROR(major))
 725         goto cleanup;
 726
 727     major = gssEapImportName(minor, &defaultIdentity, GSS_C_NT_USER_NAME,
 728                              gssEapPrimaryMechForCred(cred), &defaultIdentityName);
 729     if (GSS_ERROR(major))
 730         goto cleanup;
 731
 732     if (defaultIdentityName == GSS_C_NO_NAME) {
 733         if (cred->name == GSS_C_NO_NAME) {
 734             major = GSS_S_CRED_UNAVAIL;
 735             *minor = GSSEAP_NO_DEFAULT_IDENTITY;
 736             goto cleanup;
 737         }
 738     } else {
 739         if (cred->name == GSS_C_NO_NAME) {
 740             cred->name = defaultIdentityName;
 741             defaultIdentityName = GSS_C_NO_NAME;
 742             isDefaultIdentity = TRUE;
 743         } else {
 744             major = gssEapCompareName(minor, cred->name,
 745                                       defaultIdentityName, 0,
 746                                       &isDefaultIdentity);
 747             if (GSS_ERROR(major))
 748                 goto cleanup;
 749         }
 750     }
 751
 752     if (isDefaultIdentity &&
 753         (cred->flags & CRED_FLAG_PASSWORD) == 0) {
 754         major = gssEapSetCredPassword(minor, cred, &defaultPassword);
 755         if (GSS_ERROR(major))
 756             goto cleanup;
 757     }
 758
 759 cleanup:
 760     gssEapReleaseName(&tmpMinor, &defaultIdentityName);
 761     zeroAndReleasePassword(&defaultPassword);
 762     gss_release_buffer(&tmpMinor, &defaultIdentity);
 763
 764     return major;
 765 }
 766
 767 OM_uint32
 768 gssEapResolveInitiatorCred(OM_uint32 *minor,
 769                            const gss_cred_id_t cred,
 770                            const gss_name_t targetName
 771 #ifndef HAVE_MOONSHOT_GET_IDENTITY
 772                                                        GSSEAP_UNUSED
 773 #endif
 774                            ,
 775                            gss_cred_id_t *pResolvedCred)
 776 {
 777     OM_uint32 major, tmpMinor;
 778     gss_cred_id_t resolvedCred = GSS_C_NO_CREDENTIAL;
 779
 780     if (cred == GSS_C_NO_CREDENTIAL) {
 781         major = gssEapAcquireCred(minor,
 782                                   GSS_C_NO_NAME,
 783                                   GSS_C_INDEFINITE,
 784                                   GSS_C_NO_OID_SET,
 785                                   GSS_C_INITIATE,
 786                                   &resolvedCred,
 787                                   NULL,
 788                                   NULL);
 789         if (GSS_ERROR(major))
 790             goto cleanup;
 791     } else {
 792         if ((cred->flags & CRED_FLAG_INITIATE) == 0) {
 793             major = GSS_S_NO_CRED;
 794             *minor = GSSEAP_CRED_USAGE_MISMATCH;
 795             goto cleanup;
 796         }
 797
 798         major = gssEapDuplicateCred(minor, cred, &resolvedCred);
 799         if (GSS_ERROR(major))
 800             goto cleanup;
 801     }
 802
 803     if ((resolvedCred->flags & CRED_FLAG_RESOLVED) == 0) {
 804 #ifdef HAVE_MOONSHOT_GET_IDENTITY
 805         major = libMoonshotResolveInitiatorCred(minor, resolvedCred, targetName);
 806         if (major == GSS_S_CRED_UNAVAIL)
 807 #endif
 808             major = staticIdentityFileResolveInitiatorCred(minor, resolvedCred);
 809         if (GSS_ERROR(major) && major != GSS_S_CRED_UNAVAIL)
 810             goto cleanup;
 811
 812         /* If we have a caller-supplied password, the credential is resolved. */
 813         if ((resolvedCred->flags &
 814              (CRED_FLAG_PASSWORD | CRED_FLAG_CERTIFICATE)) == 0) {
 815             major = GSS_S_CRED_UNAVAIL;
 816             *minor = GSSEAP_NO_DEFAULT_CRED;
 817             goto cleanup;
 818         }
 819
 820         resolvedCred->flags |= CRED_FLAG_RESOLVED;
 821     }
 822
 823     *pResolvedCred = resolvedCred;
 824     resolvedCred = GSS_C_NO_CREDENTIAL;
 825
 826     major = GSS_S_COMPLETE;
 827     *minor = 0;
 828
 829 cleanup:
 830     gssEapReleaseCred(&tmpMinor, &resolvedCred);
 831
 832     return major;
 833 }