mech_eap/util_cred.c

   1 /*
   2  * Copyright (c) 2011, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 /*
  34  * Utility routines for credential handles.
  35  */
  36
  37 #include "gssapiP_eap.h"
  38
  39 #ifdef WIN32
  40 # include <shlobj.h>     /* may need to use ShFolder.h instead */
  41 # include <stdio.h>
  42 #else
  43 # include <pwd.h>
  44 #endif
  45
  46 OM_uint32
  47 gssEapAllocCred(OM_uint32 *minor, gss_cred_id_t *pCred)
  48 {
  49     OM_uint32 tmpMinor;
  50     gss_cred_id_t cred;
  51
  52     *pCred = GSS_C_NO_CREDENTIAL;
  53
  54     cred = (gss_cred_id_t)GSSEAP_CALLOC(1, sizeof(*cred));
  55     if (cred == NULL) {
  56         *minor = ENOMEM;
  57         return GSS_S_FAILURE;
  58     }
  59
  60     if (GSSEAP_MUTEX_INIT(&cred->mutex) != 0) {
  61         *minor = GSSEAP_GET_LAST_ERROR();
  62         gssEapReleaseCred(&tmpMinor, &cred);
  63         return GSS_S_FAILURE;
  64     }
  65
  66     *pCred = cred;
  67
  68     *minor = 0;
  69     return GSS_S_COMPLETE;
  70 }
  71
  72 static void
  73 zeroAndReleasePassword(gss_buffer_t password)
  74 {
  75     GSSEAP_ASSERT(password != GSS_C_NO_BUFFER);
  76
  77     if (password->value != NULL) {
  78         memset(password->value, 0, password->length);
  79         GSSEAP_FREE(password->value);
  80     }
  81
  82     password->value = NULL;
  83     password->length = 0;
  84 }
  85
  86 OM_uint32
  87 gssEapReleaseCred(OM_uint32 *minor, gss_cred_id_t *pCred)
  88 {
  89     OM_uint32 tmpMinor;
  90     gss_cred_id_t cred = *pCred;
  91     krb5_context krbContext = NULL;
  92
  93     if (cred == GSS_C_NO_CREDENTIAL) {
  94         return GSS_S_COMPLETE;
  95     }
  96
  97     GSSEAP_KRB_INIT(&krbContext);
  98
  99     gssEapReleaseName(&tmpMinor, &cred->name);
 100     gssEapReleaseName(&tmpMinor, &cred->target);
 101
 102     zeroAndReleasePassword(&cred->password);
 103
 104     gss_release_buffer(&tmpMinor, &cred->radiusConfigFile);
 105     gss_release_buffer(&tmpMinor, &cred->radiusConfigStanza);
 106     gss_release_buffer(&tmpMinor, &cred->caCertificate);
 107     gss_release_buffer(&tmpMinor, &cred->caCertificateBlob);
 108     gss_release_buffer(&tmpMinor, &cred->subjectNameConstraint);
 109     gss_release_buffer(&tmpMinor, &cred->subjectAltNameConstraint);
 110     gss_release_buffer(&tmpMinor, &cred->clientCertificate);
 111     gss_release_buffer(&tmpMinor, &cred->privateKey);
 112
 113 #ifdef GSSEAP_ENABLE_REAUTH
 114     if (cred->krbCredCache != NULL) {
 115         if (cred->flags & CRED_FLAG_DEFAULT_CCACHE)
 116             krb5_cc_close(krbContext, cred->krbCredCache);
 117         else
 118             krb5_cc_destroy(krbContext, cred->krbCredCache);
 119     }
 120     if (cred->reauthCred != GSS_C_NO_CREDENTIAL)
 121         gssReleaseCred(&tmpMinor, &cred->reauthCred);
 122 #endif
 123
 124     GSSEAP_MUTEX_DESTROY(&cred->mutex);
 125     memset(cred, 0, sizeof(*cred));
 126     GSSEAP_FREE(cred);
 127     *pCred = NULL;
 128
 129     *minor = 0;
 130     return GSS_S_COMPLETE;
 131 }
 132
 133 static OM_uint32
 134 readStaticIdentityFile(OM_uint32 *minor,
 135                        gss_buffer_t defaultIdentity,
 136                        gss_buffer_t defaultPassword)
 137 {
 138     OM_uint32 major, tmpMinor;
 139     FILE *fp = NULL;
 140     char buf[BUFSIZ];
 141     char *ccacheName;
 142     int i = 0;
 143 #ifndef WIN32
 144     struct passwd *pw = NULL, pwd;
 145     char pwbuf[BUFSIZ];
 146 #endif
 147
 148     defaultIdentity->length = 0;
 149     defaultIdentity->value = NULL;
 150
 151     if (defaultPassword != GSS_C_NO_BUFFER) {
 152         defaultPassword->length = 0;
 153         defaultPassword->value = NULL;
 154     }
 155
 156     ccacheName = getenv("GSSEAP_IDENTITY");
 157     if (ccacheName == NULL) {
 158 #ifdef WIN32
 159         TCHAR szPath[MAX_PATH];
 160
 161         if (!SUCCEEDED(SHGetFolderPath(NULL,
 162                                        CSIDL_APPDATA, /* |CSIDL_FLAG_CREATE */
 163                                        NULL, /* User access token */
 164                                        0,    /* SHGFP_TYPE_CURRENT */
 165                                        szPath))) {
 166             major = GSS_S_CRED_UNAVAIL;
 167             *minor = GSSEAP_GET_LAST_ERROR(); /* XXX */
 168             goto cleanup;
 169         }
 170
 171         snprintf(buf, sizeof(buf), "%s/.gss_eap_id", szPath);
 172 #else
 173         if (getpwuid_r(getuid(), &pwd, pwbuf, sizeof(pwbuf), &pw) != 0 ||
 174             pw == NULL || pw->pw_dir == NULL) {
 175             major = GSS_S_CRED_UNAVAIL;
 176             *minor = GSSEAP_GET_LAST_ERROR();
 177             goto cleanup;
 178         }
 179
 180         snprintf(buf, sizeof(buf), "%s/.gss_eap_id", pw->pw_dir);
 181 #endif /* WIN32 */
 182         ccacheName = buf;
 183     }
 184
 185     fp = fopen(ccacheName, "r");
 186     if (fp == NULL) {
 187         major = GSS_S_CRED_UNAVAIL;
 188         *minor = GSSEAP_NO_DEFAULT_CRED;
 189         goto cleanup;
 190     }
 191
 192     while (fgets(buf, sizeof(buf), fp) != NULL) {
 193         gss_buffer_desc src, *dst;
 194
 195         src.length = strlen(buf);
 196         src.value = buf;
 197
 198         if (src.length == 0)
 199             break;
 200
 201         if (buf[src.length - 1] == '\n') {
 202             buf[src.length - 1] = '\0';
 203             if (--src.length == 0)
 204                 break;
 205         }
 206
 207         if (i == 0)
 208             dst = defaultIdentity;
 209         else if (i == 1)
 210             dst = defaultPassword;
 211         else
 212             break;
 213
 214         if (dst != GSS_C_NO_BUFFER) {
 215             major = duplicateBuffer(minor, &src, dst);
 216             if (GSS_ERROR(major))
 217                 goto cleanup;
 218         }
 219
 220         i++;
 221     }
 222
 223     if (defaultIdentity->length == 0) {
 224         major = GSS_S_CRED_UNAVAIL;
 225         *minor = GSSEAP_NO_DEFAULT_CRED;
 226         goto cleanup;
 227     }
 228
 229     major = GSS_S_COMPLETE;
 230     *minor = 0;
 231
 232 cleanup:
 233     if (fp != NULL)
 234         fclose(fp);
 235
 236     if (GSS_ERROR(major)) {
 237         gss_release_buffer(&tmpMinor, defaultIdentity);
 238         zeroAndReleasePassword(defaultPassword);
 239     }
 240
 241     memset(buf, 0, sizeof(buf));
 242
 243     return major;
 244 }
 245
 246 gss_OID
 247 gssEapPrimaryMechForCred(gss_cred_id_t cred)
 248 {
 249     gss_OID credMech = GSS_C_NO_OID;
 250
 251     if (cred != GSS_C_NO_CREDENTIAL &&
 252         cred->mechanisms != GSS_C_NO_OID_SET &&
 253         cred->mechanisms->count == 1)
 254         credMech = &cred->mechanisms->elements[0];
 255
 256     return credMech;
 257 }
 258
 259 OM_uint32
 260 gssEapAcquireCred(OM_uint32 *minor,
 261                   const gss_name_t desiredName,
 262                   OM_uint32 timeReq GSSEAP_UNUSED,
 263                   const gss_OID_set desiredMechs,
 264                   int credUsage,
 265                   gss_cred_id_t *pCred,
 266                   gss_OID_set *pActualMechs,
 267                   OM_uint32 *timeRec)
 268 {
 269     OM_uint32 major, tmpMinor;
 270     gss_cred_id_t cred;
 271
 272     /* XXX TODO validate with changed set_cred_option API */
 273     *pCred = GSS_C_NO_CREDENTIAL;
 274
 275     major = gssEapAllocCred(minor, &cred);
 276     if (GSS_ERROR(major))
 277         goto cleanup;
 278
 279     switch (credUsage) {
 280     case GSS_C_BOTH:
 281         cred->flags |= CRED_FLAG_INITIATE | CRED_FLAG_ACCEPT;
 282         break;
 283     case GSS_C_INITIATE:
 284         cred->flags |= CRED_FLAG_INITIATE;
 285         break;
 286     case GSS_C_ACCEPT:
 287         cred->flags |= CRED_FLAG_ACCEPT;
 288         break;
 289     default:
 290         major = GSS_S_FAILURE;
 291         *minor = GSSEAP_BAD_USAGE;
 292         goto cleanup;
 293         break;
 294     }
 295
 296     major = gssEapValidateMechs(minor, desiredMechs);
 297     if (GSS_ERROR(major))
 298         goto cleanup;
 299
 300     major = duplicateOidSet(minor, desiredMechs, &cred->mechanisms);
 301     if (GSS_ERROR(major))
 302         goto cleanup;
 303
 304     if (desiredName != GSS_C_NO_NAME) {
 305         GSSEAP_MUTEX_LOCK(&desiredName->mutex);
 306
 307         major = gssEapDuplicateName(minor, desiredName, &cred->name);
 308         if (GSS_ERROR(major)) {
 309             GSSEAP_MUTEX_UNLOCK(&desiredName->mutex);
 310             goto cleanup;
 311         }
 312
 313         GSSEAP_MUTEX_UNLOCK(&desiredName->mutex);
 314     }
 315
 316 #ifdef GSSEAP_ENABLE_ACCEPTOR
 317     if (cred->flags & CRED_FLAG_ACCEPT) {
 318         struct rs_context *radContext;
 319
 320         major = gssEapCreateRadiusContext(minor, cred, &radContext);
 321         if (GSS_ERROR(major))
 322             goto cleanup;
 323
 324         rs_context_destroy(radContext);
 325     }
 326 #endif
 327
 328     if (pActualMechs != NULL) {
 329         major = duplicateOidSet(minor, cred->mechanisms, pActualMechs);
 330         if (GSS_ERROR(major))
 331             goto cleanup;
 332     }
 333
 334     if (timeRec != NULL)
 335         *timeRec = GSS_C_INDEFINITE;
 336
 337     *pCred = cred;
 338
 339     major = GSS_S_COMPLETE;
 340     *minor = 0;
 341
 342 cleanup:
 343     if (GSS_ERROR(major))
 344         gssEapReleaseCred(&tmpMinor, &cred);
 345
 346     return major;
 347 }
 348
 349 /*
 350  * Return TRUE if cred available for mechanism. Caller need no acquire
 351  * lock because mechanisms list is immutable.
 352  */
 353 int
 354 gssEapCredAvailable(gss_cred_id_t cred, gss_OID mech)
 355 {
 356     OM_uint32 minor;
 357     int present = 0;
 358
 359     GSSEAP_ASSERT(mech != GSS_C_NO_OID);
 360
 361     if (cred == GSS_C_NO_CREDENTIAL || cred->mechanisms == GSS_C_NO_OID_SET)
 362         return TRUE;
 363
 364     gss_test_oid_set_member(&minor, mech, cred->mechanisms, &present);
 365
 366     return present;
 367 }
 368
 369 static OM_uint32
 370 staticIdentityFileResolveDefaultIdentity(OM_uint32 *minor,
 371                                          const gss_cred_id_t cred,
 372                                          gss_name_t *pName)
 373 {
 374     OM_uint32 major, tmpMinor;
 375     gss_OID nameMech = gssEapPrimaryMechForCred(cred);
 376     gss_buffer_desc defaultIdentity = GSS_C_EMPTY_BUFFER;
 377
 378     *pName = GSS_C_NO_NAME;
 379
 380     major = readStaticIdentityFile(minor, &defaultIdentity, GSS_C_NO_BUFFER);
 381     if (major == GSS_S_COMPLETE) {
 382         major = gssEapImportName(minor, &defaultIdentity, GSS_C_NT_USER_NAME,
 383                                  nameMech, pName);
 384     }
 385
 386     gss_release_buffer(&tmpMinor, &defaultIdentity);
 387
 388     return major;
 389 }
 390
 391 static OM_uint32
 392 gssEapResolveCredIdentity(OM_uint32 *minor,
 393                           gss_cred_id_t cred)
 394 {
 395     OM_uint32 major;
 396     gss_OID nameMech = gssEapPrimaryMechForCred(cred);
 397
 398     if (cred->name != GSS_C_NO_NAME) {
 399         *minor = 0;
 400         return GSS_S_COMPLETE;
 401     }
 402
 403     if (cred->flags & CRED_FLAG_ACCEPT) {
 404         gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER;
 405         char serviceName[5 + MAXHOSTNAMELEN];
 406
 407         /* default host-based service is host@localhost */
 408         memcpy(serviceName, "host@", 5);
 409         if (gethostname(&serviceName[5], MAXHOSTNAMELEN) != 0) {
 410             *minor = GSSEAP_NO_HOSTNAME;
 411             return GSS_S_FAILURE;
 412         }
 413
 414         nameBuf.value = serviceName;
 415         nameBuf.length = strlen((char *)nameBuf.value);
 416
 417         major = gssEapImportName(minor, &nameBuf, GSS_C_NT_HOSTBASED_SERVICE,
 418                                  nameMech, &cred->name);
 419         if (GSS_ERROR(major))
 420             return major;
 421     } else if (cred->flags & CRED_FLAG_INITIATE) {
 422 #ifdef HAVE_MOONSHOT_GET_IDENTITY
 423         major = libMoonshotResolveDefaultIdentity(minor, cred, &cred->name);
 424         if (major == GSS_S_CRED_UNAVAIL)
 425 #endif
 426             major = staticIdentityFileResolveDefaultIdentity(minor, cred, &cred->name);
 427         if (major != GSS_S_CRED_UNAVAIL)
 428             return major;
 429     }
 430
 431     *minor = 0;
 432     return GSS_S_COMPLETE;
 433 }
 434
 435 OM_uint32
 436 gssEapInquireCred(OM_uint32 *minor,
 437                   gss_cred_id_t cred,
 438                   gss_name_t *name,
 439                   OM_uint32 *pLifetime,
 440                   gss_cred_usage_t *cred_usage,
 441                   gss_OID_set *mechanisms)
 442 {
 443     OM_uint32 major;
 444     time_t now, lifetime;
 445
 446     if (name != NULL) {
 447         major = gssEapResolveCredIdentity(minor, cred);
 448         if (GSS_ERROR(major))
 449             goto cleanup;
 450
 451         if (cred->name != GSS_C_NO_NAME) {
 452             major = gssEapDuplicateName(minor, cred->name, name);
 453             if (GSS_ERROR(major))
 454                 goto cleanup;
 455         } else
 456             *name = GSS_C_NO_NAME;
 457     }
 458
 459     if (cred_usage != NULL) {
 460         OM_uint32 flags = (cred->flags & (CRED_FLAG_INITIATE | CRED_FLAG_ACCEPT));
 461
 462         switch (flags) {
 463         case CRED_FLAG_INITIATE:
 464             *cred_usage = GSS_C_INITIATE;
 465             break;
 466         case CRED_FLAG_ACCEPT:
 467             *cred_usage = GSS_C_ACCEPT;
 468             break;
 469         default:
 470             *cred_usage = GSS_C_BOTH;
 471             break;
 472         }
 473     }
 474
 475     if (mechanisms != NULL) {
 476         if (cred->mechanisms != GSS_C_NO_OID_SET)
 477             major = duplicateOidSet(minor, cred->mechanisms, mechanisms);
 478         else
 479             major = gssEapIndicateMechs(minor, mechanisms);
 480         if (GSS_ERROR(major))
 481             goto cleanup;
 482     }
 483
 484     if (cred->expiryTime == 0) {
 485         lifetime = GSS_C_INDEFINITE;
 486     } else  {
 487         now = time(NULL);
 488         lifetime = now - cred->expiryTime;
 489         if (lifetime < 0)
 490             lifetime = 0;
 491     }
 492
 493     if (pLifetime != NULL) {
 494         *pLifetime = lifetime;
 495     }
 496
 497     if (lifetime == 0) {
 498         major = GSS_S_CREDENTIALS_EXPIRED;
 499         *minor = GSSEAP_CRED_EXPIRED;
 500         goto cleanup;
 501     }
 502
 503     major = GSS_S_COMPLETE;
 504     *minor = 0;
 505
 506 cleanup:
 507     return major;
 508 }
 509
 510 OM_uint32
 511 gssEapSetCredPassword(OM_uint32 *minor,
 512                       gss_cred_id_t cred,
 513                       const gss_buffer_t password)
 514 {
 515     OM_uint32 major, tmpMinor;
 516     gss_buffer_desc newPassword = GSS_C_EMPTY_BUFFER;
 517
 518     if (cred->flags & CRED_FLAG_RESOLVED) {
 519         major = GSS_S_FAILURE;
 520         *minor = GSSEAP_CRED_RESOLVED;
 521         goto cleanup;
 522     }
 523
 524     if (password != GSS_C_NO_BUFFER) {
 525         major = duplicateBuffer(minor, password, &newPassword);
 526         if (GSS_ERROR(major))
 527             goto cleanup;
 528
 529         cred->flags |= CRED_FLAG_PASSWORD;
 530     } else {
 531         cred->flags &= ~(CRED_FLAG_PASSWORD);
 532     }
 533
 534     gss_release_buffer(&tmpMinor, &cred->password);
 535     cred->password = newPassword;
 536
 537     major = GSS_S_COMPLETE;
 538     *minor = 0;
 539
 540 cleanup:
 541     return major;
 542 }
 543
 544 /*
 545  * Currently only the privateKey path is exposed to the application
 546  * (via gss_set_cred_option() or the third line in ~/.gss_eap_id).
 547  * At some point in the future we may add support for setting the
 548  * client certificate separately.
 549  */
 550 OM_uint32
 551 gssEapSetCredClientCertificate(OM_uint32 *minor,
 552                               gss_cred_id_t cred,
 553                               const gss_buffer_t clientCert,
 554                               const gss_buffer_t privateKey)
 555 {
 556     OM_uint32 major, tmpMinor;
 557     gss_buffer_desc newClientCert = GSS_C_EMPTY_BUFFER;
 558     gss_buffer_desc newPrivateKey = GSS_C_EMPTY_BUFFER;
 559
 560     if (cred->flags & CRED_FLAG_RESOLVED) {
 561         major = GSS_S_FAILURE;
 562         *minor = GSSEAP_CRED_RESOLVED;
 563         goto cleanup;
 564     }
 565
 566     if (clientCert == GSS_C_NO_BUFFER &&
 567         privateKey == GSS_C_NO_BUFFER) {
 568         cred->flags &= ~(CRED_FLAG_CERTIFICATE);
 569         major = GSS_S_COMPLETE;
 570         *minor = 0;
 571         goto cleanup;
 572     }
 573
 574     if (clientCert != GSS_C_NO_BUFFER) {
 575         major = duplicateBuffer(minor, clientCert, &newClientCert);
 576         if (GSS_ERROR(major))
 577             goto cleanup;
 578     }
 579
 580     if (privateKey != GSS_C_NO_BUFFER) {
 581         major = duplicateBuffer(minor, privateKey, &newPrivateKey);
 582         if (GSS_ERROR(major))
 583             goto cleanup;
 584     }
 585
 586     cred->flags |= CRED_FLAG_CERTIFICATE;
 587
 588     gss_release_buffer(&tmpMinor, &cred->clientCertificate);
 589     cred->clientCertificate = newClientCert;
 590
 591     gss_release_buffer(&tmpMinor, &cred->privateKey);
 592     cred->privateKey = newPrivateKey;
 593
 594     major = GSS_S_COMPLETE;
 595     *minor = 0;
 596
 597 cleanup:
 598     if (GSS_ERROR(major)) {
 599         gss_release_buffer(&tmpMinor, &newClientCert);
 600         gss_release_buffer(&tmpMinor, &newPrivateKey);
 601     }
 602
 603     return major;
 604 }
 605
 606 OM_uint32
 607 gssEapSetCredService(OM_uint32 *minor,
 608                      gss_cred_id_t cred,
 609                      const gss_name_t target)
 610 {
 611     OM_uint32 major, tmpMinor;
 612     gss_name_t newTarget = GSS_C_NO_NAME;
 613
 614     if (cred->flags & CRED_FLAG_RESOLVED) {
 615         major = GSS_S_FAILURE;
 616         *minor = GSSEAP_CRED_RESOLVED;
 617         goto cleanup;
 618     }
 619
 620     if (target != GSS_C_NO_NAME) {
 621         major = gssEapDuplicateName(minor, target, &newTarget);
 622         if (GSS_ERROR(major))
 623             goto cleanup;
 624
 625         cred->flags |= CRED_FLAG_TARGET;
 626     } else {
 627         cred->flags &= ~(CRED_FLAG_TARGET);
 628     }
 629
 630     gssEapReleaseName(&tmpMinor, &cred->target);
 631     cred->target = newTarget;
 632
 633     major = GSS_S_COMPLETE;
 634     *minor = 0;
 635
 636 cleanup:
 637     return major;
 638 }
 639
 640 static OM_uint32
 641 gssEapDuplicateCred(OM_uint32 *minor,
 642                     const gss_cred_id_t src,
 643                     gss_cred_id_t *pDst)
 644 {
 645     OM_uint32 major, tmpMinor;
 646     gss_cred_id_t dst = GSS_C_NO_CREDENTIAL;
 647
 648     *pDst = GSS_C_NO_CREDENTIAL;
 649
 650     major = gssEapAllocCred(minor, &dst);
 651     if (GSS_ERROR(major))
 652         goto cleanup;
 653
 654     dst->flags = src->flags;
 655
 656     if (src->name != GSS_C_NO_NAME) {
 657         major = gssEapDuplicateName(minor, src->name, &dst->name);
 658         if (GSS_ERROR(major))
 659             goto cleanup;
 660     }
 661
 662     if (src->target != GSS_C_NO_NAME) {
 663         major = gssEapDuplicateName(minor, src->target, &dst->target);
 664         if (GSS_ERROR(major))
 665             goto cleanup;
 666     }
 667
 668     if (src->password.value != NULL) {
 669         major = duplicateBuffer(minor, &src->password, &dst->password);
 670         if (GSS_ERROR(major))
 671             goto cleanup;
 672     }
 673
 674     major = duplicateOidSet(minor, src->mechanisms, &dst->mechanisms);
 675     if (GSS_ERROR(major))
 676         goto cleanup;
 677
 678     dst->expiryTime = src->expiryTime;
 679
 680     if (src->radiusConfigFile.value != NULL)
 681         duplicateBufferOrCleanup(&src->radiusConfigFile, &dst->radiusConfigFile);
 682     if (src->radiusConfigStanza.value != NULL)
 683         duplicateBufferOrCleanup(&src->radiusConfigStanza, &dst->radiusConfigStanza);
 684     if (src->caCertificate.value != NULL)
 685         duplicateBufferOrCleanup(&src->caCertificate, &dst->caCertificate);
 686     if (src->caCertificateBlob.value != NULL)
 687         duplicateBufferOrCleanup(&src->caCertificateBlob, &dst->caCertificateBlob);
 688     if (src->subjectNameConstraint.value != NULL)
 689         duplicateBufferOrCleanup(&src->subjectNameConstraint, &dst->subjectNameConstraint);
 690     if (src->subjectAltNameConstraint.value != NULL)
 691         duplicateBufferOrCleanup(&src->subjectAltNameConstraint, &dst->subjectAltNameConstraint);
 692     if (src->clientCertificate.value != NULL)
 693         duplicateBufferOrCleanup(&src->clientCertificate, &dst->clientCertificate);
 694     if (src->privateKey.value != NULL)
 695         duplicateBufferOrCleanup(&src->privateKey, &dst->privateKey);
 696
 697 #ifdef GSSEAP_ENABLE_REAUTH
 698     /* XXX krbCredCache, reauthCred */
 699 #endif
 700
 701     *pDst = dst;
 702     dst = GSS_C_NO_CREDENTIAL;
 703
 704     major = GSS_S_COMPLETE;
 705     *minor = 0;
 706
 707 cleanup:
 708     gssEapReleaseCred(&tmpMinor, &dst);
 709
 710     return major;
 711 }
 712
 713 static OM_uint32
 714 staticIdentityFileResolveInitiatorCred(OM_uint32 *minor, gss_cred_id_t cred)
 715 {
 716     OM_uint32 major, tmpMinor;
 717     gss_buffer_desc defaultIdentity = GSS_C_EMPTY_BUFFER;
 718     gss_name_t defaultIdentityName = GSS_C_NO_NAME;
 719     gss_buffer_desc defaultPassword = GSS_C_EMPTY_BUFFER;
 720     int isDefaultIdentity = FALSE;
 721
 722     major = readStaticIdentityFile(minor, &defaultIdentity, &defaultPassword);
 723     if (GSS_ERROR(major))
 724         goto cleanup;
 725
 726     major = gssEapImportName(minor, &defaultIdentity, GSS_C_NT_USER_NAME,
 727                              gssEapPrimaryMechForCred(cred), &defaultIdentityName);
 728     if (GSS_ERROR(major))
 729         goto cleanup;
 730
 731     if (defaultIdentityName == GSS_C_NO_NAME) {
 732         if (cred->name == GSS_C_NO_NAME) {
 733             major = GSS_S_CRED_UNAVAIL;
 734             *minor = GSSEAP_NO_DEFAULT_IDENTITY;
 735             goto cleanup;
 736         }
 737     } else {
 738         if (cred->name == GSS_C_NO_NAME) {
 739             cred->name = defaultIdentityName;
 740             defaultIdentityName = GSS_C_NO_NAME;
 741             isDefaultIdentity = TRUE;
 742         } else {
 743             major = gssEapCompareName(minor, cred->name,
 744                                       defaultIdentityName, 0,
 745                                       &isDefaultIdentity);
 746             if (GSS_ERROR(major))
 747                 goto cleanup;
 748         }
 749     }
 750
 751     if (isDefaultIdentity &&
 752         (cred->flags & CRED_FLAG_PASSWORD) == 0) {
 753         major = gssEapSetCredPassword(minor, cred, &defaultPassword);
 754         if (GSS_ERROR(major))
 755             goto cleanup;
 756     }
 757
 758 cleanup:
 759     gssEapReleaseName(&tmpMinor, &defaultIdentityName);
 760     zeroAndReleasePassword(&defaultPassword);
 761     gss_release_buffer(&tmpMinor, &defaultIdentity);
 762
 763     return major;
 764 }
 765
 766 OM_uint32
 767 gssEapResolveInitiatorCred(OM_uint32 *minor,
 768                            const gss_cred_id_t cred,
 769                            const gss_name_t targetName
 770 #ifndef HAVE_MOONSHOT_GET_IDENTITY
 771                                                        GSSEAP_UNUSED
 772 #endif
 773                            ,
 774                            gss_cred_id_t *pResolvedCred)
 775 {
 776     OM_uint32 major, tmpMinor;
 777     gss_cred_id_t resolvedCred = GSS_C_NO_CREDENTIAL;
 778
 779     if (cred == GSS_C_NO_CREDENTIAL) {
 780         major = gssEapAcquireCred(minor,
 781                                   GSS_C_NO_NAME,
 782                                   GSS_C_INDEFINITE,
 783                                   GSS_C_NO_OID_SET,
 784                                   GSS_C_INITIATE,
 785                                   &resolvedCred,
 786                                   NULL,
 787                                   NULL);
 788         if (GSS_ERROR(major))
 789             goto cleanup;
 790     } else {
 791         if ((cred->flags & CRED_FLAG_INITIATE) == 0) {
 792             major = GSS_S_NO_CRED;
 793             *minor = GSSEAP_CRED_USAGE_MISMATCH;
 794             goto cleanup;
 795         }
 796
 797         major = gssEapDuplicateCred(minor, cred, &resolvedCred);
 798         if (GSS_ERROR(major))
 799             goto cleanup;
 800     }
 801
 802     if ((resolvedCred->flags & CRED_FLAG_RESOLVED) == 0) {
 803 #ifdef HAVE_MOONSHOT_GET_IDENTITY
 804         major = libMoonshotResolveInitiatorCred(minor, resolvedCred, targetName);
 805         if (major == GSS_S_CRED_UNAVAIL)
 806 #endif
 807             major = staticIdentityFileResolveInitiatorCred(minor, resolvedCred);
 808         if (GSS_ERROR(major) && major != GSS_S_CRED_UNAVAIL)
 809             goto cleanup;
 810
 811         /* If we have a caller-supplied password, the credential is resolved. */
 812         if ((resolvedCred->flags &
 813              (CRED_FLAG_PASSWORD | CRED_FLAG_CERTIFICATE)) == 0) {
 814             major = GSS_S_CRED_UNAVAIL;
 815             *minor = GSSEAP_NO_DEFAULT_CRED;
 816             goto cleanup;
 817         }
 818
 819         resolvedCred->flags |= CRED_FLAG_RESOLVED;
 820     }
 821
 822     *pResolvedCred = resolvedCred;
 823     resolvedCred = GSS_C_NO_CREDENTIAL;
 824
 825     major = GSS_S_COMPLETE;
 826     *minor = 0;
 827
 828 cleanup:
 829     gssEapReleaseCred(&tmpMinor, &resolvedCred);
 830
 831     return major;
 832 }