util_cred.c

   1 /*
   2  * Copyright (c) 2010, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 #include "gssapiP_eap.h"
  34
  35 OM_uint32
  36 gssEapAllocCred(OM_uint32 *minor, gss_cred_id_t *pCred)
  37 {
  38     OM_uint32 tmpMinor;
  39     gss_cred_id_t cred;
  40
  41     *pCred = GSS_C_NO_CREDENTIAL;
  42
  43     cred = (gss_cred_id_t)GSSEAP_CALLOC(1, sizeof(*cred));
  44     if (cred == NULL) {
  45         *minor = ENOMEM;
  46         return GSS_S_FAILURE;
  47     }
  48
  49     if (GSSEAP_MUTEX_INIT(&cred->mutex) != 0) {
  50         *minor = errno;
  51         gssEapReleaseCred(&tmpMinor, &cred);
  52         return GSS_S_FAILURE;
  53     }
  54
  55     *pCred = cred;
  56
  57     *minor = 0;
  58     return GSS_S_COMPLETE;
  59 }
  60
  61 OM_uint32
  62 gssEapReleaseCred(OM_uint32 *minor, gss_cred_id_t *pCred)
  63 {
  64     OM_uint32 tmpMinor;
  65     gss_cred_id_t cred = *pCred;
  66     krb5_context krbContext = NULL;
  67
  68     if (cred == GSS_C_NO_CREDENTIAL) {
  69         return GSS_S_COMPLETE;
  70     }
  71
  72     GSSEAP_KRB_INIT(&krbContext);
  73
  74     gssEapReleaseName(&tmpMinor, &cred->name);
  75
  76     if (cred->password.value != NULL) {
  77         memset(cred->password.value, 0, cred->password.length);
  78         GSSEAP_FREE(cred->password.value);
  79     }
  80
  81     if (cred->radiusConfigFile != NULL)
  82         GSSEAP_FREE(cred->radiusConfigFile);
  83     if (cred->radiusConfigStanza != NULL)
  84         GSSEAP_FREE(cred->radiusConfigStanza);
  85
  86 #ifdef GSSEAP_ENABLE_REAUTH
  87     if (cred->krbCredCache != NULL) {
  88         if (cred->flags & CRED_FLAG_DEFAULT_CCACHE)
  89             krb5_cc_close(krbContext, cred->krbCredCache);
  90         else
  91             krb5_cc_destroy(krbContext, cred->krbCredCache);
  92     }
  93     if (cred->krbCred != GSS_C_NO_CREDENTIAL)
  94         gssReleaseCred(&tmpMinor, &cred->krbCred);
  95 #endif
  96
  97     GSSEAP_MUTEX_DESTROY(&cred->mutex);
  98     memset(cred, 0, sizeof(*cred));
  99     GSSEAP_FREE(cred);
 100     *pCred = NULL;
 101
 102     *minor = 0;
 103     return GSS_S_COMPLETE;
 104 }
 105
 106 OM_uint32
 107 gssEapAcquireCred(OM_uint32 *minor,
 108                   const gss_name_t desiredName,
 109                   const gss_buffer_t password,
 110                   OM_uint32 timeReq,
 111                   const gss_OID_set desiredMechs,
 112                   int credUsage,
 113                   gss_cred_id_t *pCred,
 114                   gss_OID_set *pActualMechs,
 115                   OM_uint32 *timeRec)
 116 {
 117     OM_uint32 major, tmpMinor;
 118     gss_cred_id_t cred;
 119
 120     /* XXX TODO validate with changed set_cred_option API */
 121     *pCred = GSS_C_NO_CREDENTIAL;
 122
 123     major = gssEapAllocCred(minor, &cred);
 124     if (GSS_ERROR(major))
 125         goto cleanup;
 126
 127     if (desiredName != GSS_C_NO_NAME) {
 128         GSSEAP_MUTEX_LOCK(&desiredName->mutex);
 129
 130         major = gssEapDuplicateName(minor, desiredName, &cred->name);
 131         if (GSS_ERROR(major)) {
 132             GSSEAP_MUTEX_UNLOCK(&desiredName->mutex);
 133             goto cleanup;
 134         }
 135
 136         GSSEAP_MUTEX_UNLOCK(&desiredName->mutex);
 137     } else {
 138         gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER;
 139         gss_OID nameType = GSS_C_NO_OID;
 140
 141         if (cred->flags & CRED_FLAG_ACCEPT) {
 142             char serviceName[5 + MAXHOSTNAMELEN] = "host@";
 143
 144             /* default host-based service is host@localhost */
 145             if (gethostname(&serviceName[5], MAXHOSTNAMELEN) != 0) {
 146                 *minor = GSSEAP_NO_HOSTNAME;
 147                 major = GSS_S_FAILURE;
 148                 goto cleanup;
 149             }
 150
 151             nameBuf.value = serviceName;
 152             nameBuf.length = strlen((char *)nameBuf.value);
 153
 154             nameType = GSS_C_NT_HOSTBASED_SERVICE;
 155         } else if (cred->flags & CRED_FLAG_INITIATE) {
 156             nameBuf.value = getlogin(); /* XXX */
 157             nameBuf.length = strlen((char *)nameBuf.value);
 158
 159             nameType = GSS_C_NT_USER_NAME;
 160         }
 161
 162         if (nameBuf.length != 0) {
 163             major = gssEapImportName(minor, &nameBuf, nameType, &cred->name);
 164             if (GSS_ERROR(major))
 165                 goto cleanup;
 166         }
 167
 168         cred->flags |= CRED_FLAG_DEFAULT_IDENTITY;
 169     }
 170
 171     if (password != GSS_C_NO_BUFFER) {
 172         major = duplicateBuffer(minor, password, &cred->password);
 173         if (GSS_ERROR(major))
 174             goto cleanup;
 175
 176         cred->flags |= CRED_FLAG_PASSWORD;
 177     } else if (credUsage == GSS_C_INITIATE) {
 178         /*
 179          * OK, here we need to ask the supplicant if we have creds or it
 180          * will acquire them, so GS2 can know whether to prompt for a
 181          * password or not.
 182          */
 183 #if 0
 184         && !gssEapCanReauthP(cred, GSS_C_NO_NAME, timeReq)
 185 #endif
 186         major = GSS_S_CRED_UNAVAIL;
 187         goto cleanup;
 188     }
 189
 190     switch (credUsage) {
 191     case GSS_C_BOTH:
 192         cred->flags |= CRED_FLAG_INITIATE | CRED_FLAG_ACCEPT;
 193         break;
 194     case GSS_C_INITIATE:
 195         cred->flags |= CRED_FLAG_INITIATE;
 196         break;
 197     case GSS_C_ACCEPT:
 198         cred->flags |= CRED_FLAG_ACCEPT;
 199         break;
 200     default:
 201         *minor = GSSEAP_BAD_USAGE;
 202         major = GSS_S_FAILURE;
 203         goto cleanup;
 204         break;
 205     }
 206
 207     major = gssEapValidateMechs(minor, desiredMechs);
 208     if (GSS_ERROR(major))
 209         goto cleanup;
 210
 211     major = duplicateOidSet(minor, desiredMechs, &cred->mechanisms);
 212     if (GSS_ERROR(major))
 213         goto cleanup;
 214
 215     if (pActualMechs != NULL) {
 216         major = duplicateOidSet(minor, cred->mechanisms, pActualMechs);
 217         if (GSS_ERROR(major))
 218             goto cleanup;
 219     }
 220
 221     if (timeRec != NULL)
 222         *timeRec = GSS_C_INDEFINITE;
 223
 224     *pCred = cred;
 225     major = GSS_S_COMPLETE;
 226
 227 cleanup:
 228     if (GSS_ERROR(major))
 229         gssEapReleaseCred(&tmpMinor, &cred);
 230
 231     return major;
 232 }
 233
 234 /*
 235  * Return TRUE if cred available for mechanism. Caller need no acquire
 236  * lock because mechanisms list is immutable.
 237  */
 238 int
 239 gssEapCredAvailable(gss_cred_id_t cred, gss_OID mech)
 240 {
 241     OM_uint32 minor;
 242     int present = 0;
 243
 244     assert(mech != GSS_C_NO_OID);
 245
 246     if (cred == GSS_C_NO_CREDENTIAL || cred->mechanisms == GSS_C_NO_OID_SET)
 247         return TRUE;
 248
 249     gss_test_oid_set_member(&minor, mech, cred->mechanisms, &present);
 250
 251     return present;
 252 }