www.project-moonshot.org Git - mech_eap.orig/blob - util_name.c

   1 /*
   2  * Copyright (c) 2011, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32 /*
  33  * Portions Copyright 2009 by the Massachusetts Institute of Technology.
  34  * All Rights Reserved.
  35  *
  36  * Export of this software from the United States of America may
  37  *   require a specific license from the United States Government.
  38  *   It is the responsibility of any person or organization contemplating
  39  *   export to obtain such a license before exporting.
  40  *
  41  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
  42  * distribute this software and its documentation for any purpose and
  43  * without fee is hereby granted, provided that the above copyright
  44  * notice appear in all copies and that both that copyright notice and
  45  * this permission notice appear in supporting documentation, and that
  46  * the name of M.I.T. not be used in advertising or publicity pertaining
  47  * to distribution of the software without specific, written prior
  48  * permission.  Furthermore if you modify this software you must label
  49  * your software as modified software and not distribute it in such a
  50  * fashion that it might be confused with the original M.I.T. software.
  51  * M.I.T. makes no representations about the suitability of
  52  * this software for any purpose.  It is provided "as is" without express
  53  * or implied warranty.
  54  */
  55
  56 /*
  57  * Name utility routines.
  58  */
  59
  60 #include "gssapiP_eap.h"
  61
  62 static gss_OID_desc gssEapNtEapName = {
  63     /* 1.3.6.1.4.1.5322.22.2.1  */
  64     10, "\x2B\x06\x01\x04\x01\xA9\x4A\x16\x02\x01"
  65 };
  66
  67 gss_OID GSS_EAP_NT_EAP_NAME = &gssEapNtEapName;
  68
  69 OM_uint32
  70 gssEapAllocName(OM_uint32 *minor, gss_name_t *pName)
  71 {
  72     OM_uint32 tmpMinor;
  73     gss_name_t name;
  74
  75     *pName = GSS_C_NO_NAME;
  76
  77     name = (gss_name_t)GSSEAP_CALLOC(1, sizeof(*name));
  78     if (name == NULL) {
  79         *minor = ENOMEM;
  80         return GSS_S_FAILURE;
  81     }
  82
  83     if (GSSEAP_MUTEX_INIT(&name->mutex) != 0) {
  84         *minor = errno;
  85         gssEapReleaseName(&tmpMinor, &name);
  86         return GSS_S_FAILURE;
  87     }
  88
  89     *pName = name;
  90
  91     return GSS_S_COMPLETE;
  92 }
  93
  94 OM_uint32
  95 gssEapReleaseName(OM_uint32 *minor, gss_name_t *pName)
  96 {
  97     gss_name_t name;
  98     krb5_context krbContext = NULL;
  99     OM_uint32 tmpMinor;
 100
 101     *minor = 0;
 102
 103     if (pName == NULL) {
 104         return GSS_S_COMPLETE;
 105     }
 106
 107     name = *pName;
 108     if (name == GSS_C_NO_NAME) {
 109         return GSS_S_COMPLETE;
 110     }
 111
 112     GSSEAP_KRB_INIT(&krbContext);
 113     krb5_free_principal(krbContext, name->krbPrincipal);
 114     gssEapReleaseOid(&tmpMinor, &name->mechanismUsed);
 115
 116     gssEapReleaseAttrContext(&tmpMinor, name);
 117
 118     GSSEAP_MUTEX_DESTROY(&name->mutex);
 119     GSSEAP_FREE(name);
 120     *pName = NULL;
 121
 122     return GSS_S_COMPLETE;
 123 }
 124
 125 static OM_uint32
 126 krbPrincipalToName(OM_uint32 *minor,
 127                    krb5_principal *principal,
 128                    gss_name_t *pName)
 129 {
 130     OM_uint32 major;
 131     gss_name_t name;
 132
 133     major = gssEapAllocName(minor, &name);
 134     if (GSS_ERROR(major))
 135         return major;
 136
 137     name->krbPrincipal = *principal;
 138     *principal = NULL;
 139
 140     if (KRB_PRINC_LENGTH(name->krbPrincipal) > 1) {
 141         name->flags |= NAME_FLAG_SERVICE;
 142     } else {
 143         name->flags |= NAME_FLAG_NAI;
 144     }
 145
 146     *pName = name;
 147     *minor = 0;
 148
 149     return GSS_S_COMPLETE;
 150 }
 151
 152 static krb5_error_code
 153 gssEapGetDefaultRealm(krb5_context krbContext, char **defaultRealm)
 154 {
 155     *defaultRealm = NULL;
 156
 157     krb5_appdefault_string(krbContext, "eap_gss",
 158                            NULL, "default_realm", "", defaultRealm);
 159
 160     if (*defaultRealm != NULL && (*defaultRealm)[0] == '\0') {
 161         GSSEAP_FREE(*defaultRealm);
 162         *defaultRealm = NULL;
 163     }
 164
 165     return (*defaultRealm != NULL) ? 0 : KRB5_CONFIG_NODEFREALM;
 166 }
 167
 168 static OM_uint32
 169 importServiceName(OM_uint32 *minor,
 170                   const gss_buffer_t nameBuffer,
 171                   gss_name_t *pName)
 172 {
 173     OM_uint32 major;
 174     krb5_error_code code;
 175     krb5_context krbContext;
 176     krb5_principal krbPrinc;
 177     char *service, *host, *realm = NULL;
 178
 179     GSSEAP_KRB_INIT(&krbContext);
 180
 181     major = bufferToString(minor, nameBuffer, &service);
 182     if (GSS_ERROR(major))
 183         return major;
 184
 185     host = strchr(service, '@');
 186     if (host != NULL) {
 187         *host = '\0';
 188         host++;
 189     }
 190
 191     gssEapGetDefaultRealm(krbContext, &realm);
 192
 193     code = krb5_build_principal(krbContext,
 194                                 &krbPrinc,
 195                                 realm != NULL ? strlen(realm) : 0,
 196                                 realm != NULL ? realm : "",
 197                                 service,
 198                                 host,
 199                                 NULL);
 200
 201     if (code == 0) {
 202         KRB_PRINC_TYPE(krbPrinc) = KRB5_NT_SRV_HST;
 203
 204         major = krbPrincipalToName(minor, &krbPrinc, pName);
 205         if (GSS_ERROR(major))
 206             krb5_free_principal(krbContext, krbPrinc);
 207     } else {
 208         major = GSS_S_FAILURE;
 209         *minor = GSSEAP_BAD_SERVICE_NAME;
 210     }
 211
 212     if (realm != NULL)
 213         GSSEAP_FREE(realm);
 214     GSSEAP_FREE(service);
 215
 216     return major;
 217 }
 218
 219 #define IMPORT_FLAG_DEFAULT_REALM           0x1
 220
 221 /*
 222  * Import an EAP name, possibly appending the default GSS EAP realm,
 223  * and taking care to avoid appending the default Kerberos realm.
 224  */
 225 static OM_uint32
 226 importEapNameFlags(OM_uint32 *minor,
 227                    const gss_buffer_t nameBuffer,
 228                    OM_uint32 importFlags,
 229                    gss_name_t *pName)
 230 {
 231     OM_uint32 major;
 232     krb5_context krbContext;
 233     krb5_principal krbPrinc = NULL;
 234     krb5_error_code code;
 235
 236     GSSEAP_KRB_INIT(&krbContext);
 237
 238     if (nameBuffer == GSS_C_NO_BUFFER) {
 239         code = krb5_copy_principal(krbContext,
 240                                    krbAnonymousPrincipal(), &krbPrinc);
 241         if (code != 0) {
 242             *minor = code;
 243             return GSS_S_FAILURE;
 244         }
 245     } else {
 246         char *nameString;
 247
 248         major = bufferToString(minor, nameBuffer, &nameString);
 249         if (GSS_ERROR(major))
 250             return major;
 251
 252         /*
 253          * First, attempt to parse the name on the assumption that it includes
 254          * a qualifying realm.
 255          */
 256         code = krb5_parse_name_flags(krbContext, nameString,
 257                                      KRB5_PRINCIPAL_PARSE_REQUIRE_REALM, &krbPrinc);
 258         if (code == KRB5_PARSE_MALFORMED) {
 259             char *defaultRealm = NULL;
 260             int parseFlags = 0;
 261
 262             /*
 263              * We need an explicit appdefaults check because, at least with MIT
 264              * Kerberos, setting the context realm to NULL will reset it to the
 265              * default Kerberos realm after the second call to get_default_realm.
 266              * We want to make sure that the default Kerberos realm does not end
 267              * up accidentally appended to an unqualified name.
 268              */
 269             if (importFlags & IMPORT_FLAG_DEFAULT_REALM)
 270                 gssEapGetDefaultRealm(krbContext, &defaultRealm);
 271
 272             if (defaultRealm == NULL)
 273                 parseFlags |= KRB5_PRINCIPAL_PARSE_NO_REALM;
 274
 275             code = krb5_parse_name_flags(krbContext, nameString, parseFlags, &krbPrinc);
 276
 277             if (defaultRealm != NULL)
 278                 GSSEAP_FREE(defaultRealm);
 279         }
 280
 281         GSSEAP_FREE(nameString);
 282
 283         if (code != 0) {
 284             *minor = code;
 285             return GSS_S_FAILURE;
 286         }
 287     }
 288
 289     assert(krbPrinc != NULL);
 290
 291     major = krbPrincipalToName(minor, &krbPrinc, pName);
 292     if (GSS_ERROR(major))
 293         krb5_free_principal(krbContext, krbPrinc);
 294
 295     return major;
 296 }
 297
 298 static OM_uint32
 299 importEapName(OM_uint32 *minor,
 300               const gss_buffer_t nameBuffer,
 301               gss_name_t *pName)
 302 {
 303     return importEapNameFlags(minor, nameBuffer, 0, pName);
 304 }
 305
 306 static OM_uint32
 307 importUserName(OM_uint32 *minor,
 308                const gss_buffer_t nameBuffer,
 309                gss_name_t *pName)
 310 {
 311     return importEapNameFlags(minor, nameBuffer, IMPORT_FLAG_DEFAULT_REALM, pName);
 312 }
 313
 314 static OM_uint32
 315 importAnonymousName(OM_uint32 *minor,
 316                     const gss_buffer_t nameBuffer GSSEAP_UNUSED,
 317                     gss_name_t *pName)
 318 {
 319     return importEapNameFlags(minor, GSS_C_NO_BUFFER, 0, pName);
 320 }
 321
 322 #define UPDATE_REMAIN(n)    do {            \
 323         p += (n);                           \
 324         remain -= (n);                      \
 325     } while (0)
 326
 327 #define CHECK_REMAIN(n)     do {        \
 328         if (remain < (n)) {             \
 329             major = GSS_S_BAD_NAME;     \
 330             *minor = GSSEAP_TOK_TRUNC;  \
 331             goto cleanup;               \
 332         }                               \
 333     } while (0)
 334
 335 OM_uint32
 336 gssEapImportNameInternal(OM_uint32 *minor,
 337                          const gss_buffer_t nameBuffer,
 338                          gss_name_t *pName,
 339                          unsigned int flags)
 340 {
 341     OM_uint32 major, tmpMinor;
 342     krb5_context krbContext;
 343     unsigned char *p;
 344     size_t len, remain;
 345     gss_buffer_desc buf;
 346     enum gss_eap_token_type tokType;
 347     gss_name_t name = GSS_C_NO_NAME;
 348     gss_OID mechanismUsed = GSS_C_NO_OID;
 349
 350     GSSEAP_KRB_INIT(&krbContext);
 351
 352     p = (unsigned char *)nameBuffer->value;
 353     remain = nameBuffer->length;
 354
 355     if (flags & EXPORT_NAME_FLAG_OID) {
 356         gss_OID_desc mech;
 357
 358         /* TOK_ID || MECH_OID_LEN || MECH_OID */
 359         if (remain < 6)
 360             return GSS_S_BAD_NAME;
 361
 362         if (flags & EXPORT_NAME_FLAG_COMPOSITE)
 363             tokType = TOK_TYPE_EXPORT_NAME_COMPOSITE;
 364         else
 365             tokType = TOK_TYPE_EXPORT_NAME;
 366
 367         /* TOK_ID */
 368         if (load_uint16_be(p) != tokType)
 369             return GSS_S_BAD_NAME;
 370         UPDATE_REMAIN(2);
 371
 372         /* MECH_OID_LEN */
 373         len = load_uint16_be(p);
 374         if (len < 2)
 375             return GSS_S_BAD_NAME;
 376         UPDATE_REMAIN(2);
 377
 378         /* MECH_OID */
 379         if (p[0] != 0x06)
 380             return GSS_S_BAD_NAME;
 381
 382         mech.length = p[1];
 383         mech.elements = &p[2];
 384
 385         CHECK_REMAIN(mech.length);
 386
 387         major = gssEapCanonicalizeOid(minor,
 388                                       &mech,
 389                                       OID_FLAG_FAMILY_MECH_VALID |
 390                                         OID_FLAG_MAP_FAMILY_MECH_TO_NULL,
 391                                       &mechanismUsed);
 392         if (GSS_ERROR(major))
 393             goto cleanup;
 394
 395         UPDATE_REMAIN(2 + mech.length);
 396     }
 397
 398     /* NAME_LEN */
 399     CHECK_REMAIN(4);
 400     len = load_uint32_be(p);
 401     UPDATE_REMAIN(4);
 402
 403     /* NAME */
 404     CHECK_REMAIN(len);
 405     buf.length = len;
 406     buf.value = p;
 407     UPDATE_REMAIN(len);
 408
 409     major = importEapNameFlags(minor, &buf, 0, &name);
 410     if (GSS_ERROR(major))
 411         goto cleanup;
 412
 413     name->mechanismUsed = mechanismUsed;
 414     mechanismUsed = GSS_C_NO_OID;
 415
 416     if (flags & EXPORT_NAME_FLAG_COMPOSITE) {
 417         gss_buffer_desc buf;
 418
 419         buf.length = remain;
 420         buf.value = p;
 421
 422         major = gssEapImportAttrContext(minor, &buf, name);
 423         if (GSS_ERROR(major))
 424             goto cleanup;
 425     }
 426
 427     major = GSS_S_COMPLETE;
 428     *minor = 0;
 429
 430 cleanup:
 431     if (GSS_ERROR(major)) {
 432         gssEapReleaseOid(&tmpMinor, &mechanismUsed);
 433         gssEapReleaseName(&tmpMinor, &name);
 434     } else {
 435         *pName = name;
 436     }
 437
 438     return major;
 439 }
 440
 441 static OM_uint32
 442 importExportName(OM_uint32 *minor,
 443                  const gss_buffer_t nameBuffer,
 444                  gss_name_t *name)
 445 {
 446     return gssEapImportNameInternal(minor, nameBuffer, name,
 447                                     EXPORT_NAME_FLAG_OID);
 448 }
 449
 450 #ifdef HAVE_GSS_C_NT_COMPOSITE_EXPORT
 451 static OM_uint32
 452 importCompositeExportName(OM_uint32 *minor,
 453                           const gss_buffer_t nameBuffer,
 454                           gss_name_t *name)
 455 {
 456     return gssEapImportNameInternal(minor, nameBuffer, name,
 457                                     EXPORT_NAME_FLAG_OID |
 458                                     EXPORT_NAME_FLAG_COMPOSITE);
 459 }
 460 #endif
 461
 462 struct gss_eap_name_import_provider {
 463     gss_const_OID oid;
 464     OM_uint32 (*import)(OM_uint32 *, const gss_buffer_t, gss_name_t *);
 465 };
 466
 467 OM_uint32
 468 gssEapImportName(OM_uint32 *minor,
 469                  const gss_buffer_t nameBuffer,
 470                  const gss_OID nameType,
 471                  const gss_OID mechType,
 472                  gss_name_t *pName)
 473 {
 474     struct gss_eap_name_import_provider nameTypes[] = {
 475         { GSS_EAP_NT_EAP_NAME,              importEapName               },
 476         { GSS_C_NT_USER_NAME,               importUserName              },
 477         { GSS_C_NT_HOSTBASED_SERVICE,       importServiceName           },
 478         { GSS_C_NT_HOSTBASED_SERVICE_X,     importServiceName           },
 479         { GSS_C_NT_ANONYMOUS,               importAnonymousName         },
 480         { GSS_C_NT_EXPORT_NAME,             importExportName            },
 481         { GSS_KRB5_NT_PRINCIPAL_NAME,       importUserName              },
 482 #ifdef HAVE_GSS_C_NT_COMPOSITE_EXPORT
 483         { GSS_C_NT_COMPOSITE_EXPORT,        importCompositeExportName   },
 484 #endif
 485     };
 486     size_t i;
 487     OM_uint32 major = GSS_S_BAD_NAMETYPE;
 488     OM_uint32 tmpMinor;
 489     gss_name_t name = GSS_C_NO_NAME;
 490
 491     for (i = 0; i < sizeof(nameTypes) / sizeof(nameTypes[0]); i++) {
 492         if (oidEqual(nameTypes[i].oid,
 493                      nameType == GSS_C_NO_OID ? GSS_EAP_NT_EAP_NAME : nameType)) {
 494             major = nameTypes[i].import(minor, nameBuffer, &name);
 495             break;
 496         }
 497     }
 498
 499     if (major == GSS_S_COMPLETE &&
 500         mechType != GSS_C_NO_OID) {
 501         assert(gssEapIsConcreteMechanismOid(mechType));
 502         assert(name->mechanismUsed == GSS_C_NO_OID);
 503
 504         major = gssEapCanonicalizeOid(minor, mechType, 0, &name->mechanismUsed);
 505     }
 506
 507     if (GSS_ERROR(major))
 508         gssEapReleaseName(&tmpMinor, &name);
 509     else
 510         *pName = name;
 511
 512     return major;
 513 }
 514
 515 OM_uint32
 516 gssEapExportName(OM_uint32 *minor,
 517                  const gss_name_t name,
 518                  gss_buffer_t exportedName)
 519 {
 520     return gssEapExportNameInternal(minor, name, exportedName,
 521                                     EXPORT_NAME_FLAG_OID);
 522 }
 523
 524 OM_uint32
 525 gssEapExportNameInternal(OM_uint32 *minor,
 526                          const gss_name_t name,
 527                          gss_buffer_t exportedName,
 528                          unsigned int flags)
 529 {
 530     OM_uint32 major = GSS_S_FAILURE, tmpMinor;
 531     gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER;
 532     size_t exportedNameLen;
 533     unsigned char *p;
 534     gss_buffer_desc attrs = GSS_C_EMPTY_BUFFER;
 535     gss_OID mech;
 536
 537     exportedName->length = 0;
 538     exportedName->value = NULL;
 539
 540     if (name->mechanismUsed != GSS_C_NO_OID)
 541         mech = name->mechanismUsed;
 542     else
 543         mech = GSS_EAP_MECHANISM;
 544
 545     major = gssEapDisplayName(minor, name, &nameBuf, NULL);
 546     if (GSS_ERROR(major))
 547         goto cleanup;
 548
 549     exportedNameLen = 0;
 550     if (flags & EXPORT_NAME_FLAG_OID) {
 551         exportedNameLen += 6 + mech->length;
 552     }
 553     exportedNameLen += 4 + nameBuf.length;
 554     if (flags & EXPORT_NAME_FLAG_COMPOSITE) {
 555         major = gssEapExportAttrContext(minor, name, &attrs);
 556         if (GSS_ERROR(major))
 557             goto cleanup;
 558         exportedNameLen += attrs.length;
 559     }
 560
 561     exportedName->value = GSSEAP_MALLOC(exportedNameLen);
 562     if (exportedName->value == NULL) {
 563         major = GSS_S_FAILURE;
 564         *minor = ENOMEM;
 565         goto cleanup;
 566     }
 567     exportedName->length = exportedNameLen;
 568
 569     p = (unsigned char *)exportedName->value;
 570
 571     if (flags & EXPORT_NAME_FLAG_OID) {
 572         /* TOK | MECH_OID_LEN */
 573         store_uint16_be((flags & EXPORT_NAME_FLAG_COMPOSITE)
 574                         ? TOK_TYPE_EXPORT_NAME_COMPOSITE
 575                         : TOK_TYPE_EXPORT_NAME,
 576                         p);
 577         p += 2;
 578         store_uint16_be(mech->length + 2, p);
 579         p += 2;
 580
 581         /* MECH_OID */
 582         *p++ = 0x06;
 583         *p++ = mech->length & 0xff;
 584         memcpy(p, mech->elements, mech->length);
 585         p += mech->length;
 586     }
 587
 588     /* NAME_LEN */
 589     store_uint32_be(nameBuf.length, p);
 590     p += 4;
 591
 592     /* NAME */
 593     memcpy(p, nameBuf.value, nameBuf.length);
 594     p += nameBuf.length;
 595
 596     if (flags & EXPORT_NAME_FLAG_COMPOSITE) {
 597         memcpy(p, attrs.value, attrs.length);
 598         p += attrs.length;
 599     }
 600
 601     assert(p == (unsigned char *)exportedName->value + exportedNameLen);
 602
 603     major = GSS_S_COMPLETE;
 604     *minor = 0;
 605
 606 cleanup:
 607     gss_release_buffer(&tmpMinor, &attrs);
 608     gss_release_buffer(&tmpMinor, &nameBuf);
 609     if (GSS_ERROR(major))
 610         gss_release_buffer(&tmpMinor, exportedName);
 611
 612     return major;
 613 }
 614
 615 OM_uint32
 616 gssEapCanonicalizeName(OM_uint32 *minor,
 617                        const gss_name_t input_name,
 618                        const gss_OID mech_type,
 619                        gss_name_t *dest_name)
 620 {
 621     OM_uint32 major, tmpMinor;
 622     krb5_context krbContext;
 623     gss_name_t name;
 624     gss_OID mech_used;
 625
 626     if (input_name == GSS_C_NO_NAME) {
 627         *minor = EINVAL;
 628         return GSS_S_CALL_INACCESSIBLE_READ | GSS_S_BAD_NAME;
 629     }
 630
 631     GSSEAP_KRB_INIT(&krbContext);
 632
 633     major = gssEapAllocName(minor, &name);
 634     if (GSS_ERROR(major)) {
 635         return major;
 636     }
 637
 638     if (mech_type != GSS_C_NO_OID)
 639         mech_used = mech_type;
 640     else
 641         mech_used = input_name->mechanismUsed;
 642
 643     major = gssEapCanonicalizeOid(minor,
 644                                   mech_used,
 645                                   OID_FLAG_NULL_VALID,
 646                                   &name->mechanismUsed);
 647     if (GSS_ERROR(major))
 648         goto cleanup;
 649
 650     name->flags = input_name->flags;
 651
 652     *minor = krb5_copy_principal(krbContext, input_name->krbPrincipal,
 653                                  &name->krbPrincipal);
 654     if (*minor != 0) {
 655         major = GSS_S_FAILURE;
 656         goto cleanup;
 657     }
 658
 659     if (input_name->attrCtx != NULL) {
 660         major = gssEapDuplicateAttrContext(minor, input_name, name);
 661         if (GSS_ERROR(major))
 662             goto cleanup;
 663     }
 664
 665     *dest_name = name;
 666
 667 cleanup:
 668     if (GSS_ERROR(major)) {
 669         gssEapReleaseName(&tmpMinor, &name);
 670     }
 671
 672     return major;
 673 }
 674
 675 OM_uint32
 676 gssEapDuplicateName(OM_uint32 *minor,
 677                     const gss_name_t input_name,
 678                     gss_name_t *dest_name)
 679 {
 680     return gssEapCanonicalizeName(minor, input_name,
 681                                   GSS_C_NO_OID, dest_name);
 682 }
 683
 684 OM_uint32
 685 gssEapDisplayName(OM_uint32 *minor,
 686                   gss_name_t name,
 687                   gss_buffer_t output_name_buffer,
 688                   gss_OID *output_name_type)
 689 {
 690     OM_uint32 major;
 691     krb5_context krbContext;
 692     char *krbName;
 693     gss_OID name_type;
 694     int flags = 0;
 695
 696     GSSEAP_KRB_INIT(&krbContext);
 697
 698     output_name_buffer->length = 0;
 699     output_name_buffer->value = NULL;
 700
 701     if (name == GSS_C_NO_NAME) {
 702         *minor = EINVAL;
 703         return GSS_S_CALL_INACCESSIBLE_READ | GSS_S_BAD_NAME;
 704     }
 705
 706     /*
 707      * According to draft-ietf-abfab-gss-eap-01, when the realm is
 708      * absent the trailing '@' is not included.
 709      */
 710 #ifdef HAVE_HEIMDAL_VERSION
 711     if (KRB_PRINC_REALM(name->krbPrincipal) == NULL ||
 712         KRB_PRINC_REALM(name->krBPrincipal)[0] == '\0')
 713 #else
 714     if (KRB_PRINC_REALM(name->krbPrincipal)->length == 0)
 715 #endif
 716         flags |= KRB5_PRINCIPAL_UNPARSE_NO_REALM;
 717
 718     *minor = krb5_unparse_name_flags(krbContext, name->krbPrincipal,
 719                                      flags, &krbName);
 720     if (*minor != 0) {
 721         return GSS_S_FAILURE;
 722     }
 723
 724     major = makeStringBuffer(minor, krbName, output_name_buffer);
 725     if (GSS_ERROR(major)) {
 726         krb5_free_unparsed_name(krbContext, krbName);
 727         return major;
 728     }
 729
 730     krb5_free_unparsed_name(krbContext, krbName);
 731
 732     if (KRB_PRINC_TYPE(name->krbPrincipal) == KRB5_NT_WELLKNOWN &&
 733         krb5_principal_compare(krbContext,
 734                                name->krbPrincipal, krbAnonymousPrincipal())) {
 735         name_type = GSS_C_NT_ANONYMOUS;
 736     } else {
 737         name_type = GSS_EAP_NT_EAP_NAME;
 738     }
 739
 740     if (output_name_type != NULL)
 741         *output_name_type = name_type;
 742
 743     return GSS_S_COMPLETE;
 744 }