www.project-moonshot.org Git - mech_eap.orig/blob - util_reauth.c

   1 /*
   2  * Copyright (c) 2010, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 /*
  34  * Fast reauthentication support.
  35  */
  36
  37 #include "gssapiP_eap.h"
  38
  39 #include <dlfcn.h>
  40
  41 /*
  42  * Fast reauthentication support for EAP GSS.
  43  */
  44
  45 krb5_error_code
  46 krb5_encrypt_tkt_part(krb5_context, const krb5_keyblock *, krb5_ticket *);
  47
  48 krb5_error_code
  49 encode_krb5_ticket(const krb5_ticket *rep, krb5_data **code);
  50
  51 static OM_uint32
  52 gssDisplayName(OM_uint32 *minor,
  53                gss_name_t name,
  54                gss_buffer_t buffer,
  55                gss_OID *name_type);
  56
  57 static OM_uint32
  58 gssImportName(OM_uint32 *minor,
  59               gss_buffer_t buffer,
  60               gss_OID name_type,
  61               gss_name_t *name);
  62
  63 static krb5_error_code
  64 getAcceptorKey(krb5_context krbContext,
  65                gss_ctx_id_t ctx,
  66                gss_cred_id_t cred,
  67                krb5_principal *princ,
  68                krb5_keyblock *key)
  69 {
  70     krb5_error_code code;
  71     krb5_keytab keytab = NULL;
  72     krb5_keytab_entry ktent = { 0 };
  73     krb5_kt_cursor cursor = NULL;
  74
  75     *princ = NULL;
  76     memset(key, 0, sizeof(*key));
  77
  78     code = krb5_kt_default(krbContext, &keytab);
  79     if (code != 0)
  80         goto cleanup;
  81
  82     if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) {
  83         code = krb5_kt_get_entry(krbContext, keytab,
  84                                  cred->name->krbPrincipal, 0,
  85                                  ctx->encryptionType, &ktent);
  86         if (code != 0)
  87             goto cleanup;
  88     } else {
  89         /*
  90          * It's not clear that looking encrypting the ticket in the
  91          * requested EAP enctype provides any value.
  92          */
  93         code = krb5_kt_start_seq_get(krbContext, keytab, &cursor);
  94         if (code != 0)
  95             goto cleanup;
  96
  97         while ((code = krb5_kt_next_entry(krbContext, keytab,
  98                                           &ktent, &cursor)) == 0) {
  99             if (ktent.key.enctype == ctx->encryptionType)
 100                 break;
 101             else
 102                 krb5_free_keytab_entry_contents(krbContext, &ktent);
 103         }
 104     }
 105
 106     if (code == 0) {
 107         *princ = ktent.principal;
 108         *key = ktent.key;
 109     }
 110
 111 cleanup:
 112     if (cred == GSS_C_NO_CREDENTIAL || cred->name == GSS_C_NO_NAME)
 113         krb5_kt_end_seq_get(krbContext, keytab, &cursor);
 114     krb5_kt_close(krbContext, keytab);
 115
 116     if (code != 0)
 117         krb5_free_keytab_entry_contents(krbContext, &ktent);
 118
 119     return code;
 120 }
 121
 122 static OM_uint32
 123 freezeAttrContext(OM_uint32 *minor,
 124                   gss_name_t initiatorName,
 125                   krb5_const_principal acceptorPrinc,
 126                   krb5_keyblock *session,
 127                   krb5_authdata ***authdata)
 128 {
 129     OM_uint32 major, tmpMinor;
 130     krb5_error_code code;
 131     gss_buffer_desc attrBuf = GSS_C_EMPTY_BUFFER;
 132     krb5_authdata *authData[2], authDatum = { 0 };
 133     krb5_context krbContext;
 134
 135     GSSEAP_KRB_INIT(&krbContext);
 136
 137     major = gssEapExportAttrContext(minor, initiatorName, &attrBuf);
 138     if (GSS_ERROR(major))
 139         return major;
 140
 141     authDatum.ad_type = KRB5_AUTHDATA_RADIUS_AVP;
 142     authDatum.length = attrBuf.length;
 143     authDatum.contents = attrBuf.value;
 144     authData[0] = &authDatum;
 145     authData[1] = NULL;
 146
 147     code = krb5_make_authdata_kdc_issued(krbContext, session, acceptorPrinc,
 148                                          authData, authdata);
 149     if (code != 0) {
 150         major = GSS_S_FAILURE;
 151         *minor = code;
 152     } else {
 153         major = GSS_S_COMPLETE;
 154     }
 155
 156     gss_release_buffer(&tmpMinor, &attrBuf);
 157
 158     return major;
 159 }
 160
 161 /*
 162  * Fabricate a ticket to ourselves given a GSS EAP context.
 163  */
 164 OM_uint32
 165 gssEapMakeReauthCreds(OM_uint32 *minor,
 166                       gss_ctx_id_t ctx,
 167                       gss_cred_id_t cred,
 168                       gss_buffer_t credBuf)
 169 {
 170     OM_uint32 major = GSS_S_COMPLETE;
 171     krb5_error_code code;
 172     krb5_context krbContext = NULL;
 173     krb5_ticket ticket = { 0 };
 174     krb5_keyblock session = { 0 }, acceptorKey = { 0 };
 175     krb5_enc_tkt_part enc_part = { 0 };
 176     krb5_data *ticketData = NULL, *credsData = NULL;
 177     krb5_creds creds = { 0 };
 178     krb5_auth_context authContext = NULL;
 179
 180     credBuf->length = 0;
 181     credBuf->value = NULL;
 182
 183     GSSEAP_KRB_INIT(&krbContext);
 184
 185     code = getAcceptorKey(krbContext, ctx, cred,
 186                           &ticket.server, &acceptorKey);
 187     if (code == KRB5_KT_NOTFOUND) {
 188         gss_buffer_desc emptyToken = { 0, "" };
 189
 190         /*
 191          * If we can't produce the KRB-CRED message, we need to
 192          * return an empty (not NULL) token to the caller so we
 193          * don't change the number of authentication legs.
 194          */
 195         return duplicateBuffer(minor, &emptyToken, credBuf);
 196     } else if (code != 0)
 197         goto cleanup;
 198
 199     enc_part.flags = TKT_FLG_INITIAL;
 200
 201     /*
 202      * Generate a random session key to place in the ticket and
 203      * sign the "KDC-Issued" authorization data element.
 204      */
 205     code = krb5_c_make_random_key(krbContext, ctx->encryptionType,
 206                                   &session);
 207     if (code != 0)
 208         goto cleanup;
 209
 210     enc_part.session = &session;
 211     enc_part.client = ctx->initiatorName->krbPrincipal;
 212     enc_part.times.authtime = time(NULL);
 213     enc_part.times.starttime = enc_part.times.authtime;
 214     enc_part.times.endtime = (ctx->expiryTime != 0)
 215                              ? ctx->expiryTime
 216                              : KRB5_INT32_MAX;
 217     enc_part.times.renew_till = 0;
 218
 219     major = freezeAttrContext(minor, ctx->initiatorName, ticket.server,
 220                               &session, &enc_part.authorization_data);
 221     if (GSS_ERROR(major))
 222         goto cleanup;
 223
 224     ticket.enc_part2 = &enc_part;
 225
 226     code = krb5_encrypt_tkt_part(krbContext, &acceptorKey, &ticket);
 227     if (code != 0)
 228         goto cleanup;
 229
 230     code = encode_krb5_ticket(&ticket, &ticketData);
 231     if (code != 0)
 232         goto cleanup;
 233
 234     creds.client = enc_part.client;
 235     creds.server = ticket.server;
 236     creds.keyblock = session;
 237     creds.times = enc_part.times;
 238     creds.ticket_flags = enc_part.flags;
 239     creds.ticket = *ticketData;
 240     creds.authdata = enc_part.authorization_data;
 241
 242     code = krb5_auth_con_init(krbContext, &authContext);
 243     if (code != 0)
 244         goto cleanup;
 245
 246     code = krb5_auth_con_setflags(krbContext, authContext, 0);
 247     if (code != 0)
 248         goto cleanup;
 249
 250     code = krb5_auth_con_setsendsubkey(krbContext, authContext,
 251                                        &ctx->rfc3961Key);
 252     if (code != 0)
 253         goto cleanup;
 254
 255     code = krb5_mk_1cred(krbContext, authContext, &creds, &credsData, NULL);
 256     if (code != 0)
 257         goto cleanup;
 258
 259     krbDataToGssBuffer(credsData, credBuf);
 260
 261 cleanup:
 262     if (ticket.enc_part.ciphertext.data != NULL)
 263         GSSEAP_FREE(ticket.enc_part.ciphertext.data);
 264     krb5_free_keyblock_contents(krbContext, &session);
 265     krb5_free_keyblock_contents(krbContext, &acceptorKey);
 266     krb5_free_data(krbContext, ticketData);
 267     krb5_auth_con_free(krbContext, authContext);
 268     krb5_free_authdata(krbContext, enc_part.authorization_data);
 269     if (credsData != NULL)
 270         GSSEAP_FREE(credsData);
 271
 272     if (major == GSS_S_COMPLETE) {
 273         *minor = code;
 274         major = code != 0 ? GSS_S_FAILURE : GSS_S_COMPLETE;
 275     }
 276
 277     return major;
 278 }
 279
 280 static int
 281 isTicketGrantingServiceP(krb5_context krbContext,
 282                          krb5_const_principal principal)
 283 {
 284     if (krb5_princ_size(krbContext, principal) == 2 &&
 285         krb5_princ_component(krbContext, principal, 0)->length == 6 &&
 286         memcmp(krb5_princ_component(krbContext,
 287                                     principal, 0)->data, "krbtgt", 6) == 0)
 288         return TRUE;
 289
 290     return FALSE;
 291 }
 292
 293 /*
 294  * Returns TRUE if the configuration variable reauth_use_ccache is
 295  * set in krb5.conf for the eap_gss application and the client realm.
 296  */
 297 static int
 298 reauthUseCredsCache(krb5_context krbContext,
 299                     krb5_principal principal)
 300 {
 301     int reauthUseCCache;
 302
 303     /* if reauth_use_ccache, use default credentials cache if ticket is for us */
 304     krb5_appdefault_boolean(krbContext, "eap_gss",
 305                             krb5_princ_realm(krbContext, principal),
 306                             "reauth_use_ccache", 0, &reauthUseCCache);
 307
 308     return reauthUseCCache;
 309 }
 310
 311 /*
 312  * Look in default credentials cache for reauthentication credentials,
 313  * if policy allows.
 314  */
 315 static OM_uint32
 316 getDefaultReauthCredentials(OM_uint32 *minor,
 317                             gss_cred_id_t cred,
 318                             gss_name_t target,
 319                             time_t now,
 320                             OM_uint32 timeReq)
 321 {
 322     OM_uint32 major = GSS_S_CRED_UNAVAIL;
 323     krb5_context krbContext = NULL;
 324     krb5_error_code code = 0;
 325     krb5_ccache ccache = NULL;
 326     krb5_creds match = { 0 };
 327     krb5_creds creds = { 0 };
 328
 329     GSSEAP_KRB_INIT(&krbContext);
 330
 331     assert(cred != GSS_C_NO_CREDENTIAL);
 332     assert(target != GSS_C_NO_NAME);
 333
 334     if (cred->name == GSS_C_NO_NAME ||
 335         !reauthUseCredsCache(krbContext, cred->name->krbPrincipal))
 336         goto cleanup;
 337
 338     match.client = cred->name->krbPrincipal;
 339     match.server = target->krbPrincipal;
 340     if (timeReq != 0 && timeReq != GSS_C_INDEFINITE)
 341         match.times.endtime = now + timeReq;
 342
 343     code = krb5_cc_default(krbContext, &ccache);
 344     if (code != 0)
 345         goto cleanup;
 346
 347     code = krb5_cc_retrieve_cred(krbContext, ccache, 0, &match, &creds);
 348     if (code != 0)
 349         goto cleanup;
 350
 351     cred->flags |= CRED_FLAG_DEFAULT_CCACHE;
 352     cred->krbCredCache = ccache;
 353     ccache = NULL;
 354
 355     major = gss_krb5_import_cred(minor, cred->krbCredCache, NULL, NULL,
 356                                  &cred->krbCred);
 357
 358 cleanup:
 359     if (major == GSS_S_CRED_UNAVAIL)
 360         *minor = code;
 361
 362     if (ccache != NULL)
 363         krb5_cc_close(krbContext, ccache);
 364     krb5_free_cred_contents(krbContext, &creds);
 365
 366     return major;
 367 }
 368
 369 /*
 370  * Returns TRUE if the credential handle's reauth credentials are
 371  * valid or if we can use the default credentials cache. Credentials
 372  * handle must be locked.
 373  */
 374 int
 375 gssEapCanReauthP(gss_cred_id_t cred,
 376                  gss_name_t target,
 377                  OM_uint32 timeReq)
 378 {
 379     time_t now, expiryReq;
 380     OM_uint32 minor;
 381
 382     assert(cred != GSS_C_NO_CREDENTIAL);
 383
 384     now = time(NULL);
 385     expiryReq = now;
 386     if (timeReq != GSS_C_INDEFINITE)
 387         expiryReq += timeReq;
 388
 389     if (cred->krbCredCache != NULL && cred->expiryTime > expiryReq)
 390         return TRUE;
 391
 392     if (getDefaultReauthCredentials(&minor, cred, target,
 393                                     now, timeReq) == GSS_S_COMPLETE)
 394         return TRUE;
 395
 396     return FALSE;
 397 }
 398
 399 /*
 400  * Store re-authentication (Kerberos) credentials in a credential handle.
 401  * Credentials handle must be locked.
 402  */
 403 OM_uint32
 404 gssEapStoreReauthCreds(OM_uint32 *minor,
 405                        gss_ctx_id_t ctx,
 406                        gss_cred_id_t cred,
 407                        gss_buffer_t credBuf)
 408 {
 409     OM_uint32 major = GSS_S_COMPLETE;
 410     krb5_error_code code;
 411     krb5_context krbContext = NULL;
 412     krb5_auth_context authContext = NULL;
 413     krb5_data credData = { 0 };
 414     krb5_creds **creds = NULL;
 415     krb5_principal canonPrinc;
 416     krb5_principal ccPrinc = NULL;
 417     int i;
 418
 419     if (credBuf->length == 0 || cred == GSS_C_NO_CREDENTIAL)
 420         return GSS_S_COMPLETE;
 421
 422     GSSEAP_KRB_INIT(&krbContext);
 423
 424     code = krb5_auth_con_init(krbContext, &authContext);
 425     if (code != 0)
 426         goto cleanup;
 427
 428     code = krb5_auth_con_setflags(krbContext, authContext, 0);
 429     if (code != 0)
 430         goto cleanup;
 431
 432     code = krb5_auth_con_setrecvsubkey(krbContext, authContext,
 433                                        &ctx->rfc3961Key);
 434     if (code != 0)
 435         goto cleanup;
 436
 437     gssBufferToKrbData(credBuf, &credData);
 438
 439     code = krb5_rd_cred(krbContext, authContext, &credData, &creds, NULL);
 440     if (code != 0)
 441         goto cleanup;
 442
 443     if (creds == NULL || creds[0] == NULL)
 444         goto cleanup;
 445
 446     code = krb5_copy_principal(krbContext, creds[0]->client, &canonPrinc);
 447     if (code != 0)
 448         goto cleanup;
 449
 450     krb5_free_principal(krbContext, cred->name->krbPrincipal);
 451     cred->name->krbPrincipal = canonPrinc;
 452
 453     if (creds[0]->times.endtime == KRB5_INT32_MAX)
 454         cred->expiryTime = 0;
 455     else
 456         cred->expiryTime = creds[0]->times.endtime;
 457
 458     if (cred->krbCredCache == NULL) {
 459         if (reauthUseCredsCache(krbContext, creds[0]->client) &&
 460             krb5_cc_default(krbContext, &cred->krbCredCache) == 0)
 461             cred->flags |= CRED_FLAG_DEFAULT_CCACHE;
 462     } else {
 463         /*
 464          * If we already have an associated credentials cache, possibly from
 465          * the last time we stored a reauthentication credential, then we
 466          * need to clear it out and release the associated GSS credential.
 467          */
 468         if (cred->flags & CRED_FLAG_DEFAULT_CCACHE) {
 469             krb5_cc_remove_cred(krbContext, cred->krbCredCache, 0, creds[0]);
 470         } else {
 471             krb5_cc_destroy(krbContext, cred->krbCredCache);
 472             cred->krbCredCache = NULL;
 473         }
 474         gssReleaseCred(minor, &cred->krbCred);
 475     }
 476
 477     if (cred->krbCredCache == NULL) {
 478         code = krb5_cc_new_unique(krbContext, "MEMORY", NULL, &cred->krbCredCache);
 479         if (code != 0)
 480             goto cleanup;
 481     }
 482
 483     if ((cred->flags & CRED_FLAG_DEFAULT_CCACHE) == 0 ||
 484         krb5_cc_get_principal(krbContext, cred->krbCredCache, &ccPrinc) != 0) {
 485         code = krb5_cc_initialize(krbContext, cred->krbCredCache,
 486                                   creds[0]->client);
 487         if (code != 0)
 488             goto cleanup;
 489     }
 490
 491     for (i = 0; creds[i] != NULL; i++) {
 492         krb5_creds kcred = *(creds[i]);
 493
 494         /*
 495          * Swap in the acceptor name the client asked for so
 496          * get_credentials() works. We're making the assumption that
 497          * any service tickets returned are for us. We'll need to
 498          * reflect some more on whether that is a safe assumption.
 499          */
 500         if (!isTicketGrantingServiceP(krbContext, kcred.server))
 501             kcred.server = ctx->acceptorName->krbPrincipal;
 502
 503         code = krb5_cc_store_cred(krbContext, cred->krbCredCache, &kcred);
 504         if (code != 0)
 505             goto cleanup;
 506     }
 507
 508     major = gss_krb5_import_cred(minor, cred->krbCredCache, NULL, NULL,
 509                                  &cred->krbCred);
 510     if (GSS_ERROR(major))
 511         goto cleanup;
 512
 513 cleanup:
 514     *minor = code;
 515
 516     krb5_free_principal(krbContext, ccPrinc);
 517     krb5_auth_con_free(krbContext, authContext);
 518     if (creds != NULL) {
 519         for (i = 0; creds[i] != NULL; i++)
 520             krb5_free_creds(krbContext, creds[i]);
 521         GSSEAP_FREE(creds);
 522     }
 523     if (major == GSS_S_COMPLETE)
 524         major = *minor ? GSS_S_FAILURE : GSS_S_COMPLETE;
 525
 526     return major;
 527 }
 528
 529 static gss_buffer_desc radiusAvpKrbAttr = {
 530     sizeof("urn:authdata-radius-avp") - 1, "urn:authdata-radius-avp"
 531 };
 532
 533 /*
 534  * Unfortunately extracting an AD-KDCIssued authorization data element
 535  * is pretty implementation-dependent. It's not possible to verify the
 536  * signature ourselves because the ticket session key is not exposed
 537  * outside GSS. In an ideal world, all AD-KDCIssued elements would be
 538  * verified by the Kerberos library and authentication would fail if
 539  * verification failed. We're not quite there yet and as a result have
 540  * to go through some hoops to get this to work. The alternative would
 541  * be to sign the authorization data with our long-term key, but it
 542  * seems a pity to compromise the design because of current implementation
 543  * limitations.
 544  *
 545  * (Specifically, the hoops involve a libkrb5 authorisation data plugin
 546  * that exposes the verified and serialised attribute context through
 547  * the Kerberos GSS mechanism's naming extensions API.)
 548  */
 549 static OM_uint32
 550 defrostAttrContext(OM_uint32 *minor,
 551                    gss_name_t glueName,
 552                    gss_name_t mechName)
 553 {
 554     OM_uint32 major, tmpMinor;
 555     gss_buffer_desc authData = GSS_C_EMPTY_BUFFER;
 556     gss_buffer_desc authDataDisplay = GSS_C_EMPTY_BUFFER;
 557     int more = -1;
 558     int authenticated, complete;
 559
 560     major = gssGetNameAttribute(minor, glueName, &radiusAvpKrbAttr,
 561                                 &authenticated, &complete,
 562                                 &authData, &authDataDisplay, &more);
 563     if (major == GSS_S_COMPLETE) {
 564         if (authenticated == 0)
 565             major = GSS_S_BAD_NAME;
 566         else
 567             major = gssEapImportAttrContext(minor, &authData, mechName);
 568     } else if (major == GSS_S_UNAVAILABLE) {
 569         major = GSS_S_COMPLETE;
 570     }
 571
 572     gss_release_buffer(&tmpMinor, &authData);
 573     gss_release_buffer(&tmpMinor, &authDataDisplay);
 574
 575     return major;
 576 }
 577
 578 /*
 579  * Convert a mechanism glue to an EAP mechanism name by displaying and
 580  * importing it. This also handles the RADIUS attributes.
 581  */
 582 OM_uint32
 583 gssEapGlueToMechName(OM_uint32 *minor,
 584                      gss_name_t glueName,
 585                      gss_name_t *pMechName)
 586 {
 587     OM_uint32 major, tmpMinor;
 588     gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER;
 589
 590     *pMechName = GSS_C_NO_NAME;
 591
 592     major = gssDisplayName(minor, glueName, &nameBuf, NULL);
 593     if (GSS_ERROR(major))
 594         goto cleanup;
 595
 596     major = gssEapImportName(minor, &nameBuf, GSS_C_NT_USER_NAME,
 597                              pMechName);
 598     if (GSS_ERROR(major))
 599         goto cleanup;
 600
 601     major = defrostAttrContext(minor, glueName, *pMechName);
 602     if (GSS_ERROR(major))
 603         goto cleanup;
 604
 605 cleanup:
 606     if (GSS_ERROR(major)) {
 607         gssReleaseName(&tmpMinor, pMechName);
 608         *pMechName = GSS_C_NO_NAME;
 609     }
 610
 611     gss_release_buffer(&tmpMinor, &nameBuf);
 612
 613     return major;
 614 }
 615
 616 /*
 617  * Convert an EAP mechanism name to a mechanism glue name by displaying
 618  * and importing it.
 619  */
 620 OM_uint32
 621 gssEapMechToGlueName(OM_uint32 *minor,
 622                      gss_name_t mechName,
 623                      gss_name_t *pGlueName)
 624 {
 625     OM_uint32 major, tmpMinor;
 626     gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER;
 627
 628     *pGlueName = GSS_C_NO_NAME;
 629
 630     major = gssEapDisplayName(minor, mechName, &nameBuf, NULL);
 631     if (GSS_ERROR(major))
 632         goto cleanup;
 633
 634     major = gssImportName(minor, &nameBuf, GSS_C_NT_USER_NAME,
 635                           pGlueName);
 636     if (GSS_ERROR(major))
 637         goto cleanup;
 638
 639 cleanup:
 640     gss_release_buffer(&tmpMinor, &nameBuf);
 641
 642     return major;
 643 }
 644
 645 /*
 646  * Suck out the analgous elements of a Kerberos GSS context into an EAP
 647  * one so that the application doesn't know the difference.
 648  */
 649 OM_uint32
 650 gssEapReauthComplete(OM_uint32 *minor,
 651                     gss_ctx_id_t ctx,
 652                     gss_cred_id_t cred,
 653                     const gss_OID mech,
 654                     OM_uint32 timeRec)
 655 {
 656     OM_uint32 major, tmpMinor;
 657     gss_buffer_set_t keyData = GSS_C_NO_BUFFER_SET;
 658
 659     if (!oidEqual(mech, gss_mech_krb5)) {
 660         major = GSS_S_BAD_MECH;
 661         goto cleanup;
 662     }
 663
 664     /* Get the raw subsession key and encryption type*/
 665     major = gssInquireSecContextByOid(minor, ctx->kerberosCtx,
 666                                       GSS_C_INQ_SSPI_SESSION_KEY, &keyData);
 667     if (GSS_ERROR(major))
 668         goto cleanup;
 669
 670     {
 671         gss_OID_desc oid;
 672         int suffix;
 673
 674         oid.length = keyData->elements[1].length;
 675         oid.elements = keyData->elements[1].value;
 676
 677         /* GSS_KRB5_SESSION_KEY_ENCTYPE_OID */
 678         major = decomposeOid(minor,
 679                              "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04",
 680                              10, &oid, &suffix);
 681         if (GSS_ERROR(major))
 682             goto cleanup;
 683
 684         ctx->encryptionType = suffix;
 685     }
 686
 687     {
 688         krb5_context krbContext = NULL;
 689         krb5_keyblock key;
 690
 691         GSSEAP_KRB_INIT(&krbContext);
 692
 693         KRB_KEY_LENGTH(&key) = keyData->elements[0].length;
 694         KRB_KEY_DATA(&key)   = keyData->elements[0].value;
 695         KRB_KEY_TYPE(&key)   = ctx->encryptionType;
 696
 697         *minor = krb5_copy_keyblock_contents(krbContext,
 698                                              &key, &ctx->rfc3961Key);
 699         if (*minor != 0) {
 700             major = GSS_S_FAILURE;
 701             goto cleanup;
 702         }
 703     }
 704
 705     major = rfc3961ChecksumTypeForKey(minor, &ctx->rfc3961Key,
 706                                       &ctx->checksumType);
 707     if (GSS_ERROR(major))
 708         goto cleanup;
 709
 710     if (timeRec != GSS_C_INDEFINITE)
 711         ctx->expiryTime = time(NULL) + timeRec;
 712
 713     /* Initialize our sequence state */
 714     major = sequenceInit(minor,
 715                          &ctx->seqState, ctx->recvSeq,
 716                          ((ctx->gssFlags & GSS_C_REPLAY_FLAG) != 0),
 717                          ((ctx->gssFlags & GSS_C_SEQUENCE_FLAG) != 0),
 718                          TRUE);
 719     if (GSS_ERROR(major))
 720         goto cleanup;
 721
 722     major = GSS_S_COMPLETE;
 723
 724 cleanup:
 725     gss_release_buffer_set(&tmpMinor, &keyData);
 726
 727     return major;
 728 }
 729
 730 /*
 731  * The remainder of this file consists of wrappers so we can call into the
 732  * mechanism glue without calling ourselves.
 733  */
 734 static OM_uint32
 735 (*gssInitSecContextNext)(OM_uint32 *,
 736                          gss_cred_id_t,
 737                          gss_ctx_id_t *,
 738                          gss_name_t,
 739                          gss_OID,
 740                          OM_uint32,
 741                          OM_uint32,
 742                          gss_channel_bindings_t,
 743                          gss_buffer_t,
 744                          gss_OID *,
 745                          gss_buffer_t,
 746                          OM_uint32 *,
 747                          OM_uint32 *);
 748
 749 static OM_uint32
 750 (*gssAcceptSecContextNext)(OM_uint32 *,
 751                            gss_ctx_id_t *,
 752                            gss_cred_id_t,
 753                            gss_buffer_t,
 754                            gss_channel_bindings_t,
 755                            gss_name_t *,
 756                            gss_OID *,
 757                            gss_buffer_t,
 758                            OM_uint32 *,
 759                            OM_uint32 *,
 760                            gss_cred_id_t *);
 761
 762 static OM_uint32
 763 (*gssReleaseCredNext)(OM_uint32 *, gss_cred_id_t *);
 764
 765 static OM_uint32
 766 (*gssReleaseNameNext)(OM_uint32 *, gss_name_t *);
 767
 768 static OM_uint32
 769 (*gssInquireSecContextByOidNext)(OM_uint32 *,
 770                                  const gss_ctx_id_t,
 771                                  const gss_OID,
 772                                  gss_buffer_set_t *);
 773
 774 static OM_uint32
 775 (*gssDeleteSecContextNext)(OM_uint32 *,
 776                           gss_ctx_id_t *,
 777                           gss_buffer_t);
 778
 779 static OM_uint32
 780 (*gssDisplayNameNext)(OM_uint32 *,
 781                       gss_name_t,
 782                       gss_buffer_t,
 783                       gss_OID *);
 784
 785 static OM_uint32
 786 (*gssImportNameNext)(OM_uint32 *,
 787                      gss_buffer_t,
 788                      gss_OID,
 789                      gss_name_t *);
 790
 791 static OM_uint32
 792 (*gssStoreCredNext)(OM_uint32 *,
 793                     const gss_cred_id_t,
 794                     gss_cred_usage_t,
 795                     const gss_OID,
 796                     OM_uint32,
 797                     OM_uint32,
 798                     gss_OID_set *,
 799                     gss_cred_usage_t *);
 800
 801 static OM_uint32
 802 (*gssGetNameAttributeNext)(OM_uint32 *,
 803                           gss_name_t,
 804                           gss_buffer_t,
 805                           int *,
 806                           int *,
 807                           gss_buffer_t,
 808                           gss_buffer_t,
 809                           int *);
 810
 811 #define NEXT_SYMBOL(local, global)  do {        \
 812         ((local) = dlsym(RTLD_NEXT, (global))); \
 813         if ((local) == NULL) {                  \
 814             *minor = GSSEAP_NO_MECHGLUE_SYMBOL; \
 815             major = GSS_S_UNAVAILABLE;          \
 816             /* but continue */                  \
 817         }                                       \
 818     } while (0)
 819
 820 OM_uint32
 821 gssEapReauthInitialize(OM_uint32 *minor)
 822 {
 823     OM_uint32 major = GSS_S_COMPLETE;
 824
 825     NEXT_SYMBOL(gssInitSecContextNext,         "gss_init_sec_context");
 826     NEXT_SYMBOL(gssAcceptSecContextNext,       "gss_accept_sec_context");
 827     NEXT_SYMBOL(gssReleaseCredNext,            "gss_release_cred");
 828     NEXT_SYMBOL(gssReleaseNameNext,            "gss_release_name");
 829     NEXT_SYMBOL(gssInquireSecContextByOidNext, "gss_inquire_sec_context_by_oid");
 830     NEXT_SYMBOL(gssDeleteSecContextNext,       "gss_delete_sec_context");
 831     NEXT_SYMBOL(gssDisplayNameNext,            "gss_display_name");
 832     NEXT_SYMBOL(gssImportNameNext,             "gss_import_name");
 833     NEXT_SYMBOL(gssStoreCredNext,              "gss_store_cred");
 834     NEXT_SYMBOL(gssGetNameAttributeNext,       "gss_get_name_attribute");
 835
 836     return major;
 837 }
 838
 839 OM_uint32
 840 gssInitSecContext(OM_uint32 *minor,
 841                   gss_cred_id_t cred,
 842                   gss_ctx_id_t *context_handle,
 843                   gss_name_t target_name,
 844                   gss_OID mech_type,
 845                   OM_uint32 req_flags,
 846                   OM_uint32 time_req,
 847                   gss_channel_bindings_t input_chan_bindings,
 848                   gss_buffer_t input_token,
 849                   gss_OID *actual_mech_type,
 850                   gss_buffer_t output_token,
 851                   OM_uint32 *ret_flags,
 852                   OM_uint32 *time_rec)
 853 {
 854     if (gssInitSecContextNext == NULL) {
 855         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 856         return GSS_S_UNAVAILABLE;
 857     }
 858
 859     return gssInitSecContextNext(minor, cred, context_handle,
 860                                  target_name, mech_type, req_flags,
 861                                  time_req, input_chan_bindings,
 862                                  input_token, actual_mech_type,
 863                                  output_token, ret_flags, time_rec);
 864 }
 865
 866 OM_uint32
 867 gssAcceptSecContext(OM_uint32 *minor,
 868                     gss_ctx_id_t *context_handle,
 869                     gss_cred_id_t cred,
 870                     gss_buffer_t input_token,
 871                     gss_channel_bindings_t input_chan_bindings,
 872                     gss_name_t *src_name,
 873                     gss_OID *mech_type,
 874                     gss_buffer_t output_token,
 875                     OM_uint32 *ret_flags,
 876                     OM_uint32 *time_rec,
 877                     gss_cred_id_t *delegated_cred_handle)
 878 {
 879     if (gssAcceptSecContextNext == NULL) {
 880         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 881         return GSS_S_UNAVAILABLE;
 882     }
 883
 884     return gssAcceptSecContextNext(minor, context_handle, cred,
 885                                    input_token, input_chan_bindings,
 886                                    src_name, mech_type, output_token,
 887                                    ret_flags, time_rec, delegated_cred_handle);
 888 }
 889
 890 OM_uint32
 891 gssReleaseCred(OM_uint32 *minor,
 892                gss_cred_id_t *cred_handle)
 893 {
 894     if (gssReleaseCredNext == NULL) {
 895         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 896         return GSS_S_UNAVAILABLE;
 897     }
 898
 899     return gssReleaseCredNext(minor, cred_handle);
 900 }
 901
 902 OM_uint32
 903 gssReleaseName(OM_uint32 *minor,
 904                gss_name_t *name)
 905 {
 906     if (gssReleaseName == NULL) {
 907         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 908         return GSS_S_UNAVAILABLE;
 909     }
 910
 911     return gssReleaseNameNext(minor, name);
 912 }
 913
 914 OM_uint32
 915 gssDeleteSecContext(OM_uint32 *minor,
 916                     gss_ctx_id_t *context_handle,
 917                     gss_buffer_t output_token)
 918 {
 919     if (gssDeleteSecContextNext == NULL) {
 920         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 921         return GSS_S_UNAVAILABLE;
 922     }
 923
 924     return gssDeleteSecContextNext(minor, context_handle, output_token);
 925 }
 926
 927 static OM_uint32
 928 gssDisplayName(OM_uint32 *minor,
 929                gss_name_t name,
 930                gss_buffer_t buffer,
 931                gss_OID *name_type)
 932 {
 933     if (gssDisplayNameNext == NULL) {
 934         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 935         return GSS_S_UNAVAILABLE;
 936     }
 937
 938     return gssDisplayNameNext(minor, name, buffer, name_type);
 939 }
 940
 941 static OM_uint32
 942 gssImportName(OM_uint32 *minor,
 943               gss_buffer_t buffer,
 944               gss_OID name_type,
 945               gss_name_t *name)
 946 {
 947     if (gssImportNameNext == NULL) {
 948         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 949         return GSS_S_UNAVAILABLE;
 950     }
 951
 952     return gssImportNameNext(minor, buffer, name_type, name);
 953 }
 954
 955 OM_uint32
 956 gssInquireSecContextByOid(OM_uint32 *minor,
 957                           const gss_ctx_id_t context_handle,
 958                           const gss_OID desired_object,
 959                           gss_buffer_set_t *data_set)
 960 {
 961     if (gssInquireSecContextByOidNext == NULL) {
 962         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 963         return GSS_S_UNAVAILABLE;
 964     }
 965
 966     return gssInquireSecContextByOidNext(minor, context_handle,
 967                                          desired_object, data_set);
 968 }
 969
 970 OM_uint32
 971 gssStoreCred(OM_uint32 *minor,
 972              const gss_cred_id_t input_cred_handle,
 973              gss_cred_usage_t input_usage,
 974              const gss_OID desired_mech,
 975              OM_uint32 overwrite_cred,
 976              OM_uint32 default_cred,
 977              gss_OID_set *elements_stored,
 978              gss_cred_usage_t *cred_usage_stored)
 979 {
 980     if (gssStoreCredNext == NULL) {
 981         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 982         return GSS_S_UNAVAILABLE;
 983     }
 984
 985     return gssStoreCredNext(minor, input_cred_handle, input_usage,
 986                             desired_mech, overwrite_cred, default_cred,
 987                             elements_stored, cred_usage_stored);
 988 }
 989
 990 OM_uint32
 991 gssGetNameAttribute(OM_uint32 *minor,
 992                     gss_name_t name,
 993                     gss_buffer_t attr,
 994                     int *authenticated,
 995                     int *complete,
 996                     gss_buffer_t value,
 997                     gss_buffer_t display_value,
 998                     int *more)
 999 {
1000     if (gssGetNameAttributeNext == NULL) {
1001         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
1002         return GSS_S_UNAVAILABLE;
1003     }
1004
1005     return gssGetNameAttributeNext(minor, name, attr, authenticated, complete,
1006                                    value, display_value, more);
1007 }