www.project-moonshot.org Git - mech_eap.orig/blob - util_reauth.c

   1 /*
   2  * Copyright (c) 2010, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 /*
  34  * Fast reauthentication support.
  35  */
  36
  37 #include "gssapiP_eap.h"
  38
  39 #include <dlfcn.h>
  40
  41 /*
  42  * Fast reauthentication support for EAP GSS.
  43  */
  44
  45 krb5_error_code
  46 krb5_encrypt_tkt_part(krb5_context, const krb5_keyblock *, krb5_ticket *);
  47
  48 krb5_error_code
  49 encode_krb5_ticket(const krb5_ticket *rep, krb5_data **code);
  50
  51 static OM_uint32
  52 gssDisplayName(OM_uint32 *minor,
  53                gss_name_t name,
  54                gss_buffer_t buffer,
  55                gss_OID *name_type);
  56
  57 static OM_uint32
  58 gssImportName(OM_uint32 *minor,
  59               gss_buffer_t buffer,
  60               gss_OID name_type,
  61               gss_name_t *name);
  62
  63 static krb5_error_code
  64 getAcceptorKey(krb5_context krbContext,
  65                gss_ctx_id_t ctx,
  66                gss_cred_id_t cred,
  67                krb5_principal *princ,
  68                krb5_keyblock *key)
  69 {
  70     krb5_error_code code;
  71     krb5_keytab keytab = NULL;
  72     krb5_keytab_entry ktent = { 0 };
  73     krb5_kt_cursor cursor = NULL;
  74
  75     *princ = NULL;
  76     memset(key, 0, sizeof(*key));
  77
  78     code = krb5_kt_default(krbContext, &keytab);
  79     if (code != 0)
  80         goto cleanup;
  81
  82     if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) {
  83         code = krb5_kt_get_entry(krbContext, keytab,
  84                                  cred->name->krbPrincipal, 0,
  85                                  ctx->encryptionType, &ktent);
  86         if (code != 0)
  87             goto cleanup;
  88     } else {
  89         /*
  90          * It's not clear that looking encrypting the ticket in the
  91          * requested EAP enctype provides any value.
  92          */
  93         code = krb5_kt_start_seq_get(krbContext, keytab, &cursor);
  94         if (code != 0)
  95             goto cleanup;
  96
  97         while ((code = krb5_kt_next_entry(krbContext, keytab,
  98                                           &ktent, &cursor)) == 0) {
  99             if (ktent.key.enctype == ctx->encryptionType)
 100                 break;
 101             else
 102                 krb5_free_keytab_entry_contents(krbContext, &ktent);
 103         }
 104     }
 105
 106     if (code == 0) {
 107         *princ = ktent.principal;
 108         *key = ktent.key;
 109     }
 110
 111 cleanup:
 112     if (cred == GSS_C_NO_CREDENTIAL || cred->name == GSS_C_NO_NAME)
 113         krb5_kt_end_seq_get(krbContext, keytab, &cursor);
 114     krb5_kt_close(krbContext, keytab);
 115
 116     if (code != 0)
 117         krb5_free_keytab_entry_contents(krbContext, &ktent);
 118
 119     return code;
 120 }
 121
 122 static OM_uint32
 123 freezeAttrContext(OM_uint32 *minor,
 124                   gss_name_t initiatorName,
 125                   krb5_const_principal acceptorPrinc,
 126                   krb5_keyblock *session,
 127                   krb5_authdata ***authdata)
 128 {
 129     OM_uint32 major, tmpMinor;
 130     krb5_error_code code;
 131     gss_buffer_desc attrBuf = GSS_C_EMPTY_BUFFER;
 132     krb5_authdata *authData[2], authDatum = { 0 };
 133     krb5_context krbContext;
 134
 135     GSSEAP_KRB_INIT(&krbContext);
 136
 137     major = gssEapExportAttrContext(minor, initiatorName, &attrBuf);
 138     if (GSS_ERROR(major))
 139         return major;
 140
 141     authDatum.ad_type = KRB5_AUTHDATA_RADIUS_AVP;
 142     authDatum.length = attrBuf.length;
 143     authDatum.contents = attrBuf.value;
 144     authData[0] = &authDatum;
 145     authData[1] = NULL;
 146
 147     code = krb5_make_authdata_kdc_issued(krbContext, session, acceptorPrinc,
 148                                          authData, authdata);
 149     if (code != 0) {
 150         major = GSS_S_FAILURE;
 151         *minor = code;
 152     } else {
 153         major = GSS_S_COMPLETE;
 154     }
 155
 156     gss_release_buffer(&tmpMinor, &attrBuf);
 157
 158     return major;
 159 }
 160
 161 /*
 162  * Fabricate a ticket to ourselves given a GSS EAP context.
 163  */
 164 OM_uint32
 165 gssEapMakeReauthCreds(OM_uint32 *minor,
 166                       gss_ctx_id_t ctx,
 167                       gss_cred_id_t cred,
 168                       gss_buffer_t credBuf)
 169 {
 170     OM_uint32 major = GSS_S_COMPLETE;
 171     krb5_error_code code;
 172     krb5_context krbContext = NULL;
 173     krb5_ticket ticket = { 0 };
 174     krb5_keyblock session = { 0 }, acceptorKey = { 0 };
 175     krb5_enc_tkt_part enc_part = { 0 };
 176     krb5_data *ticketData = NULL, *credsData = NULL;
 177     krb5_creds creds = { 0 };
 178     krb5_auth_context authContext = NULL;
 179
 180     credBuf->length = 0;
 181     credBuf->value = NULL;
 182
 183     GSSEAP_KRB_INIT(&krbContext);
 184
 185     code = getAcceptorKey(krbContext, ctx, cred,
 186                           &ticket.server, &acceptorKey);
 187     if (code == KRB5_KT_NOTFOUND) {
 188         *minor = code;
 189         return GSS_S_UNAVAILABLE;
 190     } else if (code != 0)
 191         goto cleanup;
 192
 193     enc_part.flags = TKT_FLG_INITIAL;
 194
 195     /*
 196      * Generate a random session key to place in the ticket and
 197      * sign the "KDC-Issued" authorization data element.
 198      */
 199     code = krb5_c_make_random_key(krbContext, ctx->encryptionType,
 200                                   &session);
 201     if (code != 0)
 202         goto cleanup;
 203
 204     enc_part.session = &session;
 205     enc_part.client = ctx->initiatorName->krbPrincipal;
 206     enc_part.times.authtime = time(NULL);
 207     enc_part.times.starttime = enc_part.times.authtime;
 208     enc_part.times.endtime = (ctx->expiryTime != 0)
 209                              ? ctx->expiryTime
 210                              : KRB5_INT32_MAX;
 211     enc_part.times.renew_till = 0;
 212
 213     major = freezeAttrContext(minor, ctx->initiatorName, ticket.server,
 214                               &session, &enc_part.authorization_data);
 215     if (GSS_ERROR(major))
 216         goto cleanup;
 217
 218     ticket.enc_part2 = &enc_part;
 219
 220     code = krb5_encrypt_tkt_part(krbContext, &acceptorKey, &ticket);
 221     if (code != 0)
 222         goto cleanup;
 223
 224     code = encode_krb5_ticket(&ticket, &ticketData);
 225     if (code != 0)
 226         goto cleanup;
 227
 228     creds.client = enc_part.client;
 229     creds.server = ticket.server;
 230     creds.keyblock = session;
 231     creds.times = enc_part.times;
 232     creds.ticket_flags = enc_part.flags;
 233     creds.ticket = *ticketData;
 234     creds.authdata = enc_part.authorization_data;
 235
 236     code = krb5_auth_con_init(krbContext, &authContext);
 237     if (code != 0)
 238         goto cleanup;
 239
 240     code = krb5_auth_con_setflags(krbContext, authContext, 0);
 241     if (code != 0)
 242         goto cleanup;
 243
 244     code = krb5_auth_con_setsendsubkey(krbContext, authContext,
 245                                        &ctx->rfc3961Key);
 246     if (code != 0)
 247         goto cleanup;
 248
 249     code = krb5_mk_1cred(krbContext, authContext, &creds, &credsData, NULL);
 250     if (code != 0)
 251         goto cleanup;
 252
 253     krbDataToGssBuffer(credsData, credBuf);
 254
 255 cleanup:
 256     if (ticket.enc_part.ciphertext.data != NULL)
 257         GSSEAP_FREE(ticket.enc_part.ciphertext.data);
 258     krb5_free_keyblock_contents(krbContext, &session);
 259     krb5_free_keyblock_contents(krbContext, &acceptorKey);
 260     krb5_free_data(krbContext, ticketData);
 261     krb5_auth_con_free(krbContext, authContext);
 262     krb5_free_authdata(krbContext, enc_part.authorization_data);
 263     if (credsData != NULL)
 264         GSSEAP_FREE(credsData);
 265
 266     if (major == GSS_S_COMPLETE) {
 267         *minor = code;
 268         major = code != 0 ? GSS_S_FAILURE : GSS_S_COMPLETE;
 269     }
 270
 271     return major;
 272 }
 273
 274 static int
 275 isTicketGrantingServiceP(krb5_context krbContext,
 276                          krb5_const_principal principal)
 277 {
 278     if (KRB_PRINC_LENGTH(principal) == 2 &&
 279         krb5_princ_component(krbContext, principal, 0)->length == 6 &&
 280         memcmp(krb5_princ_component(krbContext,
 281                                     principal, 0)->data, "krbtgt", 6) == 0)
 282         return TRUE;
 283
 284     return FALSE;
 285 }
 286
 287 /*
 288  * Returns TRUE if the configuration variable reauth_use_ccache is
 289  * set in krb5.conf for the eap_gss application and the client realm.
 290  */
 291 static int
 292 reauthUseCredsCache(krb5_context krbContext,
 293                     krb5_principal principal)
 294 {
 295     int reauthUseCCache;
 296
 297     /* if reauth_use_ccache, use default credentials cache if ticket is for us */
 298     krb5_appdefault_boolean(krbContext, "eap_gss",
 299                             krb5_princ_realm(krbContext, principal),
 300                             "reauth_use_ccache", 0, &reauthUseCCache);
 301
 302     return reauthUseCCache;
 303 }
 304
 305 /*
 306  * Look in default credentials cache for reauthentication credentials,
 307  * if policy allows.
 308  */
 309 static OM_uint32
 310 getDefaultReauthCredentials(OM_uint32 *minor,
 311                             gss_cred_id_t cred,
 312                             gss_name_t target,
 313                             time_t now,
 314                             OM_uint32 timeReq)
 315 {
 316     OM_uint32 major = GSS_S_CRED_UNAVAIL;
 317     krb5_context krbContext = NULL;
 318     krb5_error_code code = 0;
 319     krb5_ccache ccache = NULL;
 320     krb5_creds match = { 0 };
 321     krb5_creds creds = { 0 };
 322
 323     GSSEAP_KRB_INIT(&krbContext);
 324
 325     assert(cred != GSS_C_NO_CREDENTIAL);
 326     assert(target != GSS_C_NO_NAME);
 327
 328     if (cred->name == GSS_C_NO_NAME ||
 329         !reauthUseCredsCache(krbContext, cred->name->krbPrincipal))
 330         goto cleanup;
 331
 332     match.client = cred->name->krbPrincipal;
 333     match.server = target->krbPrincipal;
 334     if (timeReq != 0 && timeReq != GSS_C_INDEFINITE)
 335         match.times.endtime = now + timeReq;
 336
 337     code = krb5_cc_default(krbContext, &ccache);
 338     if (code != 0)
 339         goto cleanup;
 340
 341     code = krb5_cc_retrieve_cred(krbContext, ccache, 0, &match, &creds);
 342     if (code != 0)
 343         goto cleanup;
 344
 345     cred->flags |= CRED_FLAG_DEFAULT_CCACHE;
 346     cred->krbCredCache = ccache;
 347     ccache = NULL;
 348
 349     major = gss_krb5_import_cred(minor, cred->krbCredCache, NULL, NULL,
 350                                  &cred->krbCred);
 351
 352 cleanup:
 353     if (major == GSS_S_CRED_UNAVAIL)
 354         *minor = code;
 355
 356     if (ccache != NULL)
 357         krb5_cc_close(krbContext, ccache);
 358     krb5_free_cred_contents(krbContext, &creds);
 359
 360     return major;
 361 }
 362
 363 /*
 364  * Returns TRUE if the credential handle's reauth credentials are
 365  * valid or if we can use the default credentials cache. Credentials
 366  * handle must be locked.
 367  */
 368 int
 369 gssEapCanReauthP(gss_cred_id_t cred,
 370                  gss_name_t target,
 371                  OM_uint32 timeReq)
 372 {
 373     time_t now, expiryReq;
 374     OM_uint32 minor;
 375
 376     assert(cred != GSS_C_NO_CREDENTIAL);
 377
 378     now = time(NULL);
 379     expiryReq = now;
 380     if (timeReq != GSS_C_INDEFINITE)
 381         expiryReq += timeReq;
 382
 383     if (cred->krbCredCache != NULL && cred->expiryTime > expiryReq)
 384         return TRUE;
 385
 386     if (getDefaultReauthCredentials(&minor, cred, target,
 387                                     now, timeReq) == GSS_S_COMPLETE)
 388         return TRUE;
 389
 390     return FALSE;
 391 }
 392
 393 /*
 394  * Store re-authentication (Kerberos) credentials in a credential handle.
 395  * Credentials handle must be locked.
 396  */
 397 OM_uint32
 398 gssEapStoreReauthCreds(OM_uint32 *minor,
 399                        gss_ctx_id_t ctx,
 400                        gss_cred_id_t cred,
 401                        gss_buffer_t credBuf)
 402 {
 403     OM_uint32 major = GSS_S_COMPLETE;
 404     krb5_error_code code;
 405     krb5_context krbContext = NULL;
 406     krb5_auth_context authContext = NULL;
 407     krb5_data credData = { 0 };
 408     krb5_creds **creds = NULL;
 409     krb5_principal canonPrinc;
 410     krb5_principal ccPrinc = NULL;
 411     int i;
 412
 413     if (credBuf->length == 0 || cred == GSS_C_NO_CREDENTIAL)
 414         return GSS_S_COMPLETE;
 415
 416     GSSEAP_KRB_INIT(&krbContext);
 417
 418     code = krb5_auth_con_init(krbContext, &authContext);
 419     if (code != 0)
 420         goto cleanup;
 421
 422     code = krb5_auth_con_setflags(krbContext, authContext, 0);
 423     if (code != 0)
 424         goto cleanup;
 425
 426     code = krb5_auth_con_setrecvsubkey(krbContext, authContext,
 427                                        &ctx->rfc3961Key);
 428     if (code != 0)
 429         goto cleanup;
 430
 431     gssBufferToKrbData(credBuf, &credData);
 432
 433     code = krb5_rd_cred(krbContext, authContext, &credData, &creds, NULL);
 434     if (code != 0)
 435         goto cleanup;
 436
 437     if (creds == NULL || creds[0] == NULL)
 438         goto cleanup;
 439
 440     code = krb5_copy_principal(krbContext, creds[0]->client, &canonPrinc);
 441     if (code != 0)
 442         goto cleanup;
 443
 444     krb5_free_principal(krbContext, cred->name->krbPrincipal);
 445     cred->name->krbPrincipal = canonPrinc;
 446
 447     if (creds[0]->times.endtime == KRB5_INT32_MAX)
 448         cred->expiryTime = 0;
 449     else
 450         cred->expiryTime = creds[0]->times.endtime;
 451
 452     if (cred->krbCredCache == NULL) {
 453         if (reauthUseCredsCache(krbContext, creds[0]->client) &&
 454             krb5_cc_default(krbContext, &cred->krbCredCache) == 0)
 455             cred->flags |= CRED_FLAG_DEFAULT_CCACHE;
 456     } else {
 457         /*
 458          * If we already have an associated credentials cache, possibly from
 459          * the last time we stored a reauthentication credential, then we
 460          * need to clear it out and release the associated GSS credential.
 461          */
 462         if (cred->flags & CRED_FLAG_DEFAULT_CCACHE) {
 463             krb5_cc_remove_cred(krbContext, cred->krbCredCache, 0, creds[0]);
 464         } else {
 465             krb5_cc_destroy(krbContext, cred->krbCredCache);
 466             cred->krbCredCache = NULL;
 467         }
 468         gssReleaseCred(minor, &cred->krbCred);
 469     }
 470
 471     if (cred->krbCredCache == NULL) {
 472         code = krb5_cc_new_unique(krbContext, "MEMORY", NULL, &cred->krbCredCache);
 473         if (code != 0)
 474             goto cleanup;
 475     }
 476
 477     if ((cred->flags & CRED_FLAG_DEFAULT_CCACHE) == 0 ||
 478         krb5_cc_get_principal(krbContext, cred->krbCredCache, &ccPrinc) != 0) {
 479         code = krb5_cc_initialize(krbContext, cred->krbCredCache,
 480                                   creds[0]->client);
 481         if (code != 0)
 482             goto cleanup;
 483     }
 484
 485     for (i = 0; creds[i] != NULL; i++) {
 486         krb5_creds kcred = *(creds[i]);
 487
 488         /*
 489          * Swap in the acceptor name the client asked for so
 490          * get_credentials() works. We're making the assumption that
 491          * any service tickets returned are for us. We'll need to
 492          * reflect some more on whether that is a safe assumption.
 493          */
 494         if (!isTicketGrantingServiceP(krbContext, kcred.server))
 495             kcred.server = ctx->acceptorName->krbPrincipal;
 496
 497         code = krb5_cc_store_cred(krbContext, cred->krbCredCache, &kcred);
 498         if (code != 0)
 499             goto cleanup;
 500     }
 501
 502     major = gss_krb5_import_cred(minor, cred->krbCredCache, NULL, NULL,
 503                                  &cred->krbCred);
 504     if (GSS_ERROR(major))
 505         goto cleanup;
 506
 507 cleanup:
 508     *minor = code;
 509
 510     krb5_free_principal(krbContext, ccPrinc);
 511     krb5_auth_con_free(krbContext, authContext);
 512     if (creds != NULL) {
 513         for (i = 0; creds[i] != NULL; i++)
 514             krb5_free_creds(krbContext, creds[i]);
 515         GSSEAP_FREE(creds);
 516     }
 517     if (major == GSS_S_COMPLETE)
 518         major = *minor ? GSS_S_FAILURE : GSS_S_COMPLETE;
 519
 520     return major;
 521 }
 522
 523 static gss_buffer_desc radiusAvpKrbAttr = {
 524     sizeof("urn:authdata-radius-avp") - 1, "urn:authdata-radius-avp"
 525 };
 526
 527 /*
 528  * Unfortunately extracting an AD-KDCIssued authorization data element
 529  * is pretty implementation-dependent. It's not possible to verify the
 530  * signature ourselves because the ticket session key is not exposed
 531  * outside GSS. In an ideal world, all AD-KDCIssued elements would be
 532  * verified by the Kerberos library and authentication would fail if
 533  * verification failed. We're not quite there yet and as a result have
 534  * to go through some hoops to get this to work. The alternative would
 535  * be to sign the authorization data with our long-term key, but it
 536  * seems a pity to compromise the design because of current implementation
 537  * limitations.
 538  *
 539  * (Specifically, the hoops involve a libkrb5 authorisation data plugin
 540  * that exposes the verified and serialised attribute context through
 541  * the Kerberos GSS mechanism's naming extensions API.)
 542  */
 543 static OM_uint32
 544 defrostAttrContext(OM_uint32 *minor,
 545                    gss_name_t glueName,
 546                    gss_name_t mechName)
 547 {
 548     OM_uint32 major, tmpMinor;
 549     gss_buffer_desc authData = GSS_C_EMPTY_BUFFER;
 550     gss_buffer_desc authDataDisplay = GSS_C_EMPTY_BUFFER;
 551     int more = -1;
 552     int authenticated, complete;
 553
 554     major = gssGetNameAttribute(minor, glueName, &radiusAvpKrbAttr,
 555                                 &authenticated, &complete,
 556                                 &authData, &authDataDisplay, &more);
 557     if (major == GSS_S_COMPLETE) {
 558         if (authenticated == 0)
 559             major = GSS_S_BAD_NAME;
 560         else
 561             major = gssEapImportAttrContext(minor, &authData, mechName);
 562     } else if (major == GSS_S_UNAVAILABLE) {
 563         major = GSS_S_COMPLETE;
 564     }
 565
 566     gss_release_buffer(&tmpMinor, &authData);
 567     gss_release_buffer(&tmpMinor, &authDataDisplay);
 568
 569     return major;
 570 }
 571
 572 /*
 573  * Convert a mechanism glue to an EAP mechanism name by displaying and
 574  * importing it. This also handles the RADIUS attributes.
 575  */
 576 OM_uint32
 577 gssEapGlueToMechName(OM_uint32 *minor,
 578                      gss_name_t glueName,
 579                      gss_name_t *pMechName)
 580 {
 581     OM_uint32 major, tmpMinor;
 582     gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER;
 583
 584     *pMechName = GSS_C_NO_NAME;
 585
 586     major = gssDisplayName(minor, glueName, &nameBuf, NULL);
 587     if (GSS_ERROR(major))
 588         goto cleanup;
 589
 590     major = gssEapImportName(minor, &nameBuf, GSS_C_NT_USER_NAME,
 591                              pMechName);
 592     if (GSS_ERROR(major))
 593         goto cleanup;
 594
 595     major = defrostAttrContext(minor, glueName, *pMechName);
 596     if (GSS_ERROR(major))
 597         goto cleanup;
 598
 599 cleanup:
 600     if (GSS_ERROR(major)) {
 601         gssReleaseName(&tmpMinor, pMechName);
 602         *pMechName = GSS_C_NO_NAME;
 603     }
 604
 605     gss_release_buffer(&tmpMinor, &nameBuf);
 606
 607     return major;
 608 }
 609
 610 /*
 611  * Convert an EAP mechanism name to a mechanism glue name by displaying
 612  * and importing it.
 613  */
 614 OM_uint32
 615 gssEapMechToGlueName(OM_uint32 *minor,
 616                      gss_name_t mechName,
 617                      gss_name_t *pGlueName)
 618 {
 619     OM_uint32 major, tmpMinor;
 620     gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER;
 621
 622     *pGlueName = GSS_C_NO_NAME;
 623
 624     major = gssEapDisplayName(minor, mechName, &nameBuf, NULL);
 625     if (GSS_ERROR(major))
 626         goto cleanup;
 627
 628     major = gssImportName(minor, &nameBuf, GSS_C_NT_USER_NAME,
 629                           pGlueName);
 630     if (GSS_ERROR(major))
 631         goto cleanup;
 632
 633 cleanup:
 634     gss_release_buffer(&tmpMinor, &nameBuf);
 635
 636     return major;
 637 }
 638
 639 /*
 640  * Suck out the analgous elements of a Kerberos GSS context into an EAP
 641  * one so that the application doesn't know the difference.
 642  */
 643 OM_uint32
 644 gssEapReauthComplete(OM_uint32 *minor,
 645                     gss_ctx_id_t ctx,
 646                     gss_cred_id_t cred,
 647                     const gss_OID mech,
 648                     OM_uint32 timeRec)
 649 {
 650     OM_uint32 major, tmpMinor;
 651     gss_buffer_set_t keyData = GSS_C_NO_BUFFER_SET;
 652
 653     if (!oidEqual(mech, gss_mech_krb5)) {
 654         major = GSS_S_BAD_MECH;
 655         goto cleanup;
 656     }
 657
 658     /* Get the raw subsession key and encryption type*/
 659     major = gssInquireSecContextByOid(minor, ctx->kerberosCtx,
 660                                       GSS_C_INQ_SSPI_SESSION_KEY, &keyData);
 661     if (GSS_ERROR(major))
 662         goto cleanup;
 663
 664     {
 665         gss_OID_desc oid;
 666         int suffix;
 667
 668         oid.length = keyData->elements[1].length;
 669         oid.elements = keyData->elements[1].value;
 670
 671         /* GSS_KRB5_SESSION_KEY_ENCTYPE_OID */
 672         major = decomposeOid(minor,
 673                              "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04",
 674                              10, &oid, &suffix);
 675         if (GSS_ERROR(major))
 676             goto cleanup;
 677
 678         ctx->encryptionType = suffix;
 679     }
 680
 681     {
 682         krb5_context krbContext = NULL;
 683         krb5_keyblock key;
 684
 685         GSSEAP_KRB_INIT(&krbContext);
 686
 687         KRB_KEY_LENGTH(&key) = keyData->elements[0].length;
 688         KRB_KEY_DATA(&key)   = keyData->elements[0].value;
 689         KRB_KEY_TYPE(&key)   = ctx->encryptionType;
 690
 691         *minor = krb5_copy_keyblock_contents(krbContext,
 692                                              &key, &ctx->rfc3961Key);
 693         if (*minor != 0) {
 694             major = GSS_S_FAILURE;
 695             goto cleanup;
 696         }
 697     }
 698
 699     major = rfc3961ChecksumTypeForKey(minor, &ctx->rfc3961Key,
 700                                       &ctx->checksumType);
 701     if (GSS_ERROR(major))
 702         goto cleanup;
 703
 704     if (timeRec != GSS_C_INDEFINITE)
 705         ctx->expiryTime = time(NULL) + timeRec;
 706
 707     /* Initialize our sequence state */
 708     major = sequenceInit(minor,
 709                          &ctx->seqState, ctx->recvSeq,
 710                          ((ctx->gssFlags & GSS_C_REPLAY_FLAG) != 0),
 711                          ((ctx->gssFlags & GSS_C_SEQUENCE_FLAG) != 0),
 712                          TRUE);
 713     if (GSS_ERROR(major))
 714         goto cleanup;
 715
 716     major = GSS_S_COMPLETE;
 717
 718 cleanup:
 719     gss_release_buffer_set(&tmpMinor, &keyData);
 720
 721     return major;
 722 }
 723
 724 /*
 725  * The remainder of this file consists of wrappers so we can call into the
 726  * mechanism glue without calling ourselves.
 727  */
 728 static OM_uint32
 729 (*gssInitSecContextNext)(OM_uint32 *,
 730                          gss_cred_id_t,
 731                          gss_ctx_id_t *,
 732                          gss_name_t,
 733                          gss_OID,
 734                          OM_uint32,
 735                          OM_uint32,
 736                          gss_channel_bindings_t,
 737                          gss_buffer_t,
 738                          gss_OID *,
 739                          gss_buffer_t,
 740                          OM_uint32 *,
 741                          OM_uint32 *);
 742
 743 static OM_uint32
 744 (*gssAcceptSecContextNext)(OM_uint32 *,
 745                            gss_ctx_id_t *,
 746                            gss_cred_id_t,
 747                            gss_buffer_t,
 748                            gss_channel_bindings_t,
 749                            gss_name_t *,
 750                            gss_OID *,
 751                            gss_buffer_t,
 752                            OM_uint32 *,
 753                            OM_uint32 *,
 754                            gss_cred_id_t *);
 755
 756 static OM_uint32
 757 (*gssReleaseCredNext)(OM_uint32 *, gss_cred_id_t *);
 758
 759 static OM_uint32
 760 (*gssReleaseNameNext)(OM_uint32 *, gss_name_t *);
 761
 762 static OM_uint32
 763 (*gssInquireSecContextByOidNext)(OM_uint32 *,
 764                                  const gss_ctx_id_t,
 765                                  const gss_OID,
 766                                  gss_buffer_set_t *);
 767
 768 static OM_uint32
 769 (*gssDeleteSecContextNext)(OM_uint32 *,
 770                           gss_ctx_id_t *,
 771                           gss_buffer_t);
 772
 773 static OM_uint32
 774 (*gssDisplayNameNext)(OM_uint32 *,
 775                       gss_name_t,
 776                       gss_buffer_t,
 777                       gss_OID *);
 778
 779 static OM_uint32
 780 (*gssImportNameNext)(OM_uint32 *,
 781                      gss_buffer_t,
 782                      gss_OID,
 783                      gss_name_t *);
 784
 785 static OM_uint32
 786 (*gssStoreCredNext)(OM_uint32 *,
 787                     const gss_cred_id_t,
 788                     gss_cred_usage_t,
 789                     const gss_OID,
 790                     OM_uint32,
 791                     OM_uint32,
 792                     gss_OID_set *,
 793                     gss_cred_usage_t *);
 794
 795 static OM_uint32
 796 (*gssGetNameAttributeNext)(OM_uint32 *,
 797                           gss_name_t,
 798                           gss_buffer_t,
 799                           int *,
 800                           int *,
 801                           gss_buffer_t,
 802                           gss_buffer_t,
 803                           int *);
 804
 805 #define NEXT_SYMBOL(local, global)  do {        \
 806         ((local) = dlsym(RTLD_NEXT, (global))); \
 807         if ((local) == NULL) {                  \
 808             *minor = GSSEAP_NO_MECHGLUE_SYMBOL; \
 809             major = GSS_S_UNAVAILABLE;          \
 810             /* but continue */                  \
 811         }                                       \
 812     } while (0)
 813
 814 OM_uint32
 815 gssEapReauthInitialize(OM_uint32 *minor)
 816 {
 817     OM_uint32 major = GSS_S_COMPLETE;
 818
 819     NEXT_SYMBOL(gssInitSecContextNext,         "gss_init_sec_context");
 820     NEXT_SYMBOL(gssAcceptSecContextNext,       "gss_accept_sec_context");
 821     NEXT_SYMBOL(gssReleaseCredNext,            "gss_release_cred");
 822     NEXT_SYMBOL(gssReleaseNameNext,            "gss_release_name");
 823     NEXT_SYMBOL(gssInquireSecContextByOidNext, "gss_inquire_sec_context_by_oid");
 824     NEXT_SYMBOL(gssDeleteSecContextNext,       "gss_delete_sec_context");
 825     NEXT_SYMBOL(gssDisplayNameNext,            "gss_display_name");
 826     NEXT_SYMBOL(gssImportNameNext,             "gss_import_name");
 827     NEXT_SYMBOL(gssStoreCredNext,              "gss_store_cred");
 828     NEXT_SYMBOL(gssGetNameAttributeNext,       "gss_get_name_attribute");
 829
 830     return major;
 831 }
 832
 833 OM_uint32
 834 gssInitSecContext(OM_uint32 *minor,
 835                   gss_cred_id_t cred,
 836                   gss_ctx_id_t *context_handle,
 837                   gss_name_t target_name,
 838                   gss_OID mech_type,
 839                   OM_uint32 req_flags,
 840                   OM_uint32 time_req,
 841                   gss_channel_bindings_t input_chan_bindings,
 842                   gss_buffer_t input_token,
 843                   gss_OID *actual_mech_type,
 844                   gss_buffer_t output_token,
 845                   OM_uint32 *ret_flags,
 846                   OM_uint32 *time_rec)
 847 {
 848     if (gssInitSecContextNext == NULL) {
 849         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 850         return GSS_S_UNAVAILABLE;
 851     }
 852
 853     return gssInitSecContextNext(minor, cred, context_handle,
 854                                  target_name, mech_type, req_flags,
 855                                  time_req, input_chan_bindings,
 856                                  input_token, actual_mech_type,
 857                                  output_token, ret_flags, time_rec);
 858 }
 859
 860 OM_uint32
 861 gssAcceptSecContext(OM_uint32 *minor,
 862                     gss_ctx_id_t *context_handle,
 863                     gss_cred_id_t cred,
 864                     gss_buffer_t input_token,
 865                     gss_channel_bindings_t input_chan_bindings,
 866                     gss_name_t *src_name,
 867                     gss_OID *mech_type,
 868                     gss_buffer_t output_token,
 869                     OM_uint32 *ret_flags,
 870                     OM_uint32 *time_rec,
 871                     gss_cred_id_t *delegated_cred_handle)
 872 {
 873     if (gssAcceptSecContextNext == NULL) {
 874         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 875         return GSS_S_UNAVAILABLE;
 876     }
 877
 878     return gssAcceptSecContextNext(minor, context_handle, cred,
 879                                    input_token, input_chan_bindings,
 880                                    src_name, mech_type, output_token,
 881                                    ret_flags, time_rec, delegated_cred_handle);
 882 }
 883
 884 OM_uint32
 885 gssReleaseCred(OM_uint32 *minor,
 886                gss_cred_id_t *cred_handle)
 887 {
 888     if (gssReleaseCredNext == NULL) {
 889         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 890         return GSS_S_UNAVAILABLE;
 891     }
 892
 893     return gssReleaseCredNext(minor, cred_handle);
 894 }
 895
 896 OM_uint32
 897 gssReleaseName(OM_uint32 *minor,
 898                gss_name_t *name)
 899 {
 900     if (gssReleaseName == NULL) {
 901         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 902         return GSS_S_UNAVAILABLE;
 903     }
 904
 905     return gssReleaseNameNext(minor, name);
 906 }
 907
 908 OM_uint32
 909 gssDeleteSecContext(OM_uint32 *minor,
 910                     gss_ctx_id_t *context_handle,
 911                     gss_buffer_t output_token)
 912 {
 913     if (gssDeleteSecContextNext == NULL) {
 914         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 915         return GSS_S_UNAVAILABLE;
 916     }
 917
 918     return gssDeleteSecContextNext(minor, context_handle, output_token);
 919 }
 920
 921 static OM_uint32
 922 gssDisplayName(OM_uint32 *minor,
 923                gss_name_t name,
 924                gss_buffer_t buffer,
 925                gss_OID *name_type)
 926 {
 927     if (gssDisplayNameNext == NULL) {
 928         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 929         return GSS_S_UNAVAILABLE;
 930     }
 931
 932     return gssDisplayNameNext(minor, name, buffer, name_type);
 933 }
 934
 935 static OM_uint32
 936 gssImportName(OM_uint32 *minor,
 937               gss_buffer_t buffer,
 938               gss_OID name_type,
 939               gss_name_t *name)
 940 {
 941     if (gssImportNameNext == NULL) {
 942         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 943         return GSS_S_UNAVAILABLE;
 944     }
 945
 946     return gssImportNameNext(minor, buffer, name_type, name);
 947 }
 948
 949 OM_uint32
 950 gssInquireSecContextByOid(OM_uint32 *minor,
 951                           const gss_ctx_id_t context_handle,
 952                           const gss_OID desired_object,
 953                           gss_buffer_set_t *data_set)
 954 {
 955     if (gssInquireSecContextByOidNext == NULL) {
 956         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 957         return GSS_S_UNAVAILABLE;
 958     }
 959
 960     return gssInquireSecContextByOidNext(minor, context_handle,
 961                                          desired_object, data_set);
 962 }
 963
 964 OM_uint32
 965 gssStoreCred(OM_uint32 *minor,
 966              const gss_cred_id_t input_cred_handle,
 967              gss_cred_usage_t input_usage,
 968              const gss_OID desired_mech,
 969              OM_uint32 overwrite_cred,
 970              OM_uint32 default_cred,
 971              gss_OID_set *elements_stored,
 972              gss_cred_usage_t *cred_usage_stored)
 973 {
 974     if (gssStoreCredNext == NULL) {
 975         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 976         return GSS_S_UNAVAILABLE;
 977     }
 978
 979     return gssStoreCredNext(minor, input_cred_handle, input_usage,
 980                             desired_mech, overwrite_cred, default_cred,
 981                             elements_stored, cred_usage_stored);
 982 }
 983
 984 OM_uint32
 985 gssGetNameAttribute(OM_uint32 *minor,
 986                     gss_name_t name,
 987                     gss_buffer_t attr,
 988                     int *authenticated,
 989                     int *complete,
 990                     gss_buffer_t value,
 991                     gss_buffer_t display_value,
 992                     int *more)
 993 {
 994     if (gssGetNameAttributeNext == NULL) {
 995         *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
 996         return GSS_S_UNAVAILABLE;
 997     }
 998
 999     return gssGetNameAttributeNext(minor, name, attr, authenticated, complete,
1000                                    value, display_value, more);
1001 }