X-Git-Url: http://www.project-moonshot.org/gitweb/?p=mod_auth_gssapi.git;a=blobdiff_plain;f=src%2Fmod_auth_gssapi.c;h=45ddb27cd7c8b9ea9c9769fff092ab909d9605ea;hp=9d9fbc53261f082f927ffc17fb3440a74730ff97;hb=7963859eeeb1862b7486c1362b22faae300d0ee3;hpb=f20a3525f62bdc154e4a93d7e2eb6310067999b3

diff --git a/src/mod_auth_gssapi.c b/src/mod_auth_gssapi.c
index 9d9fbc5..45ddb27 100644
--- a/src/mod_auth_gssapi.c
+++ b/src/mod_auth_gssapi.c
@@ -526,7 +526,7 @@ static bool mag_auth_basic(request_rec *req,
 
     /* must acquire creds based on the actual mechs we want to try */
     if (!mag_acquire_creds(req, cfg, actual_mechs,
-                           GSS_C_BOTH, &acquired_cred, NULL)) {
+                           cred_usage, &acquired_cred, NULL)) {
         goto done;
     }
 
@@ -549,12 +549,6 @@ static bool mag_auth_basic(request_rec *req,
 
     for (int i = 0; i < actual_mechs->count; i++) {
 
-        /* skip spnego if present */
-        if (gss_oid_equal(&actual_mechs->elements[i],
-                          &gss_mech_spnego)) {
-            continue;
-        }
-
         /* free these if looping */
         gss_release_buffer(&min, &output);
         gss_release_buffer(&min, &input);
@@ -1150,48 +1144,77 @@ static const char *mag_use_basic_auth(cmd_parms *parms, void *mconfig, int on)
 }
 #endif
 
-#define MAX_ALLOWED_MECHS 10
+static apr_status_t mag_oid_set_destroy(void *ptr)
+{
+    uint32_t min;
+    gss_OID_set set = (gss_OID_set)ptr;
+    (void)gss_release_oid_set(&min, &set);
+    return APR_SUCCESS;
+}
 
 static void mag_list_of_mechs(cmd_parms *parms, gss_OID_set *oidset,
                               bool add_spnego, const char *w)
 {
-    gss_const_OID oid;
+    gss_buffer_desc buf = { 0 };
+    uint32_t maj, min;
     gss_OID_set set;
-    size_t size;
+    gss_OID oid;
+    bool release_oid = false;
 
     if (NULL == *oidset) {
-        set = apr_pcalloc(parms->pool, sizeof(gss_OID_set_desc));
-        size = sizeof(gss_OID) * MAX_ALLOWED_MECHS;
-        set->elements = apr_palloc(parms->pool, size);
+        maj = gss_create_empty_oid_set(&min, &set);
+        if (maj != GSS_S_COMPLETE) {
+            ap_log_error(APLOG_MARK, APLOG_ERR, 0, parms->server,
+                         "gss_create_empty_oid_set() failed.");
+            *oidset = GSS_C_NO_OID_SET;
+            return;
+        }
         if (add_spnego) {
-            set->elements[0] = gss_mech_spnego;
-            set->count++;
+            oid = discard_const(&gss_mech_spnego);
+            maj = gss_add_oid_set_member(&min, oid, &set);
+            if (maj != GSS_S_COMPLETE) {
+                ap_log_error(APLOG_MARK, APLOG_ERR, 0, parms->server,
+                             "gss_add_oid_set_member() failed.");
+                (void)gss_release_oid_set(&min, &set);
+                *oidset = GSS_C_NO_OID_SET;
+                return;
+            }
         }
+        /* register in the pool so it can be released once the server
+         * winds down */
+        apr_pool_cleanup_register(parms->pool, (void *)set,
+                                  mag_oid_set_destroy,
+                                  apr_pool_cleanup_null);
         *oidset = set;
     } else {
         set = *oidset;
     }
 
     if (strcmp(w, "krb5") == 0) {
-        oid = gss_mech_krb5;
+        oid = discard_const(gss_mech_krb5);
     } else if (strcmp(w, "iakerb") == 0) {
-        oid = gss_mech_iakerb;
+        oid = discard_const(gss_mech_iakerb);
     } else if (strcmp(w, "ntlmssp") == 0) {
-        oid = &gss_mech_ntlmssp;
+        oid = discard_const(&gss_mech_ntlmssp);
     } else {
-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, parms->server,
-                     "Unrecognized GSSAPI Mechanism: %s", w);
-        return;
+        buf.value = discard_const(w);
+        buf.length = strlen(w);
+        maj = gss_str_to_oid(&min, &buf, &oid);
+        if (maj != GSS_S_COMPLETE) {
+            ap_log_error(APLOG_MARK, APLOG_ERR, 0, parms->server,
+                         "Unrecognized GSSAPI Mechanism: [%s]", w);
+            return;
+        }
+        release_oid = true;
     }
-
-    if (set->count >= MAX_ALLOWED_MECHS) {
+    maj = gss_add_oid_set_member(&min, oid, &set);
+    if (maj != GSS_S_COMPLETE) {
         ap_log_error(APLOG_MARK, APLOG_ERR, 0, parms->server,
-                     "Too many GssapiAllowedMech options (MAX: %d)",
-                     MAX_ALLOWED_MECHS);
-        return;
+                         "gss_add_oid_set_member() failed for [%s].", w);
+    }
+    if (release_oid) {
+        (void)gss_release_oid(&min, &oid);
     }
-    set->elements[set->count] = *oid;
-    set->count++;
 }
 
 static const char *mag_allow_mech(cmd_parms *parms, void *mconfig,