1 /* #pragma ident "@(#)g_init_sec_context.c 1.20 03/10/24 SMI" */
2
3 /*
4 * Copyright 1996 by Sun Microsystems, Inc.
5 *
6 * Permission to use, copy, modify, distribute, and sell this software
7 * and its documentation for any purpose is hereby granted without fee,
8 * provided that the above copyright notice appears in all copies and
9 * that both that copyright notice and this permission notice appear in
10 * supporting documentation, and that the name of Sun Microsystems not be used
11 * in advertising or publicity pertaining to distribution of the software
12 * without specific, written prior permission. Sun Microsystems makes no
13 * representations about the suitability of this software for any
14 * purpose. It is provided "as is" without express or implied warranty.
15 *
16 * SUN MICROSYSTEMS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
17 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
18 * EVENT SHALL SUN MICROSYSTEMS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
19 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
20 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
21 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
22 * PERFORMANCE OF THIS SOFTWARE.
23 */
24
25 /*
26 * glue routine for gss_init_sec_context
27 */
28
29 #include "mglueP.h"
30 #include <stdio.h>
31 #ifdef HAVE_STDLIB_H
32 #include <stdlib.h>
33 #endif
34 #include <string.h>
35
36 static OM_uint32
val_init_sec_ctx_args(OM_uint32 * minor_status,gss_cred_id_t claimant_cred_handle,gss_ctx_id_t * context_handle,gss_name_t target_name,gss_OID req_mech_type,OM_uint32 req_flags,OM_uint32 time_req,gss_channel_bindings_t input_chan_bindings,gss_buffer_t input_token,gss_OID * actual_mech_type,gss_buffer_t output_token,OM_uint32 * ret_flags,OM_uint32 * time_rec)37 val_init_sec_ctx_args(
38 OM_uint32 *minor_status,
39 gss_cred_id_t claimant_cred_handle,
40 gss_ctx_id_t *context_handle,
41 gss_name_t target_name,
42 gss_OID req_mech_type,
43 OM_uint32 req_flags,
44 OM_uint32 time_req,
45 gss_channel_bindings_t input_chan_bindings,
46 gss_buffer_t input_token,
47 gss_OID *actual_mech_type,
48 gss_buffer_t output_token,
49 OM_uint32 *ret_flags,
50 OM_uint32 *time_rec)
51 {
52
53 /* Initialize outputs. */
54
55 if (minor_status != NULL)
56 *minor_status = 0;
57
58 if (actual_mech_type != NULL)
59 *actual_mech_type = GSS_C_NO_OID;
60
61 if (output_token != GSS_C_NO_BUFFER) {
62 output_token->length = 0;
63 output_token->value = NULL;
64 }
65
66 if (ret_flags != NULL)
67 *ret_flags = 0;
68
69 if (time_rec != NULL)
70 *time_rec = 0;
71
72 /* Validate arguments. */
73
74 if (minor_status == NULL)
75 return (GSS_S_CALL_INACCESSIBLE_WRITE);
76
77 if (context_handle == NULL)
78 return (GSS_S_CALL_INACCESSIBLE_WRITE | GSS_S_NO_CONTEXT);
79
80 if (target_name == NULL)
81 return (GSS_S_CALL_INACCESSIBLE_READ | GSS_S_BAD_NAME);
82
83 if (output_token == NULL)
84 return (GSS_S_CALL_INACCESSIBLE_WRITE);
85
86 return (GSS_S_COMPLETE);
87 }
88
89
90 OM_uint32 KRB5_CALLCONV
gss_init_sec_context(minor_status,claimant_cred_handle,context_handle,target_name,req_mech_type,req_flags,time_req,input_chan_bindings,input_token,actual_mech_type,output_token,ret_flags,time_rec)91 gss_init_sec_context (minor_status,
92 claimant_cred_handle,
93 context_handle,
94 target_name,
95 req_mech_type,
96 req_flags,
97 time_req,
98 input_chan_bindings,
99 input_token,
100 actual_mech_type,
101 output_token,
102 ret_flags,
103 time_rec)
104
105 OM_uint32 * minor_status;
106 gss_cred_id_t claimant_cred_handle;
107 gss_ctx_id_t * context_handle;
108 gss_name_t target_name;
109 gss_OID req_mech_type;
110 OM_uint32 req_flags;
111 OM_uint32 time_req;
112 gss_channel_bindings_t input_chan_bindings;
113 gss_buffer_t input_token;
114 gss_OID * actual_mech_type;
115 gss_buffer_t output_token;
116 OM_uint32 * ret_flags;
117 OM_uint32 * time_rec;
118
119 {
120 OM_uint32 status, temp_minor_status;
121 gss_union_name_t union_name;
122 gss_union_cred_t union_cred;
123 gss_name_t internal_name;
124 gss_union_ctx_id_t union_ctx_id;
125 gss_OID selected_mech;
126 gss_mechanism mech;
127 gss_cred_id_t input_cred_handle;
128
129 status = val_init_sec_ctx_args(minor_status,
130 claimant_cred_handle,
131 context_handle,
132 target_name,
133 req_mech_type,
134 req_flags,
135 time_req,
136 input_chan_bindings,
137 input_token,
138 actual_mech_type,
139 output_token,
140 ret_flags,
141 time_rec);
142 if (status != GSS_S_COMPLETE)
143 return (status);
144
145 status = gssint_select_mech_type(minor_status, req_mech_type,
146 &selected_mech);
147 if (status != GSS_S_COMPLETE)
148 return (status);
149
150 union_name = (gss_union_name_t)target_name;
151
152 /*
153 * obtain the gss mechanism information for the requested
154 * mechanism. If mech_type is NULL, set it to the resultant
155 * mechanism
156 */
157 mech = gssint_get_mechanism(selected_mech);
158 if (mech == NULL)
159 return (GSS_S_BAD_MECH);
160
161 if (mech->gss_init_sec_context == NULL)
162 return (GSS_S_UNAVAILABLE);
163
164 /*
165 * If target_name is mechanism_specific, then it must match the
166 * mech_type that we're about to use. Otherwise, do an import on
167 * the external_name form of the target name.
168 */
169 if (union_name->mech_type &&
170 g_OID_equal(union_name->mech_type, selected_mech)) {
171 internal_name = union_name->mech_name;
172 } else {
173 if ((status = gssint_import_internal_name(minor_status, selected_mech,
174 union_name,
175 &internal_name)) != GSS_S_COMPLETE)
176 return (status);
177 }
178
179 /*
180 * if context_handle is GSS_C_NO_CONTEXT, allocate a union context
181 * descriptor to hold the mech type information as well as the
182 * underlying mechanism context handle. Otherwise, cast the
183 * value of *context_handle to the union context variable.
184 */
185
186 if(*context_handle == GSS_C_NO_CONTEXT) {
187 status = gssint_create_union_context(minor_status, selected_mech,
188 &union_ctx_id);
189 if (status != GSS_S_COMPLETE)
190 goto end;
191 } else {
192 union_ctx_id = (gss_union_ctx_id_t)*context_handle;
193 if (union_ctx_id->internal_ctx_id == GSS_C_NO_CONTEXT) {
194 status = GSS_S_NO_CONTEXT;
195 goto end;
196 }
197 }
198
199 /*
200 * get the appropriate cred handle from the union cred struct.
201 * defaults to GSS_C_NO_CREDENTIAL if there is no cred, which will
202 * use the default credential.
203 */
204 union_cred = (gss_union_cred_t) claimant_cred_handle;
205 input_cred_handle = gssint_get_mechanism_cred(union_cred, selected_mech);
206
207 /*
208 * now call the approprate underlying mechanism routine
209 */
210
211 status = mech->gss_init_sec_context(
212 minor_status,
213 input_cred_handle,
214 &union_ctx_id->internal_ctx_id,
215 internal_name,
216 gssint_get_public_oid(selected_mech),
217 req_flags,
218 time_req,
219 input_chan_bindings,
220 input_token,
221 actual_mech_type,
222 output_token,
223 ret_flags,
224 time_rec);
225
226 if (status != GSS_S_COMPLETE && status != GSS_S_CONTINUE_NEEDED) {
227 /*
228 * RFC 2744 5.19 requires that we not create a context on a failed
229 * first call to init, and recommends that on a failed subsequent call
230 * we make the caller responsible for calling gss_delete_sec_context.
231 * Even if the mech deleted its context, keep the union context around
232 * for the caller to delete.
233 */
234 map_error(minor_status, mech);
235 if (*context_handle == GSS_C_NO_CONTEXT) {
236 free(union_ctx_id->mech_type->elements);
237 free(union_ctx_id->mech_type);
238 free(union_ctx_id);
239 }
240 } else if (*context_handle == GSS_C_NO_CONTEXT) {
241 *context_handle = (gss_ctx_id_t)union_ctx_id;
242 }
243
244 end:
245 if (union_name->mech_name == NULL ||
246 union_name->mech_name != internal_name) {
247 (void) gssint_release_internal_name(&temp_minor_status,
248 selected_mech, &internal_name);
249 }
250
251 return(status);
252 }
253