1 /*-
2 * Copyright (c) 2005 Doug Rabson
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 *
26 * $FreeBSD: src/lib/libgssapi/gss_acquire_cred.c,v 1.1 2005/12/29 14:40:20 dfr Exp $
27 */
28
29 #include "mech_locl.h"
30 RCSID("$Id: gss_acquire_cred.c,v 1.4 2006/10/25 00:44:55 lha Exp $");
31
32 OM_uint32
gss_acquire_cred(OM_uint32 * minor_status,const gss_name_t desired_name,OM_uint32 time_req,const gss_OID_set desired_mechs,gss_cred_usage_t cred_usage,gss_cred_id_t * output_cred_handle,gss_OID_set * actual_mechs,OM_uint32 * time_rec)33 gss_acquire_cred(OM_uint32 *minor_status,
34 const gss_name_t desired_name,
35 OM_uint32 time_req,
36 const gss_OID_set desired_mechs,
37 gss_cred_usage_t cred_usage,
38 gss_cred_id_t *output_cred_handle,
39 gss_OID_set *actual_mechs,
40 OM_uint32 *time_rec)
41 {
42 OM_uint32 major_status;
43 gss_OID_set mechs = desired_mechs;
44 gss_OID_set_desc set;
45 struct _gss_name *name = (struct _gss_name *) desired_name;
46 gssapi_mech_interface m;
47 struct _gss_cred *cred;
48 struct _gss_mechanism_cred *mc;
49 OM_uint32 min_time, cred_time;
50 int i;
51
52 _gss_load_mech();
53
54 /*
55 * First make sure that at least one of the requested
56 * mechanisms is one that we support.
57 */
58 if (mechs) {
59 for (i = 0; i < mechs->count; i++) {
60 int t;
61 gss_test_oid_set_member(minor_status,
62 &mechs->elements[i], _gss_mech_oids, &t);
63 if (t)
64 break;
65 }
66 if (i == mechs->count) {
67 *output_cred_handle = 0;
68 *minor_status = 0;
69 return (GSS_S_BAD_MECH);
70 }
71 }
72
73 if (actual_mechs) {
74 major_status = gss_create_empty_oid_set(minor_status,
75 actual_mechs);
76 if (major_status)
77 return (major_status);
78 }
79
80 cred = malloc(sizeof(struct _gss_cred));
81 if (!cred) {
82 if (actual_mechs)
83 gss_release_oid_set(minor_status, actual_mechs);
84 *minor_status = ENOMEM;
85 return (GSS_S_FAILURE);
86 }
87 cred->gc_usage = cred_usage;
88 SLIST_INIT(&cred->gc_mc);
89
90 if (mechs == GSS_C_NO_OID_SET)
91 mechs = _gss_mech_oids;
92
93 set.count = 1;
94 min_time = GSS_C_INDEFINITE;
95 for (i = 0; i < mechs->count; i++) {
96 struct _gss_mechanism_name *mn = NULL;
97
98 m = __gss_get_mechanism(&mechs->elements[i]);
99 if (!m)
100 continue;
101
102 if (desired_name != GSS_C_NO_NAME) {
103 mn = _gss_find_mn(name, &mechs->elements[i]);
104 if (!mn)
105 continue;
106 }
107
108 mc = malloc(sizeof(struct _gss_mechanism_cred));
109 if (!mc) {
110 continue;
111 }
112 SLIST_INIT(&cred->gc_mc);
113 mc->gmc_mech = m;
114 mc->gmc_mech_oid = &m->gm_mech_oid;
115
116 /*
117 * XXX Probably need to do something with actual_mechs.
118 */
119 set.elements = &mechs->elements[i];
120 major_status = m->gm_acquire_cred(minor_status,
121 (desired_name != GSS_C_NO_NAME
122 ? mn->gmn_name : GSS_C_NO_NAME),
123 time_req, &set, cred_usage,
124 &mc->gmc_cred, NULL, &cred_time);
125 if (major_status) {
126 free(mc);
127 continue;
128 }
129 if (cred_time < min_time)
130 min_time = cred_time;
131
132 if (actual_mechs) {
133 major_status = gss_add_oid_set_member(minor_status,
134 mc->gmc_mech_oid, actual_mechs);
135 if (major_status) {
136 m->gm_release_cred(minor_status,
137 &mc->gmc_cred);
138 free(mc);
139 continue;
140 }
141 }
142
143 SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
144 }
145
146 /*
147 * If we didn't manage to create a single credential, return
148 * an error.
149 */
150 if (!SLIST_FIRST(&cred->gc_mc)) {
151 free(cred);
152 if (actual_mechs)
153 gss_release_oid_set(minor_status, actual_mechs);
154 *output_cred_handle = 0;
155 *minor_status = 0;
156 return (GSS_S_NO_CRED);
157 }
158
159 if (time_rec)
160 *time_rec = min_time;
161 *output_cred_handle = (gss_cred_id_t) cred;
162 *minor_status = 0;
163 return (GSS_S_COMPLETE);
164 }
165