1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2 /*
3 * Copyright 1997, 2007 by Massachusetts Institute of Technology
4 * All Rights Reserved.
5 *
6 * Export of this software from the United States of America may
7 * require a specific license from the United States Government.
8 * It is the responsibility of any person or organization contemplating
9 * export to obtain such a license before exporting.
10 *
11 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
12 * distribute this software and its documentation for any purpose and
13 * without fee is hereby granted, provided that the above copyright
14 * notice appear in all copies and that both that copyright notice and
15 * this permission notice appear in supporting documentation, and that
16 * the name of M.I.T. not be used in advertising or publicity pertaining
17 * to distribution of the software without specific, written prior
18 * permission. Furthermore if you modify this software you must label
19 * your software as modified software and not distribute it in such a
20 * fashion that it might be confused with the original M.I.T. software.
21 * M.I.T. makes no representations about the suitability of
22 * this software for any purpose. It is provided "as is" without express
23 * or implied warranty.
24 */
25
26 #include "gssapiP_krb5.h"
27
28 /* Check to see whether or not a GSSAPI krb5 credential is valid. If
29 * it is not, return an error. */
30
31 OM_uint32
krb5_gss_validate_cred_1(OM_uint32 * minor_status,gss_cred_id_t cred_handle,krb5_context context)32 krb5_gss_validate_cred_1(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
33 krb5_context context)
34 {
35 krb5_gss_cred_id_t cred;
36 krb5_error_code code;
37 krb5_principal princ;
38
39 cred = (krb5_gss_cred_id_t) cred_handle;
40 k5_mutex_lock(&cred->lock);
41
42 if (cred->ccache && cred->expire != 0) {
43 if ((code = krb5_cc_get_principal(context, cred->ccache, &princ))) {
44 k5_mutex_unlock(&cred->lock);
45 *minor_status = code;
46 return(GSS_S_DEFECTIVE_CREDENTIAL);
47 }
48 if (!krb5_principal_compare(context, princ, cred->name->princ)) {
49 k5_mutex_unlock(&cred->lock);
50 *minor_status = KG_CCACHE_NOMATCH;
51 return(GSS_S_DEFECTIVE_CREDENTIAL);
52 }
53 (void)krb5_free_principal(context, princ);
54 }
55 *minor_status = 0;
56 return GSS_S_COMPLETE;
57 }
58
59 OM_uint32
krb5_gss_validate_cred(minor_status,cred_handle)60 krb5_gss_validate_cred(minor_status, cred_handle)
61 OM_uint32 *minor_status;
62 gss_cred_id_t cred_handle;
63 {
64 krb5_context context;
65 krb5_error_code code;
66 OM_uint32 maj;
67
68 code = krb5_gss_init_context(&context);
69 if (code) {
70 *minor_status = code;
71 return GSS_S_FAILURE;
72 }
73
74 maj = krb5_gss_validate_cred_1(minor_status, cred_handle, context);
75 if (maj == 0) {
76 krb5_gss_cred_id_t cred = (krb5_gss_cred_id_t) cred_handle;
77 k5_mutex_assert_locked(&cred->lock);
78 k5_mutex_unlock(&cred->lock);
79 }
80 save_error_info(*minor_status, context);
81 krb5_free_context(context);
82 return maj;
83 }
84