17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5503a2b89SPeter Shoults * Common Development and Distribution License (the "License").
6503a2b89SPeter Shoults * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22*5e01956fSGlenn Barry * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate */
247c478bd9Sstevel@tonic-gate
257c478bd9Sstevel@tonic-gate /*
267c478bd9Sstevel@tonic-gate * glue routine for gss_inquire_cred
277c478bd9Sstevel@tonic-gate */
287c478bd9Sstevel@tonic-gate
297c478bd9Sstevel@tonic-gate #include <mechglueP.h>
30*5e01956fSGlenn Barry #include "gssapiP_generic.h"
317c478bd9Sstevel@tonic-gate #include <stdio.h>
327c478bd9Sstevel@tonic-gate #include <stdlib.h>
337c478bd9Sstevel@tonic-gate #include <string.h>
347c478bd9Sstevel@tonic-gate #include <time.h>
357c478bd9Sstevel@tonic-gate
367c478bd9Sstevel@tonic-gate OM_uint32
gss_inquire_cred(minor_status,cred_handle,name,lifetime,cred_usage,mechanisms)377c478bd9Sstevel@tonic-gate gss_inquire_cred(minor_status,
387c478bd9Sstevel@tonic-gate cred_handle,
397c478bd9Sstevel@tonic-gate name,
407c478bd9Sstevel@tonic-gate lifetime,
417c478bd9Sstevel@tonic-gate cred_usage,
427c478bd9Sstevel@tonic-gate mechanisms)
437c478bd9Sstevel@tonic-gate
447c478bd9Sstevel@tonic-gate OM_uint32 *minor_status;
457c478bd9Sstevel@tonic-gate const gss_cred_id_t cred_handle;
467c478bd9Sstevel@tonic-gate gss_name_t *name;
477c478bd9Sstevel@tonic-gate OM_uint32 *lifetime;
487c478bd9Sstevel@tonic-gate int *cred_usage;
497c478bd9Sstevel@tonic-gate gss_OID_set *mechanisms;
507c478bd9Sstevel@tonic-gate
517c478bd9Sstevel@tonic-gate {
527c478bd9Sstevel@tonic-gate OM_uint32 status, elapsed_time, temp_minor_status;
537c478bd9Sstevel@tonic-gate gss_union_cred_t union_cred;
547c478bd9Sstevel@tonic-gate gss_mechanism mech;
557c478bd9Sstevel@tonic-gate gss_name_t internal_name;
567c478bd9Sstevel@tonic-gate int i;
577c478bd9Sstevel@tonic-gate
58503a2b89SPeter Shoults /* Initialize outputs. */
59503a2b89SPeter Shoults
60503a2b89SPeter Shoults if (minor_status != NULL)
617c478bd9Sstevel@tonic-gate *minor_status = 0;
627c478bd9Sstevel@tonic-gate
63503a2b89SPeter Shoults if (name != NULL)
64503a2b89SPeter Shoults *name = GSS_C_NO_NAME;
657c478bd9Sstevel@tonic-gate
66503a2b89SPeter Shoults if (mechanisms != NULL)
67503a2b89SPeter Shoults *mechanisms = GSS_C_NO_OID_SET;
68503a2b89SPeter Shoults
69503a2b89SPeter Shoults /* Validate arguments. */
70503a2b89SPeter Shoults if (minor_status == NULL)
71503a2b89SPeter Shoults return (GSS_S_CALL_INACCESSIBLE_WRITE);
727c478bd9Sstevel@tonic-gate
737c478bd9Sstevel@tonic-gate if (cred_handle == GSS_C_NO_CREDENTIAL) {
747c478bd9Sstevel@tonic-gate /*
757c478bd9Sstevel@tonic-gate * No credential was supplied. This means we can't get a mechanism
767c478bd9Sstevel@tonic-gate * pointer to call the mechanism specific gss_inquire_cred.
777c478bd9Sstevel@tonic-gate * So, call get_mechanism with an arguement of GSS_C_NULL_OID.
787c478bd9Sstevel@tonic-gate * get_mechanism will return the first mechanism in the mech
797c478bd9Sstevel@tonic-gate * array, which becomes the default mechanism.
807c478bd9Sstevel@tonic-gate */
817c478bd9Sstevel@tonic-gate
827c478bd9Sstevel@tonic-gate if ((mech = __gss_get_mechanism(GSS_C_NULL_OID)) == NULL)
837c478bd9Sstevel@tonic-gate return (GSS_S_DEFECTIVE_CREDENTIAL);
847c478bd9Sstevel@tonic-gate
857c478bd9Sstevel@tonic-gate if (!mech->gss_inquire_cred)
867c478bd9Sstevel@tonic-gate return (GSS_S_UNAVAILABLE);
877c478bd9Sstevel@tonic-gate
887c478bd9Sstevel@tonic-gate status = mech->gss_inquire_cred(mech->context, minor_status,
897c478bd9Sstevel@tonic-gate GSS_C_NO_CREDENTIAL,
907c478bd9Sstevel@tonic-gate name ? &internal_name : NULL,
917c478bd9Sstevel@tonic-gate lifetime, cred_usage,
927c478bd9Sstevel@tonic-gate mechanisms);
937c478bd9Sstevel@tonic-gate
94*5e01956fSGlenn Barry if (status != GSS_S_COMPLETE) {
95*5e01956fSGlenn Barry map_error(minor_status, mech);
967c478bd9Sstevel@tonic-gate return (status);
97*5e01956fSGlenn Barry }
987c478bd9Sstevel@tonic-gate
997c478bd9Sstevel@tonic-gate if (name) {
1007c478bd9Sstevel@tonic-gate /*
1017c478bd9Sstevel@tonic-gate * Convert internal_name into a union_name equivalent.
1027c478bd9Sstevel@tonic-gate */
1037c478bd9Sstevel@tonic-gate status = __gss_convert_name_to_union_name(
1047c478bd9Sstevel@tonic-gate &temp_minor_status, mech,
1057c478bd9Sstevel@tonic-gate internal_name, name);
1067c478bd9Sstevel@tonic-gate if (status != GSS_S_COMPLETE) {
1077c478bd9Sstevel@tonic-gate *minor_status = temp_minor_status;
108*5e01956fSGlenn Barry map_error(minor_status, mech);
1097c478bd9Sstevel@tonic-gate if (mechanisms && *mechanisms) {
1107c478bd9Sstevel@tonic-gate (void) gss_release_oid_set(
1117c478bd9Sstevel@tonic-gate &temp_minor_status,
1127c478bd9Sstevel@tonic-gate mechanisms);
1137c478bd9Sstevel@tonic-gate }
1147c478bd9Sstevel@tonic-gate return (status);
1157c478bd9Sstevel@tonic-gate }
1167c478bd9Sstevel@tonic-gate }
1177c478bd9Sstevel@tonic-gate return (GSS_S_COMPLETE);
1187c478bd9Sstevel@tonic-gate }
1197c478bd9Sstevel@tonic-gate
1207c478bd9Sstevel@tonic-gate /* get the cred_handle cast as a union_credentials structure */
1217c478bd9Sstevel@tonic-gate
1227c478bd9Sstevel@tonic-gate union_cred = (gss_union_cred_t)cred_handle;
1237c478bd9Sstevel@tonic-gate
1247c478bd9Sstevel@tonic-gate /*
1257c478bd9Sstevel@tonic-gate * get the information out of the union_cred structure that was
1267c478bd9Sstevel@tonic-gate * placed there during gss_acquire_cred.
1277c478bd9Sstevel@tonic-gate */
1287c478bd9Sstevel@tonic-gate
1297c478bd9Sstevel@tonic-gate if (cred_usage != NULL)
1307c478bd9Sstevel@tonic-gate *cred_usage = union_cred->auxinfo.cred_usage;
1317c478bd9Sstevel@tonic-gate
1327c478bd9Sstevel@tonic-gate if (lifetime != NULL) {
1337c478bd9Sstevel@tonic-gate elapsed_time = time(0) - union_cred->auxinfo.creation_time;
1347c478bd9Sstevel@tonic-gate *lifetime = union_cred->auxinfo.time_rec < elapsed_time ? 0 :
1357c478bd9Sstevel@tonic-gate union_cred->auxinfo.time_rec - elapsed_time;
1367c478bd9Sstevel@tonic-gate }
1377c478bd9Sstevel@tonic-gate
1387c478bd9Sstevel@tonic-gate /*
1397c478bd9Sstevel@tonic-gate * if name is non_null,
1407c478bd9Sstevel@tonic-gate * call gss_import_name() followed by gss_canonicalize_name()
1417c478bd9Sstevel@tonic-gate * to get a mechanism specific name passed back to the caller.
1427c478bd9Sstevel@tonic-gate * If this call fails, return failure to our caller.
1437c478bd9Sstevel@tonic-gate * XXX The cred_handle may contain an array of mechanism OID's
1447c478bd9Sstevel@tonic-gate * but we only return the MN for the first mechanism to the caller.
1457c478bd9Sstevel@tonic-gate * In theory, we should modify this to provide an array of MN's
1467c478bd9Sstevel@tonic-gate * one per mechanism back to the caller.
1477c478bd9Sstevel@tonic-gate */
1487c478bd9Sstevel@tonic-gate
1497c478bd9Sstevel@tonic-gate if (name != NULL) {
150*5e01956fSGlenn Barry if (union_cred->auxinfo.name.length == 0) {
151*5e01956fSGlenn Barry *name = GSS_C_NO_NAME;
152*5e01956fSGlenn Barry } else if ((gss_import_name(minor_status,
1537c478bd9Sstevel@tonic-gate &union_cred->auxinfo.name,
1547c478bd9Sstevel@tonic-gate union_cred->auxinfo.name_type,
1557c478bd9Sstevel@tonic-gate name) != GSS_S_COMPLETE) ||
1567c478bd9Sstevel@tonic-gate (gss_canonicalize_name(minor_status, *name,
1577c478bd9Sstevel@tonic-gate &union_cred->mechs_array[0],
1587c478bd9Sstevel@tonic-gate NULL) != GSS_S_COMPLETE)) {
1597c478bd9Sstevel@tonic-gate status = GSS_S_DEFECTIVE_CREDENTIAL;
1607c478bd9Sstevel@tonic-gate goto error;
1617c478bd9Sstevel@tonic-gate }
1627c478bd9Sstevel@tonic-gate }
1637c478bd9Sstevel@tonic-gate
1647c478bd9Sstevel@tonic-gate /*
1657c478bd9Sstevel@tonic-gate * copy the mechanism set in union_cred into an OID set and return in
1667c478bd9Sstevel@tonic-gate * the mechanisms parameter.
1677c478bd9Sstevel@tonic-gate */
1687c478bd9Sstevel@tonic-gate if (mechanisms != NULL) {
1697c478bd9Sstevel@tonic-gate status = GSS_S_FAILURE;
1707c478bd9Sstevel@tonic-gate *mechanisms = (gss_OID_set) malloc(sizeof (gss_OID_set_desc));
1717c478bd9Sstevel@tonic-gate if (*mechanisms == NULL)
1727c478bd9Sstevel@tonic-gate goto error;
1737c478bd9Sstevel@tonic-gate
1747c478bd9Sstevel@tonic-gate (*mechanisms)->count = 0;
1757c478bd9Sstevel@tonic-gate (*mechanisms)->elements =
1767c478bd9Sstevel@tonic-gate (gss_OID) malloc(sizeof (gss_OID_desc) *
1777c478bd9Sstevel@tonic-gate union_cred->count);
1787c478bd9Sstevel@tonic-gate
1797c478bd9Sstevel@tonic-gate if ((*mechanisms)->elements == NULL) {
1807c478bd9Sstevel@tonic-gate free(*mechanisms);
1817c478bd9Sstevel@tonic-gate *mechanisms = NULL;
1827c478bd9Sstevel@tonic-gate goto error;
1837c478bd9Sstevel@tonic-gate }
1847c478bd9Sstevel@tonic-gate
1857c478bd9Sstevel@tonic-gate for (i = 0; i < union_cred->count; i++) {
1867c478bd9Sstevel@tonic-gate (*mechanisms)->elements[i].elements = (void *)
1877c478bd9Sstevel@tonic-gate malloc(union_cred->mechs_array[i].length);
1887c478bd9Sstevel@tonic-gate if ((*mechanisms)->elements[i].elements == NULL)
1897c478bd9Sstevel@tonic-gate goto error;
1907c478bd9Sstevel@tonic-gate g_OID_copy(&(*mechanisms)->elements[i],
1917c478bd9Sstevel@tonic-gate &union_cred->mechs_array[i]);
1927c478bd9Sstevel@tonic-gate (*mechanisms)->count++;
1937c478bd9Sstevel@tonic-gate }
1947c478bd9Sstevel@tonic-gate }
1957c478bd9Sstevel@tonic-gate
1967c478bd9Sstevel@tonic-gate return (GSS_S_COMPLETE);
1977c478bd9Sstevel@tonic-gate
1987c478bd9Sstevel@tonic-gate error:
1997c478bd9Sstevel@tonic-gate /*
2007c478bd9Sstevel@tonic-gate * cleanup any allocated memory - we can just call
2017c478bd9Sstevel@tonic-gate * gss_release_oid_set, because the set is constructed so that
2027c478bd9Sstevel@tonic-gate * count always references the currently copied number of
2037c478bd9Sstevel@tonic-gate * elements.
2047c478bd9Sstevel@tonic-gate */
2057c478bd9Sstevel@tonic-gate if (mechanisms && *mechanisms != NULL)
2067c478bd9Sstevel@tonic-gate (void) gss_release_oid_set(&temp_minor_status, mechanisms);
2077c478bd9Sstevel@tonic-gate
2087c478bd9Sstevel@tonic-gate if (name && *name != NULL)
2097c478bd9Sstevel@tonic-gate (void) gss_release_name(&temp_minor_status, name);
2107c478bd9Sstevel@tonic-gate
2117c478bd9Sstevel@tonic-gate return (status);
2127c478bd9Sstevel@tonic-gate }
2137c478bd9Sstevel@tonic-gate
2147c478bd9Sstevel@tonic-gate OM_uint32
gss_inquire_cred_by_mech(minor_status,cred_handle,mech_type,name,initiator_lifetime,acceptor_lifetime,cred_usage)2157c478bd9Sstevel@tonic-gate gss_inquire_cred_by_mech(minor_status, cred_handle, mech_type, name,
2167c478bd9Sstevel@tonic-gate initiator_lifetime, acceptor_lifetime, cred_usage)
2177c478bd9Sstevel@tonic-gate OM_uint32 *minor_status;
2187c478bd9Sstevel@tonic-gate const gss_cred_id_t cred_handle;
2197c478bd9Sstevel@tonic-gate const gss_OID mech_type;
2207c478bd9Sstevel@tonic-gate gss_name_t *name;
2217c478bd9Sstevel@tonic-gate OM_uint32 *initiator_lifetime;
2227c478bd9Sstevel@tonic-gate OM_uint32 *acceptor_lifetime;
2237c478bd9Sstevel@tonic-gate gss_cred_usage_t *cred_usage;
2247c478bd9Sstevel@tonic-gate {
2257c478bd9Sstevel@tonic-gate gss_union_cred_t union_cred;
2267c478bd9Sstevel@tonic-gate gss_cred_id_t mech_cred;
2277c478bd9Sstevel@tonic-gate gss_mechanism mech;
2287c478bd9Sstevel@tonic-gate OM_uint32 status, temp_minor_status;
2297c478bd9Sstevel@tonic-gate gss_name_t internal_name;
2307c478bd9Sstevel@tonic-gate
231503a2b89SPeter Shoults if (minor_status != NULL)
232503a2b89SPeter Shoults *minor_status = 0;
233503a2b89SPeter Shoults
234503a2b89SPeter Shoults if (name != NULL)
235503a2b89SPeter Shoults *name = GSS_C_NO_NAME;
236503a2b89SPeter Shoults
237503a2b89SPeter Shoults if (minor_status == NULL)
238503a2b89SPeter Shoults return (GSS_S_CALL_INACCESSIBLE_WRITE);
2397c478bd9Sstevel@tonic-gate
2407c478bd9Sstevel@tonic-gate mech = __gss_get_mechanism(mech_type);
2417c478bd9Sstevel@tonic-gate if (!mech)
2427c478bd9Sstevel@tonic-gate return (GSS_S_BAD_MECH);
2437c478bd9Sstevel@tonic-gate if (!mech->gss_inquire_cred_by_mech)
2447c478bd9Sstevel@tonic-gate return (GSS_S_UNAVAILABLE);
2457c478bd9Sstevel@tonic-gate
2467c478bd9Sstevel@tonic-gate union_cred = (gss_union_cred_t)cred_handle;
2477c478bd9Sstevel@tonic-gate mech_cred = __gss_get_mechanism_cred(union_cred, mech_type);
2487c478bd9Sstevel@tonic-gate if (mech_cred == NULL)
2497c478bd9Sstevel@tonic-gate return (GSS_S_DEFECTIVE_CREDENTIAL);
2507c478bd9Sstevel@tonic-gate
251354d1447Swyllys if (mech->gss_inquire_cred_by_mech != NULL) {
252354d1447Swyllys status = mech->gss_inquire_cred_by_mech(mech->context,
253354d1447Swyllys minor_status,
2547c478bd9Sstevel@tonic-gate mech_cred, mech_type,
2557c478bd9Sstevel@tonic-gate name ? &internal_name : NULL,
2567c478bd9Sstevel@tonic-gate initiator_lifetime,
2577c478bd9Sstevel@tonic-gate acceptor_lifetime, cred_usage);
2587c478bd9Sstevel@tonic-gate
259*5e01956fSGlenn Barry if (status != GSS_S_COMPLETE) {
260*5e01956fSGlenn Barry map_error(minor_status, mech);
2617c478bd9Sstevel@tonic-gate return (status);
262*5e01956fSGlenn Barry }
2637c478bd9Sstevel@tonic-gate
2647c478bd9Sstevel@tonic-gate if (name) {
2657c478bd9Sstevel@tonic-gate /*
2667c478bd9Sstevel@tonic-gate * Convert internal_name into a union_name equivalent.
2677c478bd9Sstevel@tonic-gate */
2687c478bd9Sstevel@tonic-gate status = __gss_convert_name_to_union_name(
2697c478bd9Sstevel@tonic-gate &temp_minor_status, mech,
2707c478bd9Sstevel@tonic-gate internal_name, name);
2717c478bd9Sstevel@tonic-gate if (status != GSS_S_COMPLETE) {
2727c478bd9Sstevel@tonic-gate *minor_status = temp_minor_status;
273*5e01956fSGlenn Barry map_error(minor_status, mech);
2747c478bd9Sstevel@tonic-gate return (status);
2757c478bd9Sstevel@tonic-gate }
2767c478bd9Sstevel@tonic-gate }
277354d1447Swyllys } else {
278354d1447Swyllys return (GSS_S_UNAVAILABLE);
279354d1447Swyllys }
2807c478bd9Sstevel@tonic-gate
2817c478bd9Sstevel@tonic-gate return (GSS_S_COMPLETE);
2827c478bd9Sstevel@tonic-gate }
283