gssapi_krb5.c revision 7c478bd95313f5f23a4c958a745db2134aa03244
/*
* Copyright 2001-2003 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
/*
* Solaris Kerberos: This is identical to MIT Release 1.2.1 except for
* changes to the call kg_get_context to get the context in release and
* getcred. In order to be MT safe, we keep a global variable kg_context
* and do not keep a defcred for default credentials.
*/
/*
* Copyright 1993 by OpenVision Technologies, Inc.
*
* Permission to use, copy, modify, distribute, and sell this software
* and its documentation for any purpose is hereby granted without fee,
* provided that the above copyright notice appears in all copies and
* that both that copyright notice and this permission notice appear in
* supporting documentation, and that the name of OpenVision not be used
* in advertising or publicity pertaining to distribution of the software
* without specific, written prior permission. OpenVision makes no
* representations about the suitability of this software for any
* purpose. It is provided "as is" without express or implied warranty.
*
* OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
* INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
* EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
* CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
* USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
* OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
/*
* Copyright (C) 1998 by the FundsXpress, INC.
*
* All rights reserved.
*
* Export of this software from the United States of America may require
* a specific license from the United States Government. It is the
* responsibility of any person or organization contemplating export to
* obtain such a license before exporting.
*
* WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
* distribute this software and its documentation for any purpose and
* without fee is hereby granted, provided that the above copyright
* notice appear in all copies and that both that copyright notice and
* this permission notice appear in supporting documentation, and that
* the name of FundsXpress. not be used in advertising or publicity pertaining
* to distribution of the software without specific, written prior
* permission. FundsXpress makes no representations about the suitability of
* this software for any purpose. It is provided "as is" without express
* or implied warranty.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
/*
* $Id: gssapi_krb5.c,v 1.18 1999/03/26 03:51:42 tytso Exp $
*/
#include <gssapiP_krb5.h>
#include <k5-int.h>
/*
* Kernel kgssd module debugging aid. The global variable "krb5_log" is a bit
* mask which allows various types of log messages to be printed out.
*
* The log levels are defined in:
*
* Note, KRB5_LOG_LVL can be assigned via the make invocation. See KRB5_DEFS in
* the various Makefiles.
*/
#ifdef KRB5_LOG_LVL
/* set the log level to that specified */
#else
/* default log level */
#endif /* KRB5_LOG_LVL */
/** exported constants defined in gssapi_krb5{,_nx}.h **/
/* these are bogus, but will compile */
/*
* The OID of the draft krb5 mechanism, assigned by IETF, is:
* iso(1) org(3) dod(5) internet(1) security(5)
* kerberosv5(2) = 1.3.5.1.5.2
* The OID of the krb5_user_name type is:
* iso(1) member-body(2) US(840) mit(113554) infosys(1) gssapi(2)
* generic(1) user_name(1) = 1.2.840.113554.1.2.1.1
* The OID of the krb5_name type is:
* iso(1) member-body(2) US(840) mit(113554) infosys(1) gssapi(2)
* krb5(2) krb5_name(1) = 1.2.840.113554.1.2.2.1
* The OID of the krb5_principal type is:
* iso(1) member-body(2) US(840) mit(113554) infosys(1) gssapi(2)
* krb5(2) krb5_principal(2) = 1.2.840.113554.1.2.2.2
* The OID of the proposed standard krb5 mechanism is:
* iso(1) member-body(2) US(840) mit(113554) infosys(1) gssapi(2)
* krb5(2) = 1.2.840.113554.1.2.2
* The OID of the proposed standard krb5 v2 mechanism is:
* iso(1) member-body(2) US(840) mit(113554) infosys(1) gssapi(2)
* krb5v2(3) = 1.2.840.113554.1.2.3
*
*/
/* gss_mech_krb5 = 1.2.840.113554.1.2.2
* gss_mech_krb5_old = 1.3.5.1.5.2
* gss_mech_krb5_v2 = 1.2.840.113554.1.2.3
* gss_nt_krb5_name = 1.2.840.113554.1.2.2.1
* gss_nt_krb5_principal = 1.2.840.113554.1.2.2.2
*/
/*
* Encoding rules: The first two values are encoded in one byte as 40
* * value1 + value2. Subsequent values are encoded base 128, most
* significant digit first, with the high bit (\200) set on all octets
* except the last in each value's encoding.
*/
/* Global lock for krb5 mechanism */
#ifdef _KERNEL
#else
#endif
/* krb5 mechanism oids */
const gss_OID_desc krb5_gss_oid_array[] = {
/* this is the official, rfc-specified OID */
{9, "\052\206\110\206\367\022\001\002\002"},
/* this is the unofficial, wrong OID */
{5, "\053\005\001\005\002"},
/* this is the v2 assigned OID */
{9, "\052\206\110\206\367\022\001\002\003"},
/* these two are name type OID's */
{10, "\052\206\110\206\367\022\001\002\002\001"},
/* XXX this value isn't defined in an RFC */
{10, "\052\206\110\206\367\022\001\002\002\002"},
/*
* Solaris Kerberos: the following element is the GSS_KRB5_NT_USER_NAME OID
* (1.2.840.113554.1.2.1.1, see RFC 1964) which is used for backward
* compatibility with earlier Solaris kerberos releases.
*/
{10, "\052\206\110\206\367\022\001\002\001\001"},
{ 0, 0 }
};
/*
* Solaris Kerberos: gss_nt_krb5_name points to the GSS_KRB5_NT_USER_NAME OID
* for backwards compat with earlier Solaris Kerberos releases. In MIT this
* points to the GSS_KRB5_NT_PRINCIPAL_NAME OID (1.2.840.113554.1.2.2.1).
*/
/*
* XXX gss_nt_krb5_principal points to an OID value that is specific to MIT
* which is not described in any RFC at this point. Be cautious about using
* this.
*/
static const gss_OID_set_desc oidsets[] = {
};
/** default credential support */
/* default credentials */
/*
* Solaris Kerberos:
* We no longer store the defcred in a global variable since this will
* prevent us from assuming different user ids by gss daemon.
* This also makes gss_release_defcred a no-op.
*/
#if 0
#endif
/* XXX what happens when the default credentials expire or are invalidated? */
#ifndef _KERNEL
/* Note, the krb5_mutex lock must be held prior to calling this function */
{
"minor_status=%d\n", *minor_status);
return GSS_S_FAILURE;
}
return(major);
}
*minor_status = 0;
return(GSS_S_COMPLETE);
}
{
*minor_status = 0;
return(GSS_S_COMPLETE);
}
{
/*
* Solaris Kerberos: the following is a global variable declared
* above and initialized here below
*/
/* static krb5_context kg_context = NULL; */
if (!kg_context) {
goto fail;
goto fail;
goto fail;
goto fail;
goto fail;
goto fail;
goto fail;
}
*context = kg_context;
*minor_status = 0;
return GSS_S_COMPLETE;
fail:
return GSS_S_FAILURE;
}
#endif