2N/A/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2N/A/*
2N/A * Copyright 2000, 2007 by the Massachusetts Institute of Technology.
2N/A * All Rights Reserved.
2N/A *
2N/A * Export of this software from the United States of America may
2N/A * require a specific license from the United States Government.
2N/A * It is the responsibility of any person or organization contemplating
2N/A * export to obtain such a license before exporting.
2N/A *
2N/A * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
2N/A * distribute this software and its documentation for any purpose and
2N/A * without fee is hereby granted, provided that the above copyright
2N/A * notice appear in all copies and that both that copyright notice and
2N/A * this permission notice appear in supporting documentation, and that
2N/A * the name of M.I.T. not be used in advertising or publicity pertaining
2N/A * to distribution of the software without specific, written prior
2N/A * permission. Furthermore if you modify this software you must label
2N/A * your software as modified software and not distribute it in such a
2N/A * fashion that it might be confused with the original M.I.T. software.
2N/A * M.I.T. makes no representations about the suitability of
2N/A * this software for any purpose. It is provided "as is" without express
2N/A * or implied warranty.
2N/A *
2N/A */
2N/A/*
2N/A * Copyright 1993 by OpenVision Technologies, Inc.
2N/A *
2N/A * Permission to use, copy, modify, distribute, and sell this software
2N/A * and its documentation for any purpose is hereby granted without fee,
2N/A * provided that the above copyright notice appears in all copies and
2N/A * that both that copyright notice and this permission notice appear in
2N/A * supporting documentation, and that the name of OpenVision not be used
2N/A * in advertising or publicity pertaining to distribution of the software
2N/A * without specific, written prior permission. OpenVision makes no
2N/A * representations about the suitability of this software for any
2N/A * purpose. It is provided "as is" without express or implied warranty.
2N/A *
2N/A * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
2N/A * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
2N/A * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
2N/A * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
2N/A * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
2N/A * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
2N/A * PERFORMANCE OF THIS SOFTWARE.
2N/A */
2N/A
2N/A/*
2N/A * Copyright (C) 1998 by the FundsXpress, INC.
2N/A *
2N/A * All rights reserved.
2N/A *
2N/A * Export of this software from the United States of America may require
2N/A * a specific license from the United States Government. It is the
2N/A * responsibility of any person or organization contemplating export to
2N/A * obtain such a license before exporting.
2N/A *
2N/A * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
2N/A * distribute this software and its documentation for any purpose and
2N/A * without fee is hereby granted, provided that the above copyright
2N/A * notice appear in all copies and that both that copyright notice and
2N/A * this permission notice appear in supporting documentation, and that
2N/A * the name of FundsXpress. not be used in advertising or publicity pertaining
2N/A * to distribution of the software without specific, written prior
2N/A * permission. FundsXpress makes no representations about the suitability of
2N/A * this software for any purpose. It is provided "as is" without express
2N/A * or implied warranty.
2N/A *
2N/A * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
2N/A * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
2N/A * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
2N/A */
2N/A
2N/A#include "gssapiP_krb5.h"
2N/A#include "mglueP.h"
2N/A
2N/AOM_uint32
2N/Akrb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
2N/A cred_usage, mechanisms)
2N/A OM_uint32 *minor_status;
2N/A gss_cred_id_t cred_handle;
2N/A gss_name_t *name;
2N/A OM_uint32 *lifetime_ret;
2N/A gss_cred_usage_t *cred_usage;
2N/A gss_OID_set *mechanisms;
2N/A{
2N/A krb5_context context;
2N/A krb5_gss_cred_id_t cred;
2N/A krb5_error_code code;
2N/A krb5_timestamp now;
2N/A krb5_deltat lifetime;
2N/A krb5_gss_name_t ret_name;
2N/A gss_OID_set mechs = NULL;
2N/A OM_uint32 ret;
2N/A
2N/A ret = GSS_S_FAILURE;
2N/A ret_name = NULL;
2N/A
2N/A code = krb5_gss_init_context(&context);
2N/A if (code) {
2N/A *minor_status = code;
2N/A return GSS_S_FAILURE;
2N/A }
2N/A
2N/A if (name) *name = NULL;
2N/A if (mechanisms) *mechanisms = NULL;
2N/A
2N/A /* check for default credential */
2N/A /*SUPPRESS 29*/
2N/A if (cred_handle == GSS_C_NO_CREDENTIAL) {
2N/A OM_uint32 major;
2N/A
2N/A if ((major = kg_get_defcred(minor_status, (gss_cred_id_t *)&cred)) &&
2N/A GSS_ERROR(major)) {
2N/A krb5_free_context(context);
2N/A return(major);
2N/A }
2N/A } else {
2N/A OM_uint32 major;
2N/A
2N/A major = krb5_gss_validate_cred(minor_status, cred_handle);
2N/A if (GSS_ERROR(major)) {
2N/A krb5_free_context(context);
2N/A return(major);
2N/A }
2N/A cred = (krb5_gss_cred_id_t) cred_handle;
2N/A }
2N/A
2N/A if ((code = krb5_timeofday(context, &now))) {
2N/A *minor_status = code;
2N/A ret = GSS_S_FAILURE;
2N/A goto fail;
2N/A }
2N/A
2N/A code = k5_mutex_lock(&cred->lock);
2N/A if (code != 0) {
2N/A *minor_status = code;
2N/A ret = GSS_S_FAILURE;
2N/A goto fail;
2N/A }
2N/A if (cred->tgt_expire > 0) {
2N/A if ((lifetime = cred->tgt_expire - now) < 0)
2N/A lifetime = 0;
2N/A }
2N/A else
2N/A lifetime = GSS_C_INDEFINITE;
2N/A
2N/A if (name) {
2N/A if (cred->name &&
2N/A (code = kg_duplicate_name(context, cred->name,
2N/A KG_INIT_NAME_INTERN, &ret_name))) {
2N/A k5_mutex_unlock(&cred->lock);
2N/A *minor_status = code;
2N/A save_error_info(*minor_status, context);
2N/A ret = GSS_S_FAILURE;
2N/A goto fail;
2N/A }
2N/A }
2N/A
2N/A if (mechanisms) {
2N/A /* Solaris Kerberos */
2N/A if (GSS_ERROR(ret = generic_gss_create_empty_oid_set(minor_status,
2N/A &mechs)) ||
2N/A (cred->prerfc_mech &&
2N/A GSS_ERROR(ret = generic_gss_add_oid_set_member(minor_status,
2N/A (const gss_OID) gss_mech_krb5_old,
2N/A &mechs))) ||
2N/A (cred->rfc_mech &&
2N/A GSS_ERROR(ret = generic_gss_add_oid_set_member(minor_status,
2N/A (const gss_OID) gss_mech_krb5,
2N/A &mechs)))) {
2N/A k5_mutex_unlock(&cred->lock);
2N/A /* Solaris Kerberos */
2N/A if (mechs != NULL) {
2N/A if (mechs->elements != NULL)
2N/A free(mechs->elements);
2N/A free(mechs);
2N/A }
2N/A if (ret_name)
2N/A kg_release_name(context, KG_INIT_NAME_INTERN, &ret_name);
2N/A /* *minor_status set above */
2N/A goto fail;
2N/A }
2N/A }
2N/A
2N/A if (name) {
2N/A if (ret_name != NULL)
2N/A *name = (gss_name_t) ret_name;
2N/A else
2N/A *name = GSS_C_NO_NAME;
2N/A }
2N/A
2N/A if (lifetime_ret)
2N/A *lifetime_ret = lifetime;
2N/A
2N/A if (cred_usage)
2N/A *cred_usage = cred->usage;
2N/A k5_mutex_unlock(&cred->lock);
2N/A
2N/A if (mechanisms)
2N/A *mechanisms = mechs;
2N/A
2N/A if (cred_handle == GSS_C_NO_CREDENTIAL)
2N/A krb5_gss_release_cred(minor_status, (gss_cred_id_t *)&cred);
2N/A
2N/A krb5_free_context(context);
2N/A *minor_status = 0;
2N/A return((lifetime == 0)?GSS_S_CREDENTIALS_EXPIRED:GSS_S_COMPLETE);
2N/Afail:
2N/A if (cred_handle == GSS_C_NO_CREDENTIAL) {
2N/A OM_uint32 tmp_min_stat;
2N/A
2N/A krb5_gss_release_cred(&tmp_min_stat, (gss_cred_id_t *)&cred);
2N/A }
2N/A krb5_free_context(context);
2N/A return ret;
2N/A}
2N/A
2N/A/* V2 interface */
2N/AOM_uint32
2N/Akrb5_gss_inquire_cred_by_mech(minor_status, cred_handle,
2N/A mech_type, name, initiator_lifetime,
2N/A acceptor_lifetime, cred_usage)
2N/A OM_uint32 *minor_status;
2N/A gss_cred_id_t cred_handle;
2N/A gss_OID mech_type;
2N/A gss_name_t *name;
2N/A OM_uint32 *initiator_lifetime;
2N/A OM_uint32 *acceptor_lifetime;
2N/A gss_cred_usage_t *cred_usage;
2N/A{
2N/A krb5_gss_cred_id_t cred;
2N/A OM_uint32 lifetime;
2N/A OM_uint32 mstat;
2N/A
2N/A /*
2N/A * We only know how to handle our own creds.
2N/A */
2N/A if ((mech_type != GSS_C_NULL_OID) &&
2N/A !g_OID_equal(gss_mech_krb5_old, mech_type) &&
2N/A !g_OID_equal(gss_mech_krb5, mech_type)) {
2N/A *minor_status = 0;
2N/A return(GSS_S_NO_CRED);
2N/A }
2N/A
2N/A cred = (krb5_gss_cred_id_t) cred_handle;
2N/A mstat = krb5_gss_inquire_cred(minor_status,
2N/A cred_handle,
2N/A name,
2N/A &lifetime,
2N/A cred_usage,
2N/A (gss_OID_set *) NULL);
2N/A if (mstat == GSS_S_COMPLETE) {
2N/A if (cred &&
2N/A ((cred->usage == GSS_C_INITIATE) ||
2N/A (cred->usage == GSS_C_BOTH)) &&
2N/A initiator_lifetime)
2N/A *initiator_lifetime = lifetime;
2N/A if (cred &&
2N/A ((cred->usage == GSS_C_ACCEPT) ||
2N/A (cred->usage == GSS_C_BOTH)) &&
2N/A acceptor_lifetime)
2N/A *acceptor_lifetime = lifetime;
2N/A }
2N/A return(mstat);
2N/A}